Support Forum

I have been facing an issue with a site to site tunnel between a Fortigate and a Checkpoint. Site A has the Fortigate and Site B has the Checkpoint. This tunnel exists because we want users from Site B to have remote access(RDP) to site A. The tunnel was working properly and users were able to access the remote server normally, but as of yesterday this issue reappeared. The weird thing is that the tunnel is active, as shown both on Checkpoint and Fortigate web page, but I can't ping / RDP to the remote server. From Site A I can tracert the public IP of Site B but not the other way around, the only hop I get, is the on from the private IP of the firewall of Site B and the rest are empty. I am not that familiar with firewalls and in need of assistance. I can provide additional information about the setup and important information that would assist with the resolution of the issue.

Hello,  I wanted to know if this FG model (FortiWiFi 50G 5G) can be connected to the ISP via a wired access. Meaning, can we use the WAN port to connect to our ISPs PE?  Thanks in advance.  \Best, ~zK 

Hi, i created an ipsec remote access for iOS nativ with the wizard. When i remove the check from "Split Tunnel" the ipsec tunnel doesn't work.It only works with "Split Tunnel".What i want is a full ipsec tunnel for iOS. The diag debug shows the following: FortiGate # 2024-07-24 16:27:56.440226 ike V=root:0: comes 80.187.85.0:500->91.55.218.67:500,ifindex=30,vrf=0,len=848....2024-07-24 16:27:56.440387 ike V=root:0: IKEv1 exchange=Identity Protection id=94092f039c872a4a/0000000000000000 len=848 vrf=02024-07-24 16:27:56.440469 ike 0: in 94092F039C872A4A00000000000000000110020000000000000003500D0002200000000100000001000002140101000F0300002401010000800B0001800C0E1080010007800E01008003FDE9800200048004000E0300002402010000800B0001800C0E1080010007800E01008003FDE9800200028004000E0300002403010000800B0001800C0E1080010007800E01008003FDE9800200018004000E0300002404010000800B0001800C0E1080010007800E01008003FDE9800200068004000E0300002405010000800B0001800C0E1080010007800E01008003F

Hi,  i would like to ask you.I have FortiGate 61E 7.4.8 and i have public static IP.In one of VLAN i have server with IP 10.0.0.3 and on this server webserver are running on port 8123.From internal LAN or any internal VLANs i can access to this server.But from public IP, its not possible to access to this server. I've created Virtual IP -  and firewall policy -   But with this VIP and FW rule its still not working.But i have FortiGate web access via port 4443 and its working via public IP address correctly. Can you help me ?Thank you :)

Hi there, I have an FG40 behind the ISP router (and I can't remove it) whit a NAT 1:1 configuration.With a phone (connected to WLAN) I have to reach the NVR (connected to LAN) pointing to the public IP of the office.If the phone is outside of the office, pointing to the public IP, I can reach the NVR because I have created dedicated rules on firewall.If the phone is in LAN (WLAN but is the same), pointing to the public IP, I can't reach the NVR.How can I solve this ?Thank you 

FSSO Authentication Issue: Same Credentials, Different IP – No AccessWe’ve identified an issue with Fortinet Single Sign-On (FSSO) where users are unable to authenticate when connecting from a different IP address using the same username and password. Problem Overview: When a user logs in from one IP address, FSSO successfully authenticates and grants access. However, if the same user attempts to connect from a different IP (e.g., switching networks or subnet), authentication fails—even though the credentials remain unchanged. Possible Cause: FSSO relies on IP-to-user mapping via polling agents or DC agents. If the IP address changes and the new IP isn’t mapped to the user in the collector agent’s cache, the firewall cannot verify the user identity, resulting in failed authentication. Suggested Additional Steps:1) Force logoff from AD to trigger a fresh login event.2) Restart the FSSO Collector Agent service to refresh mappings.3) Ensure all domain co

I have FortiGate-VM in AWS 7.6.2, FortiManager 7.6.2, FortiEMS Cloud 7.4.   I am slowly rolling out ZTNA in place of SSL VPN.  One of the most annoying things I have run across is that its super easy in FortiManager and FortiGate to show which users are actively doing SSL VPN.  But there does not seem to be any such way to show who is actively using ZTNA. I can manually comb through the logs but thats a pain.  Is there some easy way to see who are the active ZTNA users?

