Support Forum

Hi  i have NSE7 certification expiring on July 2025 , i am planning to take the ZTNA exam , would this be enough to renew my certification , or shall i need to take another exams ?   

Hi Community, I have imported the configuration for 1 VDOM into Forti Manager (7.6) and after imported successfully, it's still at "modified" status. I changed Routing objects and BGP directly on the Firewall, FGM and FGT immediately went out of sync, so hence I tried to import from FGT to FGM to get back into a sync status. The policy imports successfully, but why aren't the routing objects such as Prefix Lists and Route Maps, static routes and BGP config are not updating on FGM?  What am I missing here?

If use lacp-mode static because the peer equipment does not support lacp, it seems similar to use h/w switch or s/w switch instead of LAG. What's the difference between Fortigate's lacp-mode static and h/w & s/w switch?

Hello to all,I’m trying to build a single spoke hub & spoke (Dual hub) topology using the overlay template provided by FMG 7.6.3.The architecture is formed by 2 VM fortigate hubs in 7.4.6 and an onprem A/S pair that acts as spoke in 7.4.6.Full internet topology, each hub has only one link while the spoke has 2.All the tunnels are UP, and HUB side I see the advertisement in BGP of the test subnet that I’m using onprem side (192.168.99.0/24). The BGP advertisement has something strange, I would have expected to see the VPNs as next-hop interfaces, instead it uses directly the port 1 (outside of the hub) used by the underlay.I noticed that the templates created by FMG do not assign an IP on the HUB interface tunnels, I don’t know if this is an error.From the hub loopback (172.16.5.252) I can successfully ping the spoke’s Lo (172.16.5.1).

fortigate update without license

Hi Guys,So I am not a FGT guru at all.I run a FGGT60 using 7.2.11 b1740 Here is the scenario, isp has assigned me an IP range up until now I have just been using one. Now I need to use a second and route that IP to a server on port 5. Need that server to have full internet access but not be able to see anything else on the network.Here is what I have done:Created new hardware switch with only member port 5 - 192.168.15.1  Server is on that port/switch is getting correct IP info 192.168.15.2 and has access to the internet Now How do I route my second IP address to that port/switch?Is this a simple routing issue or do I have to add a secondary IP address on the WAN1 port? Sorry for what is probably a simple question but I can't seem to find a definitive cookbook article for this and since I am operating remotely I can't really just cowboy it.. thx John             

Hi all,I've not used Peer id's in the past but I have 2 IPSEC tunnels for dial in users and they both listen on the same interface, the first one is TunnelA and then second one (below it in the list) is TunnelB so my understanding is that I can set PEER ID's on the tunnels and then specify the local id on the client and it will only connect to that tunnel that matches so I've got TunnelA and TunnelB and in the "Authentication" bit on the FortiGate side for both of these tunnels in the "Peer ID" section I've put TunnelA on TunnelA and TunnelB in TunnelB. I've also specified the same in the "local ID" in the Phase 1 Proposal bit on the FortiGate tunnels. Then on the FortiClient endpoint I've specified TunnelB in the "local id" under Phase1 so I thought this should then try to connect but only to TunnelB however it's not connecting but on our FortiAnalyzer it's showing the endpoint is trying to connect to TunnelA but then nothing after that ? i.e. I would've thought I would either see it

I am trying to reduce the amount of logs sent from FAZ to SIEM via log forwarding, but would still like to forward all FGT logs to FAZ. I can configure log exclusion and set a field-list, but the field-list options are generic and not as granular as I would like (from what I can tell). Can I create a custom field-list that is more detailed, such as a particular destination IP?I would really prefer the option to exclude based on FGT Internet Service category and destination IP, but am open to nay input.Thanks

We are migrating from SSLVPN to ZTNA on FortiGate 7.6.2.  EMS Cloud 7.4.3 and FortiClients 7.2.9 and 7.4.3. With SSLVPN I am using external browser to our SAML 2FA.  What this means is that the users Browser caches the authentication cookie for about 24 hours so they do not need to re-login and get a new 2FA.  However, I do not see any option in ZTNA to use an external browser.  So every time a user goes some where they need to authenticate with SAML and get a new 2FA. Is there any way to change this?  I would be happy with authenticate once every 8 hours if that is possible.

