Support Forum

Dear Team,I am interested in taking the FCP - FortiGate 7.4 Administrator exam, which expires on September 30. If I pass it and then take the FCP - FortiManager 7.6 Administrator exam after September 30, will I be able to get certified as a Fortinet Certified Professional in Network Security?Thank you

Hello everyone, I have requirement to allow only YouTube for one device. What is the best method to do it? can anyone confirm this method is right? 'How to allow YouTube videos while blockin... - Fortinet Community'

hi,i can't seem to monitor the IP NAT pool utilization both from the 'IP Pool' section and adding widget in dashboard. i waited more than 10 mins but still no output.does it need a fortianalyzer to make monitoring work?  ip pool GUI section:  dashboard widget:

Hi All,I am running FortiClient ARM64 on my Windows CoPilot+ PC (Lenovo). I have gone through the wizard on the firewall to setup my FortiClient IPSec connection and all seems well there. When I try to connect, FortiClient tells me that the connection timed out. However, on the Firewall itself (60F), I see that the negotiation failed with "peer SA proposal not match local policy" listed as the reason. I followed the wizard to create a FortiClient IPSec tunnel, verified the policies were added to allow access to my local network, added a policy to allow access to the internet (I don't want split tunneling). Any thoughts on what I might have done incorrectly?

Regarding the VRRP-redundant network device (FortiGate 60F) connected to the HA-configured FortiGate 200F (7.0.5), the setup involves the primary 200F connected to the master 60F, and the secondary 200F connected to the backup 60F. Ideally, when the master 60F experiences a failure, communication should occur between the secondary 200F and the backup 60F. However, according to the 200F management interface, the relevant interface appears to be down.Attempts to enable/disable the interface and static routes have not resolved the issue. Could you please advise on possible solutions?

Some office users have been experiencing intermittent Wi-Fi connectivity issues in some areas during peak hours.Affected users may lose access to network resources for a couple of minutes when it happens.Users are being disconnected randomly from the wifi while sitting and are unable to connect again unless they move their location My setup is:1*FirewallForitgateFG201F22* ForitgateFortiAP431GNot Assigned1*SwitchForitgateFS-148F-FPOE  The logs : date=2025-09-04 time=13:52:14 eventtime=1756979534438448503 tz="+0400" logid="0104043581" type="event" subtype="wireless" level="notice" vd="root" logdesc="Wireless client WTP disconnected" sn="FP431GTY23046095" ap="AP-YM-AP14" vap="WLAN-USERS-SSID" ssid="My-SSID" radioid=2 user="N/A" group="N/A" stamac="1e:da:47:7b:8e:67" authserver="N/A" srcip=0.0.0.0 channel=36 radioband="802.11ax-5G" signal=0 snr=0 security="WPA2 Enterprise" encryption="AES" action="client-disconnected-by-wtp" reason="4-Way Handshake timeout" mpsk="N

Bonjour à tous . Je me prépare pour la certification Fortigate Administrator 7.4. j’aimerais avoir des conseils, des dumps (si possible). c’est ma première certification et je veux la réuissir

Helloi'm tryng to set active all log to see the traffic outbond the lan.I have set how you see in image but all log view are clear.I'd like to set the logo on USB device (if possible)I have a fortigate 60FThanks

HiI have a new Public Certificate and need to upload it to FortiManager VM 7.4.5I select the certificate and private key, enter the certificate name, enter a password and click OK.  Then the certificate page refresh but the new certificate it's not there.  No error message appear. I was able to upload the same certificate files to FortiAnalyzer, so the certificate is good.

Hi All, Going to push out a policy on one of our FortiGates running 6.0.8. Our FortiManager is running 6.2.3 but this FortiGate is in a 6.0 ADOM. This is the error I get: 2020-03-19 11:22:43:post commit check fail: members volume-ratio- 2 0 - out of range - prop[volume-ratio] : value 0 out of range (1,255)2020-03-19 11:22:43:post_vdom copy error:members volume-ratio- 2 0:(errcode)-999 - out of range - prop[volume-ratio] : value 0 out of range (1,255) Thanks!

Good morning, everyone! I have a FortiGate model 100F, version 7.4.7. I configured an IPsec VPN on it for employees to connect via FortiClient. I created the FSSO connector, which brought the groups, and I created the LDAP connection (tested and validated). What happens is: in the VPN policy I created, when I add the group from AD, when I try to connect, it displays an error and won't connect. Looking at the logs, I saw an error called FNBAM_ERROR. What could this error be? Thank you.

Greetings, I'm working for an IT system house, and we are currently in the transition from SSL VPN to IPsec. The biggest issue we are currently facing is that we have used the SSLVPNcmdline tool integrated in our support software to connect to our numerous customers. Now I'm wondering if there are any alternatives we can use with IPsec?

