Support Forum

how can i filter the api request i want to filter the size of logs{base_url}/api/v2/log/disk/traffic/local?vdom={vdom}&filter=policyid=={policy_id} and _metadata.timestamp>={start_time_ms} and _metadata.timestamp<={end_time_ms}&start={start}&limit={limit}i want to take just the first 1000 logs but the request show all logs 

I have a scenario where there are two different Fortilink interfaces on a FortiGate. I need to extend a particular VLAN from the gate to both Fortilink-managed switches. Unfortunately this requires me to require a VLAN sub-interface on each Fortilink interface. One has an IP address configured and the other is just 0.0.0.0/0. I assumed, maybe incorrectly, that this would just do 802.1q and pass layer-2 between interfaces but I also know this is a firewall and that sort of behavior may not work. Can anyone confirm if this is supported? If not, is the only solution to re-architect this and reconfigure for only a single Fortilink?

Good day good people, I hope you are all doing well, I just want to ask if anyone has an idea on how to backtrack the reason for high resource utilization. For example, high CPU and memory utilization were observed during the morning, and we just noticed it in the evening. Does anyone know how to backtrack the issue without TAC intervention? what are the commands needed on to solve this issue Fortigate 7.2.10

Hi all,I have create an IPSEC dial up tunnel with Ike v2 and NAT-T. I use Forticlient to connect to it and it works well.  I have observed that some traffic are denyed cause when I send traffic across the tunnel, the user with witch Im logged (using forticlient) is not associated with the incoming traffic. I can see the IP from the private tunnel network but not the username. That causes the incoming traffic matches a deny policy, cause I use an user group in the incoming rule that permits traffic from the IPSEC interface. For example, I can see traffic from 192.168.106.x but the incoming traffic has not an user associated.Why the username with witch Im connected to the tunnel are not matched in incoming traffic?I attach you the tunnel configuration: Thanks ¡¡¡ 

Hi,we're deploying the FortiClientVPN via MobileDeviceManagement on our Apple iPhones.Installation is working fine so far.Our MDM (Baramundi) offers the opportunity to configure softwareinstallations via a XML file.Is it possible to configure the vpn settings during installation? Thanks in advance,Harald Schmid

I need to deploy the full Forticlient iOS app (not just Forticlient VPN) to a few hundred iPads. I'm trying to find a way to input the EMS connection info without having to track down each individual iPad and enter it manually. Jamf has options for appconfig, plist, and a few other options, but I can't find any documentation on Fortigate's support documentation mentioning support for any of this. This seems like a massive oversight, so I'm hoping someone has an answer as to how to push the Forticlient configs to these devices.

We recently deployed ZTNA via FortiClient/FortiClient EMS and we can now access internal resources without connecting to SSL or IPSEC VPN which is really slick. However, we are interested in being able to access resources behind a site-to-site VPN tunnel that exists on the Fortigate. From what I can tell, this doesn't seem to be possible or has anyone found a way to get this to work?

My FortiGate U431F is stuck in a loop in Putty after startup, with the message 'Probably Primary Meru image is corrupted, please upgrade!!' appearing during the process. However, even after entering the code 'fap22b1！$', it still doesn't stop. If I don't unplug the power, the code won't stop.What should I do? Please help me, thank you!

Hello, I encountered an error while testing on Fanalyzer's email server. According to“ https://community.fortinet.com/t5/FortiAnalyzer/Troubleshooting-Tip-How-to-understand-the-email-SMTP-issues-and/ta-p/245012 I have conducted the following checks on this knowledge base:1. Fananalyzer can normally access the Internet and smtp.qq.com2. We have not imposed restrictions on ports 25 and 5873. The username and password of the account are both correct (both the authorization code and the real password have been tried and the same error has been reported)I hope to receive everyone's help, thank you

