Support Forum

Hi, on a new installation (all new products never used) I can't get FortiAPs to appear on a FortiGate. The FortiGate (100F) is connected via Fortilink to a FortiSwitch POE 8 port to which two new FortiAP 231K are connected. I have as reference these guides which I have followed to the letter.https://community.fortinet.com/t5/FortiAP/Technical-Tip-Manage-a-FortiAP-with-FortiGate/ta-p/223348https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-Integrate-FortiSwitch-and-FortiAP-into/ta-p/385127From the CLI of the Fortigate I see that the FortiAPs have taken the IP addresses of the DHCP Server configured on the VLAN and I can also connect. But the FortiAPs are not shown in “Managed FortiAPs.”The firmwares are:Fortigate v7.2.11 build1740 (Mature)FortiAP v7.4.5 build6183FortiSwitch 7.6.1 build1047 What can I check?Thank you. 

I'm looking to purchase an FTTP internet circuit 1000(DL)/100(UL), the ISP authenticates over PPPoE.I haven't PPPoE'd through a firewall in years, and remember there being a significant performance penalty back then - as I believed it couldn't be offloaded to ASIC (probably still the case). Trying to avoid needing another piece of equipment.Does anyone running either the 70G and/or 90G know if there is a big performance penalty? (and can share stats please?)Thanks!

Hi, To set up email alerts for high bandwidth utilization on each WAN interface when usage exceeds a specific limit, I referred to the document. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Automation-stitch-configuration-for-inbound-and/ta-p/211515 However, based on the document, the configuration is subject to the following conditions: It applies only to specific FortiGate models and versions that are FIPS-CC certified.The setup must be performed when the unit is in its factory default state.If FIPS-CC is not enabled, the configuration will not be applicable.Upon verifying our environment, we have confirmed that FIPS-CC is currently not enabled. Before proceeding, we seek clarification on the following: Does Fortigate 300E support FIPS-CC certification and this configuration?What would be the implications of enabling FIPS-CC in our existing setup?What dependencies should be considered, given that the configuration is supported only on specific ve

We are trying to configure Link aggregation in Fortigate with downstream Cisco Nexus device which is in VPC. The connection is as follows:FortiGate Aggregate Interface├── port40 <--> Nexus1 Eth1/20 --> vpc 11└── port44 <--> Nexus2 Eth1/19 --> vpc 11 LACP flags: (A|P)(S|F)(A|I)(I|O)(E|D)(E|D)(A|P) - LACP mode is Active or Passive(S|F) - LACP speed is Slow or Fast(A|I) - Aggregatable or Individual(I|O) - Port In sync or Out of sync(E|D) - Frame collection is Enabled or Disabled(E|D) - Frame distribution is Enabled or Disabledstatus: upnpu: nflush: nasic helper: yports: 2link-up-delay: 50msmin-links: 1ha: masterdistribution algorithm: L4LACP mode: activeLACP speed: slowLACP HA: enableaggregator ID: 5actor key: 97actor MAC address: e8:1c:ba:c4:5b:f3partner key: 32779partner MAC address: 00:23:04:ee:be:0amember: port40index: 0link status: uplink failure count: 3permanent MAC addr: e8:1c:ba:c4:5b:f3LACP state: establishedLACPDUs RX/TX: 81/130actor state: ASAIEEact

Dear Concern,I need to configure an IPSec VPN on my FortiGate firewall, where user traffic should be NATed to a specific set of dynamic IP addresses before reaching the remote side. This is necessary because the remote side will only allow traffic from a few specific IP addresses. Kindly assist me in configuring this setup. My Firewall Details:Model: FortiGate-201FFirmware Version: v7.6.2 build3462 (Feature)

Hi all, Device: HA-pair 61F v7.2.10 Per subject, IKEv2 debug log was stuck in phase2 INFORMATIONAL state, the traffic cannot pass through even phase1 and 2 is up. For example, the sniffer log can show the icmp echo request and echo reply through the tunnel interface, but in fact the icmp request sender didn't receive the icmp reply packets. The VPN resumed normal automatically after 12 hours [43200s] after the phase2 was rekey, or by resetting the tunnel directly. This issue happened twice. So I just afraid the issue will happen 3rd time. diagnose debug application ike -1diagnose debug enableike 0:VPN: HA state master(2)ike 0:VPN:7: dec XXXXXike 0:VPN:7: received informational requestike 0:VPN:7: enc XXXXXike 0:VPN:7: out XXXXXike 0:VPN:7: sent IKE msg (INFORMATIONAL_RESPONSE): x.x.x.x:500->x.x.x.x:500, len=80, vrf=0, id=XXXXXike 0: comes x.x.x.x:500->x.x.x.x:500,ifindex=10,vrf=0....ike 0: IKEv2 exchange=INFORMATIONAL id=XXXXX len=80ike 0: in XXXXXike 0:V

