Support Forum

Hi guys,  I hope you're well.  I want to rename a managed FortiSwitch but when I attempt to do this I get the below error:  I have done this many times in the past this way and have never received this error, the FortiSwitch is currently running 7.4.3 and the FortiGate 7.2.9.  In the past when I have done this, it has been with switches I have manually authorized and configured from scratch however, with this since it was a larger install I pre-configured the FortiGate switch-controller with all my switch configurations that is the only difference I can think of.  Does anyone have any ideas if it is possible still? Regards, Dan. 

For any that use the link-monitor feature in FortiOS, dont forget that you can configure it to reach out to multiple servers at once.Yesterdays Cloudflare outage reminded me that putting all your faith in a single DNS server isnt always the best thing to do. Now using individual server settings to monitor several remote IPs with weighted rules for failover.

Hello.I need setup redundancy paths between FS but one link should be over fiber and second via WiFi bridge build on FAP (mesh config ROOT-LEAF). main problem is that fortilink over fiber is automatically formed but via APs I have to tenable p2p-fortilink. When both are configured all switches are going offline. Any change config p2p-fortilink on classic fortilink via fiber . Just to simulate two p2p-fortilinks. We really need find solution. Already did two links over mikrotik bridges but ofc MT are totally not visible for me and for fortiswitches. 

Hello Team,We are currently working on configuring per-user firewall policies for SSL VPN access using both LDAP and Azure IdP (with MFA) to restrict access to specific destinations for individual users.Our FortiGate firewall is successfully integrated with Microsoft Azure IdP for SSL VPN authentication using token-based MFA. Additionally, we have integrated our on-premises Active Directory with the FortiGate firewall for SSL VPN access.However, when creating firewall policies, we are encountering a limitation where policies are applied at the group level, rather than allowing us to define policies for individual users.Can someone advise on the best workaround for this scenario? Specifically:Do we need to create individual user groups in Active Directory and Azure IdP for each user to achieve per-user control?Alternatively, is there a method to configure this directly on the FortiGate firewall?We are also utilizing FortiClient EMS for managing remote access VPN policies. If there's a w

Hello, I’m experiencing an issue where the Web Filter profile on FortiClient EMS does not block access to sites categorized under Gaming, despite being explicitly set to Block. Details: Web Filter profile is correctly applied in EMS.FortiClient shows the Gaming category as blocked.Testing was performed on macOS M3 (Apple Silicon).The Web Filter browser extension is installed on both Firefox and Chrome.However, no block page is displayed and the user is able to browse gaming websites freely.  It appears the Web Filter is not being enforced properly on macOS endpoints.Is there anyone who has encountered this issue or has suggestions on how to resolve it? Thanks in advance.  

Hello colleagues,I have a question related to the FortiGate 7.6.0 and the property security-rating-result-submissionconfig system global set security-rating-result-submission {enable | disable} endThis property was documented and available in the 6.2 version of the product:Security rating | FortiGate / FortiOS 6.2.16 | Fortinet Document LibraryAfter upgrade of the FortiGate to the version 7.6.0 I cannot find this property anymore:config system global | FortiGate / FortiOS 7.6.3 | Fortinet Document LibraryI also found the information that this property was excluded from the CLI in the document:https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/51fcbb4f-33ff-11ef-bfe5-fa163e15d75b/fortios-v7.6.0-release-notes.pdf995885 Removed the set security-rating-result-submission setting under system.globalCan please someone confirm that the propertysecurity-rating-result-submissionis officially excluded and it will not be available in the product anymore(or it was r

I have 2 spoke and every spoke have 3 connection to the hub (2 using internet connection and 1 using WAN connection)On spoke1 when i check routing details to spoke2 why i see duplicated entries only for both internet connections? SPOKE01 (Internet) # get router info routing-table details 10.101.62.1Routing table for VRF=0Routing entry for 10.101.0.0/16  Known via "bgp", distance 200, metric 0, best  Last update 00:28:56 ago  * vrf 0 10.10.111.3 priority 1 (recursive is directly connected, INT1_2)  * vrf 0 10.10.112.3 priority 1 (recursive is directly connected, INT2_0)  * vrf 0 10.10.111.3 priority 1 (recursive is directly connected, INT1_2)  * vrf 0 10.10.112.3 priority 1 (recursive is directly connected, INT2_0)  * vrf 0 10.103.113.1 priority 1 (recursive via MPLS tunnel 192.168.120.1) If i execute get router info routing table i only have 2 result belowB       10.101.0.0/16 [200/0] via 10.10.111.3 [2] (recurs

