Support Forum

Hi, This query is related to DHCP. I configured the DHCP lease time to 7 days, and everything is functioning correctly overall. However, a few users encountered an issue where they received an IP from DHCP but were unable to access the internet. Releasing and renewing the IP resolved the problem. Upon investigation, I discovered a known issue (Bug ID: 1069208) in v7.4.7 related to DHCP. Bug ID: 1069208 indicates that if a DHCP offer contains padding while using a DHCP relay, the relay removes the padding before forwarding the packet. Please confirm whether this bug is related to the issue we are facing. #fortigate

Hello, We have been trying to setup a Dial-up IPSec connection for our remote user base (30-40 users) seeing as SSL-VPN is being/has been removed from FortiOS 7.4 and newer (we are currently on 7.2.11).  I can get a single machine to connect and work as intended, but when I connect another user device, it connects but there is no traffic that returns to the user.  It seems like only one connection works, all subsequent are denied. I've "set add-route disabled" from the CLI on the interface, but that didn't help.  So far none of my searches have turned up anything more than that. If it matters, our working SSL-VPN uses SAML and I have a similarly configured SAML for the Dial-Up Ipsec. Sorry in advance, I am very green when it comes to these FGT. Phase1edit "vpn_Dial-Up"set type dynamicset interface "port35"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset ipv4-dns-server1 #.#.#.#set ipv4-dns-server2 #.#.#.#set proposal

I got in touch with non-upgraded Fortigate 100E which got compromised (it had 7.0.8 and WAN HTTPS access enabled :\ ).The attacker logged in with non-existing accounts to jsconsole (probably known CVE with the version mentioned) and also connected to VPN with existing VPN account (is it possible he got plain text password or the password leaked?).I cleaned all the users attacker created, checked the configuration, disabled WAN HTTPS, applied GeoIP for VPN and upgraded to 7.2.11 https://1921681254.mx/ .Despite actions taken the auto-script will create new super admin user every day at 15:30 . There is no auto script listed using [get system auto-script]. Probably something on the OS or bootloader level.I tried to load firmware from USB flash using [execute restore image usb] but the hidden autoscript still creates new user every day.How to fully wipe Fortigate and load new clean system using flash drive or TFTP?

We were running v7.2.10 on multiple hardware platforms without issue. Security came along and told us we had to update software due to a CR so we are now running v.7.2.11.Since the update our Firewalls are now losing OSPF adjacencies to the core switches every couple days or so. The biggest offender only has one instance of OSPF running but some Firewalls have 4-5 instances of OSPF running (multiple VDOMs) and we lose adjacency on all vdoms simultaneously.I don't think it's a resource issue; we have beefy hardware; 4201F, 2601F, 1801F.Anyone else seeing this? Any workarounds?As always, thanks!

Hello , In my lab sd-wan everything is ok all my vpn up I create 4 vpn in a vpn zone i create a policy between my lan and the zone a static route between lan and zone vpn but i cannot ping my remote branch .   

Hi everyone.I would like to display antivirus log in my Fortigate F60 (OS 7.2.11).In the forum I've noticied that I have to set the value "av-virus-log" to enable.In the CLI, I've edited the profile and I've entered the command "set av-virus-log enable".But there is no impact, when I want to show the different value of my profile, the value does'nt exist.Have you an idea ?Thank you in advance  

Dear Fortinet Community,I hope this message finds you well. I am reaching out to inquire about the availability of firmware versions for the FortiGate 200G model. Currently, I see that even newer devices such as the FortiGate 90G are running on firmware versions 7.4, but there are no firmware upgrades beyond 7.2.8 and 7.2.11 available for the 200G model.Given the advancements in newer models, I would like to understand why the 200G model has not yet received the 7.4 upgrade. Additionally, I am eager to know when newer firmware versions will be available for the FortiGate 200G device.Could you please provide any insights on this matter? Specifically, I am interested in knowing whether there are any plans to release firmware versions beyond 7.2.11 for the FortiGate 200G, and if so, what the expected timeline for such releases might be.Thank you for your assistance, and I look forward to your response.

