Support Forum

Greetings I have recently got a second hand FortiGate 200D and because it was out of use for a couple of years the login and range is unknown. I tried to manual reset it but no luck and I cant discover the device I have tried multiple possible ranges. The device is not under support contract is there a way or place where I can download FortiOS to try and flash the device to factory settings with a usb? Thanks in advance

Hey thereHow do you handle port security?Currently i use NAC Policies with Switches. Earlier i did also MAC Whitelist for dhcp Reservation, but it consumes to much time.Also in the automation we have if a switch port changes MAC it send an Alert mail to us.The nice thing is, if we replace the switch, user can just plug all cables random in it and the NACs kicks in.

Hello everyone,I’m currently working on improving our guest WiFi captive portal logging on a FortiGate firewall and I’m trying to determine the best way to capture and later locate guest users if needed.Current SetupWe are using a FortiGate email collection captive portal for guest wireless access.I have customized the HTML replacement message so that the portal now asks for:Full NamePhone NumberEmail Address (existing FortiGate %%USERNAMEID%% field)The page functions correctly and users must fill in all fields before connecting.GoalThe main objective is to be able to identify a guest device later if there is a security or abuse issue.Ideally we would like to log the following information:NamePhone NumberEmail AddressDevice MAC addressIP addressDate/time of connectionThen be able to search FortiGate logs later to locate the user associated with a specific device or activity.QuestionIs there a supported way in FortiGate to log additional captive portal fields (such as name and phone num

Hello everyone,I need to perform a migration from a FortiSandbox VM (version 5.0.5) to a FortiSandbox 1500G hardware appliance (version 5.0.5).Does anyone have an official guide or documentation that explains the migration process from VM to hardware?I would also appreciate any technical tips or best practices for this type of migration.Additionally, are there any specific considerations or limitations that should be taken into account during this migration?Thank you in advance for your help.#FortiSandbox

Hello, Is it possible to customize the mail that will be sent to the user as soon as I provision a token to him? I didn't find an answer for that in the doc or this forum. Thanks in advance!

Hi,is there any possibility to modify the mail's text and languange, other than the ones used for the approvals?Thanks#fortiPAM 

Hi everyone,I have a design question regarding connectivity between two FortiGate HA clusters.Currently, I have two FortiGate clusters configured in Active-Passive (A-P) mode. Instead of directly connecting the clusters, both are connected through a Cisco Core switch (Layer 2) using aggregated interfaces (port-channel). Under these aggregate interfaces, multiple VLAN subinterfaces are configured.Only one cluster (FG1101E) has a public IP address and is responsible for Internet access.The other cluster (FG100E) does not have a public IP and must route Internet-bound traffic through the FG1101E cluster.Additionally, some VLANs on both clusters need to communicate with each other (inter-VLAN/inter-cluster traffic).Given this setup, I am considering two design approaches:Assigning IP addresses from the same subnet on the aggregate interfaces of both clusters and using static routes.Running OSPF between the two clusters for dynamic routing.My main goal is to simplify routing, reduce the num

Hi, We are seeing a cross section of users getting the message, "Network error. Can not connect to vpn server." while trying to connect to VPN using FortiClient SSL VPN "free" version 7.2.12 and 7.4.3.  The "fix" has been to downgrade them to an earlier version of the FortiClient (ex. 7.0.12).  For some users it works fine connecting on the newer versions, for some it does not.  Anyone else seeing this?

Hello,we have implemented FortiAuthenticator, but we have noticed that the emergency token only works when the PC is not connected to the FAC. Is there a way to perform an emergency login if someone forgets or loses their token? Are there fast recovery systems available?Thanks to anyone who can help me.

There is no EOS date for 601E equipment on the support site, is it still not decided?

We are currently using the FortiClient Windows free VPN client version 7.4.3. It has come to our attention that CVE‑2025‑62676 is reported to affect FortiClient Windows 7.4.0 through 7.4.4.Could you please confirm:Whether this CVE affects the latest free 7.4.3 build we are using.If a fixed build or patch is available for the free VPN‑Only client to mitigate this CVE.Whether Fortinet will continue to provide security updates for the VPN‑Only free client and how we can obtain any patched binaries if required.Thank you!

