Support Forum

Hello everyone! I have 2 Fortiweb devices in active-passive ha cluster. Now I can connect via HTTPS to the mgmt interface active device of the HA cluster, there is no access to the passive device, while using the cli I have access to the mgmt interface of the passive device fortiweb too.  Can I use the web UI on a passive cluster device, such as on fortigate devices? Thanks.

helloI have fortiGate40FI need to disable save logs in cloud after that I need to save all logs to external USB automatically Best Regards

Hi allI need to connect second internet redundant connection into fortigate. I am using only one fortigate. Is it possible to use one fortigate for redundancy ?

Hello everyone, I am currently working on integrating FortiAI with FortiAnalyzer, and I would like to know from which version of FortiAnalyzer this integration is officially supported.- What is the minimum FortiAnalyzer version required to recognize and store logs from FortiAI ?- Are there any specific configuration steps or limitations I should be aware of ?- Where can I find the official documentation regarding this integration ?Any insights or shared experiences would be greatly appreciated. Thanks in advance for your help!

I've got a few lab forti's that are getting behind on updates. I don't care about hardware support on them, I've got spares and I don't need to spend much for the home network lab. What's the best way to get access to firmware these days?

My forticlient ssl connection fails at 10% but successfully connected through mobile network. It was working before but suddenly it stopped working. I tried to reinstalled but did not worked. Looking for some solution or suggestions.Thanks

We currently purchased some FortiSwitch 124F-FPOE switches for a client and are running into some odd issues getting the DHCP Helper feature to work properly. DHCP Server exists at a central office with a bunch of branches connected to it via MPLS. So a hub and spoke topology, where all traffic from the branch sites is funneled back to the main office. For whatever reason when we are using a FortiSwitch at one of these branch locations, the DHCP Helper function doesn't work properly on VLANs. The native vlan on the internal interface will forward the DHCP traffic, but the other DHCP Helper on VLAN10 will not forward DHCP traffic correctly.I have confirmed routing is working properly because I can statically assign a device on VLAN10 and ping the DHCP server with no issue. There is nothing that would block this traffic.Currently have a case open with TAC and they aren't able to resolve the issue either, wondering if anyone else has run into this issue? I've tried run

Hello there, can somone please explain to me what this FortiClient VPN icon display  means ? I could establish a succesfull connection and i pressed disconnect.  After 10 min when i tried to enter again i had this icon displaying and could not establish connection I have the Forticlient 7.2.8 version because it was the only version that i could establish a succesfull connection 

Hello! I am currently experiencing a problem with dialup ipsec vpn on a fgt-90G.. i use certificate auth and the problem is that sometimes, the windows client connects, but no traffic passes through the tunnel... in logs i have ike retransmits like it shows below.. The thing is.. it sometimes works with no modifications to the configuration.. 2025-02-12 15:02:16.961772 ike V=root:0:Dialup_0:131: sent IKE msg (retransmit): x.x.x.x:4500->y.y.y.y:64916, len=1728, vrf=0, id=8e28e757f91c9b5b/5efcee79161f925b:00000001, oif=392025-02-12 15:02:18.669458 ike V=root:0:Dialup_0: link is idle 39 x.x.x.x->y.y.y.y:64916 dpd=1 seqno=2 rr=02025-02-12 15:02:18.669490 ike V=root:0:Dialup_0:131: send IKEv2 DPD probe, seqno 22025-02-12 15:02:18.669512 ike V=root:0:Dialup_0:1235: sending NOTIFY msg2025-02-12 15:02:18.669522 ike V=root:0:Dialup_0:131:1235: send informational2025-02-12 15:02:18.669540 ike 0:Dialup_0:131: enc 0F0E0D0C0B0A0908070605040302010F2025-02-12 15:02:18.669598 ike 0:Dia

Dear colleagues, I encountered the issue of authentication of external proxy servers.I have a Fortigate 100F - new, configured Explicit proxy. To connect to an external proxy server, I try to use the Proxy chaining function, everything would be fine, but the external proxy server requires user authentication when connecting to itself, I could not find this function in the settings. I also reviewed all the cookbooks and also did not find anything.On one of the resources I found only these lines: config web-proxy globalforward_proxy_auth Enable , but when I try to use it it shows Error about upsent function.

