Support Forum

Hi! For the FortiADC cluster design is it possible to do cross-connect for HA of the uplinks towards FW? If so, what would be the configuration on the virtual server port assignment since you can assign only single port?

Hi All, I've just configured link-monitor to allow failover to WAN2 when internet access through WAN1 is unavailable.I've applied this config without any errors, but it doesn't appear to display all the settings.config system link-monitor (link-monitor) # edit "WAN_Failover" (link-monitor) # set srcintf wan1 (link-monitor) # set server "8.8.8.8" "4.2.2.1" (link-monitor) # set protocol ping (link-monitor) # set gateway-ip xxx.xxx.xx9.17 (link-monitor) # set interval 500 (link-monitor) # set failtime 5 (link-monitor) # set recoverytime 5 (link-monitor) # set update-static-route enable (link-monitor) # set status enable The resulting config is displayed below.FW1 # show system link-monitor config system link-monitor edit "WAN1_Failover" set srcintf "wan1" set server "8.8.8.8" "4.2.2.1" set gateway-ip xxx.xxx.xx9.17 next endAs you can see, the following parameters are missing.(link-monitor) # set protocol ping (link-monitor) # set interval 500

Hi All,I'm trying to configure a WAN2 failover but I'm getting stuck on NAT.I have a primary leased line internet circuit on WAN1.I have a secondary FTTC internet circuit on WAN2Both WAN interfaces are in a WAN-ZONE.All firewall policies currently have a specific outbound NAT address with a dynamic ip pool address.This outbound NAT address is different to the public IP assigned to the firewall.The IP Pool addresses are Overload addresses.I have several IP Pool addresses with incremented public ip addresses assigned.Some firewall policies will have different outbound NAT IP Pool address.It is a single public IP from the range allocated to the internet circuit on WAN1. I plan to configure link-monitor to detect when there is problem with WAN1, override the current static routes and send all outbound traffic via WAN2. The problem. When testing, If a client hits a policy like this below, it cannot get to the internet.This is due to the option, "Use Dynamic IP Pool"

Hi ,I have a problem with the DHCP server when reserving ip addresses.the problem is that I have several access points that are not fortiapwhen I move from one place to another I'm obliged to connect to another access point.at each access point it gives me a new ip address, even though I've reserved an ip address in the fortigate.thank you for your reply!!!

Hello Expert, I configured a Stitch to backup our Fortigates firewall to an solarwinds tftp server. But I notice once the backups are completed for a week it is not running automatically for the next week. I did some troubleshooting and found that last trigger date and next scheduled trigger is same.Unsure if this is preventing the backup from running at the next appointed time.I humbly request some help . Please results before for guidance .  Guy-Head-Office-1 # diagnose test application autod 3alert mail log count: 0 stitch: Weekly_backups_to_TFTP (scheduled)local hit: 0 relayed to: 564 relayed from: 564last trigger: last relay:Sun Feb 9 14:08:41 2025next scheduled trigger:Sun Feb 9 14:30:00 2025actions:Upload Backup config to Tftp Server:done: 564 relayed to: 564 relayed from: 564last trigger: last relay:Sun Feb 9 14:08:41 2025 Thank youRegards  

Hi,I have 40F as Wireless Controller, with 831F APs connected to it via POE switch.How can I see which clients were connected via WPA3 PAE and which with WPA2 PSK ? I'm running the SSID in transition mode.

Hi,I'm using 40F as Wifi Controller, and using 831F APs.I have 2 SSIDs - Guests and Employees.I want to prioritize the employees over the Guests Radio wise and Bandwidth (QoS) wise.recommendations ?

Hello Expert, I am seeking some assistance to setup and Automatic Stitch to generate an email when FortiGate HA becomes out of sync. Thank  Regards

https://docs.fortinet.com/document/fortiedr/6.2.0/administration-guide/49640/working-with-fortiedr-on-vdi-environments"FortiEDR Collector should only be installed on VMware Horizon or Citrix XenDesktop master images (not on clones) to ensure protection of virtual environments." So the number of licenses consumed at the time of installation is likely to be 1, but it seems to be displayed per virtual desktop on the EDR console screen. Please tell me how to think about the number of licenses consumed for VMware Horizon (current name: Omnissa Horizon, I think) in EDR.  Thank you for your cooperation.

Hello, I want to define the exclusion list of a known application. I have a long list, do we have a different method other than adding it one by one? Thank you

I wanna change FortiEDR system time on cloud my enviroment. Does anyone have information about this?

