Support Forum

Hi I have a problem with spanning tree and ports being disabled. I don't know what to do and it is annoying me at times and prevents me from working. Maybe someone has an idea for further debugging. My client (macOS) is directly connected to a FortiSwitch (124E), which in turn is directly connected to my 40F (trunk). There are some VLAN configured. Occasionally, the port (port20) my client is on gets disabled every few seconds and I lose connectivity. FortiOS is on 7.0.8 and FortiSwitch 7.0.5. The network setup is very simple.  +-----------+ +-----------+ +---------+ | +--------------+ | | | WAN +-------+ 40F | TRUNK | 124E +--------------+ MAC | | +--------------+ | | | +-----------+ +-----------+ +---------+  The error messages are as follows: primar

"I don't know how to use it properly when both the web filter and DNS filter have Category-Based Filtering features. If I enable Category-Based Filtering in both the web filter and the DNS filter, will there be any conflict?"

Hello there,I have fortigate 201G and i configured 4 wan links on fortigate.4 wan links are added in virtual wan link and configured the sdwan rule as IP based.Now i have no traffic shaping is enabled in my fortigate but i am facing issue regarding link speed as download speed is to much slow like one Mb and upload is 90 Mb, i have 100 Mb links. Manual static routes are also configured in FortiGate no route is configured with virtual wan link all four default routes are configured with the their respective interface. Kindly help! i have checked everything there is no traffic shaping, no MTU mismatch, every policy is well configured with the outgoing as virtual wan link and incoming as my lan i cant find anything which restrict the traffic for outgoing

hello and sorry for my english, I want in CLI mode delete all addresses objects that begin with particular name : 'Block-IP' I know i can delete objects in config firewall address but how to do mass deletion with begin name ? it is in config firewall address thanks a lot  

Hi everyone,I have a FortiGate 120G with deep inspection profile applied.Since the update to v7.2.10 I have random issues and I think it does belong to quic. This morning several clients called me to tell that www.google.at does not work any more in edge browser:ERR_SSL_PROTOCOL_ERROR First I did try to block quic via application control, that didn't help so I did create a policy blocking udp 443. Didn't help either. So if blocking does not work I tried to allow it - as this telling me blocking is not neccesarry:https://docs.fortinet.com/document/fortigate/7.2.10/administration-guide/984075/blocking-quic-manually But this does not help either. What is really strange: the error messages does not appear to be consistent at all. Websites do work on some clients and on others they do not (using same firewall policy and same inspection profile). The next hour these websites do work on clients that were affected before but then it does not work on other clients.  As a wor

Hi,I have problem accessing some websites, google chrome browser shows this error:err_quic_protocol_errorI see on the logs that traffic is destined to Cloudflare-CDN Protocol 17 Destination Port 443.If I add this UDP 443 port to ipv4 policy responsible for this network traffic, then Chrome still shows this error.The same problem is on Edge browser.Fortigate with Firmware 7.2.9.Could anyone help me with that?

Environment:**********************Virtual vfw (HA)VDOM: policy BasedSoftware: 7.6.0**********************LAN Network: 10.60.250.x/24IPSEC DIALUP: 10.60.198.x/24**********************************From Fortigate CLI I can ping , SSH 10.60.250.x machines, no issuesFrom IPSEC VPN, I can ping fine , but SSH and RDP doesnt work.Fortigate logs shows everything is fine, traffic hitting right policy, packets sent, packets recieved. I am attaching pcaps from client machine running forticlient for rdp and ssh. Note: in this example , I am only talking about traffic from Forticlient, in reality from any source I am not able to ssh or RDP. Everything was working fine, this has happened suddenly last night after 2 AM.       

Hello.I was wondering if any alternatives to FortiAnalyzer that still allow the Security Fabric feature on FortiGate. If there are any, I would like to know the tradeoffs each alternative offers.If you are asking for a context, there isn't any. I am just curious to know what my options are.

Hi there,I am facing some issues with the firewall api after a recent update.The previous developer handling this was using this endpoint in python to check the firewall policy: `curl(GET, {Content-type: application/json, Authorization: api_key},  https://firewall_ip/api/v2/cmdb/firewall/policy/id`).  Can anyone kindly share the endpoint to switch on/off a firewall policy?

Good day! This is my first post on this forum, so excuse me if its too of a simple thing to ask. Up until recently i've been installing Fortitoken Windows on all of my devices, but last week i've noticed that the app on the Windows Store is missing, and I still need the app for the foreseable future. Is there a way to still install this app / get an installer, or has the app been discontinued indefinetely? Thank you very much.

Hi All, After waiting (im)patiently for the ARM64 client to use on Win11 Surface Pro laptops, I'm finding that after a reboot, the 2 virtual adaptors get removed.The outcome of this is that the vpn connection stalls at 98% and, obviously, doesn't connect.If I uninstall Forticlient, reboot, reinstall, then it all works again, until another shutdown-startup/reboot.(Bear in mind, I also have to extract the MSI to be able to install the client. This is after manually installing the VC++ packages too).The adaptors get removed after FortiClient goes through a process of "updating drivers", which it displays on screen, then tells me to reboot.I've also tried backup/exporting the config, editing the .xml to stop the auto update check, restoring the config, but it still happens.The virtual adaptors are not in a disabled state.I've also tried installing them again from the folder "C:\Program Files\Common Files\Fortinet\FortiClient\7.4.3.1790", but they don't appear again. Anyone got an

I have an unusual issue that I have to get resolved.I have a vendor that connects to our Internal IP - call it 10.1.1.1 via policy based vpn tunnel strongswan. That tunnel needs to reach 10.2.2.2 which is on a different VPN tunnel. routes are in place to get that traffic, but the vendor side can't make routes.Incessance, they want to be able to connect to 10.1.1.50 on their end, and have our end pass that traffic being sent to that IP to 10.2.2.50 on our end. The vendors end has no idea 10.2.2.50 exists. all traffic will need to be translated. I am trying to figure out if a NAT will do that, or if there is a different way?It will be internal to basically internal forwarding. Or is this not possible?

