Support Forum

We would like to enable and define the SLA Targets option in 'Performance SLA' section of the SD-WAN configuration in Fortinet console. We are having Fortinet version 7.2.11 as part of FortiGate device.In our environment, most of the traffic is normal internet browsing , emails and net searches. We do have around 2-3% of traffic to our WFH Windows Servers. We use Microsoft Teams ( free) version for internal communications, which is not self hosted. Further, there is no 'business critical' application such as VOIP or such real-time traffic. We don't have VPN or Proxy network.Therefore, considering the above factors in mind, we would like to know whether these Latency threshold, Jitter threshold and Packet-Loss threshold mentioned below would be okay for our use cases  ( 250 ms,  55 ms and 1% ) ?  These values were taken from 'Defining WAN performance SLA' section of the official document found here.  As per online searches, the recommended values lie b

does sdwan steer the traffic by modify the static route? If yes why i can't see static route created by sdwan rule when execute command 'get router info routing-table static'?

Hi! Recently the new FortiOS 7.6 was released, so being an enthousiast I upgraded a new F40 straight out of the box.After the update the devices booted but I could not reach it by it's default IP.Booting the device via console, I got error messages about interfaces en the configuration. A few of these messages are:Initialize config error 44010The config file may contain errors.Please see details by the command 'diagnose debug config-error-log read'. The initial boot gives strange characters until it shows "system is starting" and after that everything is perfectly readable.After the device booted I am unable to type anything in de commandline.So, after this line it is stuck: Please see details by the command 'diagnose debug config-error-log read'. I also tried different serial configuration (baud rate etc.). But that doesn't do the trick.During boot I'm able to press a key but all the characters are gibberish, so a flash format is a challenge.  I

Problema:En FortiClient VPN, al iniciar sesión con SAML Authentication, aparecen usuarios antiguos en el formulario de login, sigue estos pasos para borrarlos.Solución:1. Abrir la consola de FortiClient 2. Hacer clic en el ícono de Configuración (⚙ )3. En la sección Avanzado, pulsar [Clear Cookies]4. Reiniciar el login → el formulario se muestra limpio y sin el usuario incorrecto

I have an Remote Desktop Services (RDS) Gateway service running on port 443. I am trying to implement IPS rules on FortiOS 7.4.8 that block unsuccessful attempts at logging in. I can see in the HTTP/IIS logs that a 403 unauthenticated code is given when users enter an incorrect password. I tried leveraging the HTTP.Authentication.Brute.Force policy and configuring it with a threshold of 3 for a duration of 60 seconds but that did not seem to work. I then proceeded to create a custom rule (below), however it yielded the same results. F-SBID( --attack_id 1870; --name \"HTTP.401.Unauthorized.Multiple\"; --service HTTP; --protocol TCP; --pattern \"401 Unauthorized\"; ) Does anyone know how to configure the IPS to detect unsuccessful login attempts against an RDS GW server? FortiGate 

We are using the Fortigate 200F running FortiOS v7.4.8 build2795 in front of our web hosting stack.  I want to block these AI training bots because they are not respecting robots.txt and using too much bandwidth.  I was thinking of using using a custom Application Signature to filter by the user-agent like "ClaudeBot" for example and then create a custom Application Control to block those requests.  I found a similar example but could not get it to work.  Below is the Application Signature I am using, any help would be much appreciated.   F-SBID( --attack_id 9003; --name "ClaudeBot.Simple.Block"; --protocol tcp; --flow from_client; --seq =,1,relative; --data_size <0x500; --pattern "ClaudeBot/1.0|0d 0a|"; --context packet; --distance 0,context; --weight 20; --app_cat 28; )

Hello Everyone, I am having forticloud with free license. Earlier i was using old forticloud account and i would like to use new account so i changed email in the old account and given that email in the fortigate, as soon as i commit that change all logs in forticloud got deleted.Kindly let me know how i can achive this requirement 

Anyone know are we able to query the SDWAN SLA performance to geeting information about jitter, packet loss and latency using CLI, SNMP or any other way?I have requirement to insert the SLA performance to the SQL database so I can make custom report for specific SLA performance.If we see in the SDWAN performance SLAs there are graph but is limited only to 10 minutes time window and i need more longer.

