Support Forum

Hi Has anyone managed to solve a problem with FortiSASE (and it's probably the same with Fortigate) where the Fortiguard DNS lookups for the likes of device.autopatch.microsoft.com will return an IP address that matches another service that's hosted in Azure? Which ends up conflicting with policies when you're trying to create explicit ones for MS services and updates, but then random websites get bundled in...?

When we setup BGP to other neighboor such as to Azure or to accros fortigate devices is BGP interface and update source is mandatory to be set? And also is needed to make static route to the BGP peer?

Hello everyone Network requirements:One SSID100 - fortilink vlansThere will be wired and wireless devices in each vlan, they must be in the same subnet/broadcast domain.400 devices What is better to use? SSID with MPSK in bridge modeorSSID with MPSK in tunnel mode + software switch (ssid vlan + fortiswitch vlan) or is there another solution?

I have the following working Dialup IPsec config working for one of my SAML user groups and now I am trying to expand it to cover other SAML groups.config firewall addressedit "OpsVPN-US2_range"set type iprangeset start-ip 10.254.128.1set end-ip 10.254.128.254nextendconfig firewall addrgrpedit "OpsVPN-US2_split"set member "Internal_10.0.0.0/8" "Internal_172.16.0.0/12" "Internal_192.168.0.0/16"nextendconfig vpn ipsec phase1-interfaceedit "OpsVPN-US2"set type dynamicset interface "port1"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset proposal aes256-sha512set dhgrp 20set eap enableset eap-identity send-requestset wizard-type dialup-forticlientset transport autoset fortinet-esp enableset assign-ip-from nameset dns-mode autoset ipv4-split-include "OpsVPN-US2_split"set ipv4-name "OpsVPN-US2_range"set save-password enableset psksecret ENC *******nextendconfig vpn ipsec phase2-interfaceedit "OpsVPN-US2"set phase1name "OpsVPN-US2"set proposal aes256-sha512set dhgr

I have a FortiGate 401F。 I would like to know the MAC chip model of 401F. What CLI command can I use to obtain the relevant information?

 Hello everyone,I have two Fortigates:A Fortigate 60F and a Fortigate 70G.On the Fortigate 60F, there is a WiFi network, where I reserved the IP address 172.16.10.110.The Fortigate 60F is connected to the 70G via a link and a static route:  All traffic destined for the 70G must pass through the 60F.Conversely, on the 70G:   The connection works well, everything works fine.Now, I tried to restrict access to the 60G GUI (https://10.0.1.0:40443) using two local-in-policies: config firewall local-in-policy    edit 1        set uuid 5c0a2180-47a5-51f0-1e8d-733b986f1a94        set intf "any"        set srcaddr “My_IP_ADDRESS”        set dstaddr "login_group"        set action accept        set service "HTTPS-40443"        set schedule "always"    nextedit 2        set uuid 71f5a26c-47aa-51f0-2

Hi everyone,I’ve configured my FortiGate to allow access to Google Docs only for certain users. However, I noticed that those users were still able to access YouTube.Upon investigation, I found that Google Docs and YouTube share some of the same IP addresses, which makes it difficult to block one without affecting the other.When I created a policy to block YouTube, it ended up blocking Google Docs too.Has anyone found a way to allow Google Docs while effectively blocking YouTube? Any suggestions would be appreciated. 

Hello everyone,I have two Fortigates:A Fortigate 60F and a Fortigate 70G.On the Fortigate 60F, there is a WiFi network, where I reserved the IP address 172.16.10.110:The Fortigate 60F is connected to the 70G via a link and a static route:  All traffic destined for the 70G must pass through the 60F.Conversely, on the 70G:   The connection works well, everything works fine.Now, I tried to restrict access to the 60G GUI (https://10.0.1.0:40443) using two local-in-policies: config firewall local-in-policy edit 1 set uuid 5c0a2180-47a5-51f0-1e8d-733b986f1a94 set intf "any" set srcaddr “My_IP_ADDRESS” set dstaddr "login_group" set action accept set service "HTTPS-40443" set schedule "always" next edit 2 set uuid 71f5a26c-47aa-51f0-21c9-79d49494eb3e set intf "any" set srcaddr "all" set dstaddr "login_group" set service "HTTPS-40443" set schedule "always" set status disable next login_grourp is the GUI address and My_IP_ADDRESS is 172.16.10.110

Hi community, I have a doubt regarding FortiGate HA active-active mode. There are some articles explaining this mode operation, I have taken this one:https://www.fortinetguru.com/2016/10/natroute-mode-active-active-cluster-packet-flow/ Briefly and without going into too much 3-way handshake detail, when the primary unit decides that the subordinate unit should handle a packet, and forwards it to the subordinate unit internal interface, the primary unit forwards further packets in the same session to the subordinate unit. Is that correct? If so, every packet of the same sessión will pass first through the primary unit and then through the secondary unit? If so, then will link 1 be much more loaded than link 2?   Regards,Julián

FortiClient EMS Using the "Send Test Email" from the SMTP Server settings tab the test is successful, however, no actual alert emails are being sent.

