Support Forum

 Dear Fortinet Support, We are currently using FortiGate Cloud to manage firmware upgrades for our FortiGate 60F device.To avoid conflicts, we have explicitly disabled the automatic firmware upgrade on the device itself using the following CLI command: config system fortiguard set auto-firmware-upgrade disableendInstead, we have enabled automatic firmware upgrade through FortiGate Cloud by applying a firmware profile with the following settings: ・auto-firmware-upgrade-delay 3・auto-firmware-upgrade-start-hour 1・auto-firmware-upgrade-end-hour 4 ・Additionally, the central management configuration on the device is as follows: config system central-management　set mode normal　set type fortiguard　set allow-push-configuration enable　set allow-push-firmware enable　set allow-remote-firmware-upgrade enable　set fmg-update-port 8890　set enc-algorithm highendDespite this configuration, the automatic firmware upgrade has not been triggered.Our device is current

I've noticed that Devices what Device Inventory shows (in the Web Interface you can go Users & Devices > Device Inventory) aren't being updated, I can see old IPs for some devices in there. Is there some way to force the update of this view? Is this like a cache?  Thank you all. 

Hi, I am a beginner who just started my journey with Fortigate.  I am using Cisco ASA which is configured with remote access SSL VPN and users connect to VPN through Cisco AnyConnect client. I am implementing FortiGate in the lab environment. I want to find out if it is possible to use Cisco AnyConnect client with FortiGate in SSL VPN? If you happen to know any documentation or video tutorial related to configuration please share.

Is there a timeline when the SAML issue for SSLVPN on Forticlient 7.4.4 will be resolved?  When I try to login the SSLVPN auth fails.  Have to downgrade to 7.4.3 for it to work again. 

Hi All,I am using Windows DNS servers and I initially had it setup to use Google as the external forwarders.Since all my devices are set to send traffic through my Fortigate, and I had DNS security profile on my firewall policies, I thought that was fine. However, I recently read a post that said that the Windows DNS server should be set to use the Fortigate as the external forwarding destination, and that the Fortigate should have interface configured under Network > DNS Servers, and then forward to system DNS in order for DNS filtering to work.  Which of these is correct, or best practice? Thanks.   

Hi FWB/FAC adminsFWB 7.4.9FAC 6.4.10I configured SCEP on FAC and my FGT works well with it.However my FWB doesn't I get this error when I try to generate CSR: "pkcs7 unwrap error" (screenshot).FAC says the request was properly received and we can see in Pending status in Enrollment Requests.FWB doesn't keep the new key following the issue.   Any idea?

Obviously local passwords are encrypted. If you were to copy the config from one model Fortigate I would assume a different model Foritgate won't like those encrypted passwords?Is it the case that you would have to redo all local username/passwords on the new Fortigate? How does Fortinet do it when upgrading Fortigates with their conversion service?thanks!

Hello.Two weeks ago we upgraded from 7.0.13, following the upgrade path, to 7.4.6 (HV).After this, we've got several problems.1. Often the connection to the manager was lost. Reconnect after several seconds.2. Sometimes modyfications on the policies werde successful, but on installation there were no changes found.    A retry fixed it on most times. I view the modifications first. There were well.3. Sometimes no success was shown. The modifications were done, but the dialog didn't show this..4. We had some modifications, were an error message . I don't know the exactly text, but something with meta_data on the end. Our Fortigate are 600E with VDOMs and 40F.For testing we changed we used Chrome and Firefox instead of Edge. No changes.Before upgrading we ran the recommended diagnose tasks sucessfully.Afer the upgrade to 7.4.6, again. All was well.The firewall logs don't show any deny messages. Does someone these issues here? Thanks in advance for your answers.&nb

I have the following problem:The configuration was exported using a Read-only user account, so Super Admins are not visible, and I cannot log in as a Super Admin.Since I can’t log in with a Super Admin account, I’m unable to make any configuration changes.Is there any chance or option to either log in, create a Super Admin, or change this user to a Super Admin?Or is the only option to reset the device and restore the configuration file?Please help us with this issue — we can’t log in or make any changes. #FortiGate 