I recently had a UPS go down and when we recovered the power to the FortiSwitch 448E that was connected to it, the switch came up but appeared to not work at all.  I couldn't get to on any management interface except using the console port in the rear with a serial cable.  Anyway, what I discovered was that when power was lost and it booted up again, it booted from the secondary image with a stock config file.  I was able to reboot off the primary image and it appears "normal" however I need to do some testing before I start moving devices and users back to it. My question is:  Why did it load off the secondary and how can I prevent it (and my other FortiSwitches) from doing that again?  I noted the 'set image-rotation' command is set to "enable" by default but I know little about what this does and why anyone would want the image to rotate each time at boot.  I believe the current firmware on it was 7.2.3.Also, I want to make sure my other FortiSwitc

Hi All, I am new to FortiGate and i am doing a lab for LDAP I set up the LDAP server on the FG and the connection to the LDAP server is successful however, when I test a user credential on the LDAP it says invalid credential even though i am sure the credentials are correct. not sure where I can go from there?  your help and guidance is much appreciated  

Greetings, might be the wrong place to ask...I am supporting a customer that has a FortiGate 60E. They need a firewall for their current environment, and upgrade to a new internet provider. We will probably get a new firewall within the next year. I want to know what I need to do to get this device upgraded and supported to assist them. I have found that this device will go end of support in Dec 2026. How would I find out how much it would cost to get the device updated and supported for the rest of the life of the device. From what I am seeing, to true-up support is going to cost more than a new device. Does anyone know a way to get this device updated and supported for a year? I have reached out to sales, but they have been slow to respond. #Fortigate60E #support #newbie

Product: FortiGate 40FFirmware Version: v7.2.11 build 1740Severity: CriticalCategory: System Stability / Configuration PersistenceSummaryUnder low-memory conditions, the FortiGate 40F experiences a critical failure where the active firewall policy configuration is completely erased, resulting in total loss of internet-bound traffic and administrative lockout.Steps to ReproduceDeploy a FortiGate 40F running firmware version 7.2.11 (build 1740).Configure approximately 10 or more IP and domain threat feeds (external threat feeds).Add an additional external IP threat feed, referencing it in a policy.Observe system behavior as the new feed is added and activated.Observed BehaviorThe FortiGate becomes unresponsive for approximately 10 minutes.All outbound internet traffic halts.Management interface (e.g., GUI, SSH) becomes temporarily inaccessible.Upon restoration of access, all firewall policies are missing.CLI command show firewall policy returns no output, indicating full policy loss.Expe

Good evening  I want to monitor a lan to a zabbix server with ip address 192.168.1.87 connected in bridge adapter but a tracer to a zabbix server and i see the ip 10.50.3.21 FortiGate-HomeLab # show system interface port1config system interfaceedit "port1"set vdom "root"set ip 192.168.55.10 255.255.255.0set allowaccess ping https ssh snmp http fabricset type physicalset lldp-reception enableset role wanset snmp-index 1nextendFortiGate-HomeLab #FortiGate-HomeLab # show system interface vlan20config system interfaceedit "vlan20"set vdom "root"set ip 10.10.20.3 255.255.255.0set allowaccess ping https ssh snmp fabricset device-identification enableset role lanset snmp-index 29set secondary-IP enableset interface "port2"set vlanid 20nextendFortiGate-HomeLab #FortiGate-HomeLab # show firewall policyconfig firewall policyedit 1set name "vlan20-port1"set uuid a58b44a4-3d9d-51f0-e235-a09bba7147a0set srcintf "vlan20"set dstintf "port1"set action acceptset srcaddr "vlan20"set dstad

Does someone know which ports are used for vpn ipsec tunnel under sdwan scenario considering this fortigate is behind a NAT ISP connection? apart from UDP 4500 and 500 ports which one are require to allow it.

Hi All, I have been trying to get DLP to block a custom file type which is *.kdb      so by custom, I mean a file type not included in the default file filter list.  I have tried two different ways - by creating a filepattern using "config dlp filepattern  and attaching that to a DLP profile, and attaching that to my policy. Did not work. So I then created a dictionary with regex value for the file type, set pattern "\\.pmb$", and attached it to a sensor, profile, policy. None of these seem to work and the DLP is never triggered. Any ideas? Thanks. 

I am using Fortigate Firewalls between Windows clients and domain controllers. In this case by allowing DCE-RPC, does the firewall allow the required return sessions without allowing dynamic port range? What are the requirements like firmware, IPS etc?

any help " device is already added in a different domain , please contact Fortinet support 

