Support Forum

Hi FortiGate Techies, 1). I want know how to check the interfaces bandwidth utilization more than a week and in firewall it is showing only for 1 Week. i want 1 year utilization for the particular interfaces. by using Forti Analyzer also we tried to take the reports but in Forti Analyzer also it is generating total device bandwidth utilization not for particular interface.2). And how to check the how much speed is going on my particular interface per second and this reports also I required for 1 year.  FortiGate  FortiAnalyzer  FortiClient 

Hi, Is it possible to set up FortiGate to authenticate macOS native IPsec VPN clients through Active Directory, without requiring the Macs to be joined to the domain?  Our goal is to remove local user accounts from FortiGate and transition macOS users to centralized authentication using LDAP, just like we do for Windows users.  FortiGate 

I have set a couple of FortiGate VPN connections to AWS in the past and it was with two individual IPsec VPN tunnels with two static routes that had different administrative distances. Each IPsec tunnel required me to enter a /30 CIDR IP Address rather than 0.0.0.0, which affected the static routes Gateway IP through the VPN tunnel. I wanted to see if it Is possible to create an Redundant Aggregate VPN tunnel to both AWS VPN Tunnels rather than two individual sets of IPsec VPNs (2x IPsec tunnels, Firewall Policies, Static Routes, etc.).Creating the two tunnels and joining them into the Aggregate tunnel is simple enough, but I need clarification when it comes to the static route(s) and the AWS 2 IPv4 CIDR Addresses. Original configuration required manually adding /30 IPv4 CIDR for each tunnel which updates the Gateway IP for each static route. It seems that an IPsec-Aggregate only allows one entry from 0.0.0.0/0. 

I'm running 40F with the latest version, it has FortiSwitch connected to it and managed by the 40F running the latest firmware as well, and 831F access points connected to the FortiSwitch, using the latest firmware managed by the 40F.I understand that the recommended version is 7.2 and we're running 7.6looking at the downgrade guides it says that the configuration would be saved.is there a way to downgrade remotely without losing configuration ? or the only path is to downgrade and re-configure everything manually again ?  

I'm using a WLAN NAC policy to transfer clients between VLANs based on FortiClient ZTNA Tags, but it takes 2-3 minutes before a client is moved from the onboarding VLAN to the destination one. I already did the optimization regarding this doc:  https://docs.fortinet.com/document/fortigate/7.0.0/new-features/527756/fortigate-nac-engine-optimization But I think it's not sufficient. I'm using FG600 with FortiOS: 7.2.11

 Hi all - I have been fighting with the FortiManager API for a while now.  With a Python script, I've been able to:Authenticate to FortimanagerQuery all Fortigates in FortiManageLoop through the devices to find a specific FortigateCollect details from any individual or all Fortigates includingInterface Status, IP address, subnet, vlan and descriptionGrab the Switch Hostname, Serial Number and number of portsI am struggling with figuring out how to pull the switch details for:Mgmt IP addressModel Number (It appears to part of the start of the serial number)I'm pretty sure I can get it pretty easy from the FortiOS directly, but I'm really hoping to pull the details from FortiManager with the same "connection".  I can see the details in FortiManager under FortiSwitches. Any ideas anyone? Thanks,-Todd 

We just received licensing for FortiClientEMS, and I'm not following the documentation for setting this up. 1. The request to build the FortiClientEMS server has been sent, but it will be a few days before it's ready. I don't have the ability to test anything on the server at the moment.2. We want to use Entra ID for the SAML SSO authentication. Do I need to configure SAML SSO on the FortiGate or the FortiClientEMS server? On the admin guide, this is stated: "Communication between EMS AD connector and AD servers: Enables synchronization of AD groups and users with EMS for endpoint management, policy enforcement, and SAML-based authentication." This occurs over TCP-8871, so I'm confused if the FortiGate or FortiClientEMS server authenticates the user. However, on all our FortiGates that are configured to use SAML SSO for administration, this is configured on the FortiGates.3. The FortiClientEMS documentation shows TCP-389/636 for LDAP to the AD servers. We do have on-prem AD server

HI Community  Is there any way to change the time zone setting of FortiSASE generated reports. By default it came from GMT  

Hello,   I would like to ask you for yur opinion on this:   I have two ha clusters:   Cluster #1 has two 400Fs and is active-passive Cluster #2 has two 200Fs and is active-passive   between these two clusters is a link. This is an LACP Aggregate Interface with two ports (2x10G SFP). Should there be a switch in between the two clusters? Can they be connected directly? I could disable the LACP participiation of the secondary node on each cluster to avoid mac address conflicts (since without switch there is no LAGs) which wouldn't be a problem since the secondary node is passive anyways.   what would you say is best practice here?  I found support docs that show it without switch but I also heard ppl say you have to have a switch in here...   So I am unsure now and also wo talk about a load of money (switches with many sfp ports are really expensive).

