Support Forum

Hope you are doing great , So my customer have fortigate NAC running version 7.2, customer wants to login the switches using a single LDAP group. LDAP is  integrated with the NAC. can any one share me any tutorial or any step by step configuration link ? 

Good Afternoon ColleaguesI hope you are doing well .  When moving from a network with HQ (Datacenter) and many remote branches that using MPLS to Fortinet SD-WAN , Does HQ (Datacenter)  & remote branches need to have static  IP addresses ? Best Regards

We use LDAPS to check users belong to an AD group in our explicit proxy policies. Ever since we replaced our domain controllers with Server 2025, users receive a pop-up saying proxy authentication is required. We use regular bind type, with our AD CA's certificate. This test OK, and diagnose debug application fnbamd -1 shows the certificate working.The CNI is cn, but I've tried using sAMAccountName and uid. Looking in Event Viewer on the DCs, I see lots of event id 1216 and 15351535Internal event: The LDAP server returned an error.Additional DataError value:00000003: LdapErr: DSID-0C060666, comment: Error decrypting ldap message, data 0, v65f41216Internal event: An LDAP client connection was closed because of an error.Client IP: <ip of firewall>:17943Additional DataError value:3 The system cannot find the path specified.Internal ID:c06065f I briefly tried disabling ldapserverintegrity and LdapEnforceChannelBinding on the DCs to see if that was the cause, but no cha

Hello all,i'm trying to limit how much bandwidth my user can have for downloading. i have setup a per-ip-shaper at 30mb but it seems that the limitation randomly apply at 10-15mb instead. from what i can find online this seems to be the proper way to use it? i have set the web facing interface max bandwidth properly and can't think of why it wouldn't match the speed i set, any idea?

I’m facing an issue with connecting to the VPN using FortiClient.When I click on “Connect”, it does not show the username/password (or SSO) login prompt and nothing happens — the button stays in blue color.

Hi, Has anyone had any luck getting FortiClient vpn working on Tahoe? so far iv had 0 success .All windows based clients work fine however

Probably an easy question and after reading it seems Fortigate can do what I want.I have a couple secure networks that per our device onboarding process, I want to whitelist those MACs to have connectivity on their respective network (plug in device to wall, get internet. Plug any device not on address list that hits that network/vlan, no network). We have UniFi layer 2/layer3 switching and running into issues with wireless and downstream of allowed MAC lists.I can give more info if needed, just curious if my assumption on Fortigate functionality is accurate. Happy to read another linked thread if I missed it.

Hi, I need to create a launcher for the ASDM.Any suggestions? Thanks

Do I need an Advanced Bot Protection (ABP) license to enable biometric-based bot protection on FortiWeb?

Users have experienced high latency when connecting to FortiClient IPSec (EMS) over Starlink. We have observed that users on Starlink connections encounter noticeable latency when establishing IPSec sessions through FortiClient.

Hi All,    Is possible to disable the dynamic mapping object feature on Fortimanager?   I have a customer that often change object configuration directly on Fortigate and after "import policy" in Fortimager and then "re-install pollicy".    The problem is that after "import policy" it change the type of object from "address" to "dynamic address" and just that Fortigate that was changed is actualized on Fortimager.   Regards,Claudio Rezende   

Looking at buying some Fortinet kit, has anyone experienced failure within a year or two?Is the quality good, or does it improvement in terms of things failing?Whats your experience?

Hello, Apologies if this isn't the right place for this question, and I will say upfront I am somewhat of a novice with Fortigate.   I am running a Fortigate 60D,  I have two vlans, a private network for my PCs and an IoT VLAN where all my Google speakers connect  to.  I'd like to me able to manage/cast to my Google devices from the private network.  I've tried adding a policy to allow MDNS traffic between the two networks, but I'm not sure I set it up right.   Can someone please help with a step-by-step guide on how to set this up? Thanks!! 

Hey thereHow do you handle port security?Currently i use NAC Policies with Switches. Earlier i did also MAC Whitelist for dhcp Reservation, but it consumes to much time.Also in the automation we have if a switch port changes MAC it send an Alert mail to us.The nice thing is, if we replace the switch, user can just plug all cables random in it and the NACs kicks in.

Hello,            I downloaded FGT_VM64_KVM-v7.4.11.M-build2878-FORTINET.out.kvm from the Fortinet site but only thing in the extracted folder is the fortios.qcow2 file (103mb). Why doesn't admin or maintainer login work? I can't activate the free  license or activation via web on VPC in Eve-ng . I dont know the ip of the firewall to even try.  Could that be why I am not getting login info because wrapper.txt.is missing?  I am unable to login to get to the web gui to activate license.    Any help will be appreciated.

