Support Forum

I have 2 Active directory servers at 2 different locations my Forti-authenticator sync with this AD using LDAPs where i have imported certificate extracted from AD however need to confirm as my both AD sync but are in different location an my authenticator is also in these 2 different location so should i extract the certificate from both AD 

Hi, we are using FortiClient as VPN but we are experiencing problems to access Factorial Website. To try to solve this problem I have set two URL Filters which is located in Configuration > Security.But unfortunately this is not working either. Any solution for this?Thanks in advance.

I would like to report a bug I have encountered with FortiClient. Here are the details:When I open the FortiClient Console, the window appears but often disappears within a few seconds.If I create a VPN connection named 0000 with the Client Certificate set to None, the FortiClient Console remains open and does not disappear.However, if I create a VPN connection with the Client Certificate set to any value other than None and select it from the dropdown list in the FortiClient Console, the console often disappears within a few seconds.Additionally, I have checked the Windows Event Viewer, but there were no logs at the relevant times in either the Windows Logs\Application or System sections. I also set the Log Level to Debug in the FortiClient Console and exported the logs after reproducing the issue, but there were no logs at the relevant times.Furthermore, I found that deleting certificates issued by DO_NOT_TRUST_FiddlerRoot in the certmgr.msc (Certificates - Current User > Personal

Hi, yesterday a Firewall Policy was accidentally deleted on Fortinet (v7.0.11). In Log Events I only see "Delete firewall.policy 37". How and where can I see what the policy did so that I can recreate it?Thanks.

In a multi-VDOM setup (91G @7.4.8) I have connected routes in several VDOMs, iBGP between VDOMs, one VDOM as RR. For root VDOM I have the route 192.168.0.0/24 (VLAN on a LAG), and the physical port is up. I can even ping it. But it does not show up in the routing table - and thus is not advertised to it's peers nor the RR. Any pointers here? It's not in the routing-table database. I see the connected routes of the other VDOMs via BGP. FG1 (root) # execute ping 192.168.0.1PING 192.168.0.1 (192.168.0.1): 56 data bytes64 bytes from 192.168.0.1: icmp_seq=0 ttl=255 time=0.0 ms--- 192.168.0.1 ping statistics ---1 packets transmitted, 1 packets received, 0% packet lossround-trip min/avg/max = 0.0/0.0/0.0 msFG1 (root) # get router info routing-table connected | grep 192DS1 (root) # get router info routing-table details 192.168.0.0/24% Network not in table  

Hello all, I'm a newbie here as well as a newbie to FortiGate FG_80F Firewalls I have two questions Regarding opening two port in my firewall. First, I want to say that I tried to follow a doc from support How to open a port. The problem is I do not have an IPV4 policy on my firewall so I can't continue with the article from support. 1) I need traffic to pass through Port TCP and UDP 5080 and 5081. How do I configure the Firewall Policy to allow through these ports?2) And how do I configure nat to consistent nat? And need to make sure SIP and ALG is disabled.  I would appreciate any help I can get. Thank youChris

Hi,We have 2 fortigates in different locations and each of them include SPA license, in a addition to a FortiSASE subscription.To maintain policy consistency for remote users and also branch site users, we are planning to use the branch fortigate as an Edge Device in FortiSASE instead of establishing a direct tunnel between branch fortigate and the HQ one.I'm just wondering how common is this ? it looks so complicated reading the admin guidePS: we have UTP bundle with each fortigate (HQ and branch), in my opinion a direct tunnel between both sites is better, and FortiSASE will be used mainly for remote users only.

Hello,I’m working on a project where FortiGate is integrated with Active Directory using FSSO. I’ve successfully retrieved AD groups such as Basic-Access,Whatsapp-Access, and Anydesk-Access.Requirement:Users in the Basic-Access group should have basic internet access (with restrictions such as blocking social media,whatsapp,youtube).If a user is also part of Whatsapp-Access (in addition to Basic-Access), they should retain the Basic-Access permissions but also gain the ability to use WhatsApp.The client wants full control from AD, so we should only add/remove users from groups without making changes on the firewall.Issue I’m facing:The problem comes down to policy order.If I place the Whatsapp-Access policy above Basic-Access, a user in both groups only matches the Whatsapp policy and ends up with WhatsApp only (all other traffic blocked).If I reverse the order, then the Whatsapp policy is never hit, and the user only gets Basic-Access.So effectively, the firewall only applies the firs

