Support Forum

Hello Fortinet Community,I am currently managing a FortiSwitch 148F-FPOE running firmware version 7.6.1. Each port on the switch is configured with two VLANs: one for data and one for voice.I would like to enable port security similar to Cisco, so that if someone connects a different PC to a port, it will be blocked or restricted.Could someone provide guidance or configuration examples for enabling port security in this scenario on a FortiSwitch?Thank you in advance for your help

Hi all I’m looking to adjust the priority of IKE routes, which according to CLI guidance should be a command under ipsec phase1-interface, set priority x.But the command/option doesn’t seem to exist. This is an advpn / bgp on loopback configuration on the spoke side. Im looking to amend the priority of IKE routes for the hub loopback when learned over a cellular overlay to avoid BGP establishing in that direction.I’m assuming another command is required as a pre req but my brain is drawing a blank on this one.Any help much appreciated.Thanks

Hello Fortimanager admins,  I’ve encountered an unusual issue and would like your feedback. After connecting my FortiManager (v7.4.7) to a preconfigured FortiGate (v7.4.8), the firewall’s configuration was lost. The networking configuration (such as interfaces) remained intact, but all other settings disappeared.The only action I performed was importing the firewall’s configuration into FortiManager as usual.Has anyone experienced this behavior or knows why it might happen? Thanks in advance,

Hi, I dont know what to do, I have problems creating a SASE Interface with the Internet Access lines I would like to use for the balancing. This comes all from older configuration and we added other lines after some time. Right now I have in SD WAN the following entries:Virtual-wan-link> WAN1> WAN3upg-zone-port9> WAN Port 9SASE> WAN2> WAN4 I am not able to delete or get the WAN Port 9 into the SASE. I dont know how to do that and I dont find information. I think if I add WAN 9 in the SASE I could use SASE in the outgoing Interface for WWW Policies. The problem is that in Policies I cant change to Interface Pair View because I have in some polcies SASE + upg-zone 9 as outgoing interface and I need this one also. Any suggestions? Thanks!

Hello All,On a Fortigate 40F via the command "diagnose npu np6xlite dce", i can see the counter STAT_EHP1_INCR_FRAG increasing. FGT40F (global) $ diagnose npu np6xlite dceSTAT_EHP1_INCR_FRAG:0000000000000147[a7]FGT40F (global) $ diagnose npu np6xlite dceSTAT_EHP1_INCR_FRAG:0000000000000004[a7]FGT40F (global) $ diagnose npu np6xlite dceSTAT_EHP1_INCR_FRAG:0000000000000003[a7]FGT40F (global) $ diagnose npu np6xlite dceSTAT_EHP1_INCR_FRAG:0000000000000001[a7]FGT40F (global) $ Someone know what this counter means ? 

Hi,When connecting to a FortiGate via IPsec VPN that is configured with email OTP, it is expected behavior that the local PC loses internet connectivity until the OTP is provided and the VPN completes the authentication process. This security feature is intended to ensure that while the VPN session is being established and before user authentication is fully completed, only the essential VPN traffic is permitted and all other communication is blocked on the client device.Now i am looking for a solution to override this to allow Internet Access for OTP Retrieval so that at least it can be taken from email.ThanksRohit k

Hi all,I am trying to work out how to change the fortigate reports to show Display Name instead of CN.in our environment the users cn is a student number and their display name is their actual name.I am trying to change this as we use fastvue for fortigate and it cannot generate reports correctly now.No matter what i set the CNID to it still only shows the cn regardless of FSSO restarts ect.Any help would be much appreciated.

