Support Forum

Hello, we are currently running our Fortigates on FortiOS 7.0.13 and want to upgrade them as the version is coming out of support in next few months. we first considered 7.2.10 (7.2.11 now) but Fortinet recently changed their recommanded version to 7.4.7 for our models. Reviewing the release notes, I noticed this known issue :  1069208If the DHCP offer contains padding when DHCP relay is used, the DHCP relay deletes the padding before relaying the packet. From what I understand on various internet sources, removing padding from DHCP packets could be an issue for certain devices that could no more get an IP. I found nothing specific for Fortigate setup however. This is a major issue for us as our main Fortigate is used as a DHCP relay, and it is the only one so we cannot test it before. I was curious if someone encountered DHCP issues on 7.4.7 ?

Hi All, I am facing an issue with my IPsec remote VPN split tunnel configuration on FortiGate. When a user connects using FortiClient-VPNonly addition client software, it works fine. However, when the user connects using the FortiClient-ZTNA edition, the default route (0.0.0.0/0) is added to the host machine, forcing all traffic through the VPN, even though split tunneling is configured.Anyone has any idea? 

Dear team, I recently upgraded my system from windows 10 to windows 11,after that have been trying to run some SQL jobs in SAP HANA studio but the SQL is getting terminated due to VPN connection failure the exception is "Data receive failed [java.io.IOException: The network connection was aborted by the local system.]. " anybody faced such issues in the past, kindly share possible trouble shouting areas to fix it, this is urgent.BR/Veera

Hello, I have question. How can I generate a report to view Bandwidth Per Link Internet?FortiAnalyzer firmware version 6.4.12

Hello Gentlemen, I want to redirect thehttps://exmple.com/entohttps://example.com/en/product-category/audio-visualhow can I do that with fortiWeb using URL writing in simple way? I need the correct steps Thank you 

Hello Everyone,Is there a way to generate a daily report of connected VPN user data from FortiClient EMS that includes the following details:User ID / UsernameProfileRole NameLast LoginEmail IDFailed attempts Currently, the report export option is available only in CSV format, but it does not include the Email ID and Role Name. Also, all reports appear to be merged, making it difficult to isolate specific data.Has anyone configured a custom report in EMS to include these fields? If so, please share the steps or any guidance on how to achieve this.Thank you!

Hallo,i am using FortiEMS with 2 different Client licenses active, one for EPP and one for ZTA.I only have 25 EPP licenses that i want to give to specific clients.Is there a way to specifically use those licenses on those clients or will the EMS randomly assign them to the next best client?

Hello, I have a question. I have an FG 61E with Firmware 6.2.3 and a Bundle License. When I try to apply the license on the Dashboard, it shows that the license has expired. However, in FortiCloud, it shows that the license is activated. I have rebooted the device, but the license is still not activated.

We have security policies in place to block social media applications. However, in the past few days, these applications have been accessible without any restrictions. Upon investigation, we found that traffic over SSL and QUIC is being allowed for these sites. Please assist us in fully blocking access. Model : FortiGate 60FFirmware : v7.2.10 build1706 (Mature) Application Control Policy : Web URL Filter Policy : Log in which we can see that the websites are getting allowed :

Hi, Is it possible on a fortimail (6.4.x) to implement Web Rating override on URLs contained on incoming emails? Issue:A colleague will send an email containing a URL to an internal resource, with an internal only domain name.A response to the mail from the outside will be received by the fortimail which sees the internal domain as "Newly Observed Domain", and quarantined.On a FortiOS based device, we could override this web rating. I don't see this option on the fortimail.As it's an internal domain, it's unlikely to be accepted using https://www.fortiguard.com/webfilterWorkaround:Fortimail's URL exemptions are a stopgap, but prone to failing with port / hostname changes. Not keen on using regex's due to lack of info (Just documented as perl-regex-alike), and possibility of creating a security hole. 

