Support Forum

Hello, For FortiSwitch managed by FortiGate (FortiLink) and 802.1x (wired connection-Fortiswitch):- Which parameter configures the radius authentication timeout? In case of high latency, how long does it take for an authentication to fail with a timeout?- Which parameter configures the number of authentication attempts before the radius timeout? Thanks,

Switching fromcase1tocase2and then back tocase1results in an issue where obtaining an IP address fails, and even manually configuring the IP address does not allow normal network access. Changing the MAC address can immediately resolve the issue, or waiting approximately 5 minutes or restarting the Fortigate can also resolve it. This issue does not occur when bypassing the Fortigate.Below is my Debug Flow result:Packet Trace #8902025/3/18 20:25vd-root:0 received a packet(proto=17, 0.0.0.0:68->255.255.255.255:67) tun_id=0.0.0.0 from internal4. Packet Trace #8902025/3/18 20:25allocate a new session-0042a27f     Packet Trace #8902025/3/18 20:25in-[internal4], out-[]     Packet Trace #8902025/3/18 20:25len=0     Packet Trace #8902025/3/18 20:25result: skb_flags-06000000, vid-0, ret-no-match, act-accept, flag-00000000 Packet Trace #8902025/3/18 20:25in-[internal4], out-[internal3], skb_flags-06000000, vi

Hello. I am a network engineer working in an on-premises environment. There are intermittent slow internet issues, but it is not due to CPU or memory overload on the switch devices. When I monitored the situation using the diagnose switch physical-ports datarate command, I noticed a sudden increase in usage on both the TX and RX sides. What could be causing this issue? Also, are there other ways to check this in FortiGate or via CLI?

Hi, I am after some guidance on anyone who has setup a DMZ Server to utilise Google re-CAPTCHA.   The DMZ area is restricted for outbound Internet access and any server that requires a service is locked down to only what it needs. What is the best action to allow a DMZ server to Google re-CAPTCHA on a Fortigate 600F Firewall? Info.  Google apparently uses https://www.google.com/recaptcha/api/siteverify   &  https://www.google.com/recaptcha/api.js DNS to resolve to google.com The odd guide recommends allowing access to the following subnets but this equates to around 212,992 IP Addresses.The reCAPTCHA servers can be located on any IP address owned by Google. While we can not provide official support for IP Address-based ACLs, Google's public IP space can be found by issuing the following command from a Linux/Unix box:dig -t TXT _netblocks.google.comThe result right now is:ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.

Hi, I have a simple setup right now, with a Fortigate 600E on Floor 2, and a Cisco SG350 10G besides this, and I also have another Cisco SG350 10G on Floor 1. Each floor also have a storage server.Workstations from Floor 1 and Floor 2 are connected to the respective floor Cisco swich, and the Fortigate has X1 interface for internet in, and x2 interface to connect to the Floor 2 switch. The Fortigate is the router and dhcp server. But now the bosses want Floor 1 and Floor 2 to be completely separate, and only share the x1 internet connection (which should be also be filtered to only allow certain internet destinations) but worksations from Floor 1 cannot "see" workstations from Floor 2, and viceversa. Can you guide me how to setup something like that, preferably from the GUI of the Fortigate 600E ?I assume I will setup different VLAN's on each switch, with Trunk configured to communicate between them, but then what should I setup on the Fortigate ? Thank you 

Hi,I seem to remember that I ones saw a DSL tranceiver for fortinet. when you have a DSL and not like a 60E-DSL but you use an EDGE-switch to split the connection to 2 firewall. But I can't seem to find the DSL tranceiver anywhere. Anybody knows some documentation about it?

I have FortiAP FP431G running v7.4-build0591, which is managed by a FortiGate 1101E running v7.0.13 build0566 and I am unable to get the 6 GHz network working. The security mode for the SSID is set to WPA3 SAE. When the platform mode is set to Dual 5G the SSID broadcasts, I get connectivity via Dual 5GHz and 2.4 GHz. However, when I set to Single 5G the 6GHz radio does not broadcast nor the 2.4GHz or 5GHz. Any advice on how to get this configured properly?

How to enable MFA for Fortigate Admin Users?

Hello everyoneexample i have three spoke under same advpn, but i wanna isolate spoke A from other spoke B & C, can i do that ?

Good day, This is URGENT.I am seeing “No license” for features Virus Outbreak & Antispam. These features were always in the green during my 2024 subscription and even after renewal license in January 2025. Last time I checked, even last week, these 2 features were in the green/licensed. I Logged on this morning and now realizing this. What is the cause for this change? Contact Fortinet support or something i can do from cli etc.? This is very strange. HELP!  

We have a scenario where an MSSP is facing a critical storage issue and needs an immediate resolution. They have a two-node replica setup and are considering deleting one worker from a shard to restore system functionality.The plan is to remove one worker, migrate the remaining worker to new storage, and then recreate the deleted worker.Would this approach be feasible? Could deleting a worker impact data integrity or overall system functionality? Any guidance on best practices for handling this scenario would be greatly appreciated.Version: 7.1

How to set an expiration date or period for an SSL VPN account? Device is currently running v7.4.6 build2726 (Mature)

Hi Guys, We have two sites connected together but we want to have two guest portals so that we can get a user from each site to approve the requests. Currently it is setup as one guest portal. Any guides or help to achieve this? We are on FortiNAC 7.6.2.0715 (GA) Thanks John

Hi!After on boarding many FortiGates into FortiManager (7.2.8) and using FortiManager's "Find duplicate objects" we see a very large number of duplicate Address objects in the GUI.However, there's no option to produce a report, or even download these out of the GUI. How to do this?Thanks! 

