Support Forum

So i was wondering if anyone has this working in production. Trying not to go the captive portal route. Can I achieve this with Fortiauthenticator, If yes what scep client are you using for devices to request their certs? Any input would be appreciated. 

Hello, we utilized IPsec VPN last month, and several of our remote usersare expressing concerns about sluggish internet speeds when they activate the VPN. Certain users have had their connections reduced by 50%, while others have faced a decrease of 80%. Kindly be aware that the remote server is located a significant distance from the remote users.Is there something we can do to improve their speed?

Hi all,  I have a FortiGate 100F series, and some devices are having internet, some are not, but all the configurations seem to be okay. Any suggestions?

Hi All,I've setup HA interface monitoring for FortiGate. When the link from primary unit down , the Firewall should Failover but it didn't failover and the primary unit still remain active regardless of the links fail.I tried removing both FortiGate from HA and reconfigured and tested but still the same , the HA failover is not happening.  Are there any possibilities that could prevent from FortiGate Interface Monitoring to be stopped working? We are using version 7.2.0 .K7SRA1ITFWFG03 (global) # get system hagroup-id : 12group-name : HA-Groupmode : a-psync-packet-balance : disablepassword : *hbdev : "port21" 50 "port16" 22session-sync-dev :route-ttl : 10route-wait : 0route-hold : 10multicast-ttl : 600sync-config : enableencryption : disableauthentication : disablehb-interval : 2hb-interval-in-milliseconds: 100mshb-lost-threshold : 6hello-holddown : 20gratuitous-arps : enablearps : 5arps-interval : 8session-pickup : disablelink-failed-signal : disableuninterruptible-upgrade: enabl

Hi All, anyone experiencing issue with Fortigate Firewall sending delayed logs to the syslog server?I am experiencing an issue where the logs are only coming up 5-10 seconds after the connection has been established.  Thanks

I recently downloaded the Forticlient VPN (7.4.2.1717) using the `FortiClientVPN_OnlineInstaller.dmg`.I'm using a Macbook Pro - Mac Sequoia 15.2 And after that, I received a warn saying "Please contact your administrator or connect to EMS for license activation.".And the Forticlient Icon App received a Lock and Key Icon at the left bottom corner. What should I do to fix that to use the Forticlient without a License activation.

Hi,Strange behavior happened after upgrade from 7.2.10 to 7.4.7.Whole Company started to lose connectivity both to Internet and internal resources. We rebooted the device and it resolved the issue for like 30 minutes and started doing the same behaviour. No major changes since yesterday whatsoever.It was upgraded during last weekend, but the problems started to occur this morning. For now, firmware was downgraded to 7.2.10 and it is stable again. Any of you had this issue?Regards

Hello, we have an issue with blocking hdfull.monster. We tried in Webfilter and URL filter and it would not work. Checking nslookup there are Cloudflare IPs and comparing with the test sessions I see other Cloudflare IPs. Any suggestion how to block this video stream monster? Thanks!

Hi Team, I need to know if it is possible to change the MTU on the ports of a Fortiswitch, I have been reviewing the config, and the only thing it allows me to change, is the MTU in: HOSTNAME # conf system interfaceHOSTNAME (interface) # edit internalHOSTNAME (internal) # set mtu-override enableHOSTNAME (internal) # set mtu 1600 HOSTNAME # config switch globalHOSTNAME (global) # set max-frame-size<integer> frame size between 68 and 10000 If I try it on the interfaces, I don't have the option to modify the MTU. HOSTNAME # config switch interfaceHOSTNAME (interface) # edit port1HOSTNAME (port1) # getname : port1description : (null)type : physicalnative-vlan : 1allowed-vlans :untagged-vlans :discard-mode : nonedhcp-snooping : untrusteddhcp-snoop-learning-limit-check: disabledhcp-snoop-option82-trust: disablearp-inspection-trust: untrusteddhcp-snoop-option82-override:stp-state : enabledstp-loop-protection : disabledstp-root-guard : disabledstp-bpdu-guard : di

Hello,     We are a mid-sized school in Pennsylvania, 4 buildings + admin, 3000 students etc. We are looking to replace a couple of 7+ year old SonicWall nsa 6600 devices with compairable Fortinet or PaloAlto devices, and I'm heavily leaning towards Fortinet because of a bad PaloAlto experence a number of years back at a different job. What is the suggested Fortinet hardware that would be compairable to the SonicWall 6600s that we have now? Currently we have dual fiber lines coming in from our primary ISP and a second fiber line coming into from a fall over ISP, All connections are currently registering as 1Gbps connections, although I'm checking with our Primary ISP if that is the true speed or just what our SonicWall is tapped out at. thanks in advance. 

