Support Forum

As discussed, while using FortiClient, we have observed an intermittent behavior when incorrect credentials are entered. In some instances, the expected incorrect credentials/error prompt is not displayed, whereas in other instances, the prompt appears as expected.To further investigate this behavior and identify a possible resolution, we have also posted the issue on the Fortinet Community for additional inputs and recommendations.We request you to kindly share any suggestions or recommendations from your end that may help us troubleshoot and resolve this intermittent behavior.We will continue to monitor the behavior and share any further observations or updates.

Hi community,I am very familiar with configuring FortiGate Web Filter policies using traditional Active Directory via LDAP and FSSO for user and group-based rules. However, we are moving to a pure cloud environment with Microsoft Entra ID (Azure AD), and I want to achieve the same group-based web filtering capability.Environment Details: FortiGate Model: FG-120G FortiOS Version: 7.6.7 Identity Provider: Microsoft Entra ID (No local Domain Controller / No FortiClient EMS) Since Entra ID does not support native LDAP out of the box like traditional AD DS, I understand that integrating Entra ID with FortiGate for user-based policies relies on SAML 2.0.My Questions: What is the recommended workflow to map Entra ID User Groups (Object IDs/Claims) into FortiGate user groups for policy enforcement? How does FortiGate handle transparent user identification and policy matching for web traffic when using SAML instead of classic LDAP/FSSO queries? Are there any best practices or step-by-st

FortiGate-A ↔ FortiGate-B IPsec Tunnel – BGP TCP/179 Return Traffic Not DecryptingHi Fortinet Community,I am troubleshooting a BGP connectivity issue over an IPsec tunnel.Environment:FortiGate-A: FortiGate 60F FortiOS: 7.4.11 GA FortiGate-B: Remote FortiGate IPsec: IKE/IPsec with NAT-T BGP: TCP/179IssueThe BGP session is not establishing over the IPsec tunnel.Troubleshooting performedThe IPsec tunnel is UP and DPD status is OK. NAT-T is enabled and UDP/4500 traffic is observed in both directions. FortiGate-A generates the BGP TCP/179 SYN and sends it through the IPsec tunnel. Flow debug confirms that the packet enters the IPsec interface and is encrypted successfully. On FortiGate-B, the SYN-ACK is generated and confirmed to be taking the correct return path toward FortiGate-A. On FortiGate-A, the return UDP/4500 packets from FortiGate-B are visible on the WAN interface. However, the IPsec dec:pkts counter does not increase when the return traffic is generated. The decrypted inner TCP/

Hi everyone!On my FortiAuthenticator running version 6.6.10, I've connected a remote LDAP server and already imported the first batch of users. As a second step, I've set up a sync rule for it.I'd like to clear up a few doubts regarding the sync rule, and confirm whether the following understanding of the automatic enablement (for new users imported via the sync rule) is correct:Under Synchronization attributes → OTP method assignment priority: do I just need to move SMS to the top of the list and flag/enable it? Is that the only step required ? (see screenshot below)*   What sync interval would you recommend? Is every 30 minutes a reasonable value ?   Finally, if I understood correctly: for users that already exist on FAC (previously imported), the sync only updates already-mapped attributes (e.g. phone number, email) — is that correct ?* Thank you all in advance!"This is the way"

Permission denied when using ssl user to log in fortigate firewall.What does -455 mean by the way?

I have two FortiWeb 400F units in Active-Passive HA mode. The management IP addresses on port 1 are x.x.x.180 (Primary) and x.x.x.181 (Secondary). When accessing the web interface, I can only log in to the active HA unit (x.x.x.181). I understand that access to the GUI is limited to the active unit because the "Reserved Management Interface" option is not enabled; however, when attempting to configure the reserved interface on port 1, the port does not appear as an available option for assignment.What configuration steps must I take to enable GUI access to the passive unit as well? 

Hello everyone! We are currently running FAZ (100 licenses and 50GB logs per day) and we only use it's log collector functions, all the SOAR and SIEM functionality is gathering dust atm.We are planning to also purchase FMG to manage configurations of the firewalls, and there's a question I would like to ask: as far as I can see, FortiManager is capable of performing as a FortiAnalyzer. Are there FortiManager licenses that can provide 50GB logs per day and around same 100 devices, so we don't buy FAZ anymore?Any help is appreciated. Thank you in advance!

When my FortiSwitches reboot, they lose the FortiLink synchronization with the FortiGate. I have to manually set the date and time on the FortiSwitch for it to re-synchronize with the FortiGate. My FortiGate is running version v7.6.6 build3652, and the FortiSwitch is running version S148EP-v7.6.4-build1114. Please help me resolve this issue so it does not happen again.