HiHoping somebody can help me as I'm going round in circles. We recently replaced a Cisco Firewall. A support company that looks after one of the servers on subnet 10.70.0.* had a site to site VPN to a management VLAN of 10.7.1.*. From there, they would hit a NAT IP, which would translate to the the server IP in the 10.70.0.* network (both forwards and reverse). The Site to Site VPN to the management VLAN is working fine, but I just cannot get my head around setting up the NAT in the Fortigate. Tried as if it were an external NAT, and that didn't work. Tried adding the server VLAN to the VPN and doing a NAT (even a Zone) and that didn't work. Feel like I'm missing something, but can't find a guide on how to do this. Below is a diagram of what I'm trying to do if it helps? Many thanks in advance. Dan   

I currently have a FortiGate configured for IPSec remote access authenticating via PAP and RADIUS to an NPS server running the MFA Extension - it all works great and I receive the MFA code via SMS but I have a question. I would like to force the usage of either approve/deny or OTP within the Microsoft Authenticator itself, and stop the SMS method. I've read all over the place that if I add the registry key "OVERRIDE_NUMBER_MATCHING_WITH_OTP" to the NPS server registry that it will return back to the approve/deny or OTP Authenticator method but it refuses and continues to deliver the code via SMS - I've tried this registry key with both TRUE and FALSE values. I've tried playing around with authentication protocols on both the FortiGate and NPS side but to no avail nothing appears to work. I am running MFA Extension version 1.2.2893.1 - I've even attempted to try and find a previous version of this extension to see if that fixes my issue. This might also be an issue within

I do ping 10.103.248.44 and the ping is reply, when i do sdwan failover i can see the ping is always timeout.We must change the ping to other host example 10.103.248.45 and the ping is reply.Seem the fortigate icmp session to 10.103.248.44 is cached and will be reply if the cache was refreshed.Anyone know how we can fix this?

Hello, i have 2 different internet connection and want to connect to the Azure VP{N gateway.We set active active mode disabled on azure side, and this mean we only have single BGP peer ip address and single AS Number.How we can make BGP neighbor for 2 line internet but using single peer remote ip?When i try set BGP neighbor for 2nd internet and entry the BGP peer IP i got this error "Duplicate entry found."  

I am starting the process to migrate our SSL-VPN users to ZTNA. We have SSO configured for all SSL-VPN users now. I cannot find any documentation for configuring EntraID as the SSO provider for ZTNA authentication. I have found this reddit post that says it can be done, but all requests for documentation/proof were met with "the site is no longer available" and "I don't have the config anymore", so I'm skeptical. Has anyone configured Entra ID SSO for ZTNA connections? What is the correct Authentication Sheme config? What are the correct ZTNA Server settings and how do they correlate to the existing SSO for SSL-VPN, e.g., login url, logout url, idp url, etc? edit: readability, formatting

Hi, Like the title suggests, like trying to configure a Hairpin-NAT ( SSLVPN > LAN ) I got across the most annoying thing ever. I did configure some so far, but only from LAN > LAN this one I think it's a first. This works ( SSLVPN > LAN ) for some reason if I enable WAN > LAN , but I dont want access from WAN to the VIP, only from SSLVPN.   id=20085 trace_id=13771 func=print_pkt_detail line=5869 msg="vd-VDOM:0 received a packet(proto=6, 192.168.220.100:64947->PUB-IP:3050) tun_id=0.0.0.0 from ssl.VDOM. flag [S], seq 1209702776, ack 0, win 8192" id=20085 trace_id=13771 func=init_ip_session_common line=6048 msg="allocate a new session-ef2fd6a5, tun_id=0.0.0.0" id=20085 trace_id=13771 func=iprope_dnat_check line=5338 msg="in-[ssl.VDOM], out-[]" id=20085 trace_id=13771 func=iprope_dnat_tree_check line=827 msg="len=1" id=20085 trace_id=13771 func=__iprope_check_one_dnat_policy line=5198 msg="checking gnum-100000 policy-2" id=20085 trace_id=13771 func=

Hello Community!I am attempting to install additional features to my Forticlients in the field, specifically, the SSOMA feature.I have created a package with the features I want.I have created a "Managed Deployment" and linked it to an OU that has clients that are going to need the feature, and the deployment is Enabled.In the EMS, I can see the endpoints being notified they need the install (the endpoint does show in the client that the administrator has scheduled an install).  The installation finishes - the EMS reports (with a green checkmark) that the deployment was successful. The feature that I pushed, unfortunately, does not appear, even after reboot. What am I doing incorrectly?Is there a log I should be looking at? Attempting to push the package via a 3rd party agent using msiexec (with the transforms.mst) shows that the local .mst file from C:\windows\installer\ is being used, which doesn't have the feature needed.Am I using this "Managed Install" feature