We are in the process of migrating from Forticlient SSL-VPN to IPsec VPN (over TCP443).When I configure an IPsec VPN connection, I can't save the configuration; the "save" button doesn't work. An SSL-VPN configuration can be saved.For the test, we're using a free version of Forticlient VPN, version 7.4.3.I've also tried a previous version, 7.2.11. I've uninstalled it several times and also performed a manual cleanup of Forticlient files. As far as I can tell, I have all the permissions correct on macOS (Sequoia 15.6).Fortinet support isn't helping because this test client doesn't have EMS.So, I'm hoping this community can help me.Is anyone else experiencing a similar issue?

I was configure traffic shaper policy for limit internet speed from lan to the internet, the policy name is 'pc_to_internet'.Policy 'pc_to_internet' is working normally and for source i use my LAN address.But i have another shaper policy to limit speed from the ipsec vpn site to site (1st row).When i set source using my LAN address (same with policy pc_to_internet) then i try to copy file from another site2 then the speed is not limited. But if i change the source to site2 address and destination to my LAN address then the speed is imited.Anyone can help me to understand why src and dst is different to limit bandwidh to the internet and to the another site using vpn site2site?

Hi How do Fortigate work if I ping test on passive when HA is a-p mode?Do packet go directly to destination from passive or via active?When I do ping test in passive, there are some equipment that appears in the arp table and some that don't.What are the criteria that appear in arp table? Thank you.

I have topology below where we have 3 WAN connection from different provider.With this topology, in the hub i create loopback interface and set as dialup vpn interface.On the spoke it's better to create loopback interface and put the tunnel under this loopback, or put the tunnel directly under the physical port (example port1 on spoke1)

Hi Guys, Just a few things to raise about the way FC handles external browsers for SAML auth.If you initiate a connection that is configured to use the SAML auth via external browser from the FortiClient GUI, the external browser is not given focus when the tab opens.If the connection is initiated via the context menu from the system tray, the browser is given focus as expected, even when the FC GUI is currently in focus.I appreciate that because it just opens a new tab in the existing browser, it can take advantage of existing login sessions, but it would be nice to have an option to open in a new window and/or private browsing window of the browser.This would allow for greater flexibility in scenarios where you have a password manager that is able to fill out the details on each connection, which is preferable to establishing a session (say in Okta) because you want to be somewhat frequently switching between user accounts in the same Okta tenancy which the SAML auth process doe

Hi FAC adminsI noticed FAC 6.6.6 has only 2 resolved issues among 45 known issues on 6.6.5 (and still known on 6.6.6).I wonder why so few issues have been fixed in this patch.Is it worth updating?

SDWAN SLA performace in spoke1 choose shortcut tunnel to spoke2 because the latency is more small than main tunnel to the hub.SDWAN SLA performace in spoke2 choose main tunnel to spoke2 because the latency is more small than main tunnel to the hub.With this case spoke1 and spoke2 can't communiate. DOing the packet sniffer i can see traffic from LAN spoke1 is reach to spoke2 but spoke2 will reply using main tunnel to the hub.How we can deal with asymetric routing like this due to different SLA performance result?

Hi everyone, I've been working on a dataset to extract the number of FortiGates by model that experienced a conserve mode event. The query works, but it seems like the DISTINCT function isn’t actually returning only the unique entries. For example, I only have one FortiGate-40F-3G4G, but the query returns more than one device. As shown in the attached image, during the period when I ran the report, this same device triggered four conserve mode events, and the query counted all of them instead of just once.I've tried everything and still can't figure it out — lmao.  Here's what I'm trying to achieve:Get the list of unique devnames that triggered conserve modeIdentify the model of each deviceCount how many unique devices per modelAny help would be much appreciated!Here's my query: SELECTt1.platform AS tipo_dispositivo,COUNT(DISTINCT t2.devname) AS total_dispositivosFROM$func-fgt-inventory AS t1JOIN (SELECT devnameFROM $logWHERE $filterAND LOWER(TRIM(msg)) LIKE '%

Hello, I was digging into creating NAC policies using user-based policies. Currently, I am using FSSO user groups in the user group attribute.I did create a firewall policy to allow traffic between the onboarding VLAN and the collector agent server, and the user is authenticated without hitting the NAC policy. I am wondering if I can use FSSO user groups in NAC policies. Any ideas?

