Support Forum

Hello community,Since I have configured some mail alerts with the automation in our FortiGate-VM I noticed that the "High CPU" message gets triggerd every day exactly every 8 hours (0:00; 8:00; 16:00). But the cpu spikes only for a very short time, since I don't even see the spike in the CPU widget or GUI process monitor.I tried configuring the generation of the local reports to other times than those 3 times with the CPU spikes, but it still happens.I also looked at the times where IPS and AV database updates (setting is automatic), but it never was at those times from the CPU spikes in the last weeks.Also rotation of logfiles only happens at 0:00 so this does not explain the other times from the CPU spikes. I also run some CLI commands for monitoring the system performance, when a mail alarm is sent, here is the output from it:========== #1, 2025-08-14 08:00:07 ========== FW-SAAS config global FW-SAAS (global) get system performance status CPU states: 83% user 14% system 0% nice

What is the difference between running Fortigate VM Evaluation on KVM and Hyper-V? In Hyper-V during my use I didn't have problems with limiting policies, but in KVM this occurs in any installation I made. In theory, what works in one should work in the other, right?

Hi,I'm new to cybersecurity.I fully completed these two courses. FCF - Introduction to the Threat Landscape 3.0 Self-PacedFCF - Getting Started in Cybersecurity 3.0 Self-Pacedbut in fortinet training institute' dashboard it displays as in progress/resume.any solution for this? 

hello, I need to restrict IPSEC VPN I need to connect only from UAEI Make this step but problem when I connect VPN (connection fine but no data send for example I cannot ping to any server or pc or login to FortiGate).

Hello all,  I am using Fortigate F60 in transparent mode at Homelab using DSLRouter as WIFR Router,DHCP Server and Internet GW with Static Public IP . Now I want to use Fortigate as Remote Access VPN, as per my basic Fortigate knowledge may be it not possible due to DHCP service are not available in tranparent mode.  Is there any possbility to configure Remote VPN Access in transparent mode. Regards 

I'm preparing to migrate from FortiEMS 7.2.10 to 7.4.4 in a test HyperV environmentI've downloaded and configured version 7.4.4. I don't have any Linux knowledge.Now I want to perform the migration steps.But I'm getting the following error during the first command:Error: unknown command "sudo" for "emscli"How can I enable sudo? 

If i have 2 internet link how we can configure sdwan policy to fullfill my below requirement- group 1 use link1 and will be switch to link2 if link1 have high latency or packet loss.- group 2 use link2 and will be switch to link1 if link2 have high latency or packet loss. in shortway i want to use best quality but also load balance. If we use only best quality for all users there will be bottleneck for one link and no traffic for another link.

FortiOS 7.6.4 released on 2025-08-21.I'm listing here some very interesting new features: 945633You can now use both FortiSwitch network access control (NAC) and 802.1X authentication on the same switch port. After a device is successfully authenticated with 802.1X authentication, the NAC user policy checks if the device is assigned to a specific user group. If the device matches the NAC user policy, it is assigned to a specific VLAN.1106711The FortiSwitch controller now supports generalized Layer 3 switch configuration for hybrid L2/L3 networks. This includes Switched Virtual Interface (SVI), Routed Virtual Interface (RVI), Virtual Routing and Forwarding (VRF), DHCP Server (with minimal configuration for isolated L2 domains), and IPv4 static routes, enhancing network management capabilities.1058743Auto speed negotiation on the 10G Base-T interface now allows the 1G/10G copper ports on the FGT100xF to automatically handle both 1G and 10G speeds and duplex settings, eliminatin

Hi,I am trying to install FortiClient 7.4 onto my Mac (OS 15.6.1) for the very first time.After downloading the dmg file and double clicking on it, the Installer window pops up.After double clicking on that installer to download the app, I keep getting an error saying, ''Can't connect to update server''How can I fix it ? I tried updating software, uninstalling and reinstalling the dmg file but it just doesn't proceed.Any help is appreciated Thanks a lot !

I had FortiClient VPN on my device - Windows 11. Since it was not connecting successfully to my VM today, I thought of uninstalling it and reinstalling it. The FortiClientVPNInstaller.exe file is downloaded successfully from https://www.fortinet.com/support/product-downloads#vpn, but running it as or not as administrator, it retrieves the image list successfully but fails to download the image at 13% or 21%. This takes at least 30 to 45 mins and it has been failing consistently since morning. The installer can't be download even if my device is connected to mobile data (change in networks doesn't help I mean). The same image file got downloaded on my colleagues devices in 2 mins (he is located in Mumbai and I am in Pune).The errors received is error in downloading image. Is there a solution to this problem? Is there an offline installer for FortiClient VPN only?Note: I had turned off firewall or antivirus to verify if the installer goes through, but it did not.

