Support Forum

Hi there! I have three Fortigates, two physical and one on AWS. Recently (since 05/02/25) I have noticed that Forticloud is not collecting the VPN logs that I usually check daily. The current firmware version on all three devices is 7.4.3. The Forticloud connection is fine on the console. Has anyone experienced this? Thanks for your help.

Hi together, acutally I am dealing on the following issue:We tried to setup a remote IPSec VPN as SSL-VPN wont't be supported in the future.The connection establishes, routes are configured on the client correctly. There are also packets sent from the client to the company network (packet counter is increasing) but no packets are received (packet counter is staying at 0).On the Fortigate (acutally only a 40F for testing) the packets are shown in the capture and (e.g. a ping) also reaching the destination. The destination (e.g. DNS-Server) responds successfully and Fortigate sends the packet back into the tunnel (the packet capture shows this). But the packets are not received by the client.After arount 20 seconds (+/- 5 seconds) the FortiClient ends the connection. But I think it is not really ending it, only killing it, as the connection stays in status "up" on the Forit for a while then. Forti 40F has 7.4.7, Forticlient has Version 7.4.0.1658.Config of Forti:config vpn ipse

I have a Fortigate device with two internet access lines, and one of them is having browsing issues. I've already checked with the provider and the service is working fine. I've run a debug and see this IP-related message. Could someone help me? func=get_new_addr line=1205 msg="find SNAT: IP-204.199.64.3(from IPPOOL), port-51586"

Hi , I'm trying to setup a custom Report to show all users browsing activity in a customers network. so for example user A - consumed maybe 5gb on whatsapp - 2gb office updates etc... just to break down what their doing on the network at a glance.  and filter based on the subnet their in so for guest users see what's going execs etc... based on subnets e.g.: VLAN1 - LAN  (10.214.11.0/24)VLAN2 - CCTV (10.213.11.0/24)VLAN3 - GUEST (10.212.11.0/24)VLAN4 - CORP WIFI (10.211.11.0/24)Essentially i want to be able to just generate a report and specify the subnet when running the report. I have tried doing this with a custom dataset but as soon as i specify the Subnet the report generates blank content. Running - FAZVM64 KVM - v7.4.6 build2588 (Mature)   SELECT user_src, hostname AS website, SUM(minutes) AS total_time_minutes, SUM(bandwidth) AS total_bandwidth FROM ( SELECT count(dtime) AS minutes,

Hello, We have an LDAP connection to our DC setup on our Fortigate 60E (v6.2.2 build1010). We connect to the domain controller over a S2S VPN. Insecure connections on port 389 connect just fine. However, when I attempt to turn on LDAPS, and issue command: diagnose test authserver ldap SDC_LDAP <username> <password> I get authenticate '<username>' against 'SDC_LDAP' failed!I have imported a CA cert into the Fortigate that is in the trusted CA store of the DC (SDC_LDAP) as well. After a bit of troubleshooting, I believe I cannot connect via LDAPS because the Fortigate does not resolve the fqdn of the LDAP server IP, thus causing a cert validation failure. Entering in the fqdn of the DC into the server field does not work because the Fortigate does not resolve the name to an IP address (a DNS resolution failure).  Using the Ldp utility from my desktop I get a similar result, I can connect via LDAPS just fine if and only if I use the DC hostname/f

Hello, we´re experiencing lower download throughput when putting a wireguard vpn server behind a Fortigate 500E cluster: [Wireguard client]-----[Internet/30ms]--------[Wireguard server]-----[FortiGate]------[SMB server] => ~ 42 MB/s[Internet/30ms]--------[Wireguard client]-----[Wireguard server]-----[FortiGate]------[SMB server] => ~ 42 MB/s[Wireguard client]-----[Internet/30ms]-------[Wireguard server]-----[SMB server]----[FortiGate] => ~ 42 MB/s[Internet/30ms]--------[Wireguard client]-----[Wireguard server]-----[SMB server]----[FortiGate] => ~ 42 MB/s[Wireguard client]-----[Internet/30ms]--------[FortiGate]------[Wireguard server]-----[SMB server] => ~ 10 MB/s[Internet/30ms]--------[Wireguard client]-----[FortiGate]-------[Wireguard server]-----[SMB server] => ~ 10 MB/s - Setup:Fortinet 500E cluster (active/passive)FortiOS 7.4.7Wireguard with UDPclient downloads 20GB file from SMB serverall server with public IP, no NAT - policy flow basedconfig

I'd like to export the port configuration of all my FortiSwitches that are managed through FortiLink from a Fortigate. The export should be in table format, similar to what I see in the "FortiSwitch Ports" view in the FG Switch Controller. This is mostly for documentation. Is there an easy way to achieve this? Thanks Dan

