Support Forum

Hello, Is there any way of determining whether there will be a FortiAP v 7.4.x release that fixes bug ID 1060165: The FAP-231G/233G/234G 2.4GHz radio would stop SSID beaconing? I know there is a 7.6.2 fix for this, however it requires FortiOS 7.6.3 to ensure compatibility and I'm not confortable to push that FortiOS release out yet to production FortiGates. Thanks,

Hi,I have 40F, I understand that the recommended version to use is the latest 7.2 - let me know if I'm wrong.We have 7 units of 831F.I understand that it is recommended to work with the same version on the firewall and the APs.yet - I see that I miss new features that exist on version 7.6 such as 802.11mc (Wi-Fi RTT) Support.would it even be possible to use the new features while using old version over the 40F ?what happens if I use newer version over the APs ?

Hello,My account manager has told me that since we have replaced our Fortigate via RMA, that we can't renew support for the replacement device when the contract expires. This doesn't seem right. It's a 101E and is still a supported device.  Any thoughts?

I can't install Dissolvable Agent on my Android phone. What is the latest version of dissolvable agent support?Mine android OS is 15.. 

 this error message coming when i am creating vlan  version : fortinet 7.2.1 plotform: vm ware workstation , eve-ng  

I have a question about FG-200F-BDL-811, this hardware is End of Life?When? What is the replacement?Thank in advance.

 Hi ForumI'm writing about migrating from SSLVPN to IPSecVPN Dial Up as the SSLVPN is deprecated in version 7.4.3.I have looked online and found alot of resources regarding building the IPSec Dailup but nothing about what client one should use.My question is, what client does the end user use with the IPSec Dialup - is it the same as the SSLVPN client or is a different one?If it is the same, does the client need to be configured to use IPSec Dialup?Thanks!John

HelloI have fortigate firewall and i have 2 vlan. Let say vlan100 for NAS and vlan200 for cctv.The cctv can connect to the nas only if cctv and nas located in same subnet, the cctv can't discover the nas if the nas located in different subnet. Can we make some forward broadcast to enable the cctv can discover nas even in different subnet?

When I connect to a wifi as a fortinac configuration redirect to registration portal and then I fill the requirement when the processing done faceing issue  in a attachment photo. What is the error and how can i solved to this issue.Farther I want do know nac guest registration process. What now I know is first when i connect to a wifi I will be got a isolation assign ip righ? then I success the registration process I will got a respective assign vlan right? If that correct how can i do to got a isolation ip first? Further more  , if i don't use coa message i do not got a multivlan assign ?Thanks for ur helping.

Can anybody please share all the extra security features you get when using FortiEDR on an iOS/iPadOS device? With iOS already being locked down pretty tight, is it basically just URL and Web Security scanning? Does it scan files/links clicked in an email prior to opening? Just looking for all the "extra" or "added" security features you get when putting this product on an iPhone or iPad. Thanks for the information. 

Dear Fortinet Community,We are a small team of 15 people using a FortiGate 30E firewall and a D-Link DIR-2680 Wi-Fi router. We have two SSIDs. Lately, Wi-Fi speeds on both networks have been slow. The ISP technician confirmed the wired LAN speed is good, but Wi-Fi speeds are much lower. They suspect the FortiGate 30E might be affecting the throughput.When I tested the Wi-Fi, I got 364 Mbps download but only 12 Mbps upload, which seems low for our 500 Mbps plan.Could the firewall be limiting the speed? How can we check and fix this? AlsoHow do I see the actual output speed the firewall is providing right now?If the speed is low, what could be the possible reasons for this?If the speed cannot be improved, what is stopping it from being faster?If the speed can be improved, what changes ?Thank you in advance for your support.

I created a VIP to map (forward) external port to internal port on the server inside (e.g. 8080 to 80). When I create a firewall policy for this incoming connection, should I specify external or internal port or both in the "Service"?If only one is enough (for example, 8080) how another (80) is managed in that case (explicitly opened or whatever...)?

Hi,I have FortiSwitch 108 POE connected to 40F and being managed by the 40F.I didn't configure any password for the fortiswitch - and connected to the FortiLink.yet - I understand that it is needed for manual configuration.is there a way to configure it ? or do I need to reset it ?

I have a new 200g replacing a 100f. Due to the number of ports I need, I need to use the 5g ports on the 200G. Can these 5g ports operate at 1g speed? I cannot test it at the moment, I can set the speed to 1000full or auto in the CLI config but I do not want to run into any surprises during the cutover

Device Unresponsive After Firmware Upgrade to v7.2.9The FortiGate 400E has become completely unresponsive. The unit exhibits the following behavior:Power LED: Solid greenStatus LED: Flashing rapidly (continuously)Console Access (PuTTY or Tera): No output observed during boot-upUSB Recovery: No response when using a properly formatted USB drive with valid firmware imageTFTP Recovery: No firmware request or activity detected from the device; unable to initiate recovery due to lack of console accessMultiple recovery attempts—including use of different cables, terminal software, USB drives, and TFTP configurations—the unit does not respond or enter bootloader mode.seems bootloader failure triggered during the upgrade process. 

 Hi,  I have Fortegate 100F with OS 7.4.x I configured SSO with EntraID successfully and login was working.  I have a questions.Q) Can I use more than one entra id group for separate vpn portal and policy. A user member of group A and assigned the portal A and apply policy A, and B user member of group B and assigned the portal B and apply policy B And I have in troubleT) User can login was successfully with Entra ID, and connected.But SSL VPN client didn't receive internal routing table, only DMZ routing table was received.It add routing table in manually 'route -Add xxx -mask...' then it can be communicated.Anyone have solution like issue, please help me. Thank You. 