One of our users have reported everytime they try to connect to the VPN it disconnects them from their network connection.  Does anybody have any potential solutions? 

HiI need FortiClient VPN Online Installer on macOS using .pkg, with silent installation and preconfigured VPN, via ManageEngine Endpoint Central.So, Can I get the VPN-client only .pkg for MAC (not .dmg)? Currently we are using free version of FortiClient.We are using FortiGate at our company and have been using the FortiClient VPN client downloaded from the official Fortinet website. However, the available macOS download is a .dmg file, which only supports GUI-based installation.For software automation purposes, we require a .pkg version of the FortiClient installer (for macOS).If the .pkg version is only available with a licensed product, could you please let us know which specific product or license is required to obtain it?Thank you in advance for your assistance.TIA :)

coding using python to get the log in via API and process the data.. but the question is, when we use the API_Key from Forti, the content is empty, as if the API_Key used does not have authorization to get that Intrusion Prevention data. However, when I tried to use a cookie that was the result of intercepting the API.. there was a result

Hi - Does FortiClient VPN software (paid or free version) has a kill switch feature... meaning if VPN drops the PC should get disconnected from internet until VPN connection is up again.

Good morning!Can I make a usage report for my fortigate interfaces? To receive in my e-mail? If I can also configure something to receive an alert if my link exceeds the contracted limit.

Hi everyone,my colleague and I are working on a migration project involving several FortiGate 50E units that need to be replaced with new 50G models across three different sites. We've already downloaded the configurations from all the existing devices.What’s the best approach to transfer the configurations to the new FortiGates?Has anyone used FortiConverter for this specific model change (50E → 50G)?Any tips, recommendations, or best practices would be greatly appreciated.Thanks in advance!

We have recently started using FortiPAM 1.5 and are experiencing some challenges.We have a SCADA system for video, which is based on MediaMTX with three video servers.The issue is that when I create a "web account" target with the associated secret, I am able to log in to the SCADA website itself.However, the video is opened directly from my PC to the video servers. This traffic needs to go through the proxy, just like the SCADA website.I have tested various things, including adding the IP addresses of the video servers to the Domain list IP mask list on the target.This has not helped. FortiPAM does have access to all the video servers over the local network. What needs to be done to make this work? 

Hi, I have a question about configuring the connections between FortiSwitches.I currently have a FortiSwitch 148F that connects to a 124F.These two switches are connected with a single LAN cable (cable A) between the Fortilink ports and a single LAN cable (cable B) between two standard ports.Isn't it possible to also convey normal traffic via the Fortilink connection?The other question concerns the possibility of increasing the connection cables between the FortiSwitches to two.What is the most suitable solution to maintain the Fortilink connection and do LAN aggregation?Thanks.

Hello, Our Fortimail rejects emails which are too big Is it possible to get a daily report with the rejected mails (from, to, subject, date) ? Thanks for your help.

I have 205 switches (version 7.4.3 )registered on a FortiGate VM08 (version 7.4.5 ), which is itself registered on a FortiManager (version 7.4.7). However, only 69 switches are properly synchronized and managed through both the FortiGate and the FortiManager. The others are not receiving the configuration via the FortiGate. Could the issue be that the FortiGate VM08 can only actively manage a limited number of switches (for example, 69 or 96 maximum) through FortiLink?I'm looking for confirmation from TAC or documentation reference if possible.Thank you!

