Support Forum

Hello all, I am currently setting up 802.x1 EAP-TLS authentication on an external cloud radius server on my FortiSwitch 448E-POE (Fortilink) and am experiencing a minor issue.Basically, I wanted to do this via TLS TCP (RadSec).I noticed that the FortiSwitches only send the packets as UDP. Presumably, the current FortiSwitch FW S448EP-v7.6.2-build1085,250526 (GA) does not support TLS over TCP, is that correct? In any case, there is no mention of “set transport-protocol tls” in the radius profile on the switch.The FGT with FW v7.6.3 build3510 (feature) seems to support this; at least, I can see that the packets are sent as TCP and they also arrive on my RADIUS server.In any case, I have now adjusted the RADIUS client so that it performs authentication via UDP on the RADIUS server. The query is also successful and arrives at the RADIUS server.The problem is that when I try to authenticate on a port of the FortiSwitch, no packets arrive at the RADIUS server. In debug mode, I can see t

Hi everyone!, I'm currently facing a problem with DDNS associated with fortiddns.com. The service isn't updating and returns an update error. Additionally, when I attempt to edit the configuration, no servers appear as available. This started after the DNS incident. I have another FGT 100F with the same configuration and it's not experiencing the issue. Has anyone else run into this problem?Any insights or suggestions would be appreciated.best regards! 

Hello there I have F60C v4.0,build5849,110804 (MR2) I noticed that there is the USB port to load configuration or to backup configuration. Could you please tell me if I can attach an external USB disk to increase details and size of logs and reports? TIA

Hello, Fortinet newbie here.I am trying to migrate our campus network from a collapsed Dell core on S series switches to a Fortinet core with two Fortigate 601F  in HA and two FortiSwitch 2048 in MCLAG. My plan is set up VRRP on the FG601 to join the production network and eventually make the HA  the primary router and take over the network. After I created the vlans and VRRP, like this:FortiGate-601F # config system int   edit "VLAN4"set vdom "root"        set description "WAC_1st_Flr"        set vlanid 4        set interface "fortilink"        set ip 172.16.4.4 255.255.255.0        config vrrp            edit 1                set vrgrp 4                set priority 25                set vrip 172.16.4.1  &nbsp

I would like to get FortiClientVPN 7.4.1 or 7.2.5. Could you please tell me the link?

Hello I have a Lenovo with windows 11, the version 7.4 of Forticlient VPN do not work, so I have install the version 7.2.4.0972At this moment the problem is the conenction stuck at 98% and than stops.I take this info from sslvpndeamon. log[2024-07-01 15:23:01.0858060 UTC+00:00] [10656:10652] [sslvpndaemon 1343 info] (Time Zone: GMT Standard Time) (Fri Mar 1 19:40:58 2024, 58s) 2024-07-01 15:23:01.071 type: 0x1ff size: 128 memory: 0x0000000000000000[2024-07-01 15:23:01.0858261 UTC+00:00] [10656:10652] [sslvpndaemon 641 info] sslvpn daemon is started[2024-07-01 15:23:01.0861140 UTC+00:00] [10656:8736] [sslvpndaemon 501 debug] GetAdapaterFullDNSRegistrationEnabledListFromRegistry() called. vpnType: 0[2024-07-01 15:23:01.0861521 UTC+00:00] [10656:8736] [sslvpndaemon 501 debug] Key AdapterFullDNSRegistrationEnabledList does not exist.[2024-07-01 15:23:01.0861603 UTC+00:00] [10656:8736] [sslvpndaemon 501 debug] AdapaterFullDNSRegistrationEnabledList size:0[2024-07-01 15:23:01.0918392 UT

I am pulling my hair out (what little I have left).  I recently upgraded subscriptions with FTG for web filtering.  When I did, I could no longer access my Cisco switch web interface.  Full disclosure, I am a novice.  The swtich is passing traffic, and I can see it as an Device Asset, with an assigned IP (which I have set as static), as well as the identified MAC address for the device.  I however could not get the web interface to connect since upgrading the web filtering.  I went ahead and used the MAC address to assign it a Static IP in the FTG on the internal interface.  (the IP was set on the cisco before we lost our ability to connect).  The device is listed as an asset, but from the DHCP page, it doesn't show the IP as registered, reserved, nothing.  Just missing.  I can't connect to it from our file serve computer using Chrome or Safari (mac environment).  Curious, I used another work station on the same subn

Hi everyone,I've downloaded FGT_120G-v7.0.17.M-build7572-FORTINET.out, and after I upload it to my appliance, it shows an incorrect build number. I Uploaded a screenshot. Can anyone help 

I have a problem with VPN IPSec/IKEv2 with domain user authentication. The tunnel itself and the connection to it work fine, the only problem occurs when the user is blocked and logs in again using prelogon. On the first login attempt, the message “unable to connect to VPN...” appears. , and on the second attempt does it connect to the VPN and log me into Windows. However, the VPN itself disconnects for a few seconds, forcing me to log back into the application and servers. Is there a way to allow prelogon VPN to log in after blocking a user without disconnecting from the VPN?

