Support Forum

I have 2 offices, Site A is Sophos and Site B is Fortigate. I have established Site-To-Site VPN for the two sites. The tunnel between the two sites is UP, but the Tunnel Interface IP cannot ping each other and the two sites cannot ping each other. The server under the site cannot ping the opposite endpoint. The following is relevant information:Site A (Sophos)WAN IP : 11.11.11.11LAN IP Subnet : 172.29.21.0/24, Server IP: 172.29.21.11 (LAN Gateway under Sophos Firewall)Tunnel Interface IP : 10.212.0.1/29Firewall Policy: Accept LAN(172.29.21.0/24) toVPN(10.210.101.0/24) Site B (Fortigate)WAN IP : 22.22.22.22LAN IP Subnet : 10.210.101.0/24, Server IP: 10.210.101.11 (LAN Gateway under Fortigate Firewall)Tunnel Interface IP : 10.212.0.6/29Static Route: 172.29.21.0/24 via interface S2S_DCOF_MFirewall Policy: Accept LAN(10.210.101.0/24) to S2S_DCOF_M(172.29.21.0/24)  (Below Fortigate IPSec Tunnel Status)   Here I'm using Route-based to establish a Site-To-Site VP

I am able to connect to my IKE v2 IPsec tunnel for remote access using my local laptop plugged directly in to internal1 port, however I cannot ping lan (VLAN gateway 172.16.10.1) that sits behind FortiGate. FortiOS version is 7.4.7 and FortiClient on laptop is 7.4.3.1761I configured IKE v2 using API POST/PUT and this is what the final phase 1 tunnel looks like:{ "name":"IPSEC_VPN", "q_origin_key":"IPSEC_VPN", "type":"dynamic", "interface":"internal", "ip-version":"4", "ike-version":"2", "local-gw":"0.0.0.0", "local-gw6":"::", "remote-gw":"0.0.0.0", "remote-gw6":"::", "remotegw-ddns":"", "keylife":28800, "certificate":[ ], "authmethod":"psk", "authmethod-remote":"", "mode":"main", "peertype":"any", "peerid":"", "default-gw":"0.0.0.0", "default-gw-priority":0, "usrgrp":"", "peer":"", "peergrp":"", "monitor":"", "monitor-hold-down

Hi Community, We have 2 IPsec Tunnels (Tunnel 10 and Tunnel 20) between Fortigates (Remote and Concentrator) with only 1 Phase 2 Selector configured and auto-negotiate disabled. Both tunnels are working as expected where we have connectivity from both sides.  Tunnel 10 is presenting 2 Phase-2 Selectors via GUI und CLI, where the first Phase-2  is UP and the second one is DOWN. We have already deleted the entire Phase 2 Interface and reconfigured it, restarted the entire cluster (A-P) and nothing helps. We really don´t understand why there are 2 Phase Selectors in a scenario where we have only 1 configured, please any idea how to troubleshooting and solve this issue? FortiOS 6.4.11 and keep in mind that Tunnel 20 with the same setup in the same device has not this issue and we have several others FGT with the same setup and also not presenting this issue.  I really appreciate any comments, thank you!FortiGate 

We are using Forticlient 4.2.4.0271 Recently we started noticing that Forticlient changes a DHCP assigned DNS setting on the NIC to a static DNS setting while it is connected (and uses the DNS settings of the IPSEC VPN connection from a Fortigate as the static settings). It then changes it back to automatically assigned when the Forticlient is disconnected. However, if the system goes into hibernate while the Forticlient is connected, it doesn' t seem to revert these DNS setting changes back to DHCP automatically assigned, causing an issue when the user tries to use the Internet on another network that requires DHCP assigned DNS. Has anyone else seen this problem?

