Support Forum

Hi, Trying to create/work on a physical link and a VLAN under it, but the connection is Down with red arrow down always. Looking at the hardware device nic information, the following is the output:# diag hardware deviceinfo nic port3Admin :upnetdev status :down.....link_status :Down I already checked the cable and LED lights. Anything else which I need to look into? Thank you!

I'm having issues connecting with Forticlient VPN 7.4.3 Running on a macbook pro Sequoia15.4When i click Connect, nothing happens.It says "Connecting" for about 30 seconds, then the button changes to "connect" instead.No windows with logon, no alerts.The channel is a SAML channel which works perfectly on our windows machines.I've removed and reinstalled the VPN client 3 times, and made sure that I didn't miss a "request for access" on the machine.I also tried while the Macbook was still on version 14.x but it gave the same error.Any idea's how to solve this?

I've been attempting get IPv6 prefix delegation for longer than I want to admit. And I'm close, but no cigar.So I request a /56 prefix from ISP.Got: delegated-prefix iaid 1 : 2600:8800:ab81:a100::/56YES, it works. So on the LAN I have SLAAC and DHCP Stateful server running. I have a network IP checker, and it looks like Macs, Android, and others are getting it. For this Mac:fe80::10e9:87a:620c:eeda2600:8800:ab81:a101:edf6:9551:c99f:6228 So it LOOKS like its working, but its not.  So if I look at the IPv6 addresses my Mac has it has several with this prefix, but it also has several others.  See attached below.  But I have no idea where those ab81:4a00 are coming from, but all my computers are using those addresses and they are not externally routable.  So no external web site can see my IPv6 address.  Does anyone know where these other IPv6 addresses are coming from, or maybe more important, how can I get rid of them.  I've come so far, but n

We are deploying Forticlient VPN ver: 7.2.4.0138 to about 400+ Chromebooks and Chromeboxes.We are trying to push out a Managed configuration with the deployment from Google Workspace.The managed configuration requires a JSON file. We can find no reference for field/key names required for this nor what fields/keys absolutely have to be present for it to work. We have experimented with field/key names based on an export of a forticlient vpn from a windows machine with no success. We continue to receive the following error on our chrome devices. "Discarding policy for component app:com.fortinet.forticlient_vpn due to data validation failure: The JSON blob dictionary value doesn't contain the required Value field"  The client deploys without issue, the actual VPN works without issue when manually configured. We are not Fortinet customers, we have a 3rd party vendor who provides the VPN but has refused to help with the JSON configuration. Can anyone provide a reference/doc

Hi, I’m trying to delete multiple users in FortiMail using a script, but the command config user local doesn’t work. What’s the correct command to delete users via a media script? 

I am trying to generate a CSR on the Fortigate and getting the message "etc/cert/local/root_"certname".key: Read-only file system".I have full super-admin permissions on the Fortigate. Has anyone seen this before?

Fortigate + Fortiswitch + Fortiap, wired and wireless NAC work fine on their own. But how to configure nac for bridge ssid configure for a vlan created under Fortilink. Briefly there is Vlan 10 under fortilink. When I apply Fortiswtich port nac mode, wired users are successfully logging in and getting ip. How do I apply this to wireless users. How do I ensure that both wired and wireless users get ip from the same network and are included in the same vlan.

Pid: 02023, application: fnbamd, Firmware: FortiGate-120G v7.4.6,build2726b2726,241210 (GA.M) (Release), Signal 11 received, Backtrace: [0x7fa186367c] [0x00c9b6a4] [0x00c9cfb8] [0x00c8c8f0] [0x00c8cab0] [0x02b2c80c] [0x00caaaa8] [0x0044eaac] [0x004543bc] [0x00454944] [0x004575f8] [0x004580fc] [0x7fa1b12f24] [0x0044a550] [0x0044a550] System event i got but reason and coot casue i am not able to get?