hello everybody, I defined a ZTNA Group that includes two ZTNA Tags:  I know that a firewall policy can work with ZTNA Tags. But is it the same for a local-in-policy?Looking at the documentation: config firewall {local-in-policy | local-in-policy6} edit <policy_number> set intf <interface> set srcaddr <source_address> [source_address] ... set dstaddr <destination_address> [destination_address] ... set action {accept | deny} set service <service_name> [service_name] ... set schedule <schedule_name> set comments <string> next end It generally talks about a destination address. But is the local-in-policy capable of understanding a ZTNA group?I didn't find anything indicative about this. I'm working on a Fortigate 60F v7.2.11.Thank you

Hi. I have a Cisco switch configured with gateway IP at 10.24.111.65. The switch is connected to the fortigate through a trunk with VLAN 101 tagged. Im trying to do vlan-routing from my VLAN1 which is configured with gateway in the fortigate to VLAN101 with the Cisco Switch as gateway. I have created VLAN101 in the fortigate without address.Firewall policies from-to VLAN1-VLAN101.Static route Destination 10.24.111.64/255.255.255.192, Gateway 10.24.111.65 and Interface VLAN101 I cannot ping the gateway or any devices on vlan 101 from vlan 1. (Reply from 192.168.80.254: Destination host unreachable.) The devices on VLAN101 are showing up in the fortigate users & devices under VLAN101. What am I doing wrong?The cisco and all devices connected to that is supplied by a third-party supplier and I cannot do any configuration on that network.

Fortigate 90G FirmVer7.4.5Default internal is VLAN ID 0.I tried to change this VLAN ID 1,but errore poped up something like "cannont use VLAN ID 1..." I want to use VLAN ID 1 ,because I want to fortigate deliver VLAN ID 1,100,200 by trunk-port to cisco L2switch. How can i change VLAN ID 1 of fortigate? or it is not nessesary to define VLAN ID 1?By the way, what means internal vlan id 0 is?  

Today we received a security audit assessment from a 3rd party security company. They indicated they can login successfully to our border FortiGate firewall using jsconsole from a trusted management interface. The trusted management interface is connected to the Out-of-band (OOB) Management network and is restricted to specific internal users including the 3rd party security company performing the audit. Can anyone speak to this access, good, bad, indifferent?Can jsconsole be used to make changes to the firewall?Is there a way to block jsconsole access?Thank you 

Hello, I hope you are all doing well, I tried installing the FortiEDR Collector on Debian 11 and Ubuntu Server based on the steps in the official documentation, but the installation fails with the following error message: E: Unsupported file ./FortiEDRCollectorInstaller_OS_Version.deb given on commandline Or in case of Debian 12: Unsupported Linux flavor. debian Do you have any idea on what may be causing this problem?

Hi,I have 40F as Firewall and Controller, Connected to FortiSwitch, and has several FortiAP's connected to it.I have 831F APs and 231F APs.for some reason I see that there are 3 devices that are connected to the 831 which has much bigger distance than the 231F.Despite the fact that the 231F have no clients connected to it at all.This lead that the signal strength of these clients is "Fair" and not better.yet - if any of them would connect to the 231, due to the distance (1-2 meters away from it) - it should be much better.I assumed that the 231F doesn't support 802.11AX, yet one of the devices is using 802.11AC. how can I tell the reason ? also can I "transfer" a device from the 831 to the 221 manually via the controller?  

I currently have 2 x fortigates configured in a VRRP group. There are 2 x VLANs on both Fortigates and both Fortigates are VRRP master for one VLAN and backup for the subsequent VLAN. e.g. FW1 is master for VLAN 100 and FW2 is master for VLAN 200. FW1 is backup for VLAN 200 and FW2 is backup for VLAN 100. I have configured split DHCP scopes on both fortigates so that if one goes down or connectivity is interupted, the other will serve DHCP addresses to clients. Is there any way to set a delay in DHCP response on the FG to the secondary (VRRP backup) DHCP server so it will only offer an address if the primary VRRP firewall doesnt beat the backup unit? If not - how would I go about having this added as a feature request? I went for VRRP over HA for capacity and granular policy control on the backup VLAN in a fail-over scenario. Session sync is not at all important in the current environment. The alernate solution is to move DHCP server to Windows servers.  