Hello all, We have a major issue with the Forticlient VPN connection..After many tests, here is what we know : When using the Forticlient app on an ANDROID tablet/phone with a direct wi-fi connection, it works flawlessly  When using the Forticlient app on an ANDROID device by using a phone's mobile data to connect the device to the internet, it doesnt work. We get the error message « show error:revoked by android reboot »  When using the Forticlient app on an IOS device, it works perfectly either with direct wifi or a through a mobile hotspot. We are always using the latest iOS, Android or Forticlient version available.We have this issue since April 2025.Our IT service is clueless.  Does anyone here could help to sort this out?  Thank you very much and have a great day! FortiClient 

Hello,we are running a SDWAN infrastructure with one Hub and several spoke. All sites are equipped with 60E clusters running 6.2.3.On one of my spoke I have a strange behavior.each 3 min I have this error in router events logs:BGP: %BGP-5-ADJCHANGE: neighbor 192.168.88.254 Down BGP Notification FSM-ERRfollowed byBGP: %BGP-5-ADJCHANGE: neighbor 192.168.88.254 UpThe problem is that during this event all connexions from spoke to hub are shut during roughly 30 sec any idea ? 

I have a FortiSwitch attached to my FortiWiFi50G and would like to take a backup of my FortiSwitch Configuration. Does anyone know how to accomplish this? #Forti Switch

Hi ,   I would like to know the difference between the capabilities that a native SD-WAN at the Fortigate level can offer and those offered by the UNDERLAY AND APPLICATION MONITORING SERVICE license.When should this license be used ? What are technical limitations in native sd-wan in fortigate ? BR

Hello,I would like to know if it is possible to use RSSO instead of FSSO solution, because one of my customer using FSSO has problems with DNS resolution, but I have some doubts for wired clients.There is a lot of documentation about wireless devices using 802.1x, but is it possible to integrate Radius Accounting when the user logs in using the NPS server?Tank youVincenzo Stolfi

Hi, I have FortiClient EMS, FortiManager, and several FortiGates in my environment.EMS is connected to each FortiGate and showing "connected" in the Fabric Connectors;In EMS I configured classification tags to some users;In FortiManager, I have a Global Header Policy applied to all FortiGates;This policy has an EMS classification tag as part of the source match condition.Problem is devices without the EMS tag are still matching the policy. Only troubleshoot I was able to do is running <diag user device list> only to find that there are no tags showing up. Forticlient EMS  v7.4.3Fortimanager v7.4.6Fortigate(s) v7.4.7 I would appreciate some help on how to further troubleshoot the issue. Thanks in advance.  

I can only access a specific website when I disable the web filter. The Fortigate 40F firewall doesn't display any message informing the blocked category. The website isn't placed in any category. When I disable the web filter, I access it normally. I've already placed the website in the Static URL filter, including Exempt, Block, Allow, and Monitor... but nothing happens. It doesn't block or allow. I've also disabled the Fortiguard Category Basel filter, and nothing happens.   

I' ve got a policy/protection profile set up for just outbound email from our public email server and in the DLP rules I' m looking for SSN' s. We are getting quite a bit of false positives in that the numbers look and are formatted like ssn' s but aren' t. Typical example is a reply to an email from Hotmail. Microsoft adds this to their email: Hotmail: Free, trusted and rich email service. Get it now. ( http://clk.atd= mt.com/GBL/go/171222984/direct/01/ ) As you can see, the URL has a 9 digit number that looks like a SSN. Is anybody else using DLP to look for SSN' s or credit card numbers in email/html and is running into this type of problem? We' d really like to continue to use the regex to look for data leaks but it' s becoming a management/helpdesk nightmare. Also, does anybody know when Fortinet gained the capability to look inside the new MS office file formats(.xlsx and .docx)? I tested pretty extensively with DLP and noticed that the firewall could look insid