I have spent the last few weeks parsing FortiGate syslog from two firewalls — one hosting edge and one branch unit — and ended up building a small dashboard around it. I am sharing both the findings and the tool, because the findings are useful even if you never touch the tool.Five things that quietly produce wrong results1. The syslog header time is not the event time. Use FTNTFGTeventtime, which is nanoseconds since the epoch (divide by 1,000,000 for milliseconds), together with FTNTFGTtz. Depending on your relay, the header can be the device's local time, and everything lands shifted by hours without any error being raised.2. app= is not the application. In CEF, app= is the service label; the application that application control actually detected is FTNTFGTapp. A filter written against app= matches something, so it looks like it works.3. Security-profile blocks never say act=deny. The app-control log carries act=block, while the matching traffic log shows a normal-looking client-rst

I have below issue on FMG cloud , when importing / install cofiguration to fortigate I got below error :error user fsso polling , modifying ldap-server is not allowed

FortiMail is a cloud service while FortiAnalyzer is deployed on-premises .FortiMail need to send logs to FortiAnalyzer on-premises

We have FortiManager 7.6.7 and two FortiGates running FortiOS 7.4.11.Under Security Profiles > SSL/SSH Inspection, we have an object named “SSL-EXCEPT” with set cert-probe-failure allow, and this profile is used in several firewall policies.In FortiManager, the same object also has allow configured. However, whenever we make any change in FortiManager, it applies unset cert-probe-failure, which is preventing us from managing changes on these FortiGates through FortiManager.How can we fix this?

We are currently facing an issue with log forwarding between our FortiGate 1100E and FortiAnalyzer device. The FortiGate is configured to send logs to the FortiAnalyzer; however, we are experiencing issues with the logs not being received/displayed correctly on the FortiAnalyzer. Issue details: FortiGate Model: 1100E FortiAnalyzer Model: FortiAnalyzer-150G   We have already verified the basic connectivity between the FortiGate and FortiAnalyzer and confirmed that the logging configuration is in place. However, the issue is still occurring. FG11E-PPCL-DC-ACT $ diagnose debug application fgtlogd 255Debug messages will be on for 18 minutes.FG11E-PPCL-DC-ACT $ diagnose debug application miglogd 255Debug messages will be on for 18 minutes.FG11E-PPCL-DC-ACT $ diagnose debug application oftpd 8 10.61.9.1command parse error before 'oftpd'Command fail. Return code -61FG11E-PPCL-DC-ACT $ diagnose sniffer migsock filter name=global-fazFG11E-PPCL-DC-ACT $ diagnose sniffer migsock ssl-trace enabl

Hello Fortinet Community,I have a customer requirement regarding remote access VPN connectivity.My understanding is that FortiGate supports both SSL VPN and IPsec VPN for client-to-site connections. However, I have also seen recommendations to move away from SSL VPN in newer releases, and I am planning to deploy this solution on FortiOS 7.6.The customer's requirement is very specific: they want to ensure that only one concurrent VPN session is allowed per user account. For example, if a user connects through FortiClient using their username and password, a second person should not be able to use the same credentials simultaneously from another PC and establish another VPN session.Is this behavior supported natively by FortiGate/FortiClient? If so:Is there a specific setting to limit concurrent logins per user? Does it work for both IPsec and SSL VPN? Are there any best practices or recommended approaches to enforce this requirement?I would appreciate any guidance or configuration recom

Hello,i am running Forticlient 7.4.3 on Ubuntu. Sometimes my client works, then when i shut down my laptop and turn it back on i keep getting this error. No restart can help in any ways. Some time passes (it generally feels random: sometimes it's like 5 mins, sometimes more than one hour passes by and the problem persists.Then suddenly i manage to log in my vpn again...Any suggestions on what to do?I have this script that i run often after i restart my computer: this helps me out altering my connections and enabling the DNS again, because it seems the forticlient enters some DNS in my wifi connections, so i need to remove these entries:#!/bin/bash # List current running connections and allow user to select one using fzf connection_drop_name=$(nmcli c show --active | awk 'NR>1 {print $1}' | fzf --prompt="Select a connection to drop: ") # Check if a connection was selected if [ -z "$connection_drop_name" ]; then echo "No connection selected. Exiting." # exit 1 fi # Bring down th

So umm my college has blacklisted quite a few websites and apps so as to promote productivity and a studious environment. They are using fortinet for this task.Unfortunately this also includes steam, epic games and even the riot client. I cannot access any of them and cant play any games on my dorm wifi. I was hoping to gain help for bypassing this even if its just for steam epic and riot. I can always use my mobile data connection to access the other websites but playing valorant on mobile data hotspot leads to ridiculously high ping in the neighborhood of like 150-250 ms. Can anyone help with this??keep in mind I am not an expert or even well versed in networking so please treat me like your parents when trying to explain how things work or how to go about trying to bypass this.

