Support Forum

Hi,Is there a way to get report through fortianalyzer about rules on the firewall, not the usage of those rules?We have shared firewall for some users, and customers would like to receive reports of rules associated with their networks.It seems I can only get them to the report if there is either all logging enabled on the rules, or MTU filters record the event. I would like to have just rows of the rules, but afaik it isn't possible what I have searched?All loggin is the only way?

Hi,I've already set up my FortiNAC scenario with FortiGate and FortiSwitch in the lab, where it worked. Now I'm doing the same in production, but it doesn't want to work no matter what I troubleshoot.I have access value VLAN 31 for my guest network, where I want all users that have MAB to fall into.I have correctly configured the RADIUS attributes, and the logical networks are mapped to VLAN IDs in FG Virtualized Devices > Model Configuration.   My host in Policy Details matches the MAB policy, and the logs show that it is matched to go under VLAN 31.My FortiSwitch port has Group Membership Role Based Access and Reset Forced Registration. I've also tried adding Forced Registration/Forced Authentication, and it doesn't work. In my RADIUS logs, I don't know if it's bugged, but FortiNAC RADIUS keeps sending VLAN 1 even though it should match VLAN 31. Why is that happening? REST-HTTP-Status-Code = 204, REST-HTTP-Status-Code = 204, REST-HTTP-Status-Code = 200, Tunnel-Type = VLAN, Tunnel-

Hi all... I was using FortiClient VPN on MacOS Sequoia and all was working fine, but after update for MacOS 26 Tahoe, I'm experiencing several issues on applications that not recognizes the VPN. For example, I have a Java development environment configured on my Mac, but after update, when I start a Spring Boot backend application, it does not can reach database on Azure. Same for older Java applications using Wildfly 17. Error massage points to my local IP, not for VPN IP. VPN is connected, routes appears as result for netstat command, but I can't connect do my databases because allways returns erros saying my local IP is not on firewall. Anyone has an idea to solve this? Regards,Bruno

Hello,We are experiencing an issue in our environment with FortiNAC and would like to understand the root cause.EnvironmentFortiNAC Aruba Access Switches 802.1X enabled on switch ports Printers and endpoints authenticated through FortiNAC Wired environmentIssue DescriptionWe have several devices, including network printers and some user laptops, that intermittently lose network access.Symptoms:Device works normally for a period of time. After some time (sometimes a couple of days), the device loses network connectivity. The switch port remains physically up. Reconnecting the cable does not resolve the issue. As soon as we manually perform "Register as Device" (or re-register the host/device) in FortiNAC, connectivity is immediately restored. No switch configuration changes are required for recovery.This behavior affects both:Printers Wired laptopsObservationsDuring troubleshooting, we noticed that some affected hosts show:Last Modified By: Systemshortly before or around the time the de

Hello all. We are rolling out 7.4.2 to our Mac fleet. We are seeking a way to do this via automation to auto-enable the system extensions so that when our JAMF instance touches our devices, it will install automatically. We are seeking to do this via PKG or DMG. Is this possible?

Dear All, Anybody can explain in laymon term what is under lay and over lay in SDWAN concept and how does it work. Why under lay and over lay need.  Thank you in advanced for sharing the knowledge.  

Hi everyone, The UniFi OS GUI currently has limitations regarding routing traffic coming from an inbound VPN tunnel into an outbound VPN tunnel (VPN-to-VPN routing). If you have a Route-Based IPsec (VTI) tunnel and want to route its traffic through an outbound WireGuard client connected to a VPS/VPN provider, the standard Traffic Routes won't catch it.  After some debugging via `iptables` and `tcpdump`, I've managed to build a reliable solution using Linux **Policy-Based Routing (PBR)** and `systemd` persistence that survives UDM Pro reboots and firmware updates. Here is a step-by-step guide on how to achieve this. --- ### Prerequisites Before starting, connect to your UDM Pro via SSH and find your exact interface names:1. **Inbound IPsec VTI Interface:** Run `iptables-save | grep vti` to find it (e.g., `vti64`).2. **Outbound WireGuard Interface:** Run `wg show` to find it (e.g., `wgclt1`).3. **Inbound Subnet:** The network behind your IPsec tunnel that needs internet access through Wi

