Support Forum

Hello everyone,I’m currently facing an issue with the FG3501F Firewall. If anyone has encountered something similar, could you share the technical reason behind it? Here’s the scenario:We have two interfaces on the Fortigate firewall connected to the Server Farm—Port1 and Port8. The goal is to route internet traffic via a static route and intranet traffic via Policy-Based Routing (PBR). We’ve configured PBR for the /16 subnets toward Port1 for intranet traffic, while adding a static route for the same subnets towards Port8 for internet traffic. However, the firewall is not prioritizing the PBR, and *all traffic is routing through the static route instead*. Any insights?

Heyho, just ran into this: On my FortiManager in an adom I added an IPSec VPN provisioning template in device manager. This has a phase1 and also a phase2. I had no problems with phase1. But I do have a big problem with phase2:I need to enter the selectors (dst-subnet and src-subnet) and I do enter the correct ones. However it doesn't matter wether i input them in the form subnet/suffix or subnet,suffix. When I click apply it says its invalid.If I create the phase2 without templete and the same subnets it works fine.Any clues?

I am setting a new Firewall Cluster, when I import the firewall policy (show firewall policy/show) from the previous Firewall into the new Firewall (excluding UUID details) I can see the new  policy on the new Firewall "show firewall policy" but I cannot see the policy in the GUI...! If I create a policy rule in the GUI I see the policy in "show firewall security-policy" but not in the "show firewall policy"  ouput I am really struggling to see why? There are no advanced features in the policy just source/dest/port/accept.Is there something I need to turn off? This should be just a simple import, there are too many existing rules to import manually.

Hello. We have a Fortigate where we have configured exporting syslog messages to an external syslog server, the problem we have is that we are getting alot of syslog messages most of them informational and Notification severity. Is there a way we can filter what messages to send to the syslog server? for example,  only to get messages of  Warning severity or above.

Hi FGT adminsCan FortiOS be compromised? I mean like any other OS by an attacker or a malware.Have there been any known cases?Is there any method to check if my FortiOS is compromised?Does FortiOS checks itself for possible compromise?Note: here I'm talking about FortiOS itself, not about FortiGate configuration.

We can install any version of FortiClient VPN on brand new Macbook (15.3 Sequoia).Problem lies in the new MAC security layer in the OS.  Creating a connection then clicking on Connect produces an error: "To connect to the VPN with FortiClient, open Security & Privacy Settings and allow the system software from FortiTray".Problem is that option is NO longer available is the new Mac OS versions.Called Apple to confirm this is a  issue, and they report the section of the security applet has been removed and will not come back. See screenshot. Will there be a newer build to accommodate for this new Security Change is MAC OS?The version shown here is the latest 7.4.2.1717Thanks!Brett FlaggIntegraONE

We're looking to monitor FortiGate DHCP information using SNMP from a remote appliance for historical and alerting purposes. We used the published KB to create an additional poller for the listed OID but the problem we're facing is we can't figure out how to corelate the utilization to a specific interface. Being able to simply trigger off pool exhaustion is handy, but the historical data and even the alerts and semi-useless if we don't know which network or pool it corresponds to. Is anyone out there today familiar with this? Ref:SNMP traps and query for monitoring DHCP pool | FortiGate / FortiOS 6.4.0 | Fortinet Document LibraryMonitor DHCP via SNMP - Fortinet Community

Anybody else seeing a pattern with 50E dying? I had these deployed for about two years. I've had two starting to have packet loss and one that's not forwarding even though port is up. I saw a thread on reddit and this is starting to become a growing concern. I was able to have the client replace two of them but I'm afraid we're going to start seeing more problems with the 50E. Anybody know if we can RMA these still without support? The client is going to lose confidence in Fortinet. This rate of failure is unacceptable. Update 2022-02-03:Had another two breaking down. 1 is showing slow speeds. The other one isn't passing traffic even though port is up. 6th 50E broken now. Update 2022-04-26:2 more units bad.

Hi team I have a scenario where some end user machines are being blocked from accessing DNS yet the services in the policy are set to all services. This is affecting some machines while others are working fine #FGT

We are looking to integrate our ConnectWise Manage (CM) ticketing system with our FortiVoice Call Center IVR, but I cannot find documentation for this. I see that multiple FortiProducts offer a connector of sorts for CM, like FortiSOAR, but I don't know if FortiVoice can do this natively, or if FortiSOAR can connect to FortiVoice to do this.Ideally, a customer would be able to create a new service ticket in our CM system while on the Call Center IVR or have the ability to pull up their service ticket from CM.Anyone have any ideas?

How would one go about showing the upgrade history going back at least 18 months on a 1500D?

