Support Forum

TopologySpoke ---ipsec--- SDWAN HUB ---ipsec--- DC (non Fortigate)Site A(Spoke) and Site B(Spoke) follow the same topology.However on Site A, when I do a ping sweep to a resource on DC I see a 3-4% packet loss, when I do a ping sweep from Site A to SDWAN Hub there is no packet loss. There are no packet loss monitored on the performance SLAs as well. I mirror the same test for Site B and other sites and dont have this issue and they are all using the same template configurations. Tried to play with NPU, MTU, MSS as per several guides but did not resolve the issue. env: 7.2.8 

Hello, In the firewall logs, different app names appear while DNS is expected to be seen as application in internet-directed DNS traffic, what is the reason for this? Can you give information about the subject?  Best Regards,İsmail Ürek

Does Fortinet provide a general overview of EOL dates for all FortiOS releases like this?ReleaseReleasedEnd of Engineering SupportEnd of Support7.49 months ago(11 May 2023)Ends in 2 years(11 May 2026)Ends in 3 years and 8 months(11 Nov 2027)7.21 year and 10 months ago(31 Mar 2022)Ends in 1 year(31 Mar 2025)Ends in 2 years and 7 months(30 Sep 2026)7.02 years and 11 months ago(30 Mar 2021)Ends in 1 month and 6 days(30 Mar 2024)Ends in 1 year and 7 months(30 Sep 2025)6.43 years and 10 months ago(31 Mar 2020)Ended 10 months ago(31 Mar 2023)Ends in 7 months(30 Sep 2024)6.24 years and 11 months ago(28 Mar 2019)Ended 1 year and 11 months ago(28 Mar 2022)Ended 4 months and 4 weeks ago(28 Sep 2023)6.05 years and 11 months ago(29 Mar 2018)Ended 2 years and 11 months ago(29 Mar 2021)Ended 1 year and 4 months ago(29 Sep 2022)

Hello guys. In the company I work for, we have 05 Fortigate firewalls that are EC2 in AWS. Today we backup the firewall manually and I would like to do these backups automatically and the perfect world would already move these backups to a S3 Bucket. Is there any way to do that?

Please can you help. I have been supplied with a brand new Dell Latitude 5550 windows 11 laptop from the company I work for and I am required to connect via Forticlient VPN to the work network from home, which I can not do.  It is version 7.2.5.1053 and the VPN connection will go through the motions and ask me for a verification code and actually connect but then drops out anywhere between 30 and 60 seconds, telling me ‘SSL VPN connection is down’. I have connected to the internet via wifi and ethernet cable.  I have tried multiple cables, ones I know are ok, with them plugged into switches and directly to my Virgin Media Hub 4 router. My household uses multiple other devices such as windows 10 computers, imacs, ipads, smart TVs, android phones, apple phones, heating control system, which are all connected by either wifi and ethernet with no problems at all. I have an older Dell Latitude 5500 work laptop running windows 10, which works with no problems at

Hi all, At our client we have one user who is not able to make a VPN connection. The client seems to connect until it reaches 90% and then goes back to 0.Below i pasted a piece of log from the client. From Fortinet community there are some topics referencing the same kind of issue. Possible solutions include disabling IPv6 on the NIC, setting remoteauthtimeout 60 on the Firewall, reinstalling the Forticlient. All of which we have tried, but didnt solve the issue.We use SSO for single signon. Devices are Entra joined. I can see in the Enterprise Application (in Azure) that authentication is succesfull.The client version is 7.2.4.0972. From what i read in several topics this shouldnt be a troublesome version.The only thing we didnt try is removing the software with the fcremoval.exe tool. We did however remove the client including the data from the appdata folders. What other opties do we have besides using the fcremoval tool (we have to get on site to use this tool in saf

Hi,I had configured two VPNs/Site betwen HQ and sites (Hub/spoke) for resilience. One of two VPN is a Dialup over 4G and the other is an IPSEC site-to-site over Radio links (Fluidmesh). no loadbalanacing or SDWAN in this architecture. So my problem is when the Spoke chang the IP Publics (VPN dialup over 4G), is creating a new phase 1/phase2 on Hub but the old phase1/phase2 still stuck on Hub so i get 2 connections dialup over the same vpn and is causing disconnecting on communication between 2 sites. 

