Support Forum

I am unable to push a certificate to endpoints on EMS. I have uploaded the certificate in EMS, and I can confirm that EMS has picked it up and is reporting the certificate is valid. Under the Systems Settings Profile, I have checked "Install CA Certificate on Client" and checked my certificate. I can confirm that the System Settings Profile is applied to the group my test endpoint is in. I can also confirm the certificate is valid, I was able able to manually install and trust it on my test system.I know this setting works with another certificate, as we are using it to push a different certificate to endpoints. However, this new certificate is not being pushed out. I cannot find anything in the documentation about this -- does anyone know why a certificate would not be sent out to endpoints?

can someone tell me if fortigate 60F has battery in it and also provide material data sheet for Fortigate 60F

Hello,While trying to create a new VDOM, I encountered the following error message. Note that this is the first VDOM I am creating on this FortiGate-VM.Can someone please help?

Hello experts,I have a FortiGate Active-Passive cluster (FG-101F) running version 7.2.10.I configured the mgmt port on the firewall for management purposes. In the HA configuration, I wanted to add the mgmt interface under Management Interface Reservation in order to manage each cluster member separately.However, the mgmt interface does not appear in the list. I also tried to configure it via CLI, but I received an error message indicating that the interface is unavailable.Thank you for your help.

Hello everybody,I'm working on a Fortigate 70G v7.2.11.Long time ago I created an IPSec Tunnel using a wizard tool.On this tunnel, I enabled the split tunneling.I have 2 Windows PCs (PC A - Windows 10 / PC B - Windows 11)On both PCs I have a free FortiClient VPN version (PC A: 7.2 / PC B: 7.2 and then I tried to upgrade to 7.4).What I'm pretty sure of is that each client should receive, connecting with the same settings on the same tunnel, the same configuration.This is the PC B configuration:        This is the IPSec tunnel:  On the working PC A, routes are configured correctly (route print): Network address             Mask          Gateway     Interface  Metrics          0.0.0.0          0.0.0.0    192.168.1.254     192.168.1.66     35         10.0.0.2  255.255.255.255 &n

I have a 60F and a 100F and both of them have stopped generating any kind of system events or logs whatsoever. They have both been working as intended for years up until yesterday when I got on to check some wifi logs and there is just nothing there suddenly. I've tried diagnose log test and still have nothing. Any help would be appreciated. Thanks.

Hi, We are migrating our SSL VPN to IPSec VPN (IKEv2), so moving the users from Ldap (AD) to Radius (NPS). Users can use SSL and IPSec simultaneously, which is great. But we faced an issue with duplicate push notifications when using FortiToken Mobile in conjunction with Radius authentication. If the same user connects to SSL VPN, he/she only gets one push notification, if the user is Local (without Radius or Ldap) he/she also gets only one push notification. So, the issue is only when using Radius authentication. ftm-push debug shows duplicate FTM messages in case of Radius (identical with the same token and reg_id), in other cases there is only one FTM message. What could be the issue and possible solutions? FortiGate-70F, FortiOS v7.2.11. ===user config=== config user local edit "user" set type radius set two-factor fortitoken set fortitoken "FTKMOB***" set email-to "***" set radius-server "dc1-radius-new"

Hi, we have a small office connected with fiber from Vodafone. Their router has 192.168.1.1 and we have a transfer network to our FG WAN 192.168.1.254. With this kind of router we were not able to connect the fiber directly to the FG so we had to configure it like that. Now we have problems for months now. Every other week for 2-3 days the users loose connection to the internet like 4-5 times a day. Later we check and everything seems normal. Vodafone sent like 4-5 times a technician to test and he connects the laptop to the router and also everything is fine, so we are doing nothing to check the situation. Any siggestions we could do or test? Thanks!

