Support Forum

I have some questions regarding EMS. I want my Remote Access IPsec VPN users to have auto-connect and always-on capabilities.Are there any functional differences between EMS On-Premise and EMS Cloud licenses? Are there any limitations with one that do not exist on the other?Does the EMS On-Premise license come with its own installation package? Is it possible to deploy the EMS On-Premise installer on a cloud platform of my choice (e.g., Azure) without any issues?Aside from the Endpoint license packages, I understand there are also User-Based licenses.How do they differ from Endpoint licenses?When using a User-Based license, how does EMS Know that the user is using license, how does it identify the user, Is it tied to the AD username?5. Can a User-Based license for a single user be used on multiple devices? Let’s say I have an office with 4 laptops, all using the same AD user to connect via VPN, and all are connected simultaneously. Would a single User-Based license cover this scenario?

Hi, Which Firewall model is recommended for an average organisation for the user counts mentioned below with  NGFW capabilities? 250-500 users500-750 users750-1000 users  Thanks in advance

Hello. In my lab environment I am trying to setup 802.1x with dynamic vlan assignment which I have successfully configured. However I would like to build out on this even more and try to make fw policys based on the user, so is it possible to use the same "token" that I use to authenticate the user with 802.1x to create firewall policys with this instead of prompting the user to authenticate again to recieve their firewall policys? Any suggestions? Is it even possible?

If a host is registered manually or by device profiling but does not match any network policy, the correct VLAN is still assigned. For example, even though the role for that host requires the "Persistent Agent - Yes" condition to be set in the User/Host Profiles, it still gets assigned to the correct VLAN even if the host does not have a persistent agent. I came across a comment suggesting that a default VLAN should be defined and the "Reset Forced Default" option should be enabled in the all ports settings. For instance, if I define the default VLAN as an isolated VLAN ID and enable "Reset Forced Default" in the port settings, the cookbook says "Ports that return to the default VLAN when hosts disconnect." for reset forced default setting. This implies that the task is not being accomplished as intended. Could you please explain it?

Hello guys, I was trying secure a guest wifi from illegal torrent streaming. i set up  web filters , application control and all work fine. But we found a <<hole>> lets say. A user used hotspot from his phone and connected to a streaming site (from the ones we have blocked) . The problem is that when he connected to our wifi the movie continued to play .  Is there a way to stop that session with the site automatically?I was thinking something like a reoccuring Session killer to particular sites. is it possible? FortiGate 

Hi all,  I hope you're well.  I am having issues connecting our branch firewalls to our fabric root FortiGate. All the configuration is correct as prior to upgrading all firewalls to 7.4.7 this was working just fine. Post upgrade to 7.4.7, we found that the set group-name "NAME" command was stripped from the security fabric configuration. This configuration was re-applied, and we can now see communication between the branch firewalls and fabric root on port 8013 however when running a sniffer, I get the below:  It seems as though that when it tries to validate it doesn't like the admin port that is configured which is not a default port. I have tried setting this to "Use Admin Port" as well as "Specify" but am still having the same issue. I am not sure as to what else I can change, changing the management port is not possible but I feel it would display the same behaviour no matter what this was set to.  Has anyone come across this issue before a

Hello, we have a small group of Fortigate managed by a Fortimanager VM (both versions 7.6.3).For one of them, the Normalized Interface objects in "Policy & Objects > Normalized Interface" are not being populated correctly:All interfaces (VLANs, Tunnels, etc.) are incorrectly typed as 'Physical', and all addressing information are missing.From the same screen, if I try to add a "per device" mapping of an interface on that unit, the drop down menu is not showing the one I need.ST-FW mapping is incorrect.But the interface data appears correctly in "Device Manager > Network > Interfaces", where I can see their addressing and I can map them to the normalized one.The same mapping looks fine here, and I can edit the interface.Seems that two views (Policy & Objects vs Device Manager) of the same object are not matching. I have already performed the following troubleshooting steps without success:Full 'Import Config', 'Refresh Device', deleting and re-mapping the interface

 Hello all, I have a problem where my two 448E switches are displayed as “online” under Managed Forti Switches. I can also access the port configuration and change it. So I guess the NTP is not the issue. NTP is also activated for the fortilink interface and set as Local.However, in the topology, the connections are displayed as disconnected “dashed lines.” The MCLAG configuration is also not displayed correctly. Also with dash lines. But when I hover the mouse over the ports, MCLAG is shown as active.When I go to “Diagnostics and Tools” for the respective switch, the ports are not displayed here.  “CLI Access” also does not work. "Option is disabled because of the following reason(s)FortiSwitch must have a valid assigned IP in order to connect to the CLI."Also Faceplate will not show.I have also checked whether “lldp-reception and lldp-transmission” is enabled in the fortilink interface. This is the case; it is enabled.FGT01 # execute switch-controller get-conn-statusMa