 Hello,I am working on a project where I am deploying 90G firewalls across branches. It's a manual configuration for initial connectivity like LAN, WAN, Policies, and IPsec, while the rest is managed in FortiManager afterwards.To eliminate repetitive work in the GUI, I use Python for the initial configuration. I configure two LAN networks with DHCP as "VLAN switches." However, once I complete the configuration, I can get an IP address from the second VLAN (CCTV) switch I created, but I am unable to get an IP from the first DHCP server (LAN) configured (config sys dhcp server > edit 2).Every time, I need to log in to the GUI, disable the DHCP, and configure it again to make it work.I have tried several methods in the CLI, such as disabling and enabling, reconfiguring, restarting, etc., but I end up with the port malfunctioning, where it does not come up. As soon as it detects a cable, it switches off.Do you have any idea how I can reset or enable the DHCP service in the initial

I dont do much of out FGs, so just want to check something before appling it. We have been told to implement 'replay-resitant authentication mechanisms' this by our Security manager, using the commands below set config system globalset admin-https-ssl-versions tlsv1-2 tlsv2-3set admin-ssh-v1 disable I just would like some validation that this is only applicable to logging onto the devices as an admin user and that it does not effect any firewall flows in any way.I plan to use - set cfg-save revertset cfg-revert-timeout 600 To cover any issues when applying We only use our FGs for firewall type connections.  

Has anybody ever gotten a local user db working with an explicit proxy? on any FortiOS version? I have cfg and policy and it looks good but every time I test it shows needs authentication. sample of the cfg I've been testing on now 3 different fortigatehomefgt (root) # show authentication ruleconfig authentication ruleedit "proxy-auth"set srcaddr "all"set active-auth-method "Auth-scheme-Negotiate"nextendhomefgt (root) # show authentication settingconfig authentication settingset active-auth-scheme "Auth-scheme-Negotiate"endhomefgt (root) # show user group proxy_userconfig user groupedit "proxy_user"set member "kfelix1" "kfelix"nextendhomefgt (root) # show firewall proxy-policyconfig firewall proxy-policyedit 1set uuid 0428149c-e925-51ef-1e15-2684e04091aeset proxy explicit-webset dstintf "wan1" "wan2"set srcaddr "all"set dstaddr "all"set service "webproxy"set action acceptset schedule "always"set logtraffic allset groups "proxy_user"nextend diag wad debug enable auth show

The product is locked:    

I've had it managed with EMS and enabled for my endpoint profiles for years, but never gave it much thought before. Specifically, the categories that you can enable, block, or monitor. If my endpoints are behind a Fortigate with web and application filters, the application firewall policies seem redundant.I have all the categories set to approve, because I want to control that with my FG, not EMS profiles. I do have the "Block Known Communication Channels Used by Attackers" so I guess that's some good it's doing.

This problem began after I upgraded Fortigate from 6.4.15 to 7.0.17 without any configuration changes. Before this, the issue was not observed. It's not a problem if it asks for a username and password; the issue is that it started asking for a token, which was initially required only for VPN users.FortiGate is requiring a token for internet access, even for users who should only need a token only for VPN. The firewall integrates with MS AD with LDAP and FSSO.VPN users authenticate with tokens via FortiAuthentication, also integrated with MS AD and LDAP. FortiGate requires a token for internet access only if users are in local, not when are in remote access.All firewall rules for Internet access are configured to validate FSSO users, with LDAP validation as a fallback in the same rules. See the attached screenshot. 

Hi,Quite new on Fortinet configI'm stuck with this error for a couple of days now on a very simple setup using FortiGate-40F v7.2.8 Using FortiClient on ubuntu 22.04 and windows 10 - now far away from the device, I try to set it up using ssh diagnose debug application sslvpn -1 showsSSL_accept failed, 1:unexpected eof while reading /**************    Hereafter  - config vpn ssl settings      *************/set status enableset reqclientcert disableset ssl-max-proto-ver tls1-3set ssl-min-proto-ver tls1-2unset banned-cipherset ciphersuite TLS-AES-128-GCM-SHA256 TLS-AES-256-GCM-SHA384 TLS-CHACHA20-POLY1305-SHA256set ssl-insert-empty-fragment enableset https-redirect disableset x-content-type-options enableset ssl-client-renegotiation disableset force-two-factor-auth disableset servercert "Fortinet_Factory"set algorithm highset idle-timeout 300set auth-timeout 28800set login-attempt-limit 2set login-block-time 60set login-timeout 60set dtls-