Hi all Some background before start, due to SSLVPN will be retired after upgrade to 7.6.3 or higher, so our Hong Kong Office still keep to 7.6.2 and try to setup IPsec dialup VPN but no luck, it is very unstable and always cannot reloved internal DNS, so we use our China office fortigate upgrade to 7.6.4 and test the IPsec VPN.So far it is stable, can access internal LAN perfectly, can reloved DNS and also can access other site-to-site VPN Huawei Cloud LAN, but still have few more thing not working.China Fortigate ver: 7.6.4Hong Kong Fortigate ver: 7.6.2Client VPN ver: 7.4.3.1790 (download from forti website)Below is now facing issue:1. Some user cannot access internet after connected VPN, but I am fine with my home PC with my mobile network and home wifi. They also using home wifi, will asking them to try moble network tonight. But our forti client is same ver and setting.2. Cannot access Hong Kong Office LAN. Already create a policy allow IPsec to HK Office and seems it hav

Dear colleagues, I am looking for an article or advice on how to redistribute only OSPF routes to a single BGP neighbor, without including connected or static routes. We are using a FortiGate device where all routes—connected, static, and OSPF—are currently being redistributed to all BGP neighbors, which is the intended behavior. No filters are in place, as all routes should be advertised. However, we have recently added another BGP neighbor where we want to redistribute only OSPF routes. I have not been able to find a clear way to achieve this. I know it is possible to add a filter, but it seems that I would need to manually include all OSPF networks, which I would prefer to avoid for future scalability and maintenance. Has anyone encountered a similar requirement and could point me in the right direction? Many thanks in advanced and best regards,Joerg

HI! Does anybody know if exist the possibility of configuring and controlling central SNAT using the destination port? I mean, could you make the firewall SNAT HTTPS traffic and not SSH traffic, for example? I think that it is not possible, in the version I am using, 6.0.13, but I would like to check if it is as I expect. Thanks for support!

I have HUB and SPOKE ADVPN topology, shortcut tunnels are working fine but direct BGP peering between spoke is not established and only spoke to HUB bgp is working, i have configured neighbour groups/range at both HUB and SPOKES. kindly suggest the solution.

I have set up Fortigate 7.2.3 trial QEMU VM in GNS3.How am I supposed to to evaluate the product if I can't even create a VLAN interface? There are 3 physical interfaces and 1 fortlink (802.3ad Aggregate). Error message:Maximum number of entries has been reached.Object set operator error, -4 discard the setting.

Hi teamsI am using a FortiGate firewall with stateful inspection enabled, and we'd like to understand the packet processing logic for return traffic.Could you please share any information you have on this?Specifically, I am looking for an explanation of return traffic similar to the one provided in the following URL: https://docs.fortinet.com/document/fortigate/6.0.0/parallel-path-processing-life-of-a-packet/478386/packet-flow-ingress-and-egress-fortigates-without-network-processor-offloadingI am currently considering whether to address return traffic by adding a policy route or by adding a less-preferred static route. Our main question is whether the routing table is consulted at all for stateful return traffic.Thank you Kenji

Can we disable the prompt which asks for access read-only, read write access after we login into FortiGate.

 Hi in a scenario,Can i do multiple ports forwarding for traffic coming on a single ip to multiple servers behind fortiweb??

Recently we bought the latest Microsoft Surface Pro with Snapdragon processor, tried installing Windows FortiClient 7.4.1 which reaches 100% & rolls back with installation failure message. Tried with Microsoft App store FortiClient & configured with Windows native VPN & got error "ProSSLVPN Error: code=-30008000(v1.0.1041)". Can any Forti Gurus help ?? Thanks & RegardsMurali S L

I have 2 Active directory servers at 2 different locations my Forti-authenticator sync with this AD using LDAPs where i have imported certificate extracted from AD however need to confirm as my both AD sync but are in different location an my authenticator is also in these 2 different location so should i extract the certificate from both AD 

Hi, we are using FortiClient as VPN but we are experiencing problems to access Factorial Website. To try to solve this problem I have set two URL Filters which is located in Configuration > Security.But unfortunately this is not working either. Any solution for this?Thanks in advance.

