Support Forum

I have problem with my tunnel (remote access). I have tunnel IPsec and autentication from Local user by FortiClient. But I want only one user in same time, I have ip adress range X.X.10.15 - X.X.10-25 and I have 10 users. Now, users can autentication by one user name and password. I must create new remote access for new user or group with one IP adress? I found in the Fortinet, SSL VPN have this option limit-use, IPsec also?

Hey Guys I have recently got a Fortigate 60F, and i would like to use my Unifi AP6 Plus to manage wifi and SSID's, but im a little clueless on how to make that work and how to allow the unifi to manage the connection through the fortinet firewallI dont have a spare device to run a controller 24/7 sitting around, but i did read unifi ap's can be managed by an app, i am just not sure what settings to setup on the fortigate. I am not after a complex setup, i just want the AP to bridge with the firewall and then the AP to do the SSID's and wireless work

Is it possible to Buy a license for a used fortigate bought from Ebay? Thanks

Hi colleages,   Is there any way to know if one (or more) of my FortiGate  comes down from FortiGate Cloud ??   Event handler?   I tried with this and doesn't works:     Any idea?? Thanks in advance.  

Hello,I have these 2 doubts: 1- If I want to protect a web server NATed to internet , I can do this only with a normal VIP and SSL inspection , right?I mean I do NOT need to enable Load Balance feature like this example:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-Inbound-SSL-Deep-Inspection/ta-p/191543  2- And if I want to protect for example an email server (encrypted traffic) in the SSL inspection profile ,under "Protocol Port Mapping" I have these 2 choices right:   - select "Inspect all ports" or - on "HTTPS" add the ports that I want (i.e 25,587,465)With any of these 2 I would be protecting my email server from malware and other attacks (with AV/IPS profiles) right? Thank you in advaceRegards    

My fortigate hub have BGP connection to the spoke, the spoke ip is 10.10.112.11 and BGP was established. But why i can't ping to that spoke bgp peer ip? So traffic from the hub can't reach the spoke using this tunnel interfaceIf i ping 10.10.112.1 from spoke to the hub the result is reply.

Hi all, Background: We have been running fortimanager in v7.2.8 while our FGT are running 7.0.17 in which everything has been working like a dream. We have recently upgraded the fortimanager to v7.4.6 as a step before moving the FGT's to v7.4.7. ADOM's on fortimanager are all still 7.0this has knocked out our ability able to push any changes onto any of our FGT's from the fortimanager. each time it fails with a message when drilling down to find it:Copy device global objects"category 0", "", id=0, COMMIT FAIL -   -  (in system template Spoke-System-Template),,(in Template Spoke-System-Template) variable 'site_id' not exist"category 0", "", id=6295, COMMIT FAIL -  (in Template Spoke-System-Template) variable 'site_id' not exist This "site_id" variable is like all our variables and has always been created as a per device variable under policy and objects -> advanced _ metadata variables.when we go to the system template and run a previ

hey guys, im having a little trouble with inbuilt wifi, i got a Fortiwifi 60F, and i want to split the 5Ghz band and 2.4Ghz So i made two SSIDS, and applied them manually to the 2.4 and 5Ghz profiles, but the 5Ghz has no internet.It also seems like nothing happens when i try and connect my TV, the SSID and password are the same before i swapped out my old router with the fortiwifi firewall. But my mobile phones all work on the 2.4Ghz inbuilt profile that came by default, i just changed the SSID and password. My printer also wont connect, all of this worked on the same SSID settings and wifi settings, i made them the same on the fortigate so everything would automatically connect.

Dear Concern,I need to downgrade the firmware of my FortiGate-201F firewall from 'v7.6.2 build3462 (Feature)' to 'v7.4.7 build2731 (Mature)'. How can I do this? Please provide the steps. On the Fortinet Support Portal , there is an option to check the upgrade path, but not for downgrade path. Does this mean that a downgrade path is not required? Can I directly downgrade to the desired firmware, or do I need to follow a specific downgrade path? Please guide me.

Hello expert, I have a hub and Spoke Topology.I configure  spoke (Lethem) to to reach Head Office using a vpn thru the internet.We have a static route on the spoke to allow all clients to access the internet by backhauling the request to the Head Office checkpoint firewall.Because I configured a Wan interface on Lethem to access the internet to create vpn  ipsec tunnel to Head Office, I notice the FortiGate device itself is able to access the internet.How can I stop the Fortigate device from access the internet? Regards 

I need to generate a Web Filter report and also Application Control, I'm going through an audit he wants it on paper

Hi Guys, New to FortiNAC. Looking to do a compliance check using the Persistent Agent to detect if the Windows OS is up to date and if it isn't send a message telling the user to update. The end goal after this would be to keep the computer in the Registration VLAN that would have access to out WSUS server where they could download and update their computer. John 

Hi Team, I am currently facing an issue where I am unable to log in with any account created on FortiWeb. It consistently displays "Incorrect credentials." Since no "prof_admin" account is being accepted, I would like to recover the admin password without using a "prof_admin" account. I have already tried the "maintainer" method, but it was unsuccessful.Could you please assist me with this?  Thank you.