I know fortiedr is from the ensilo acquisition. Anyone have any recent experiences with FortiEDR ? and maybe some opinions on how it compares to other ones in the market ? We have fortigate routers and switches, but not sure we definitely need to have that "single panel" convenience, though it sounds nice. Obviously nothing catches everything, and we would prefer better lateral spread prevention, than protection of said endpoint (as in we could sacrifice a known corrupted endpoint, which maybe the fortisandbox might help with as well). that and we would only allow VPN connections if the client was running forticlient with protection, rather than letting any endpoint connect. It might be difficult to determine on login, whether the endpoint had EDR running outside of the fortinet security fabric mechanisms..So we are considering Windows Defender ATP (endpoint), s1, fortiedr right now. There just isnt much information on fortiedr out there. S1 kind of requires MSP, and we're looking to k

Hi Team, After upgrading to FortiOS 7.4.4, the set reply-to has been hardcoded. Does this impact the sender email address reflected in the relay and sms server? Currently, there is error of same sender and receiver email for the sms based 2FA authentication as reflected in the relay logs. Is there a way to change the sender email on the FortiGate side? I have looked into these KBs already:Updated default email notification server 7.4.4 | FortiGate / FortiOS 7.4.0 | Fortinet Document LibraryConfiguring SMS Two-Factor Authentication... - Fortinet Community Thank you!

안녕하세요, 로그인 할 때 98 % 후,다음과 같은 문제가 발생합니다.기존 커뮤니티 게시판에 나와 있는대로 설정해 놓았는데, 전부는 아닙니다. 다른 해결책이 있습니까?

In a FGCP cluster trying to get session sync traffic over the dedicated interface with the set session-sync-dev command. But the corresponding diagnose output seems to indicate it doesn't work. fgt1 (root) # diagnose sys ha session-sync-devHA sessync ports: 1dmz probe: HA probe, Standalone connected, peer_mac = 00:00:00:00:00:00HB pkts: rx=0, tx=508298SES pkts: rx=0, tx=0 Seems to indicate HB packets are send, but none received. Also the status remains probe for HA.The cluster is connect with a direct cable, no switch in between or such.Tried with other interfaces also, wan1, internal4, ... Anyone has this working and different command (diagnose sys ha session-sync-dev) output? What are your counters and status?

I want to configure FortiLink over a point-to-point layer-2 network for connection to FortiGate Firewall and Cisco BB (Backbone). I need to connect FortiSwitch via Cisco BB. I'request support on how I can perform this configuration.The environment have: Fortigate > Cisco BB > FortiSwitch  

I have a Fortiswitch standalone mode - no Fortigate - I am trying to set up MS NPS for radius authentication. I have all set up in the NPS.On the Fortiswitch for a new administrator I cannot choose remote as an option - greyed out.Is what I am doing possible - if so how do I get rem

Hello All Please be informed that we had a customer, and he purchases FortiGate firewall 81F and 3 Forti Switches 124F He was asking to connect all Forti switches directly to FortiGate with Forti Link mode to make sure that he avoids the single point of failure and if any switch become down that doesn't affect to both switches Please advise if there is any recommendation will be appreciated

Hello everyone, I would like to understand how FortiMail calculates email sizes, particularly when encryption is involved or more. The issue I’m facing is that the size varies inconsistently. I understand that factors like attachments influence the final size, but at times and very often, this instability causes emails to exceed the configured size limit, impacting their transmission. I want to avoid having to adjust the email size limit manually each time. Are there any solutions I might have overlooked? ? Best regards

Hi Everyone, Does anyone know how to navigate or check previous version of fortinet?I need the date/timeI've already check the link below but can't navigate it where can i find the datehttps://community.fortinet.com/t5/Customer-Service/Technical-Tip-Check-firmware-upgrade-date/ta-p/329149 Note:The firmware is automatically update thats why i need the logs of previouse version and date and time.

hello , here jai two wan the first is set up for ipsec the second is to go to internet I have a problem with the webfilter when I put a web filter in a policy via wan 1 PPPOE the webfilter its work but when I put it on the wan 2 ip manual the webfilter blocks everything

Greetings.I faced the following situation.In FAZ Storage Info, a message appeared that the logs for ADOM Syslog exceed the possible time limit, i.e. Analytics (Actual/Config Days) - 62/62. I would like to remove this warning. But there is enough space.I went to this ADOM: Syslog, went to Log View > Log Browse and found that there are logs for 2022, which should not be the case. I wanted to delete them. But when I select the logs from the VDOM - Syslog, the Delete button does not become active.I would be grateful if you could tell me how to solve the problem.Best Regards 

Hi guys, I am configuring a Guest SSID in Bridge mode on fortigate (FortiAP) with external captive portal authentication on aruba clearpass. The redirection to the captive portal works correctly. Authentication works on some devices and some browsers, credentials are sent in https Post and requests are processed correctly by Aruba clearpass.However, on some devices, authentication does not work and credentials are not sent to Clearpass. Has anyone encountered this problem? Best regards

I already have SSL-VPN running with SAML enabled and it works fine..I'm starting to setup IPSEC-VPN and it's configured to work with a local group and local account, just to get it running.If I want to start using Azure SAML with IPSec-VPN, can I use the same samluser/saml remote group I have for SSL-VPN or do I need to setup a new one for IPSEC-vpn in parallel, including the Azure side of it.should the ipsec-vpn also be setup on a loopback interface ? (my ssl isn't, currently) are the steps the same ?