Hi Fortinet community, Good day and greetings! I would like to seek for your kind advise and suggestions. I have this pending changes on my managed fortigate and everytime I try to install it, it's giving me error.I cannot locate and track these policies.  ++++++++++++++++++++++++++++++Starting log (Run on device)  Start installingFIREWALL-1 $  config vdomFIREWALL-1 (vdom) $  edit rootcurrent vf=root:0FIREWALL-1 (root) $  config firewall policyFIREWALL-1 (policy) $  edit 1FIREWALL-1 (1) $  set uuid aaaaaaaaaFIREWALL-1 (1) $  unset actionFIREWALL-1 (1) $  unset srcintfFIREWALL-1 (1) $  unset dstintfFIREWALL-1 (1) $  unset srcaddrFIREWALL-1 (1) $  unset dstaddrFIREWALL-1 (1) $  unset scheduleFIREWALL-1 (1) $  unset serviceThe attribute can't be empty!command_cli_unset:6496 clear MEMBER table oper error. ret=-56Command fail. Return code -56FIREWALL-1 (1) $  unset utm-statusFIREWALL-1 (1) $ 

Hello,I’m looking for guidance on best practices to handle configuration rollbacks when working with FortiManager Cloud.In my current setup, I created an SD-WAN Overlay Orchestration with all the required configurations and assigned it to specific sites. Now, I need to remove or roll back that configuration (for example, deleting the overlay or reverting changes), and I want to understand the safest and most recommended approach.What would be the best way to handle this scenario?Thanks!

Hi All  I upgrede my Fortigate 80F to 7.0.6 and now my GUI is not working. I did a rollback to the the previous one and still having the same issueI got the warning about a non trust cert on the browser. Once I accept and , the login page is never display here is output of the debugFortiGate-80F # diagnose sys process pidof httpsd1235 Any ideas?1403140514061407140814091410    FortiGate-80F # [httpsd 1403 - 1660398975 info] fweb_debug_init[409] -- New GET request for "/api/v2/monitor/web-ui/extend-session" from "24.232.150.82:65512"[httpsd 1403 - 1660398975 info] fweb_debug_init[411] -- User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0"[httpsd 1403 - 1660398975 info] fweb_debug_init[413] -- Handler "api_monitor_v2-handler" assigned to request[httpsd 1403 - 1660398975 info] fweb_debug_final[298] -- Completed GET request for "/api/v2/monitor/web-ui/extend-session" (HTTP 401 Unauthorized)[httpsd 1410 - 1660

Hi all. I have an issue with one "dynamic" enviroment [dynamic it that sense that network admins are changing PC and other equipement adresses quit eoffen] that in Asset Identity Center on Fortigate (7.4.11) assets attributes like Address stay as they was identified on the first recognition. Address (ip address) is not changing in database.  It is a little bit frustrated,because that functionality is used by admins to recognize assets connected to FortiSwitches port and in general to find where device is and how behave.  How asset identity center update works?How to trigger asset attribute change? Of course i found otpion of remove assets from database, but it is done manually and hard to do that for specific devices.

I'm deploying an SD‑WAN configuration with BGP over loopback across my infrastructure.Some spokes have only one WAN link, while others have two.After configuring the dial‑up VPN on the hub (which only advertises the 10.200.0.0/16 network), and after creating the loopback interface used for BGP and the loopback used for health‑checks, I proceeded to configure the spokes.Unfortunately, I ran into the following issue on the spokes that have two WAN links.After creating the SD‑WAN rule that instructs all LAN traffic destined for the hub network (10.200.0.0/16) to use the VPN with the best latency, and after correctly configuring the SLA targets, only one of the two VPNs is detected as UP in the SLA targets.The second VPN never shows as UP.From my checks, it seems that only the first VPN is considered UP, because it is the only one responding to the SLA target ping.This makes me suspect that there may be a missing configuration command related to BGP or VPN on the spokes.Below is the config

Hi, I upgraded my Forticlient EMS to the 7.4.5 version and now i can't access to the web portal. When i try to run the command "service restart --all" in the linux console i have the next error:get services status: start apache2 service: exit status 1exit error: [exit status 1], exitStatus: 1Can someone help me with this issue please?

