Support Forum

hi everyone,running fortios 7.4 on fortigate 70g with sd-wan across three wans (all have fixed external IPs):isp1: cable internet (docsis, static config, no dhcp passthrough)isp2 & isp3: two separate 5g connections (fixed external IPs, but dhcp passthrough to the firewall, ip/netmask/gateway set automatically)the problem:isp2 & isp3 work perfectly — they show dynamic 0.0.0.0/0 routes and are fully used by sd-wan.isp1 needs manual ip/netmask and a static route. it shows “up” in sd-wan but carries no traffic unless both 5g connections are disabled.routing table shows isp2/isp3 dynamic routes at the top, while isp1 sits static and is ignored.isp1 says enabling dhcp passthrough on their docsis modem is too much work and would break their provisioning, so they won’t change it.questions:any supported way to make sd-wan handle static-only wan links?any cli tricks to make sd-wan treat that static route like a dhcp one?would upgrading to 7.6 help, or is this just a hard limitation?need

Dear All,I tried a lot but unable to register Fortigate with Fortimanager. Please note that I am using Fortigate Version: FortiGate-VM64-KVM v7.0.3,build0237,211207 (GA) and Fortimanager Version : v7.2.10-build1682 250211 (GA). FMG ========================================Fortigate to Fortimanager reachability is fine.FMG # execute ping 192.168.10.1PING 192.168.10.1 (192.168.10.1): 56 data bytes64 bytes from 192.168.10.1: seq=0 ttl=255 time=2.953 ms64 bytes from 192.168.10.1: seq=1 ttl=255 time=3.292 ms64 bytes from 192.168.10.1: seq=2 ttl=255 time=3.024 ms64 bytes from 192.168.10.1: seq=3 ttl=255 time=2.750 ms--- 192.168.10.1 ping statistics ---4 packets transmitted, 4 packets received, 0% packet lossround-trip min/avg/max = 2.750/3.004/3.292 msFMG #FMG # config system global(global)# showconfig system globalset enc-algorithm lowset hostname "FMG"set ssl-protocol tlsv1.0set usg enableend(global)# =========================================================== Fortigate=

i have firewall fortigate 201F version 7.6.3 cannot find SSL VPN configuration tried t

we have implemented a policy in the application filter to block the mobile category and applied application signature android block . However, access is still occurring from mobile devices. please help me resolve th issue 

 Hi,In FortiGate I blocked SSL traffic from outside the EU using local-in-policy. Now I would like to allow temporary access for a single AD user only, without enabling it for others.What is the best way to implement such an exception? Which solution is supported by FortiGate?Thanks in advance for your guidance! 

Hello,first time poster here so have mercy :) I am new to Fortinet but a long time security / networking administrator. I recently acquired a FortiGate 40F, FortiSwitch 108F and a FortiAP 221 to test it out and learn about Fortinet.  I am running into a stupid problem that I can't understand:  I would like to create VLANs on both FortiSwitch and FortiGate so that FortiGate is the gateway and DHCP-server on these VLAN networks. Furthermore, I would like to use the VLANs on the FortiSwitch so that I can use multiple ports on the switch on these VLANs, say port 1-4 has native VLAN accounting_VLAN and port 5-8 has VLAN printer_vlan, etc. I would also like to use 1 or more ports on the FortiGate on these VLANs if needed. But this does not seem to be possible, to create a VLAN and then tag the VLAN on both FortiGate and FortiSwtich ports? From what I can see now, if using VLANs on the FortiSwitch, I can't use these VLANs on the FortiGate ports and use the F

Hi,We have integrated fortigate with forticlient EMS, the remote access profiles and EMS tags are able to push on the forticlient successfully. We are having a scenario.In forticlient, after connecting the EMS through its IP, if profile didn't pushed and we manually enter the SSL VPN remote gateway and sends a connection request, it gets connected.Whereas we want to restrict it such that VPN will only gets connected once its profile will pushed from EMS, if we manually connect the SSL VPN, it should restrict. We have also implemented a scenario like VPN will only be connected once EMS gets connected, but now we have another challenging scenario which I had mentioned earlier. I request the seniors to please help out on this. Thanks

Hi Fortianalyzer VM running on v7.0.3 facing issue related to analytics logs exceeding the configured disk quota. It has been identified that one of our ADOM's is using more disk space for analytics usage than configured. In the Data policy - Keep Logs for Analytics is 60 days & Keep Logs for Archive is 365 DAys. I have enable alert and Delete When Usage Reaches 80%. How can I solve the following case, returning the analytics logs to the maximum configured size?

Hey guys. I've been having a problem with logs disappearing since I updated firmware version 7.0.2 to 7.6.2 for a period longer than a week. When a week of log collection "Incidents & Events > Event Monitor" is completed, the date of the first occurrence returns to 3 days ago, and we have much more logs stored than 3 days ago. I already ran the command to rewrite the sql, I got the logs from February 28, 2025 to March 7, 2025 (exactly one week). I would like to know if there is any way to completely restore from the beginning (I believe it is around May 2022) all the logs, including those from the Event Monitor session and for the logs to remain permanent. Below are some images of the problem.This is the collection after I ran the sql library rewrite command which lasted for 9 days, as in the image below.  Today (March 7, 2025), the problem with showing the logs appeared again and you can only see the events from 3 days ago as in the image 

how do i export the forti token users list in my fortigate?i have about 180 users in the list

Has anyone every migrated a VM based FortiAnalyzer from VMware based VM to something like proxmox? Can you install fresh on proxmox then migrate the data? Can I just do the VM migration and then figure out how to load necessary drivers? I promised I have searched a little and all I find is things about how to install a VM.

