Support Forum

Hi,so what is the plan going forward with SSL VPN?There is NO alternative to it for us as we are forced to use Port 443 for incoming connections due to restrictions in hotels. IPSec: **bleep**s its pants when there are multiple connections from the same source ip, specially if there is another connection to a third party gateway involved from the same source.ZTNA: Uses different Ports to 443 so unusable.WebVPN: Heap of Trash and does not work at all with locally installed software that needs to communicate with a server. And due to NIS2 (European IT Security Safety Laws) beeing in place now we basically have a 4 month old, 100k$ doorstop with 4 1/2 years support on it left as the fortigate is not updateable.

Hi,I have a problem with the RESTAPI to create a localuser on my Fortiauthenticator. When i use the expires_at field, i get automatically an error :Cannot add local user "toto" (Response: HTTP 400), Error: b'{"localusers": {"expires_at": ["Invalid time format. Time should be formatted using ISO-8601 (e.g. 2015-02-17T15:42:50.972335-08:00). If timezone is not given, time is assumed to be in UTC."]}}'I'd tried with many format (with and without timezone, miliseconds), i also tried with the example... Nothing at all.

Hi Team,Can anyone let me know how to check that when was taken last backup in Fortinet firewall. thanks 

Hi - has anyone successfully deployed the FortiClient with auto-connect enabled, in a Windows Hello environment? We are having issues with the VPN client not auto-connecting at login, and I believe it could be due to how fast Windows logs in using Windows Hello with a camera and no password. Thanks. 

I bought a used 100F on ebay few months ago. It was running FOS v7.0.10M and yesterday i managed to upgrade to v7.6.3F After upgrade, i performed factory reset, it means all ips/av signature reset to OOB. I then downloaded ips, av signatures along with some others packages (i have another subscription) and all were upgraded. Is this normal, I known that it's not compliant with entitlement but i used for home only and this guy perfect fit to my requirements.Do i have any issues with this?

Is there any way to assign static IPs for several users from SASE 

Hello, We have noticed that the incident timestamps shown under the “Analysis” section in FortiDeceptor are displayed in UTC format. Is it possible to customize or configure this to reflect our local time zone (e.g., GMT+3)? If such a configuration is available through the interface, we would appreciate guidance on how to apply it.We would appreciate your assistance and clarification on this matter. Best Regards,İsmail ÜREK

Hi Team, Wanted to work on protecting the network from DHCP snooping. FortiGate acts as DHCP server. The plan is to block DHCP request from malicious or unauthorized DHCP server. How can this be achieved? Note that I do not have a FortiSwitch in place. Will using a local in policy to block the traffic help? Thank you in advance!

Hi guys, is it possible to enforce registration/isolation vlan  for the devices connected to the hub or unmanaged switch?All devices connected to the managed switches are working fine once i enforce to the isolation vlan and the captive portal is working fine but don't know about the hub. Thanks   

Hi Everyone, I plan to implement Fortisandbox to ensure file uploads by users on the website are safe from potential threats. I would like to ask:1. How is the topology or architecture of this fortisandbox position placed.2. Is there a best practice or similar implementation reference that I can learn from. Thanks in advance for you help!

FortiGate running 7.4.2 This is probably going to sound weird but I setup my first ZTNA ssh proxy and it works.  However, in the firewall policy I have defined a few tags that can use the policy.  The tags are different ActiveDirectory Groups our EMS has picked up. So I have a tag for the Operations group (which I am a member of) and a tag for the QA group which I am not a member of.  Then we have a tag called EXAMPLE which is our entire AD domain.  All users in our domain are a member of this tag. When the firewall policy only has the tags Operations and QA with a match ANY I get a deny for this policy.  If I add the tag EXAMPLE to the policy I can use it. My question is is there a diagnose command I can run to see how the FortiGate is going through the policy and trying to determine if a users tag is a match or not?

Hi guysSpecifically, I would like to confirm whether the FortiWiFi-40F-3G4G supports tracking bandwidth usage per IP address and, upon reaching a defined threshold (e.g., 10 GB), can automatically suspend network access for that IP address or a group of IP addresses that exceed the limit. I would appreciate any guidance you can provide. Regards

Hello,I want to implement a FortiGate 600F HA Active-Active cluster, with the ISP’s equipment in bridge mode, providing a WAN IP via DHCP. Can you tell me if a router is needed between the cluster and the ISP’s equipment?

Hi,If I summarize correctly, we have 2 sites A and B.On site A, we have the fortigate which is a NAT router and the ISP's internet connection is connected to the fortigate.On site A, we have the fortigate which is a NAT router and the ISP's Internet connection is connected to the fortigate's WAN port.On site B, we have a 2nd Fortigate, and have connected port 1 of Fortigate1 to the WAN1 of the second Fortigate.On the Lan of the second Fortigate, we've allocated the CCTV cameras, and we'd like to view them from our site A.Fortigate1 LAN IP address: 172.20.100.1/24Fortigate 2 LAN IP address: 192.168.1.1/24Fortigate1 WAN IP address: 10.1.10.1Fortigate2 WAN IP address: 10.1.10.2

