Support Forum

Hi, I have a fex-40d which I would like to use to provide primary internet access for a remote fortigate 60dI initially configured the fex-40d to local mode, passthrough. This worked for a few weeks but then stopped working and I had to do a sim swap before the lte conection came live again. I am able to connect my laptop to the ethernet interface, I get a passthough dhcp address and I get access tot he intenet. However, when I connect it the fortigate 60d I have not internet access. The passthough adress is obtained by the 60d but no internet access. Change it back to my laptop and I can access the internet. What is happening to the 60d that stops internet access (it used to work and does on a fortigate 60e) Is there some blocking going on the 60d? As an alternative config, I'd like to use the fex-40d in local NAT mode so I can still access the management interface of the fex. Does anyone have a good config for this as an example?I set the management to local and n

Hello, I need some help in the following topic, I am note able to solve to mix external end internal vlans into Fortilink. There is a FortiGate connected to 8 FortiSwitches via FortiLink interfaces. VLANs and subnets created on the FortiLink can be used on the switches without any issues. However, I need to be able to forward a VLAN arriving in a VXLAN to a specific FortiSwitch port. I can pass the incoming VXLAN as a trunk through a software switch to a manually configured switch without FortiLink, and I can use the VLANs. However, in this case, I lose the switch controller functionality, or I have to establish a separate physical connection. I would like to request assistance on how to switch a VLAN within a VXLAN to VLANs defined on FortiLink, or how to forward all tagged VLANs existing within the VXLAN to the switches via FortiLink. Thank you fro your help in advance. Regards,Antal  

Hey all,3 branch business, maybe expanding to a 4-5 branch business in next two years.Company might want to switch to fortigates as branch routers/firewalls, and fortiswitches for layer 2.What would you recommend I do for a setup? Currently using Cisco site to site VPN tunnels, but if we want to expand I'm worried it's not feasible to continue site to site. Thinking of a bit of a network change when moving to fortinet hardware.Any suggestions? Any thinks I should look up to make the swap easier?

I have configured a File Filter on a FortiGate 40F running FortiOS 7.6.3. The filter is applied to the LAN -> WAN policy and set to Both (two-way). However, the problem is that it only blocks files being uploaded from LAN to WAN, while downloads are not blocked.Additionally, the antivirus on the same policy correctly blocks infected downloaded files, so the issue doesn’t seem to be with the policy or antivirus itself. I don’t want to create a WAN -> LAN policy because I don’t want external users to have access to the LAN network.Also, I can’t find the PROXY feature in the configuration — it seems like it might have been removed or is unavailable in this version.Does anyone know if this is expected behavior for the file filter in FortiOS 7.6.3? Am I missing some configuration to actually make it work two-way? Any advice would be much appreciated.

Hello Team,I am deploying forticlient EMS and stuck at few things and would appreciate if some one guide:1. I had installed the forticlient EMS and created a remote VPN profile. This profile is pushed once the remote laptop is connected with the forticlient EMS.2. Lets say a user is working from home and I need to pushed the VPN profile on his laptop, if its not pushed, a user will not be able to connect to the VPN. So what will be work out of this, how a remote user gets connected to the EMS server and how this all will work?3. Also if there are two ISPs (Internet Service Provider) running, and we want to connect the remote users on both of them. Then what configurations we need to do on the forigate firewall and on the Forticlient EMS? Appreciate if someone could help on this.Thanks

I have a somewhat working setup on a 91G running 7.4.8, that I am struggling with. Sometimes it works fine, now it doesn't. I have IA-PD from my ISP, and it seems to be correct. I have three interfaces on LAN side that gets each their own /64: lan (shortened)    ip6-mode            :     nd-mode             : basic     ip6-address         : 2a01:xxxx:161f:670a::1/64    ip6-allowaccess     : ping https ssh     ip6-prefix-mode     : dhcp6     dhcp6-prefix-delegation: disable    dhcp6-information-request: disable     ip6-delegated-prefix-iaid: 1    ip6-upstream-interface: Vlan102     ip6-subnet          : ::a:0:0:0:1/64 The other interfaces have :b: and :c: respectively. Now, when it doesn't work I see that the FortiGate claims

