Support Forum

For all the issues we hear, I figured I would post a good story.Pair of 200E gates in HA. Was running 6.4.15, upgraded to 7.4.6.Upgraded per the upgrade path, however the Gate had a small difference in the path than the support site had. So I used the site path, and downloaded the updates and did not use the auto update in the GUI.Each step went well, with a few mins for HA to sync. Verified each step with each Gate for a double check and all was well. Up on 7.4.6, 5 Fortiswitch on a mix of 7.x firmware and all reporting as expected.No major hangups, gave HA time to sync between jumps and all devices were happy. (forced ha sync start on 2 jumps)Just wanted to toss out a happy story for the sub. Not that I have had bad upgrades, but wanted to highlight a good story of a multi line FW upgrade.

How we can deal with asymmetric routing in ADVPN if we have 2 connection from spoke to hub?We often facing issue where spoke can't talk to the hub if traffic in and traffic out using different interface.

When an Android phone uses FortiClient to connect to a VPN, the connection is successfully established but then automatically disconnects after 2 ~ 3 seconds.Do you know a solution, or is there anyone experiencing similar symptoms? forticlient version : 7.2.1.0118 android phone : one ui 5.1 / andriod 13one ui 6.0 / android 14 fortigate debug[13525:root:76f5]allocSSLConn:264 sconn 0x7f30c0541400 (0:root)[13525:root:76f5]SSL state:before/accept initialization (106.x.x.x)[13525:root:76f5]SSL state:SSLv3 read client hello A (106.x.x.x)[13525:root:76f5]SSL state:SSLv3 write server hello A (106.x.x.x)[13525:root:76f5]SSL state:SSLv3 write certificate A (106.x.x.x)[13525:root:76f5]SSL state:SSLv3 write key exchange A (106.x.x.x)[13525:root:76f5]SSL state:SSLv3 write server done A (106.x.x.x)[13525:root:76f5]SSL state:SSLv3 flush data (106.x.x.x)[13525:root:76f5]SSL state:SSLv3 read client certificate A (106.x.x.x)[13525:root:76f5]SSL state:SSLv3 read client key exchange A:syste

Hi everyone,I’m currently looking for the recommended versions of FortiADC and FortiWeb for use in a production environment.Has anyone here had experience with the latest versions of these products and can recommend which ones are stable and secure right now? Are there any specific builds or patches I should be aware of?Looking forward to your responses and advice!Thanks in advance!

I have a Fortigate that has two vdoms (root vdom and OOB vdom). The OOB vdom is connected to the Forti-switch and the Forti-switch is being managed by the OOB vdom Fortigate. The Forti-switch has 3 Vlans and all the ports on the Forti-switch have been used. How can I configure a physical port of the Fortigate so that I can access the three Vlans on the Forti-switch Please help with configuration. 

Afternoon, I'm trying to customize the custom message for web filter blocks in FortiClient EMS.  At this point, just getting started, I have a couple of questions. First, is it possible to customize the background color to something other than white?Second, when I load a custom logo, it seems that no matter how large I make it it's still tiny.  Is there anything I can do about that? Thanks, -Mark

Hello, we have a issue with our FG-VM02V. At the beginning the vm had a evaluation license. A few weeks later we registered a normal license in the asset management portal of the vm. There the status seems to be fine, but the vm itself didnt updated the license status and the vm turned into grace period which will end soon. Later we registered a forticare support contract to the vm and the license status for the support was updated without any problem, but the normal license status of the vm didnt changed. We have already tried to download the license file (.lic) from the asset management portal and upload it to the vm. This was not possible due to a error that a manual upload is not possible. Also we run the cli-command "exec update-now" alone and together with debug commands. We need help to fix this issue.

Hi everyone,I’m encountering a 504 Gateway Timeout error when trying to access a FortiGate firewall through FortiPAM. The error states:Remote server did not respond to the proxy. I’m using the proxy feature in FortiPAM, which listens on port 8080.The FortiGate Web GUI is configured to run on a custom port, and I’ve specified that port in the URL while accessing it through FortiPAM.Has anyone experienced a similar issue or have any suggestions on how to troubleshoot this?Any help would be appreciated!Thanks!

