Support Forum

Hello guys!Override FortiGate block-intra vlan traffic.Is it possible to override  block-intra vlan I have two client on the same subnet need to talk with each other. But in the same time I will like to block anything else to reach each other is it possible to do so. Thank you  

hi everyone. i need to configure ssl vpn with ldap authentification.is it obliged to generate a certificate from my winfows server, or use the buikt in certificate of fortigate or buy a certificate for may vpn connection.please help

Hello,i'am a new user in fortigate world :) with FG-51EI read some tuto to learn how it works, and i'm stuck with routing between vdom.it won't work :'(i'm french, and my isp provider is named free.To be able to watch tv with their player, it have to get an IPV6 SLAAC without DHCPv6. unfortunately, i don't know how to do that with fortigate. (it's not the subjet but if someone can help me for this point, i will be very happy )So i create a root vdom in transparent mode, with member interface wan 1, and port 1. my tv player works without problem.now, i create another "test" vdom in NAT mode, for testing, homelab. the interface member are the others portsi wish to link this nat vdom with the root transparent vdom, and .... no way to make it works :'(i miss something but i don't know what.I relied on these links, for helpinghttp://socpuppet.blogspot.com/2014/09/a-meshed-vdom-transparent-using-inter.htmlhttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Connect-2-Transparent-VDOMs-w

Hi,we have a customer with a FortiWLC-50DWhen we try to set some options, for example security profiles, system ask us a login.Both our admin (level 15) accounts doesn't work.Is there any other root account? Can we solve it via CLI?Thanks 

Hi Everyone, We have a Wi-Fi setup with a FortiWLC 200D controller and approximately 50 FortiAP 822i access points. Currently, we’re experiencing significant issues with Wi-Fi stability. When connected to an SSID, the connection is highly unstable. On devices like Windows PCs or Android phones, the Wi-Fi signal icon frequently fluctuates between full connection and a single bar. This issue affects all available SSIDs. Here’s what we’ve tried so far:Changed the connection type between the access points and the controller from Layer 2 to Layer 3.Conducted a Wi-Fi scan with a professional company. They reported that the Wi-Fi itself appeared fine and suggested the issue might lie elsewhere in the network. I also investigated the network infrastructure, including switches and firewalls, but found no apparent problems.The FortiWLC and APs are running on version 8.4-8. I’ve also checked the debug/diagnose section on the WLC but didn’t notice anything unusual. Does anyone

Question on Radius policy,  I have a FortiGate connected to a FAC for 2 sets of users (both using the same LDAP source)  One set is using a policy, that requires chained authentication, (RSA Token server) and that policy is at the top and it works fine,  I added a second policy, as I want WIFI users to authenticate with AD if they are in the WIFI Group, so I created a 2nd policy and placed it above, with the a matching radius attribute of SSID = "MYSSID" My question is, when someone connects to this SSID, does it send this radius attribute? or do I have to tell the gate to send this attribute ? I cant test this from the Gate, as you can add radius attributes in the "test autheserver radius etc etc"  or can you?

Hello, We have virtual Fortigate Deployed in VMWARE, We are trying to configure Dial-up VPN with cert authentication, but we get "XAUTH authentication failed" error, also in debug we see "fnbamd_cert_auth_copy_cert_status-Leaf cert status is unchecked" What it can be and how fix? 

This is my first foray into the need for VXLAN and have some questions. My current site has a L3 Aruba switch, which handles my internal VLANs, an egress VLAN connecting to my FortiGate which connects to both a private WAN circuit to my data center (which in turn, provides Internet) and a backup Internet circuit for Internet failover and the IPSEC VPN spoke to hub (data center). Bought new building that we will be moving to, so want to implement VXLAN so I can use the same VLANs and subnets for all the new equipment going in so when we do actually move, it will be an easier transition. So the VXLAN config will be a temporary situation (no more than 6 months is my guess). From a design perspective, my idea is to implement the same low cost Internet "backup" at the new site, but it will be the main Internet connection until time gets closer for the move to add the higher dollar private WAN circuit as the primary. I will establish a IPSEC VPN connection between the two sites dir

Hi  Am running Fortinac v7.4.0.0427 (GA) and the Endpoint Compliance doesn't run when a registered host connects back to the network ,or it takes very long to do so ,6+ mins however if i scan the host ,the compliance action is executed .Any idea why this could be happening ?

