Support Forum

Hi All, We are experiencing strange behavior in our Fortigate 4401F A-P HA environment. During reboot of the standby device, some sessions, which are carried on the active device, are dropped/stucked. Does anyone encountered such behavior? Thank you!   

Hi all,We have just got our iPads to connect using the FortiClient app with IPSEC and SSO and this works fine so the user can log in using their Azure details and then the login window shows that they have successfully logged in and this window then disappears and the VPN then connects however we've noticed that the Windows FortiClient app doesn't have the SSO option with IPsec (correct me if I'm wrong on that but it only seems to be for SSL) so we're trialling the ZTNA with a view to getting EMS (we don't have EMS installed yet though) and found this DOES have the SSO option with IPsec so I've configured it the same as the iPads and it shows we're successfully logged into the SSO but then whereas on the iPads the window disappears, this doesn't happen...the window just stays there and if we close it then the VPN goes from disconnect to connect as though it's just disconnected but if I check the VPN status without closing the window then it's not connected anyway ?I've tried both the i

With just over a year of hands-on experience, I still have great deal to learn regarding FortiGate configuration so I'm hoping to hear from some experts regarding how to use FortiGate as a core switch.  I'm managing about 40x FortiGate firewalls (mostly 200F) at a moderatley sized school board with 40 elementary and secondary schools.  Theconfigurations were setup by one or more predecessors before I took over the responsbility.  For the most part, we only have a single ISP link and a single internal switch link on each FortiGate.  Depending upon the size of the site, we could have anywhere from 1-5 campus switch stacks at each site with anywhere from 2-6 switches per stack.  The largest site would have about 18 switches across 4x switch stacks.  All switch stacks are aggregated with a core switch stack where there is a single uplink into the firewall.  Layer3 switching (routing between VLANs) is done on the Fortigate Firewall.  OSPF and BGP are

We need to migrate our internal network from the Fortigate ethernet port to one of the fiber ports in order to get the 5Gbps subscribed in FortiGate 600E model, what are the basic check we need to perform to check if it is supported and is there's any documentation I can follow for this configuration.

Hello,  our "Vulnerability Scanner" detected that libcurl.dll as vulnerable to CVE-2025-0167Vulnerable files are:C:\Program Files\Fortinet\FortiClient\libcurl.dllC:\Program Files\Fortinet\FortiClient\x86\libcurl.dllWe use free FortiClient VPN SSL, so we can't confirm if full paid version is vulnerable too.We've upgraded to FortiClient VPN SSL 7.4.3, but libcurl.dll version is still vulnerable 

Hello community, I tried many ways to configure IPsec vpn to access only a specific subnet, but all have failed.Can you guide to how to configure such connection. Thank you!

Hello Team,We have deployed the FortiGate Firewall-201G in HA (Active-Passive) mode. Due to port limitations, we have connected a FortiSwitch (model 148F) to each firewall. These switches are managed through the firewalls.Currently, we are facing an issue: only the FortiSwitch connected to the primary firewall is coming online. However, we want both switches (connected to the primary and secondary firewalls) to stay online.Additionally, while the firewalls are in HA mode and have failover configured, the switches do not have any failover setup. This means if one switch goes down, traffic cannot switch over to the secondary switch, which creates a single point of failure.We have tried using crossover connections and the FortiLink split interface feature, but were not successful. We also noticed that the MC-LAG option is not available on the FortiSwitch 148F.Could you please advise on the best way to configure failover for both FortiSwitches connected to the primary and secondary firewal

https://youtu.be/SKPrKeKKW4w Starting with FortiOS 7.2.1, Fortinet removed built-in 15 days free evaluation license from the Fortigate VM images. It was replaced with the permanent evaluation license, still free. The steps to get it have changed - you now have to create a free Forticare/FortiCloud account, and use it inside the Fortigate GUI to activate this evaluation license. The license will be generated and added to your Forticloud account automatically.