Hi We have hundreds of windows desktops VMs on top of VMware Horizon VDI, we have tried to auto deploy the FClient agents using AD GPO, but, the agent does not auto connect to EMS after msi installation. when i install the same agent manually, auto connection works fine Please, can someone help here (FortiClient EMS 7.2.5)   

Hey, we have a quite a lot FGs in our network but sofar no G model, any bad experiences with this model? We are thinking to trade up a FG81E to 90G, comparing the specs it is quite a huge step but I would like to know if we can expect this hardware change as an easy one. For example we are testing with a 30G model and the updates are quite strange. The only thing that bothers me right now is that in this location we have more than 30 user assigned with FortiToken.Sofar we never changed Tokens from one FG to another, as I have been told it should not be so hard but I would like to know if we later can keep the same tokens for the users. Thanks for your information!

Can a FortiGate firewall used for data center (east-west) monitor traffic within the same segment or within the same VLAN?

I have a FortiGate 70F running 7.4.7 and I'm trying to set up a DNS server on it to resolve some internal server host names.  The system DNS is pointing to the FortGuard DNS servers.  I am using FortiSwitches connected via FortiLink for clients on multiple VLANs.  I enabled DNS Servers in Feature Visibility to add that option and noticed that it already had an entry for the fortilink interface set to Forward to System DNS, and a DNS Database entry for fortiswitch set to Primary/Shadow that has 5 entries, one for each of my FortiSwitches.  I did not make any of these, so this is apparently done automatically when you install a FortiSwitch.  I am trying to get clients on the Lab VLAN to resolve host names for 3 servers in our environment.  I went through the steps to add a new DNS Database using Primary/Shadow and added 'A' and 'PTR' records and a domain name for the 3 servers on our internal network.  I saved this and then added a '

This may be too broad of a question, but will ask in the event some replies or questions may provide any guidance at all. We just ordered FortiPAM, but am struggling on placement of the device based on the design documentation as per this link https://docs.fortinet.com/document/fortipam/1.6.0/administration-guide/541708/fortipam-designs. Most VLANS at HQ (1st floor, second floor, 3rd floor, servers...) reside on an Layer 3 Aruba 5406Z switch and the respective VLANS are trunked down to access switches. Our FortiManager and FortiAnalyzer also belong to the server VLAN on the 5406Z. We have one switch port directly connected to the firewall with appropriate routes in and out. We also have SSL-VPN on this firewall and connectivity to remote sites are via SDWAN ADVPN. Additionally, we have FortiClient EMS cloud. Any suggestions on placement of FortiPAM? Does it need to be on it's own interface on the firewall? There is mention in the article about single or multiple interface design b

Hi, I'd like to share with all of you a python script to perform full FortiGate config backups. It started as a simple automation for my work two years ago and has become a hobby. Along with today's new release i decided to do this post and maybe help some of you who do this task often. As i no longer have access to an appliance, my tests are done with a FortigateVM. Feel free to try out this tool and share your thougs here. All suggestions, comments and feedbacks are welcome. It requires Python 3.8+ and support FortiOS 6.x and 7.x versions. https://github.com/mcarneir0/fortigate-backup-api 

After upgrade, one particular large user group (1400 members) is seeing a high number of incidents where Forticlient SSL VPN authenticates, sets up tunnel and then exits after 1-2 seconds with "User requested termination of service". Eventually it works so not consistent on any client. Any ideas?

Good evening, everyone. Is there any version of FGT KVM that allows you to create more than 3 firewall rules with an evaluation license for studies?