Hi  I want to achieve this :When a registered host is connected ,its first put in isolation vlan until it passes endpoint compliance ,is this possible? I have set the default vlan as isolation ,however when a registered host connects ,its moved from isolation -> production then isolated.Thanks 

Dear Fortinet Community. Today I have a very easy and short question. We will buy a Fortianalyzer in the next days. And now our data security guy wanted to know who exactly has access to the data collected on the FortiAnalyzer. We have seen sometimes a bigger packet of dataexchange between the FortiAnalyzer and Fortinet Servers... So we asked ourself. Does our FortiAnalyzer TestVM send data to Fortinet, so that our data will be shared with the manufacturer? Or in another way... Can Fortinet access in any case our FortiAnalyzer and read the data stored on the appliance? However. There is just one qestion :) Can anyone instead of me as Admin can see the data collected by the Analyzer? Any help or hint is very much appreciated. :) With kindest RegardsFortiLover

Dear all,A question about how FortiGate handles the communication with a SCEP server when the CSR is based on elliptic curve.As stated in this FortiGate article [1], a CSR based on elliptic curve can be sent to a SCEP server.In that case, and as specified in the SCEP rfc8894 [2]:"The form of encryption to be applied depends on the capabilities of the recipient's public key. If the key is encryption capable (for example, RSA), then the messageData is encrypted using the recipient's public key with the CMS KeyTransRecipientInfo mechanism. If the key is not encryption capable (for example, DSA or ECDSA), then the messageData is encrypted using the challengePassword with the CMS PasswordRecipientInfo mechanism. "That further says: "Note that some early implementations of this specification dealt with keys that were not encryption capable by omitting the encryption stage, based on the text in Section 3 that indicated that "the EnvelopedData is omitted"My question: when emitting a CSR based

Hi guys. I have an issue with this device. Aleatory, it would work for some days, other days it would not turn on the radios. The logs shows it constantly leaving and joining. Accessed the SSH interface, and got the following log. Every exactly 24 seconds it shows a "signal 11 (Segmentation fault) received". What does it mean?   FP221ETF18009026> crash1: 2024-11-25 10:45:23 <05543> $ 8: e5d33000 e0822003 e15b31b6 e28310022: 2024-11-25 10:45:46 <05753> firmware FortiAP-221E v5.04,build437b176,170810 (Release)3: 2024-11-25 10:45:46 <05753> application wtpd4: 2024-11-25 10:45:46 <05753> *** signal 11 (Segmentation fault) received ***5: 2024-11-25 10:45:46 <05753> Register dump:6: 2024-11-25 10:45:46 <05753> r0: 00a47790 r1: 00a47790 r2: 00a5778e r3: 00a577de7: 2024-11-25 10:45:46 <05753> r4: 0023d598 r5: 000000a5 r6: 00000008 r7: 000000008: 2024-11-25 10:45:46 <05753> r8: 00000000 r9: 00000000 r10: b6fe9f7c fp: bead4a2c9: 2

I am having problems when upgrading to the new version of FortiAnalyzer. The database recontruction gets stuck and does not progress. It has been taking the same time for days. This does not allow me to review and collect logs.

Hello experts, I have this issue with my users while using FortiClient:When a domain user's password, configured as a VPN User, expires, FortiClient, despite prompting for a password change, is unable to actually reset it.It reports "Password Field do not match," but upon checking, the fields are identical.

Hi,we have such problem on every webpages with the newest chrome version 131 error appears:ERR_SSL_PROTOCOL_ERROR as I read Chrome implemented any new TLS mechanism in this version:https://chromestatus.com/feature/5257822742249472is any solution for this?

Hello fellow gurus. I am hoping one of you maybe able to help me with a problem I am facing.I just deployed two Azure FortiGate VMs using the market place in a HA acive-passive with ELB/ILB.I am able to get in to the management web interface. When I try to ping 8.8.8.8 from the cli 'exec ping 8.8.8.8' I am getting a 100% loss.I check and I have the static route setup (which is created by default).What else am I missing here? I'm new in Azure so it's probably something simple.Thanks!