Greetings all I have an interesting issue on a FortiGate 40F, with OS 7.0.18 (soon to be upgraded to 7.2, then 7.4.7, to see if that solves the issue). I have done BGP routing before without issues, but over MPLS lines between FortiSwitch ports. In this case we have dual, redundant, IPsec VPN connections over a single WAN interface The IPsec's run fine, and both Pri and Sec are up. Then there are the BGP links, which I created via a BGP loopback interface, with primary IP 172.26.200.21 (just did the secondary link first) and secondary IP 172.26.200.1. The BGP links are also running fine, with packets processing, and both advertised and received routes visible on both sides of the VPN.BGP Pri: 172.26.200.1 (Mine) <> 172.26.200.2 (ISP)BGP Sec: 172.26.200.21 (Mine) <> 172.26.200.22 (ISP) However, the received routes are not being inserted into the main routing table, and thus any packet I receive over the IPsec to my VIP fails the return path check and is d

Hi all,  I hope you're well.  I am migrating a site with existing Cisco switches to FortiSwitch but will not be using the default FortiLink interface since the VLAN's are already created under the existing aggregate interface. Templates have been configured and will be pushed out via FortiManager however, in order to add the switches into FortiManager I must issue set fortilink enable as a FortiLink interface must exist on the FortiGate.  If I make the interface a FortiLink interface by using this command, does it remain as a standard trunk so that the Cisco switches and assigned VLAN's remain servicing clients meaning I can do this in hours or does this interface only work when a FortiSwitch is detected making this service affecting in hours if connected to Cisco switches? My thoughts are that this would not affect anything, but I have not tested issuing this command with anything other than a FortiSwitch attached so wanted to confirm. &nbs

In TCL scripts, the "exec" command is used to send text strings to the Fortigates and Fortigate output is then returned to the TCL script which can then be processed by TCL.A typical example would look like: exec "get system status\n" "# " 10 The first parameter is the text to be sent to the Fortigate with \n being the new line character used to terminate the command.The second parameter (in the above case, "# ") is the string that the Fortigate should return to exec which exec should wait for before moving on.The third parameter (in the above case, 10) is (perhaps suspected to be) the timeout value which tells exec to wait up to 10 seconds for the "# " string to be returned by the Fortigate before exec will give up waiting and move on.However, I have searched for details on the second and third parameters and have not been able to confirm the precise usage requirements for either parameters.In the case of the second parameter - the matching string. Is the string a regex or j

Short version of the story, I've got an external SDWAN provider but traffic through the SDWAN provider is doubling my ping latency.  The provider says it's a routing issue that's outside of their control and they've submitted a ticket but if or when their provider supplies a solution is a question.  In my Fortinet, I can set the ping source as my WAN2 interface (that's where the SDWAN solution is plugged in) and manually run a ping from there.  However, I'm wondering if there is some way to track this in a more automated way from the FW itself?  I'm thinking perhaps through some kind of automation stich but I'm not sure if it's really possible or not.

We have this issue, where some clients are getting a lot of legitimate URLs blocked, because they seem to be "unknown", although they are not unknown. These are common sites from Microsoft for example. This happens with remote clients that use FortiClient Webfiltering: blocked traffic log in ForticlientWord security warning because of FortiClient certificateFortiClient certificateNow the users get certificate error messages in Word for example, because Forticlient blocks the URL and provides its own certificate.Why does this happen? Client has proper internet access, DNS is working accordingly. Problem happens with FortiClient 7.2.5 and also 7.2.8. Any ideas?

Hi Team,I am currently using FortiClient VPN on my users' laptops, all of which have Intel Core processors. However, I recently purchased a new Microsoft laptop with a Snapdragon processor. When attempting to install FortiClient VPN, I encounter the error: "FortiClient VPN Setup Wizard Ended Prematurely."Is there a solution to install FortiClient VPN on my new laptop? Your assistance in resolving this issue would be greatly appreciated. 

I already try but no success at first try. as when i update from 6 to 7 now is the same i believe that there's an issue with deep inspection. someone has experienced ther same?. I don't wanna live the headaches again.

Hi everyone, Does anyone know why there isn’t a Cybereason Antivirus product available for validation in the FortiNAC endpoint compliance scan? I managed to create a custom scan, which is working well, but now I need to validate either SentinelOne or Cybereason, and with Antivirus plus Custom scan I did not found a way to do this, because there is no OR between them, only AND. FortiNAC 7.2