Support Forum

Hi,I am trying to block specific applications example TeamViewer . I don't want anyone to access our network from outside or even using TeamViewer inside the network.Also the are lots of other users who have admin access to their computers , so I cannot prevent them from downloading anything but i want to be able to prevent them from executing the install file example WireShark.I have tried reading on the forum but the documents does not match exactly what i want.The firmware version for my FortiGate 100F is v6.4.9 build1966(GA) ThanksTazio 

Hi Fortinet Community, We're facing an issue where traffic shaping on our FortiGate device doesn't seem to be working as expected. Despite setting up the necessary configurations, no traffic appears to be shaped — the system always shows current-bandwidth=0(kbps) when monitoring shaping statistics. What We’ve Verified So Far:1. Class IDs are configured correctly.2. Traffic Shaping Profile is set up and active.3. Relevant Traffic Shaping Policy is in place.4. Interface outbound bandwidth is configured.5. Traffic Shaping Profile is applied to the correct interface.6. Ran "diagnose netlink interface list" command No matter what we try, shaping stats show zero usage:  Any help or insights would be greatly appreciated.Thanks in advance!

hello, i am facing an issue with some of the hosts installed persistent agent, these hosts are not communicating with fortinac server. i have checked everything and also disabled the antivirus running the hosts and uninstalled and installed the persistent agent and nothing is working. Any ideas will be helpful.  

Hello, I need some help with this issue. I have a user who is working remotely and connecting to the Forticlient VPN software. She is able to log in just fine however she cannot access our server drives or our exchange server. However, when I log in at my location I am able to access the drives just fine. Could anyone help me pinpoint the issue. I'm not an expert in this area by any means but I am the only one available to help. Thank you.

Hello. We are currently using FortiSwitches with FortiLink.In version 7.2.x, I understand that changing the FortiSwitch name does not affect active sessions. Recently, we upgraded all our devices (gate, switch, AP) to 7.4.x.We have about 20 switches in use.However, when we change a switch name from the gate, it appears that some other switches temporarily disconnect and reconnect. It also seems that active sessions are interrupted.Based on my research, it seems that when a managed switch is renamed, it is deauthorized and then rejoined, which causes all sessions to be dropped. As the switch reconnects, STP path recalculation occurs, so session drops or other switches disconnecting may be observed. Is this understanding correct?I referred to the following URI for this information:community.fortinet.com/t5/FortiGate/Technical-Tip-Unable-to-change-managed-FortiSwitch-name-after/ta-p/280009docs.fortinet.com/document/fortiswitch/7.4.0/fortilink-guide/59264/defining-names-for-managed-switche

Hello, Our FortiAnalyzer has been running continuously for about 180 days, however: - Analytics log is only 1 day,- Archive log is kept for only 11 days. - Disk occupancy is 85% (445 GB total available).  Our expectation was that these times would be much longer. No manual changes were made to the log retention settings.I rebuilt FortiAnalyzer but then the day counts were updated as shown in the image below.  Best Regards, İsmail Ürek FortiAnalyzer 

Tunnel flapping, or frequent disconnects and reconnects, between a FortiGate 7.2.9 (HUB) and 7.4.7 (Spoke) device in an ADVPN setup.Following this are observed.In IPsec VPN logs DPD failure errors is showingIPSec tunnel disconnect and reconnect frequently.BGP neighbor renegotiation.observed packet loss 16 % frequently, unable to figure it out reason of packet loss in the tunnels not on public interfaces.

Dear Team,I’m using an HA setup with FortiGate 121G devices. After a sudden power outage, I received a notification stating "File System Check Recommended" (please see the attached screenshot).Although the firewall has restarted and is functioning normally , all policies, routing rules, and services are working as expected and the message still persists.Additionally, the HA status page is not loading correctly (screenshot also attached). Any suggestions on how to resolve this?