So we trying to setup a new Dialup IPSec tunnel but we keep getting a connection time out message. We rebuild the tunnel and policies multiple times thinking we missed a step but from the videos we found online this should be the simplest thing to do. I can see the traffic make it to the firewall and I see in the local traffic logs that the traffic is denied (even though we setup local-in-polices) to allow the IKE traffic.  So we are stumped and we are hoping that we are missing something simple that a more experienced person setting these things up might clue us in on. Our firewalls are running 7.4.8 and we are running Forticlient 7.4.3 (We've also tried 7.0.9 and 7.2.9 since some posts we stating older versions worked vs the latest version). I feel something is blocking the traffic on the Firewall I'm just not sure what it could be. Thanks for all and any help. Phil

I’m fairly new to FortiAnalyzer and need to investigate if any users have accessed certain domains over the past several months. I have a list of domains and subdomains (e.g., example.com, sub.example.com, etc.), and in some cases I only have wildcard formats like *.example.com.I need to find out:Which user has accessed these domains Or which device/source IP generated the traffic or had any session with those domains.What’s the best way to search in FortiAnalyzer using just domain names or wildcards?Should I be looking in Web Filter logs, DNS logs, or Forward Traffic logs?Thanks in advance.

Am hoping someone can shortcut me to a solution. About a year back we moved to a new office, introduced a new FG120G firewall, logs are sent to our existing FAZ-VM running v7.6.3 firmware.Because of PCI DSS Compliance we have a custom report which is supposed to give us a list of potentially harmful WiFi APs in/near our environment. That report does give me some data. e.g. a list of APs detected with a signla strength greater than -75dBm.However the report also used to give data about On-Wire and Off-Wire APs, those which I had classified as Accepted, those which were designated Rogue, etc. That data came from built-in Charts / Datasets from some previous version of the Fortianalyzer.At some point since we left our old office (about 3 years ago) and getting our new office (about 1 year ago), these built-in Charts / Datasets apparently just stopped working. It appears to me that all the On-Wire, Off-Wire, etc charts/datasets have just stopped producing data.Has anyone noticed and/or tri

I've inherited a site that has a mish mash of different cameras all around the place including about 50 FD-20's (which appear to be pretty ancient)We're standardising on Ubiquiti at the moment, so have an ENVR where the rest of our cameras live and the question has come up about integrating the existing cameras into the recorderFrom what I can tell by the documentation and what I can see in the firmware, they should support ONVIF but I cannot for the life of me get them to work. I have FD-50's that adopted straight awayHas anyone managed to make them work? Is there a special trick?I tried probing around for the URL for the onvif metadata but no luck and support just flat out doesn't respond...

Is there any expiry for the evaluation license of FG firewall on Hyper-V?

Hi community,I have the following VoIP setup:Avaya IP Office v2 --- FG-80F --- ISP1 / ISP2 (SD-WAN)My goal is to configure a simple failover, where the FortiGate automatically switches to the secondary ISP if the primary link goes down.However, I’m running into the following issues: With SIP helper / SIP ALG enabled:Once the SIP communication is established (INVITE, ACK, etc.), the SIP ALG forces the voice traffic to go out through the failover link (ISP2), even though it should stay on the primary.This breaks the voice session.I’ve tried separate rules and SD-WAN policy routes, but the issue persists. With SIP helper disabled (no ALG):The SIP/SDP packets are sent out through the correct WAN link.However, the SDP headers are not NATed and still carry the LAN IP address.As a result, packets reach the destination but the remote side cannot reply. Has anyone faced a similar scenario?I solved this problem configuring the wan ip on the avaya but just can set 1 of them so if m

FortiSASE is pointing only default profile so only one user group working through Radius Server it is not pointing second profile user group? Can anyone help me on this issue. I have two user group created in the AD Server and add into the Radius Server, so now FortiSASE not identify the two group in the FortiSASE but I configured two groups in the fortisase.  

When using forti OS version 7.4 the ssl vpn was retired and replaced by ipsec vpn and my android is able to connect to the ipsec vpn.Can we make the andoid forti client to be always auto connect and always up so when i lost mobile internet connection and the connection back the vpn will be connected automatically?