 I have two network segments: 10.100.x.x and 10.200.x.x networks. I've successfully established a VPN tunnel between these two different subnets using Fortinet FortiGate-60F(SD-WAN). I have configured a virtual server with the following setup:Virtual IP: 10.200.0.250Mapped to real servers: 10.200.0.102 and 10.100.0.102Health check is configured for both serversIssue: When I shut down the server at 10.200.0.102, the traffic is not being forwarded to 10.100.0.102 as expected. The load balancing/failover mechanism doesn't seem to be working across the VPN tunnel. Network Topology:10.200.x.x subnet: FortiGate internal IP 10.200.0.254, Server 10.200.0.10210.100.x.x subnet: FortiGate internal IP 10.100.0.254, Server 10.100.0.102VPN tunnel: IPSEC connection between the two subnetsVirtual IP: 10.200.0.250Questions:What could be preventing the traffic from failing over to the cross-subnet server (10.100.0.102)?Are there specific firewa

In our environment, we use FortiClient VPN version 7.0.14.0585. We started researching into the possible benefits of Intune, so I configured enrollment, compliance polices, and a simple BitLocker requirement. Those are the only changes to our Entra/Intune environment that I made. Soon, I had rolled Intune out onto a few computers in our division. One of our employees notified us of issues connecting to the VPN, and we suspected Intune to be at fault. Sure enough, when Intune was removed the issue went away. Screenshot is attached. When clicking yes, you are brought a blank page with a 300 second time out.

Hello, I found this thread: https://forum.fortinet.com/tm.aspx?m=68922 from four years ago discussing whether or not there is a bug tracker that is accessible.  I couldn't find one so I have to guess no is still the answer.  That leads to the question, if release notes only tell you the following bugs were fixed, how are you supposed to know if the fixed bugs are actually relevant to your environment, and/or a security concern?   I'm running 2.5.3 and 2.5.4 just came out.  It fixes seven bugs, identified only by ID number.  Are they critical security issues?  Display issues that I could care less about?  Should I schedule an emergency outage now?  Or never since the bugs don't matter to me? How does one make the decision with no information?  

Hello all,I have a client where WIFI is prompting as though captive portal is enabled while set to WPA2-Personal.We've updated both firewall and APs to the most recent version 7.2, to no avail.Next attempts will be a downgrade to observe if the issue persists on 7.0I will be happy to add details or information as needed. Hoping someone can help.**EDIT**This issue started last Friday 11/4 (no changes or updates that we are aware of)Current config:config wireless-controller vapedit "guest-test"set ssid "testSSID"set passphrase ENC set intra-vap-privacy enableset schedule "always"nextend

  Normally our internet speed at company should be 500 mbit/s corporate internet.Here is my configuration SO: GPON router LAN/WAN > Forti WAN Port > PORT1 > HP managed switch > AP devices.But We get 70-80 mbit/s internet speed.Because of this installation ( which I think is something wrong ) I created a DMZ Host on Gpon Router     

Hello,I am trying to configure my home FortiGate 40F as an L2TP client. I have followed the steps in the official Fortinet technical article, but the connection is not working as expected. I would like to ask for help with the following points: 1.Are there any additional configuration steps needed beyond the guide? 2.How do I properly configure L2TP with an IPsec pre-shared key (PSK) using the CLI? Where should I enter the PSK? 3.When I run diagnose vpn l2tp status, it shows “disable.” What could be the reason? 4.After setting up the L2TP client, are there specific firewall policies, NAT, or routing configurations required for proper connectivity? Here is my current configuration:config system interfaceedit "wan"set status upset l2tp-client enableset l2forward enableconfig l2tp-client-settingsset auth-type autoset defaultgw enableset mtu 1460set user <user_name>set password <password>set peer-host <host_IP_address>set peer-port <port>end

Hello everyone, Im curious if there is a way to filter inbound IPSec VPN connections by source address per tunnel on Fortigate. So far i saw that you can do it if you use IKE v2 and select the option "set remote-gw-match", but this only allows any, iprange, ipmask or country. Theres no way i can use an Address Group for this? The reason is that i have people that connect to my Fortigate that have 2 (or more) different outbound public addresses that do not belong to the same IP block, so i cant wrap them on a ip range or ipmask without adding unwanted IP addresses. Thank you in advance! 

I want to ask, how to change registration email to another email in fortigate?

I have a Fortiwifi 30g running OS v7.2.11I have a Fortiswitch 108F-FPOE running OS v7.6.1 connected to the Fortilink A on the 30g.Both devices are on the latest available OS version.I have a Playstation 5 connected to port 2 on the switch on it's own VLAN.I want to create a dedicated wifi network that is only connected to the same VLAN the PS5 is on.The 30g doesn't support bridge network mode.I've created SSID and put the VLAN ID into the "Optional VLAN ID" field in the SSID config but when I connect to the SSID I don't receive an IP address.I have looked through the forum and help section and nothing has worked.I have tried: How to create a new Bridge SSID with its VLAN dedicated for users Combining WiFi network and wired LAN with a software switch for DHCP leases Plus watching multiple tutorials on YouTube.If I make a Bridged SSID I cannot add it to the FortiAP profile and see a message stating"Bridge mode is not available on local WiFi radio" I have created