Ran into this issue today and figured I would post the solution, since I couldn't find it. Situation is a VPN hub/concentrator running 5.2.8 with multiple IPSec VPN peers configured as dynamic/dialup peers. When testing the new firewalls one at a time before shipping out, each one worked fine. But after users received them at their site, none worked. They all kept bouncing up and down. Tunnels would establish, and then with 2-3 seconds go back down again, over and over. The solution was to disable add-route under the Phase 1 settings for each VPN peer: config vpn ipsec phase1-interface     edit "DVPN-PEER-1"         set add-route disable     next end I didn't capture the log message, but what was seen was a message indicating that route 0.0.0.0/0 was being passed from one VPN to the other. Since Phase 2 selectors are set to all zeroes, and add-route is enabled by default for a dynamic pe

Hi, In my lab I have a 200E on 5.4.4. I'm using ssl deep inspection for 443 traffic. I'm testing with the Fortigate SSL cert added to the trusted root cert authorities store on computer accounts for windows 10. Normal https traffic is working fine tested on IE11. My issue is when using RDP connections through rd gateway servers. Specifically external Windows Server 2012 rd gateway servers wont connect rdp sessions from windows devices behind the Fortigate in my lab. Interestingly SBS 2011 rd gateway servers connect successfully, actually. I tried both proxy and flow based modes. Same result. Does anyone have similar issues or know how to resolve?

Hi, I find that IPV6 SD-WAN rules are unable to add IPV6 FQDN objects.Was this by-design? Or a bug?Device: fortigate 60eOS: 7.4.7 config firewall address6 edit "speed.cloudflare.com" set uuid 3e275afe-e74f-51ef-ba51-85ac2c2767bd set type fqdn set fqdn "speed.cloudflare.com" next end  

For instance, this is just one rabbit hole if you want to dive into this issue:   https://sites.google.com/classrooms.management/view/home For Reference: FW-7.02-1706

Good morning, I have a question regarding SSL/ssh inspection, on some machines that are used for development I had to exclude the following domains since they could not access the pages they needed:sourceforge.netdevelopers.facebook.comdl.google.comrepo.maven.apache.orgupload.video.google.comgitlab.comwww.jetbrains.comInformation Technology Categorywe already have the certificate installed in the browsers but in this case how to do it, they use php storm, android studio to program. Those machines use Debian and Ubuntu.I don't think it's safe to leave so many pages excluded.  What would be your recommendations in this regard?Thanks

I have a FortiGate 601E, and I need to determine whether it supports IP Reputation. If it does, could you guide me on how to check and configure it?

Dear alli have already advpn on some my networkexample HUB A have 3 spoke, spoke A, spoke B, and spoke Cbut there are some additional network example spoke D and spoke E that need connect to Spoke A as hub can spoke A become HUB to spoke D and spoke E ?

Hello guys, I'm new here and I'd like some help with BGP and public range configuration. It's the first time I configure both. Info :I have a new setup with one ISP with two connections (Two routers), a primary (10Gig) and a secondary (4Gig).- Both are connected to a Fortigate 1000D.- A p2p public IP to both routers with BGP configuration.- The p2p IPs are non-routed IPs.- A public range /27.- Only the default route is shared by the ISP. I would like to know what's the best way to configure the public range to avoid limitation? Just to try the connectivity, I have tested this right now => Set the Public range with loopback interface. It works, but only the first IP is available of course. Also, I realized that I can't use the loopback in local out routing for the DNS/Fortiguard. I also tried to set a loopback with a /32 and did the same with the BGP network command, but even if it's shared to the neighbor, I lose internet connectivity. Maybe it's normal with