Hello, i need to delete a test ipsec dialup vpn, this vpn has no reference but i'm unable to delete neither in cli nor in gui.It was firstly created via the vpn wizard and then changed to custom vpn.I also create a loopback and associated it instead of the wan1 interface but nothing changed.How can i fix it? Following the configuration: FW-VPN-A (ipsec_dialup_vpn) # showconfig vpn ipsec phase1-interfaceedit "ipsec_dialup_vpn"set type dynamicset interface "wan1"set mode aggressiveset peertype anyset net-device disableset proposal aes256-sha1set add-route disableset dpd disableset nattraversal disableset psksecret ENC jd2XioYxP9J8q0kk2kkqW11BE3YteLWRNpehZ1k6B0Ccmn1lmMjY3dkVAnextendFW-VPN-A # config vpn ipsec phase1-interfaceFW-VPN-A (phase1-interface) # delete ipsec_dialup_vpn This phase1-interface is currently usedcommand_cli_delete:6989 delete table entry ipsec_dialup_vpn unset oper error ret=-23Command fail. Return code -23Thank youRegards

Hello, some users in the domain can access the internet when they enter their own users in the agent after logging into the local admin account. I want to quarantine users who log in with local admin, how can I do this.

Hello Forti experts,I’m currently migrating from Stormshield to FortiGate.Is there any tool or script that could help me migrate the firewall rules (around 1000 rules) from Stormshield to FortiGate?Note: I’m able to export all the rules from #Stormshield into a CSV file Thank you 

For many days I have a big problems with manage unwanted traffic, connected with multicast on Fortiswitch. The all of packets come from LG tv screens and caused switch hanging what is not registered on other vendor like DCN or TP Link. According to your firt suggestion, our switch has been upgreaded to the newest SW but it did not have positive impact on transmission (IGMP traffic has been turned on as well). Let me know if you have similar problems and how to solve this problem.

 Hi Fortinet Community, I'm currently using FortiClient EMS 7.4 and FortiGate running FortiOS 7.4. When I try to access a server located in the DMZ using ZTNA access policies with ZTNA tags, I receive the following error:  Despite this, everything seems fine on the FortiGate side:The ZTNA tags are successfully synced from EMS.The relevant endpoint appears under the correct tag in the FortiGate.Running diagnostics shows that the endpoint is recognized and tagged appropriately."diagnose endpoint ec-shm list" command correctly shows the endpoint info.I can't identify where the issue is happening—whether it's on the client, EMS, or FortiGate. Has anyone encountered this issue or have suggestions on what else I should check? Appreciate any help or guidance from the community! Thanks.

Hello, we have to update a FG80E to a new FG90G cluster. We need SSL VPN, mayber later on we can change from SSL VPN to IPSec, but not now in the process of installing the new FG. After reading x posts about the SSL functionality and FG90G someone can tell me 100% with what FortiOS I have the functionality. I updated both of them directly to 7.4.8 without thinking about the SSL (they have 8MB RAM, what the hell????) and now without registering the FGs I cant even downgrade the FortiOS. Thanks,Roland

Hello, we are changing in one of our offices from FG80E to FG90G. In the FG80E we used Hardware Switch to use for our 2 segmentions in our newtwork. We dont use VLans in our network. Any suggestions to use VLan Switch or Software Switch. The normal LAN was configured as Vlan Switch and checking some KBs I saw that the VLan Switch is compared to the old Hardware Switch and using Software Switch there might be some memory issues. Any suggestions, I dont want to get to problems later on. Thanks!

FortiNAC-F - How to Configure FortiNAC as a Local RADIUS Server for 802.1X Authentication (Part 1) In this video, we walk you through the step-by-step process of configuring FortiNAC as a local RADIUS server to enable 802.1X authentication.  This is a vital setup for ensuring secure network access control by validating user and device credentials before granting access to your network. :pushpin: Key Highlights: Understanding the role of FortiNAC in 802.1X authentication Setting up FortiNAC as a local RADIUS server Configuring user credentials and policies for secure access Integrating with switches Testing and troubleshooting the configuration  Whether you're a network administrator or a cybersecurity enthusiast, this tutorial will give you the knowledge you need to enhance your network security with FortiNAC. https://youtu.be/KqkxFoYvG2w

Hi Fortinet Community, I have set up a Fortigate Captive Portal, and I'm having a problem with regards to its Authentication Timeout, already set it to 1440mins. after auth-timeout, my device is force to disconnect, then when reconnecting need to do re-authenticate.I've read somewhere here, to extend the timeout, instead of idle timeout use hard timeout to extend for at least a month. is there any way to do this with out any timeout? Thanks...

