Support Forum

I'm looking for an install path to install forticlient on Linux without gui so that it doesn't require licensing. Installing on Windows or Linux with gui allows you to select the free option checkbox to prevent license requirements. In Windows you can change a registry key but where is that value stored in Linux? How can I get this installed in a similar manner, on a Linux system without gui, so that it doesn't constantly expire and require reinstall?

Hello everybody,I'm working on a Fortigate 70G with a 7.2.11 firmware.I've an IPSec tunnel:  Regarding this tunnel, I have two firewall rules:     The first policy regards the IPSEC_FULL_ACCESS user group and it allows connections to the 10.1.0.0/24 network, including a specific machine, wich address is 10.1.0.207/24. It works fine.The second policy regards the XYZ_VM_IPSEC user group and it allows connections only to the specific 10.1.0.207/24 machine. It's been working for a while. The XYZ_VM_IPSEC users could in fact access only the 10.1.0.207/24 machine.Since two days, this is not possible anymore. The XYZ_VM_IPSEC users can lo longer access that machine. The log settings are set to "all sessions" (not in the screenshot, but the screenshot is not updated) but logs are empty. Fortigate detects nothing.But...and this is what I am not able to comprehend...if I edit that specific firewall policy, shifting the destination address from&nb

I just finished creating a large number of site-to-site IPsec tunnels (approx. 170) using the CLI, but most of them don't seem to be functioning. Only six or eight of them have ever come up and connected.  I can see all of them in the gui, and in a backup of the configuration, so they definitely created.   At first, I thought it was an issue with the way the PSK had imported from my script, so I went through a number of them and re-entered and saved the PSK from the GUI to ensure that it encrypted correctly, but that didn't seem to remedy the issue. If I go into the CLI and run 'diagnose vpn ike gateway' I see entries for the 6 or 8 that work, but not for the rest.  If I run the command for a specific tunnel name, I don't get any information back at all. Something I have noticed in the IPsec dashboard that may or may not be significant, the remote gateway IP addresses are not updating.  All of these tunnels use dynamic DNS hostnames for their rem

 Fortigate Version 7.2.10 We have several internet facing devices that use virtual IPs and a phone system that uses SIP which has a one-to-one IP assigned to it. We have two ISPs with link-monitor setup.  To match our new locations, we are attempting to migrate to SD-WAN. We made the necessary changes to add the WAN ports to SD-WAN (removing existing polices on the interfaces and readding them).  Upon completion the internet was tested and worked - failover to second WAN worked. Our internet facing devices were able to be access via the virtual-IP mappings on their respective public IPs\ports. We are not using SLA targets - strictly a primary\failover scenario. Our SIP device however was unable to register with the trunk provider. The Fortigate shows the IP was assigned and the SD-WAN was using the interface in the specific range. I don't believe the PBX system was able to access the internet with the one-to-one IP assignment.  Restoring the

Not sure if this is because WPA3 SAE's spec is not allowing or making this combination useless/meaningless. But with our 6.4.10 wireless-controller on a FGT, I don't seem to have an option for wpa3-sae+captive-portal in the VAP's security setting, while it's available with wpa2-personal.Can someone explain why it's not there? Thanks, Toshi

Hey all,I recently updated our FortiManager instance to v7.4.5 build5874.After doing so, I was trying to install a device + policy package to a test firewall.For some reason, it is trying to append the following commands whenever I try to install, even though I did not configure these settings:config log tacacs+accounting filterset cli-cmd-audit enableconfig log tacacs+accounting2 filterset cli-cmd-audit enable config log tacacs+accounting3 filterset cli-cmd-audit enableall 3 fail with the same message:CLI audit log needs to be enabled in global setting to enable CLI command audit for TACACS+ accounting!node_check_object fail! for cli-cmd-audit enableI've tried the commandconfig system global set cli-audit-log enable end But the same error persists.Just not sure where these commands are coming from in FortiManager or what I have to do to fix. I appreciate any help!