The only link I can find on the support site with this scenario I am wanting to achieve is https://community.fortinet.com/t5/FortiGate/Technical-Tip-DNS-database-with-FortiGate-as-a-slave-to-a/ta-p/192942 where it gives the basic items to do to get this working. What I am making further inquiry about is what might need to be done on the Windows side? i.e... since this is going to a secondary DNS, is the FortiGates's DNS, BIND, and thus I need to set the Windows DNS properties to allow BIND secondaries? Do I need to turn off DNSSEC for remote responses? Just those types of inquiries since the article did not expound on that at all...and since I am running into errors, this has gotten me to make further inquiry. From the Windows side of things, I get a "Validation error, please try again later".  From the FortiGate's side, when I do "diag test application dnsproxy 8" from the CLI, I do get record information like the example output of the link provided, yet from the G

I’m setting up EAP-TLS for Entra-joined devices using FortiGate NAC Lite (7.4.x) and FortiAuthenticator (6.6.x) with certs deployed via Intune SCEP. I’ve got it mostly working but need a known-good config to compare against—especially: FortiAuthenticator SCEP & RADIUS settings FortiGate 802.1X interface config Any Intune SCEP profile tips If anyone can share a working example or config snippet, it’d be a huge help.Thanks!

After upgrading our FG200E from v7.2.4 build 1396 to v7.2.5 build1517 our configured SD-WAN zone and both of our WAN interfaces no longer show up in the dropdown selection "Outgoing Interface" when editing or creating new firewall policies.Additional facts I have collected so far:I can see and edit the SD-WAN zone under "Network" > "SD-WAN".When editing the SD-WAN zone, clicking on "References" delivers no results.When editing the SD-WAN members, the dropdown "SD-WAN Zone" shows no selectable entries.I can use the configured SD-WAN zone in firewall policies and edit the zone and the members via CLI, so there is a workaround, it seems to be a web-GUI issueDoes anybody know wether this is a (known) issue with the firmware or are there any possible mistakes we could have made in our configuration which just did not pop up until after the upgrade?

I have two sites broadcasting there available newtorks via bgp over a site to site connection.  When I do a firewall policy test the remote system, it gives my default outbound policy vs the Firewall rules I have already established.  BGP Neighbors BGP Paths So none of my site to site policies match when I do the test policy function. I am sure I am missing something but dont know what. Thanks in advance 

Hello, may I ask an expert from Fortinet to explain in detail how the "Intelligent analysis" feature works? Admin guide is rather vague. I have just created my first WA test profile. I have kept the Intelligent analysis value at default 50. Now it has been 2 hours and already 2 legitimate messages got classified as: Identified by BEC-Weighted Analysis: Intelligent analysis, score: 50 I see no valid issues with messages. So far it looks like it creates false positives, exactly the opposite of what Admin guide states. Thanks,Petr

Fortgate 80E firewall memory usage hanged up at 82% and Firewall Showing (Conserved mode Error). Which stopped firewall mode to 82% usage for safer side.Some services were working and some were disturbed. I deleted all logs of fortigate to resolve this issue.  Needs suggestion from Senior members what was this issue, why this occured , what is best approach to reolve this issue? Either my solution was true or not?

Hello! I have an odd problem with L2TP server over IPSEC on my FG-100F box running 7.4.6 software.My configuration:config vpn ipsec phase1-interface edit "L2TP-VOLZ" set type dynamic set interface "VLAN96-TESTLAB" set ike-version 2 set peertype any set net-device enable set proposal aes256-sha512 set dpd on-idle set psksecret ENC <removed> set dpd-retryinterval 60 next end config vpn ipsec phase2-interface edit "L2TP-VOLZ" set phase1name "L2TP-VOLZ" set proposal aes256gcm set encapsulation transport-mode set l2tp enable next end config vpn l2tp set status enable set eip 10.100.251.254 set sip 10.100.251.1 set enforce-ipsec enable set usrgrp "IPSEC VPN" end config system interface edit "l2t.TESTLAB" set vdom "TESTLAB" set allowaccess ping set type tunnel set snmp-index 99 next end config system interface edit "L2TP-VOLZ" set vdom "TESTLAB" set ip 0.0.0.0 255.255.255.255 set allowaccess ping set type tunnel set snmp-index 129 set interface "VLAN96-TESTLAB" next end confi

