Support Forum

Does anyone have a chart or template or custom report they are willing to share that graphs (in and out bandwidth utilization) on each of the WAN interfaces of each of the Fortigates? The closest to what I am after would be the Chart: Interface Utilization Device List1) Is there a way to filter just on WAN interfaces?2) Is there was way to remove all graphs except for the utilization sent and received? Using FAZ 7.4.2

Does any one know where is the Upgrade Path Tool for FortiMail? Or any one have a cheatsheet/pdf with that information? In the Fortinet web the Upgrade Path Tool doesn’t have information about FortiMail

Hi,I want to send the events from FortiPAM to the SIEM, to see login to the console and so on. In the FortiSIEM CMDB-->Devices I see the PAM device and "Pending" status, I approve the status and in Edit Device, select Type: FortiProxy, there is no FortiPAM type. When I search for the events in SIEM they appear as "Unknown_EventType".In the raw events I can see "Authentication Failure: Local", for example...Thanks

Hello, I’m currently trying to connect to my company’s FortiClient VPN while working from another country. However, the connection is being blocked due to the firewall’s restrictions on connections originating from outside the allowed region.To overcome this, I attempted to set up a proxy using an Amazon EC2 instance located within the allowed region. I’ve tried various methods, including using socat, stunnel, and nginx, to forward the traffic from my local machine to the VPN server via the EC2 instance. Unfortunately, I haven’t been successful in establishing a working connection.FortiClient often stalls at 31% or 40% during the connection process, which I suspect could be due to TLS version mismatches or certificate validation issues. In some cases, FortiClient fails to present the usual certificate acceptance prompt.Are there any specific configurations or tools you’d recommend to make this work? Thank you

Hi all, I found that some hosts are found under Compromised Hosts. 1. Does it mean it is infected by malware? I scanned with AV and got nothing2. One record show nylon.com is SpywareCnC but I checked it is a fashion website. Is it false alarm?[link]http://nylon.com[/link]  Thank you!!

Hello,I’m experiencing an issue with an SSL VPN setup on my Fortigate, and I’d appreciate some guidance. Here’s the scenario:There are multiple VLANs (e.g., 100, 200, 300, and 400), and the Fortigate handles the routing between them. Within the local network, devices in VLAN 100 can access VLANs 200, 300, and 400 without any issues, as there are existing firewall rules in place to allow this.The SSL VPN is configured in Tunnel Mode with the setting Enabled Based on Policy Destination. SSL VPN Portal Settings:Routing Address Override: UnconfiguredSource IP Pools: SSLVPN Tunnel Address RangeFirewall Policy for SSL VPN:Incoming Interface: ssl.rootOutgoing Interface: VLAN 100Source: SSLVPN Tunnel Address Range and VPN User GroupDestination: VLAN 100 Address RangeService: AllNAT: DisabledWhen a client connects to the Fortigate via FortiClient VPN, they can access resources in VLAN 100 as expected. However, they are unable to access devices in VLANs 200, 300, or 400.It appears that the

Hi.I'v got a forticlient ems poc installation on 7.2.5 (about to upgrade to 7.2.6)  Iv got the before_os to connect with the machine cert (with a ldap check to the ad that then computer is there with dns) and then the auto connect when log in to user cert (again with the ldap to check if the user is there with cn) and that works fine.But sometimes when i have the computers lid closed and open it and login with Windows Hello pin or face its stuck on the machine auth, thats a major problem cause iv got firewall policies som the machine auth only allows for password reset and the user cert to allow more.Anyone have problem with this thing? if i can't fix it im think about going with the before logon option with the button so the only auto connect tunnel is the user.Morten

I've blocked many mobile phones from connecting to our wifi via MAC blocking at the DHCP advanced options on Fortigate. But the problem is most of these phones have MAC randomisation turned on, so the next day they're back on my Wifi again. Is there any other way to block these devices, other that using a whitelist option?Is there a way to block by hostname? or any other identifier?

I have worked with different vendors and technologies for a couple of years in the IT industry. Still, when it comes to Fortinet I have very limited experience, and rarely when I touch firewalls setup...etc.recently, I've got involved with a new Fortinet project, a lot of branches offices with 2x HQs, all VPN made manually with headquarters, with no centralized mgmt,branchcustomer it planning to set, fortimanager, and analyzer to orchestrate mainly SD-WAN and central management Fortinet environment,I want to start learning the most effective way, my question is: can I start with SD-WAN training (NSE7) directly to understand how their SDWAN works for Fortinet? I do have CBTNuggest access.or I must do NSE4 training first before I jump to something else,or may be I have to think otherway, please let me know you thought on how to get started my main focus now is SD-WAN fortinet,

Hi, We have an IPSec Tunnel between office1 and office2 to connect two Servers. We need office1 users to connect to the server in office2 using another interface instead of the IPSec Tunnel and let only the servers communicate over IPSec. How can we achieve this, if it is possible? BR.

Hi Guys, on the fortigate 120G I have created  a automated weekly backup to our TFTP server.everything is working fine, my only concern is that the password is in plain text. is it possible to encrypt it? i have looked everywhere but can't find solution. Fortigate 120G - running firmware 7.2.10 script : execute backup config sftp E:\Backup-Netwerk/ROVPNFG/backup_%%log.devname%%_%%date%%.conf <server-IP> <username> <password>

Hello folks,I have the problem, that my remote-site does not use static-ip-adresses. So I can only use a dial-up-vpn-configuration. Some devices between the 2 VPN-endpoints are needing a permanent connection, but when no traffic goes over the tunnel, the tunnel will not "get up". Is there a way, to keep the dial-up-tunnel up, although there is no traffic going over it? (keep it up permanently)

Dear team, I have a Captive Portal, and I need to log in to two devices using the same user account. How is this possible.?

