Support Forum

Hi All, I am trying to find information if we can use "any" as source and destination interface in the security rules which are allowing traffic that will be routed base on the SD-WAN rules via the respective members of the SD-WAN zone, or it is mandatory to specify the zone in the the security policy. Thank you! 

Despite having set "Assertion consumer service URL" in  "config user saml" as "https://FQDN:PORT/remote/login?realm=REALM", authentication call always shows:AssertionConsumerServiceURL="https://FQDN:PORT/remote/saml/login"> The result is that after successful azure authentication, Fortinet VPN SSL clint tries to connect to:https://FQDN:PORT/remote/saml/login"and it fails because the Fortigate does not respond to it. The correct URL is: https://FQDN:PORT/remote/login?realm=REALM  

hello everyone , i have problem FAZ version 7.4.6 is losing logs day over day i can't create reports i have 1 Ter disk , is there any suggestions on how to solve this problem thanks in advance .

Hi sir, I got issues on my new FortiSwitch FS-108F which bought on two days ago. In switch idle and standalone mode, and without any other Fortinet product connected to it: 1. There are several events about CPU_SENSOR reached/exceeded the threshold value, is it related to HW issue?  2. In the idle mode, no idea why the memory always over 60% utilization, and the system temp around 39~40 degree C.   I am considering to return this device back to seller and request refund, but before that, I'd confirm if the device has problem to use. BTW, I have also export the debug report and sent it to Fortinet customer support for above issues. Thanks,Jacky

Hi Team, Can you help with the following issues:I want to restrict the number of mails received from incoming emails from Gmail, Yahoo, and Outlook domains. However, the session profile can only be applied to the IP Policy and not directly to domains. What solution is available?Is there a way to see the sender's IP address (not the sending server's IP) for an email on FortiMail?Thanks. 

Hello on the forum! We have a configuration need where the SSL VPN tunnel mode user gets assigned a single static IP assigned via the portal when they sign in, and this IP must be the same with every login.  The appropriate IPs assign correctly among the different users logging in, but I noticed with split tunneling turned off, the VPN assigns a gateway on the Forticlient PC incremented +1 from their fourth octet on the IP. For example: user gets assigned 192.168.1.1, and the gateway on the Forticlient PC = 192.168.1.2 and so forth (IPs used are just examples). I've noticed that turning on split tunneling eliminates this gateway, but we don't want these clients to have internet access. In the Addresses assigned through the VPN portals, I've tried assigning: a subnet = 192.168.1.1/32, and an IP range = 192.168.1.1 - 192.168.1.1 with no prevail.  I've even tried configuring ippools with no prevail. I do have a static route in the firewall SSL interface

hi Guys,  is there any explanation of why the documentation is providing wrong instructions on ansible fortimanager https://ansible-galaxy-fortimanager-docs.readthedocs.io/en/latest/docgen/fmgr_firewall_address.html#notes in the docs it mentions that to create a firewall address object with ansible the task, the yaml file has to look like this tasks: - name: Configure IPv4 addresses. fortinet.fortimanager.fmgr_firewall_address: bypass_validation: false adom: ansible state: present firewall_address: allow-routing: disable associated-interface: any name: "ansible-test1" visibility: disable now after a stupid amount of time troubleshooting with direct api calls to fortimanager and running a debug on fortimanager where direct api calls are working but the ansible yaml call doesnt and thats when I realized that the  visibility: disable  is the cause of the issu

Hello I'm trying to connect the EMS Server to an LDAPs Server and when testing, it return a "Protocol Error"The connection to LDAP it's strictly just for AD? Doesn't work with an OpenLDAP or FreeIPA? It´s possible to do with an OpenLDAP or FreeIPA? Or just doesn't work, thanks to brand integration? All the firewalls work like a charm with OpenLDAP and FreeIPA Ldaps. Thnks to all, for any advice!