Hi all,I'm trying to move away from the SSL VPNs we have and setup IPSec and if i use the basic wizard this all works but it then defaults to IKEV1 so i set it as a custom tunnel and selected IKEV2 but when i then change the "accept types" to Peer ID from Dialup Group and then select the same group we use in the SSL config i then get "invalid length of value" ? There doesn't seem to be much information on this that i can find apart from a few posts saying the group has to be either setup locally or of the type "firewall" which this is ? If i choose IKEV1 and use XAUTH then it accepts the group without any issue.any help would be great.Thanks

I have the FSSO Collector Agent installed on the AD server, using local polling (no DC Agent).The Collector Agent service is running, and user logons are being fetched correctly.However, in FortiGate, the FSSO connectors status shows as "Down", yet some AD groups are still fetched (e.g 1 and 7 groups).Previously, when using local FSSO user group source, FortiGate fetched 65 groups, even while status showed disconnected.Now, using Collector Agent method, only 7 and 1 groups are fetched from two external connectors pointing to the same AD IP and the policies using User group type FSSO did not get affected on changing the FSSO source group from local to Collector agent.I’m confused about:How group fetching is working when the connection shows -Down.Whether it’s mandatory to create FortiGate User Groups and assign AD groups to them for policy use — or can we directly use AD groups in policy source?What causes this group fetching inconsistency and disconnection status, and how can I resolve

I'm new here, so I hope this is the appropriate place for this post. I wanted to share an issue we experienced this week that may help others using FortiGate firewalls.On Wednesday morning, we discovered that our classroom monitoring software—which allows teachers to view student Chromebook screens—had stopped functioning. I reported the issue to the vendor, and after some investigation, we found a pattern: all affected schools were FortiGate users.Upon reviewing our FortiGate security logs, we identified that the vendor's domain had been flagged as a proxy, and FortiGuard was blocking its SSL certificate. Interestingly, we also noticed that several Apple domains were being flagged as proxies as well, which may explain why our Apple devices have been stalling or having trouble connecting to the internet.After we added exceptions for the monitoring software domain in both the Web Filter and DNS Filter, everything began working properly again.While I’m not sure how or why FortiGuard upda

Hi, on a FortiGate VM, when trying to activate a VM permanent trial license with the command "execute vm-license",  I get the following error message: Forticare response error 57Failed to download VM license any suggestion on how to solve this?Thanks

I am having an issue with FortiClient (IPsec). Even if my internet connection drops for just a second, FortiClient disconnects. How can I fix this? I am using the free version of FortiClient, and I would like to know if there is a way to adjust this behavior, either on FortiGate or within the FortiClient settings. Is there a possibility to adjust this setting, for example, by modifying the configuration file after performing a backup?

Hello everyone, how do you handle Windows security center when using FortiClient EPP? Our users got windows notifications on every boot that FortiClient is not up do date (it seems to take quite a few minutes to update signatures) so I decided to disable windows security notifications overall and also hid the security center symbol on the taskbar... Anyone else found another solution for this?

Hi, Someone with experience updating FortiMail devices, If the release notes of a version provide the following Upgrade Path:   Is it feasible to upgrade directly from version 7.2.5 to version 7.4.3, even if the specific step through version 7.2.5 is not mentioned in that Upgrade Path? I believe it is, because version 7.2.5 is higher than the 7.2.2 version specified there. Could you confirm this for me to be 100% sure, please? Thank you very much! Best regards.

I am trying to restrict unauthorized IPsec connection based on Geo Location. I am creating 1 address object with all location excluding the group of which i have created. Kindly help on this i tried in all this 60F,100F,201F firewall models

With the newest version of 7.4 firmware (7.4.7) / Fortigate 60E when adding the "Fortiview sources" widget to the dashboard, you cannot select anymore a graph view (like bubbles or bars).I used this feature in the past to quickly view the bandwidth usage across all devices from the dashboard.

Hi folks, Looking for some advice here. We have an access control system off-site (no Forti equipment) that sits behind what appears to be a "proxy" FQDN. LAN -> WAN -> URL -> Redirected IP/port -> ACS.Every time the URL is accessed, it will redirect to a new IP and port combination - what I imagine is some kind of load-balancing. I can whitelist the redirected IP and the port, but it changes after a day or so. Efforts to glean the IP/port ranges I need to whitelist have been futile. Is there a way to whitelist a FQDN's redirections? I port forwarded a customized port on the ISP router to the private IP of the ACS interface in the past (by being there physically)...but this WAN IP has changed - and I'm looking for a way to allow access remotely. Am I overthinking it? Thanks for your thoughts!

Hello! I have a Windows server, as a Windows RRAS VPN server, connected to the fortigate's "internal" interface. No one on the same network is able to connect the VPN, which is to be expected. Everyone outside the office can connect to the VPN with no problems. The same firewall also has a guest VLAN, which has no access to the internal network, it only has one policy, to connect to the internet, and I'm trying to make the VPN work for computers on that VLAN. The computers are able to connect to the server, windows asks for credentials, and then drops. I've tried policies, Virtual IP's, port forward, but can't get it to work. Any help is much appreciated! Thank you!