We have experienced an issue with specific in-house built applications that worked when not behind our Fortigate 7.x firewall but started to fail when we placed behind it. Turns out the application does not send keep-alive or heartbeats and so the session-ttl kicks on the FortiGate and kills the application. We worked around it by creating a specific rule on the Fortigate to increase the TTL for that application but we are wondering if it is possible to log these events and send to the FortiAnalyzer so we have visibility of this condition going forward as we move more applications behind our firewall? 

I logged in with an admin account to monitor the Fortigate interface, but after 10 minutes the account automatically logged out ( if not in use ). i created a secondary account but after using it for a few months, the same error occurred again.is there any way to guite me to fix it?  

How to configure the FortiSwitch Fiber 424E as line command interface to connect commutators.

Hi,  We have configured password policy for both admin and ipsec preshared key as below conf system password-policyset apply-to admin-password ipsec-preshared-keyset expire-day 90set expire-status enable Now the strange behaviour is, after 90 days we really didnt get any notification about ipsec preshared key expired neither IPSEC tunnel went down. We tried shutting down the ipsec tunnel and still the old key was working. There is no clear documentation about this in fortinet public document..This is working fine for admin-password where after 90 days, its prompting to change the password. With this scenario, can we assume that this password expiration is applicable only for admin password and not for ipsec preshared key??.. Please clarify it.. RegardsRaja 

  Dear Team Fortinet Comunity  I have issue this VPN IP Sec anomaly error status negotiate and failure and this issue looping errot stat , do you have any suggestion for the resolve this issue or manual to fix this problemThank you for support and cooperation  

Hi,I manage several firewalls using FortiManager, and I’d like to automate the regular backup of each firewall’s configuration. So, how can I set up this automation within FortiManager to export all managed firewall configurations to SFTP?  FortiGate FortiManager 

Hello and sorry for my english, In fortiauthenticator i created captive portal. All works very well ! But now i want to change logo on portal but when i go to 'administration' -> 'images' the button 'create new' is gray out. So i can't do nothing ! I can edit or delete images but not create. I am connect with admin account, i tried with other administratror account : same problem.thanks for help

Hi All, We have x2 Fortiswitch424E configured MCLAG using x2 10G fortinet DAC Cable.I encountered an issue where one of the MCLAG interface (port 25) keep coming up and down every few minutes.  Anyone got any idea what's happening?  Below is the error message that I found, 

 I have a virtual IP configured on Fortigate, and I can access the server via the virtual IP from any network, even from my cell phone.From the local network that goes through Fortigate, I also need to access the virtual IP via the browser, but nothing appears on the page.The interface IP address is in the same segment as the virtual IP, and all segments use the same link to navigate.I hope you can help me identify a possible problem.

Hi Community, If you have ever used FortiAP 23JF (Inroom, wall mounted) and used an Operation Profile to configure the LAN ports to specific VLAN's, like a VoIP or IPTV connection, you might get puzzled if you try the same on FAP231F or FortiAP 431F.The GUI in the Operation Profile has the same options as the OP for FAP23JF, but for some (strange) reason, on those models, you need to either A) use the CLI on the AP to actually enable the Bridge Mode, or B) create a configuration profile that does it on the AP's you assign that OP too. Why the FortiGate can do this all by itself on FAP23JF, but not on FAP321F or FAP431F is left out in the open.. For option A, a description is mentioned here.In short, SSH to the AP, after you have set the Bridge-To-SSID values on the AP/OP Profile, and then use these commands: cfg -a WANLAN_MODE=WAN-LAN cfg -c  For option B:1: On the Operation Profile, enable the option: FortiAP configuration profile.2: In the Popup, cl