I have tried to setup two FortiAnalyzer 300G in Geo-Redundant HA. Version 7.6.2The devices are on two different locations and have identical hardware and setup.It always failed to sync the initial config.On secondary FAZ I only see this logs:FAZxxxxxxx, dvm, dvmcmd control, Unregistered device xxxx_FG201F add failed, Add device, xxxx_FG201F, Unregistered device xxxx_FG201F add failedFAZxxxxxxx, fazsys, system, Unable to accept logs from Device (FG201Fxxxx 10.xx.xx.x) due to internal error, errcode=-1002.,Receive logs, Fail to receive logs.First time I have solved this problem by exporting the logging device list and import it to secondary before setup of HA. But after Upgrade to 7.6.2 this has not worked anymore.I was just before creating a support ticket, but then I got the idea with certificate.We have an internal PKI and have installed our own certificate for FAZ.SAN is correct, CA and chain Certs are installed. All look good.So I had used the certificate from PKI in the config of H

I have LLDP set up on our VoIP vlan for yealink phones. We are using a FortiGate 100F for our firewall/router. We are trying to expand overhead paging coverage by adding an ALGO 8301 device and 8186 Speakers. For some reason I cannot see the 8186 speakers on our network. They are assigned an IP and I can see them in the DHCP monitor but I can't get into the web interface to configure the speaker. I read that ALGO does not support LLDP. I have tried to manually configure the port to our VoIP vlan but this still does not allow the ALGO web UI.  I discovered accidentally, that if I put a yealink phone on the network, allow it to discover the phone and then remove the phone and return the ALGO speaker to that port that then suddently I can get into the web ui.  The other issue we have is that once I have this system all configured when we dial the ALGO 8301 it randomly drops the yealink phones and only pages the speakers ever few calls. We use GoTo connect for phones. I

I installed Forticlient VPN 7.4.3 without troubles. The connection looks fine and I get access to the intranet of my company when I use the exact IP number, but I cannot use names. I get the error DNS_PROBE_FINISHED_NXDOMAIN.I checked the nslookup resolves the webnames.I checked that quetying resolvectl does not work, but applying the solution posted in https://community.fortinet.com/t5/Support-Forum/Ubuntu-24-04-Forticlient-VPN-installation-w-DNS-resolution-fix/m-p/313257, makes it work.Even though, I still get DNS_PROBE_FINISHED_NXDOMAIN in the navigator. I am absolutely lost right now.Any idea of what may be going on? Thank you!

HelloRecently there was a post from Fortinet PSIRT about the symlink trick:https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activityIs there any chance to get information how to find indicators of compromise (IOC)?I mean I can update to 7.2.11 (I am currently on 7.2.10) but the used CVE's are older and I updated the fortigate before the publication of these CVE's, so there is a small chance to be compromised.I just want to check if the fortigate is compromised, if yes, i will reinstall it. If no, I just update to 7.2.11 and have a happy life :) Any ideas?

We have a pair of FortiGates in an active/passive cluster, and have created a secondary VLAN Interface for VoIP traffic.We have Netgear switches with Auto-VoIP-VLAN enabled.  This works by matching MAC prefixes. It appears that FortiGates do not allow the MAC address of VLAN Interfaces to be modified, so I've manually configured the primary switch to use port-based VLAN to get the FortiGates and Netgear switches working.  This works, but is not the most ideal solution. So, my question is:  Is there a way to change the MAC address of a VLAN Interface?  Or, is there another type of Interface that would do basic LAN stuff, which would allow me to change its MAC address? Thanks!

Hi everyone,I don't manage to display Antivirus or ips log in my fortigate (OS 7.2.11).I've set "antivirus log" and "extended log" to enable.In "IPS signature and filter", packet logging is enable and action is block.When i try a test from the cli with the command 'diagnose log test' , there is no log.What is the problem in my conf.Thank you in advance

 i have a ready and stable sdwan (Hub and Spoke) with two underlay link (internet / MPLS) using  fortimanager overlay template and i want to delete the MPLS link and add internet link  ? what is the procedure  ?is it to re-edit the  overlay template and install the configuration again or what is the  best  method ? FortiManager 

We have some FortiAP's set up with our FortiGate, and a few SSID's assigned around.  The last SSID to be created is for guests. One of the things that I enjoy about Cisco Meraki access points is the ability to require guests to get permission from an employee via email.  After joining the guest SSID, they would be thrown to a captive portal that would require them to enter their name & the email address of an employee.  The email address would be required to match the company's domain(s) (etc *@mycompany.com).  The employee would receive an email with links to approve or deny guest access.  This allowed a measure of security and responsibility, without being a burden on IT to authorize each guest. So... is there anything like this available with FortiAP ?   (We are not looking to collect guest email addresses, or create accounts for guests in our Fortinet environment.) Thanks!

