Support Forum

Is there a re-release of this? I only have compressed logs with me at the moment, I need this program to uncompress it according to numerous threads and articles. Thanks!

Hello everybody, we are actually using on a Fortigate (running 7.0.x OS) the SSL Offloading Feature for checking inbound-Traffic (!) to an Web-Server located in our dmz:  config firewall vip edit "Loadbalancer SSL www.example.org" set comment "for IPS on SSL" set type server-load-balance set extip 1.2.3.4 set extintf "wan1" set server-type https set monitor "192.168.1.22" set extport 443 config realservers edit 1 set ip 192.168.1.22 set port 443 next end set ssl-mode full set ssl-certificate "www_example_org 03-23" set ssl-client-renegotiation deny set ssl-client-session-state-type disable next end config firewall policy edit 99 set srcintf "wan1" set dstintf "dmz" set action accept set srcaddr "all" set dstaddr "Loadbalancer SSL www.example.org" set schedule "always" set service "HTTPS" "HTTP" set utm-status enable set inspection-mode proxy set ssl-ssh-profile "my_certificate-inspection" set ips-sensor "my_protect_server" set application-list "my_app_protect_server" se

Hi everyone, thank you for taking some of your time to read this. We switched ISP a couple months ago for a Bell Gigabit Fibe Ethernet. They gave us a HomeHub 2000 that I had to put in bridge mode to stop it from acting as NAT router (first problem). I then setup the WAN1 connection using the Bell credentials in PPOE and I could not get any signal.I called Fortigate support and we setup a DNS using fortiguard effectively creating a domain name linked to our static IP. Is this correct ?  I found two similar threads but neither mention if they have static IP. Ultimately I would like to remove the fortiguard DNS server causing latency.  - Fortinet 40f PPPOE connection fail on bell canada - Fortinet Community   - Technical Tip: Bell Fibre configuration directly o... - Fortinet Community 

Hi,I have below requirement Have 2 WAN linksNeed to steer the O365 destinated traffic by default from WAN1. If the WAN1 link was hit 90% percent of the bandwidth, need to be fail-over to WAN2. After the WAN1 utilization become fine need to fail-over again to WAN1.Can we do this in SD-WAN?

Hello, on my FortiGate I have two users as super-admin. Now I want to delete the one named "daniel" - but I cannot do this. There are no references in the GUI visible, and after searching via full-configuration on the CLI there is one entry. But I do not know how this settings came in the past to this, and also this is not visible in the GUI - or, at least, I did not see this yet. Anyway, I have no chance to get this entry changed so that the user is free to become deleted. Please see attached screenshots. Any idea for this? FortiGate 40F (FortiOS 7.6.3) Regards,Daniel 

hello everyone,i'm new to the forum and was wondering if it was possible to achieve what i asked in the subject.to summarize...The will is to have a captive portal, on fortigate, with local authentication, that allows me to steal the public source ip of the user, which will then be enabled, in some ad-hoc policies.the most likely use, would be to access the firewall configuration interface, where in the policy a specific user is identified, who has just authenticated on the captive portal, coming from the internet...another situation, the possibility of accessing other devices, such as video devices, with the same system...thanks.

Good day to all.We have FortiGate 200f and its license had expired some 3 months ago.I want to confirm if we renew it say we purchase one year enterprise license will the new license be activated after the date it is purchased and expire after its duration (say one year)  is reached ?Regards. 

Hello, I'm trying to deploy DPI on a Fortigate80F v7.0.17. Right now everything works as expected but one thing, the "Trusted CA List". I'm unable to inspect anything that has a certificate from there and i haven't found a way to ignore the list, so, if i want to inspect packets from YouTube, i'm not able to do so because it has a Google Certificate. I have QUIC blocked from application control and from firewall policies, i haven't found anything that is not related to quic, but it seems like is not the issue i'm facing. Has anyone had this problem? Thanks 

Upgraded FAC from 6.6.2 To 6.6.4 as we need the "Endorsor" option so Guests can type in an email for WIFI approval. everything worked fine before with manual approval. After the upgrade the new feature does not work, but that is not the issue. Now, No Guests can login to the WIFI, they see the portal and register, and I get the approval email and can approve, they show up in the correct group as before, but the credentials dont work. I get the following in the logs: "Local user authentication from (null) with no token failed: NAS not allowed for authentication"Type IdNameSub CategoryCategoryDescription20350Authentication Failed NAS Not AllowedAuthenticationEventAuthentication failed, NAS is not allowed for authentication ype IdNameSub CategoryCategoryDescription20114Authentication Failed without Followup LoginAuthenticationEventAuthentication failed, no successful follow up login. The first error indicates the NAS is no longer allowed? none of that has changed? I do