Hi all,I would like to ban some IPs when an DoS attack ocurrs. I'm trying to do that using stitch, and "anomaly logs" trigger action. The problem is that I cannot stablish a count number or filter whith "anomaly logs". I don't want to ban an IP when is detected for first time by my DoS policy. I would like to ban it when it is detected, for example, 10 times during an attack.  That is the problem: I can't use event filter or count for anomaly trigger. If I try to create a custom trigger, I cannot find the log ID 0720018432 or similar, to can customize it. Could you help me to create an automation trigger to detect malicious IP during an DoS attack? I need an IP to appear several times and I don't know how to set this counter, so as not to ban it the first time (it could be from someone who doesn't belong to the attack).1-->An IP appears X times in a short time several times with "anomaly event".2-->Foritigate ban IP (quarantine). Is it possible? Than

Hi, I have HQ with 2 WAN Int, one is a public IP, and 4 branches as Spokes with no public IP. I have built SD-WAN in my HQ to do Load sharing. Now I want to let the spokes connect with the HQ to reach some services. 1- is the right VPN dial-up hub and spoke?2- should I build a VPN from SD-WAN wizard, or no need I can build it as normal from a VPN IPsec tunnel?3- If I want spokes to communicate with each other, what should I do extra? is it only add routing and security policy? or do I have to change the VPN type?

Can I just flip the switch on IPSec XAUTH² to 'inherit from policy' and use the same rules as SSL-VPN, where you have to specify a Source and User/Group? Last time I tried this, the FortiGate acted as a MITM for IPSec users and redirected HTTPS³ to its own IP, causing a certificate error. I had to roll back without investigating further. FortiGate 200F 7.2.11² XAUTH is set to a group containing a remote group which is a radius of our 2FA token.³Split Tunnel, so not all HTTPS requests, only the ones where a FW rule was hit.    

Hi Team,  There are certain users facing random wireless connection on the FortiAPs. For an example two users facing the same problem and they are connected to the same AP. Do you know what is causing this problem?  Here is the following error message:  Action: client-disconnected-by-wtpReason: "Disassociated due to an excessive number of frames requiring acknowledgment, which are not acknowledged because of AP transmissions and/or poor channel conditions." Model: FAP-231FSoftware: 7.2.4-build0395

Hi,   I am trying to setup Survivability branch with no luck:I have Main FortiVoice 5000F, and FortiVoice LSG unit with different models in branches, among them I have FVE500F, both have version  v7.0.5(GA), build232, 2024.09.19.All My FortiFone 380B are registered to FortiVoice 5000F.I following up the tasks listed in below link in order, to make the survivable branch works with no luck:https://docs.fortinet.com/document/fortivoice-enterprise/7.0.5/fortivoice-local-survivable-gateway-deployment-guide/119483/deployment as below:1.Change the deployment mode from PBX to survivability branch on the FortiVoice LSG unit2. Add or import branch extensions to the primary FortiVoice phone system at the main office.3. Add a survivability branch to the FortiVoice phone system at the main office, with Management mode Partially Managed.4. Apply the branch configuration from the main office FortiVoice phone system to the FortiVoice LSG unit at t

Setup a Fortigate 60E with the SSL-VPN and it works fine for most users but one user is having a permission denied (-455) error which I cannot work out what is wrong. The password is correct, 2FA code on Forticlient has been setup correctly (twice now to confirm).   It was working yesterday fine but the user tested today and it has this issue. I tried logging in with a different user on that device and it works so its user related but cannot work out what it is.   The logs show little info other than SSL VPN exit error so looking for opinions?

Hi Fortinet Team,  We are trying to bring up Dial-up vpn tunnel between FortiSASE POPs and Fortigate SPA Hub.  Fortigate SPA Hub BGP neighbor range is 172.31.2.0/24. Fortigate SPA Hub loopback ip is 172.31.2.1/32Spoke ip is 172.31.2.2/32But when we assigning BGP Router ID Subnet is 172.31.2.0/24. FortiSASE POPs are getting assigned with 172.31.2.1/32 (Primary POP) and 172.31.2.2/32 (Secondar POP), but those IPs are assigned in our SD-WAN SPA Hub and spoke, due to that BGP is not coming up. We referred this FortiSASE POP to FortiGate SPA Hub BGP co... - Fortinet Community still facing the issue. Expecting clear recommended config and config #Fortisase  Thanks,Ajay M