Hi, Can we create SD-WAN primary-primary hub without using SD-WAN overlay template ? We have not currently deployed the HUB2 for now and it will be delayed. But we can not wait until the site is ready. So we need to firstly deployed the first HUB and the second HUB and finally the primary-primary configuration. Can we do it ?

Hello, I configured an IPsec Ikev2 Dialup VPN on a Fortigate 2200E in 7.4.7. based on certificates.The Android tablets run the latest version of Forticlient available and their OS is Android 14.The customer wanted a full-tunnel, inside the HQ network there is a proxy for Internet access, while everything else must (or should) transit on the internal network avoiding the proxy server. The VPN has the mode-cfg enabled and the DNS are passed. Unfortunately in IKEv2 I cannot set the DNS suffix, but the customer would need it because otherwise every URL that searches in the tablet browser ends up on the search engine. How can I solve this situation?On Android, the proxy is configured under the APN settings, unlike Windows which is done on the Browser.Searching through Forums and KB I managed to trace that it is enough to change the IKE VPN from v2 to V1, is this really the only solution? I know there is an option under the phase1-interface "set internal-domain-list" but what's the

Helo!i have a question is there possible if i integrate Anti-Virus on F5 with Fortisandbox?Because, i will create an feature on web application for uploading file with xlsx and pdf format. I want to send the file for scanning on fortisandbox before pass to the server.ive read some article https://my.f5.com/manage/s/article/K70941653but i still wondering, is it possible or not?  thank you.

Hello,  I recently installed my newly obtained Fortigate 61E, and updated to 7.0.3. I setup an IOT VLAN for my IOT devices. All of the devices can connect to the internet just fine, except for one exact device. After rebooting the device, that device will connect to the internet for a little while, then appears to lose connection. The entire time, the device can be pinged on the LAN with it's DHCP reservation. Looking for any recommendations, as I'm a bit new to this.  Thanks in advance!

I had tried to setup VPN connection. Using the latest version client and firewall. In windows During the login time it shows"VPN Server may be unreachable (-14) " . Status shows 80% complete. BUT it works in ANDROID..!!! Anyone resolved this ?  

I am getting this error when trying to do Firewall upgrade:"Image Upgrade Failed. Incorrect Address Name." while trying to upgrade I am unable to find the KB which has the same problem.How do I proceed with this? Thanks!

I have a user who is attempting to connect to a VPN using the Forticlient Linux CLI client. In order for them to connect, they need to Enable "Single Sign On (SSO) for VPN Tunnel". I don't see an option for enabling this through the CLI. When I view the VPN profile it shows as disabled. Does anyone know how I can enabled this option in the Forticlient Linux CLI?  $ forticlient vpn view MYVPN VPN: MYVPN Remote Gateway: vpn.myVPN.com:10443 Client Certificate: None Authentication: Disabled Single Sign On (SSO) for VPN Tunnel: Disabled Auto Connect: Disabled Always Up: Disabled Save Password: Disabled $ forticlient version FortiClient Version: 7.0.8.0292 ===================================== Engines ===================================== AntiVirus: 6.00282 Vulnerability: 2.00031 ===================================== Signatures ===================================== AntiVirus: 1.00000 AntiVirus Extended: Unavailable Vulnerability: 1.

How to create and Communicate subnet like 10.20.30.0/24, 10.20.28.0/24,10.20.29.0/24 on Fortigate HA firewalls. Whereas access switches are cisco with only by default configurations. Having vlan 1 passed. In current scenario, subnet 10.20.30.0/24 working fine with multiple policies of firewalls.  If we create multiple networks on firewall, How we can control users if static ip assigned to wired pc/nodes while creating security policies, firewall policies. 

hi,I've created secondary IP Address to certain Interface (Internal 2), so we can define on Internal 2 has 2 ip:ip-1, and ip-2can I make:certain host (computer) from ip-1 communicate to specific IP address on ip-2?If different interface, I can make policy route, how about in this case?kindly please advice. thank you

I have a, maybe silly question but maybe someone can answer me.. We have FAC setup with RADIUS clients in a 10.10.0.0/16 subnet, mainly used towards switches for MAB. The thing is we want to configure VPN for a firewall with an IP in the same subnet. Is it possible to configure this as a /32 without it being affected in the /16 subnet policy?

