Support Forum

Hi, We have a web filter profile which is named QA_WF and it has a 3 hours time quota for category 25 (Streaming Media and Downloading) and category 37 (Social Networking). Quota keeps counting incorrectly even though no activity has been performed in this category. Version 7.4.5 QA_WF has quota config;config quota edit 1 set category 25 set duration 3h next edit 2 set category 37 set duration 2h next end In the SS_1.png file, you can see all category 25 logs. The first log was recorded at 2025-04-30 11:05:28 and Quota Used:0. After that, there is no recorded log until 12:13:48 in this category and the user just opened-closed that tab (a Youtube video and Facebook page same for both (not tested Facebook in screenshots but we tested it)) and shutdown the machine. But as you can see in the SS_2.png file, the actual time is shown in the bottom right and the user has 56 minutes left at 13:08. So once this user's quota starts counting, it keeps counting even though no ac

I'm currently setting up a FortiGate firewall and facing a strange issue. The FortiGate WAN interface is directly connected to my ISP router. From the FortiGate, I can ping the ISP gateway successfully.However, from the ISP router side (or any host behind it), I cannot ping the FortiGate IP.Here’s what I’ve checked so far:Ping is enabled on the WAN interface (set allowaccess ping is configured).The interface is up, IP is correctly assigned, and the cable is physically connected.No local-in policy is blocking ICMP.No trusted hosts are configured under the admin settings.Subnet and default routes appear correct.and when I connect that ips wire to my laptop it can get the internet access and able to ping my ip from outside network.

I have played with FortiWeb trial VM and the demo center (FortiWeb Demo) and after reading some docummentation and watching (9) FortiWeb API Protection: Overview - YouTube and (9) FortiWeb - Machine Learning Based API Protection - YouTube I see that FortiWeb has ML for API discovery but what about discoverying if API endpoints don't enforce authentication or authorization or using weak authentication? The traffic could be legitimate but the devs in some cases by mistake don't enforce API autentication/authorization on some API endpoints or a forgotten old version of an API URL endopoint (shadow API). Can FortiWeb see the requests and still after time with Anomaly detection make suggestions for API security improvement even if all the requests don't have authorization header (not a deviation but still a security issue) ?

Hello,  I played with fortiweb trial Evaluation limitations | FortiWeb Private Cloud | Fortinet Document Library and demo https://fortiweb.fortidemo.com/ and I also watched FortiWeb API Protection: Machine Learning based Protection but it is not clear if FortiWeb can  generate swagger or openapi file based on ML/AI learning of the API traffic? Maybe if not the on-prem appliance (vmware or in a cloud like AWS/Azure) if the FortiWeb cloud can ?

I have 2 firewall connecting using site to site dialup vpn because site 2 is behind cgnat.Now i wanted to configure a port forward to a internal devices behind site 2.I have configured the VIP and policy at site 1 but its not working, is any step i miss out or any other ways to do it ?VIPedit "Test3"set uuid b7def848-4834-51f0-5298-bafc01a19730set extip public IPset mappedip "192.168.2.20"set extintf "any"set portforward enableset extport 34263set mappedport 3389nextFirewall policyedit 17set name "Test3"set uuid c8b54f82-4834-51f0-0ccf-a0367faa8ea9set srcintf "mgmt1"set dstintf "TO_P"set action acceptset srcaddr "all"set dstaddr "Test3"set schedule "always"set service "ALL"set logtraffic allnext

I do 5 minutes speedtest to the internet but why in the traffic shapper the utilization seem very low

How to configure the web filter polyce time range  on  FORTIGATE 40 F 

Hi!So i'm facing a strange issue with wildcard address object (FQDN).If i configure the object as *.learn.microsoft.com i cannot reach anything from my client, not even the "microsoft.com" domain.If i configure it as *.microsoft.com i can reach the website and all the subdomain (lean.microsoft.com included).i've already configured the "config system session-helper" for DNS traffic. If i run "diag test application dnsproxy 6" looks like my FGT cannot resolve the subdomain: I found this old technical tip where its says that wildcard FQDN should not be used in firewall policies.Any suggestion?