We have 2 sites (SiteA & SiteB) that have 2 VPN tunnels with HQ. e.g.:  SiteA ---- HQ ---- SiteBNow I can access to HQ on site A and access to HQ on siteB.Can I access to SiteB devices on SiteA?

If spoke1 have MPLS connection to the hub then hub have advpn to site2, can spoke1 talk to site2?

I ADVPN with BGP and SDWAN enabled, is add route in the VPN Phase1 Interface should be enabled or diasbled? 

Good morning friends.In the Fortigate firewall I see that the log and report "summary" option is blocked. According to the knowledge base https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-System-Event-Summary-is-disabled/ta-p/245747, this is resolved by enabling some options from Logging and Reporting -> Logging Settings. However, when I accessed that option, I did not find the "Enable fortiview history" option. My question is, to enable this option, do I need to have a FAZ license? or fortigate cloud?

Hi everyone,I wanted to give Fortigate a try, and I installed it as a VM with an evaluation license.Unfortunately, there doesn't seem to be much you can do with such a license, especially the inability to set VLANs up (due to interface limitations) is a big drawback to me.So, I was wondering how I could get a 60-90 day trial license.Could you please help me find out? Thanks

Hi everyone,Our office will be moving to a new location in a few weeks, and we recently purchased a new FortiGate. We need to transfer the FortiToken Mobile token license from our old FortiGate to the new one (the license was purchased about two years ago).I understand that I’ll need to open a support case with Fortinet to request a new license code. However, what I’d like to know is how long it typically takes for Fortinet to issue the new license once the case is opened.Specifically, since we’re moving on a Friday night, if I open the case at that time, is there any chance I’d receive the license code later that night? Our management team wants to ensure that users can connect to the VPN with 2FA by Monday morning.I already reached out to Fortinet directly, but I haven’t received a clear timeframe. If anyone has gone through this process recently, I’d really appreciate it if you could share your experience.Thanks in advance!

Hello,I am monitoring Fortigates using SNMPv3. Among other things I monitor the status of DHCP scopes to be informed if they are near to get full. The main (and the only) OID related is 1.3.6.1.4.1.12356.101.23.2.1.1.2. It returns per line the amount of assigned leases in percents of the total IP addresses in the scope. I can see the following situation: if there are reservations in the DHCP scope and if a device with a reservation got a lease, this device (this lease) is not counted in the SNMP response. It can lead to situations that some IP addresses are assigned and not free anymore, but the number of assigned leases according to SNMP is still 0. Which is wrong. Different Fortigates 100E, 100F and 200E and FortiOS 7.2.11 and 7.4.8.Could anyone please check this and let me know if I am missing anything? 

We have multiple Fortiswitches managed by a Fortigate.  I need a command to see the MAC addresses on a specific port on a managed switch.  For example, I need to see the MAC addresses on port 1 of switch "1234."  I can use this command to see "port1": diagnose switch-controller switch-info mac-table | grep port1 But this command lists all the port 1s for all the managed switches. I need a command that let's me specify which managed switch I want to view. Thanks.

We are converting checkpoint configurations to fortigate (finally getting rid of it)But I have seen the interface setting and here is something I am not used to itIn Checkpoint the LAG interface itself (the physical) has a network without VLAN the Forticonverter converter exactly the same settings. see screenshots bellow:I am used to put all IP addresses and betworks to logical interfaces with VLANIDSo my question is, will this work normally in fortigate? with VLAN ID 1 ? untagged ? can this interface (the physical) be assigned to policies later ? Thanks