Hello Everyone, we have a problem with the configuration of our HA, the HA is well configured and synchronized but the problem is that the master works well, but as soon as there is a problem on the master and we switch to the slave there is no traffic passing through the slave and we lose all access to the internet until the master is restored. a lacp conf has been set up (the master and the slave belong to the same LACP aggregate on the switch side).Initially, when I plugged the ports, they were all UP, but the slave ports went down later after a LACP negotiation I guess.  https://docs.fortinet.com/document/fortigate/6.4.15/administration-guide/666376 

greetings all, I got the information as following from FortiSwitch, what is an Internal port and the usual reason why it shows so much drops? Port(internal) is Admin up, line protocol is upInterface Type is Pass Through without PHYAddress is E8:ED:D6:51:77:14,MTU 10000 bytes, Encapsulation IEEE 802.3/Ethernet-IIfull-duplex, 1000 Mb/s, link type is autoinput : 13316481778 bytes, 82631689 packets, 0 errors, 481076 drops, 0 oversizes42314 unicasts, 55849479 multicasts, 26739896 broadcasts, 0 unknownsoutput : 252618470 bytes, 1781502 packets, 0 errors, 0 drops, 0 oversizes25319 unicasts, 1754202 multicasts, 1981 broadcasts0 fragments, 0 undersizes, 0 collisions, 0 jabbers thanks you.

We have an issue at our org where some machines have the "free" FortiClient VPN installed on their machine with existing connection profiles to random sites. The issue is that we are pushing FortiClient Zero Trust and during the install process, it removes the free version along with their VPN profiles. Is there a way to find a "backup" stored in the local machine somewhere by default or no? Is there also a way to stop this behavior when the new client gets installed? I doubt there is but I thought I would ask. Thanks. I know you can add custom connection profiles when the Zero Trust version is installed but that doesn't solve my current problem.

Hi, we have a IPSec connection from our main 200F (7.4.4) firewalls to Azure. Users complain about performance so we are checking the connection. We use AES126 256SHA and have 6 networks in P2. We checked package capture and we saw retransmissions so thats why we would like changing MTU. First the MTU, we get through by: ping x.x.x.x -f -l 1280, so I thought 1280 + 28 = 1308 should be best MTU config, correct? Changing the MTU for the VPN interface would affect all connections in Phase2? Thanks!  

A somewhat special problem: Background:The clicks on our homepage are to be analysed. Clicks that are made from the office (fixed IP address) can be filtered out so that they do not distort the result. However, some employees work from home and there are many different IP addresses and these cannot be filtered out. I would therefore like to be able to specify in the VPN connection that calls to a specific domain do not go via the employee's local IP, but via the VPN connection and then via our fixed IP. This would also filter out these clicks via the fixed IP. Is that possible? 

Hey,We are using a Forti 100F as a firewall and have several FortiAP 231F in different locations. These are all on the same network and directly connected. Now the question is, is it possible to use the "locate wifi clients when not connected" feature without an extra server and without using Aeroscout (because we don't want to use another server for that). If so, is there any documentation on what needs to be done to use this feature, or does it just need to be enabled? Another question would be where these disconnected clients are listed and how to distinguish them from the "normal" connected clients.Thanks for your help!

We currently use passive authentication for web filtering using FSSO with a collector agent installed on a local domain controller. We are finding more and more situations where local domain controllers are being decomissioned in favour of Azure based AD and wish to know if passive authentication is supported in this way. Our only resource to go off is https://docs.fortinet.com/document/fortigate/7.2.5/administration-guide/33053 but as we haven't attempted before, perhaps someone who has can shout up and advise whether or not this is the answer, or advise whether or not passive authentication is supported. Thanks in advance!

hi,i was trying out 'worflow' in FMG and already had a few session list/history.i can't seem to remove/purge old session ID, so i just disable workspace and re-enable it back to clear it.can the old session be manually removed from the list so that only new session will appear and be approved?