I'm looking at the SSID configuration and I was wondering about Broadcast suppression - 1.what are the thresholds ?2.I undertand what ARP poison means (I am a CCIE after all), I understand ARP proxy.yet I don't understand the following - ARP replies - does it block ARP reply which is in broadcast ? after all ARP reply is unicast.ARPs for known clients ? does it block ARP reply from a known client ? does it block traffic intra SSID ? DHCP downlink ? does my 40F can still work as DHCP server ?DHCP unicast ? what does feature mean ?DHCP uplink ? does it mean DHCP Snooping ? does it mean that the client can't request for DHCP ? can anyone provide me recommendation and explanations ?

 unable 

Hello allI wonder if the Test pages for Web Filtering work as expected?i.e. https://fortiguard.fortinet.com/wftest/14.html does not get blocked although i blocked the category in my web filter. First i thought it might be an issue in my filter settings, however a friend of mine (who administer another firewall) reports the same. Does the page above get filtered by your filters? Best regards

I'm working on setting up an IPSEC VPN tunnel between a remote cellular router (Digi TX64) and the FortiGate 300E at our headquarters.  I've got the tunnel up and stable, but can't seem to get traffic to flow properly.  If I run a ping from a device behind the Digi to a device behind the FortiGate, I can run packet sniffer on the FortiGate and see the ping packets coming into the FortiGate from the VPN interface, but I never see them leave the FortiGate to go on to the actual host.  Once I get the formula for this sorted out, I get to duplicate it about 180 times for routers across our bus fleet.  All of the bus routers use the same 192.168.x.0/24 internal subnet, so I need to NAT the traffic as it is passing through the FortiGate into our main network, and then reverse that as it passes back through the FortiGate to return to the bus.  I also need to ensure that NAT is always one-to-one such that traffic from a specific 192.168.x.0 address will

So I currently have a shop running aged gen 1 ubiquiti with an updated controller os running on Linux.I'm not having the greatest experience and looking to go Fortinet full stack.2x Fortigates3x fortiswitch FPOE full poe. And looking at either 100 or 200 series.What is everyone's opinion?The current setup: 2x Gen 1 48 poe 500w 2x gen 1 24 poe 250 w 2x gebt 1 16 poe 150w Soniwall fw.Here's why I'd like to upgrade.Full poe for voip expansionFull poe for switch consolidation. They added too many switches since ubiquiti can't handle full poe usage.Full poe for cameras and badgingMore expensive product cause it's a in house install so more money to gear and no project overhead.Fortilink. IMO fortilink is what unifi pretends to be. I know it's local but I can get in local. So I don't mind loosing a silly app that isn't very functional on the mobile side.

We are using a cluster of two 120G since February running the special-built 7.0 fortios releases with various platform specific annoyances (non-critical bugs).Any hint when this platform gets added to the general release pool?

Je crois que par inadvertance, j’ai effacé l’OS de mon Fortigate, il y’a par contre les infos d’un serveur TFTP mais je n’ai pas accès à ce serveur. Que faire s’il vous plaît

     We have a home user who is getting disconnect from the VPN every 30 seconds. She has confirmed she is using the correct password. We don't think it is local network as the same issue occurs on mobile hotspot. Issue has only just started in the last 24 hours. FortiGate Client 7.2.1.0779   The VPN log is attached ( I have started out some sensative bits like my company name and user name)fctver=7.2.1.0779 fgtserial=FCT8001468094356 emsserial=N/A os="Microsoft Windows 11 , 64-bit (build 26100)" user="********" msg="Traffic log" sessionid=1380262705 srcname=sslvpn srcip=172.17.0.100 srcport=0 direction=outbound dstip=london-********.co dstport=443 proto=6 rcvdbyte=12895686158 sentbyte=12888050432 utmaction=passthrough utmevent=vpn threat=disconnect userinitiated=0 browsetime=02/18/2025 11:37:26 AM info sslvpn date=2025-02-18 time=11:37:25 logver=1 id=96600 type=securityevent subtype=sslvpn eventtype=status level=info uid=2E74E029E55740

