Support Forum

HiAt my client I have made IPSEC tunnels between devices, Connections are Established on 2 phases, you can see the traffic that works, from the FG device I can  PING, Tracert, works properly however from the workstation itself unfortunately does not work,I test Tracert from workstation:goes to FG and disappears (only 1 hop to GW fortigate).There are policies and routing set up. I'll add that I'm using a non-RFC address in local network 192.100.100.0/24 (could this be the problem?) in Traffic Monitor I can see that traffic is going into Tunnel

Hi, I have a problem with forticlient 7.2.2.0776 on Mac OS Sonoma 14.1.2.When I'm connected to forticlient for a specific customer, I can't access Internet at all (email, Teams, web browser...). However, when I log on to the same customer via forticlient on a Windows computer I don't have the problem. So it seems like an issue related to my Mac. But what is strange is that I have another customer who uses forticlient and when I log on to that customer on the same Mac, I have access to internet, so it doesn't seems related to my Mac after all. I'm very confused and don't know where the restriction is- Is it something that I should do on my Mac (but if yes why it's working for another customer on the same mac?)- Is it something that the admins of my customer should do on their side (if yes, do you know what they should do?) RegardsYoan.

hello team,I have configured mp-bgp with VXLAn between 2 Fortigates and everything is working fine,I need to  advertise only connected IPs to the local switch to other FortiGates/VDOM via BGP.The same thing for both Fortigates.I need to do that because we have remote locations that we would like to connect directly to the Fortigate that has the Server IP instead of traversing the vxlan to reach the destination server.thank you

I understand the point of a NGFW is to consolidat a stack of security appliances into one. But isn't the fiewall itself subject to DDoS attacks - esp since it doesn't act in stealth mode? Wouldn't it be best practice to have either a cloud based DDoS service or a dedicated and stealthed DDoS security appliance like FortiDDoS infront of the gateway firewall?

Hi, i need help with radius, i don't know but sometime auth dont works. User client when open a browser must insert domain credential. autetication on the firewall works the tests are always positive, while on the client to navigate, credentials must necessarily be entered.thank you

Hi all, I am new to this product, and I am requesting for the procedure to configure DLP and DLP logging. 

Hello everyone,I’m planning a new installation for FortiNAC and I’m trying to decide between FortiNAC 9.4 or FortiNAC-F 7.6. I’m not entirely sure about the key differences between the two versions and which one would be the best fit for my needs.Could someone please explain the differences between FortiNAC 9.4 and FortiNAC-F 7.6? Specifically:What are the feature differences?Are there any performance or scalability considerations?Which one is more suitable for a medium to large enterprise environment?Additionally, if anyone has experience with configuring either of these solutions, I would greatly appreciate any tips, best practices, or even a step-by-step guide to help me get started.NB: my licence is : FortiNAC Control and Application Extended VM Certificate (FNC-CAX-VM for 2 VMs)(LIC-FNAC-PRO-100)Thank you for your help!Best regards,

Hi. Can I know if upgrade FortiManager to 7.2.8 and FortiProxy to 7.2.11, will FortiManager be able to support FortiProxy?  From what I read in FortiManager 7.2.8 release notes, FortiManager 7.2.8 supports configuration management for the following versions of FortiProxy:7.2.97.2.77.2.67.2.37.2.27.0.12 to 7.0.177.0.7 to 7.0.10FortiManager 7.2.8 supports logs from the following versions of FortiProxy:7.2.0 to 7.2.97.0.0 to 7.0.172.0.0 to 2.0.51.2.0 to 1.2.131.1.0 to 1.1.61.0.0 to 1.0.7 What does supports configuration management and logs means? If upgrade FortiProxy to 7.2.11 will it have any compatibility issue with FortiManager? Thanks!

Hello.Where i can download firmware for this Fortigate 200B?This is a old fortigate i want to use to learning. I don't have any contract.Thanks.

How can i setup an alert to be notified when Fortiportal which polls multiple FMG and FAZ,cant poll 1 or multpile devices and makrs thme as down. Polling is done daily.

Issue with WebSocket Connection Closing Prematurely in My Network SetupNetwork Setup Overview:In my current network setup:Incoming traffic first reaches the FortiGate firewall (version 7.2.9).It then passes to the core switch and routes to FortiWeb (version 7.6.1).From FortiWeb, it goes to an aggregation switch and finally reaches the application via a service HA setup.We have a published website that uses WebSocket connections for real-time reporting on a specialized application. The WebSocket sends data every 5 seconds to keep the connection alive.Testing and Actions Taken on Network Devices:Set session TTL to 1 hour on FortiGate.Configured the following on FortiWeb:set tcp-keepidle 300set tcp-keepintvl 60Removed the security policy profile from FortiGate.Set an alert security policy on FortiWeb.Checked switch traffic for any configurations limiting requests or sessions (found none).Observations and Issue:When the WebSocket connection originates locally (within the same VLAN as the s

Hello everyone, I have a problem with fortiClient it stops at 31% and right after I get this error message:Unable to establish VPN connection. The VPN server may be unreachable. (-4006)But the same Forticlient is able to connect to other SSL VPN customer, so I have this problem with only one customer Any help please Best regards

I cannot use the IP addresses from the IP pool as the source IP for ping commands.