Hi,When I add new interface, I cannnot Hardware Switch Interface Type.CLI too,======================XXX(test2) # set typevlan VLAN interface.aggregate Aggregate interface.redundant Redundant interface.loopback Loopback interface.wl-mesh WLAN mesh interface.fext-wan FortiExtender interface.emac-vlan EMAC VLAN interface.ssl SSL VPN client interface. CLI too==========================# set typevlan VLAN interface.aggregate Aggregate interface.redundant Redundant interface.loopback Loopback interface.wl-mesh WLAN mesh interface.fext-wan FortiExtender interface.emac-vlan EMAC VLAN interface.ssl SSL VPN client interface.Would anyone be kind enough to tell me the solution?Model:FortiGate-120GOS:v7.4.8 build2795 (Mature)Thank youKenji,

How we can create access list to limit which ip address can be connected to the vpn dialup?

I have been facing an issue with a site to site tunnel between a Fortigate and a Checkpoint. Site A has the Fortigate and Site B has the Checkpoint. This tunnel exists because we want users from Site B to have remote access(RDP) to site A. The tunnel was working properly and users were able to access the remote server normally, but as of yesterday this issue reappeared. The weird thing is that the tunnel is active, as shown both on Checkpoint and Fortigate web page, but I can't ping / RDP to the remote server. From Site A I can tracert the public IP of Site B but not the other way around, the only hop I get, is the on from the private IP of the firewall of Site B and the rest are empty. I am not that familiar with firewalls and in need of assistance. I can provide additional information about the setup and important information that would assist with the resolution of the issue.

Hello,  I wanted to know if this FG model (FortiWiFi 50G 5G) can be connected to the ISP via a wired access. Meaning, can we use the WAN port to connect to our ISPs PE?  Thanks in advance.  \Best, ~zK 

Hi, i created an ipsec remote access for iOS nativ with the wizard. When i remove the check from "Split Tunnel" the ipsec tunnel doesn't work.It only works with "Split Tunnel".What i want is a full ipsec tunnel for iOS. The diag debug shows the following: FortiGate # 2024-07-24 16:27:56.440226 ike V=root:0: comes 80.187.85.0:500->91.55.218.67:500,ifindex=30,vrf=0,len=848....2024-07-24 16:27:56.440387 ike V=root:0: IKEv1 exchange=Identity Protection id=94092f039c872a4a/0000000000000000 len=848 vrf=02024-07-24 16:27:56.440469 ike 0: in 94092F039C872A4A00000000000000000110020000000000000003500D0002200000000100000001000002140101000F0300002401010000800B0001800C0E1080010007800E01008003FDE9800200048004000E0300002402010000800B0001800C0E1080010007800E01008003FDE9800200028004000E0300002403010000800B0001800C0E1080010007800E01008003FDE9800200018004000E0300002404010000800B0001800C0E1080010007800E01008003FDE9800200068004000E0300002405010000800B0001800C0E1080010007800E01008003F

Hi,  i would like to ask you.I have FortiGate 61E 7.4.8 and i have public static IP.In one of VLAN i have server with IP 10.0.0.3 and on this server webserver are running on port 8123.From internal LAN or any internal VLANs i can access to this server.But from public IP, its not possible to access to this server. I've created Virtual IP -  and firewall policy -   But with this VIP and FW rule its still not working.But i have FortiGate web access via port 4443 and its working via public IP address correctly. Can you help me ?Thank you :)

Hi there, I have an FG40 behind the ISP router (and I can't remove it) whit a NAT 1:1 configuration.With a phone (connected to WLAN) I have to reach the NVR (connected to LAN) pointing to the public IP of the office.If the phone is outside of the office, pointing to the public IP, I can reach the NVR because I have created dedicated rules on firewall.If the phone is in LAN (WLAN but is the same), pointing to the public IP, I can't reach the NVR.How can I solve this ?Thank you 

FSSO Authentication Issue: Same Credentials, Different IP – No AccessWe’ve identified an issue with Fortinet Single Sign-On (FSSO) where users are unable to authenticate when connecting from a different IP address using the same username and password. Problem Overview: When a user logs in from one IP address, FSSO successfully authenticates and grants access. However, if the same user attempts to connect from a different IP (e.g., switching networks or subnet), authentication fails—even though the credentials remain unchanged. Possible Cause: FSSO relies on IP-to-user mapping via polling agents or DC agents. If the IP address changes and the new IP isn’t mapped to the user in the collector agent’s cache, the firewall cannot verify the user identity, resulting in failed authentication. Suggested Additional Steps:1) Force logoff from AD to trigger a fresh login event.2) Restart the FSSO Collector Agent service to refresh mappings.3) Ensure all domain co