Hi everyone, I was struggling to get FortiOS config in YAML format into Python. Thanks to this post I found out it's a bug - 976722.System configuration export in YAML seems invalid - Fortinet Community Fortinet fixed the bug in 7.4.8. I updated a device to 7.4.8 and downloaded the config in YAML format. I can now load the config into Python, but I'm facing a new challenge. The object that is created from the file is a Python dictionary with two keys: 'global' and 'vdom'. This is expected. When I select key 'vdom' and load it into its own object, its data type is list. This is where the problem is. The list contains only one of two VDOMs I have in my config. The YAML file contains both VDOMs. Did anyone encounter the same issue? Any idea how to proceed?

Hi all, We're trialling on premise EMS and I'm struggling to get the FortiClient installed. I've got 2 domain joined laptops and I've made sure that all of the ports are open in the Firewalls (and I've tried it with the Firewalls off) and made sure that the EMS server can reach the required folders etc and the laptops back to the EMS server along with making sure the credentials are correct (and i've tried local admin creds) but it keeps failing. It does create the FortiEMSinstaller_logs folder along with the FortiEMSinstaller folder on the laptops and in the logs the only error I can see is this:[2025-05-28 15:57:59.5684027 UTC+01:00] [ info] [service:0 ] [27800:13432] [ 154] [WinMain] installing FortiClientInstallerService service[2025-05-28 15:57:59.5687825 UTC+01:00] [ info] [service:0 ] [27800:13432] [ 34] [orchestrator::service::install_service] service is installed - replacing it[2025-05-28 15:58:00.6898569 UTC+01:00] [ error] [service:0 ] [27800:13432] [ 50] [orchestrator:

I'm using Fortigate 70G with Comcast broadband in WAN1 and a 5G router for backup connected to WAN2. What's the best way to configure failover? I just kind of assumed that I should use SDWAN, but if I'm being honest, I don't really need any of the SDWAN "features." Since the 5G router will have a cost-per-bandwidth, I really only want to use it if/when Comcast is down.Can I achieve this type of failover configuration with SDWAN or am I better off just doing link-monitor?

Hi, We are deploying FortiManager Cloud and when we start trying to import configuration of the FortiGate, there are conflicts displayed. Just want to know if it is okay to use the default of FortiManager and overwrite the conflicts displayed, it will not affect the config of the FortiGate device?

 We use a common email address (e.g., no-reply@mydomain.com) to send emails from various systems. To distinguish between services, we dynamically change the display name—such as:MYDOMAIN Payroll no-reply@mydomain.comMYDOMAIN Marketing no-reply@mydomain.comMYDOMAIN Invoicing no-reply@mydomain.comHowever, these emails are being resolved as forged. This issue arises because the inconsistent display names triggers anti-spoofing/anti-spam checks, especially when combined with a shared sender address.How can we prevent this issue and ensure reliable delivery of these emails across systems?

Hi, Would like to know if the conflicts displayed when we are trying to import configuration the FortiGate device config FortiManager Cloud may affect the overall function of the FortiGate device itself? We plan to use the FortiManager default config. 

Both the FortiGate Firewall content processor（CP） and the network processor（NP） have IPsec encryption and decryption functions, and there is overlap in their functions. How are the two processors divided in IPsec encryption and decryption?

