Support Forum

HI Team, We have recently implemented FortiGate 200G firewall to replaced SonicWALL. Will before used one of the feature is not working in FortiGate i will raise ticket support team and confirmed they it will work like you can post your new query our R & D team will check and update, if possible, to next release.  Here with i have mentioned my Query: - As per our company policy we have configured AD based internet policy both internal users and  sslvpn users.we have more than 15 internet policy used in firewall both LAN to WAN and same as SSLVPN to WAN. we have created a firewall group with point AD group for example "Mailonly-allowed". these group using to SSLVPN to Wan policy who are part of this group connecting sslvpn they get internet access only mail access and they get which of the service i have allowed that user for example - HTTP, HTTPS. But here what is the challenge we have facing, In that Mailonly group all users not required to SSLVPN may

HiI lost access to the web ui of the fortigate fw after changing the ha settings from active-passive to standalone. As soon as i selected standlone and clicked OK, fw starts buffering for sometime and then i lost the web ui and ssh access.then wento inside DC and connected laptop to mgmt interface in same subnet still web ui inaccessible, via console am able to access the cli and found mgmt interface ip was not present. I set the ip address again and tried accessing which failed. I took a reload of the device but of no use.Now what can i do further to take the web ui access?

I made a GNS3 lab with 1 Fortigate (as a gateway) and 2 PCs:Structure:1. PC1 -> Fortigate (Port1).2. PC2 -> Fortigate (Port2).Configurations:Fortigate:config system interfaceedit "port1"set mode staticset ip 10.0.0.1 255.255.255.0set allowaccess ping https sshnextendconfig system interfaceedit "port2"set mode staticset ip 11.0.0.1 255.255.255.0set allowaccess ping https sshnextendconfig firewall policyedit 1set name “PC1-to-PC2”set srcintf "port1"set dstintf "port2"set srcaddr "all"set dstaddr "all"set action acceptset schedule "always"set service "ALL"set nat enablenextedit 2set name “PC2-to-PC1”set srcintf "port2"set dstintf "port1"set srcaddr "all"set dstaddr "all"set action acceptset schedule "always"set service "ALL"set nat enablenextendPCs ip: 10.0.0.2/24, 11.0.0.2/24 and the gateway the fortigate.PCs firewall are disable.The PCs can ping the fortigate but cant ping each other.What i am doing wrong?

Hi, I' m researching the best Fortigate option for me. I would like to confirm how noisy the 100D is? Unfortunately noise is absent from the product matrix/tech specs. I' m getting fibre very soon, I' ll get 1Gb burst rate and expect average bandwidth to be around 250-400Mb/s. My options are either a 60D which is cheaper and fan-less but only 200 Mbps IPS or a 100D. But as the box will be in my living room, noise is a critical factor. How realistic the advertised IPS rates are in real-life? (Protection will be client only + SIP). Thanks, Stephane

ansible [core 2.15.13]python version = 3.9.18fortigate running 7.6.2Installed the latest fortios collection in ansible. When ever I run a simple playbook I get the following:[root@fm02-proxy02a ansible]# ansible -i hosts all -m ping[WARNING]: Unhandled error in Python interpreter discovery for host us2fgt1.example.net: unexpected output from Python interpreter discovery[WARNING]: Platform unknown on host us2fgt1.example.net is using the discovered Python interpreter at /usr/bin/python, but future installation of anotherPython interpreter could change the meaning of that path. See https://docs.ansible.com/ansible-core/2.15/reference_appendices/interpreter_discovery.html formore information.us2fgt1.exmaple.net | FAILED! => {"ansible_facts": {"discovered_interpreter_python": "/usr/bin/python"},"changed": false,"module_stderr": "","module_stdout": "us2fgt1 # Unknown action 0\n\nus2fgt1 # ","msg": "MODULE FAILURE\nSee stdout/stderr for the exact error","rc": 0} I am trying to u

I am unable to access Fortinet free training anymore.Did something change?

Hello all,Is the FortiGate next-generation firewall still Fortinet's flagship product???

Dear All, I have following connection: CIsco Switch - SFP-10G-SR - om3 MMF cable 3 meter - FN-TRAN-SFP+SR - FortiGate 100F, X2 port. Previewsly I used SFP-10G-SR on both devices, link was worked, bot after installing FN-TRAN-SFP+SR link goes down.I have more then one FN-TRAN-SFP+SR, but same result for all modules.Does anyone knows why these SFP-s do not wan to takl with each other?  Thanks in advance.   