Hi , I have connected to FortiGate Cloud , Show error : fortigate cloud internal error Could you please give me some advice?FG 61E firmware: 6.2.3

I have installed  FMG-VM64-HV  on hyper-vFMG firmware v 7.2.10. I am able to ping and ssh the FMG but not able to https or http on GUI however I have allowed https http ping ssh on the allowaccess interface setting.

Dear Concern, I want to set a limit on a specific SSL-VPN user so that this user can establish multiple connections at the same time. For example, User A should be able to establish SSL-VPN connections from two different laptops at a time using FortiClient. If I configure it via GUI: VPN > SSL-VPN Portals, edit the SSL-VPN Portal, and enable "Limit Users to One SSL-VPN Connection at a Time", this restriction applies to all users, preventing multiple connections for everyone. However, I want to remove this restriction only for a specific user while keeping it enabled for others.How can I achieve this? Please share the configuration steps. Waiting for your valuable response.

Why when I configure the Network of the FGT device in FMG, the configurations are not synchronized to the device even though I have applied and checked that there are diff changes compared to the previous Revision. For example, if I enable the https service of an FGT device using the FMG interface, I cannot access it, but if I access the device and configure it, I can access it normally.

New FortiGate admin here.  We have two internet connections.  I'm looking to shape traffic so specific connections prefer WAN2, while everything else prefers WAN1.  Criteria would need to include connections to outside servers (both ingress and egress) that could be specified by IP or FQDN, as well as by protocol (eg. SIP). And, when either WAN connection drops, the traffic would need to fail over to the available WAN interface. I'm not finding good documentation on accomplishing this.  Any help would be appreciated!

FortiClient version: 7.2.8.0926Linux version: Ubuntu 22.04.5 I have two VPNs defined, 1 added manually and the other added by EMS.The one added manually connected fine before adding EMS. After adding EMS, connecting to either VPN crashes FortiClient right after connecting. I tried to connect through CLI, but I am not sure if this is possible with SAML authorization. I tried to look for something in the logs, and this is what I found right around the crash, in sslvpn.log:20250402 01:33:11.112 TZ=+0200 [sslvpn:DEBG] route:614 Add the route for 91.226.249.10(192.168.0.1)20250402 01:33:11.112 TZ=+0200 [sslvpn:DEBG] route:374 Set up split tunnel routes20250402 01:33:11.112 TZ=+0200 [sslvpn:INFO] nettools:484 Received error: File exists [-17]. Stop reading socket20250402 01:33:11.112 TZ=+0200 [sslvpn:INFO] nettools:375 Failed to receive netlink message20250402 01:33:11.112 TZ=+0200 [sslvpn:EROR] route:417 Failed to add route. Route details: destination 185.166.1

When we use BGP, it's mandatory to set the interface in BGP neighbor and make static route to the BGP neighbor peer ip?

In sdwan enviroment with one hub and multiple spokes, in which side the sdwan sla should be configure? In the hub or in every spoke?

Hello, everyone.We've different sites with Fortigate 100F in HA. The different sites are connected via VPN, so they are visible to each other.We're testing the evaluation version of Fortimanager to evaluate its functionalities.Specifically, we would like to know if it is possible that, with a specific vDOM existing on both remote sites, Fortimanager is capable of replicating any new policy bidirectionally. In this way, the rules of that vDOM would be the same regardless of the site.What we're looking for with this is that in the event of a catastrophe on one of the sites, it is easy to redirect traffic to the other site, with all the rules and policies that were needed on the downed site already existing.We aren't clear if Fortimanager is capable of carrying out this requirement and if not, how could we carry it out? Through API?Thanks in advance for the suggestions. All the best

Hi, Right now using on login for our standalone FortiSwitches and wanted to setup LDAP for authentication. FortiSwitch_148F-FPOE, V7.2.9. Can't see an article on this but saw on that say it is not supported, however, that was 2023.  Thanks 

We are aware of the kernel panic mode issue on 7.2.8 and intentionally avoided it. However, in the past month, we've suddenly been hit with many systems experiencing the "unexpected power off" issue. We use Fortimanager and can confirm no recent changes to anything. We even have half the devices using a separate config where half of the systems use SDWAN and the other half doesn't https://100001.onl/ .Seems to have started in early March.Reaching out to see if others are experiencing anything similar. TAC case opened and under investigation.Thanks.

Hi, is it possible to monitor per ip address created. for example under interface port 1 there are hundred Nat translation. 10.0.0.1 to 10.0.0.100. Can FortiGate tag SNMP to each ip address for network monitoring to create bandwidth graph. Also per vlan?