HI, I have experienced a very interesting problem.I had a network device that was working fine when connected to using a computer or when connected via the FortiGate, however, when connecting via the FortiSwitch it would not work and the FortiSwitch would not even learn the MAC address (The interface was showing up and STP was changed to forwarding state properly).After long time of troubleshooting i found that the MAC address on that network device could not be found in any OUI database. The manufacture created a new Firmware that corrected the MAC address and i was able to then use it via the FortiSwitch.I'm trying to understand why the FortiSwitch was blocking it and if there is a log or something i could've seen it getting blocked. I was unable to find any relevant documentation. I'm not using any special security (No NAC, 802.1x authentication etc)Using fortiswitch 148f-f with firmware 7.6.0

I have been using the proxy based UTM profiles for all our students firewall profiles and have had no issues until last week. We started getting Certificate issues on client devices. such as Err_Cert_date_invalid.  The certificate in question is issued by FortiGate but on inspection it is expired even though the certificate in the Manager is not expired. Im not even sure where to begin with this but it is causing issues as I have had to change to Fow based but this is allowing students to access sites that they shouldn't be despite rules being setup to prevent this. Regards

I have a Fortigate 90G with 5 S148F-FPOE switches connected in a line. All the uplink ports show high Oversized packet counts. I am seeing this from the gate to switch one, 1145975344 and from switch 1 to switch 2 885605148. But all uplink ports are showing these high numbers. I am getting reports of disconnects and speed issues. I have checked all ports on all switches for CRC errors. I see a few ports, but the count is 9 or less. Fortigate is running 7.4.7 and switches are running 7.6.1. This is a recommendation on the matrix, just trying to figure out what is going on. 

I am trying to get a IPsec dialup VPN accessible from two interfaces WAN and LAN3. Currently the IPSec VPN listens on WAN and that works well. I have added a virtual ip on the LAN3 interface mapping from the public IP to WAN IP and created a firewall policy using this VIP. With this in place the IPSec VPN will connect from LAN3 however no traffic flows across the tunnel. Any idea what I am missing?

Hi there,Understood that we are able to call commands in CLI to execute the collection of logs residing on disk in the Foritgate FW Admin Panel. Is there a similar command to collect all logs residing on cloud too? I'm trying to simplify the collection of all logs using CLI. This is on the assumption that I only have access to the admin panel in Foritgate. Thank you! 

Hello -  We are migrating to 2x new FortiGate appliances in the AWS cloud, in a single VPC.These devices only serve 16 VPNs, half of which are DR VPNs.There is no public traffic, and no firewall rules to manage.Can someone recommend a Fortinet Partner that can help us?Thank you!

Hi all,I'm doing a trial setup of some FortiExtender FEX-202Fs with my existing Fortigate 91Gs which are managed via a FortiManager VM. I plan on using these as LAN extenders for remote microsites. I've managed to get the FEX units working well with the FGTs on their own, but the trouble comes when I try to use FMG to create firewall policies involving the FEX interfaces.  In the FGT UI, I can see the FEX units correctly appearing under the "LAN Extension" category. Firewall polices work fine when configured directly on the gates. However, when the FGT configs are imported into FMG these same interfaces appear as the "VLAN" type. I am then not able to select these interfaces when making firewall polices. I'm assuming this is because the "role" variable on the erroneous VLAN page for these interfaces is set to "Undefined". Unfortuantely I am not able to change the interface role, as an error message appears notfying that "VLAN ID must be between 1-4096", but the option to set

Good morning! How does static mode work in LACP on Fortigate?As far as I know, Fortigate don't send lacp messages in static mode,so how can I communicate in a static-static configuration? Thank you

Hello, I tried to export the system configuration file from my FortiGate with FortiOS v7.2.7 build1577, today the first time in YAML. When exporting using the WebUI I chose: Scope: Global, Backup to: LocalPC, File format: YAML, Password mask: enabled, Encryption: disabled. When I then tried to load the yaml file with the PyYAML python library v6.0… without the expected success:  import yaml with open("[…].conf.yaml", encoding='utf-8') as fd: yconf = yaml.safe_load(fd) File "[…]\Python311\site-packages\yaml\parser.py", line 438, in parse_block_mapping_key raise ParserError("while parsing a block mapping", self.marks[-1], yaml.parser.ParserError: while parsing a block mapping in "[…].conf.yaml", line 2407, column 9 expected <block end>, but found '<scalar>' in "[…].conf.yaml", line 2408, column 50  When examining with a text-editor, I found the following at the guilty part of the YAML-file (starting at line 2405):  firewal