Hello, I am trying to setup a FortiAuthenticator policy for Wireless dot1x. The authentication works but RADIUS attributes (vlan and ACL) is not pushed to client.Here is what I have tested; Added the Remote LDAPCreated a User Group which retrieves user via LDAP Filter (not via imported users).Created a Realm for LDAP UsersCreated a Policy that:WLC as RADIUS ClientAuthentication Type Password/OTP (PEAP and EAP-MSCHAPv2)Identity Source - username@realm - Points to LDAP Realm, uses Windows AD Domain Auth and filters on the groupAuthentication Factors - Password Only and Windows AD computer authentication I have tested with User Group pointed to imported users and remote user sync rule but that does not work either.Does anyone have any idea? I checked the debug logs but cannot find anything interested. Also we havetested this with a local group (MAB) and it works fine.

Hello, dear friends. On my FortiGate, I have created a software switch with ports 4 and 5 that has a segment 192.168.141.1/24 - Wired network. Likewise, a VLAN on that software switch has a segment 10.100.0.1/24. Wi-Fi network. But the Wi-Fi network on my Unifi SW and Wi-Fi gives me Wi-Fi for the devices and assigns me the IP 10.100.0.1/24. I need to create a VLAN to assign the same segment 192.168.141.1/24. But if I create a VLAN with the same segment 192.168.141.1/24, that IP doesn't match the other one configured in the software switch. A separate network is created. How can I create a network that has the same segment and shares the same gateway so the devices can see each other? What step do I need to take?

Hi everybody Currently, I have an active FCA and FCF certifications, but it is near to expire.I checked the fortinet training pageIn this page, I see this consideration.If your FCA certification is still active, you can extend its expiration date to two years from the date you complete one of the following requirements:Completing the FortiGate Operator course and passing the FortiGate Operator exam.Passing one exam for any FCP certifications.Passing one exam for any FCSS certifications.However, when I took again the Fortigate Operator exam, I can't recertify. Can help me about it?How I can recertify the FCA and FCF qie the Fortigate operator course?? Thanks in advance

As far as I know, When lacp mode passive, it responds when it receives a lacp packet. but during the LAG test, Forti-A was set to lacp-mode passive and Forti-B was set to lacp-mode passive.Both Forti-A send lacpdu and Forti-B receive lacpdu.Is it because there are still sessions we communicated when it was active-passive? 

FortiGate FSSO has been successfully configured and enrolled. However, when applying it to a firewall policy and checking user connectivity, the connection appears to be successful.The issue arises when a user logs into their laptop using fingerprint authentication or a PIN code—under these conditions, the FSSO-based policy is bypassed, and unrestricted access (e.g., to websites like YouTube) is allowed.I would like to understand the root cause of this behavior and whether there is a viable solution to address it.

Hi,I have a fortigate fws a-p mode managed by fortiManager in air-gap environment, all are in air-gap.What i see recently i replaced the passive fw with new unit due to rma. after joining it to cluster, both got in-sync as well.I see the licenses on both a-p are getting revoked, i applied the license file for each unit separately but that does not help. It shows license file succesfully uploaded it will show all IPS, AV in Green with proper expiry date, after 2-5 min it all gets orange with no license.What i observed is that the license section shows License update ip as Fortimanager, do i need to upload the license via Fortimgr ?i tried for active fw license file upload under fortimngr Foortiguard settings > service pack > but that also does not help.

Hi  i have NSE7 certification expiring on July 2025 , i am planning to take the ZTNA exam , would this be enough to renew my certification , or shall i need to take another exams ?