Hi, I am using Multi vdom setup on my Firewall, on the 2nd VDOM I have noticed when I have created the 2nd virtual interface vlan on the new VDOM on the same physical  internal ports as the 1st vdom, I notice the physical ports are greyed out on the 2nd vdom, but green on the 1st vdom. These new virtual interfaces are assigned to the new vdom fine but why are the physical ports greyed out on the 2nd vdom? I manged to establish the BGP neighbors in these new vlan interfaces fine. If I view the Global config on these physical interfaces I see the 1st vdom is configured under the physical interfaces, you cannot assign multi vdoms in the global vdom. 

Hi, I am new in both eve-ng and fortigate. sorry for my naive question. I create my first lab with fortigate firewall using trial license, everything work fine. then in my second fortigate lab, serial of fortigate node change and trial license is invalid and I cannot register it gain using my account.  Is there a way to sustain the fortigate image with its serial number in different eve-ng lab ?  

Hello,We deployed an instance of EMS to a Linux environment and can not access to GUI with the admin username and blank password.Access to EMS is only possible through ESXi environment by using ems username.has anyone encountered this problem? Vasilis

New Fortinet admin here.  I'm looking to configure the built-in DHCP server to push an alternate VLAN & Subnet based on MAC address.  This would be used for VoIP phones. For example, the DHCP server would hand out 10.0.0.2 on VLAN 0 to the first non-VoIP device on the LAN.  But, if the MAC address matches those used by our VoIP handsets, it would hand out 10.0.1.2 on VLAN 100. I'm looking to do this without forcing specific ports on the switches to be dedicated to the phones. Any ideas? Thanks in advance!

We had a case with technical support for an IPSEC VPN issue between two sites. Followed up for 2 days. Didn't fix the problem. Last case closed by engineer. Reopened the case. Mentioned clearly we have more than 100 users effected but still logged the case as P3. Called twice to get the case handled with higher priority but the CS team refused to take it up and also hung up the phone. Very bad response from the technical team. I also shared some details for the case later and still no response. 

I have new FortiGate 71g, but it seems there is no new firmware version available for this. The latest i can find is 7.2.8, does anyone know about this? 

how x forwarder will work for private to private ip could you please suggest on this

Hi, We currently have a HA pair of 201F Fortigates.  Currently they link to a pair of HPE FlexFabric switches using the X1 and X2 interfaces using a aggregate interface.  Under this interface are a bunch of VLAN interfaces for various networks we use.  This interface is called Briggs_INTTrunk and has an IP address assigned directly to it.  This subnet this interface sites on 172.19.0.0/21 also has a bunch of old servers on it which are a hangover from a few years ago, the servers use the firewall IP on this interface as their default gateway.   The FlexFabric switches are going to be replaced with a pair of FS1048E switches configured in a MCLAG and I want to migrate to Fortilink to take advantage of the management aspect this will give us.  We also plan to replace some of the other legacy switches with FortiSwitch in due course. The migration to fortilink seems to involve downloading the existing configuration and re-ording the interfa

Maybe this is an easy one but I haven't figured it out.  I have 4 LANs, one wired and three WiFi, one is a guest, and one is a IoT.  They all need to access the internet, and I have 6 or 7 blocking rules that are repeated for each.  I want to have these policies in one place that all internet access goes through.  I use Central NAT. So, I'm guessing I make a VLAN, and put the rules in there. Then just have each LAN exit to this VLAN, and have the VLAN exit to the WAN port. But in this VLAN, what do I do about IP addresses and what about Central NAT?  So LAN to VLAN to WAN.  Do I just NAT LAN to WAN, like normal, and the VLAN figures it out inside?  Anything I need to look out for?  Thanks.