Hello all ,  I am using Fortigate 60F for homelab as below diagram. I want to connect all Wife users and LAN users using the same 192.168.0.0/24 network . How can I do Fortigate bridge mode for LAN and WAN Interfaces , if yes hhow can i achieve it . Thanks in advance for some valid reference.   

Hello,We’re running a standalone FortiGate 60F on FortiOS 7.4.7. Our setup has two WAN links:ISP1 = backupISP2 = primaryOur goal is to:Force all Microsoft Teams voice/media traffic (UDP 3478–3481 for STUN/TURN and UDP 50000–50059 for RTP) to always use ISP2, with ISP1 only as a backup.Make sure Teams voice traffic has higher priority than all other traffic on the network so call quality isn’t impacted during congestion.Since this is a standalone 60F, I know some advanced SD-WAN features may not be available. What’s the best practice on this platform for:Steering those specific ports to ISP2 (router-policy vs SD-WAN service match).Ensuring return traffic stays symmetric on ISP2.Setting QoS / traffic shaping so Teams traffic gets top priority.Any config snippets or guidance would be appreciated!Thanks,

hi,i'm moving an IKEv1 config from ASA to FGT.the crypto ACL or interesting traffic have 3x "inside" source loopback IPs (object "NETWORK_3") and 1x "outside" public IP 46.3.2.1, i'd assume this is the public WAN IP of the remote device/FW. access-list CMAP_ACL extended permit ip object-group NETWORK_3 host 46.3.2.1  <<< CRYPTO ACL/INTERESTING TRAFFIC crypto map CMAP match address CMAP_ACLcrypto map CMAP set peer 46.3.2.1  <<<crypto map CMAP set ikev1 transform-set TSET123 my questions are:1.do i configure in FMG phase 2 tunnel quick mode selector local and remote subnets as 0.0.0.0/0 and then configure the 3x "inside" loopback IPs and 1x "outside" public IP in the VPN FW policy in/out rule?   2.do i  still need to configure a host route for 46.3.2.1 to hop via virtual/phase 1 tunnel and also its blackhole route?  

I've cross checked the knowledge base multiple ways on this issue, and I'm can't tell if this is a setting or a firmware issue or just hard coded. Firmware is 7.2.11 on a Fortigate 80e I use the CLI console from the GUI often. Mainly I use it to SSH to switches and work in that manner. I do this because of company policies. But there is a very annoying feature that I can't seem to resolve. If the CLI Console in the GUI is idle for 50 seconds, I lose my connection. I have to press enter to start again. This can be very annoying when I'm connected to another device and trying to work. I've confirmed this with a stop watch and it will end the session 50 seconds after typing has stopped.  Is there a setting for this? Or was this just poor thinking by the engineers?

######Ubuntu 24.04: Forticlient VPN installation##### 1. Additional packages need to be downloaded in order to install Forticlient VPN: ## download libayatana-appindicator1 by scrolling to the bottom and clicking your architecture (amd64)https://packages.debian.org/bullseye/libayatana-appindicator1## download libayatana-indicator7 by scrolling to the bottom and clicking your architecture (amd64)https://packages.debian.org/bullseye/libayatana-indicator7## download libdbusmenu-gtk4 from this linkhttp://security.ubuntu.com/ubuntu/pool/universe/libd/libdbusmenu/libdbusmenu-gtk4_18.10.20180917~bzr492+repack1-3ubuntu1_amd64.deb 2.  Install these deb packagessudo dpkg -i *.deb## install libgconf-2.4 and libnss3-tools by running the shell script on this pagehttps://2h3ph3rd.medium.com/how-to-install-libgconf-2-4-on-ubuntu-23-10-fec6bda8d5f5## download the forticlient vpn deb package fromhttps://www.fortinet.com/support/product-downloads#vpn## install forticlient vpnsud

Recently, I have configured FAC to act as an IdP proxy for Azure for a gate SSL VPN. The primary objective is to use EntraID and EntraID MFA for all company users. In my lab environment, it works pretty well, but on the production endpoint (i.e., with enterprise-enrolled endpoints), it doesn't ask for MFA. It seems to be related to AzureAD PRT and appears to be an issue with Azure rather than FAC problem. However, I found that it is possible to send the forceAuthn=true attribute in the SAML request. Cannot find how to obtain it in FAC.Anyone have already facing the same problem ? Did anyone solve it ? Thx

For about 4 weeks now i have started to see some gaps in the Logs for forward traffic.some logs with the gaps are matched to IP's of user machines, but they are getting deny all as it cannot validate a policy against a user.FSSO is setup and looks to be working correctly, the only thing that has changed was a change of certificate that we were using for SSL Inspection as we reconfigured our NPS server.I am at a bit of a loss at what else to look at.