This affects various versions from 5.0.7 through 5.2.1 (at least).Our Fortigate VPN server is current 5.0.9. Frequently, the first (at least) to establish a VPN connects hangs when connecting.   If you then disconnect, most often the second an subsequent attempts succeed.     Our user community's patience in dealing with this inconvenience is fading.   Here is quote from one user..  " I’ve had this recurring issue with the FCL VPN, despite all the configuration changes over time, where I cannot connect on the first try. I can immediately connect on the second try. I have tried a variety of scenarios (rebooting, not-rebooting, trying different networks, disabling IPV6 etc, disabling security services like EMET) and none of these things have any effect on the result." We have deployed several different VPN profiles - some used mode config and other use DHCP over ipsec.   The problem seems worse with the DHCP profiles, but does occur with the o

Hi All, I am trying to create a pcap file to send to an application vendor support team. I need the capture to be one host to either of two hosts. From the CLI this command captures the required traffic :diagnose sniffer packet any 'host SOURCE_IP and ( DEST_IP_1 or DEST_IP_2)' However I can't see how to export the output as pcap so must used the GUI.Creating a capture using advanced filtering does not allow me to save this filter with the error "Failed to save packet capture. Error: The string contains XSS vulnerability characters."  It seems the issue is the (). So how does one do a packet capture on a fortigate with an OR and save it to PCAP  ? Dominic

Hello, I am playing with fortigate trial versions (7.2.11 and 7.6.2) and I was testing local user authentication with captive portal.  I have configured the ip address of the interface as captive portal location. It works for HTTP traffic but for HTTPS traffic the browsers generate "ERR_SSL_VERSION_OR_CIPHER_MISMATCH".  Maybe this something that does not work the trial versions do not support  2 GB RAM FortiGate models no longer support FortiOS proxy-related features | FortiGate / FortiOS 7.6.2 | Fortinet Document Library but it is not clearly stated.     

Hi ZTNA adminsCan a subnet be used as ZTNA destination? E.g.: "10.1.1.0/24:443".Actually EMS and FortiGate accept it as configuration without error, and we can see it propagated on the client as a ZTNA destination, however when I try access a host (e.g.: 10.1.1.20:443) from the client it seems not working.So am I missing something or is it just not supported?

Hello, We would like to allow only certain domains in the static URL filter.Is the following the correct way to write it if the domain is an exact match and subdomains are not allowed? exampleI want to allow only 【example.com】,If I do not want to allow the subdomain 【aaa.example.com】when I select Regular Expression, →　example \. com Normally, when you select a simple URL filter, writing 【example.com】 is recognized to include subdomains.The following web site was used as a reference. https://community.fortinet.com/t5/FortiGate/Technical-Tip-URL-Filter-expressions-for-the-FortiGate/ta-p/192746 FortiGate 

Recently my computer is unable to use the IPsec VPN connection in the FortiClient VPN free version. We have multiple users that can use this exact connection. My login also works on other devices. When I fill in my username and password and click "Connect" I get an notification from FortiClient saying "FortiClient timed out when connecting to ourvppnname". A couple of seconds later a message pops up "IPsec connection disconnected". The SSL connection works fine. Any advice will be appreciated!

Hello, in fortigate 7.6.3 (latest), can you choose an SD-WAN interface (or multiple interfaces) listening interface in a IPSEC tunnel ? I can't yet upgrade mine. Thank you here is where : as

Hi, FortiFamilyIs it possible to send syslogs from Fortigate HA Passive equipment?

Hello!I wanted to ask if anyone has experience with the different FortiClient Technologies and if they are certified to work with any Linux System (Ubuntu, Debian, etc.) esp Fedora 42, is it compatible? Sources would be appreciated, i can't really find anything on this specific topic!Thank you very much in advance!