Hello Expert, I create a automated stitch to schedule  daliy back and tftp the file to windows server.When I Test using a exec backup full-config tftp backup.cfg 192.xx.xx.xx from the fortigate the backup works okay. I created the action trigger and stitch but for some reason the backup is not generated at the designated time  as defind in the trigger. I humbly request some guidance to troubleshoot Thank you

Hi guys. I have a FortiAP that would not become online in the Fortigate. It would take IP from DHCP, would respond ping , but would refuse SSH, and when accessed by web it would show the message below. Any idea if it can be fixed? Access Error: 404 -- Not FoundCan't locate document: /

Hi there We are rolling out MFA to our Forticlient VPN users. When user clicks connect a popup window appears for the SMAL idp, titled "Forticlient SAML Authentication". There is a timeout counter in the tile window that starts counting down from 300 seconds. When the popup appears, we can see in the FortiClient window, above the VPN Name box it says "status:connecting". The user needs to enter a login name, then a password, then a passcode, each on a different screen within the popup window. The popup closes and the user is returned to the Forticlient window which then goes through the connection stages and connects to VPN. The issue we are having is that if the user does not enter their login details within 30 seconds in the popup window, when the popup closes, the "status: connecting" message disappears and no other connection messages appear and the user is not connected to VPN. Even if we do nothing in the popup window, the "status: connecting" message disappears wi

Hi there, I've got a FortiGate running 7.2.9 and FortiClient EMS server running on 7.4.1 but I'm not quite sure where to start getting ZTNA up and running. We use Okta for our IdP and I'm presuming that'll be what manages the role based access control but I was hoping there was some guide available to walk you through getting everything working together. Everything I've found so far has been for previous versions of FortiClient EMS which requires Active Directory (which we don't have.) If anyone can point me in the right direction, I would REALLY appreciate it! Thanks!

HiI was wondering if anybody have made a Fortinet network with, FG, FS and multiple FortiAP 233G and how to extend the Zigbee network to get IOT devices to work all over the network with example an Homey Pro Since it would not be able to cover the entire office area.If you have an idea for something better than a Homey Pro, please let me know.

Hello, I'm confused regarding network lockdown support for IPSec in FortiClient.Document Library for FortiClient 7.2.0 describes in the New Features section that network lockdown is supported.https://docs.fortinet.com/document/forticlient/7.2.0/new-features/394388/ipsec-vpn-support-network-lockdown-and-hotel-mode-7-2-5On the other hand, documentation for FortiClient EMS says it is not.Which one is correct?Or how to resolve situation when we need to disable Internet communication for client who is not connected to IPSec VPN or disables the tunnel?Do I need to use permanent route to FortiClient's virutal interface for that?

Good guys, can someone provide me with a download link for the FortiClientTools file from support.fortinet.com Support -> Firmware Download. unfortunately I don't have access.Thanks

Hi FNAC adminsIn FortiNAC or FortiNAC-F, is there a way to restrict access to admins to some containers (or switches), in such way some admins can manage some switches, and some other admins can manage some other switches.

Hi all,  I hope you're well.  I am testing FortiSASE and have setup and working as I would like however, I would like to run some alternative IPsec VPNs as well as the SIA into FortiSASE. Within the SASE portal I have added the IPsec VPN into the "VPNs available to users" section and this Endpoint Profile is pushed out to my device.   The problem is that within the portal I cannot find any section whereby I can specify my VPN settings and even though this VPN gets pushed to my device I am unable to adjust the VPN settings within FortiClient as they're greyed out and therefore I can't get the VPN working.   Is there anyone that has configured other VPNs in the Endpoint Profile that can help me locate these settings or tell me how I can push the IPsec VPN settings I require to the device from the profile? Thanks, Dan. 

I am using a FortiRecorder VM with a number of cameras. Unlike the 400F's I am seeing the system load reach 99% for the same number of camera's as the 400F, the network environment is very similar. 1gb to the recorder and all the camera's are on one switch running at 100 Mbps. What I seem to not be able to find is any information on what System Load means exactly. What is System Load?

greetings all, I know that SLA targets in performance SLA are a set of constraints that are used in SD-WAN rules to control the paths that traffic takes. and The Link Status section of the performance SLA configuration consists of three settings that determine the frequency that the link is evaluated, and the requirements to be considered valid or invalid. what if I set: Packet Loss in SLA targets to 12%, andFailures before inactive in Link Status: 5.And I use= Lowest Cost (SLA) in SD-WAN rule Scenario: there are 5 consecutive Packet Loss at a specific time point, but the Packet Loss rate is still lower than 12% (calculated based on the latest 100 probe). Will any a link re-selection occur? If yes, will existing traffic session be interrupted and re-established via the newly selected link? If yes, will the communication of the session be down for a short time? Thanks,Sean

We have configured our FortiGate with a WPA2-Enterprise SSID that authenticates via LDAPS pointing to an Azure AD Domain Services instance. All our company users are cloud-only and synced to Azure Domain Services. We do not have an on-premises AD or an Azure hybrid deployment, and we don't have FortiAuthenticator.Users can connect to the Wi-Fi, but they suddenly disconnect, The connection then reconnects after some time either automatically or sometimes when the user manually reconnects.I initially thought the issue might be due to network latency, so I set a traffic shaping policy that gives high priority and bandwidth to LDAPS traffic destined our Azur AD DS public IP, but the problem still persists.Has anyone faced a similar issue?