Hello everybody,regarding ZTNA, we found a bug after yesterday Forticlient EMS 7.2.5 upgrade.This is happening only on macOS devices.We have a ZTNA destination profile:On Windows device, rule are correctly retrivied. But, on macOS, I can see no destination (I have all the tags I need):Debbuging this problem, I was looking at the Forticlient ztna.logs, and I found (I removed some rules for simplification): 2024-10-11T16:24:28.238 TZ=+0200 info ztna mergeCfg:{"enabled":1,"rules":[{"name":"EMS","mode":"transparent","enabled":0,"destination":"10.1.0.217:3389","gateway":"ztna.ntditalia.com:13389","encryption":1,"local_port":"7788","type":"private"},{"name":"VMAgostini","mode":"transparent","enabled":0,"destination":"10.1.0.215:3389","gateway":"ztna.ntditalia.com:13389","encryption":1,"local_port":"7788","type":"private"}],"portals":null,"gateways":null,"notify_on_error":1,"portals_enabled":1,"gateways_enabled":1}2024-10-11T16:24:57.148 TZ=+0200 info ztna sync portal select portal err:e

looking to centrally manage and lock down FortiClient configuration settings through FortiClient EMS (Enterprise Management Server)

Hi Team,Is there a way to enable Interface Pair View on a FortiGate 121G without removing the existing policies? From what I’ve found, it seems that enabling this option via CLI may result in the deletion of current policies.I’d appreciate any guidance that would allow this without impacting the existing configuration.

 Some time i got anomaly traffic like below pic.We can see below my NPM server (10.103.248.55) monitor on of my VM on azure (10.201.1.7).All non PING traffic have right path where the traffic routed to Azure Tunnel Interface.But PING traffic routed to the internet so my NPM server detect this VM as down.If we restart the NPM server then the PING traffic routed to the right interface.Anyone ever facing same issue with me?

Hello, I'm new at this so be patient with me. I'm unable to connect to my network remotely via IPsec VPN - I can connect on first PC - however unable to connect via second PC. I checked the client configuration on working PC and matched on PC that isn't connecting. From my forticlient that isn't connecting via IPsec VPNIKE phase1 authentication fail as peer's certificate is not verified 2/2/2023 10:52:16 AM info sslvpn date=2023-12-02 time=10:52:15 logver=1 id=96602 type=securityevent subtype=sslvpn eventtype=status level=info uid=C936E3C1403F4C3B9369EFE22C3B5171 devid=FCT8000484597987 hostname=DCDDCD-VKISEE7Q pcdomain=N/A deviceip=172.16.80.11 devicemac=34-17-eb-c3-e9-f4 site=N/A fctver=7.2.0.0690 fgtserial=FCT8000484597987 emsserial=N/A os="Microsoft Windows 10 Professional Edition, 64-bit (build 19045)" user=jakec msg="SSLVPN service started successfully" vpnstate=12/2/2023 10:52:25 AM info system date=2023-12-02 time=10:52:24 logver=1 id=96823 type=systemevent subtyp

Hi everyone,Because SSL VPN will be removed soon, I started testing IPSec VPN as an alternative on a customer’s FortiGate firewall. I used the VPN wizard to set it up. The users who should connect are part of a remote LDAP group.When I try to connect with FortiClient, it just stays on "Connecting" and nothing happens. If I click "Disconnect", it says "Disconnecting", but also gets stuck.If I connect using SSL VPN, everything works fine, so the problem only happens with IPSec VPN. Tried on FortiOS V 7.2.11 and 7.4.7 and Forticlient is 7.0.9.0493 I have encountered this problem now on several FortiGates with different IPSec setups.In another forum, some users said that installing Microsoft Visual C++ Redistributable fixed it for them. I tried that, but it didn’t help in my case.Has anyone else had this issue and found a solution?Thanks a lot!

Hi Everyone, We have a FortiSwitch 448E connected to a Fortigate 90G via FortiSwitch. Since the operation manual says ACL (Access Control List) can't be accessed when FortiLink is in use, is the only way to access this via the Management port? Any assistance is greatly appreciated. Thank you very much,Sonny

Hello,I have a request regarding license renewal.I’ve received two new Contract Registration Codes for renewing licenses — one for a FortiGate and one for a FortiSwitch device.These devices were already licensed previously, and now I need to renew them.As I understand it, for FortiGate, the process is:System → FortiGuard → Enter Registration CodeIs that correct?As for the FortiSwitch, it is managed through the FortiGate.How should I apply the license in this case?Do I need to register it separately, or is it handled via the FortiGate interface?I would appreciate your guidance on the correct steps.Thank you in advance!

