Support Forum

Hi Team  FortiClient Androide Manged by SASE request password for install Certificate. How can i config or find the password ? FortiClient  FortiCloud Products 

Hi,  Would like to manage the web-server certificates automatically for some Fortigates using ACME protocol connecting to an internal PKI ACME server. As far as i can see, there is only the option of connecting via ACME to Let's Encrypt. Is there any option of using ACME via Fortigate but using a custom ACME server? Othewise, will have to create a custom script to manage the certs leveraging FortiManager/FortiGate API. Thanks,

We have encountered a problem that the VPN version 7.4.1 cannot connect. The following is a screenshot of the specific cause

Pleas check my website - trainingcq.comIt is on black list,I cleaned all the files and scanned for virus Thank youAvihay

Hello Fortinet Community, I'm encountering an issue with application control on my FortiGate 60F running firmware version 7.4.8M.Scenario:I created a WAN access policy that allows NTP, DNS, and PING services only.  Additionally, in the Application Control profile applied to this policy, I allowed only the following applications:NTPDNSPINGAll other applications are set to block.Issue: Despite allowing DNS in the Application Control settings, I'm seeing legitimate DNS traffic being denied in the logs. This traffic is:Port: 53 (UDP)Destination: 8.8.8.8 (Google DNS)Action: DeniedDetected Application: GitHub    It appears the firewall is misclassifying some DNS traffic as the "GitHub" application, which is not allowed by the control policy, and thus it's being blocked. What can I do to fix this without disabling Application Control Profile.Any insights or suggestions would be greatly appreciated. Thank You.

Hi All,  I hope this email finds you well.I am writing to request your assistance with configuring multiple VLANs on our network. Below are the details of the configuration we need:VLAN Configuration on Firewall LAN Port:We need to configure two VLANs on the LAN port of our firewall, each with a different IP address.DHCP Configuration:Enable DHCP for both VLANs to ensure proper IP address allocation.L2 Switch Configuration:We have an L2 switch that needs to be configured under the firewall LAN.Could you please provide guidance or support on how to proceed with these configurations? Any documentation or step-by-step instructions would be greatly appreciated.Thank you for your assistance.  

Hi,I've been trying to create an IPSec VPN connection following the IPSec VPN Wizard but for some reason this connection is not working, I tried several ways but without any success... Any suggestion, help or ideas of how can work are welcome... 

When I am creating FortiManager instance on AWS I am unable to pass through second step of configuration wizard "FortiManager Setup - Register and SSO with FortiCare". I am always receiving "An unexpected error occurred message". Connectivity to this instance seems to be ok, i am using default security group, pings from FortiManager VM cli are ok, dns works fine etc.What can be the reason? Is there any way to skip this step?  

Hello,I have a question about FortiGate 500. I have an OpenVPN server with a private IP address of 192.168.1.2. I have assigned this server a public address like 1.2.3.4 and my server uses this address to connect to the internet. Now I want to assign a public virtual IP address, such as 1.2.3.5, for users to connect to this server via the Internet.Is it possible? Thank you.

I am looking for NSE7_OTS-7.2 course material ,could any one pls. share

Hey guys, I'm having a problem installing the VPN with Forticlient. The installation stops prematurely and displays this message. Have you e xperienced something similar?  

What's up people, sorry for my imperfect English but I will do my best to make myself understood, sorry in advance.Just a week ago I changed the way some branches were connected to my matrz. I was using openvpn on my ubuntu machines and from matrix I could access the machine via terminal to do updates, install packages, see how the network connection was and so on.Now, I switched to using the VPN of Fortigate, I saw some documentation but I still do not understand if you can do something similar to see the ip of the computers of my branches, because if before I saw their individual ip from openvpn, now I only see the ip of my forti, which is my gateway.Because of this, I can't access my computers as the ip is the same for each and every one of them (my forti's).I wanted to know if anyone knows a way to correct this and be able to simulate what I had before but with the fortigate VPN.Part of the problem is that also from my branches to matrix I can see my equipment by Ip but not from my