I would like to report a bug I have encountered with FortiClient. Here are the details:When I open the FortiClient Console, the window appears but often disappears within a few seconds.If I create a VPN connection named 0000 with the Client Certificate set to None, the FortiClient Console remains open and does not disappear.However, if I create a VPN connection with the Client Certificate set to any value other than None and select it from the dropdown list in the FortiClient Console, the console often disappears within a few seconds.Additionally, I have checked the Windows Event Viewer, but there were no logs at the relevant times in either the Windows Logs\Application or System sections. I also set the Log Level to Debug in the FortiClient Console and exported the logs after reproducing the issue, but there were no logs at the relevant times.Furthermore, I found that deleting certificates issued by DO_NOT_TRUST_FiddlerRoot in the certmgr.msc (Certificates - Current User > Personal

Hi, yesterday a Firewall Policy was accidentally deleted on Fortinet (v7.0.11). In Log Events I only see "Delete firewall.policy 37". How and where can I see what the policy did so that I can recreate it?Thanks.

In a multi-VDOM setup (91G @7.4.8) I have connected routes in several VDOMs, iBGP between VDOMs, one VDOM as RR. For root VDOM I have the route 192.168.0.0/24 (VLAN on a LAG), and the physical port is up. I can even ping it. But it does not show up in the routing table - and thus is not advertised to it's peers nor the RR. Any pointers here? It's not in the routing-table database. I see the connected routes of the other VDOMs via BGP. FG1 (root) # execute ping 192.168.0.1PING 192.168.0.1 (192.168.0.1): 56 data bytes64 bytes from 192.168.0.1: icmp_seq=0 ttl=255 time=0.0 ms--- 192.168.0.1 ping statistics ---1 packets transmitted, 1 packets received, 0% packet lossround-trip min/avg/max = 0.0/0.0/0.0 msFG1 (root) # get router info routing-table connected | grep 192DS1 (root) # get router info routing-table details 192.168.0.0/24% Network not in table  

Hello all, I'm a newbie here as well as a newbie to FortiGate FG_80F Firewalls I have two questions Regarding opening two port in my firewall. First, I want to say that I tried to follow a doc from support How to open a port. The problem is I do not have an IPV4 policy on my firewall so I can't continue with the article from support. 1) I need traffic to pass through Port TCP and UDP 5080 and 5081. How do I configure the Firewall Policy to allow through these ports?2) And how do I configure nat to consistent nat? And need to make sure SIP and ALG is disabled.  I would appreciate any help I can get. Thank youChris

Hi,We have 2 fortigates in different locations and each of them include SPA license, in a addition to a FortiSASE subscription.To maintain policy consistency for remote users and also branch site users, we are planning to use the branch fortigate as an Edge Device in FortiSASE instead of establishing a direct tunnel between branch fortigate and the HQ one.I'm just wondering how common is this ? it looks so complicated reading the admin guidePS: we have UTP bundle with each fortigate (HQ and branch), in my opinion a direct tunnel between both sites is better, and FortiSASE will be used mainly for remote users only.

Hello,I’m working on a project where FortiGate is integrated with Active Directory using FSSO. I’ve successfully retrieved AD groups such as Basic-Access,Whatsapp-Access, and Anydesk-Access.Requirement:Users in the Basic-Access group should have basic internet access (with restrictions such as blocking social media,whatsapp,youtube).If a user is also part of Whatsapp-Access (in addition to Basic-Access), they should retain the Basic-Access permissions but also gain the ability to use WhatsApp.The client wants full control from AD, so we should only add/remove users from groups without making changes on the firewall.Issue I’m facing:The problem comes down to policy order.If I place the Whatsapp-Access policy above Basic-Access, a user in both groups only matches the Whatsapp policy and ends up with WhatsApp only (all other traffic blocked).If I reverse the order, then the Whatsapp policy is never hit, and the user only gets Basic-Access.So effectively, the firewall only applies the firs

Hello all, We have a major issue with the Forticlient VPN connection..After many tests, here is what we know : When using the Forticlient app on an ANDROID tablet/phone with a direct wi-fi connection, it works flawlessly  When using the Forticlient app on an ANDROID device by using a phone's mobile data to connect the device to the internet, it doesnt work. We get the error message « show error:revoked by android reboot »  When using the Forticlient app on an IOS device, it works perfectly either with direct wifi or a through a mobile hotspot. We are always using the latest iOS, Android or Forticlient version available.We have this issue since April 2025.Our IT service is clueless.  Does anyone here could help to sort this out?  Thank you very much and have a great day! FortiClient