Support Forum

Hi, I’m running into a strange issue with an IPsec tunnel to a Cisco firewall and I’m hoping someone can help.The tunnel comes up fine and traffic does pass through, but the connection slows down significantly. For example:If I ping 8.8.8.8 directly from an end-user machine, the replies are just a few ms.If I ping a remote address over the tunnel, the latency jumps to about a second.Even pinging the remote VPN gateway itself shows very high delay. As soon as I bring the tunnel down, latency immediately improves to under 10 ms.Setup details:Both the Internet and VPN zones share the same physical interface on the firewall (different VLANs) and use the same ISP.I don’t believe the issue is on the remote side, because if I establish same tunnel to the same remote gateway from a different firewall, it works normally.So far, I’ve tried flushing the tunnel on both ends, but that didn’t help.Does anyone know which commands I could run to troubleshoot this further, or what else I should be chec

Someone can correct me if my understanding below is correct or not regarding sdwan best quality and lowest cost (SLA). Best quality When use best quality the parameter used is only to select one from available belowLowest Cost (SLA)With this criteria then the parameter used is SLA target from each performance SLA?

Hello, I have a pair of 100F firewall configure in HA with Active/Standby and HA dedicated MGMT Revervation is also configured with ha-direct enable. I am tried putting the AD details in the fieldsa and under regular provided the AD Credentials Administrator, and trying to browse DN, but is is always says invalid LDAP Server. Note : Windows is successfully authenticated to users.  

I have 3 sites and 6 FAC vms  , 2 fac in HA(active-passive)  in each site is deployed.  one site will be primary and other two will be secondary. can we syn config of primary site with other two site in this setup?

Dears Appreciate your support to advise with the needed co to solve below issues:High121010TLS Version 1.1 Protocol DetectionHigh17367Fortinet FortiGate Web Console Management DetectionMedium157288TLS Version 1.1 Deprecated ProtocolMedium187315SSH Terrapin Prefix Truncation Weakness (CVE-2023-48795)Medium51192SSL Certificate Cannot Be TrustedMedium57582SSL Self-Signed CertificateLow153953SSH Weak Key Exchange Algorithms EnabledLow10114ICMP Timestamp Request Remote Date Disclosure 

Hi Experts, I am looking for some guidance on how to go about adding a new hub to an existing sdwan deployment. I'd really appreciate if there are any sample configurations of a dual hub setup for reference.Thanks

Hi Experts, I am running into issues with Dynamic vlan change where a managed fortiswitch is responding to radius attributes sent by Cisco ISE acting as a radius server. I've followed the documentations and ensured that the fortinet attributes are in the Cisco ISE. https://docs.fortinet.com/document/fortiswitch/7.2.5/administration-guide/110309/radius-change-of-authorization-coa I've attached screenshots of the radius server and fortinet radius configuration. We see that the ISE sending the following but, the fortinet doesn't switch the vlan. Tunnel-Private-Group-IdTunnel-Medium-TypeTunnel-Type FGT: 7.2.5 | FSW: 7.4.0

We are configuring a site-to-site IPsec VPN with a remote peer (Cisco device, managed by Madrid Digital). The VPN negotiation fails during IKE exchange with the following error:ike V=root:0:VPN-MadridDigit:3600: cert type not supported 7We understand from RFC 2408, page 34 that type 7 refers to a Certificate Revocation List (CRL). The remote peer sends a CRL object as part of the certificate payload, which appears to trigger the failure on our FortiGate.Our FortiGate environment:Model: FortiGate-VM64-KVMFirmware: v7.4.8 build2795 (GA.M)Serial number: FGVMMLTM25010920Mode: NATHA: StandaloneLicense valid until: 2026-06-23Steps already taken (without success):The local certificate and remote CA (CA_Cert_1) are correctly imported and marked as valid.We confirmed that CA_Cert_1 does not contain:crl-urlcrl-checkauto-updateWe attempted to disable CRL checking with:config vpn certificate settingset check-revocation disableBut the command fails with:command parse error before 'check-revocation'

Our FortiManager and FortiGates are running 7.4.6, and we ran into the bug where when we deploy a change, the rule ID is appended to the global-label. Whereas before, we may have 10 rules under a section, there is now a section above each an every rule, with the rule ID added off to the side of each section. For example, "out to internet'rule 1rule 2...rule 10 is now"out to internet(1)"rule 1"out to internet(2)"rule 2etc. The solution is to "workaround by creating a CLI template related to the configuration and assigned to the device." I've been looking at this off and on today, but I can't figure out how to accomplish this. Can anyone point me in the right direction? Thank you.