I used foritgate 1101E in china  we all used forticlient the chinese network can't access google play store ,but we have mpls vpn line to outside china through SSL-VPN to access google play store .android phone still can't to access google play store after conecting to ssl vpn ForiTac: the traffic of android.clients.google.com is forwarded from the local network when conecting to a tunnel ssl vpn    

Alright, so we just migrated our datacenter firewall from a Cisco ASA to new FortiGate boxes, and inside this DC is our primary/active FortiManager VM. Well with this migration we pre-created the DNAT policy to map a public address to the inside IP of the FortiMAnager VM but intentionally did not create a security policy expecting all the traffic would be blocked and all the external/remote boxes would disconnect. To our surprise, after the migration was completed we logged into FortiManager and found that all the remote firewalls are still connected and fully communicating. After this discovery we quickly logged into the edge firewall and do not see a single trace of that traffic outside of hit counters on the DNAT rules. It's as if this traffic doesn't exist - the only thing demonstrating it exists are all the connected devices. The firewall is running in policy-based mode, and there is currently a 1:1 DNAT rule, but no security policies for the flow. Has anyone experi

Hello everyone!In our environment, we use wsus as PC patch management.We would like to connect it to fortinac so that we can use it in the remediation vlan. Do you have any ideas?

Hello, dears!I hope this message finds you well. On our Fortigate, we have 2 lines, one for backup. The backup cable (LAN) comes from an antena, and we have used an injector to give it power. The port LED turned amber and doesn't blink. This has happened before, and I kept moving to a new port, which have made me use around 3 ports for the same line. This is so annoying to configure new ports for the same purpose. EDIT: The problem is the connection is shown on the SD-WAN Zone, but with very low speeds of bps, making it not usable at all. Now, it has happened again. I don't know ho to solve this. NOTE:- The line works when I connect it to my PC directly.- We have used SD WAN Rules and Firewall Policies to make different SSIDs use the Main line and Backup line. #Fortigate 

Dear community,I'm trying to integrate an F5 WAF with FortiSandbox using ICAP on port 1344. The goal is to have the F5 WAF send PDF files to FortiSandbox for analysis.I have configured both the F5 WAF and FortiSandbox accordingly, but ICAP connectivity is not working. I also attempted to telnet to the FortiSandbox IP (ICAP server) on port 1344, but the connection was refused (even though ping works fine).My questions are:Are there any methods to test ICAP connectivity and troubleshoot the issue to determine whether the problem is on the F5 or FortiSandbox side?Is a FortiSandbox license required for integration with the F5 WAF?Thank you in advance

Hi All, I'm having trouble with SD Wan Rules, I have a scenario that when ISP1 goes down I want it not to failover to ISP2.I already tried to create SD WAN rule, the Interface selection strategy is in MANUAL, and only 1 outgoing interface is selected, but when I simulate ISP1 to go down, it still goes to ISP2. Also have dedicated health check for the said SD WAN rule with Update static route disabled. note: Fortigate 101F v.7.4.7 Any help will be much appreciated. Thanks

Hi I am trying to activate the permanent evaluation license without any luck!Here what i am getting on CLI:FortiFirewall-VM64-KVM # execute vm-license This VM is using the evaluation license. This license does not expire. Limitations of the Evaluation VM license include: 1.Support for low encryption operation only 2.Maximum of 1 CPU and 2GiB of memory 3.Maximum of three interfaces, firewall policies, and routes each 4.No FortiCare Support This operation will reboot the system ! Do you want to continue? (y/n)y Failed to download VM license.execute vm-license-options account-id mymail@mail.comexecute vm-license-options account-password mypasswordThe username and password are 100% correct DNS is working and i can ping forticloud! GUI looks like this:  What do I miss here? 

Hi,  can anybody tell me if FortiOS and other products from Fortinet are affected by the new RegreSSHion Exploit, CVE-2024-6387? Regards, Brisacto

Hello, i have a Fortigate 30E in our enviroment, but i lost the login credentials. now i bought a second one of the Fortigate 30E. so i want to make a firmware update, but it seems to be its impossible to get firware without registrating the device in the portal of Fortinet. First question, if i register the device to get an update, can i unregister it, for selling it after using ist for my work?  so if the firmware was updated, ill want to send it to the location for using it for the guest w-lan connection.  the problem device with the lost login credentials would be send back to me, so i can make to reset the device an make a firmware update too, on it.  if the problem fortigate 30E was reconfigured, ill want to chage it to the first fortigate 30E again, and want to delete the backup fortigate 30E. #second question, how can i make a reset on the problem fortigate 30E how can i do that, is it possible to reset the configured fortigate

