Support Forum

Hello - New to the Community and Wondering if Someone had some thoughts that I am missing. I have a branch that uses an HA Pair in Active-Active mode running through the Primary Adtran Switch of a Four Switch Daisy-Chain. I have taken over for an MSP and Previous Admin that are no longer hired by the company and our current MSP is unable to resolve the current problem and neither them or myself are able to login to the current switch to review the setup used for the HA. The switches are old and need to be replaced since they are End of Life. I have attempted to establish the new switches with an HA configuration for the HA pair and all looks good, except that I now have packet loss and dropped packets about every 20 packets. The HA was in Active-Active Mode and I have the ISP Connected Ports Trunked with LACP enabled along with one respective connection to each FortiGate (A and B) that are also LACP Enabled. STP is setup and Loop Protection disabled. I have rev

Hi Team,I was trying to edit an existing BGP route-map via FortiManager but cannot save the configuration. I am getting this notification while doing so.Error: rule/1/set-priority : out of range - prop[set-priority]: value 0 out of range (1,65535).But I don't see any attribute or priority to set in the route-map configuration dialogue box. Please do let me know what am i missing here.Warm RegardsFortiManager FortiGate 

Hi EveryoneWe have a Fortigate 80F currently configured with WAN1 only.There are many MIPs configured with this current Class C under Policy Objects -> IPv4 PolicyWe are migrating to a new ISP provider and have a new Class C.I am hoping to be able to configure this new ISP on WAN2 and create new MIPs  using the new Class C.Is this possible without bringing down the current WAN1?This is a production FW so causing a routing issue will be a disaster.The current WAN1 will be disconnected once the new WAN2 is tested successfully.Any help or direction is GREATLY appreciated!

Recently I have recieved this email from forticloud:-------------Start-----------------Dear Customer,We are reaching out to inform you about an important update regarding FortiGates provisioned to FortiGate Cloud without active subscriptions.To ensure robust security posture of your devices, starting Feb 28, 2025 FortiGate devices without an active FortiGate Cloud subscription will be required to upgrade to the latest firmware patch within 7 days of patch GA release.This change ensures enhanced security, reliability, and compliance with the latest features and updates provided by FortiGate Cloud. FortiGate Cloud will provide notification and prompts for upgrade when new patches are available on the web portal and the option to configure the upgrade time/day window of choice within 7-day schedule for convenience. Please note that cloud access and log upload to FortiGate Cloud can be restricted if not upgraded for devices without subscription.What does this mean for you:1. To maintain un

Hello Everyone, Does FortiWeb ML Based Bot Protection need a javascript to be injected ? I am asking if it can be used for API traffic as well  Does FortiWeb ML Based Bot Protection need a javascript to be injected as from what I have read from FortiWeb Bot Protection: Machine Learning based Protection  it seems that the Biometric Based and Deception based Bot features would need this but I see no reason for ML/AI to need it. Outside of that I wonder if during DOS attacks normal urls start returning 5xx (Nginx returns 503 during DOS) or does not respond will this cause false positives as FortiWeb needs to be aware which urls were returing normal 2xx or 3xx responses and not to block the user with Bot protection?    

Hello team! I have a new question about FortiClient EMS.I need to authenticate FortiClient users with an active directory domain and with 2FASo far, I could add the active directory domain in my FortiCllient EMS, and I can use the domain users when I connect a FortiClient (Without 2FA)When I started to search into this, the first option I found, needed to have FortiAuthenticator, but we dont have FortiAuthenticator.The second option that I found, is using Fortigate with the security fabric option, but my fortigate is not in a security fabric, because we havent any FortiManager or FortiAnalyzerI did not found any other method.Is there a way to add 2FA to AD domain users just using FortiClient EMS and Fortigate? Thanks in advance.Regards,Damián 

It appears I am missing some features like log view and in the adom I also dont see options for where to save logs, on which disk. Is it because I am using payg?  

Hi all, I am using Fortigate v7.4 version and calling APIs to get the details of firewall( 1 ) cmdb/firewall/policy( 2 ) cmdb/user/local etc.Above one is applicable for v6.4.15 version also? Could you provide the direct API docs of v6.4.15 version. 

Hi team, I have some doubts about integrating remote FortiSwitches to FortiGate. I have read this document, but I still have doubts:https://docs.fortinet.com/document/fortiswitch/7.6.3/fortilink-guide/801182/fortilink-mode-over-a-layer-3-network This is my topology: SW-1 and SW-2 are not a stack, they are independent switches. SW-1 and SW-2 internal IPs (192.168.1.x) can reach FGT FortiLink IP 10.10.1.1. I will use in-band management for the FortiSwitches (the internal IPs).On the FortiSwitch, will these be the commands for SW-1? config switch-controller global  set ac-discovery-type static  set source-ip 192.168.1.2                  <<<< in-band internal IP?  config ac-list    edit 1      set ipv4-address 10.10.1.1            <<<< FortiLink IP in FortiGate?    next  endend Am I correct? In FortiGate do I

Hi, After reviewing the forti demos at https://www.fortinet.com/demo-center and the documentation and some trainings I wondered what layer 3/4 and expecially layer 7 HTTP auto DOS protections are available without configuring manual thresholds in FortiDDos, FortiWeb, FortiADC ? I mean like by triggering DOS protection based on the web server latency in HTTP responses or web server starting to return more 5xx response codes ? I beliave that only fortiDOS offers auto thresholds as in the HTTP profile I see no manual thresholds like in FortiWeb or FortiADC but if I could get a confirmation?   