Hello,I would like to ask if there is a proper guide or recommended method for copying the exact configuration from one FortiGate device to another. Both devices are running the same model and firmware version. Will the license differences have any effect on this process? To clarify, the licenses were purchased separately, but they provide the same functions.My plan is to back up the configuration from the source device and then restore it to the target device. I also intend to configure these two units as an HA pair afterward. Before proceeding, I would like to confirm if this may cause any complications or if there are specific considerations I should be aware of.Thank you in advance for your guidance.

Hi, while configuring Tier 1 (Core) and Tier 2 (Distribution )FortiSwitch. I want to test 2 device ping each other, with the same vlan (for example VLAN2). Let say I don't want to mind the FG, only the L2 first. Do I need to set the VLAN2 with IP address to the Tier 1 (Core) and Tier 2 (Distribution) or it will work even if I set only to Tier 2. Thanks

The upgrade order is 7.2.8 > 7.2.9 > 7.2.11, but I accidentally guided the upgrade to 7.2.11 right away. Is there anything that could be a problem? These are 101F and 61F. Thank you

We're facing an issue where traffic shaping on our FortiGate 60F device doesn't seem to be working as expected.Despite setting up the necessary configurations, no traffic appears to be shaped — the system always shows strange current-bandwidth (diagnose netlink interface list) when monitoring shaping statistics. Same configurations works well on Fortigate 100E. At same time shared shaping and per-ip shapers works as expected on Fortigate 60F.The only thing that makes shaping profiles work on Fortigate 60F is disabling ASIC Offloading in the relevant firewall policy. But we wouldn't want to do that because all the traffic would go through the CPU.FortiOS version 7.2.9 - 7.2.11The real upload bandwidth is about 8 Mbps, but the system shows as 27kbps 

Hi, I was using FortiGate version 7.2 with SSL Full inspection mode, and all was good. Now I have moved to 7.6.4, the latest version, but I think the configuration goes differently. I have generated a CSR from (Certificate). And sign it through my local CA. Then import it as base-64. Then import it to my FortiGate. Now the certificate appears under my Local CA. When I go to settings, I'm able to use this certificate. But at the SSL/SSH Profile, I'm not able to use this certificate for my SSL Profile. Kindly let me know the right way to do SSL full inspection with a certificate that is signed by my local CA for version 7.6.4 

I am looking for assistance getting a multiple IPsec tunnel configuration working on a single WAN IP. Utilizing IKEv2 for Entra SAML authentication.  I have two IPsec configurations, each are configured the same with the exception of PSK and Local ID. Forgot one other note: The second tunnel is configured to use IPv4 Split-Tunnel. I can successfully connect to the "primary" one or the employee one I setup first. As long as my PSK/Local ID and DHG/Encryption in my forticlient is set correctly it authenticates and connects. If I attempt to switch to the Vendor intended tunnel and use that configuration, I get through Entra Authentication and it hangs and fails to connect.  Details120G running v7.4.8Using Forticlient free v7.4.3.1790 Hoping someone can point me in the right direction of what I am missing. I was really expecting the Local ID to make this simple to configure. I have tried changing Encryption & DH groups on the second tunnel phase1/2 (o

We are encountering an issue with upgrading our firewalls over cellular. During the firmware update the firewalls wwan connection drops and the firmware push fails. (hangs at 36%)Could this be related to the Modem firmware or is there a setting that needs to be updated to prevent this from happening?Are there any diagnostics to troubleshoot this issue? FGR-70F-3G4G 7.2.6b1575 -->7.4.7b2731LTE Modem EM7565 Firmware SWI9X50C_01.08.04.00 (Generic)Fortimanager 7.6.4 b3579

  Hi All  Just got a couple of the new FAP-23JK access points but I can't get them to connect to the local FGT-80E. SSID is in a Tunnels mode, the FGT-80E is running V7.4.8 and does have default profiles for the AP.After authorising the AP briefly shows as connecting in the FGT GUI then drops to offline. This repeats endlessly.  Other WAPs (FP221E) work fine.  I did a debug on the WAC application using (di de application cw_acd 0x77) and it looks like a DTLs issues but none of the DTLS options on the WTP profile make any difference. Debug output