Hi, we upgraded our core network by replacing the core firewall with FortiGate-600F and Aruba Switch 8360v2.The issue is with the interconnection between the FortiGate and Aruba switch. The 25 Gbps port (x5) on the FortiGate-600F is not working when the DAC cable is connected to the Aruba switch. There is no link on the port.We tested several DAC cables – original Fortinet DAC cable, and original Aruba DAC cable – but none of them worked.Interestingly, if the DAC cable is connected to two interfaces on the same unit, the port starts to work. There is a link on it. We connected the DAC cable to ports x5 and x6 on the FortiGate, creating a loop. Both DAC cables from Fortinet and Aruba were working. Similarly, on the Aruba side, creating a loop brought the interfaces up.Could you help me to fix this issue and understand why the interconnection between the two network devices is not working?Thank you 

Dear Team,In the article "Prevent firmware upgrade depending on the current firmware license's expiration date" (7.4.2), it states that "In FortiOS 7.4.2 and above, enforcement of an active FortiGate firmware license to allow firmware upgrades has been improved. Enforcement is based on the expiry date of the current firmware license compared to the release date of the first GA release of a major version. For example, for FortiOS 7.4.x firmware upgrades, enforcement is based on the expiry date of the current support contract compared to the release date of FortiOS 7.4.0 GA." This means the FortiOS license expiration date must be later than the "first GA release" of a major version (e.g., 7.2.0, 7.4.0, 7.6.0, etc.). For instance, if the current FortiOS license expires on February 1, 2025, and the version is 7.2.x, it can be upgraded to 7.4.x because the 7.4.0 GA release date was May 11, 2023. It can also be upgraded to 7.6.x because the 7.4.0 GA release date was July 25, 2024.Further ass

Good morning everyone, I can't so much as ‘unravel’ a configuration and I'm trying to ask some of you if you can give me some advice. Host from network 10.0.0/24 ping host to network 192.168.0.0/24   all ipsec between the three firewalls are configured and workingI can only configure the first two firewalls (from left to the right)i have tried putting static routes, adding the 192.168.0.0 network in the vpn tunnels and also in the policies but i still cannot reach the host 192.168.0.20 from 10.0.0.20 Thanks a lot 

unable to ping from FortiGate VM throw Port2 and Port3 to any connected device throw these two ports and also we enable Ping under each interface instead of can ping and hear Arp throw port1 when connect it throw any device.Can any one help me ?

Hello, Few days ago we've started having trouble with our Active Passive cluster of two 1000F fortigates running 7.2.10 firmware. After making changes on the primary unit, those changes does not propagate to secondary and after few minutes we see HA cluster out of sync. We've waiting couple of hours but they didn't synchronize. The only way to get synchronize back is to manually force it by CLI: diagnose sys ha checksum recalculateexecute ha synchronize start After executing those commands couple of times on both primary and secondary cluster becomes synchronized. Any ideas what happened?

We're having Fortigate 1000F in AP HA cluster. We're having an IPSEC tunnel with remote location where we have Wireless access points. Those access points are authorizing clients via NACVIEW radius server which is located on our side of IPSEC tunnel. Everything was working fine until we've upgraded our fortigates from 7.2.10 firmware to 7.4.7.  After the upgrade all RADIUS traffic via IPSEC tunnel stoppped. No traffic is seen on policicies in traffic log. Log is set up to ALL and before the upgrade we've had all the traffic logged. And of course RADIUS authorization stopped working. No request are arriving to NACVIEW radius server from the AP controller on other side of IPSEC tunnel. After downgrading back to 7.2.10 everything started to work again. Is there any bug in 7.4.x firmware reguarding the radius traffic over IPSEC tunnel that anyone know of? We would like to upgrade to 7.4.x firmware due to new policy layout which is much more usefull than t

Hello, Currently I am working on configuration below and can not make it work. Point is that local PC and EC2 PC must communicate with each other. There is APN router which is not managed by me , so using red ipsec2 network to make required site to site connection. This scheme was used for long time but with additional PC in local network which was making required IPsec. Now I want to get rid of it and move everything to FortiGate. This is FortiGate F40 OS 7.0.0 . Ipsec configuration Could any body take a look and advise if this is even possible ? If it is maybe there some some special (like "site to site") name for configuration I could google? Thanks in advance. 

I have 2 different internet connection on my fortigate, then i build vpn site to site from internet-A  to the azure and configure the BGP and the connectios was established with below details.Azure BGP ASN is 65515 and peer ip is 172.16.0.64Fortinet Local ASN is 65103, then in the interface tunnel i set the IP 10.103.103.103 for local peer and remote IP is 172.16.0.64 255.255.255.255 When j try to build 2nd vpn site to site from internet-B to azure, the tunnel is up but the BGP was not established because if i set remote ip in the interface tunnel to 172.16.0.64 255.255.255.255 the fortigate say that ip already used in 1st tunnel.Also in the BGP neighboor what interface should i use for interface and update source bexause i have 2 internet connection. If i create another local BGP ASN in the fortigate, when i specifiyng ip 172.16.0.64 the fortigate also say the peer ip is duplicated. Anyone know how we can setup BGP for 2 different connection if the destionation only hav