Hi community, Looking at the following post, it seems FGT-1 sends the SYN to FGT-2 through the LAN switch. https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-HA-A-A-cluster-3-way-TCP-handshake/ta-p/197467 In the following situation, what happens if link 1 goes down? The SYN cannot be distributed from FGT-1 to FGT-2, then does the active-active configuration stop working? If not, what happens?  Regards,Julián

I am using FortiClient software on my Android mobile device to maintain connectivity to my network from outside. Sometimes, the client software disconnects automatically. I want the client software to stay connected at all times unless I manually disconnect it.

English is not my first language, and I wrote this post with the help of ChatGPT. If any part of this message sounds strange or unclear, please feel free to point it out Our goal:Users connect to Fortinet SSL-VPN.We want to enable split tunneling, so that only traffic destined for AWS goes through the VPN.All other traffic should go through the user's local internet connection.Challenge:Since AWS services use dynamic IP addresses, it’s difficult to keep the split tunnel routing accurate and up to date. Even when we try to add known AWS IP ranges manually, they change often, which breaks connectivity.We also tried DNS-based split tunneling — defining domains (like *.amazonaws.com) instead of IPs — but this approach hasn’t worked reliably either, possibly due to how Fortinet handles DNS resolution and route injection.Has anyone dealt with similar issues? What's the best way to implement split tunneling to AWS services when IPs are constantly changing? Is there a reliable method usin

We're sending all logs from FAZ running 7.4.6 to an external log collector, but we want to not send some traffic, such as NetFlow over tcp port 2055. Under Systems Settings > Advanced, there is a Log Forwarding tab where we've defined where the messages are being forwarded to, and within this area, there is a section called "Log Forwarding Filters." I've been looking into the "Enable Exclusions" section, where it's possible to select a field called "Destination Port (dstport)," but it doesn't appear to be possible that the actual port number can be defined. Can this be done? If so, can anyone offer guidance for accomplishing this? Thank you.

Last week I updated my Fortianalyser 400E from FAZ_400E-v5-build1082-FORTINET.out to FAZ_400E-v5-build1151-FORTINET.out After that the device won't boot at all. I logged a ticket to support and passed two hours trying to make it boot. We formated the boot partition multiple times, uploading  and finally the support offered me an RMA.New device come in, same issue won't pass the booting process.I created another ticket and they issued another RMA.. should have my new device soon. Did this happen to one of you? Is someone can help me getting out my logs from the first device that failed? The support told me this was "difficult" when the fortios don't boot. I'm able to go in the IPMI we console as the server is a supermicro but I can't boot on another operating system, the bios is password protected.  Here what we see from COM port, it stuck after the last line on both devices.Reading boot image 3597061 bytes. Initializing FortiAnalyzer...The disk was no

Hi, Would like to ask what will happen to our billing if the users onboarded exceed to our current subscription of 1000 users? Right now, we onboarded 1200 users. Does this might cause over-subscription and charge us for it?

i am getting this error suddenly when adding FG to Fortimanager desc="Failed to retrieve nonhasync config" user="System" ,Both Fortigtes are in sync , no corrupt config , still can not get the config when adding , when it finishes it pass on everything except retrieving config.Fortimanager running 7.6 3 , Fortigate running v7.4.7 , ADOM 7.4 i have other fortigated added without no problemany idea

I am just sharing the FGT-50G VDSL config for other VDSL users connected via CETIN (the Czech Rep. provider). The config differs a bit in comparison to older xDSL FGT models. And Fortinet documentation does not provide useful samples. Data (traffic) via 802.1Q VLAN that is specific for CR enviromnemt. FortiGate-50G-DSL #FortiGate-50G-DSL # get system statusVersion: FortiGate-50G-DSL v7.0.17,build7592,250125 (GA.M)FortiGate-50G-DSL # show#config-version=FG50GD-7.0.17-FW-build0682-250125:opmode=1:vdom=0:user=adminconfig system interfaceedit "dsl"set vdom "root"set type physicalset alias "isp-physical"set phy-mode autoset tc-mode ptmset annex bset profiles 17a 30aset lldp-reception enableset role wanset snmp-index 6edit "vlan848"set vdom "root"set mode pppoeset allowaccess pingset alias "isp-logical"set snmp-index 12set username "xDSL"set password ENC <pass>==set interface "dsl"set vlanid 848endFortiGate-50G-DSL #FortiGate-50G-DSL # get system dsl statusDSL Module Status: [up]D