Hello, I recently updated FortiClient on a laptop to version 7.4.3.1790. Since then, the VPN has been unable to connect, and the Fortinet virtual adapters show as "Unknown Device" in the Windows 11 Device Manager. Every time I reboot the laptop, a FortiClient popup appears and says that FortiClient drivers have been installed that require a restart to finish. Each restart adds two more Unknown Devices in Device Manager.  A reinstall or repair of FortiClient doesn't fix the issue. I've tried reinstalling Visual C++ 2015-2022, but no luck there either. The two virtual adapters are supposed to show as:- Fortinet SSL VPN Virtual Ethernet Adapter- Fortinet Virtual Ethernet Adapter (NDIS 6.30) How can I fix these two virtual adapters? Thanks,Simon

Is there anyway for RSAT tools to work with ZTNA?  Users can get to domain controller via ZTNA but RSAT tools is not working.  

HI all, I’m deploying a couple of 701G fortient onver an inter DCI (one fortinet on each DC) using vxlan (on a nexus 9k) and I found that when HA is enabled the same MAC are generated and for this reason this MAC’s are getting dropped from vxlan table and HA is not forming. If HA is disabled and I leave them as stand alone and put IP’s on the interfaces they can ping each other (the same for mgmt) once HA is enabled and the virtual MAC’s come in the connectivity on HA is not working and both MGMT can’t ping each other anymore and I have a duplicated messaje on my nexus logs. Does anyone know what could be wrong? Working on a 7.4.11 Regards

Hi erveryone,We use the FortiMail only as a filter.The MTA is provided by an external service provider.The FortiMail is therefore between our service provider and our internal mail server.We have deactivated the SPF check in the Antispam and in the Session Profile, because this is not needed in our construct.Nevertheless we get in the log for most mails a SPF Fail/Softfail with the message "that MTA (IP address) is/may not permitted to send email for ....".The mails are processed and sent correctly but this log entry bothers us.We are aware that the external MTA will normally trigger SPF since the mail is not sent from the original mail server to FortiMail.Is it possible to disable the entry, it is not relevant for us or is there another hidden setting somewhere that enables SPF checking?Are any of you aware of a similar problem or could it be something else? Thank you in advance!!

I have a strange case with some fortiAPs right now. 1x FAP 231G and 1x431F both on 7.6.4. I want to set a VLAN ID to have the management tagged but the variable is missing when typing cfg -s. Then i connected to the HTTPS GUI and the field is also missing. I typed in the command cfg -a AP_MGMT_VLAN_ID=200 on the CLI and I got no error. cfg -c for commit to flash. Nothing happened. Reboot and still no change, the AP won't take the VLAN ID. I have 100 more 231G on this site and also 20x431F and they all have the variable and it works fine. How is this possible? Anyone else encountering this problem?

I have a problem with FortiClient VPN 7.0.8.0427 on a few Windows PCs. When trying to connect I get:‘VPN Connection Failure - VPN connection failed. Please check your configuration, network connection and pre-shared key then retry your connection. If the problem persists, contact your network administrator for help.’The VPN does not work with any user account on the affected PC. The same users, the same VPN profile and the same FortiClient version work correctly on other computers. The problem was already present on a fresh Windows installation, so it is not caused by software installed later. Reinstalling FortiClient also did not help.Basic network connectivity looks fine. Internet connection works, the FortiGate is reachable and the client can communicate with the VPN gateway. I tested both Ethernet and Wi-Fi with the same result. Packet capture confirms that UDP/500 traffic reaches the FortiGate and the FortiGate response comes back to the affected PC.I also tested several other lap

Hi all, I have peaks of high CPU usage on the FortiSwitches FS-248E model. Theses FortiSwitch are in modo fortilink.The event is the following:   How can I lower CPU usage? Currently very few customer traffic.Thanks,

I am using FortiGate as aDHCP Server and Windows Serve as DNS (Active Directory). Clients are getting IP addresses correctly, but DNS records are not being created or updated automatically in WINDOWS DNS.So:DHCP works fineBut no A or PTR records are created in DNSIs this expected behavior with FortiGate DHCP, or is there a way to enable dynamic DNS updates?Any help would be appreciated.