Today we update our Fortigate 90G witn 8GB ram from 7.4.7 (with sslvpn tunnel mode active) to 7.4.8 and the SSLVPN dissapears!!!!THIS IS REALLY WEIRD!!!We contact to support a give me this answer:---> https://docs.fortinet.com/document/fortigate/7.4.8/fortios-release-notes/743723/new-features-or-enha... <------> Resolved issued -> bug id 1026775 Remove SSL VPN from FG9xG. WTF!!! Fortinet delete SSLVPN a publish in a resolved issue??????????

Hi to all!I upgrade my Fortigate 90G from 7.4.7 to 7.4.8 and force to migrating to IPSec VPN dial-up tunnel. The auth for the users was config with Groups connected to LDAP (Windows AD) and all is ok.The IPSec VPN tunnel Phase1 XAUTH type = "autoserver" and user group = "Inherit from policy" When I try to monitorize "Security Fabric -> Asset Identity Center -> Identity" is empty, but with SSLVPN i can see the auth users for vpn connections.  Any ideas or help? PD: I also have it setup "Security Fabric -> External Connectors -> FSSO agent on Windows AD" Thanks!

In our FortiGate environment, both BGP and static routes are configured for the same destination. However, the system currently prefers the static route, which remains active at all times. As a result, during an IPsec tunnel failure, traffic does not automatically fail over to the BGP route. At present, we are required to manually disable the static route on both ends to allow BGP to take over. We are seeking a solution that enables automatic failover from the static route to the BGP route when the IPsec tunnel goes down. Ipsec tunnel not showing in interfaces  

Hey Folks  I was hoping I could get some help on the best practices on setting up 3 ISPs in an SDWAN configuration from my 100F to my 60E at a remote site that houses a few servers .   I have a 5g modem  , att fiber connection and spectrum business service all plugged into my 100F firewall . Wan1 SpectrumIPSECTUNNEL1 Port11 ATT BusinessIPSECTUNNEL2 Port12  ATT 5gIPSECTUNNEL 3 I have 3 ipsec tunnels built between the two fortigates as well and they are all the same phase 2 selectors . All I am trying to do is put the 3 ips into the SDWAN and have the fortigate fail over from 1 downed isp ( wan1 wi/ ipsectunell1)  to the second Wan connection  (Port 11, ipsectunnel2)  etc  .  I've tried setting this up once and had issues with different communication going over different isps when all I want is all the communication going over 1 isp and one tunnell until the need to fail over.  I've been knocking my head

I upgraded to FortiClient VPN 7.4 (whatever the latest download is) from 7.2.10.1217 and it just flat doesn't work. I can VPN into our foritgate and connect as normal, however every other application that tries to connect to the internet on my client computer just fails. Fix was to downgrade back to 7.2.10.1217. Uhm, is this a thing? I was trying to get our IT department to allow us to use Windows standard VPN client instead of this proprietary vpn client, but they can't seem to figure out how to do that with our fortigate firewall.

I have about 12 remote sites connected via BGP with ADVPN. At each site, I have Shoretel VoIP phones. They connect and register just fine. The issue I run into is that if a phone gets disconnected, it does not seem to want to connect again. I do have the VLAN going to a black hole if the site-to-site goes down, but the issue comes if it is just one or two phones that disconnect. Not sure how to reset the phone connection over the VPN. If I go to the Shoretel phone system and move the phone from one server to another, then back to the original server, the phone reconnects. Not sure if anyone else has seen this issue and can give some feedback.

