Support Forum

Hi all, I have a Fortigate device set up SSL VPN, when I create an account and connect on Laptop, I can ping to the Server normally, but when I also use this account to connect to my phone (Android and Iphone), I can connect, but I can't ping to the Server.Forgate uses Firmware 7.2.5 build1517Please help me with this problem.

Is there a way to use Fortimanager trial in an airgap environment? The Entitlement Files not work because the Trial has no support.

Im having following issue:Im using FortiEMS 7.2.4 with the Cloud functionality and whenever clients go offline for a longer period of time they get kicked out of their workgroup and they don't connect back to their previous workgroup whenever they come back online.Is there a way to connect the clients back to their previous workgroup even when the requirements don't match anymore or do they always have to match even if they only reconnect?Is there an option in the Cloud version to never let a client disconnect or increase the time until they disconnect? Thanks FortiClient

Hello Everyone I have a fortigate and fortimail VM setup in my lab that connects to two Exchange servers. I can successfully receive external email through the Fortimail VM however when I try and send externally, It just gives me an error immediately "too many hops". I have checked the fortigate and I see traffic passing for SMTP.  I have policies setup on Fortimail and I can successfully validate MX records for my domain and i can telnet test externally on port 25 without issue. Not sure what to change or where to check what is causing this. I even set the max hops to 200 to test and it uses all 200. What I notice on the logs page is, that when I send externally, it lists the same email about 30 times, however when I receive, that mail is listed once. Please can you guide me where to check this? ThanksEd

Can I get data in the other Fortiview panels. but I can't see any data from our VPNs in our FAZ in the Fortiview section, any suggestions? Thanks

Hi all, I have 2 switches connected to 2 fortigate interfaces that forms a software switch. This software switch routes some Vlans that terminates at these ports. Both ports share layer 2 and 3 parameters. When traffic from different vlans reaches firewalls, I route traffic between then with rules.I won't go into the details of this design, but the switches are in different locations and need to share networks/vlans. With software switch, servers from both switches can directly reach the gateway with direct connections to the firewall. In some cases, I move virtual servers between locations (using a dedicated Fiber cable) and with this topology servers works with same network configuration in both sites. I would like to connect a new cable between switch 1 and switch 2 to bypass traffic between same vlans but, if I do that, I'll form a layer 2 loop. (Red line diagram). What I would like if it's possible is:1)Use 2 different ports in firewall to can route same networks/vl

Hello, I’ve set up two sites connected via VXLAN over IPSEC, and everything is functioning as expected.  However, I’ve noticed an issue with ARP behavior under specific conditions: From Site A, when I connect from another VLAN (e.g., VLAN 30) to a virtual machine in VLAN 10 or VLAN 20 on Site B, I observe a change in the ARP table on the device in Site B.Example: I check the ARP table of PC B20 (a device in VLAN 20 on Site B).The MAC address for 10.112.20.254 (router’s IP) initially shows 00:09:0f:09:00:00 (MAC address of the FortiGate on Site B).When I connect from PC A30 (a device in VLAN 30 on Site A) to PC B20, and I re-check the ARP table on PC B20, the MAC address for 10.112.20.254 changes to 00:09:0f:09:02:00 (MAC address of the FortiGate on Site A).This unexpected behavior raises concerns about network stability and could impact communication. Has anyone encountered a similar issue, or does anyone have insights on why the ARP entry changes in this

Hello everybody, I'm working on a 60F Fortigate.I have an internal domain called vpn.xxx.com. I set some custom DNS records to redirect the request to vpn.xxx.com to a specific machine. The interface we are working on is the Wi-Fi interface. From the picture, 192.168.1.1 is the router. So far, so good. Everything is working. My network settings are:  If I ping vpn.xxx.com: 10.1.0.1 replies correctly  Now I connect to a VPN Client. The network settings I showed before remain the same. The difference, now is that 10.1.0.1 is not the one ho replies to the ping. Now, 79.x.x.x replies to the ping:and vpn.xxx.com is not reacheable anymore. Who is 79.x.x. x? Is the WAN interface of the Fortigate: Now, you cou ld say that the problem is the VPN, that probably changes some DNS stuff. It could be right, but there is only one problem. If I disconnect from the Wi-Fi (on wich are set DNS custom records) and connect to my phone hotspot and to the VPN Client, vpn.xxx.com is reache

We are encountering an issue with users connecting to our VPN web portal via Fortinet using their Active Directory (AD) credentials. Specifically, when a user's password has expired and Fortinet prompts them to create a new one, the portal fails to validate whether the new password complies with AD's complexity requirements.As a result, Fortinet provides a confirmation that the password has been successfully changed, despite the update not being propagated to the AD. This discrepancy causes users to believe their password has been updated, when in reality, the original password remains active. Consequently, users frequently contact support after being unable to authenticate using their "new" password.Is there a way to enforce AD password policy compliance directly within Fortinet or otherwise mitigate this issue to reduce user confusion and support overhead?

Hello guys,We have Forgates 100F in our production with v7.2.8.I would like to configure encrypted logs sending to Syslog server. But I didn't find settings in GUI  nor CLI commands.Could someone tell me if it is possible to do ? If yes, how ?Thank you.