Hello Community,I am configuring an IPsec VPN for remote users on FortiGate 7.2.13 and would like to use DDNS (Dynamic DNS) instead of a static public IP address.Has anyone successfully deployed this configuration? I would appreciate guidance on.

Good morning, everyone.I'm having an issue configuring FortiClient on Linux.My company uses VPN through the IPsec protocol. So far, I have tested it on different Linux distributions, including Linux Mint, Zorin OS, and Fedora.I'm using the official package provided by Fortinet. However, after installing and launching FortiClient, the option to configure an IPsec VPN simply does not appear in the interface.At first, I thought it might be an issue related to the graphical interface or a specific Linux distribution, but I tested it on three different distributions and the same behavior continues.I also tried importing the XML configuration file for the VPN. FortiClient reports that the import was successful, but the configuration is not actually loaded. If I try importing it again, the same thing happens, creating a loop where the VPN profile is never created or displayed.Has anyone experienced this issue with FortiClient on Linux while using an IPsec VPN?If anyone can share their experie

We are experiencing persistent database replication failures across our HA cluster and are looking for advice on the most stable release train before we perform a clean rebuild.Timeline: v7.6.6: Initial deployment worked for several weeks, but we eventually started encountering internal database errors whenever we tried adding new network switches. v7.6.7: Upgraded to address the switch-addition errors. The upgrade broke High Availability database replication completely between the primary and secondary nodes. STS Release: TAC advised upgrading to the Short-Term Support (STS) release, but HA database replication remains broken.  Which version/release train is currently the most stable for FortiNAC-F running HA, 802.1X, and EDR? Is the 7.4.x train the recommended target for production HA stability right now?

Hey everyone,I am now a Junior Network Engineer, and my company recently advised me to gain the Fortinet NSE 4: FortiOS Certification. As such, I have been preparing to take the Fortinet NSE 4 - FortiOS 7.6 Administrator exam.Like many newcomers, I began my preparation with the book, starting with the official Fortinet documentation and study guide. Although everything made sense from the theoretical point of view, there were certain difficulties in applying these concepts in practice. It is one thing to know what is supposed to happen to your network feature, and quite another to be able to fix it when something goes wrong.I faced certain obstacles in the form of a lack of practical knowledge on how to troubleshoot certain problems described in the documentation. Therefore, I had to change my approach to learning. In order to find solutions to practical issues, I began looking for FortiOS 7.6 Administrator questions and scenarios on the web. I also started digging into scenario-based

I need to deploy a FortiGate cluster A-P in different location each FW. It will be an Active-Passive cluster. The WAN interface IP (ISP) ranges provided by the ISPs will differ at each site. So NATs, routes, WAN interfaces are differents. The plan is to set up the A-P cluster and then manage the units using FortiManager. What would be the best way to do this? Site A - FGT1 PrimarySite B FGT2 SecondaryI'm thinking about the potential issues with setting up the cluster first, applying the configuration, and then migrating it to FMG. Any ideas or recommendations? 

I have always worked in a Cisco shop and I am new to Fortinet.  I do not know what this is.  Do I need this?  I did not ask for it.  It just showed up on my quote.    

Hi!Next week I'll have to update 2 Fortigate to the 7.6.7 version.The system is in HA and the cluster is " in sync " status ( Primary / Secondary )how can I upgrade it in the best way to avoid downtimes ? what things should i verify before upgrade ?Thanks 

as i have done the sdwan configuration for the redundency purpose and i am unable to access the internet through the wan 2 so help me

I have set up a site to site VPN on the fortigate 90G with 4 selectors. On the other end is a Cisco ASA device. After all configurations are done and I try to bring up the VPN, the tunnel is coming up but only one selector out of the 4 phase 2 are coming up. I have 2 servers on the local side and there are two servers on the remote side. Each device on my local network is supposed to talk to the each device on the remote side. I have tried to use named addresses, grouped addresses, and the actual IP addresses for the selectors but I’m still getting the same result. I also tried to set the initiator-ts to enabled but this also seems to not help. What seems to be happening is that tunnel is only bringing up the first match of the selector and ignoring the rest leaving them in a down state. I would really appreciate any assistance. It’s been giving a headache for a few days now and I can’t get it to work as it should. I would also like to point out that I do not have access to the cisco d