 Will there be any impact and future problems if I use a different transceiver?

Hello everybody, I'm working on a Fortigate 70G v7.2.11I defined an interface:   and a policy to allow the traffic:  With this policy, I want to say: wherever I call you, you have to allow the traffic.If I connect to any 70G interface (wifi, wired lan etc.), it works. I can ping 10.0.0.2.There is only one interface for which this policy does not work: It's the admin_tunnel (or the ipsec interface), an ipsec interface. I've already tested this ipsec tunnel for other scopes and it works fine. In fact, I already defined one policy:  The problem is that if I'm connected to this tunnel I can't ping 10.0.0.2 anymore.Why is that? shouldn't the traffic I send out the tunnel just fall under any -> 70Gto60F (port5) the policy?   

Hello,We are using the Forticlient VPN app on our company IPhones. We created an Intune Configuration profile for our users but the SSO button is switched off.How can we switch on the SSO button in this configuration? Our users can't change it by themselves because it is an MDM VPN.

FortiClient 7.4.1 is automatically prompting to connect to the VPN. After installing FortiClient Zero Trust Fabric Agent 7.4.1, I noticed that it frequently prompts to connect to the VPN without any user action. The connection appears to initiate automatically, and the username and password are saved in the Remote Access tab. Has anyone else experienced or is currently experiencing this issue? Thank You  FortiClient 

Hello Fortinet Community , I would like to clarify a scenario regarding the integration between FortiMail and FortiAuthenticator. In our enterprise environment, users are authenticated via FortiAuthenticator, and their email traffic is filtered by FortiMail. Specifically, in cases where certain users receive a high volume of phishing, spam, or other malicious emails, is it possible to automatically quarantine all incoming emails for those users?

Hi everyone, I'm currently trying to set up a new FG-120G, and I'm currently stuck with enabling the proxy mode inspection. I tried following these two instructions for activating proxy mode inspection:- https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-the-visibility-of-Proxy-Mode-in/ta-p/270448 - https://community.fortinet.com/t5/FortiGate/Technical-Tip-Inspection-mode-option-is-not-visible-under-Policy/ta-p/250797  I activated "Policy Advanced Options" under Feature visibility. Then I tried the commands in the CLI, but there is no "gui-proxy-inspection" under "config system settings". Even under "config system global" there is no "proxy-and-explicit-proxy".I also tried restarting the FortiGate after activating the Feature "Policy Advanced Options", but the commands still don't work. (since the command "fnsysctl killall httpsd" did nothing) Are there any requirements or settings that I'm missing to activate proxy mode?View of creating a

HelloWe integrated Huawei AC6508 WLC with FortiNAC, using local RADIUS, but we facing some issue.When we set Default Attribute Group to RFC_VLAN we notice in RADIUS logs that FortiNAC sends the right response to the WLC, however the WLC still asks the user to authenticate, like it the WLC didn't recognize the RADIUS responseWhen we set Default Attribute Group to None we notice that the WLC put the authenticated user in the default service VLAN, so it worksSo I guess the that the predefined RFC_VLAN Attribute Group is not the good one to use with our WLC.In the FortiNAC document "Huawei Controller Wireless Integration" guide they mentioned to leave the value "None" optionally, but in our case we need to include the target VLAN in the RADIUS response. Any idea on what should be the attributes of the right Attribute Group to use?

Currently i have a Fortinet FortiAnalyzer 7.2 Analyst exam that i earned on December 14, 2023. So my concern is can i use it to as elective take Fortinet Certified Professional Network Security? And i just need to sit an exam for core exam FCP - FortiGate Administrator? Please advise. Thank you.

There have been internal discussions about blocking *all AI websites, so I was asked if that could be done on the FortiGate. I don't see a category for this, but I did find a webpage that had something under General Interest - Business | Aritificial Intelligence Technology. However, I don't see that category in our FortiGate, which is running 7.2.5. Does anyone have suggestions for this? Thanks

Hi guys,  I have configured an endpoint compliance scan for windows 10 and windows 11 hosts in FNAC version 7.4.0. all windows 11 pro scan is passed while windows 10 Pro 6.3 22H2 fails.Any idea about the issue? 

I have referred the below article but this showing only active passive I need active active dual hub architecture implementation guide. https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan-sd-branch-architecture-for-mssps/242513/sd-wan-configuration

Hello, I'm using an FGT60F with firmware v7.2.11 build 1740.Our provider only gave us a fixed IP address.Is it possible, for example, to forward the URL test1.domain.com to one server and test2.domain.com to another?Thanks, Rolf

Hi, I would like to know if there is a way to configure an IPSEC site-to-site tunnel using FortiManager without using the IPSEC template ?