I have a home lab environment, and I have created a VIP for my Citrix Lab with NetScaler frontend. Regardless of what I try traffic to the VIP is being dropped based on debug view, but I don't see any traffic in the logs. This used to work with another service but that stopped working as well. Fortigate-70FFirmware: 7.6.1   Debug Trace 2025/06/12 09:31:54,"vd-root:0 received a packet(proto=6, X.X.X.X:30212->X.X.24.153:8445) tun_id=0.0.0.0 from wan1. flag [S], seq 3633665461, ack 0, win 65535"2025/06/12 09:31:54,allocate a new session-0005eb2b2025/06/12 09:31:54,"in-[wan1], out-[]"2025/06/12 09:31:54,len=12025/06/12 09:31:54,checking gnum-100000 policy-10612025/06/12 09:31:54,"result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"2025/06/12 09:31:54,find a route: flag=80000000 gw-X.X.24.153 via root2025/06/12 09:31:54,"in-[wan1], out-[], skb_flags-02000000, vid-0"2025/06/12 09:31:54,"gnum-100017, check-ffffffbffc02ca54"2025/06/12 09:31:54

Hello all, We use IPsec Dialup VPN with SAML via EntraID. When I try to connect via IPsec VPN inside same network in which the Fortigate is located, I get the error "ERR_EMPTY_RESPONSE" when calling SAMLIs this an expected behavior? If not, what could be the issue and how can I fix it?If I'm connected outside of my Fortigate, all is working fine.Similarly, we also have an SSL VPN via SAML EntraID and the login works within the same network.Also the Single Sign-On settings for the IPsec SAML looks similar to the SSL SAML. Fortigate: v7.6.3 build3510FortiClientVPN 7.4.2.1737 / 7.4.3Best Regardsfabs

we want to permitt user to authenticate on captive portal  one a time during 2 months and reauthenticate after 2 months.is it possible with fortigate ? please help . 

Hello Folks, i need to deploy 2 ipsec vpn for remote access.the ip address of each client is associated in the radius server (NPS) as radius attribute, how can i replicate this configuration for ipsec?i read i need to enable the "set mode-cfg enable" and "set assign-ip " commands, unfortunately as per the configuration below, i'm unable to change the latter commad (in gui i'm returned "-1: Invalid length of value" as i set the group, and in cli i can't edit nor delete it).furthermore i need 2 vpn, the first allowing user to use split tunnel and the other denying it, how can i achieve this scope?is it possibile?For the ip assignment i don't have fortiauthenticator so i'm forced to use the NPS. FORTIGATE (phase1-interface) # showconfig vpn ipsec phase1-interface edit "VpnRaNoSplit"set type dynamicset interface "Wan_vpn"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset ipv4-dns-server1 10.2.22.18set proposal aes256-sha256set dpd disableset dhgrp

Hey guys I’m planning on taking FCP core exam Fortigate Administrator (formerly NSE 4) soon as i’ve been working with fortinet fortigate for the last six months and been studying for the exam from time to time. Some topics i didn’t set up on work but i tried to use an emulator to practice. I wanted to know if the practice questions reflect somehow the exam level or? What i prepared so far:studied the courseworked with fortinet fortigate for six monthswent through the practice questionsI’m just doubting if what i prepared is sufficient or not…

what are the causes of SSLVPN failed login ?user reported after enter MFA pin, encounter permission denied -445 error.could it be wrong password or AD account locked.our users is authenticated through radius server.

how do i generate a report for failed for the past 3 months from FortiAnalyzer ? 

I have two Fortigate devices: FG1 and FG2. There's a tunnel between them, with a computer connected to the LAN port on FG1 and a file server on FG2. I would like FG1 to resolve the domain to an IP address, which is why I set up a DNS server on FG1. Now, the question is: what should I enter in the DNS Forwarder, and should I check "authoritative"? I don't know what that means, but I think I should check it because I don't want the query to go to the internet, but rather to stay within my network. The DNS forwarder is set to 8.8.8.8, and it works, but I don't know why. If I set the DNS forwarder to 8.8.8.8, I understand that addresses not found in the local database will go to the internet. But why does it work if I'm setting up a new zone? Shouldn't this option be in DNS Service on the interface, not in the DNS database? And when I add a second zone because I want it to resolve another domain, what should I enter in the DNS forwarder? When I leave it blank, everything still works,

I have a problem with FortiClient VPN 7.4.0.1658 versionI need connect to the VNP server in local network.My computer with the client do not have internet access.When I am trying to connect I can observe warning message in FortiVPN_1.log:fortivpn::StateMachine::HandlePreflight_EnvironmentCompliance environment does not permit VPN connections: No Internet.In state: TunnelConnectAbortedI do not need internet to connect to the VPN, because the server is in local network.During startup I can observe in this log:fortivpn::INetworkAvailability_impl::Get LAN is available, Internet is not availableIs it possible to configure the client to not use the internet, but only local network to connect to the VPN server?