So to give you guys some context, I have 13 sites globally with 26 total firewalls (All FG200E) that we are going to be looking at upgrading at the end of the year. With Fortinet pushing for either IPSec or ZTNA we have decided to move forward with implementing ZTNA. We already have an EMS server in place, so it just makes the most sense for us. Especially considering we use Microsoft SAML for authentication. We are currently running 7.0.17 on all the FortiGate's, 7.0.12 on the EMS server, and FortiManager is running on 7.4.6I am just looking to hear on your experiences with the latest mature versions of 7.2 or 7.4 and what you guys would recommend for us? We have not moved on from 7.0 because of how stable everything is right now and the last thing I want is to introduce any kind of bugs and have to deal with that. Anyone else here running ZTNA with SAML SSO?

I've received IP address information from my new ISP, and it looks like I may need an additional router. They provided two public IP ranges: one labeled as the WAN, which is a /30 subnet, and another labeled as LAN, which is a /29 subnet.From what I understand, the /29 subnet contains my usable public IP addresses, and I need to route traffic from this range through the WAN (/30) subnet.Is it possible to configure this setup using a FortiGate firewall, while still using it as a traditional firewall—publishing services from an internal or DMZ network through the /29 public IPs? What would be the best way to approach this configuration?

HKJC is very common gambling website in Hong Kong.I would like to use fortigate gambling web filter but i want to exclude HKJC website.What can be done about it?Thanks

Not that I'm pushing 7.6 in to production anywhere, but with SSL-VPN being totally retired, there's one show-stopper with IPsec that I'm wondering if anybody has found a solution for.At least with non-EMS managed FortiClients (95% of my install base) on an IPsec VPN setup you can't push a DNS suffix to a client like you can on SSL-VPN. DNS lookups work fine as long as you use a FQDN - but - you can't use just the hostname to connect to things. Has anybody found a solution for this or heard rumors of it being addressed at some point?

Is it possible to configure a time-based administrator user access in FortiGate?For example: an administrative user must be able to login the firewall device from 9 am to 11 am. Beyond 11 am, the login access should be disabled 

Hi, Since last day afternoon, it' s so strange that some staff cannot access to the https website like the e-banking, webmail via https...etc. This case is happened since last afternoon, the one would keep failed to access to the same https website if he found it' s failed since last afternoon, but some other https websites are working properly~ Even the same https website he can' t be accessed to, other staff may able to access.... so it' s not talking about the issues of the https website... I have no idea now... even both of the DNS server and FG are rebooted, the result is the same~ Anyone could help and give some direction? Thanks!!

Hello community, I am new to FortiSIEM, I want to build a rule to detect new devices in my network, I had the idea to create like a list containing MAC addresses and a rule to check each time if a mac is in that list if not it will trigger an incident and add the mac address to the list (if you are familiar with qradar it is like a reference set), the problem is I don't know if that is applicable also in FortiSIEM or there is another approach to solve the problem??? any idea is appreciated, thank you in advance.

I am looking how other organizations might be using the full featured Forticlient beyond the VPN.How are you using the different features in the client and how and what are you logging from the client?

During a migration from FortiClient EMS 7.4.9 (windows) to FortiCLient EMS 7.4.3 (Linux) the migration.exe program signaled a failed migration, with the last lines log the log stating: 2025-04-11 13:27:38,091 Exception type : Traceback (most recent call last):File "main.py", line 66, in mainFile "lib\ems_client_lib.py", line 101, in copy_cert_filesFile "lib\ems_client_lib.py", line 62, in copy_filesFile "lib\helper\scphelper.py", line 50, in copyFile "lib\helper\scphelper.py", line 33, in ExecCmdException: ExecCmd: echo 'xxxx-omitted-xxx' | sudo -S chown -R forticlientems.forticlientems "/opt/forticlientems/data/certs", Error: [sudo] password for test: chown: warning: '.' should be ':': ‘forticlientems.forticlientems’2025-04-11 13:27:38,094 [chan 1] EOF sent (1)2025-04-11 13:27:38,095 EOF in transport thread2025-04-11 13:27:38,097 EOF in transport thread2025-04-11 13:27:38,097 EOF in transport thread2025-04-11 13:27:38,098 EOF in transport thread It appears that the executabl

