Support Forum

hi, we have 4 VDoms on a single physical fortigate running 7.2. All 4 have internet access, 3 over NAT, 1 via explicit Proxy. If i want to whitelist a Domainname (In case SSL-Inspection or some other security feature is blocking access) i have to configure the whitelist entry separately on all 4 VDoms. I am looking for a way to centralize the whitelist on a single place (i.e. a textfile on a webserver). Then use that object in a policy on top of every ruleset. I therefore created a  threat feed What i tried so far:DNSFiltern/a for explicit proxyn/a on global VDOMWebfilternot possible to solely allow the whitelist and ignore all fortiguard categories. They must either be set to allow or block Maybe i am missing something here? Is it possible to achieve a common ruleset over 4 Vdoms with Fortimanager?   

Hello everyone.I have a question regarding the status of some hosts in FortiNAC that are showing as "Disabled Online". I have already checked the settings to find out the reason, but so far I have not been able to find the cause and resolve the issue. Has anyone else experienced this? If so, can you share what was done to resolve the issue?Thank you for your attention.

I have a firewall configured on Transparent mode (two interfaces, inside and outside). Also I have a MGMT interface connected to the same vlan. In this case can it form L2 Loops? What is best practice?

Hi together, we are actually implementing Forti SRA for remote access for our admins. We installed the SRA VM in our DMZ, only one interface with a RFC1918 IP address. On the Fortigate in the datacenter we have a VIP forwarding an external IP to the SRA.Connecting to the SRA is possible but it seems that there are two different GUIs in the SRA (look at the screenshots attached). Sometimes one appears, sometimes the other. We didn't find out yet on what it depends. If the "well-known" Fortinet GUI appears, there is a messageConnection to the interface IP address via the GUI is only used for uploading the license. All FortiSRA configuration should be performed by connecting to the proxy addressAlso after logging in via this way if one accesses the secrets there is a messageThe feature is not available on interface IP.It does not depend on the browser used (Chrome, Edge, Firefox), the browser plugin is installed in every browser.When the Forti SRA Login page appears everything is fin

Hello,FortiClient 7.2.x (also 7.4.x) shows invalide certificate warning after every reboot of the client, also the setting to do this on ems are not enabled. Any idea?Fortinet says this normal.....  

Hello.  Does it matter if the mode of the policy and the mode of the web filter are different except when Fortigate's policy is flow mode and web filter is proxy mode? Thank you. 

IPSec VPN with SAML was configured according to https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-Microsoft-Entra-ID-SAML/ta-p/307457. The configuration seems to be in place according to the documentation, but I get ERR_CERTIFICATE_INVALID (which is to be expected), but if I click 'Continue (unsafe),' the Script Error shows up. Error says 'Permission denied,' and the URL says 'about:blank.' If I click 'Yes' for 'Do you want to continue running scripts on this page,' it simply goes back to the untrusted certificate popup. It cycles back and forth indefinitely. Does anyone have an idea as to what I can try? Thank you.  

Hi!every KB I've seen, including 212757 & 199661, omits explanation of "scope" attribute in Kernel Table/FIB printout.I understand it originate from Linux Kernel Table, but, in Fortigate context, can anyone may volunteer qualified meanings of 0, 253, 254 and 255, and significance of each?Thanks!

We have 242 devices we need to enable local traffic logging option of syslog through Forti manager. 

Hello,I've a problem with only some clients (some users can connect to the tunnel without any problem). The VPN client is Fortigatevpn 7. 4.3 and the firmware of the Fortigate is the v7.6.3 build3510.This is the trace of one of the connection that ends with the timeout:ike V=root:0: comes xxx.xxx.xxx.xxx:4500->yyy.yyy.yyy.yyy:55008,ifindex=3,vrf=0,len=389....ike V=root:0: IKEv2 exchange=SA_INIT id=a26c3f92f0df5a36/0000000000000000 len=385ike 0: in A26C3F92F0DF5A3600000000000000002120220800000000000001812200006C02000034010100050300000C0100000C800E01000300000802000005030000080300000C0300000804000015000000080400001400000034020100050300000C0100000C800E01000300000802000005030000080300000C0300000804000015000000080400001428000068001400000D6B9152EBB35B01EA7298CF01F3127CF921F13B1855AA2DD180EC15DA2315F3601081A8BFA658707448BC16F20E1B3337FDB618FF0137B6AB68C13718A34889ADE62BF3728F840FEAC090A542E69C8FA8F2214EE2026060E3B5824EADA389562B000014F3EC39D2CC6635F93DC56A90466163AF2B0000144C53427