Hi I manage a larg group of remote workers and since the adoption of the ipsec from ssl vpn our ticketing system is on fire. Everyone complains about speed, slow , drops from rdp...etc... I am using an intermediary fortios 7.4.6 before I go to 7.6.4 but now I'm starting to regret.  Anyone gone thru the same issue ? I have an active ticket with fortinet but wonder if any of you can share a fix if you  had same experience.  I haven changed yet the tsp-mss and mtu setting as I am waiting to hear back from fortinet support. I am using latest version of forticlient not ems ... Tx 

Hello everyone,I’m planning to replace my current Vigor 3220 router with a FortiGate 100F as the main firewall and router for my network. Current Network TopologyCore Switches: 2 × Dell S4112F (OS10), N160-N161 configured as a VLT pair.Access: Dell N1148T Switches N162-N165 connected via trunk ports to Core Switch.Old Router: Vigor 3220 (172.16.16.221) Connected via 1Gbit Link to Dell N1148T -N162 Switch port52. SVLANs: 1 (Mgmt), 110 (Servers), 120 (Users), 140 (WiFi), 510 (Staging Server), 520 (Staging Users).FortiGate 100F (test LAN 172.16.16.222 :( connected to Dell N1148T-N162 on port 51 (trunk)Currently, all inter-VLAN communication happens at the Core Switch level (the Dell S4112F pair). Each VLAN has its own SVI and VRRP configuration on the cores.  Fortigate Test Network At the moment, I created two testing VLANs (510, 520) and added static routes on the core switches so that those VLANs go through the FortiGate: ip route 0.0.0.0/0 172.16.16.221ip route 10.5

Hi, we need to config remote-access ipsec vpn on fortigate. can configure using a floating public IP address?the routing for this floating IP is configured properly, should be routed to the firewall via internet and local internet router. Can someone please advise? thanks in advance! 

I have about 150 computers that are very rarely directly connected to the internal network and connect to the central office via VPN.I am implementing ZTNA connections instead of VPN. Is there a way for a client computer to retrieve GPO policies from AD through ZTNA? When I was using VPN, this problem did not exist.I managed to solve SMB login by installing KDCPROXY, but I don't know how to handle GPO refresh?I use Forticlient EMS 7.2.x

Hi All,I'm working on a business continuity project.My goal is to have a 2nd datacenter where I replicate the Virtual Machines. I'm trying to find the best solution for the network.AS IS:Right now all the buildings and department are connected to the HQ1.The datacenter is in HQ1.DPT-1 is phisically located next to HQ1.DPT-2 is phisically located next to HQ2.Building-3 is phisically separated from HQ1 and HQ1.All the routing is done by Fortigate cluster in HQ1HQ2 at the moment has only a switch that connect that part of the network to HQ1 where the datacenter is located. The link is with a single private fiber link that pass under a street.All the vlan are spreaded across the network and divided by function not by department (es client vlan, server vlan etc) TO BE:I have to avoid interruption caused by fiber issues. We'll replace the current fortigates in HQ-1 with a cluster of 121G.We'll add a cluster of 121G in HQ2.We'll add a new ISP link in HQ2.We can add radio link f

My request : Configuration convert Fortigate 100E to 70FI use this site.https://service.forticonverter.com/https://convert.fortinet.com/forticonverter/index.html"3 Interface Mapping " > "Hardware Switch" I can't click next step because it has 'Unmapped interface' .'Hardware switch' has two space , but three options .Please help me avoid it . 

I plugged my new 50G in before going away for a week. Everything seemed fine in the 24 hours prior to me leaving. When I got back, it seems there are issues, and I notice about 12 hours ago, I was upgraded to 7.4.9 from 7.4.8. It's like there is an MTU mismatch, but I have my WAN set to DHCP and it's auto selected 1500, so I think that looks fine.Are there any other issues that might cause packet loss or intermittent internet issues, esp on wireless devices (connected to the Fortigate by TPLINK AP's).Sorry, it's a bit vague, this is definitely new behaviour since either the switch to the 50G from my 60F (brand new install) or since the deployment of 7.4.9 by Fortinet.TIA for any ideas.