Hello,I have a problem with the explicit web proxy function.We run a Fortigate 200F with 7.4.7. Before that we had a 240D.I have a program that runs on a Server using proxy. Never had any Problems with the 240D.Now we switched and I am getting this Error: HTTP.status:::Error:The connection to the Site 'https://ratsinfo....' could not be established.Errorcode '80072F78':The Proxy- or Webserver has send a 'TimeOut'.HTTP-Header:(HTTP-Objekt nicht verfügbar)SendTime(s): 15Retry not possibleintern errormessage: 7ERROR Microsoft.HTTPCANCELED Here the Original text in german: HTTP.status:::Fehlerhinweis:Die Verbindung zur Seite 'https://ratsinfo-kleinblittersdorf.de/gi/netdata1.php?q=1&version=542&v=10:15:28' konnte nicht hergestellt werden.Auswertung Fehlercode '80072F78':Der Proxy- oder Webserver hat eine Meldung 'TimeOut' gesendet.Mögliche Ursache(n):Die Verbindung zum Internet kann nicht aufgebaut werden.Prüfen Sie die Einstellung zur Internetverbindung.Prüfen Sie,

I have configured call restriction profiles for certain extensions, and it works correctly. However, I need to change the default audio file that indicates "no permissions and please contact the administrator" to another language (Spanish). I've already preloaded an audio file in Spanish, but I can't find the option to associate it with the call restriction. Has anyone experienced the same situation? FortiVoice 

Hello, I am having an issue when generating a custom report on FortiAnalyzer.I have created a custom dataset, added it to a chart and when I run it from here with real data, the table is showing successfully with data.The issue is when I need to add this chart into a report and run it, I always get in the pdf report No matching log data for this report but when I run it directly from the chart tab it is working.Below is the dataset created, appreciate your help why in the report it is not workingSELECTsrcip,dstip,action,policyid,user,$calendar_time(itime) AS "time_stamp"FROM $logWHERE $filterAND type = 'traffic'AND subtype = 'forward'AND policyid = 120AND `group` = 'users'ORDER BY eventtime DESC 

Hi everyone, bit of a niche problem, I have many students working from home with laptops provided by us, they are hard configured to browse by the proxy we have set and they're locked down to keep it that way,  they can browse some times but not all. So we have an implicit proxy exposed on the FG's wan interface.The proxy is configured to default deny.There are proxy policies in place permitting access to Azure for the auth process to succeed which it doesA default policy is inplace that has the SAML_Group object associated against it to permit the learners access to the web, src=all + SAML_Group, dst=all, security= student-web-filter, Full SSL inspection.Clients win11, have the CA cert installed from the gate to their trusted ca stores. A session token is provided to the user post auth with 5 minute timeout.The user on their laptop can browse the web to certain sites, but then it suddenly blocks them going from say google to whatsmyip.In the logs I can see the successfu

Hello Team,I am trying to rewrite  https://exapmle.in.com to https://exapmle2.out.net (URL are fake).I have tried HTTP header rewriting ( without success) and body rewriting 9 the URL was redirecting to the new URL, which is not our case).We need to keep the traffic to Fortiweb and not redirect the traffic to the end URL.Bello the config config waf url-rewrite url-rewrite-ruleedit "ASK-AI-REWRITING"set host-status enableset host exapmle.in.comconfig header-insertendconfig response-header-insertendconfig header-removalendconfig response-header-removalendset request-remove-duplicate-headers disableconfig match-conditionedit 1set reg-exp exapmle2.out.netset HTTP-protocol httpsnextendnextendconfig waf url-rewrite url-rewrite-ruleedit "ASK-AI-REWRITING-2"set action http-response-header-rewriteset location_replace $0exapmle.in.com$1set location-status enableconfig header-insertendconfig response-header-insertendconfig header-removalendconfig response-header-removalendset respo

Hello,I’m encountering a persistent issue on my FortiWeb device. In the logs, I consistently see entries like: Main Type=HTTP Parsing Error, Sub Type=HTTP Parsing Error Action=alert_Deny To troubleshoot, I have disabled both “Malformed Request” and “Malformed URL” options under HTTP Protocol Constraints. However, these logs are still being generated, and the traffic is denied.I have checked the configuration but couldn’t find any explicit setting to disable or further tune the handling of HTTP Parsing Errors.My questions:Is there a way to disable or adjust the detection for HTTP Parsing Errors?What else could trigger this log even after disabling the relevant protocol constraints?Are there any hidden or advanced settings I should be aware of?Any suggestions or documentation references would be greatly appreciated!Thank you.