Hello Fortinet Community,We are facing a persistent issue with Wi-Fi performance in our office building and would appreciate some guidance or suggestions to resolve it.Environment Setup:Building Floor: 3 adjacent offices on the same floor.FortiAP Deployment:Office 1:  single 221E FortiAPOffice 2: Two 231G FortiAPsOffice 3: Single 431F and Two 221E FortiAPsTotal FortiAPs: 6 (all managed via FortiGate)ISP Plan: 750 MbpsFirewall & Switches: FortiGate 400E and Cisco SGS 350 (getting full speed at wired data points)Issue:While we consistently receive full bandwidth (750 Mb) at wired endpoints, Wi-Fi-connected devices experience unstable and poor performance. The wireless speed varies significantly:Often drops to 30–50 MbOccasionally goes up to 100–200 MbNever reaches anywhere close to the wired speedsBehavior is the same even in none business hours, with no user load on the networkTroubleshooting Done:Upgraded firmware of all FortiAPs to the latest versionAdjusted radio channe

I need to upgrade a group of not licenced fortigates, I tried to run a script that execute a restore image tftp but after downloading and validate the image from the tftp server the script stops with errors and doesnt do anything. I would like to know if this upgrade process is posible and if there are alternatives to do this upgrade on not licenced fortigates. Maybe a script on an external server that execute a ssh on every fortigate. Thanks!

I am using Fortigate200F fw. I have a rule that permits facebook but from 2 days ago people can't access facebook. Couldn't resolve problem. Pls help

hi,i have a FW policy whose 'bytes' column stuck with 0 and it's not incrementing.i can see FW policy matching log and fortiview session traffic.i created a clone of the FW policy earlier for troubleshooting, place above the original FW policy, allowed any source and destination address, deleted the cloned FW policy after i saw traffic matched, then revert back original FW policy to specific source/destination subnet.i tried to update statistics and clear counters but to no avail.is there any other troubleshooting step i can do in order for the FW policy to display increment in the 'bytes' column?    

hi,i'm migrating a cisco asa ACL to a FGT.just to confirm, i'll always need to create 2x FW policy: inbound and outbound rule for each single ACL?an example would be below: !! ASA:access-list DMZ-IN extended permit tcp object SERVER-SUBNET 10.200.0.0 255.255.0.0access-group DMZ-IN in interface dmz !! FGT:edit DMZ-IN 1set srcintf "any"set dstintf "port 1" !! DMZ interfaceset srcaddr "SERVER-SUBNET" set dstaddr "10.200.0.0_16-SUBNET"set service "ALL_TCP"set schedule "always"set logtraffic enableset status enableset action acceptset nat disablenext edit DMZ-IN 2 !! JUST CLONE REVERSE FW POLICY 1set srcintf "port 1"set dstintf "any"set srcaddr "10.200.0.0_16-SUBNET"set dstaddr "SERVER-SUBNET" set service "ALL_TCP"set schedule "always"set logtraffic enableset status enableset action acceptset nat disablenext

Hello Fortinet community, We recently deployed an ADVPN‑based hub‑and‑spoke topology using FortiGate firewalls: Hub: FG‑601F (FortiOS 7.4.8M)Spokes: FG‑40F (low‑user sites - FortiOS 7.4.6,7.4.7,7.4.8)FG‑100F (mid‑user sites - FortiOS 7.4.6,7.4.7,7.4.8)  Scale: ~450 total spokesPhase 1: ~300 spokes deployedPhase 2: remaining ~150 spokes deployedAt each spoke site, we have 2 or 3 ISPs, each establishing separate IPsec tunnels to the hub (via ADVPN). OSPF is used for dynamic routing across a single OSPF area. After Phase 1, everything worked cleanly.After Phase 2, roughly 70–90 spokes intermittently lost access to resources behind the hub, despite their ADVPN tunnels remaining UP (Including phase 1 devices). Based on our investigation so far, we suspect an OSPF routing or neighbor issue at the hub, possibly due to the high number of neighbors (since each spoke generates multiple neighbor adjacencies to the hub). My Key Questions: 1. Has anyone

How can I use librenms to retrieve all FortiLink device information under FortiGate?I have FortiAP Fortiswtich.I have FortiOS 7.6.0 

I am trying to reboot a downstream device in the fabric, but the automation stitch is not triggering. The trigger is a weekly schedule at hour 3 (3am - see image below). For action, I've tried using the system action (included with v7.2 onward) as well as a CLI Script for the reboot. Interesting points to note:  If I use the system action and click on the Test Automation Stitch, it reboots the downstream device.If I use the CLI Script and click on the Test Automation Stitch, it reboots the root and downstream device.Waiting for the trigger to reboot in either instance never occurs. Any help is appreciated. All devices are running 7.6.3Root device is a 600EDownstream device is a 40F I have followed the below, but this does not mention if it can be used for a downstream device in a fabric. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-Automation-Stitch-to-schedule-restart-reboot/ta-p/19185 

Dear All, I have observed sometimes google dns gets unreachable from fortigate which is configured public DNS server under DNS setting. I am using two public DNS server (google 8.8.8.8) and fortigate (96.45.46.46). No setting used like DNS over TLS and DNS over HTTPS. I just want to know if anyone has experienced this issue and what have you done to resolve the issue. Thanks