I have a client that refuses to spend the $20 for a static IP through Comcast and they want me to install a fortigate 60f in their home office. I’ve set the Comcast XB-7T gateway device to bridge mode, but the Fortigate is not pulling an IP address when the Wan interface is set to DHCP. When the gateway device is not in bridge mode, I get a private IP address (10.0.0.x) on the wan port of the fortigate without a problem, but this puts devices behind the firewall in a double nat situation, which is causing massive network slowdowns (800mb drops to 20mb connection). He also wants to be able to use VPN to access his network from outside (planning on using a DDNS for when the IP changes) as needed, so I need to get this working fit them. I am open to suggestions on what I am doing wrong. I never have these problems when the client gets a static IP. Thank you in advance. - Chris

Not able to login  firewall with local username password can anyone please share the solution on this after upgrading  Not getting GUI access of firewall after upgrading to 7.2.8 to 7.4.8

Hi, We have the following setup:SD-WAN with WAN1 (Fibre) and WAN2 (4G)Two IPsec tunnels: To-Hub1 (via WAN1) and To-Hub2 (via WAN2)Both tunnels exchange different BGP routesThere are two issues:Fibre (WAN1) had an outage and traffic failed over to 4G.After Fibre restored, logs showed To-Hub1 reconnecting successfully, but the tunnel remains down in the firewall.How can we set different route preferences between these two BGP tunnels?We want traffic to prefer To-Hub1 and only failover to To-Hub2. TIA :) 

HI, can you guys teach me how to bind public IP with local port in fortigate. we want to setup ubuntu server. please also advice what we should do in ubuntu server.

Hi, next week I have to do a Trade Up with a new FG model. I would like to make sure that I dont get problems with 3 FortiAPs (OK with Firmware). Problem is that all of them are really bad accessible and I dont have the option to reset them. Any suggestions? Thanks for your help!R

Hi!I have setup an Hub and Spoke enviroment via the wizards.The tunnel is up between the Hub and Spoke and I can see the BGP neighbours.The problem is when I try to redistribute static routes from the Hub. They do appear in the routing table on the Spoke but they show as "Recursive" to the local WAN. So the traffic is not routed over the tunnel.I did just add them under the BGP configuration on the Hub and toggled "Redistribute static".What else am I missing? :)

Hi, I'm using Fortigate-30E running FortiOS v6.2.16 build1392 (GA). Not sure when it happened, but I can't create geography address anymore. It worked in the past.As can be seen in the picture, the country/region field is empty with no entries.  Please advise,Thanks, Ofir

Hey guys. I am an FGT90G owner.I have tested firmware 7.0.12, 7.0.13, 7.0.14, 7.0.15.1. On all firmware there is a problem with Traffic Shaping Policies.I have configured a few rules in Traffic Shaping Policies. The network works fine, but after a few hours, all traffic that matches these rules stops working. After that, I disable the rules in Traffic Shaping Policies and my network works again.If I re-enable the rule in Traffic Shaping Policies, the network does not work.In the logs I see errors - Session time out.The problem is solved only after rebooting the FortiGate.But on firmware 7.0.12, if you turn off the rules in Traffic Shaping Policies and turn on the shaper in Firewall Policies, the Network works without problems. (26.07.2024 - The problem returns if I make changes in Trafic Shaper. Solution: Reboot the FortiGate)   2. Second problem.It is only present in versions 7.0.13, 7.0.14, 7.0.15.I have 29 routers of Zyxel usg-20-vpn connected to FGT90G as Dial-Up IpS

I have below ADPVN with BGP Topology.Spoke1 and spoke2 have 3 connection using different provider, two using internet connection and one using dedicated wan.Since we use different wan connection on spoke1 and spoke2 there is no shortcut tunnel across spoke.When both internet on spoke1 is down, i believe the traffic from spoke1 to spoke2 can use wan connection. Am i right?But if i do show bgp routing details to spoke2 on spoke1 i can see valid route only via shortcut tunnel and no route to spoke2 via wan connection. Anyone know why? 

how to enable x-forwodrer in fortigate firewall 

I want to create a dataset on my Fortianalyzer 7.4.6 that shows the following data:1. Username2. Group associated with the user3. User type (Whether local or LDAP)4. User status (Whether the user is enabled or disabled)5. Authentication (If it's by email, bring the email associated with that account, or if it's by Fortitoken, bring the token associated with the account)Last VPN connection I've tried Multiple Script, but it doesn't show any information. Does anyone have a script that can help me generate the requested data? Or how can I get this information from my Fortigate? Sorry for my English.