Hi all, in a hand full of sites we have got problems with our dyndns connected ipsec sites.These tunnels have to be manually reseted from time to time. Within the logs I can see the tunnel is getting down and our HQ Fortigate tries to connect to the old public IP address.Also shown in the log, the new public IP is trying to initiate a connection to the HQ FG. Seams like the FG is not updating its dns entry for this site.  After disable/enable the tunnel the site is up immediately.  Anyone got an idea on this? Can´t be the solution to restart a tunnel from time to time. RegardsMarc

When using Teams and sharing my screens all kinds of updates try to occur. ( high bandwidtrh the VPN just drops ) it seems to always want to check for updates. and then with in minutes I'm disconnected, the vpn drops and destroys my ability to use the network at all. I am forced to reboot. Why we use this I do not know. Here is a small sample of the debug level logging. 3/12/2025 11:13:52 AM debug update get_soft_invent(), soft_invent item: 0 1^Microsoft Windows 11 Enterprise Edition#x64#en-US^Microsoft Windows Desktop Runtime - 6.0.36 (x64)#48.144.23186#Microsoft Corporation3/12/2025 11:13:52 AM debug update get_soft_invent(), soft_invent item: 0 1^Microsoft Windows 11 Enterprise Edition#x64#en-US^Microsoft Windows Desktop Runtime - 6.0.36 (x64)#6.0.36.34217#Microsoft Corporation3/12/2025 11:13:52 AM debug update get_soft_invent(), soft_invent item: 0 1^Microsoft Windows 11 Enterprise Edition#x64#en-US^Nmap 7.95#7.95#Nmap Project3/12/2025 11:13:52 AM debug update get_soft_in

Recently upgraded my firewall fleet (about 15 60f's, 2 100f's)We're experiencing a crash of some sort every 2-4 days.Of course a ticket has been opened and they're working it, albeit very very slowly. Pretty disappointed in their lack of urgency and overall continued lack of code quality.The crash debug logs from the console session has:NP6XLITE: __np6xlite_tunmgr_write:61 timeoutNot sure if anyone has seen this or knows anything about this issue ---- we're experiencing a high impact when this crash occurs, of course.

When is EOL and EOSL on Fortigate 1000D device?

Hello, I’m experiencing an issue with FortiNAC-OS 7.2.8.I’ve created a device profiling rule with the following settings:Registration: AutomaticType: WindowsRole: NAC-DefaultRegister as: Device in Host ViewAdd to group: XXXAccess Availability: AlwaysMethods:DHCP Fingerprinting with different custom attributes:Message Type: AnyHost Name: ICT-*Message Type: AnyHost Name: DSKT* However, Windows devices are detected but not properly profiled and registered. For testing purposes, I tried both creating a single custom attribute with Host Name: "ICT-*, DSKT*" and creating multiple rules with a single hostname per rule, but neither approach worked. I have another rule for IP Phones, which is working without any problems. What am I doing wrong? Any suggestions?

I had SAML to Microsoft Entra ID working fine for a little bit here, but then FortiClient started showing "Credential or SSLVPN configuration is wrong. (-7200)" on every connection attempt. SAML works just fine when connecting to the same system over WebVPN, so this does not appear to be an issue with the SAML config. Any suggestions for getting FortiClient to work again?

I have to configure HA in FortiNAC-F ver7.6.2 .I'm sure I do all of steps in documentation but when I reboot there is no HA in the GUI interface can some one help please.https://docs.fortinet.com/document/fortinac-f/7.6.0/high-availability-fortinac-os/760103/step-2-configure 

How i can Connect Two Site through vpn in different countries and one country block ipsec VPN if i am  usingsite a and site b two public ipor site a public  and site b dynamic

Firmwarev7.6.2 build3462 (Feature)ModeNAT I have a FG with the Evaluation License running in a Proxmox VM. There are three interfaces configured: Port3 is the LAN and works fine, Port2 is set to WAN and is connected to Starlink and works fine. Port3 is set to WAN and is connected to Spectrum and no matter what I try, it will not get an IP via DHCP. I can move the modem cable to any other device I have in the building: A tp-link WIFI router, an MSI laptop, a Dell laptop, and they all connect and get an IP without issue. I've tried swapping proxmox interface and VLANs with Starlink, swapping cables with Starlink on the FortiSwitch, I've tried swapping physical ports with Starlink on the FortiSwitch, I've tried swapping the interface with Starlink in the FG, and just now I brought a whole new modem to the game. Nothing has changed. Starlink always comes up and Spectrum fails to connect DHCP. Oh, and I've tried both circuits in and out of SDWAN.Below is the interface...it is

Hi team i have fortianalyzer and i want to alerts of critical severity on mail but i am unable to do the setting in event handler list what is setting we need to do? or other solution is there

 Hello,I have an IPSec VPN site-to-client configured on my FortiGate, and I would like users to use the public IP of my WAN configured on the interface.I’ve already created a policy from the VPN interface to the WAN with NAT, setting up an IP pool, as my WAN has a /32 subnet.However, I haven’t been successful with the configuration. Has anyone done this setup and can offer assistance?I’m using FortiOS v7.4.7 on a FortiGate 90G.Thank you!#fortigate