What could be causing the icons before to application names not to display?They disappear after a while.They don't show up in the "Application Signatures" or "Application Name" logs.Only a restart helps. Fortigate 61E firmware 7.2.13The signature databases are up to date. 

Hello! There is a migration scenario where I am not sure 100% about the port-naming\mapping order.I have 2 FortiGate VM in a public cloud (some local Open-Stack\KVM based vendor). My case is moving VMs between AZs and it can be done only manually. So for now I have 5 interfaces\ports on each VM and whey were configured in an adding order (I added one by one and got "port1, port2, port3" etc). In the migration process I'll have to stop the VM, save the image and redeploy in another AZ (like moving an HDD) and attach the image. I will create the same networks with the same IP parameters , but my concern is that when I power on the VM ports can be1) the same 5, but mixed between each other2)First 5 ports got "empty" and new start from 6 to 10Both options are bad. Does anyone know anything about port naming\mapping and the correct order and how can I impact within KVM environment.  I couldn't find anything except several reddit's posts 7ish years old.The ver is 7.4.11Thanks!

Hello everyone, Previously, Fortinet allowed customers to purchase a FortiGate-VM separately and renew only the license. However, this option has now been replaced with the FortiGate-VM subscription model, where both the VM and its licenses must be renewed together.My question is, when the VM subscription (including the license) expires, what exactly happens? Will the entire VM and its configuration be lost, or is there a way to retain the configuration (probably through snapshot) Kind regards,

I stepped away from Fortinet for a while and am coming back to find that there still seems to be no real solution to connecting the internal switch ports and external (FortiSwitch) switch ports on the same VLAN.  You'd think that once you setup FortiLink, attach a FortiSwitch, and start making FortiSwitch VLANs that those VLAN interfaces would be available to add to either a software switch or hardware (vlan) switch. It doesn't seem that is the case though... Instead, it seems the only way to share traffic between internal ports and external ports is to PHYSICALLY connect between them? Is this really the best (only?) solution:Create virtual VLAN switch with VLAN ID of zero on Fortigate.Add all the ports you are going to use as membersCreate sub-interfaces for each VLAN ID that you are using on the networkDesignate a physical port on the firewall as the trunkCreate a trunk port on the switch controller for the FortiSwitchesPhysically connect the internal (fw) switch trunk

Hi,my network has a fortinet fortigate 200F firewall and active directory with windows server 2019 (DHCP and DNS) and is connected to the Internet via two different ISPs (A and B) with their respective routers/modems configured for load balancing. There is also an external web server connected to ISP A with a static IP. The ISP A router/modem is a netgate pfsense configured so that the web server uses public IP 1 for external connections (from the Internet) and private IP 2 for internal connections (LAN). Connections to the web server work fine from the external network, but from the internal network I am experiencing a potential DNS Rebind attack issue. After some research, I think this is due to the fact that sometimes internal connections use ISP B, which is the one that does not manage the web server.So I wonder what is the best way to force the firewall to route all internal connections to the web server URL to ISP A (excluding ISP2). Where can I find a guide?Thank you.

Hello :)I have a question about connecting via Putty or PowerShell. How do I clear the history of entered commands that are substituted after pressing the up and down keys? Connecting via SSH to the FG900, I don't know where the history of such commands is located. Please help.

Hello, I would like to know if it is possible to force a check for a new version. The issue is that it takes a few days for my EMS in Europe to detect a new version once it is released in the US side. Is it possible to trigger the check or download it manually via the GUI ? There is a workaround via the CLI using an SCP transfer but it’s not the simplest method. Thanks

Hi All,What is exactly going on at Fortinet changing the certification levels every 2 years.So I have the following active:NSE 4 and NSE 5I completed the proctor exam Fortinet NSE 7 - Enterprise Firewall Administrator

Greetings I have recently got a second hand FortiGate 200D and because it was out of use for a couple of years the login and range is unknown. I tried to manual reset it but no luck and I cant discover the device I have tried multiple possible ranges. The device is not under support contract is there a way or place where I can download FortiOS to try and flash the device to factory settings with a usb? Thanks in advance

Hey thereHow do you handle port security?Currently i use NAC Policies with Switches. Earlier i did also MAC Whitelist for dhcp Reservation, but it consumes to much time.Also in the automation we have if a switch port changes MAC it send an Alert mail to us.The nice thing is, if we replace the switch, user can just plug all cables random in it and the NACs kicks in.