Hi all I am very new to Fortigate. Just set up a FG 60F that needed port forwarding from a cloud service to an internal printer on port 9102. What I have done so far:Set up VIP with external IP of WAN interface and internal IP of printer:                Created firewall policy with the source being the public IP of the cloud service, destination the VIP              Debug logs give these messages:id=65308 trace_id=9 func=init_ip_session_common line=5995 msg="allocate a new session-0009a61c"id=65308 trace_id=9 func=get_new_addr line=1205 msg="find DNAT: IP-<printerIP>, port-9102"id=65308 trace_id=9 func=fw_pre_route_handler line=180 msg="VIP-<printerIP>:9102, outdev-wan1"id=65308 trace_id=9 func=__ip_session_run_tuple line=3413 msg="DNAT <WAN_INT_IP>:9102-><PrinterIP>:9102"id=65308 trace_id=9 func=vf_ip

As per the subject, how to duplicate the LAN to WAN traffic from FG-A to FG-B's LAN to WAN. The LAN IP is 172.20.1.254 and the WAN IP is 10.0.9.246. As shown in the image, how should this be handled?

HiWe have a small Fortigate with SSLVPN for home users.For a few months we have had more and more VPN login attempts. In the past from few IP address. We have blocked this on the firewall. Now we have ~100 attempts per day, always with a different source IP.This floods the log and important events can be missed.Geo-blocking is not an option as the CEO should have access even when on vacation.Can we configure that a denied is only sent for known usernames?Any other ideas?

Hello,Can I upgrade my FortiOS to 7.4.7 if I have Fortigate 200e?I have also FortiAP-231F v7.4.5, build0734, 250108 (GA)Thanks

Hi, We are planning on rolling out a handful of Fortigates 90G - currently we have 3 setup in a non-production environment. We are receiving a TLS link between some sites and other sites will use ADVPN Hub\Spoke with SD-WAN and dual ISP. The VPN part is working fine and so I've removed those links for the time being.  For the TLS we have 2VLANs on our hub FortiGate (200,300) setup under port3.  Our PC connected to the main Fortigate can each all other Fortigates. The other PCs connected to the other Fortigate can reach the hub but cannot each the Fortigate at the other end. The reason looks like BGP is not interesting the route into the routing table. As it is the only path to the destination, I am not sure why and am clearly missing something.  Willing to post any config that will help. Here are screen captures of what I'm referring to. The first one is the main Fortigate where the trunks for the TLS from our ISP will come in and the second one is th

If I follow the suggested steps below to remove my switches from management prior to exchanging the fortigate appliance, can someone please clarify what happens to the switch configuration? I've seen references to Fortigate specific items being deleted but can't find a definitive answer about the config in general.  Trying to prepare for and avoid potential disaster when we change management.  Thanks. On the root FortiGate, go to Security Fabric -> Fabric Connectors.In the topology tree, click on the FortiSwitch device you want to remove.Select the option to Deauthorize the device.

Has anyone used FortiConverter, and if so, what are your thoughts on it? I am replacing a 40F with an 80F. There is a fair bit of configuration on the 40F, I would think doing it with FortiConverter might take an hour as opposed to about 3 hours manually.I am planning to buy "FortiGate-80F 1 Year FortiConverter Service for one-time configuration conversion service. " Do I need any other licenses with this?

Polling resources using fortiweb api and send to influxdb. Using grafana for dashboard. Steps1. Linux Server preferably Ubuntuset static IPset NTPapt update && apt upgrade2. Install Dockersudo apt install apt-transport-https curlcurl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpgecho "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/nullapt updateapt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin -y3. Install Influxdb & Grafana Dockeruse provided docker compose file.take note of the influxdb details:org: my_apibucket: fwb_prodtoken: token <-- your tokenadd influxdb datasource in grafana4. Install python3 on Linux Server with modulesapt install python3-fullapt install python3-requ

Hello, we have installed two switches model fortiswitch-m426e-fpoe.The access points connected from port 17 to 24 does not come UP all patterns because the APS need 802.3bt (poe ++). Regarding this device, this model support poe++.How can activate this option in the 8 ports what support this option? Best Regards,

greetings guys,I am trying to understand how the sd-wan performance SLA probing traffic (for example, Ping/ICMP) is steered.I have configured the SD-WAN performance SLA, two member interfaces are selected in the SLA, let's say, port1 (MPLS in the picture) and port2 (OL_INET in the picture). the SLA is using Ping as the probing protocol probing the detect server 10.74.x.x.port 1 is an MPLS underlay interface, port 2 is an overlay based on Internet IPsec tunnel. If I use the CLI in fortigate, I do see the probing traffic (ICMP echo/request) is flowing through the member interface added in the SLA. diag sniffer packet OL_INET 'dst host 10.74.x.x' 4 0 ainterfaces=[OL_INET]filters=[dst host 10.74.x.x]2025-02-24 06:43:45.156019 OL_INET -- 10.250.a.b -> 10.74.x.x: icmp: echo request diag sniffer packet OL_INET 'src host 10.74.x.x' 4 0 ainterfaces=[OL_INET]filters=[src host 10.74.x.x]2025-02-24 08:01:03.828714 OL_INET -- 10.74.x.x -> 10.250.a.b: icmp: echo reply the 1

Installed Forticlient VPN on Macos 15 Sequoia.After trying to connect I'm getting the message "Initialize VPN system extension was failed" when trying to connect to our VPN. Also Forti Tray is nowhere to be found on Network extensions to turn it on.Do you have any solutions? We tried uninstalling/restart/reinstall but the problem remains the same. 

Boa tarde Implementei uma regra baseada em usuários do Active Directory para o grupo de marketing.Neste grupo, bloqueei a categoria de compras (block), mas tenho alguns sites que se enquadram nesta categoria que permito (web rating overrides). Esses sites não são mais permitidos. Em outras palavras, pelo que percebi, todos os sites que estão nesta categoria de compras não estão mais respeitando as regras da whitelist. Como podemos fazer os ajustes para ativar isso mesmo que a categoria seja negar e permitir os sites?