Currently using the latest Forticlient version 7.4.3.1790. Connection established but after a second the Forticlient application crashes/shutdowns automatically.

Hi,I have 3 FortiExtenders (FXT311F-v7.4.6-build25) connecting to my FortiGate 100F (7.4.7 build 2731)via their lte1 interface. They are all showing in the FortiExtenders section - can see their wan ip address and perform basic diagnostics. The are all using the default lan extension profile and ipsec tunnel.I have policies configured to enable them to access my local lan etc.The problem is that the IPSEC Tunnel just never comes up  - there is very little information out there relating to the Extenders so hoping someone on here can shed some light on how to fix this issue. Regards

Hi everyone,Perhaps somebody has the same problem or know how to deal with it. I have a used FortiAP 321c. I also have FortiKey and registered device in FortiCloud. It should be connected directly to the Ethernet. To set up the connection, router need to remember the username and password of the network. I tried to find such options, but without any result.It doesn’t work through Wi-Fi too. When it is connected to the Ethernet at first, all indicators are becoming green, after that LAN indicator is still green, but the Wi-Fi is turning for another 15–20 seconds yellow, and then stops gloving. Wi-Fi can’t be found by searching. So, I can’t set it up all.Could you please help us to set up this router and the Wi-Fi connection through it?Thank you in advance.

Hello, We have been testing IPsec dialup connections using autoconnect and Entra ID credentials and so far it has worked pretty well. One area of concern is how to exclude situations where we may not want the auto connect to kick off (IE, local admin login or a user login that is not a member of the VPN group). We are using EMS to configure FortiClient on Windows devices. We have the VPN tunnel configured for auto connect only when off-fabric which covers a majority of these one off situations but is there a better way to exclude users/situations from the auto connection? Maybe something like "stop auto connection after 3 failed attempts"? We have always up max tries set to 3 but this seems to only cover reconnect attempts. Another thought was creating an additional remote user group on the firewall as a "catch all" group for users who are not members of the defined VPN groups and allow them to establish a vpn connection but  go out the WAN only. Local accounts off-

After upgrading the firmware of a Fortigate 200F in an HA configuration from 7.0.5 to 7.2.2, the HA synchronization was lost. Ideally, we would like to upgrade all the way to version 7.4.3. Please advise on how to resolve the issue if synchronization breaks, and whether there is an upgrade path that avoids this problem.

After upgrading the firmware of the FortiGate 200F in an HA setup from 7.0.5 to 7.2.2, the VPN tunnel configuration was lost. Ideally, we would like to upgrade all the way to version 7.4.3. Please advise on how to prevent the VPN tunnel settings from being erased during the upgrade, and whether there is a recommended upgrade path that avoids this issue.Additionally, the FortiGate 200F is connected to a media converter (ONU) provided by the ISP on the WAN side. Before the upgrade, the device was able to automatically obtain an IP address even with the interface set to 0.0.0.0. However, after the upgrade, it no longer receives an IP address.We reverted the firmware to the previous version and restored the backed-up configuration, but the IP address is still not being assigned. Although the configuration matches exactly with the pre-upgrade state, we suspect that some internal setting may have changed.We would greatly appreciate your guidance on how to ensure the VPN tunnel settings are p

After updating the firmware of the Fortigate 60F from 7.2.2 to 7.2.4, I encountered that SNMP responses stopped coming from the interface configured on the non-managed VDOM.The configuration is as follows: SNMP server → Managed VDOM → Non-managed VDOM (SNMP target interface).The administrator's trusted host is also registered with a /32.The firewall policies between the VDOMs are verified to be correct. No changes were made during the update.Additionally, I have configured the set vdoms as described in the URL below, but nothing has changed.https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Configure-SNMP-in-multi-vdom-to-send-trap-to/ta-p/398884 When checking the communication logs in the managed VDOM, allowed communication from the SNMP server IP to the SNMP target interface is visible. However, in both send and receive directions, the received byte count is 0B.Using a sniffer in the managed VDOM, no response packets are observed.Similarly, a sniffer on the non-mana