Hi Guys, Can't connect FGT (ver:6.0.5) to FAZ (ver: 6.2.1 FortiAnalyzer), connectivity test fails; FGT been added to FAZ devices;exec log fortianalyzer test-connectivity Failed to get FAZ's status. SSL error. (-3) Capture shows that FAZ sending RST back to FGT: 66.345323 port10 out 172.16.102.248.13765 -> 172.16.102.247.541: syn 1195392681 66.345952 port10 in 172.16.102.247.541 -> 172.16.102.248.13765: syn 1231566839 ack 1195392682 66.346003 port10 out 172.16.102.248.13765 -> 172.16.102.247.541: ack 1231566840 66.346728 port10 out 172.16.102.248.13765 -> 172.16.102.247.541: psh 1195392682 ack 1231566840 66.346857 port10 in 172.16.102.247.541 -> 172.16.102.248.13765: psh 1231566840 ack 1195392682 66.346885 port10 out 172.16.102.248.13765 -> 172.16.102.247.541: ack 1231567207 66.346990 port10 in 172.16.102.247.541 -> 172.16.102.248.13765: ack 1195392843 66.347044 port10 out 172.16.102.248.13765 -> 172.16.102.247.541: psh 1195392843 ack 12315672

I have two 80F fortigates that i am trying to lab vxlan on for production. One system is on 7.2.4 and the other is on 7.2.2. Following the documentation it says to add the vlan interface and the vxlan interface to the switch for the last step. On the 7.2.2 version it has the vlan system interfaces available to add to the switch. These are identical configs on each side I have them set up as policy based and vlan switch mnode. Not sure if this is a bug, but I am using this guide to set up the vxlan

HelloAfter pentests we have issue about showing SSLVPN webpage. I need use SSLVPN only in tunnel mode (this is not problem), but without showing any page in browser. I looked on cli and gui and can`t still found any solution, how disable web page, but still have actvite tunnel mode.Do you have any idea?Thank you

I have a Fortigate F100 with rules in place for the management address of my company's UPS. One policy allows SMTP traffic from that address to our mil server. The other allows DNS traffic from that address, nothing else. I'd like to log any other traffic from the address in question that doesn't match either of these two rules; what's the simplest way to configure such a policy? Just clone the 'UPS Management Address to DNS' rule, set it to DENY instead of ACCEPT, choose every service other than DNS, and hit the log option?

Hello, My fortigate has 2 IPs: 192.168.1.1/24 and 192.168.2.1/24 Clients are set up in these two different subnets with their corresponding gateway (192.168.1.1 and 192.168.2.1).How can I isolate these 2 subnets to block traffic between them? I know it's not the proper way to isolate subnets but I need it for now. Thank you

Hello,In EMS I configured a FortiClient installer, and generated a link to users can connect and download the forticlient installer.For example:https://link.domain.com:10443/installers/Default/WIN-INSTALL_7.2.8 It works but when users go to this link it presents a warning in the browser because the cert in self-signed(not trusted by browsers).Where is in the EMS that I can change this certificate? I have already a valid cert uploaded to the EMS but I do not know where to apply it for this.. Thank you.Regards

Hello guys, im trying to find a solution in order to block malicious ip automatically via an api solution or something else. Does anyone ever done something like this? What i am thinking is to create an external connection an push an api from there but i am not an expert in terms of api stuff and will take some time to figure out things. If anyone ever done something similar in a more easily way please share your thoughtsAll help appreciated.

Hi, after playing around with ZTNA, some things are not clear to me and maybe, someone has the same struggles and / or "caps" in the head. a) To reach out a certificate based authentication and to remove the VPN gateway, you have to work with full ZTNA servers which than, the Fortigate acts like a proxy for. What I am missing; you can do a kind of load balancing with the real servers behind a HTTPS ZTNA server, but there is no option to do a health check like you could do on a "normal" virtual server. Also, it would be interestesting, if real SSL offloading works and deep inspection is done in a correct manner, so IDP/IDS and all traffic is inspected well and no signifcant security risk will raise here. Same with encrypted traffic, like SSH over a TCP tunnel. b) The most  - maybe stupid - issue I ran with the following issue:- Let´s imagine you have a service like a git repository server on your site, behind a Fortigate. You can protect it using ZTNA, but you also m

Hello,Is posible to intergrate FAC to security Fabric? Is there a link you can point?We have a couple of FGTs ,FAZ and want to add a new FAC to the sec fabric...I did not find this info. thank youregards.

hello all, i have 6 floors in a company , each floor has 2 or 3 edge switches and each office in the floor has a small tp-link switch (5port) that compine the PCs, and this small switch connected to the edge and all floors connected to two core switches working as MCLAG and all the switches are managed by fortigate.i have 3 connection connected direct to the fortigate (ADSL , MPLS , Leased Line).on the fortigate i have configured a vlan for each floor , when i enable these vlans and assign them to each floor i found a big packet loss in the network but when i work with one vlan for all floors all thing work fine with no isuue.can anyone help with this issue?