Home lab - secondary WAN (set to failover) changes IP address every month or two and Fortigate is dropping the connection even though set to DHCP. If I manually trigger it to renew it does instantly....shouldn't it do this without prompting? I only realize when I see that it's down. Today it may have caused some issues even though the main stronger Wan stayed up throughout.

Hello team, In our company we have two different environments behind two different Fortigates (both on 7.2).Both environments are reachable via SSL VPN using Forticlient. Is there a way to create an installer or deployable package (either .exe or .msi) that already has both Connections configured? So that at first installation the user already has in the drop-down menu both VPN Connections? We do not have EMS license, just firewall. thanks in advanceF.

Hi Everyone.I was looking for this problem involving the "1Password browser extension".Is there a function/method for Forticlient/FortiEMS protected endpoint to catch or block this kind of "Clickjacking"? Thanks in advance.Max 

HI all we have developed a tool using rest-APi for creating documentation on the configuration of a FortiGate. My question is has anyone else done this and if so what did you use. we used Python and API calls to populate a word document the details.  

Solved.

Hello everyone, I am trying to figure out if it is possible to use mclag and fortilink to connect the following devices together and how to do it. I have thought of two possible scenarios, but I am not sure if either of them is possible, so I am asking for your opinion. In the first case, I am afraid that I do not have enough ports 10gbit ports to create all link connection, while in the second case, I am afraid that it is not really feasible because I would basically want to have two independent tier1. I don't need guidance with the configuration, I just need help understanding which scenario might be the best one. The system will consist of the following devices, each with four 10Gb ports, which I would like to implement (using fiber SFPs to connect everything). 1x Fortigate FG-120G2x Fortiswitch FS-448E-POE2x Fortiswitch FS-424E-POE FirstHere I don't have the fifth 10Gb port in the 448s to be able to go from the first 448 to the second 424 and from the second 448

We are migrating our network infrastructure to FS1048e switches. We have some legacy equipment that  refuses to communicate at a port speed of 1Gbps. The transceivers we are currently using are FN-TRAN-GC. Copilot suggested FN-TRAN-SFP+GC, but the website it referenced is a third party site that doesn't give me much confidence in its accuracy. Our requirements for the transceiver are an RJ-45 connector, compatible with the FS1048e that can operate at a speed of 100Mbps. Has anyone else run into a similar need and found a working transceiver for the FS1048e?

We have been going through the process of setting up our Firewall to access Forticlient connections. All went well with connecting via just a Pre-Shared Key but we wanted to implement Saml using Entra ID. We went through multiple documents and have everything setup correctly (At least we think so). When we try to connect we get the popup to provide our credentials. After the credentials are submitted we are shown a <FQDN> server IP address could not be found. I made another connection using an external browser and when I make the connection I can see it sending the request to our Public facing IP address and then resolves to <FQDN>/remote/saml/login. The message in this window is 'can't reach this page'. There are Firewall policies setup to allow all traffic from the VPN Tunnel so we can verify that it works before scaling back but still does not work. The only thing that comes to mind is I read that the <FQDN> needs to be reachable from the internet. Ours i

Hi,I am planning to use ADC in transparent mode and would like to know if there are any limitations compared to L3 mode. I couldn’t find clear information on this.For example, are there fewer load-balancing methods or health check options available in transparent mode than in L3 mode?Regards, # https://docs.fortinet.com/document/fortiadc/7.2.4/handbook/592141/transparent-mode

Is anyone experiencing an issue with FortiClient VPN when 'Enable Local LAN' is checked with an IPSec configuration? For example, when 'Enable Local LAN' is checked, the VPN will not connect whatsoever. If so, what setting on the FortiGate needs to be changed in order for this to work?

Im asking because in the last three years i upgraded over 200+ fortigate 60E/F 100F and 500E and never had any issue. I always follow the upgrade path and do it through fortimanager. I have to upgrade some devices tomorrow and I got the bad thinking what would I do if the device does not get back up after reboot... Tell me your stories and how did you fix the unexpected upgrade fail?

Hi FNAC AdmisFortiNAC-F 7.2.9Ruckus ZD1200 v10.xThe WLC doesn't support CoA. So if I understand well the FNAC will send a RADIUS disconnect request in order to change the client's VLAN. But this doesn't happen.The test I've made is to fail the scan of the client. When the client is in wire network it is sent to quarantine, however when it is on WiFi it is not sent to quarantine and not even disconnected.Furthermore when the host is at risk and I try disconnect and reconnect to the SSID, it is put in the production VLAN instead of the isolation VLAN.Followed FortiNAC's "Ruckus Zone Director Wireless Controller Integration" document, but it doesn't mention anything about the issue and its resolution.

Hi Fortinet Team,I would like to know how to remove the OT SKU from the customer portal. I also want to clarify whether OT Security is no longer part of the Enterprise Protection plan, as I understand it has been moved to a separate bundle.In our company, we are not using OT services. However, when I log in to the FortiCloud portal under Assets, it shows some expired licenses related to OT Essentials. Could you please assist me in resolving this issue and guide me on how to remove the expired OT SKU from our portal?I have attached Photo for you reference  Thank you in advance for your support. 

Setting up a FortiGate for multiple distinct schools (30). Each requires custom web filters. We manage all sites under one VDOM. Configuring custom web filter settings were a category is blocked and they want to allow a specific site. Block social media but allow Facebook. Once a category is blocked, an allow does not work. So we started to create custom categories for web rating overrides. We must of hit the limit of custom categories "maximum number of entries has been reached", we have 52. Is there a way to increase that number per VDOM? v7.4.8