Hello,I need help configuring VLANs and DHCP for my clinic Wi-Fi setup. Here’s my setup and the issue I am facing:Setup / Concept:Goal: Segregate Wi-Fi into 3 SSIDs:Corp → VLAN11 → Internal network (192.168.11.0/24)Employees → VLAN20 → Separate subnet (192.168.20.0/24)Guest → VLAN30 → Separate subnet (192.168.30.0/24) with captive portalFirewall: FortiGate 30E Firmware v6.2.15 build1378Acts as DHCP server for all VLANs.firewall Port lan2 used as uplink to my managed switch.VLAN sub-interfaces on lan2:lan2.11 → VLAN ID 11 → IP = 0.0.0.0 (since lan1 is already 192.168.11.1)lan2.20 → VLAN ID 20 → IP = 192.168.20.1/24, DHCP enabledlan2.30 → VLAN ID 30 → IP = 192.168.30.1/24, DHCP enabledSwitch: D-Link DGS-1210-10P (Managed PoE)Port 8 = Uplink to FortiGate lan2 (untagged VLAN11,tagged VLAN 20 & 30)Switch management IP = 192.168.11.7Ports 1,2,3 = For UniFi U7-Pro APs (untagged VLAN11, tagged VLAN20 + 30)Controller: UniFi virtual controller at 192.168.11.50 (inside VLAN11)APs: 3× Uni

I am trying to upgrade the firmware of a 108F-POE switch from 7.0.5 to 7.4.8. In Fortigate interface, I can upload the firmware image, but the upgrade process does not start. Any idea what might be wrong? I tried other firmware versions as well (e.g 7.2) but no success 

Hello everyone, I am publishing this post because I would like to know if any of you have updated a FortiGate with several VDOMs in use in version 7.0.17 to 7.4.9 or 7.4.x, if anyone has done so and if they had any incompatibility problems, specifically if they have done so with any 81F or 2601F model, I would appreciate your positive comments.

I recently purchased a Fortigate 50G, and the firmware on the device is v7.0.17 build7598 (Mature). I see possibility of upgrading beyond 7.0.17 but it doesn't see to be possible through the GUI. Also when I check the Firmware images available in Support section of Forticloud I don't find any firmware for 50G, I find them only for 50G-5G.Any info how I can upgrade?   

Hi Newbie Question here I am new to Fortinet as our company just changed over from Cisco for our 300 stores. One thing i have noticed is that when im logged into FortiGate for a particular store and I've changed an IP for a device, the new IP is not showing up changed in the ports section.  How do i make it "refresh" the IP's without having to reboot the FortiGate and taking a store down.     

Hi all, In FMG, when I click on the policy block tab and then select the " where used option, a new page appears that includes a list of policy packages where this policy block is used. I'm wondering what the entry column refers to?   

I am preparing for my Fortinet NSE 6 - FortiAnalyzer 7.2 Administrator NSE6_FAZ-7.2 exam and i am seeking the best exam preparation resource. Could some recommend me NSE6_FAZ-7.2 practice test?

We are experiencing an issue where BYOT devices ( eg; Android ,IOS), excluding computers/laptops, are frequently marked with an "Invalid physical address" status. This issue appears to have started after upgrading to version 7.6.*. In version 7.4, this problem did not occur.To temporarily resolve the issue, I’ve been manually adding the MAC addresses of the affected devices to the NAC OUI settings. However, this is not a feasible long-term solution given the number of devices on the network.I have already executed the scheduler, but it did not resolve the issue.Request:Can you confirm if this is a known bug in version 7.6.*?Is there an alternative or automated method to resolve or work around this issue?Environment Details:Affected version: 7.6.*Previously working version: 7.4Device types: BYOT devices (excluding computers/laptops)Current workaround: Manual MAC address entry in NAC OUI settingsScheduler: Already executed, no resolutionPlease advise on how to proceed or if a patch/fix i

Hello,we have a case, that one of the clients wants to catch all the messages which subject starts with "Hey" and to quarantine them.I tryed to implement a content profile and there use a Dictionary profile where i check Regex content, but this didn't work. Any idea / experience? BrMarko

Hello,one of our customers will like to know if is possible to setup FortiMail FortiSandbox configuration so, that it will not prepend "[Scan Notification] Attachments are held for scanning" text to body and subject, when the message will be processed in the fortimail sandbox for a long time? ThanksMarko