Hi,I'm working with the following setup:FortiGateFortiAuthenticatorFortiSwitch (wired access)FortiAP (wireless access)User identities are synchronized into FortiAuthenticator via SAML from Azure AD. Based on SAML group membership, I assign users specific VLAN IDs and group name attributes.Wi-Fi Scenario (FortiAP):802.1X authentication is handled by FortiAuthenticator.FortiGate acts as the NAS and receives RADIUS accounting.FortiGate successfully builds RSSO sessions, including username, IP address, and group name.I can create identity-based firewall policies based on the group – :white_heavy_check_mark: this works perfectly.LAN Scenario (FortiSwitch):802.1X authentication is again handled by FortiAuthenticator.FortiSwitch acts as the NAS and communicates directly with FortiAuthenticator.FortiAuthenticator assigns the correct VLAN ID, but FortiGate does not receive any identity/group info.In Firewall Users, no username or group is shown – only traffic from IP within the VLAN and have na

Our hub and spoke have two ISP's. However when one of our wan connections fails over on a spoke, BGP will continue to try to send the routes to the hub over the downed interface. The only way to make it flip to the correct interface is by editing an SDwan SLA rule or a reboot. I worked with TAC for 4 hours tonight, but didn't have any luck solving it.We are using BGP over loopback and on version 7.4.8. Anyone else have this issue? If you have a working config, could you post it?Thank you

Hi!I've enabled receive/transmit LLDP globally and confirmed on adjacent (Cisco) switches that this works for all Fortigate interfaces.However, on Fortigate, "diagnose lldprx port neighbor" shows expected information, except that it excludes the interface (mgmt1) I provisioned as a Reserved HA Management interface.How to show LLDP neighbor for ha-mgmt-interfaces?Thanks!

Dear all, I want to know for the sake of knowledge as i have to implement this scenario at my small office. How can I manage two fortisw (LAN and Internet facing Fortisw) from single fortigate firewall.  Can I manage using this diagram.  

hi,i recently migrated from ASA to FGT and received complaints that HTTPS traffic is very "slow".when i moved back to ASA, it works fine.i suspect there's an issue in MTU or TCP MSS or both along the path.1) can someone advise what is the "optimum" value for MTU and TCP MSS?2) is there a way to know/test this from client machine?3) should i set either one or both to 1400 or 1300 to avoid "slowness" issue? config system interfaceedit "wan" set mtu-override enable <<< DO I NEED TO ADD THIS? set mtu <MTU Value> set tcp-mss <MSS Value> next edit "lan" set mtu-override enable <<< DO I NEED TO ADD THIS? set mtu <MTU Value> set tcp-mss <MSS Value>  

Hey guys, I'm trying to get an IPsec VPN working for a client since their new FortiOS firmware dropped SSL-VPN support.Here's the problem: The very first time I built the IPsec VPN, it looked like it connected, but I couldn't actually get to the internet or my DNS server through the FortiGate. Thinking it was a glitch, I ended up deleting it, re-making it, and deleting it a few times. Now I'm getting this persistent error when I try to set it up:"Unable to setup VPN. The rollback process has encountered an error. Orphaned objects may still exist in the configuration database." I've made sure to clean up everything after deleting the VPN each time – references, static routes, firewall policies, address – but this "orphaned objects" error just won't go away. Has anyone seen this before or know how to fix it? Any help would be awesome

Hi All,Good Day.  I have some issues with FSSO where it is not hitting the firewall policy and traffic is getting denied.  My setup:- I have a  DC agent installed on the DC server itself. - A collector server (Separate)- TS Agent installed on Citrix.  Issue:When user logs in to the Citrix, the TS agent is able to get the port and the username/IP and send it to the Fortigate.I can see the user authentication on the Fortigate User Auth page but the rule is not hitting as the user ID is not a match. I have got a TAC case raised but not much help as they could not find the fault.I am seeking assistance from the community to see if there is anytone can help and guide me to the right direction.  I am have configured TS server to connect to the CA via Secure Connection on port 8003.Appreciate any help that you can provide/share.Similar issues to what is described here:https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-TS-Agen