Hi, I really need help to solve following problem. When I try to install device settings via FortiManager I get error 'Installation to real device failed' It's really simple configuration just allow web management on interfaces. Don't know how to debug this issue. ReagrdsPeter 

I'm very new to networking, and I'm a bit over my head. The current situation is we have two firewalls (Firewall 1 and Firewall 2) and two different WANs (VDOM Prod = 1.2.3.4/32, VDOM Nonprod =5.6.7.8/32) on physical ports on Firewall 1. There are no WAN connections are Firewall 2, so when there's a failover, we lose connection to the outside.  My end goal is to have a physical port on each that can support both VDOM WANs without adding more physical WAN drops to the greater network. So, here is my concept:Firewall 1:Physical Port-1 1.2.3.4/32 (Prod VDOM)   VLAN 5.6.7.8/32 (NonProd VDOM)Firewall 2Physical Port 2 5.6.7.8/32 (NonProd VDOM)   VLAN 1.2.3.4/32 (Prod VDOM)Is this a feasible solution? Should I make the connection identical?  Thank you for your time. 

Hi all Need to know what are the feature that are available in Fortigate box without any security bundle.  

Hey all! We've ran into some issues regarding FortiClient IPsec connections with two gateway IPs. I've noticed if you change the IP to another one the connection still goes to the first one that was configured. Has anyone had this same issue?  Best regards!

Hello,on Fortigate 100F how I can monitor the PSU state without execute a commenad in a shell? When a PSU is disconnected the system LED should be amber?I tried to disconnect one of the PSU and I not have any alarms from the hardware led and also in the GUI. Thank you.

I have configured a default route via a SDWAN zone for Internet breakout traffic, this consists of two internet connections. The default route via this SDWAN zone is not being populated in the routing table, both interfaces are up and working. For testing I set a default route out WAN1 and then WAN2 separately, they were both able to reach the internet and the default route was stored in the routing table. Any possible ideas why the route is not being installed and working with the SDWAN zone?     

Hi there, it's a little bit off-topic (non-technical) but belongs to Fortinet. I see many user having their actual Fortinet level as color banner under their Reddit user name shown here (NSEx, FCA etc.) ... I cannot find this option to enter this information. Where to do so?

I can't seems to get this working, I want if somebody connect to User SSLV VPN via FortiClient then they can connect to any local device at least by ping, but specifically for this I want them to connect to Synology NAS IP which is 192.168.110.81 I have added this policy```===config firewall policyedit 7set name "SSLVPN_FortiClient_Outgoing"set uuid fb89aba2-f0f5-51ee-81b1-c690350fbb9dset srcintf "ssl.root"set dstintf "internal"set srcaddr "SSLVPN_TUNNEL_ADDR1"set dstaddr "MGMT_Device" "MGMT_DEVICE" "SYNOLOGI"set action acceptset schedule "always"set service "ALL"set utm-status enableset ssl-ssh-profile "certificate-inspection"set av-profile "Server-AV"set webfilter-profile "default"set dnsfilter-profile "default"set ips-sensor "Server-IPS"set application-list "default"set logtraffic allset groups "SSLVPN_USER"set nat enablenextend===``` but  still seems can't get it workIf I change [set srcintf "ssl.root" ] into other local VLAN like 192.168.60.xxx then it work perfectl

Since SSLVPN will be going away on small units, I have been switching users to IPSEC VPN as we roll out new firewalls. However, I have been having a lot of trouble with the VPN-only Forticlient. The big issue is that, for 30-40% of new Forticlient installs, the client does not seem to respond to the firewall's replies in Phase 1. Firewall log shows P1 successful, then timed out 30 seconds later. If I run wireshark on the client, I see the firewall's traffic arrive at the PC, but then the Forticlient seems to just re-send the first packet again. Seems like only an uninstall-reboot-reinstall has a chance to fix this, winsock reset doesn't seem to do anything.The other thing is that when the client fails to connect, the window never updates, it just sits there on "disconnecting." Closing the window and re-opening it from the taskbar gets it back to normal, but I don't remember SSLVPN's ever acting like that. Today I tried using the Windows native client instead, but it seems lik

I use the Dynamic Device & OS Identification for addresses and it works great, BUT it only works for IPv4 as far as I can see. You can define an address by MAC address in both IPv4 and IPv6 but you can't create a Dynamic address in IPv6 based on Device or OS.  Why is this missing?  Its a very helpful feature in IPv4.  Is there a workaround? I'm on 7.4.8 

I got error Login: Please enter your username and password when I try to connect to VPN, with protocol SSLVPN.Problem is just on my iPhone 7 with iOS 15 (not possible to upgrade to higher OS). On another iPhone with latest iOS all works well.  Not working on both FortiClienbtVPN and FortiClient apps. Version of app: 7.4.7.0183