Hi, would be glad if someone can help: Info: Forticlient 7.4.3 deployed from EMS with autoconnect EMS-Telemetry with specified Passphrase Situation:Users sometimes connect with multiple different devices over time (which is ok). I need to free up licenses after let's say 3 days of no connection so these doesnt eat up all free licenses.I told EMS-Server to deregister this clients, which works but when you do it it will also disconnect the EMS Telemetry. Problem:When the user wants to reconnect with one of the deregistered devices at a later time he must first click on Connnect with EMS" in the "zero Trust Settings" of the Forticlient.The Client is not asking for the Telemetrie Key to reconnect, which is fine, so why does it disconnect at all???That doesnt make sense in my opinion and leads to this unneccessary extra step. Anybody knows which setting I'm missing or how to free up the licenses without loosing EMS-Telemetry Connection?Best regards,Daniel 

I have the Fortigate-81E-POE. I am trying to upgrade from 7.4.2F to 7.4.4F I have to follow the update path from 7.4.2F to 7.4.3F first but it wont let me upgrade. When attempting to upgrade to 7.4.3F, the following error message is displayed:This is a FortiOS v7.4.3-build2573 firmware image that cannot be installed because the device's FortiGuard license for firmware upgrades expired on 2017/07/07.Any suggestions thanks!

I have Network Performance Monitoring server to monitor internet connection whether is up or not.I have 2 different internet connection so NPM will ping to 8.8.8.8 for make sure reachability internet 1 and ping to 8.8.4.4 for internet2.Currently i use sdwan policy to steer the traffic where i make 2 rule for NPM.Rule1 :Src : NPMDest : 8.8.8.8Member : internet1Rule2 :Src : NPMDest : 8.8.4.4Member : internet2But in the end i have default sdwan policy to steer the traffic distribute to internet1 and internet2 with latency criteria.My issue is when internet1 or internet2 down the NPM never send alert since the traffic can be flow using active internet by default sdwan policy.Anyone know how we can make rule for NPM to always use internet1 for 8.8.8.8 and internet2 for  8.8.4.4 and not going to use default sdwan policy? 

Hi Guys, I'm very frsutrated about the shift to IPSEC. IPSEC over TCP isn't really ready in 7.4, LDAP auth only works wit eat-ttls what means a bad config in FortiClient etc.And now I'm standing in front of my next problem. I have 3 Entra tenants all 3 should use SAML for IPSEC. In SSLVPN I would configure Realms, but what is the the way with IPSEC? In my understanding I only can configure 1 SAML Port on my WAN interface but for 3 tenants I have to use 3 different SAML ports for 3 Applications. Any ideas or am I wrong? By the way, how do you deploy ikev2 with LDAP in FortiClient?

Using version 7.6.3 on the Fortigate (also tested this on v7.4.7) and a Fortigate-120G. Has anyone tried using the automation tab to create a stitch that when triggered will send a notification to a webhook? And that webhook being a power automate "When a teams webhook request is received"? I have this setup for when a user logs in, and I see the stitch being triggered, but power automate never receives the webhook request. I tested with Postman to make sure that the power automate link was good, and it was because it posted a message in a channel when I sent a test. I also used a website called webhook.site to see what exact information was being sent and the stitch was able to send the webhook request to this site and I was able to see what information was being sent. But again when I send it to power automate, it never even receives the request.

Hello, I would like to know the specifications of Fortigate, when is a reverse lookup done when a name resolution query is made to a particular domain? example:■forward lookupFQDN : aaa.comIP : 54.11.11.11 ■reverse lookupFQDN : bbb.comIP : 54.11.11.11 Is there a possibility that different name resolution will be performed even if the IP address is the same?Also, if there is a way to check reverse lookups with a command, please let me know

I have a FortiGate 70f firewall with two ISP connections configured on WAN1 and WAN2. I have configured static routes for both the WAN interface, also created firewall policies for both the interface. But when my WAN1 is goes down, the failover to WAN2 is not working, I have to disable the down WAN interface static route then it divert traffic to WAN2. I don't have anything running on this firewall as this is new device and want to test it first and then put it on production environment. Here the my setup is little different, I kept normal unmanaged 8 port switch between ISP and Firewall, means ISP first comes in my 8port switch then from switch to Firewall. If I connect ISP directly back to the firewall it works perfectly, it only give me an issue when I have 8port switch between ISP and Firewall. I need expert advice on this issue. Thanks in advance.

Running Fortigate 7.6.2.  I would like to set up Shadow DNS server to improve ZTNA proxy queries for a *.example.net proxy.  All possible matches for *.example.net can be looked up via our AD DNS servers inside our network.  So my question is should I put the DNS service on the WAN interface or should it be on the LAN interface? The ZTNA users are on the WAN side.  The AD DNS servers are on the LAN side.