Hi The company I work for has rolled out FortiVPN globally. We mainly use Macbooks but there are a few die-hard Chromebook / ChromeOS users still out there. Chromebooks can use Android apps and there is a Forticlient VPN Android app which could be used, but currently it doesn't work because, according to our IT team, "we use context aware access which requires Google Chrome, whereas the Forticlient VPN uses its own inbuilt browser". Can anyone suggest a workaround for this limitation? Or is the only fix for Fortinet to update the Forticlient VPN Android to use Google Chrome? Which I suspect is very unlikely to happen. Thanks Stuart

Consider that I have web filtering on a policy for my guest wifi users to block gambling sites.  It works in that if I visit Draft Kings, I get served the SSL error, click advanced and continue on my browser and get served the "Fortinet has blocked this page". I browse any non-blocked categories just fine. I am wondering:What is the proper way to solve this for guest wifi? Even if I was willing to buy a Digicert certificate, what do I register when the URL is the site I'm visiting?A workaround I thought about: is there a way to possibly serve that blocked page as HTTP so it won't  give that cert issue?

I have FG 100 E, and I have it setupDHCP ServerAddress range 192.168.2.2-192.168.2.254Netmask 255.255.255.0is there something missing so that some devices sometimes can't get the IP address                                     Thanks.

Hi, I am experiencing problems with the vpn only client on an new hp pc witch intel network card, the vpn is not reaching the firewall, did turn off all firewalling and antivirus, checked with other pc's on the same network and vpn works fine so it look like a hp, intel vpn issue, i am using windows 11 last updates installed also last firmwares an bios HP Please advise. Dennis Kuipers

Hi,I am struggling with Fortigate VM evaluation license upgrade. My FortiGate VM had been deleted, it worked just fine, and I imported it from my backup. At first it seemed fine. I had correct serial number, I was able to reach for an evaluation license to the forticloud asset. Devcie has downloaded it succesfully and rebooted. That's were the issue begins. After reboot, name of the device has changed to Serial Number and the SN disapeared leaving VM with a wrong one. I did factory rest and it allowed me to restore proper SN for my device but issue is beeing repeated everytime I try to get the Eval License. Any idea where is the problem? Before license update.Device:Forticloud registration:Rebooting:  After reboot hostname is changed to SN and SN is invalid   Finally I am not able to upload Evaluation License.Maybe someone struggled with same issue?I will apprecaite any advise how to deal with it.Many thanks! 

Hi,  I have configure 3 60F like that: - 1hub- 2 Spoke In the Hub, the WAN 1 ip of the Remote-GW is: "set remote-gw 10.1.230.100"And in the spoke, IPSEC 1 show 10.1.230.100. But it's the lan IP. How to change with the wan ip ? Exemple: config overlaysedit "wan1"set overlay-tunnel-block 10.10.10.1 255.255.255.0set remote-gw 10.1.230.100set interface "wan1"set bgp-neighbor "10.10.10.253"set ipsec-phase1 "fabric_vpn_1"set sdwan-member 1next

Hello,I want to export logs for specific policy IDs and download the logs to then run a script over it.My problem is the following: The FAZ is unbearably slow. If I download the logs via "Log View-->FortiGate-->Filter with Policy ID --> download txt " It takes eons to prepare the logs before I can download them. At first its quite fast and then it slows down, to about 20-40 Logs/second. For Log Files that hit the 100k Log cap, this takes a long time. I have to move the cursor every few minutes as well so that my session doesnt expire.  Is it possible to let this log preperation happens in the backround so I can come back and just download it instantly?Or should I use the raw logs from "Log Browse" with EVERY Policy ID and change my script so it sorts the Policies itself? Any Help would be great!