Running Fortigate on 7.4.5.I have some VLAN interfaces that are part of a LAG. I need to move one of these VLANs out of the LAG and have it tagged on a separate physical interface (or perhaps a different LAG).I did see the article https://community.fortinet.com/t5/FortiGate/Technical-Tip-Migrating-VLAN-interfaces-from-one-interface-to/ta-p/257285 suggesting looking at the "parent" where the Integrate Interface is available, but I don't have that. All the VLANs as well as the parent LAG have the Integrate Interface greyed out. How can I move it? I really don't want to delete and recreate it as I have lots of policies linked I would need to delete and recreate too. 

I have enabled fortigate ddns but site not loading. I need to know this option now days working or not ?

Hello,I am using an FG 80F with FortiOS version 6.4.15, connected to several Mikrotik devices via dial-up L2TP IPsec VPN. For dynamic routing, I use the RIP v2 protocol to enable communication between clients behind the devices and other remote networks.When upgrading to FortiOS 7.0.X, I followed the manual steps to adjust L2TP: adding a static route to the 192.168.254.0/24 network for l2t.root and modifying the firewall policy. While the VPN connections are established, RIP does not function, and routes to remote Mikrotik networks are not created.Below is my routing table in version 6.4.15 with the RIP protocol functioning correctly. S* 0.0.0.0/0 [10/0] via 181.120.228.253, wan1S 92.62.234.133/32 [15/0] via 92.62.234.133, VPN MikrotikS 178.255.168.3/32 [15/0] via 178.255.168.3, VPN MikrotikS 178.255.168.18/32 [15/0] via 178.255.168.18, VPN MikrotikS 178.255.168.25/32 [15/0] via 178.255.168.25, VPN MikrotikS 178.255.168.27/32 [15/0] via 178.255.168.27, VPN MikrotikS 178.255.168.28

Hi.We have had a terrible time finding a combination of versions that work for our clients, within the same client forticlients won't work with 7.2, some won't with 7.4, even some with 7.0x.We need to update all to the latest build in their branch and trying to find a quick easy seamless process that won't break everything. I obviously want to keep all current connections intact and settings https://tutuapp.uno/ .We have an RMM agent, so we can script to do this any way that is reliable.TIA.

 My fortigate firmware broken or corrupt. How can I reinstall new firmware to fortigate 200f. Please help #fortigate #Fortinet @everyone #firewall

Hi Team, anyone can help on "Fortinet VPN Zero-Day Exploited in Malware Attacks Remains Unpatched: Report" The DeepData malware framework was seen exploiting a Fortinet VPN client for Windows zero-day that remains unpatched.Link: https://www.securityweek.com/fortinet-vpn-zero-day-exploited-in-malware-attacks-remains-unpatched-report/

Hi, Currently managing HA cluster, but when trying to access the secondary firewall via CLI, I keep on getting connection closed advised after approx. 10 seconds. What might be causing the issue? I need to access the secondary firewall since the HA cluster keeps on getting out of sync. "Connection to x.x.x.x closed." Thank you!

After installing Hyper-v Fortimanager VM accesing the gui and trying to register a trial license.  Cloud credentials are entered and the agreement is accepted.  After that it returns to the license screen with "undefined" in red.  Is it possible to just get a trial license to install? 

Hi, I am seeing that error in my dashboard, and was planning to click the 'Activate' so I can log in button but its greyed out. I do not have the full subscription to the FortiGate Cloud. Is this the reason why? Thank you

Hello Team, would you share your recommendations of migrating core switch Cisco 4507R+E to fortiswitch 448E is it applicable ?will the FortiSW be enough or i'll need to go to another versionand may i know what does that means ? "Supporting up to 48 ports in a compact 1 RU form factor, "     

I've been searching through the Product Life Cycle info but I'm unable to locate the end of life date for the following models FortiGate-40FFortiGate-60FFortiGate-101F Is anyone able to help with this please Thanks & regardsSteff 

hi,we have FG-xx "F" in our environmentmy question is, since these FG have internal HDD1. is it "safe" to enable log "all sessions"?2. haven't seen much FG docs regarding syslog, is logging buffer "circular" in a FG, i.e. overwritten by newer logs?3. is there a default threshold or buffer size in the HDD by these "F" models? is there also a "preferred" FW policy sequence based on its specific purpose/criteria? this is to prevent an overlap or "shadow" FW policy. refer sample below1. DNAT using VIP2. SNAT using IP pool3. SNAT using Egress interface 

Hi, I would like to use my Fortigate hostname to login into the device using SSH (e.g. Username@hostname). However, PuTTy gives me an error when I try it this way. Is there a setting or command I must enable to allow me to login in this manner?

We make use of the Guest Management facility to create vouchers for the guests at the Lodge.We have 2 areas where guests can make use of their vouchers and sometimes the same voucher is printed due to the fact that there are 2 locations (FortiAP at each location)There is a Comments field available if a Single user is created, but alas when multiple accounts are requested, the Comments field is no longer available.The Comments field would be ideal to indicate, say the location where the voucher is being used. This would mean that no double prints are done.Is there a way around this? Could it be a feature request?Maybe in CLI to do a bulk update to a range of userxxx - userxxy and set Comments to "this is for Lodge 1"

Hi all,I am working on a test machine configured to access the Internet via a proxy PAC script set to FortiProxy. At the moment, when I open the browser, the proxy authentication banner appears correctly; by entering the domain credentials, I can browse without problems.Now, however, I need to configure FortiProxy so that Microsoft Teams can bypass authentication. The goal is to allow Teams to run without requiring proxy authentication, while for other services the proxy login request should continue to work as it does now. What are the methods for doing this? Thanks in advance for the supportBR