So we have been running Forticlient and EMS cloud for 18 months. We have had many issues with the following: Split tunnel for Webex and MS teams not workingZTNA tags not syncing to FortigatesLocal LAN Access not workingEach and every one of these things we find that do not work lead us to log tickets and we end up having to upgrade versions of Forticlient or worse wait for EMS cloud upgrades to become available which can take months.  Furthermore, we have seen numerous regressions in Bugs around split tunnel for example. Our latest is as follows:- MS teams and Webex are not split-tunnelling even though configured. Support have indicated these are due to internal Bug IDs 966971 and 1045328 - They say these are fixed in Forticlient 7.4.1 but there is no mention of this in the public release notes Resolved issues | FortiClient 7.4.1 | Fortinet Document Library as far as I can see- The 'fix' also requires EMS cloud 7.4.x which has not ETA for release!So a

I was wondering as for SQL or XSS attacks fortiweb has 3 options for detections what is the order of operations ? Is it first signatures then Syntax Detection and  then attack ML models that are build on the appliance itself after time from the passed traffic? Also what happens it an attack matches all 3 options? My final question is for SQL injection and XSS attacks shouldn't signatures be stopped and just Syntax Detection and attack ML models to be used as I have read that they have less false positives ?  

Hi, We have two Sites, Site A and Site B already connected by telephone line(old), so they share the subnet ip address, now we want to have a VPN tunnel as a Backup with two Fortigate on each side, we cannot change the subnet ip address,  Configuring Site-to-site IPSec VPN in Central SNAT mode with overlapping subnets doesn't work because this will change to new IPs, which is the best solution for this?

After upgrading the firmware FortiOS Fortigate 60F from version 7.4.7 to 7.6.0, only the native VLAN is available for use. Allowed VLANs no longer function on the FortiSwitch ports.Ports with two "Allowed VLANs" configured are not working or are unavailable. Only the "Native VLAN" works. Later versions 7.6.1, 7.6.2, 7.6.3 don't fix it. I have to downgrade  to firmware version 7.4.7 for it to work successfully. I will wait for a correction to that Bug.   

HelloI have a 10.x.x.x/8 network with several FGT clients that are managed in FMG. I cannot access the FGT clients through Remote Access in FMG. What should I analyze to find out why Remote Access is not working?

Hi guys! We are currently experiencing some issues trying to transition from SSL-VPN to IPSec Dial-Up using SAML with MS Entra ID.We are using FortiOS 7.4.8 and FortiClient 7.4.3 1790 VPN Only Version. As far as the authentication via SAML goes, it all works perfectly, we followed the official guide on how to set it up and as long as we use UDP as transport, it all works just fine. The problem comes because we were having some stability issues using UDP (FortiClient randomly disconnects while actively working over the VPN) and we wanted to try TCP transport to see if that change would impact stability.  In the original setup, we had two tunnels configured, one for each WAN connection, with the same following config:edit "VPN-IPSec-Iplan"set type dynamicset interface "wan1"set ike-version 2set peertype oneset net-device disableset mode-cfg enableset ipv4-dns-server1 192.168.2.88set ipv4-dns-server2 192.168.2.90set proposal aes256-sha256 aes256-sha512set ip-fragmentat

I've got a cluster of 601Es running 7.4.7 that I need to move the internet port from port 1 (copper) to port 9 (sfp) and I was dreading doing it manually (delete policies, addresses, objects, then interface and then recreate everything on new interface) and noticed something "new" (to me) called Integrate Interface.  Does anyone have 1st hand experience in doing this?  Just wondering if there are any "gotcha's" or things I need to watch for.  Thanks in advance for anything tips, tricks or advice.

Hello,i need to configure a vpn ipsec access for a few users through the implementation of fortiauthenticator cloud, fortitoken cloud and EMS.These users should be locally created on the fortiauthenticator cloud, associated with the fortitoken cloud and then, with the EMS, i need to check their compliance.I've correclty deployed the ipsec vpn with local users just for test and it's working, now i need to use the FAC cloud, how can i create the users on it and let them visible in the authentication process?I thought to add the FAC cloud as radius server but obviously it's doesn't have an ip being a saas solution.Did anyone face a similar implementation?The scope of this scenario is to let the users connect via vpn to the remote resources and when a new user needs to grant access it should only be added on Fac cloud with its fortitoken cloud.Thank youRegards

Hello team!! I read the first 8 chapters of the "FortiClient EMS 7.4 Administrator Study Guide".  After this I started to open the FortiClient Cloud, and created some different objects there.  But playing with my FortiClient Cloud, before set this in production, I get some questions.  Please, answer my questions or guide me to reach the answers.  Sorry if there are obvious questions.1) I configured an authentication server (Windows AD), and this is connected, but when I create a Group Assignment Rule, I cannot select a Domain Group, just workgroup group.  Why?  (All computers objects are in All Endpoint as "Not installed", and I am able to use Domain Groups in "Manage Deployment")2) If I want that a group has a ZTNA application (The app is hosted in a server which is in the same site that Fortigate), I need to create 2 applications?  (One for on-fabric endpoints and the another for off-fabric endpoints).  If not, where do I need to point thi