Hi!consider: config system link-monitoredit monitor_idsrcintf ifnameserver monitored_server:update-cascade-interface disableupdate-policy-route disableupdate-static-route disableend as I understand, this will cause interface ifname to be marked as failed if monitoring of monitored_server fails. This means all configured dependencies, including all static and dynamic routes, would become unavailable. Please correct me if wrong. I do not understand if the following is necessary and what effect/value it adds to above: config system interfaceedit ifname:fail-detect enablefail-detect-option link-down detectserverend Any one can answer?Thanks!

Hi,  Recently we received multiple logs from a FortiGate appliance that are related to the "diag log test" command like the one below  date=2024-05-10 time=17:33:16 devname="firewall" devid="ID" eventtime= tz="" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" severity="high" srcip=168.10.199.186 srccountry="United States" dstip=224.141.85.77 dstcountry="Reserved" srcintf="internal" srcintfrole="lan" dstintf="dmz" dstintfrole="undefined" sessionid=50000 action="detected" proto=6 service="HTTP" vrf=32 policyid=0 attack="test_attack" srcport=50000 dstport=80 hostname="host2" direction="N/A" attackid=32587 profile="sensor" ref="http://www.fortinet.com/ids/VID32587" user="user5" group="group1" incidentserialno=0 crscore=30 craction=8192 crlevel="high"  We checked the firewall and no admin account was logged in during the period of the events. Please note there are multiple events from Malware, Botenet, Filedownloads etc

Hi all, i have an issue with my office fortigate 1500D which appear on console when power on the appliance and keep rebooting. Here the issues: ------------[ cut here ]------------ kernel BUG at kernel/watchdog.c:232! invalid opcode: 0000 [#1] SMP CPU 11 Modules linked in: Pid: 50, comm: migration/11 Not tainted 3.2.16 #2 RIP: 0010:[<ffffffff8026f63a>]  [<ffffffff8026f63a>] watch_lockup_crash+0x7a/0x80 RSP: 0000:ffff88043fd63e78  EFLAGS: 00010046 RAX: 000000000000000c RBX: ffff88042e211d48 RCX: 00000000000000d5 RDX: 00000000000000c9 RSI: 0000000000000092 RDI: ffffffff807c34d4 RBP: 0000000000000000 R08: 000000000000000b R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88042e211d48 R13: 0000000000000001 R14: ffff88042e73bea8 R15: ffff88043fd6cdd0 FS:  0000000000000000(0000) GS:ffff88043fd60000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000000 CR3: 00000000006e1000 CR4: 00000

Hello All,I am trying to understand how ospf works over ipsec tunnel as OSPF used multicast to discover neighbourship and ipsec does not support OSPF.I understand we can configure non broadcast link and define remote IP under tunnel interface.as our tunnel interface ip is a private ip then how does ipsec takes this private tunnel ip communication to other side of the tunnel. 

I am a little bit lost here so any guidance is greatly appreciated. I am able to add the Fortigate-50G to our Fortimanager 7.6 but since the 50G only comes with version 7.0.17 firmware it gives errors when trying to push configs or policies.   I see the rejected commands in the log, and when I try them on the Fortigate CLI, it is clear they do not exist. I tried this under the default 7.6 ADOM, and also under a freshly created ADOM with the lowest possible value of 7.2.  I cannot create an ADOM with 7.0 so how is this supposed to work? Please advise.  Thanks. 

In EMS can I assign multiple endpoint policies to a single workgroup (i.e. one for remote access and another for web filter, vulnerability scan and system)?  What I've read suggests I should be able to do it, but when I try it out it only applies the policy with the lower priority number.

Hello, I am trying to setup a GRE tunnel with ExtraIP.com. They provide a few documents about different firewalls, but not fortigate. I've setup a tunnel with the following config:config system gre-tunnel edit "ExtraIP" set interface "VLAN100" //VLAN 100 is my WAN connection from my provider set remote-gw (REMOTE GW OF EXTRAIP) set local-gw (MY PUBLIC IP) next endconfig system interface edit "ExtraIP" set type tunnel set interface "ExtraIP" set allowaccess ping set alias "ExtraIP GRE" set ip (SECOND IP OF /29)/32 next end When I check the diag sniffer with this commanddiag sniffer packet wan1 "host (ExtraIP Gateway)" 4 I get only packets comming in, there are no packets going out0.593645 VLAN100 in (ExtraIP GW) -> (My Public IP): gre: length 50 proto-800 1.929499 VLAN100 in (ExtraIP GW) -> (My Public IP): gre: length 70 proto-800 And when I assign port 443 via VIP and firewall policy to a linux server with n