Hello,I am facing an issue with fortigate firewall in cluster a-p, both are integrated with cisco ise working as Radius server.Suddenly, we are seeing that Radius settings for ISE is failed; saying " can't contact radius server"Fortigate version is 7.2.4however, there is another set of FGT firewalls which are working fine.Only difference is that these firewalls are in DMZ and ISE is behind mgmt firewalls which are working fine. So DMZ Fws talk via transit vlan.

I have a customer that recently upgraded their ISP service from 100M/100M to 200M. The ISP tells us to change the speed setting to AUTO for it to reflect the change.  I have issued the following command:config system interface    edit WAN2        set speed autoThis  did change the result of the get hardware nic WAN2 command to show a speed_setting of 1000, but the actual Speed and Duplex are still at 100 Half and their overall bandwidth is capped at 100.  Is there another location that I need to adjust to make this pull the actual speeds from the provider?  I've rebooted in case that is needed to pull the changes but it had no effect on the bandwidth.

Hi everyone,I would like your input about a design discussed with my technical manager.We have 2 on-prem Fortigates inlcuding SPA licences with each (part numbers used FC2-10-FGVVS-662-02-12 and FC-10-0400F-662-02-12), one is a VM hosted in the cloud, the other is a FG-400F in the HQ. My question is, is it possible to make FortiSASE as a central point of security enforcement between both sites, knowing that the HQ doesn't host anything, the users will basically access cloud resources hosted behind the virtual FG. remote users will have accounts in fortiSASE directly.I'm wondering if this setup is valid, if not, doesn't require anything special in terms of licensing ? Might be helpful to include FortiSASE licenses here:Enhanced Support PremiumTelephone Support PremiumFortiTrust ZTNA & CASB (users)FortiTrust ZTNA, EPP & CASB (users)FortiTrust SASE & CASB (users)FortiTrust Forensic Analysis Service Thank you in advance  

Looking for info on creating the QR code for IOS ( deploying to about 100) with us replacing SSLVPN with IPSEC using SAML ( SSO )

Hi Team, Is there a way to clear the cached PMK for the FortiWifi authentication connection? This is to ensure that when end devices reconnect to the network, it will be forced to reauthenticate and not us cached data. Can confirm that the setting for the existing Lifetime of the PMK-R0 key can be set in:config wireless-controller vapset ft-r0-key-lifetime < integer> Is there a way to see the sessions related to this? and also clear this? Thank you!   

Hello Community,I will try to be as brief as possible.A couple of months ago, we installed the collector agent to our two main DCs and respectively the DC agent to a number of DCs across our SDWAN topology. Since the begin the majority of the users are not getting in "Currently logon users" list in FSSO even though when I try to logoff and logon again, even restarting the machine does not help, but when I check Event Viewer on DC the user is successfully logged in / Authenticated. Same thing for new user creation. What we have observed is that the DC agent has the information of the logged in users but the collector does not, it is like they are not synced. Another observation is that the same users appear constantly, a different users will be added to the users that appear on the FGT once in a while. We have a TAC case opened for 2 months with not much progress, we updated the collector to the version they suggested, we checked the registry in the KERBEROS on the DCs, we unistall

Hi, dear community.We are facing the following problem:We have FortiAnalyzer v6.4.13 and have been receiving the following notifications for several days: Disk usage for Adom XXX has reached the delete threshold of 90% of total 50.0GB. Archive Usage at 89.6% (13.4GB) and Analytics Usage at 90.3% (31.6GB).I read that the logs should be automatically deleted after this message. But I don't think so, because we received a notification before that: Disk usage for Adom XXX has reached the delete threshold of 90% of total 50.0GB. Archive Usage at 88.8% (13.3GB) and Analytics Usage at 91.0% (31.9GB).Please tell me if we should do something about it. Because the messages are coming every day and we don't want our storage to be full.Best regards.

hello and sorry for my english, I have Ucopia server. When external users are connect to wifi VLAN, the portal is open and the can create account and connect to internet. i know that my fortigate offer portal but it is possible like Ucopia that users can create account to register before go to internet ? thanks