Hello Fortinet Community,I have a setup with two WAN connections that are part of an SD-WAN virtual interface. On each of these WAN links, I’ve configured a site-to-site IPsec VPN tunnel to a remote location. The phase 1 and phase 2 settings for both tunnels are identical, except for the WAN interface used. My goal is to achieve redundancy between these two IPsec tunnels—so that if the primary tunnel goes down, traffic automatically fails over to the secondary tunnel. Could anyone guide me on how to properly configure this redundancy within the SD-WAN framework? Should I use performance SLAs, specific SD-WAN rules, or routing strategies?  Any detailed guidance or configuration examples would be greatly appreciated.  Thanks in advance!

Hi,I play around with Fortimonitor on the Cloud trial. And to be honest, it seems to have potential.It has  the possibility for a quick and dirty integration. BUT we also found a lot of bugs, but can not report them, because, of missing contract. And no, we do not buy, before the bugs are fixed. However; it seems, nobody really seems to use this kind of monitoring-tool. This is the only explanation why so many bugs seems to be there, or even many things do not work or documentation is outdated. - Mongodb. Seems to work on Replicasets only up to V6, with V7, it does not recognize the replica-status, because of new json output format, also, it still searches for mongo - binary, which is now mongosh ... - Rabbitmq completely fails because of hard python code error Who from Fortinet could debug this with me, that we could solve this issues? I am volent to debug it with you and help. But somebody has to take care on it from your site.BestRonny

I was asking to change some website tags when I saw that in character.ai there was the tag Deny_ALL. This tag doesn't seem to change and I can't find it anywhere in the tags list. Can someone explain to me what this tag is?

FYI, im not a coder of sql expert by any means...here is my ChatGPT generated Fortianalyzer SQL query:-- Main query: Count occurrences of srcip, dstport, and policyid SELECT srcip, dstport, policyid, COUNT(*) AS event_count FROM $log -- Replace with the appropriate log source WHERE srcip IS NOT NULL AND dstport IS NOT NULL AND policyid IS NOT NULL GROUP BY srcip, dstport, policyid ORDER BY policyid, srcip; -- Order by policyid and srcip -- Summary query: Unique dstports per policyid SELECT CONCAT('PolicyID ', CAST(policyid AS STRING), ' unique dstports') AS srcip, STRING_AGG(DISTINCT dstport, ', ') AS unique_dstports, policyid, NULL AS event_count FROM $log WHERE srcip IS NOT NULL AND dstport IS NOT NULL AND policyid IS NOT NULL GROUP BY policyid ORDER BY policyid;Wen i paste this code in the SQL query dataset window, I get this error and don't know how to fix this.Validate ResultERROR: 'group by' or 'order by' clause is expected in hcache.Ultimately

hello guyshelp me how to create SSL VPN for remote access on fortimanger to push on the fortigate

Is there an option to add per device mapping for VLANs in FortiSwitch Manager ? I do not want to add it one by one using GUI.

I have created a rule to detect whenever there is a successful VPN login.  I have the incident title set as:"Successful VPN login from $user at IP $srcIpAddr to $userGrp" However, the "$userGrp" attribute is not displaying as expected.  Instead, it comes through as the "$user" attribute followed by "Grp". Example: I (amacready) logon as part of the "Standard" user groupDesired result: "Successful VPN login from amacready at IP 1.2.3.4 to Standard" Actual result: "Successful VPN login from amacready at IP 1.2.3.4 to amacreadyGrp"  Is anyone able to suggest where I'm going wrong?

Hello, I'm running FortiClient EMS 7.4.3 with a FG-120G on version 7.4.7. I've configured some ZTNA access on the FortiGate, and it works like a charm. Now, I'm trying to push the ZTNA connection through EMS. The great thing is, my ZTNA applications are automatically detected since my FortiGate and EMS are connected via a connector. My problem is: when I try to create an application, I can't see those gateways. And of course, if I try to create a new gateway with the same IP, I can't.  In the ZTNA destination profile, I see both of my auto-detected applications, but they're not being pushed to the EMS client. So, I'm a little lost here — the "Web Proxy Rules" are not being pushed to the client, and I can't create a rule because I can't create an application, since I don't see the gateway. I was able to create an application with a fake gateway, download the XML, modify the gateway, and re-upload it. But I'm pretty sure it shouldn't be that c