Dear, Analyzing the logs on my WLAN I see hundreds of repeated error messages. Failure Details: Action: DNS-no-domain Reason: Server 120.64.11.10 replied "non-existing domain" Message: DNS lookup of from client failed with "non-existing domain" This type of error is displayed for all APs. In "Reason" the IP varies a bit. Any idea what that might be?  Best RegardsAndré

HelloIs there a FortiGuard IP address threat feed? Like C&C, Spam sources, etc, ...I know we can block bad IP addresses directly from IPS, DNS filter & Antispam profile, but is it available from Fortinet as URI to use as external source in IP address threat feed?

Hi, Can someone please help me, I accidently delete my EMS IP on the connect page now I cant connect to my office computer, please help, I do remember my login details but not the IP, many thanks

We have two layer 2 vlans with the same vlan ID but different subnets at two different locations. Site 1 vlan99 10.1.X.0, site 2 vlan99 10.1.Y.0. We want to move a server on 10.1.X subnet to be hosted in the location where 10.1.Y lives without having to re-ip the server so the clients on 10.1.X can still access it and not see any changes. How is this possible to accomplish if possible at all without making other larger changes to subnets/client PCs?

Where do I find replacement 2.4/5ghz antennas that match the white originals? My Google Fu is not coming up a direct replacement option.

Hello fellows, I have the following situation:A FortiGate 61F (FortiOS 7.2.6) with a local DHCP service for the clients in the network and also a local DNS service with a "local.tld" zone. Using the DDNS mechanism, the IP addresses assigned via DHCP should be entered with the host names of the respective computers in the DNS zone.Unfortunately, this does not work in my case. I have made the following configuration, which should be sufficient according to the documentation: config system dhcp server    edit 1        set dns-service local        set ntp-service local        set domain "local.tld"        set default-gateway 10.1.1.1        set netmask 255.255.255.0...        set ddns-update enable        set ddns-update-override enable        set ddns-server-ip 10.1.1.1        set ddns-z

I am using windows server 219 and installed FortiClient 7.4.3. But I cannot see the row about “Security Posture Tags: ” Could you help to check the reason ?

Hello, dears,I hope this message find you well. I am trying to rename a FortiAP Profile, which is not the default one. However, there is no button or option.I also checked the CLI from the profile, but there was no option, at least I could not find one, for renaming the profile. I would appreciate any help. Sagvan Saleem#fortiap #fortiapprofile

Does anyone know the end-of-life date for the Fortigate 201E model? I can't find it in the Product Life Cycle.

I have created an IPsec Remote Access VPN tunnel. When I connect to the tunnel I am unable to ping any interfaces or devices on the LAN. I have firewall policies to allow all traffic to and from the VPN-to-LAN traffic. I am wondering if the issue has to do with my Phase 2 selectors being 0.0.0.0/0 for the local and remote addresses. I do have a static route of 0.0.0.0/0 to the WAN interface, and if it matters there is a site-to-site VPN tunnel set up as well that I would like to be able to ping across to the other site's LAN. Thank you all for your assistance in advance. 

My current 100F firewall is configured with 400 sdwan spoke members and each member with a health check SLA, but when health-check set interval is set to 1500 ms it affect my CPU process and reach 100% is there any range or limit suggested to avoid CPU increase ? 

hello, here is my problem. i have a vm that can switch off servers when there is a power outage, managing a ups. that vm can send ssh commands. it's easier to send exec shutdown instead scripting. if the firewall is master, no need to worry, failover will do its job. if the firewall is slave, no failover. so in order to easily switch off a firewall from a specif location, i need to need to connect to by its own IP address and not from the HA mgmt IP address. if i configure in band management ip address, the vm needs to be in the same vlan, and that is not possible. i can't add another network card. is there a solution for the vm to get a ssh connection to a specific firewall, i guess the solution can route the network flow. maybe out band management? i don't know. thank you  

Good afternoon!I have the following scenario and would like the community's help. I have a Fortigate VM with 2GB of disk space, only one disk. However, this same disk was expanded by VMware to 52GB. Fortigate continues to recognize only the initial 2GB. How do I expand just the main disk without having to add another disk?See the screenshot below:I saw in the lab that adding another disk and formatting it works, but how do I use the main disk that already has space?

Hey Everyone,  Is there an option FortiNDR be configured with the IP address of the AD server to detect AD attacks? I did see Device Enrichment | FortiNDR 7.6.2 | Fortinet Document Library but I was wondering not about enriching the other hosts but for FortiNDR to monitor the AD server IP address or FortiNDR to autodiscover it, so to detect Pass-the-Hash / Pass-the-Ticket, Kerberoasting, DC Shadow, DCSync or Golden/Silver Ticket attacks Active Directory Attacks ? For example by FortiNDR knowing that there are two AD servers on ip addresses 1.1.1.1 and 1.1.1.2 then if another host sends DCSync requests using MS-DRSR protocol to 1.1.1.1 or 1.1.1.2 this will suggest AD attack as only AD servers should use DCSync between them.  

Hi, I have a fex-40d which I would like to use to provide primary internet access for a remote fortigate 60dI initially configured the fex-40d to local mode, passthrough. This worked for a few weeks but then stopped working and I had to do a sim swap before the lte conection came live again. I am able to connect my laptop to the ethernet interface, I get a passthough dhcp address and I get access tot he intenet. However, when I connect it the fortigate 60d I have not internet access. The passthough adress is obtained by the 60d but no internet access. Change it back to my laptop and I can access the internet. What is happening to the 60d that stops internet access (it used to work and does on a fortigate 60e) Is there some blocking going on the 60d? As an alternative config, I'd like to use the fex-40d in local NAT mode so I can still access the management interface of the fex. Does anyone have a good config for this as an example?I set the management to local and n