Currently running FortiOS 7.2.11 and we're exposing a web server behind a Virtual Server configured for SSL offloading. Our security team is asking us to set the minimum protocol to TLS 1.2, but we've been asked to make sure no legacy clients are still using TLS 1.1. I checked the forwarding logs and am not seeing protocol or ciphers, is there a way to see this in the logs or to pull this from FortiAnalyzer?   Denny

Greetings! I am encountering an issue with playbooks in FortiAnalyzer. A few weeks ago, everything was working correctly, and I could see automatically created incidents. However, this is no longer the case. I created new and they don't work too. Also, I checked their settings and everything must work Could you please advise on how to resolve this?  

I'm using a Lenovo IdeaPad Slim 3 with Windows 11 Home Single Language (Version 24H2, Build 26100.4061). When I try to connect to a VPN , it doesn't connect—no error shows, it just stays stuck on "connecting."Internet works fine otherwise. Any idea what could be causing this?

Hello,I've come across a number of posts about this topic on both FortiNet and T-Mobile forums but I haven't found a solution. We have one user who has T-Mobile for home internet. She cannot use the FortiClient IPSec VPN consistently. When I was first setting up VPN for our users, I noticed this issue with my own T-Mobile hotspot on my iPhone and we were forced to also offer SSL-VPN. We implemented our new VPN and have been rolling fine for a few weeks now. However... I came to learn this week that she'd actually been able to use the IPSec VPN and it was working fine for her. Then this week after she had a tech help her with an email issue, the IPSec VPN no longer works for her, and the SSL VPN disconnects on her frequently. I worked with her for about an hour this morning. She has a Mitel 5340 phone in Teleworker mode which we used for communication while I did a remote support session with her. I noticed no issue with either the VoIP or the Remote session.I made sure I

Hello everyone, I recently came across information saying that Fortinet has introduced a new feature allowing HA to be configured with only one licensed device, rather than requiring licenses for both units in the HA pair.  From what I’ve gathered, this feature appears to be available only for models ranging from FortiGate-40F to FortiGate-100F. Some models in the FortiGate F series, such as the FortiGate-40F-HA, appear to support this functionality. However I haven’t seen a similar designation for the FortiGate-30G model for example. Could anyone please confirm whether the G series includes this feature by default? And I’d like to know if this HA configuration supports active-active mode or if it is limited to active-passive, which would be the more expected scenario. Thanks in advancedCheers,

Hello!We have an interface on our Fortigate which has multiple secondary IP addresses. Is there a way to stop the traffic between the networks? For example:Interface with IP 10.0.0.254/24Same interface with secondary IP address 172.16.0.254/24Same interface with secondary IP address 192.168.0.254/24 Unfortunately, it is currently possible for devices in the respective subnets to reach each other via the interface. However, I would like to prevent traffic between them and define exceptions. We also do not have enough ports to bring the individual networks into their own interface.Thanks for your help!

Hello,trying to convert a FTD policy to Fortigate using FC 7.2.0.Some ACLs contain multiple source interfaces.The converted policy imho seems to miss source interfaces.This happens with FTD ACLs having multiple source interfaces as well.example: access-list CSM_FW_ACL_ remark rule-id 268444674: ACCESS POLICY: ACLFirePower - Mandatory access-list CSM_FW_ACL_ remark rule-id 268444674: L7 RULE: Inside_kms access-list CSM_FW_ACL_ advanced permit tcp object-group-ifc Verwaltung any object-group-ifc ServerNetz object rz-kms eq 1688 rule-id 268444674 access-list CSM_FW_ACL_ advanced permit tcp object-group-ifc Bibo_Inside any object-group-ifc ServerNetz object rz-kms eq 1688 rule-id 268444674 access-list CSM_FW_ACL_ advanced permit tcp object-group-ifc Inside any object-group-ifc ServerNetz object rz-kms eq 1688 rule-id 268444674 access-list CSM_FW_ACL_ advanced permit tcp object-group-ifc ServerNetz any object-group-ifc ServerNetz object rz-kms eq 1688 rule-id 268444674 access-list