Hey, I customized the pages and save it but it hasn't been affected. I still see the default pages when I get blocked messages. Do I need to do anything else?

We currently have two sites, Site A and Site B, with identical destinations defined over separate VPN tunnels. Each site has a separate SNAT range using different IP addresses, so they know which location/route to send traffic back to. Both of our firewalls are setup as Central SNAT, and they are running 7.4.6. We're about to implement a new solution that requires us to change the destination IP range at Site B, so that the new system can check each path for dropped packets, latency, etc., and then it will send the traffic over the best path. For example, our internal host 192.168.1.1 currently sends to VendorA host 192.168.2.55. Traffic to VendorA is advertised exactly the same to both of our sites, but SiteA is the preferred site. SiteB will only be used if SiteA goes down. This won't work with the new system. What we need to do is to keep the destination for VendorA going out SiteA as 192.168.2.55, but we need to change the VendorA subnet going out SiteB as 192.168.3.55. I

I'm on the verge of buying the FortiToken 410, but it comes in a 5-pack and I'm running a one-man show network. Can I use the FortiToken for authentication on other platforms—like my email account, web hosting provider, or password manager? Your answer is very much appreciated :) Thanks in advance <3

We have just upgraded our 100F from 7.0.17 to 7.4.9 with 7.0 going end of support.It upgraded to 7.2 and then to 7.4 Everything seems to work fine with the exception of FortiAnalyzer Cloud. It's refusing to connect and send logs. We did upgrade the FAZ from 7.4 to 7.6.4 however it hasn't seemed to make any difference and both versions seem to support our Fortigate version. I have also removed the device and re-added it to FA Cloud still with no luck.  There's no access issues that I know of # exec ping fortianalyzer.forticloud.comPING fortianalyzer.forticloud.com.geo.fortinet.net (154.52.2.161): 56 data bytes64 bytes from 154.52.2.161: icmp_seq=0 ttl=52 time=20.6 ms64 bytes from 154.52.2.161: icmp_seq=1 ttl=52 time=20.5 ms64 bytes from 154.52.2.161: icmp_seq=2 ttl=52 time=20.5 ms64 bytes from 154.52.2.161: icmp_seq=3 ttl=52 time=20.5 ms64 bytes from 154.52.2.161: icmp_seq=4 ttl=52 time=20.5 ms--- fortianalyzer.forticloud.com.geo.fortinet.net ping statistics ---5 pac

Hello, i got an issue with user's licence on my ems, I should have one license for each user but for some of them I have, for example, "licensed 2 verified 1" and also if I go in the unverified user section I cannot find the same user between them. I'll attach some pictures for better understanding.Thank You

Hi, I have been trying to access the training portal for some hours. I tried login with master account, did not work, sub-user, did not work. I even created different account. I am using my own FortiCloud account. By the way this worked yesterday. Anyone else experiencing this issue?Thanks in advance 

Title - self explanatory.  

I have two VDOMs (excluding root / global). 1 is called VDOM_TP which is the VDOM configured in transparent mode and the other is VDOM_ROUTER. For this case I will not be referring to VDOM_ROUTED. I have an SNMP server which needs to receive SNMP traffic from my firewall. I have added the same management IP which I configured when making my firewall transparent.I am able to use the same management ip for https and ssh and although I have enabled snmp on the same interface as https and ssh, I am not able to get snmp traffic. I have tried using nmap and found that port 161 is  block. So this is not an issue of snmp community/user. I saw a fix but it was applicable to V7.6+ so I was wondering if there's a fix for this specific version?  

I am wanting to change the hostname of our fortigates so they are more self explanitory. However we have a NPS server running and the NAS identifier is set to the present hostname of the fortigate.Is it possible to change the fortigate hostname and then also the NAS identifier on the NPS server? Will this impact anything else? Such as certs of other EAP settings? We are using EAP TLS with cert. for authentication.Also how would you do this for two fortigates with two different hostnames? Can you add a second NAS identifier in NPS under EAP TLS properties and Connection request policies?Thank you