Hello. We are getting ready to migrate to a new Fortigate 101F. Our current device is a Fortigage 101E.  The version of FortiOS installed on the new device is 7.2.8. Should I upgrade to 7.2.11 or go to the latest 7.4 release. We are currently running 6.4.16 on the 101E.

In the Fortigate, WiFi & Switch Controller > FortiSwitch VLANs, I have assigned different colors to each VLAN.For my FortiGate 100F that is still running v7.4.7, those VLAN colors carry over to the WiFi & Switch Controller > FortiSwitch Ports in the Native VLAN and Allowed VLANs columns.But on my FortiGate 100F that is running v7.4.8, the Native VLAN and Allowed VLANs columns show the same port icon color for every VLAN.Anyone aware of a setting I've overlooked that controls whether or not to show the VLAN colors on the FortiSwitch Ports list? Switching to the Faceplates view, the port icons are colored to match the Native VLAN. But I'd really like to get back the color coding for the Ports list view.Thanks!

Good morning, Got a weird problem that shouldn't be a problem regarding Fortivoice and the Fortifones.  We have about 10 employees that have two phone numbers (one for each company they represent) and for some reason they can't be assigned to a phone. Example: Mike has the phone number xxx-xx-xxxx for company A and it's assigned to extension 3000Mike has the phone number yyy-yyy-yyyy for company B and it's assigned to extension 3001Mike has a Fortifone FON-280B on his desk.  It has 4 buttons along the right side.Mike would like the 1st button be for the xxx-xx-xxxx number for company AMike would like the 2nd button be for the yyy-yyy-yyyy number for company B Our 3rd party implementation team has having issues with it and/or the Fortinet support either isn't understanding or it's not possible.  I should note that I don't have admin access to the system but any suggestions offered I'll pass along. I mean, It's not rocket science.  Our old pho

Hi all,One of our customer is currently managing Fortigate device using FortiManager. The Firewall has VDOM activated. On the firewall, I created one admin user (with prof_admin admin profile, so RW access) to allow management of one VDOM only (root). When the admin user connects to the Fortigate, it receives a prompt that 'This FortiGate is currently managed by a FortiManager device' but the Login Read-Write button is missing. So the admin user has only read access even if the prof_admin (RW access) is assign to him...What can I do to solve this problem ??Regards,HA

Hi There,I have 40F running 7.2I have Site2Site IPSEC VPN Running.I have added to to Phase 2 the Subnet that is used for the Remote Access SSL-VPN users (172.16.255.0/24).over the split tunnel - I've added the subnets that are in the remote S2S Firewall (because these are the relevant subnets).I've added a rule over the firewall - do I need to set anything else ?here is the configuration I've used:config firewall policyedit 26set name "POD1"set srcintf "ssl.root"set dstintf "S2SVPN"set action acceptset srcaddr "SSL VPN"set dstaddr "POD1"set schedule "always"set service "ALL"set users "pod1"nextend config vpn ssl settingsset servercert "SSL-VPN"set tunnel-ip-pools "SSL VPN"set source-interface "wan"set source-address "all"set source-address6 "all"set default-portal "SSL_VPN"config authentication-ruleedit 1set groups "VPN_USERS"set portal "SSL_VPN"nextendend config vpn ssl web portaledit "SSL_VPN"set tunnel-mode enableset web-mode enableset limit-user-logins enableset save-pass

There is vulnerability find in Fortidevsec tool. We verified with developers, as they are saying there is no possible to inject in logger. Hence they are saying false positive. Is it possible to false positive? what are the things to verify in the code level?