Hi all,Trying to set up FortiClient IPsec VPN (IKEv2) with SAML (Microsoft Entra ID) on FortiOS 7.4.7. When I try set xauthtype saml or set saml-server, I get parse errors (code -61). Also getting psksecret required errors if I skip PSK.Docs don’t mention any prerequisites. Has anyone gotten this working with Entra ID? Seems like the tunnel needs to be created in a specific order.Thanks!

Hello, I would like to clarify some questions for 7121F configuration.I need to provide 420Gb NGFW performance and have 10*100Gb SFPDD ports. I think I need 7121 chassis and 8*FPM-7620F и 1*FIM-7921F? Is it working configuration? Could you provide some advices?

Hi everyone,I’m trying to understand how FortiGate SSL VPN handles IPv6 traffic when connecting through a mobile hotspot (e.g., 5G tethering).I’ve noticed some unexpected behavior and would appreciate clarification on how to properly control traffic routing. Here’s my current setup:SSL VPN is configured with split tunneling disabledNo ssl.root → wan policy is configuredThe client connects through a 5G hotspotDespite no outbound policy, the client can still access external websitesThe public IP shown is my 5G IPv6 address, not the company's public IPv4 address Questions:When connecting to SSL VPN over a 5G hotspot, is traffic routed only through IPv6?Is it possible to configure FortiGate so that IPv4 traffic works properly over SSL VPN even when connected via a hotspot?If no outbound policy is configured, why does IPv6 traffic still bypass the tunnel and reach external websites?Any insights or configuration advice would be greatly appreciated. Thanks in advance!

What things will I lose if I don't purchase a Forticare license in the case where I don't need support?I am specifically referring to the Forticare license for FGT, FAZ, FMG, and FAC.

Good morning, Since yesterday, I have a problem with two notebooks where the token prompt does not appear at all. The accounts work perfectly well on other devices. Does anyone have an idea what might be causing this?

Hi Dear Community Members,  I am bit confused to take and restore Fortigate 201F firewalls backup.  Someone clearly guide me , how we can take and backup 2 fortigate firewalls if they are operating in HA mode Primary and secondary. After backup how we can reset them and restore again backups so that previous primary remains primary only restoring backups.  --> Either we need to take backup of both firewalls--> Primary & Secondary individually or only using HA cluster ip --> after resetting both firewalls or only primary firewall if we restore those taken backup eithe previous primary will automatically become primary and secondary will syn again? 

hi,i need some help with ASA to FGT conversion. i used forticonverter but not confident of the output so i did this manually.can someone confirm if below config conversion is correct? this is just a NAT between two internal networks. !! ASA interface Port-channel20.61 nameif outside security-level 0 ip address 172.16.248.78 255.255.255.248 interface Port-channel20.60nameif insidesecurity-level 100ip address 172.16.248.70 255.255.255.248object network obj-172.18.7.7 host 172.18.7.7 nat (outside,inside) static 172.29.13.1route outside 172.18.7.0 255.255.255.0 172.16.248.77 1route inside 172.29.0.0 255.255.0.0 172.16.248.69 1 -----!! FGT config firewall vipedit "vip-172.29.13.1"set extip 172.18.7.7set mappedip "172.29.13.1"set extintf "po20.60"nextconfig firewall policyedit 1set srcintf "po20.61" set dstintf "po20.60"set srcaddr "all"set dstaddr "vip-172.29.13.1"set service "ALL"set schedule "always"set status enableset action acceptset na