Hello Guys, We got a new Customer who currently works with a Sophos Firewall.Since we usually work with FortiGate we got a new FortiGate for them and normally we set this up by hand.But we would need the exact same Firewall Rules etc for this Customer (atleast for now, this might change in the future but this is a good place to start). Since I think there might be a easier way to export existing Firewall rules etc. to a new Firewall I thought I might as well ask. I know that the other way around there would be a Forti Product for that. Do any of you know if there is a easy (and preferrably) way to do this?Thank you for your help already :)

 Hello, I've been searching for a solution on our Fortigate 80F. I need to route SSL traffic to different servers based on the FQDN but also including the targeted web service/page. This is for an ArcGIS deployment. I've found how to accomplish this with the FQDN alone, but not with the /page. For example: https://server1/un  gets routed to server3:6443andhttps://server2/ent  gets routed to server4:6443 My knowledge is limited here, so hopefully I'm describing this in a way you'll understand, haha! Thanks! 

I have this case with FortiMail 7.4.5 VM FortiMail has the following configuration for sending quarantine report config antispam quarantine-reportset schedule-hours 7 8 9 10 11 12 13 16set schedule-days monday tuesday wednesday thursday friday saturdayset web-release-hostname aaaa.bbbb.comset web-release-unauth-expiry 72end However, it only sends all reports at 09:00, despite new spam emails arriving at different times.For example: a user received spam yesterday at 18:40. That email should have been included in today’s 07:00 report, but the report was never sent. Another user received a spam email today at 09:15. It should have been included in the 10:00 report, but no new reports were sent after today at 09:00. I tried running "execute reload cronserviced", but there was no change.  

Hi everyone,Is it possible to tell FortiPAM that users can only connect to WebRDP if they have the extension installed? Because now they can't even connect clientless.Thanks

Hi everyone, I have a strange issue that I can't figure out.  We have a Fortigate 100F and want to use the X1 port as a WAN port with the new leased line that’s been installed. The leased line presents with an Adva FSP 150-GE102Pro which connects through SFP.  I purchased 2 AddOn Fortinet FN-TRAN-SX Compatible Transceivers and tested them with the Adva and a media converter and they immediately connected up. I then tested in the Fortigate X1 port and got nothing. I manually updated the X1 port to be speed 1000 Full duplex and then the Fortigate said the connection was up but the red light on the Adva remained. It looks like the Fortigate can send but not receive. The port has been removed from the Fortilink group and is set to WAN with the correct IP address, subnet and gateway. I've tested these with a laptop through the media converter and it all works fine. It seems to be a connection issue between the Adva and the Fortigate Any ideas?

hey all first off, my english is not great, so if anything is confusing, please let me know okay, i have remote sites under my control connected to my main site via multiple VPN tunnels, one for each physical WAN interface IP in these remote sites, some have only have internet access via the main tunnel and some also have another ppoe connection on wan2 via some other local isp, some have sd-wan configured, but in all of them, for some reason, i can't ping from wan interfaces to outside when i try, it either gives me : remote-site1 # exe ping 8.8.8.8PING 8.8.8.8 (8.8.8.8): 56 data bytes--- 8.8.8.8 ping statistics ---5 packets transmitted, 0 packets received, 100% packet loss or when directly specifying the interface: remote-site1 # exe ping 8.8.8.8PING 8.8.8.8 (8.8.8.8): 56 data bytessendto failed: 101(Network is unreachable)sendto failed: 101(Network is unreachable)sendto failed: 101(Network is unreachable)sendto failed: 101(Network is unreachab

are there any plans to change current eval lic restrictions ? i used to have ADVPN/SDWAN lab with 6.4 Version, and eval restrictions there were just fine, after 2 weeks expiration i could backup configs and restore them in new lab, and i cloud test almost every  sdwan scenario. new eval license (7.2.1->) has some pretty stupid restrictions    3int, 3routes and 3policies  ? polcies are not that big of a deal (at least for me), i can do any any allow, but with route and especially interface restrictions i am struggling to set up the proper lab. for example in advpn test with 2 ISP and Lan. i already use 3 Interfaces, wan1 , wan2 and lan, then i at least need two additional tunnel interfaces, which can be created but after restart they are gone. i also need remote access to machines so i have to use lan interface for that, instead of creating dedicated management interface, which is kind of messing up routing in my physical network. and for scena