Hi,I operate two FortiGate 120G devices in an Active-Standby HA configuration with a BGP connection.When an Active-Standby failover occurs, there is a  BGP interruption of approximately 30 seconds.The following KB article states that the BGP process only runs on the daemon process of the active unit, and that a new process is launched upon failover.Could you please provide detailed documentation or evidence regarding this point?KBhttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-FortiGate-HA-and-BGP-graceful-restart/ta-p/196150On a FortiGate HA cluster, the BGP router daemon process is only running on the Primary unit. When there is an HA failover a new BGP process will be launched on the newly elected primary.Additionally, I observed a outage of 25-30 seconds during failover.I understand this is not related to the BGP keepalive timer (30 seconds) but is simply the time required for the BGP process to launch and establish a connection on the new primary unit.I

Hi, i'm wondering if there is a solution for the following concept... Suppose user A is on site A in vlan A.  He/she wants to use a resource which is on site B and does this by using Forticlient vpn.  User A can also use any resource in vlan A on site A. Suppose user A want to access a resource in vlan B of site A.  With an active Forticlient the result depends of what routing table info the user gets back after initiating the Forticlient vpn.  If the destination subnet of vlan B happens to be in there, then the trafic will get tunneled through the ssl vpn, and then back over an ipsec site-to-site vpn.  Which is kinda lame, as the data is actually local.  You could ofcourse remove the destination subnet from the received routing table info, but this would mean that it would stop working for any other user at any other site... Configuring the site-to-site vpn correctly is naturally also a very viable solution, but in this case study

FortiGate GUI public IP not reachable - Azure HA with ELB-ILBHi all,I have deployed a FortiGate HA solution, Active-Passive, FortiOs: 7.4.7M, license model: PAYG, in Azure.I am currently unable to access the GUI despite having actioned the following:* Created the internal and external load balancers, with backend pools mapping to the NICs of the internal (trusted) and external (untrusted) fortigte subnets* Enabling http redirect to https and explcitly setting the admin port to 443 for https* Enabling https, probe-reponse and other access capabilities on both the management and wan interfaces.The port structure is as follows:- port1 = wan- port2 = lan- port3 = hasync- port4 = mgmt* Ran a debug and can only see that SYN packets are sent, but no ACK```fgta-p-uks-01 # diagnose sniffer packet any "host 10.202.1.68 and port 443" 4 0Using Original Sniffing Modeinterfaces=[any]filters=[host 10.202.1.68 and port 443]3.393207 port4 in 84.51.233.23.57711 -> 10.202.1.68.443: syn 27649927603.405

Hi! We're a Fortinet distributor in Canada and we are surprised for the prices offered by some US-based stores.Does anyone know if there's a different price list for the US? Are partner levels discounts (Select, Advanced, Expert) different compared to the rest of the Americas?It would be amazing if someone could share one of these price lists with me.

Hello Team,i have configured VXLAN over VPN  with MP-BGP EVPNVLANs that are part of VXLAN have VRRP enabled .VXLAN  and VRRP are working as expectedThe problem is when traffic is traversing the DCs (From the Secondary DC to the Primary DC - VRRP-wise) ,At the destination DC, the traffic is not returning as there is no routing pointing to VXLAN for the return traffic.There is BGP between DC and the network that is trying to reach the VXLAN IP, which is advertised over the IPSEC.The strange thing is that when i runed POC on FG 7.4.7 it was working. attached the config:    

I have an environment in which industrial switches (not fortiswitch) needs to be on the same mgmt vlan for all subnets. I am not finding a way to have the mgmt vlan passthrough on a foritgate with v7.6.x while also having the interfaces for the OT subnets.Confused? Here is an example:- Port WAN1: vlan 200 interface (main OT network), tag vlan1000 (mgmt) without creating interface- Port 1: Contains vlan 801 interface- Port 2: Contains vlan 802 interface- Port 3: Contains vlan 803 interfaceVLAN1000 must be tagged on Ports WAN1, 1, 2, and 3, without interface (passthrough). This is used to manage the managed switches.This can be done on industrial firewalls from Siemens and Hirschmann. How is it done with Fortigate?

We have separate VDOM for each of our clients on our 2000E FW. The clients have access to their respective vdom only. However, when they do route lookup they can see all interfaces on our 2000E.    