Hey all Trying to automate a few things so I made a script that makes a script that makes the many objects I need to create on a regular basis. The problem is that whatever I do, I can't get the "Upload bulk CLI file" to take my CLI script, all I get is "configuration file error". Pasting the whole script on the CLI works fine and behaves exactly as expected, so I have no idea what the GUI upload function is going on about. Here's a super simple CLI script I made for testing: config firewall addressedit "Blocked-IP-22.222.22.222"set subnet 22.222.22.222 255.255.255.255nextedit "Blocked-IP-222.22.222.22"set subnet 222.22.222.22 255.255.255.255nextedit "Blocked-IP-11.111.11.111"set subnet 11.111.11.111 255.255.255.255nextedit "Blocked-IP-111.11.111.11"set subnet 111.11.111.11 255.255.255.255next end 4 simple address objects to create. Even if they exist, this doesn't produce any error on CLI since it's just editing existing objects anyway. GUI though, "configuration file e

Good afternoon everyone! Came across an issue today and I think I found the problem, and a work around solution.A few people I have seen have this issue, so I wanted to post my results in case anyone else needs them. Original Issue: Forticlient (ipsec) VPN not connecting on Windows 11 After some troubleshooting, I found that the VPN would work only over Wifi and not via Ethernet.I then tested a USB to Ethernet adapter, and it was able to work.So I narrowed the issue down to the onboard Ethernet driver.Driver was up to date, so I did the typical uninstall/reinstall, Did not work.However I knew my Windows 10 machines worked flawlessly. Solution: I was on Realtek driver version 1168, So I decided to try downgrading the Wifi driver to 10.54.That fixed the issue. It seems the problem is related to the newest Realtek Ethernet drivers, at least it was for me.I don't know if other brands have the issue too. I wanted to get this information out there for anyone who

hi,i'm migrating ASA BGP config to FGT and particular on re-using the 'no auto-summary', 'no sync' and 'redistribute static' commands. i'd appreciate if someone can confirm if i need these command syntax/placement under FGT BGP are correct?  ASA:router bgp 65101 address-family ipv4 unicast  neighbor 172.16.6.249 remote-as 65102  neighbor 172.16.6.249 activate  redistribute static  no auto-summary  no synchronizationexit-address-family ----- FGT config router bgp set as 65101 set router-id 172.16.6.250 set auto-summary disable set synchronization disableconfig neighbor edit "172.16.6.249" set capability-graceful-restart enable set remote-as 65102endconfig redistribute "static" set status enableendend

Has anyone ever experienced and issue FortiManager immediately logging out Admins 10-30 seconds after logging into the GUI?For the passed year FMgr has been working fine, we typically authenticate via SSO with Okta as the IdP. For the passed year no issues, we've made the internal decision to move all SSO authentication to Azure where possible to slowly phase out Okta.I was able to successfully switch to Azure as the SSO IdP and things worked great with no issues. About a week later one of my counterparts reported issues of him not being able to stay logged into FMgr.I troubleshot and confirmed what he was reporting. I tried from multiple machines, browsers (private & incognito), cleared cache....still the same results. After looking at logs on the Azure side, it seemed that it was receiving a "logoff" request, which essentially logged the user out.To troubleshoot further I removed all SSO settings on the FMgr side leaving only the local Super Admin account and the issue persisted

Hello everyone,I’m facing the following issue: when generating a traffic report for the previous month, the report also includes the first day of the following month. For example, when requesting traffic data for July, the report correctly shows all data for that month, but it also includes August 1st, although with a very low traffic volume.It’s worth mentioning that when running the SQL query directly on the dataset, the results are correct and only include data from the requested month.I’d appreciate any guidance to understand or resolve this behavior.FortiAnalyzer 

This article describes how to send an email notification in an event one of the playbook steps failed. This is solution is not a global error_handler notification and thus should be configured on each playbook. For the purposes of this description, the usecase is blocking an malicious ip and sending an email notification on the list of blocked IPs.Prerequisites;i) Configure firewall connector - Give read-write permissions to the API userii) Configure SMTP connectorplaybookThe playbook logic:Start > block_ip > code snippet > Collect Failed Errors > Condition > Send mail notificationIn all your playbook steps enable ignore errors.In any of your playbooks that you intend to track failed steps, include two critical steps;(i) Set Variables Step The above variable playbook step is Collect Failed ErrorsThe variable name is failed_errors - The objective is to collect failed steps errors across the playbook.failed_errors jinja;{% if steps.block_ip.status != "Succes

Hi, suddendly, one of our FGT (7.2.11) cannot reach the internet. Both wan are up and gateway reachable. the default route is set to the sd-wan. One 2nd firewall on another site with the same rules (pushed from a FMG) is fine .all internal traffic is fine including to/from our IPsec vpn remote sites.SD-WAN SLA are all up including the ones testing external dns. But an execute ping 1.1.1.1(or any exeternal IP) from the FGT give a Network unreachable. default route is set to the sd-wanAny ideas ?

I configured three firewalls, with the HUB using a dial-up. One SPOKE can communicate normally with the HUB. However, after adding another SPOKE, although the IPSEC VPN tunnel was successfully established, the HUB's tunnel IP cannot be pinged. Could you please help identify what the issue might be? Thanks