Hi all,  I hope you're well.  Hopefully you can help me, I have security-fabric running across multiple FortiGate firewalls and I have noticed that we receive no alerts from triggered automation stitches on our downstream firewalls. At present, I have the set configuration-sync set to local but I have seen documentation mentioning that this must be set to default. config system csfset status enableset uid "ed76b59ad28e4b088e9626a7f32dfc89"set group-name "<name>"set configuration-sync localset fabric-object-unification local My main concern is that I do not want to break anything, I want to keep the set fabric-object-unification local as I do not want to synchronise firewall objects and addresses to downstream devices I would only like the automation stitches to be handled by the root FortiGate and for the triggered automation stitches to alert accordingly.  Can anyone confirm that changing this to 'default' will onl

We have had FortiClient deployed without our business by a 3rd party and is managed via EMS.This is mainly for remote access, which is working fine. Though we have the situation a number of our users have additional user certificates beyond our standard user certificate due to the nature of some of their work, most are issued by 3rd parties for dedicated secure applications.So we have the issue of these users attempting to access services away from our estate and failing, as FortiClient defaults to the wrong certificate. Is there a way to set which cert the client should have selected? Rather then having them having to select the correct one?

Hello,I'm experiencing a limitation with my FortiAP 231F. I’m unable to add more than two SSIDs on the same radio (either 2.4 GHz or 5 GHz).Is this a restriction due to the current configuration, licensing, or a hardware limitation of the FortiAP 231F model?What is the maximum number of SSIDs supported per radio on the FortiAP 231F?

Hello Team, i have two FGT-400F.when I configure HA in A-P mode I lose access to mgmt, or rather, I keep losing packets and sometimes I have response but then I lose them again.HA status seems ok from cli but secondary appears out-of-sync HA Health Status: OKModel: FortiGate-400FMode: HA A-PGroup: 0Debug: 0Cluster Uptime: 0 days 0:43:2Cluster state change time: 2025-05-05 15:12:06Primary selected using:<2025/05/05 15:12:06> FG4H0FTXXXXXXX is selected as the primary because it has the largest value of override priority.ses_pickup: enable, ses_pickup_delay=disableoverride: disableConfiguration Status:FG4H0FTXXXXXXX (updated 1 seconds ago): in-syncFG4H0FTYYYYYYY (updated 2 seconds ago): out-of-syncSystem Usage stats:FG4H0FTXXXXXXX (updated 1 seconds ago):sessions=11, average-cpu-user/nice/system/idle=0%/0%/1%/98%, memory=20%FG4H0FTYYYYYYY (updated 2 seconds ago):sessions=0, average-cpu-user/nice/system/idle=0%/0%/0%/99%, memory=19%HBDEV stats:FG4H0FTXXXXXXX (updated 1 seco

Hey all I am looking to disable FIPS mode on a FortiGate 100E, 200E, 500E. Is it as simple as format, load new firmware, restore config? Is there anything in the config that needs to be edited out?    

I want to back up the entire FortiGate device to FTP/TFTP, including all configuration files, hard disk logs, etc. so that I can restore and review the information when needed. Could you please let me know the command for this?

Hi All, I'm having trouble getting new FAP431F AP's online. I suspect a PoE problem but can't find clear information in the documentation to verify. Hoping the community may be able to help clarify PoE requirements.I'm connecting the 431F's to a Cisco 2960 PoE switch (802.3af only). The switch detects the AP, grants 15.4 watts of power, port immediately flaps (up/down) 4 times, then the cycle repeats (logs below).%ILPOWER-7-DETECT: Interface Fa0/20: Power Device detected: IEEE PD%LINK-3-UPDOWN: Interface FastEthernet0/20, changed state to down%ILPOWER-5-POWER_GRANTED: Interface Fa0/20: Power granted%LINK-3-UPDOWN: Interface FastEthernet0/20, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/20, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/20, changed state to down%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/20, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/20, cha

I have a Fortigate 40F. I have been trying for weeks to get DNS Filtering working. The basic setup is simple. When a user goes to a restricted site they do get redirected but the Block Page will not show up as there is a certificate error. (This is understandable since the Fortigate cert does not have the same name as the page the person is trying to go to). For Web Filtering the solution was to download, install and trust the default Fortigate cert. This works for Web Filtering but it does not work for DNS Filtering.I have Googled endlessly with no solution. I have a support case open with Fortinet. So far, they have not been able to provide a solution.If anyone can help with this, it would be much appreciated.

hi Let's say I have an SD-WAN rule based on the MANUAL strategy. This SD-WAN rule has two interfaces (WAN1 and WAN2), with WAN1 being the interface that was added first and therefore becomes the preferred interface for internet communication. If the WAN1 interface loses internet communication, will WAN2 be used? If so, how does Fortigate determine that WAN1 has lost internet communication and should use WAN2? Since with the Manual strategy it is not possible to select a Performance SLA.The final goal is to make all connections to a given destination IP on the Internet always go out through the WAN1 interface unless the WAN1 interface has lost communication with the Internet, in which case WAN2 can be used.

Just an info for you all. Upgrading from 7.2.10 to .11 the GRE tunnel in SDWan dropping connection for whatever reason. Downgrade to previous release solves problem... nothing is being mention in the release log.FGT 400F

Hi every one.We use in my company the ForticlientVPN-only software. We use it to access the VPN of our customer. (link https://links.fortinet.com/forticlient/win/vpnagent)On 2 HP laptops, the installation of these software crashes, avec that sequence :- Installator downloads package -> OK- Installator extracts package -> OK- Then a window opens 0.5 sec and close immediately- Then nothing. The installation of the Forticlient licenced software works fine on theses two laptop. Do you have any clue ? Thank you in advance