I am just wondering if someone is aware the order of security profile processing in FortiSASE? What i am trying to understand is if URL filtering gets processed before the CASB App profile? Or does the App profile gets processed first?Is there a order in terms of how this is processed. I am aware in terms of how security policy is processed but not too sure around the security profile order.

Could someone guide me on the correct process to extend the FortiPAM VM hard disk size and allocate the extra space to the system? Are there any specific commands or steps required within FortiPAM to recognize and use the new disk space after increasing virtual disk size in ESXiAny help would be appreciated.

Ive been working on this guide to configure DHCP over IPSEC without problems .https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/189440/ipsec-vpn-with-external-dhcp-serviceThe problem is when the remote user disconnected , the device sends a dhcp release to the dhcp server and the lease goes off.This is the main reason im migrating sslvpn to dhcp over ipsec if to remains ips of device for 2 weeks at least base on the mac address.This is what i saw when users disconnected.DHCP 342 DHCP Release - Transaction ID 0x34073082 

Hi!I think I'm confortable with Azure networking, I'm ok with networking in general. Yet I never used SDWAN feature on Fortigate.I'm looking into the option to put a single Fortigate VM into Azure in a hub&spoke model and use SDWAN feature. I don't really see a need for Azure virtual WAN as per the size of the limited deployment, and the cost of Az vWAN can't be justified. I would appreciate some guidance please.1/ Is it possible to have Express Route and Internet as the underlay networks? Any limitation?2/ Is it possible to have Express Route reachable on internal/LAN side in such a SDWAN setup? Or does Fortigate SDWAN zone setup require a dedicated NIC for WAN port?3/ Any Fortinet document you would recommend please? Googling Fortigate SDWAN and Azure always returns content related to vWAN deployement model.Thanks!

Hello,I would like to know if it is possible to change the AND in the fields to OR because I would like my action to be triggered only if one of the parameters I define is triggered.Thank you in advance. 

I have lant to migrate all of virtual machine to new server in different location, and we need to keep same ip address.The vlan handled by core switch and the core switch connected to the fortinet, in new location i also have same devices and both location have internet connection.Since the migration will done partially, this need both location should have same ip address, same vlan and can communicate each other.So can we use VPN in fortinet to transfer Vlan ? In my mind if we can transfer vlan over VPN then the new location will have same vlan and each host on new location can communicate with devices in of location.IF migration is done for all virtual machine then i can shutdown vlan interface on old location and make new interface vlan on core switch in new location.

Hello,I have to connect over IPSEC two locations. Achitecture is looks like below: SiteA LAN - FGT1 - Router - ISP1 device------ Internet-------- ISP2 device - Router- FGT2 - SiteB LAN Possible to create IPSec on Fortigtes  (some NAT-T )?? If yes, could you please provide some tips how to set ?? Thanks

Hello everyone, I am exploring better options for configuring FortiMail HA across two different sites—one FortiMail device in Site A and another in Site B. My initial idea is to connect the two devices via an MPLS VPN. However, this approach can be costly for geographically distant sites and requires extremely low latency to function effectively. As an alternative, I am considering using DNS failover... Does anyone have a better suggestion ? Best regards,

Hi, We run 3 firewalls for VPN connections.I created a CR on the first one and we generated a multi SAN certificate which was uploaded and works fine.I tried the same cert on the other two and i get an error saying there is no CR for this certificate.Error message: Uploaded certificate has no matching certificate signing request (CSR)Does each FW require a seperate CR to generate a different multi san cert? TIA :) 

Hello everyone, I came across an information stating that FortiMail retains quarantined emails for 7 or 14 days before they are permanently deleted from the device. Is there a way to extend this retention period, for instance, to one month or so? Best regards,

Hello,We have cluster of two FGT200F on production, there is no Internet connection, no default route set.  In two months we have to refresh all license - current will expire.  Can we use one port (for example port 1) and connect to them some LTE router for a while ?? Action Plan:1.Set port1 to (dhcp) get IP from LTE Router 2.Set default route pointing to LTE Router IP3.Create a access rule to interent with NAT on Port1 Looks OK ?? Second question, does secondary FGT will automatically refresh lic  , or we have to the same as above on secondary ?? Thanks 

 UI of FortiClient crashed, how can I uninstall in this situation. thanks. application disappear UIunable uninstall

how do i generate 3 month bandwidth utilization report for specific interface using FAZ300G?firmware version 7.2.9.specifically i need to generate report for one IPSec tunnel interface on my FG401E FW.

We have been using MS Teams voice calls without issue on multiple sites for a few years.Recently we upgraded from 7.2.10 to 7.4.5.We are seeing intermittent problems with one way voice which started being reported in the week after the upgrade.It could be coincidence but I am wondering if anyone has experienced the same? We have the SIP Helper and ALG turned off and have been operating like this without issue since we implemented Fortigate on 6.4.x ThanksPedro