Hi all I'm aware of the following resource for finding out what software versions are still supported and when hardware goes end of life:   https://support.fortinet.com/Information/ProductLifeCycle.aspxDo Fortinet provide an API to be able to programmatically access this information?  For example, Cisco provide a number of APIs to query things like recommended software versions, end of life for hardware, etc.: https://developer.cisco.com/site/support-apis/   I'm looking at automation to pull this information into our monitoring and CMDB systems, so ideally want to avoid having to manually review the info on the Product Lifecycle pages on a regular basis. Dave

Hello all,I have site 2 site tunnel between paloalto and fortigate firewall.On paloalto firewall i have enabled tunnel monitoring with fortigate but i can see on paloalto tunnel monitoring shows down.i can see packet send on paloalto keep on increasing but packet received is 0.no issue with monitoring range proxy ID but issue with all other proxy ID in same tunnel.Anyone know how it works and what i may be missing.

Hello , Our client is requesting a firewall cluster consisting of two physical appliances (we don't know whether this is active/active or active/passive).He has requested a requirement : "Threat prevention throughput of the firewall cluster: minimum 18 Gbps." Does this throughput need to be guaranteed for each firewall, given that the traffic will ultimately be handled by a single firewall? Or does this mean that each must ensure a minimum of 9 Gbps? 

Hello,I'm am spanking brand new to the Fortigate world!!!  The only thing that I'm absolutely certain of, that relates to Fortigate, is how to spell it!!! My question is, what Fortiget training should I begin with?  I'm not new to networking, nor am I new to cybersecurity, but I'm a newborn in the world of Fortinet!!!   Many thanks in advance!!!

Hi all,Recently we have implemented Forti equipement in our network.1x FG100f connected to 2 48port FortiSwitches in MCLAG.Since implementation , 3 months ago, everything works fine except one app that works with firebird database.Client desktops and servers are separated with VLANs , on that particular policy non security profile is enabled.Funny thing is that database server is hosting MS SQL and Firebird database engine, and only app using Firebird is causing issue which is that after xy minutes of idle time client app crashes with error:INET/inet_error: read errno = 10054Googleing this error is giving me direction to session timeout, poor network connections etc.In our case there is no poor connection and regarding session timeout no defaults were changed, TTL is 3600s.My question is how can i catch cause?I was trying with debug flow , source ip dest ip and dstport but results i get are informative, just telling me  InterVLAN Policy:edit 6set status enableset name "interV

Hi,I'm currently trying to deploy a FortiAnalyzer VM (qcow2) on Proxmox VE. The image boots up initially, but I get the following error message during startup:Image:FAZ_VM64_KVM-v7.6.3.F-build3492-FORTINET.out.kvm.zip SetupHypervisor: Proxmox VE 7.4-19VM configuration:System disk: faz.qcow2, approx. 4 GB, attached as scsi0Second empty disk: 100 GB, attached as scsi1SCSI controller: virtio-scsi-pciBoot order: scsi0 → no CD → net0Network: virtio, VLAN tag 90, bridge vmbr1RAM/CPU: 4 GB / 2 coresAlready verified:The second disk was present from the very beginning (not added later)It's completely empty and correctly attached as scsi1scsihw is correctly set to virtio-scsi-pcilsblk during boot shows both disks (vda + vdb)The VM has been recreated multiple times, using qm destroy --purge and a fresh importProblem:Despite the second disk being correctly attached, initialization fails. The system can't mount /var, LVM setup fails, and FortiAnalyzer doesn't fully boot.Login is not possible (

I've installed FortiClient VPN only version and gave it full-disk and VPN permissions (to both: FortiClient.app and fctservctl2).But when I try to connect to a VPN, it shows me an error: "To connect to a VPN with FortiClient, open Security & Privacy Settings and allow system software from FortiTray.". I've wanted to try to add FortiTray.app to the whitelist as well, but I cannot do it since it's located inside the FortiClient.app package.How do I fix this?

Hi,I'm encountering an issue when trying to add a FortiGate device to FortiNAC; the process fails with the error mentioned in the subject line. However, I am able to successfully establish an SSH connection from the FortiNAC to the FortiGate via the CLI.I have Created an API admin and genereted the key, where it is used? Could you please assist in troubleshooting this? This article didnt help to solve my issue  Thank you in advance!"