Hi, I have a fortigate and managed fortiswitchs.FG 80f version is v7.4.6Fortiswitch 148f is v7.2.4 I have setup DHCPv6 on a VLAN and my devices are getting IPv6 addresses from DHCPv6.I would like to reserve one of the devices so it will always receive the same IPv6 address. I was unable to find a way to do it with IPv6. I do have the option to do it with IPv4.

hi I am trying to figure out why our fortigate configuration is not honouring the phase 1 lifetime setting of 28800s (8hrs)Over the weekend I started monitoring the tunnel with pingplotter and noticed a clear pattern as to when the phase 1 rekey happens.the rekey would start the process after 7hrs 38min, not the 8hrs as configured on the fortigate.the other thing thats happening is that during this time, network connectivity between the fortigate and azure is down for about 45-60s.using pingplotter i can see a clear pattern with this and that the rekey happens every 7hrs38min (excluding full tunnel drops) causing network connectivity issues along the way. here are the time stamps from pingplotter showing phase1 rekey.the tunnel drop timestamp indicates that the full tunnel went down.17/01 - 15:4317/01 - 23:20 + 7hrs 37min18/01 - 06:58 + 7hrs 18min (tunnel drop)18/01 - 14:36 + 7hrs 38min18/01 - 22:14 + 7hrs 38min19/01 - 05:52 + 7hrs 38min19/01 - 13:29 + 7hrs 37min19/

Hi Guys, We are unable to reset uptime by using dia sys ha reset-uptime. But didn't work

hello everybody am facing strange issue where I can't ping from our new site lets name it HQ-2 I have configured firewall policy and everything we have an ipsec tunnel between main site HQ and new site HQ-2 I have vlan for MGMNT other device in same vlan they can reach the AD via the ip sec tunnel such as switches but still my firewall can't ping when I run the command Diagnose sniffer packet to see whats going on it seems the firewall is trying to ping the AD via the dmz interface which has the ip 10.10.10.1 nothing is connected to this interface I have tried to use policy route but still the same issue any advice what could be the issue here ? thanks in advance

Hello!I need to set up FortiEDR notifications for when a collector/device gets put in isolation automatically via the playbook. All of the system/security event notifications are setup and work properly, but how do I get the isolation notifications sent to the distribution lists?  Thank you!S0ck-Pupp3t

Hello,I'm currently configuring a second client IPSec VPN. The new uses IKEv2, on the same WAN interface/IPaddress. I saw help pages about the PeerID and LocalID, but my tries aren't okay. I have an phase1 error. I put a PeerID on the Authentication frame, and I reported it on the LocalID in the Forticlient configuration as I understand. Is it okay ? What about the LocalID on the Fortigate ?  The existing Client VPN has this configuration :Is this configuration a problem ? 

Good day Fortipeeps! I just wanted to ask if anyone has any idea how to calculate the total average or maximum CPU utilization. For example, the total average over 24 hours. I’m a bit confused about per-core CPU utilization. it is considered alarming if one of the core have high utilization?I would appreciate your insights Thank you! 

 showing the error above, have not blocked the firewall/ traffic from between servers, please help to check it. thanks.  FortiClient 

Hey, I have device profiling rules one is for APs and the others are for Cameras and Printers with the Vendor OUI. When I plugged in an AP on Switch FortiNAC tagging it to AP_Role but the others does not work although it appears in the Hosts. Same configs for both of them. What could be the problem? It can detect AP but can't detect the others.

Hello everyone,  I've configured the antispam profile action on FortiMail to use personal quarantine. However, the end user receives a notification about a quarantined email several hours later—sometimes even a full day later. I've checked the NTP synchronization, which appears to be fine, and the latency between the mail server and FortiMail is normal. My current FortiMail version is 7.4.2, and I plan to update to 7.6.0 to see if it resolves the issue. Does anyone have a better suggestion or know if there's a way to adjust this delay on FortiMail? Best regards,

Hi everyone, The ZNTA on my FortiClient EMS working well with SAML verification user and invitation codes. However, we got problem on connecting using the FQDN.- With unchecked "Enforce User Verification", the FortiClient using FQDN connect to EMS successfully without any SAML login (insecure as we adopt off-net workstation).- With checked "Enforce User Verification", the FortiClient using FQDN doesn't connect to EMS. The error message is about the connection require invitation code. if you made FQDN connection with user verification successfully, please kindly advise what is wrong or missing in my configuration setup. Thanks so much.