Good morning everyone,It has been a while indeed. This is a follow up to a resolved post below: Post: Forticlient EMS removable media accessDate:14/5/2024----------------------------------------------------------------------------------------------- Since I configured this feature in EMS, it has been working perfectly, blocking usb devices while only allowing certain devices, especially Keyboard and mouse. However, my manager attached a USB dongle/device to a computer apart of target group/profile, and it is blocked by the USB policy. He instructed to disable the "Removable Media Access" feature on LAN until this ethernet-usb can be allowed on computers. I really don't want to keep this off for too long. Don't know why that instruction, but hey, following orders, at least my name won't be called for any issues. Can you show me to allow this device in Endpoint Profiles -> Malware Protection -> "profilepcs" -> Removable Media Access? Kindly see image below/at

Hi there,I guess I'm doing something wrong - I hope you can help me.My topology is very simple - 40F managing FortiSwitch POE that has 7 FortiAP connected to it in Local Switching mode.there are 3 floors, 2x831F in first floor, 2x831F in second floor, 1x831F and 2x221E on third floor.the 831F is for each classroom, with 30 students, each has a laptop, and a phone.I have 2 SSIDs - STAFF and STUDENTS.yet when I look at the GUI for interfering SSID - despite the fact that the channel selection is auto, and all are controlled via the same 40F - the 831F sees the other 2 831F as interfering SSID.but that makes no sense - they should each use it's own channel, with auto power, and auto channel selection.how can they interfere each other ? they should support each other don't they ?  which CLI commands should I provide you ?

Hello,I would like to implement VDOM In azure infrastructure. As I discovered when you implementing VDOM you must to assign interfaces to the VDOMs, but in case of Azure you have just 2 interfaces and I don't know how I can assign 2 interfaces for example to 3 VDOMs? 

Hi, I have a problem after the firmware was upgraded from 7.2.10 to 7.2.11.  I'm having general GUI connection issues through HTTPS and sometimes the CLI gives connection lost as wella s the GUI itself losing conenction on firefox even after clearing the cache. There are no noticeable issues on edge browser. does anyone know what happend? why did this new firmware screw up connection to fortigate in general? ciao,Antonio

Hi,A pen test on our outside IP shows us that port 2000 (Cisco Skinny Clients (IP Phones)) and 5060 (Session Initiation Protocol).We don't need those ports. And our security office wand to close these ports.We are running on software version: v5.4.5The configuration change we did to close port 5060:conf globalconfig system session-helperdelete 13endAnd for port 2000 we used the following:conf vdom(vdom) # edit Firewall# config voip profile(profile) # edit default(default) # config sccp(sccp) # set status disable(sccp) # end But unfortunately this did not close the ports.Does anyone has a suggestion to close these 2 ports. I hope someone can help me. Thanks in advance.Greetings Palermo

Today I wanted to use application to connect to the server. I get the following message:"Sorry could not start connection "s" Error Revoked by android REBOOT!" .The problem has been happening since today because yesterday everything was working normally even though I didn't change anything. It is worth adding that I managed to connect the desktop to the server using this small data. I tested the problem on Android 10 and 13 and the message was the same.

Hi, today we tried to get information about our interface bandwith with iperf and Fortigates. We would like to get information about a FG location in South America. Our main office are in Europe and we use FG100Fs and 7.2.X. All our offices have at least 2 x 1000/1000mb access but in South America we can only do speedtest on browsers where we get like 800/800 at the most. Firts, we could not run iperf within the VPN from FG Europe <> FG South America. We set up a iperf server on windows on our side but doing diag traffictest run -c x.x.x.x we could not connect. We checked Windows FW, AV and policies and there was no way. As iperf-int we tried all interfaces (internal, WAN and the VPN interface). After that we tried with a linux in our network and we created a VIP with 5201 and trying from our FG with WAN as interfaces we got like maximum 12mb trying at least 10 times. Doing the same from our FG locationes in EU we got like 300-700 mbs.  We would like to k

We have some Fortigate 92D with FortiOS 6.2.12When we are trying to manual update of ISDB (ffdb file) there is error code -85 and message about "Updating FFDB is disabled"How can I fix this issue?FortiGate