some clients cant get auth.   2024-12-16T09:18:21.114057+01:00 FortiAuthenticator radiusd[12310]: Waking up in 28.7 seconds.2024-12-16T09:18:23.758246+01:00 FortiAuthenticator radiusd[12310]: Waking up in 0.3 seconds.2024-12-16T09:18:23.758261+01:00 FortiAuthenticator radiusd[12310]: (6) Received Access-Request Id 89 from 172.16.1.249:38059 to 172.16.1.250:1812 length 1202024-12-16T09:18:23.758268+01:00 FortiAuthenticator radiusd[12310]: (6) User-Name = "host/war-l-glub"2024-12-16T09:18:23.758272+01:00 FortiAuthenticator radiusd[12310]: (6) EAP-Message = 0x020700060d002024-12-16T09:18:23.758275+01:00 FortiAuthenticator radiusd[12310]: (6) NAS-IP-Address = 172.16.1.2492024-12-16T09:18:23.758280+01:00 FortiAuthenticator radiusd[12310]: (6) NAS-Port = 52024-12-16T09:18:23.758284+01:00 FortiAuthenticator radiusd[12310]: (6) NAS-Identifier = "3460F9DAC3EE"2024-12-16T09:18:23.758288+01:00 FortiAuthenticator radiusd[12310]: (6) Service-Type = Framed-User2024-12-16T09:18:23.7582

I am using a generic cisco style USB to serial cable to gain console on a 60F. The host in a small raspberry pi. This works fine except when the FortiGate is rebooting. Between "Restarting System" and "System is starting..." the console reads garbage.I have used both minicom and picocom. Basically they give different garbage, with picocom being more resilient. It is particularly interesting that the problem is only for the duration of the boot loader output. Without interrupting the console connection it is working to begin with, then the FortiGate bootloader spits out garbage, and then once the OS itself starts the output is normal again. Which is a pity because that's the point of rebooting via console, we prefer to format our units and then TFTP our production OS onto a clean unit. The idea behind a raspberry pi is a small unit we can ship around that provides both the tftp server and can easily handle multiple console cables (for initial build and working on clusters).&nb

I don't know if this is the correct place to post this but we found a possible bug. We had our test IPSec Dialup tunnel successfully setup and routing rules implemented. Last week our team started converting the setting from our test setup to how we want our production settings to be. During this process the team changed the PSK, Peer ID and name of the VPN tunnel. After these changes were saved traffic no longer was being routed to the correct destination. I found that DNS queries were traveling down the tunnel and traffic was being denied. We changed everything back to the way it was during testing and there was no change to behavior. Everything was still being blocked. Then I was reviewing the interface for the VPN tunnel and noticed that the 'Security Fabric Connection' was still checked from a previous test we were working on. I unchecked the box it okay and all traffic for the VPN tunnel started routing correctly again. So I went back to the VPN tunnel and changed

Just need a little validation check against something I am implementing yet feel like I am losing something as well. What I mean by that is, I have in my environment, an edge firewall (this is where my users get their primary Internet from), a core firewall (that is acting also as my core router for my private WAN and firewall for my datacenter servers), and my site firewalls. Most of my security inspection is happening at the site firewalls. Since those traffic flows have now been inspected at the site level, I had no inspection for that traffic at the core if it went to the edge, again with no more inspection at the edge (only inspection was for some segmented VLANs off the core to my datacenter servers, etc...). Now that I want to implement QoS/traffic shaping on some traffic (Apple and Microsoft blowing up my bandwidth), my assumption is that I am going to have to implement traffic shaping also end to end... so edge, core, and site. Am I thinking correct on this? I feel like t

Hello everyone,My internet service provider has given me a pool of public IP addresses ranging from 193.x.x.2 to 193.x.x.5 with gateway 193.x.x.1.Now I have two problems: basically, the network configuration at the moment is that the router, which is the LAN network from 192.168.88.x, is connected to the wan1 port of my fg100f.Despite having this pool of addresses, I access the Internet as 84.82.x.x and cannot figure out how to access it as 193.x.x.1. The second problem is that I do not know how to directly set the IP address 193.x.x.2 on the WAN1 port of my Fortinet fg100f.Does anyone have any advice on how to solve these problems?Many thanks in advance.

Hello! The issue I'm seeing is that FortiClient will connect from the my home network, but the connection drops immediately.  sslvpn.log says this:20250829 10:08:18.570 TZ=-0400 [sslvpn:DEBG] vpn_connection:3447 Start IO loop20250829 10:08:18.573 TZ=-0400 [sslvpn:INFO] main:1781 State: Connected20250829 10:08:18.605 TZ=-0400 [sslvpn:EROR] vpn_connection:1316 IO write remote failed. SSL error: 520250829 10:08:18.605 TZ=-0400 [sslvpn:EROR] vpn_connection:2290 Error: Disconnected because of error: IO write remote failed.The odd part was I went to random public wifi hotspots...and it was able to sustain a connection. Forticlient on other computers (windows though, don't have another linux one) didn't have a problem from this network. It did work for several months before this issue happened, so it doesn't seem to be something with the network.   I was able to get it to connect once by changing the IP range of the network, i.e. what the DHCP handed out. (192.168.x.x to 1