Hi Team I am facing very slow connection speed when I am connected with Fiber Internet Wifi. But work good on Mobile Internet. FortiClient VPN 7.4.2.1737 Please help. RegardsSivakumar

Hi, we have a user that works off a hotspot which has no Ethernet connections. Can the FortiAP connect the hotspot router wirelessly? We haven't found a clear answer in the documentation. Thanks

So i'm pretty new to working with a cloud only environment. So we decided wifi would be eap-tls, so using cert only to authenticate. Does any one have this setup working. Any input would be great. Already have the FAC CA cert...have that template in azure configured. How are you guys having the devices fetch their cert? Scep with FAC? third party ?

Hello community, Is there a way to block MAB for rogue devices in FortiNAC? The issue i'm facing is with a Cisco Switch with the following configuration in the portsinterface GigabitEthernet1/0/9switchport access vlan 31switchport mode accessswitchport voice vlan 18authentication host-mode multi-domainauthentication order mab dot1xauthentication priority dot1x mabauthentication port-control autoauthentication periodicauthentication timer reauthenticate 180mabsnmp trap mac-notification change addedsnmp trap mac-notification change removeddot1x pae authenticatordot1x timeout quiet-period 10dot1x timeout server-timeout 30dot1x timeout tx-period 10spanning-tree portfast This port is intended to work with MAB for a Phone and with 802.1x for PC, however when a PC with no supplicant with certificate connected to the phone, the switch sends mac to FortiNAC, and I see Login OK with mac address, and therefore the device is able to receive the Default VLAN (in this case VLAN 31 whi

I cannot see the device hostname within Fortigate logs when they communicate internally, meaning within LAN but when the devices access the Internet meaning from LAN to WAN, i can see the hostname just fineDevice detection is already turned on for the LAN interfaceIs there anything else I should look for?

Fortiguard Servers unreachable via 2 Different Locations with two Different ISP'sDNS Debugging followed and ping responses from Fortigate's both show 290ms response times.Fortiguard Servers are set to use lowest latency location as well.Still unreachable, Is there an outage ?

Hi,After upgrading the FGT100F from 7.2.10 to 7.2.11 we are now seeing a user certificate prompt each time we attempt to connect to the admin interface for the 7.2.11 firewalls. I found the below article and  run the following two commands, it appears we have already met those conditions.FGT100F # show full-configuration | grep admin-https-pki-requiredset admin-https-pki-required disableFGT100F # show user peerconfig user peerend Certificate prompt on Admin interface - Fortinet CommunityIt looks like we had the same issue as for v7.4.6 and v7.6.2 but the article states it is currently under investigation. I checked as well the upgrade path for FGT100F and it seemed upgrading to 7.4.8 and 7.6.3 is not an option for the fixed version.For your advise. TIA :)  

Hello everyone, I wanted to share an odd issue we're encountering while using Let's Encrypt certificates (TLS-ALPN challenge) with FortiWeb. We're running FortiWeb 7.2.10 in a HA active-passive configuration, set up as a reverse proxy. The setup involves serving multiple sites under SNI, all using a single Let's Encrypt certificate with multiple domain names. To ensure everything is done over HTTPS, we chose to use the TLS-ALPN challenge, and everything worked fine during the configuration and certificate issuance stages. However, now that the sites are no longer required, we decided to revoke the certificates. That's where the problem starts. The revocation process appears to go as expected. I can see that the revoke requests are properly sent to Let's Encrypt, and when I check via OpenSSL, the certificate shows as revoked (verified against the certificate's OCSP URL with openssl). Additionally, the certificate's status updates to "revoked" on both the primary and secon

The 601e only has a single management port.  I would like to configure one of the 1G physical ports, or something else, for management purposes. I ran across "https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/313152/out-of-band-management-with-reserved-management-interfaces" and "https://community.fortinet.com/t5/FortiGate/Technical-Tip-HA-Reserved-Management-Interface/ta-p/190132".  Are these the best approach?  I don't need or want to be able to access this remotely.  Simply for those times when someone is physically present, they can connect a device, and have access to the GUI/CUI without having to swap any existing management cable connections, and without having to go over the network.Note there are two 601e units in an HA configuration and is in a secured location.  If it matters, it is also connected to FortiManager.