Hi everyone, I have a question regarding how FortiGate handles override of blocked categories in Web Filtering. Let me explain my setup:I have Web Filtering enabled with a custom profile where the "Streaming Media and Download" category is set to block. The goal is to allow certain users to override the block and access specific sites within that category after authentication.To do this, I enabled "Override blocked categories" and assigned the built-in monitor-all profile. Inside this monitor-all profile, I kept "Streaming Media and Download" set to block, but I also configured a URL Filter exception, where I added a wildcard like *youtube.com and set the action to "exempt".The expected behavior is:When a user tries to access YouTube, the override page should appear.The user logs in with credentials.Due to the URL Filter exemption, access to YouTube is allowed.All other sites under the "Streaming Media and Download" category remain blocked.However, this doesn’t seem to work as intended

 hello,i have problem with my vpn ipsec i tried to connect to vpn but i have error during phase 2   and on wireshark i'm stuck at here same on forticlient log,  i have no idea why config :same auth-encryption for vpn settings and client good selectors for phase 2 ( src and dest addresses  ) why quick mode failed ? i can share log from CLI thanks 

I had a user download the "VPN-only" edition of the FortiClient VPN the other day and when they go to use it, it is telling them that they have a license for 30 days and then it expires. They are remote so I can't verify, but they are insisting that they downloaded the "VPN-only" version off the website. I have never seen the VPN-only version mention a license. Is this something new? And once they 30 days pass, they will still be able to use just the VPN right?

Hello, I need help to configure IPsec VPN on my FortiGate. I have created the users and configured the tunnel, but I can't access it via FortiClient. I really need your help.  

Hello, I have 2 FortiGate VMs that I want to configure HA in Active-passive mode. I immediately lost GUI access when I applied the HA configuration to the first VM. The same thing happened to the second FortiGate VM.For context, both VMs are deployed on vSphere and are connected to the same port group.Does anyone know why this happens and how I can resolve this problem?

Hi,We have FortiMail and trying restrict outgoing email to a few addresses only in an external domain, let's say to user1@abc.com and user2@abc.com  and block off everything else to that domain. I have created 2 Recipient Policy with Recipient Pattern, first policy with all the email addresses, and then second policy with wildcard *@abc.com, then enabled Content profile and set max size to 10 and also 102400, Action to Reject.I can see the second policy is able to catch non whitelisted address as expected, but still accept and send those emails and not reject them. Any idea why or better method to implement this?   

Hi all,We want to set up a captive portal for guest users, on our FortiNAC.  We're currenty using a selfsigned certificate, issued by our internal CA.  When we connect to this portal using domain computers, this seems to work fine because the CA is trusted.  But when external consultants want to connect to the portal, they're getting an SSL error in their browser because the certificate isn't trusted.We do have a wildcard certificate for our external (public) hostname, issued by an external CA, but I suppose we can't use this certificate for our portal?Thanks for feedback!

Hello all, I would like to start a VPN connection through the FortiClient from command line interface.It all works fine manually but I cannot get the syntax right, it seems. Please see the attached picture. Using online resources, I think it should be someting along these lines: "C:\Program Files\Fortinet\FortiClient\FortiClient.exe" connect -s "Aexis VPN" -u wgielis:MY_PASSWORD Version: 6.0.0.0067 https://kb.fortinet.com/kb/documentLink.do?externalID=FD41256https://forum.fortinet.com/tm.aspx?m=123014 Thanks a lot for any pointers ! Wim

Hi, Syslog functionality was operating correctly when a single VDOM was in use. However, after enabling multi-VDOM, the syslog configuration now appears exclusively in the Global VDOM mode, making it applicable only to the Global VDOM. In the root VDOM, where all policies, VPN tunnels, and other configurations are present, it is not possible to configure syslog. Attempts to use the "config log syslogd settings" command in the root VDOM were unsuccessful, as the term "syslogd" is not recognized. We are currently running version 7.4.7v. To forward logs, each VDOM needs to have its own separate syslog configuration.

We’re running FortiNAC 7.6.x (NAC-OS) with a trusted 3RD PARTY SSL certificate assigned to our captive portal. BYOD devices are redirected to the registration portal via VLAN isolation and FortiNAC policies.However, we are encountering the following issues:HSTS-enabled HTTPS sites (e.g., chatgpt.com, google.com) throw unskippable certificate errors (ERR_CERT_COMMON_NAME_INVALID) when intercepted before registration.Windows 11 endpoints are not reliably triggering the Captive Network Assistant (CNA). What we’ve confirmed:A valid certificate is in place and bound to the portal (port2).msftconnecttest.com is not in the Allowed Domains list.DNS and HTTP access to FortiNAC from the Registration VLAN are working.What we need:Clear guidance or official best practices to ensure:Windows CNA detection reliably triggers upon network joinHTTPS/HSTS certificate errors are avoided entirelyAny specific FortiNAC settings required to optimize detection behaviorLooking for any insight into possible