HI All,I'm running into an interesting issue. We have a script in FortiManager that sets the source-ip of connections to their various services, Netflow, FSSO, LDAP, etc. However, after updating our firewalls to 7.2.11, I'm finding that the following no longer works: config system netflow     set source-ip $(lan1_ip)end Neither does config system netflow     config collectors            edit 1                 set source-ip $(lan1_ip)            end     end Did this command change between 7.2.10 and 7.2.11 and isn't documented, or did I miss it somewhere? I've opened a ticket with TAC, but figured I'd ask here as well to see if there's a faster response.

We have two WAN links from two different ISPs coming into our active/passive HA pair of FortiGate 300Es running v7.4.7 build2731 (Mature). Currently there is no aggregation or load balancing in place. They are just two separate circuits, and one isn't really being utilized much day to day. In an effort to improve that, I am working toward implementing SD-WAN on the FortiGates. To minimize downtime, I am setting up new links for the SD-WAN zone on unused ports. We only have one port available from the ISP router at present, so have to run through a layer 2 switch in order to provide service to both FortiGates. The plan is to replace the single switch with a stacked pair to eliminate that switch as a single point of failure. While waiting for the stacked switches to be available, I've set things up as shown in the attached diagram so I can continue getting things prepared. However, the 802.3ad agg link I created on the FortiGate doesn't seem to be working as it isn't

Hello. On a Fortigate, is there a (CLI) command to change printout output from 'more' to 'standard' without a configuration change? Perhaps lurking as an option in some diagnose command? R's, Fern

Hi. I want to check if I allow all PING type in FortiGate interface administrative access but deny ICMP Timestamp in firewall policy, will ICMP Timestamp traffic still be allow?

Hi, I'm trying to connect a Fortigate 60F internal port to a Cisco N2K FEX switch as a management interface so I can manage it remotely through our lab setup. The problem I'm having is once connected the switch is putting the port into an 'bpdu-guard-err-disabled' state. I just wanted to confirm that an out of the box Fortigate 60F firewall in NAT mode wouldn't be sending spanning tree BPDU's out of the internal interface? What I need is for this 'internal' port to behave like a regular access port.

Dear Team,I have a question regarding the use of the Per-IP Shaper feature in traffic shaping on the FortiGate firewall.I configured a traffic shaper with a total shared bandwidth of 20 Mbps (Reverse enabled) for 10 users.Additionally, I applied a Per-IP shaper limit of 4 Mbps.My inquiry is:Does this configuration mean that all 10 users combined can consume up to 40 Mbps (i.e., 4 Mbps per user), or will the total bandwidth still be limited to 20 Mbps regardless of the Per-IP shaper setting?Looking forward to your clarification.

We've been running FortiNAC for 2 years now and are starting to deploy Intune joined workstations. I followed the 9.4.6 Intune integration guide and it's successfully polling Intune and bringing in devices. The issue we are now seeing is,  we're a global company sharing a single MS tenant and NAC is pulling in thousands of devices from other countries.  Since this is an API call, it sounds like we cannot do the filtering to our devices only via Entra, so we need FortiNAC to filter the devices on an extension attribute or a tag. While ChatGPT seems to think FortiNAC can filter the devices, it failed to spit out how, and I cannot see any filtering options in the connector setup. Does anyone know if it's possible to setup a polling filter to narrow the list of devices it will ingest from an external MDM? On another note, the FortiNAC 9.4.6 Intune integration guide, steps 9 and 10, tell you to setup a permission under Windows Azure Active Directory, which was deprecated

How can I set up an SSL VPN connection on an FGT60F v7.6.2.F? Unfortunately, I can't find this option in this FortiOS version.