I am having 4 VMs 2 each for FortiNAC and FortiAuth, reachability is completed, all kinds of https or http accesses are allowed from CLI, but still unable to access GUI of any machine 

Hello, I would like to know if anyone in the community has any AutoCAD document with drawings of the devices, any of them really, but if I had to ask for just one, it would be the FGR-60F. If anyone has something like that, I would really appreciate it.

Hi,I have a strange case with some fortiAPs right now. 1x FAP 231G and 1x431F both on 7.6.4. I want to set a VLAN ID to have the management tagged but the variable is missing when typing cfg -s. Then i connected to the HTTPS GUI and the field is also missing. I typed in the command cfg -a AP_MGMT_VLAN_ID=200 on the CLI and I got no error. cfg -c for commit to flash. Nothing happened. Reboot and still no change, the AP won't take the VLAN ID. I have 100 more 231G on this site and also 20x431F and they all have the variable and it works fine. How is this possible? Anyone else encountering this problem?

Hey everybody I'm new . currently I'm working as a desktop engineer and I'm planning to start studying. In a fortigate firewall now can anyone tell me where to start this course any free resources youtube channel n all. 

how can implement 

We have 8 sites running fortigate with version 7.4 and 2 sites running fortigates with version 7.6. When creating ADOM, is it better to create 7.4 ADOM or 7.6 ADOM to import configurations from all sites? I assume configuration needs to be re-installed from FortiManager back to the Fortigate devices to validate configuration? 

Hello Fortinet Community,I would like to better understand the behavior of FSSO group membership updates and firewall policy matching.Our environment has an FSSO Collector Agent monitoring two Domain Controllers. FortiGate receives the user logons correctly and applies policies based on AD groups. We also configured Group Lookup every minute, and we can confirm that the updated group membership is correctly reflected in FSSO/FortiGate.However, the change is not immediately reflected in the actual traffic.For example, we have an AD group that allows AnyDesk through a specific firewall policy:When a user is added to the group, the membership is updated correctly, but the traffic policy may take some time to apply. When the user is removed from the group, FSSO shows the updated membership, but AnyDesk may continue working for some time. We completely close and reopen AnyDesk during testing to generate new connections, but the previous policy may still be matched.My questions are:Is this e

Hello,We are planning to upgrade our FortiWeb HA cluster from version 7.0.9 to a newer stable release.However, we noticed that several versions are available (7.2.x, 7.4.x, 7.6.x, 8.0.x), and it is not clear which versions are considered as mature or feature.I tried to check whether Fortinet provides a Recommended Release for FortiWeb, similar to what is available for FortiOS, but I couldn’t find any official guidance.Additionally, the upgrade path does not seem to be available on the Firmware Images console. Could you please advise:Which FortiWeb version is currently recommended for production?The correct upgrade path from 7.0.9?Any known limitations or considerations for HA environments?Anything more that i should take in considerations for the new version ?

I try to install the FortiNAC on Azure for my HA but i try search FortiNAC on the marketplace and i didn’t find fortinac as documented in thisarticle FortiNAC Azure Deployment GuideHere available images from Azure Marketplace. 

I have been experiencing this error message when trying to install the FortiClient VPN, and I keep getting the error message "Unable to access image servers." I have read on some other forums that if I try installing the VPN while connected to a mobile hotspot, I should not get this error message. But the error still persists. Any assistance provided will be accepted.