Hello, I'm scheduling some reports for my customer and the report filename comes with the serial number. I'd like to know if anyone was able to put the hostname on the Output Profile for the e-mail subject comes with the hostname. Regards, 

Hi all I am trying to setup a ipsec dialup (to replace SSL VPN) on a FGT200G running 7.4.8, and I am using FortiClient (VPN-Only, free version) with 7.4.3.As for authentication, I want to start out with local user (without MFA). Once this works I am going to try with Radius (users on FAC with and without FTM) and from there to SAML. I would like to use a specific interface and a specific (public) IP on said interface (to distinguish that dialup from other dialups).Preferably, I would like to use peerid's (if possible, but I guess that depends?).Additionally, I would like to use a PSK. So that the client needs that before connection and getting to any kind of user authentication with username/password (and potential MFA), if that is possible.(As for split-tunneling and full tunnel, I will try and play around with this, once the first configuration snippet works) The internet is full of examples (officially from Fortinet as well as from all you experts). Unfortunately, I a

Hi allI am trying to setup ipsec dialup (IKEv2) using port tcp/443 on a FGT200G with 7.4.8 and with Forticlient (vpn only version) 7.4.3.Amongst other issues, I am facing a connection block (not negotiation error, I seem not to get that far).My connections requests from my client (and from my IP) are seen on the fortigate (on port tcp/443) as expected, but are being blocked by local-in-policy number 0. I have added one single local-in-policy that should allow ssh, icmp and https (which is tcp/443 in the service object) from my IP address. ICMP works and the FGT replies for my IP, however, tcp/443 is being blocked,As this is all in one single local-in-policy, I have no idea where I went wrong - ICMP works, so why doesn't tcp/443? Thanks for giving me a hint where to lookBest regards 

Hi, I have a Windows Server 2022 RDS Server (Terminalserver Services).I want to install FortiClient as AV / EDR Client. I've created an installer and invitation link for all the AV Modules excluding: VPN and Application Firewall. But the Forticlient does not seem to work well in multiuser envoirements. If a new user loggs into the terminalserver and authenticates with forticlient, another user will logged out. the forticlient also gets out of sync with forticlient ems cloud. Is there any best practise on how to deploy forticlient to a rds server? Thank you for your help 

can we deploy the User Based policies in similar way we were able to do onsite Active Directory integration using SSO. We normally use FSSO agent for that on AD server, how can we do that on Azure. PS. I am not talking about forticlient or VPN usage here but actual firewall rulebase using the User Groups. 

Hello, I'm reaching out as I couldn’t find the proper place to submit feature requests on the Fortinet website (such as support or partner portals). Therefore, I'm sharing this feedback here in the community forum in hopes it reaches the appropriate team. One of my customers operates a network with approximately 100 FortiSwitches, all integrated via FortiLink with FortiGate. Managing ACLs on FortiSwitches in this environment has been extremely frustrating. Here’s the issue:I want to apply ACLs that allow or deny traffic based only on destination service ports, while keeping source and destination IPs as 'any'. This is a very common requirement in real-world environments. However, this configuration is not possible when the FortiSwitches are managed by FortiGate via FortiLink. The managed FortiSwitch ACL configuration lacks the ability to define service ports. There is also no option to disable FortiGate control over ACLs, which means that even if I manually con

Hello,I’m trying to understand the compatibility between FortiClient VPN and different versions/editions of Windows. Specifically, I want to know:Which versions of Windows (e.g., Windows 10, Windows 11) and their editions (e.g., Home, Pro, Enterprise, Education, Home Single Language) are officially supported by FortiClient VPN?Is Windows 11 Home Single Language Edition compatible with the FortiClient VPN (especially for remote access via SSL/IPSec)?Also, what is the minimum and recommended FortiClient version for Windows 11 systems?I would appreciate it if someone could share any official documentation or personal experience regarding this compatibility. Thanks in advance!

Hello everyone, I’m working with a FortiGate 60F (v7.2.11 build1740 [Mature]) and a FortiSwitch 124F-POE (v7.6.1 build1047). I want to set up FortiLink over a trunk connection using ports A and B on the FortiGate and connect them to ports 23 and 24 on the FortiSwitch. My goal is to build a FortiLink trunk for redundancy and increased throughput. However, as soon as I configure the trunk on the FortiSwitch, it stops being recognized by the FortiGate.Am I doing something wrong? Is it even possible to set up FortiLink in this way, using a trunk across two ports? Any help or guidance would be appreciated.Thanks in advance!

In my lab environment i try to use 3rd party DNS server, i already upload the 3rd party certificate but why the certificate is not showing in DNS SSL certificate?