Hello admins, Are there openings to become moderators in Fortinet forum?if so, would you please share details.Thank you

question description：C:\Program Files\Fortinet\FortiClient>FortiClient.exeC:\Program Files\Fortinet\FortiClient>Error: Cannot open C:\Program Files\Fortinet\FortiClient\resources\app.asar\assets\js\guimessenger64.node: Error: A dynamic link library (DLL) initialization routine failed.C:\Program Files\Fortinet\FortiClient\resources\app.asar.unpacked\assets\js\guimessenger64.nodeat ./node_modules/guimessenger/guimessenger64.node (C:\Program Files\Fortinet\FortiClient\resources\app.asar\assets\js\main.js:22:189)at __webpack_require__ (C:\Program Files\Fortinet\FortiClient\resources\app.asar\assets\js\main.js:38601:42)at ./src/main/loader.js (C:\Program Files\Fortinet\FortiClient\resources\app.asar\assets\js\main.js:23284:18)at __webpack_require__ (C:\Program Files\Fortinet\FortiClient\resources\app.asar\assets\js\main.js:38601:42)at ./src/main/logger/logger.js (C:\Program Files\Fortinet\FortiClient\resources\app.asar\assets\js\main.js:24107:19) at __webpack_require__ (C:\Program Fil

I have 8 devices (currently on their own SSID tunnel on my home network that is Fortigate, Fortiswitch ad Fortiap) 6 that use 2.4G and 2 that can use and seem to prefer 5G. Last week they have begun requesting multiple IPs which has caused them to be "Removed due to IP conflict". 8 devices have filled up the whole DHCP table which at one point showed over 300 devices. This has been set up for almost 2 years and has run without issues. Current lease time on the gate is roughly a week which hasn't been a problem. I shortened the lease time to just over a day as apparently Ring devices can request a new lease every 12 hours and I cleared the table and factory reset one of the devices to attempt to reconnect but it will not connect even though the number of devices showing in the table was under 10. Has my gate somehow "blacklisted" the MAC of those devices? Ring cameras and the base station which are hard wired are working fine, this is a wifi issue. Is it best to try to avoid IoT wifi de

Good evening!I have a FortiGate 101E with two internet providers using both WAN ports. They are configured so that when WAN1 goes down, WAN2 takes over, but only for failover purposes.My goal is to use each WAN service for a specific VLAN. For example, VLAN 01 should use WAN1, and VLAN 02 should use WAN2.Is it possible to achieve this configuration?Thank you very much!

Hello, I have a question concerning OSPF with access-list and route-map.It has to filter permit 192.168.0.0/16 and deny any. When using an access-list, it works. When using a route-map it doesn't.Here is part of the configuration: FGT (ospf) # showconfig router ospf  set distribute-list-in "access-list-01"  config area  edit 0.0.0.0  next  edit 0.0.0.1  nextendconfig network  edit 1    set prefix 10.0.242.0 255.255.255.0  next  edit 2    set prefix 10.99.12.0 255.255.255.0    set area 0.0.0.1  nextend.......FGT (ospf) # showconfig router ospf  set distribute-route-map-in "route-map-01"  config area  edit 0.0.0.0  next  edit 0.0.0.1  nextendconfig network  edit 1    set prefix 10.0.242.0 255.255.255.0  next  edit 2    set prefix 10.99.12.0 255.255.255.0    set area 0.0.0.1  nextend.......FGT (ac

Dear Fortineters,I've a question about a particular Fabric configuration I would like to realize (if possible). We have a typical Fabric infrastructure:FORTIGATE --> FORTISWITCH --> FORTIAP We would like to add a FortiSwitch behind the FortiAP using one of its lan ports in order to extend the Fabric like this: FORTIGATE --> FORTISWITCH --> FORTIAP --> FORTISWITCH. Do you think it's possible?Have you already implemented this kind of scenario?Configuring FortiAP LAN ports may be useful?https://docs.fortinet.com/document/fortiap/7.2.5/fortiwifi-and-fortiap-configuration-guide/430146/lan-port-options Thanks in Advance Massimiliano Pontarollo 

I am new to FortiClient EMS, I am installing and configuring at the moment. I can see that the FortiClient download URL is https://servername:1443/installers/ I am planning to configure IIS to run another website on port 1443.  Is there a way to change the FortiClient download URL to a different port? I am not sure if I can have 2 websites running on the same server with the same port.Please advice 

Hello Fortinet Community, I have configured a traffic shaping profile on my FortiGate firewall, along with a traffic shaping policy where I have assigned a Class ID. However, I am unsure about the correct way to apply the traffic shaping profile to interfaces and set the outbound bandwidth.In my traffic shaping policy, I have selected the destination interface as the virtual-wan-link (WAN1 + WAN2) as the outgoing interface. My question is: if I apply the traffic shaping profile separately to WAN1 and WAN2, will the traffic shaping function as intended?   I would appreciate any clarification or best practices regarding this setup.Thank you!