We used to have FortiClient version 6.2.6 and it works well on SSL VPN connection to our corporate network (gateway FortiOS version 6.4.3).  Once we upgraded to FortiClient 6.4.3, we start getting intermittent connectivity issue in that user cannot access network resources due to DNS resolution failure.  It's found to be caused by client's network interface attempts to query DNS through IPv6 and failed.  It then stop there without attempting querying IPv4 DNS.  We are stuck with no solution from Fortigate and desperately need to resolve it.  Does anyone encounter similar issue and can share some ideas?   Thanks

Hello ,The vpn was working fine for 1 week, then i received this error, and i cannot connect againi tried to connect with a different 4 ISP but same problemso what i suppose to do  thank you 

Hi, I have FortiGate connected to  Cisco switches (core + access), which is connected to 7 FortiAPs. I want to create multiple SSIDs (VLAN 10 and VLAN 20). Currently, I have created two VLANs under my LAN physical interface on my FortiGate, and two SSIDs in bridge mode. on the switch side. I changed the point-to-point interface (to FG and to AP) to Truck. and created (vlan10, vlan20). Unfortunately, the internet is very slow, and AP keeps restarting suddenly. I opened a ticket with TAC, but it was not helpful. Kindly advise if my config is correct. Or better to move to Tunnel mode. And what is the difference between Tunnel and Bridge mode in function and configuration on a Cisco switch?

Hello,   The issue is: why Fortilink cannot be established over a media converter ? What are the limitations ...? Vendors of ""proper"" media-converters ??? I thought that media converter is only a dump converter: from electric signals to optical -so it does not introduce anything in the traffic -> ergo it completely transparent and FolrtiLink shoul (!) works   What about config like this Of course : -FG is configured for FortLink on the port that is connected to the media-converter -SFP are proper for the fiber : SFP SM for SM fiber type -Link on BOTH sides are UP and blinking... [F-Gate UTP] <--Cat 5e copper --> [ UTP  MediaConverter  SFP] <--Fiber --> [SFP  FortiSwitch]   any magic command from CLI (again...!) on Fgate or Fswitch ?????   UPDATE: the SAME Fortinet SFP module plugged from switch to Fluke Analyzer and connected via media-converter to normal  (non-fortilink) port in FGate  works from the first kick ... &nb

I have 2 site to site from site-A to site-B and sdwan only enabled in site-AIn the site-B I configure static route to site-A via 2 link with same cost.The issue is when site-A select link-B for example then site B reply using link-A.How we can prevent this kind of asymetric?

OK to set the scene.We are using Fortinet EMS Cloud with Entra SSO authentication.  We create the deployment and push via Intune.  Our machines are built with Autopilot in a Hybrid setup.  When the Forticlient is installed and the machine rebooted, the VPN shield is not present so the user in unable to connect to the network remotely.  Note, this is not an issue for newly built machines on the network only those that are remote.The endpoint profile is not pushed to the machine until the user has logged into the machine.  But as the user cannot login, the machine cannot receive the profile.How can the configuration profile be pushed as part of the initial Forticlient install? Martin

I'm currently trying to get some port forwarding setup on my Fortigate 61F running 7.2.11 build 1740 but am running into some issues because I'm having to run the Fortigate behind another SOHO router (long story). The Fortigate has been added to the DMZ of the SOHO router and its interface is being assigned an ip from the router via DHCP.  I started by configuring the port forwarding like I normally would do by creating a VIP using the following details:External Ip address is set to 192.168.123.45Internal ip address is set to 192.168.21.2Both Internal and external ports are set to desired port numbers Once the VIP was created, I then created the firewall rules to allow traffic to flow, not realizing at first that the traffic was going to have the local_in policy applied to it instead.  Once I determined that it was being treated as local_in traffic, I created a local_in policy for the traffic as follows: interface is set to internal3 srcaddr is set to alld

Hey,I’m currently getting ready for the NSE5 FAZ-7.2 (FortiAnalyzer) exam and looking for the most updated and reliable practice questions for 2025.If anyone can suggest trusted resources or mock exams that closely match the actual test format and difficulty, I’d really appreciate your help.Thanks in advance.

Hi,is it possible to provision a Let's Encrypt certificate with an additional domain (SAN certificate) on a FortiGate 200F. We are using the firmware 7.0.11 at the moment.In the wizzard there is only one input field for domain. Padi