 Iam getting this error, its working on other pcs but not on mine, i even disabled wirewall and windows defender but that also didnt help, i tried connecting to other internet connections, even mobile data, still getting the same issue, the creds are completely working .. working on other pcs

For some reason the  XSS or SQL injections are moved to a seperate WAF profile in Fortigate and not in the normal IPS functions but I saw the below article: Stream-based antivirus scanning for HTML and Javascript files | FortiGate / FortiOS 7.6.0 | Fortinet Document Library      As I have test fortigate I confirmed with proxy mode rule and WAF feature enabled that basic web attacks are detected but in the newer trial versions proxy rules can't be used because of the RAM limit, so I can't test if now the newer versions can scan web traffic with a flow rule not only for antivirus.  If anyone can confirm if not now then in the future flow mode rules will support WAF profiles it will be great as at the moment even the waf profile is not visible under flow rules in the trial option!   I know that FortiWeb is a true WAF that has auto policy building with url, header and parameter learnings, API protections and discoveries, Java

Hi all, we want to switch our FortiClient dial-up connections from IKEv1 to IKEv2, but we are having problems with this. I have created a new IKEv2 Test-VPN on the Fortigate and a test user that is authenticated via RADIUS. Everything in the setup works fine with IKEv1, but as soon as I change the parameters to IKEv2, the login fails. Device is a FortiGate 300E cluster with OS 6.0.10, I tested with different FortiClient-VPN versions from v6.4 to 7.0. Here is what an IKE debug shows me: ike 0: comes 178.2.99.151:64916->20.30.40.50:4500,ifindex=11.... ike 0: IKEv2 exchange=AUTH id=xxxx/xx len=80 ike 0: in xxx ike 0:IKE-v2:31239: dec xxxA65 ike 0:IKE-v2:31239: responder received EAP msg ike 0:IKE-v2:31239: send EAP message to FNBAM ike 0:IKE-v2:31239: initiating EAP authentication ike 0:IKE-v2: EAP user "testuser" ike 0:IKE-v2: auth group IKEv2-Users ike 0:IKE-v2: EAP 1195273714 pending ike 0:IKE-v2:31239 EAP 1195273714 result 2 ike 0:IKE-v2: EAP challenged for user "testuser

I have created an MCLAG between the two switches using the graphical interface. Each switch is connected with one port to a cluster of 100F firewalls in active-passive mode. For now, I’ve only connected a single physical cable because I don’t fully understand the situation yet, so I’m keeping things as simple as possible.I don’t understand why all the links always appear in a disconnected state.Additionally, I would like to use multiple LAGs, both between the switches and also between the firewalls and the switches, but I’m not sure what the correct configuration should be.My firewall is running firmware v7.6.3 build3510 (Feature), and the switches are on S248EF-v7.6.2-build1085,250526 (GA).

Hello,I have a setup with SD-WAN where I have multiple sites, on one of the sites I have two ISP connections.To made failover I created Internet SLA to made failover possible. So I created this in SD-WAN -> Performance SLAsLast week the wan2 which was the active link went down (ISP told me they cut fiber cable during some repairs on the street). The problem is that the failover didn't worked and I needed to move SD-WAN VPNs manually to wan1 link. What I do wrong here ?

Is there a way to use dynamic learned OSPF in address objects?What I'm trying to achieve here is create an sdwan rule to direct traffic to certain routes that are learned from OSPF to a certain sdwan zone.I know that by default implicit deny will route traffic to these IPs correctly however I want to control it through sdwan rule.

SPOKE Endpoint:Has two WAN links (wan1 and wan2) with private IP addresses, requiring NAT traversal.HUB Endpoint:Has a single WAN link with a public IP address, no NAT traversal required.Type: "dynamic Dialup user" (Dynamic PPPoE Connection).Tunnel Aggregation Requirement:Merge the two existing IPsec tunnels (from SPOKE to HUB) into a single "IPsec Aggregate" tunnel. The Spoke can only have one tunnel established online at the same time and cannot have two tunnels established online simultaneously.May I ask what method can be used to establish them simultaneously and complete the tunnel aggregation? spoke config：config vpn ipsec phase1-interfaceedit "spoke_test1"set interface "lan3"set ike-version 2set peertype anyset net-device disableset aggregate-member enableset proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256set localid "88"set dpd on-idleset network-overlay enableset network-id 88set remote-gw hub address-xxxxxset p

Hi Community  Is there anyway to enable Dynamic Threat Detection on the FortiSASE managed Forti Client   Thank You, #FortiSASE