Hello team! We have 2 Fortigates 100F in HA 7.6.4 and a FortiClient EMS cloud 7.4.3We already have 3 dialup IPsec IKEv1 VPNs for each WAN working, all authenticating with ADAlso we have 1 dialup IPsec IKEv2 VPN for each WAN working, also authenticating with ADI recently added another existing AD domain in the Fortigate and EMS (Both domains are in different DCs), installing the agents needed The authentication server was correctly added in the EMS Cloud and we could see AD objectsIn the Fortigate, we have added an external connector (FSSO Agent on Windows AD), like in the other domain, and created a new LDAP Server, like in the other domain.  The external connector is up, and the new LDAP server passed both tests ("Test Connectivity" and "Test User Credentials") I then created a new local user group, using 1 remote group (In the second AD) and created 1 new IKEv2 dialup VPN for each wan, using this new groupIn the EMS, I duplicated the working IKEv2 VPN profile for

On August 26th, I attempted to log into my client's network using FortiClient VPN only.  I received a JavaScript error.  I came here, found a solution and performed the suggested steps.  I don't have the JavaScript error anymore.  The problem I have now is that the FortiClient FortiToken input field does not display.  I receive the 2F token code via email; however, I have no way to input the code.I have been trying to fix this for four weeks and I'm hoping someone can suggest a solution I might try.Note: It is not the user name case sensitivity Thanks in advance.

I'm attempting to setup remote access VPN using IPSec and authentication with SAML using Entra ID. There are a couple of tricky parts about this setup:1. Dual WAN for failover/redundancy2. Different groups need be configured for different VPN access I have been able to successfully configure and test the connection individually to a single WAN but having issues connecting individually to the 2nd WAN. The connection to the 2nd WAN gives a WAN1 cert error. I have verified that the WAN2 Entra enterprise app and the WAN2 IPSec VPN configs do not reference the WAN1 cert.I also have not figured out how to sperate the different VPN access groups without building a bunch of enterprise apps in Entra the reference specific access groups. My hope is to have a single app for each WAN connection with different groups for access, then limit network access by the group membership in the policy. I can find plenty of documentation on how to do this with SSL-VPN, but I'm trying to stay away fr

Does anyone have any references for how to configure the digital I/O on a Fortigate rugged? I would like to be able to set up one of the outputs to alarm on failure of one of the power inputs.

Hello,i'm stuck in creating an Ipsec dialup vpn ikev2 with cisco DUO.During the Phase1 negotiation i see errors on the EAP failing negotiation, following the screenshot directly from the firewall gui and the log taken from cli.I double checked all the settings, configured even the following for EAP:    set eap enable    set eap-identity send-request    set acct-verify enable But i'm still facing "FNBAM_DENIED" followed by the "connection expiring due to EAP failure", what am i missing and should do?My radius is DUO_MFA with ip 192.168.20.125105.94.83.72 is the remote ip and 25.36.47.58 is my public ipjohn.week is my userFw version is 7.4.7Forticlient version is 7.4.3 and 7.4.0.1658     VPNFWISDB (Vpn) # ike V=internet:accepts ike tcp-transport(vd=1, vrf=0, intf=0:55, 88.51.233.52:4500->157.245.243.118:36001 sock=0 refcnt=2 ph1=(nil)) (53).ike V=internet:Wrong IKETCP prefix(OPTION)ike V=Vpn:5: comes 25.36.47.58:500

Hello, i'm trying to set up a Dialup ipsec vpn with cisco Duo as Mfa in order to allow remote users to connect to my company.The fortigate version 7.4.7 has 4 Vdoms (root + internet, mydmz, myvpn).the internet vdom is used to manage internet traffic inbound and outbound.mydmz vdom exposes my public services and has ip 161.10.10.1/28, the myvpn vdom instead is where i want to terminate the vpn and has ip 161.10.10.6/28 (this is the ip configured in forticlient).I'm able to ping ip 161.10.10.6 and from a debug flow i see  the traffic passing correctly from port 10 associated to  internet vdom to port11 associated to mydmz vdom (i'm not able to see traffic arriving to port 12 in the myvpn vdom but the ping is ok....).However when connecting via forticlient (version 7.4.3 or 7.4.0) i see in the log UNIDIRECTIONAL flow from outside to inside and never viceversa; internet to mydmz vdom.What could be the problem?The policy to allow traffic from internet to myvpn vdom

Hi. I want to get license for fortinet on VMware, can you help me?

I am login with partner account but i am not getting service option beside support and i am not create a ticket please solve it

Hi.I've got a 60E that I'm replacing under the trade-up as it is EOL next year July.The reseller told me it would simply be deactivated which is fair enough that I don't have to ship the old one back, but what exactly does that mean?Is the old device going to be nothing more than a paperweight going forward, or could it be used as a basic firewall without all the subscription features. I.e. could I used it at home and create forward/blocking rules etc.Or do I simply send it off to an e-waste recycling center?