I want to update my FortiNAC 500F (from 7.2.4 to 7.4 ) ,are these steps correctI tried all the protocols 

Hi, Since my upgrade from 7.2.9 to 7.2.10, I encounter somes difficulties to access certains parts of the GUI.I reach access to the firewall after a lot of time (5 minutes).I can't upgrade to 7.4.X because the GUI crash too (No upgrades available).Is there any way to solve this problem ? (Probably WebSocket). Best regards 

Hi All,I am having some strange issue. Set up is a Hub and Spoke SD-WAN network and 120G cluster work as the hub 100F and 60F nodes are the spokes. Only 3 spokes have.(2x100F,1x60F).All the firewall OS version is 7.2.11 While working on the firewalls, not every time but can not say an exact time the GUI is going unresponsive. All the GUI getting freeze and when refresh, URL is searching on a white page.After sometime it got normal again.This issue not only happens when accessing the firewall from the public IP but the LAN IP too.This is not specify to one firewall. All the ones gave this issue time to time. But during this time period i can access the firewall by SSH and no traffic interruption. Firewall works fine without any complain. No RAM or CPU peaks even. TAC said even debug https also could not find any issue.A custom port is used for https and that port also open for the firewall accessing IP during the issue time. In the OS release note also i could not find th

I want to update my fortinac 500F from version 7.2.4 to 7.4.x , when i try to ping the host update.fortinet.net to test if it's reachable or not it failed

Hey,we have FortiClient EMS (Linux) running at version 7.4.5 build2111 (Mature)And recently we installed a small independent elasticsearch cluster that's only supposed to get the FortiClient Endpoint Events. The FortiClient EMS Administrator Guide is not helpful at all at explaining how to get EMS to connect to that elasticsearch cluster. It keeps complaining about the CA certificate:2026-03-18T15:07:43.445Z ERROR service/event.go:103 create indices: create all indices: check if index forticlientems_alerts_745-write exists: an error happened during the Exists query execution: tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "Elastic Certificate Tool Autogenerated CA") I used the emscli to give it the proper parameters including a path to the certificate, imported it to the ubuntu trust store and tried every possible way I can t

Probably since thursday when our VPN (Forticlient 7.0.7.0245) is connected we have assigned local DNS but when trying to access or ping some internal services/servers it doesnt resolve. Tried using command below and got our local DNS serverscutil --dns | grep 'nameserver\[[0-9]*\]'when I use nslookup with hostname it also does resolve to IP. Any ideas what could be wrong? Thanks,

 Hello,I would like to share an issue we are currently experiencing with a FortiGate HA cluster after upgrading to FortiOS 7.6.6. I'm also interested to know if anyone else has encountered similar behavior.Environment:2× FortiGate 200FHA cluster originally running in A-A mode550 firewall policies40k sessions/s during peakUTM enabled (AV, IPS, Web Filtering, WAF)Full SSL inspection500 users20 site-to-site IPsec IKEv2 tunnels50 IPsec dial-up users (IKEv2 + SAML via Entra ID + MFA)FortiClient EMS 7.4.5FortiAnalyzer 7.6.63 Gbit internet connectivityBefore the upgrade:The cluster was running on FortiOS 7.4.11 and had been completely stable for a long time.Upgrade timeline:Upgraded from 7.4.11 to 7.6.6 on Saturday (21 Feb 2026).Everything initially appeared to be working correctly.On Monday around 11:00, when normal traffic load started, the first cluster failure occurred.Observed symptoms:The failures appear to start with HA communication issues (HA ports dropping). Shortly after that

Hi everyone! I am posting this again because for some reasons, my previous post was tagged as spam. I cannot push my installation on my fortigate firewall via fortimanager. It is giving me this error. No one among my team is aware who did the last config but they are certain that no one did this type of change. Most of the error is thiscommand_cli_unset:6496 clear MEMBER table oper error. ret=-56 For further logs, please refer to the attached image fileThe logs read from left to rightIf the image is un-readable, let me know for anyone interested and i will forward the actual logs text file Regards,Renz