Hi, we are changing to a new FG90F cluster and we would like to use SD WAN. We have a fiber internet access we used before for the www traffic and MPLS internet access for all branch and headquarter access. The actual HA used only routing so that all internal MPLS traffic went by A and default route for internet was used by B. We want to use SD WAN also just to have an option in the future when we need more outgoing traffic for this office.  Now we wanted to use SD WAN also as failover if something happens with B and we tried the implicit rule in SD WAN rules with 99-1 for B. We had a small window today and we wanted check before we change the cluster but we got problems accessing our MPLS network. We had a static route for all MPLS traffic but when we wanted to connect to our LDAP server we could not establish the connection. Removing internet access B and leaving olny MPLS A connected we just connected fine with the internal LDAP in our data center. So someth

Hi, "For the public Cloud VMs, the status of 'allow-traffic-redirect' is always set to disable due to one-arm traffic." is advised in this KB: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Traffic-handled-by-FortiGate-for-packet-which/ta-p/196651 However, looking at my existing configuration for 7.0.12, "allow-traffic-redirect" is currently enabled.Tried to look at a newly provision VM which is at 7.2.9, "allow-traffic-redirect" is currently disabled. Would you know at which FortiOS version was the default value changed?My existing configuration was from 6.0 Thanks!               

Hi, we just implementing FortiAuthenticator Version 6.6.3 as radius server together with our HP Aruba / Procurve Switches. I configured MAC-Based Authentication on the switches: aaa authentication mac-based chap-radius server-group "FAC"aaa port-access mac-based 2-19 On FortiAuthenticator Site I- created the devices under User Management --> MAC Devices- registered the switch as radius client und created a Mac Authentication ByPass Policy The authentication works by I always have an error before the successfull authentication. If the Client is connected: 2025-05-13T09:00:14.065119+02:00 facauth: Updated auth log '606d3ca7ee62' for attempt from 10.10.1.116: user authentication error: invalid user2025-05-13T09:00:14.068143+02:00 facauth: Updated auth log 'B20195042' for attempt from 10.10.1.116: MAC-based authentication successful  Am I doing anything wrong in the config.  2025-05-13T09:00:14.062802+02:00 FortiAuthenticator-BA radiusd[1488]: (47

Hi Team, I am planning to configure HA on FortiGate 60F firewalls in Active-Passive mode, and I want to connect two ISP links directly to the firewalls. Is it possible?

Hello Running FAZ 7.4.7  What does has this impact on (exceeding the daily logs license)?Does this mean new logs will not be saved?Or it has (something) related to TAC support?  

Hello, I'm trying to configure an IPsec tunnel to replace ssl-vpn, but i can't make split tunnel to work. I have split-tunnel enabled with just an internal network allowed, and a policy that explicity allows traffic to that network. The problem is, once connected, the tunnel pushes a default route to the client, so all the traffic goes thru the Fortigate.I already tried things i saw on this forum but nothing worked To add info; doesn't matter what config i do on the forti or client side, doing "route print" always show a default route to the Forti (when i'm connected). 

Hi, I am setting two sites with vlan layer 2 bridging, VXLAN over IPsec, version 7.4.8Data networks are working fine, but the Avaya phone has no dial tone and is not dialling. I didn't see any place on CLI to adjust MTU on VXLAN interface for this version   

I have created an IPsec tunnel between two fortigate firewalls. On the first fortigate firewall, there is both incoming data and outgoing data(see attached photo 1.png). On the second fortigate firewall, there is outgoing data, but not incoming data(see attached photo 2.png). The IPSec VPN Tunnel is up on both fortigate firewalls. I have checked the match logs on both fortigate firewalls, but have not found errors. How do I solve the problem?1.png1.png 2.png2.png

Dear all, I am moving from SSL VPN to Ipsec, which I have not had any problems with with the Notebooks, the problem I have had is with the Android client which does not have SHA256 security, has anyone had the same problem?

Hi all,I need some help configuring a fortigate 90G Meraki switch with APs on interface x1 and a FortiSwitch interface x2 with an AP. I got the Meraki side working by using manual mode on the x1 interface directly to the Meraki and using a trunk (I'm not sure if this is correct), but I'm stuck getting the FortiSwitch and AP working. I configured the dedicated FortiSwitch interface on port x2, and although the interface is showing as online, the status is still down. The switch is also offline, even though I can access it directly.I'm not sure if I'm on the right path with my current configuration, but any help would be greatly appreciated.

Hi, I advice by technical support based on the ticket id 7990064 to find the answer in here, because i am using Forticlient free version so didn't come with Technical support. I was implementing FortiClientVPN (free) with SSO/SAML + MFA using O365 Azure on Windows/IOS/Android clients and connect to a Fortigate-501E running FortiOS version 7.0.9,build0444 (GA) and it works very well. The issue on Android client happen since both Android13 OS and FortiClient VPN apps v7.0.xx released. When Forticlient VPN apps on Android trying to connect it will automatically redirect chrome browser to O365 azure login page, the authentication and MFA approval process works fine, but get stuck on browser with displaying "This site can't be reached...127.0.0.1 refused to connect" and it never loads the forticlient VPN apps.                 Troubleshooting taken, update chrome apps, changes defaul

Hello everyone! With the lack of support for the vpn client through official channels, I turn to everyone here to see if they can help me out. I have been working for two weeks to get some version of the fortinet vpn working on Bazzite with no luck. No matter how I install it, all that happens when I open it is a white screen with a context menu that says <empty> when I right click in it and a menu bar with only a couple options or just a complete white screen under the title bar. I can only try installing the official RPM because their linux downloads page hold incorrect instructions for Fedora (which Bazzite is based off of). I desperately need some assistance because this is the only thing preventing me from being able to get off Windows, but my work requires it.

Hi @community,I'm encountering an issue while trying to sign in to the Fortinet NSE Training Portal. After logging in with my credentials, I receive the following error message: "You have logged in successfully as '<username>' but do not have an account in Moodle."   Could someone from the support team or community help me resolve this?  

Hi NAC admins FortiNAC 7.6.3.FortiOS 7.4.8 managing FortiSwitches 7.4.6. According to "FortiNAC - FortiSwitch FortiLink Integration Guide" doc, both SNMP MAC Notification & Syslog methods are supported.https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/bf034eae-75df-11ef-8355-fa163e15d75b/FortiNAC-F_7.x-FortiSwitch_FortiLink_Integration_Guide.pdf From the pros and cons list on page 7 & 8, am I supposed to I understand that Syslog method is more recommended than SNMP MAC notif method?Anyone tried both and can advise on the best one?

I’m working with a BGP setup involving three FortiGate firewalls:FW-AFW-BFW-CFW-A has two BGP neighbors with FW-B: one over a point-to-point link and another over an IPsec overlay tunnel. Both neighbors advertise the same routes to FW-A. However, I need FW-B to only advertise the routes it receives via the point-to-point neighbor.To achieve this, on FW-A I apply an outbound route-map to the point-to-point neighbor with FW-B, matching the route 192.168.10.0/24 and tagging it with the BGP community 65002:200. FW-A also sends this same route to the IPsec overlay neighbor, but without any community tag.On FW-B, this results in receiving the 192.168.10.0/24 route from both neighbors — one copy with the community 65002:200 (from the point-to-point link), and one copy without the community (from the overlay).FW-B also peers with FW-C. Between these two, I configure a route-map outbound on FW-B that matches routes with the community 65002:200, so that only routes received from the point-to-poi