Support Forum

failed to connect to the vpn

I have encountered the following issue. I configured Traffic Shaping for several networks that pass through a single interface. I set a bandwidth limit at the IP level (Per IP Shaper) to 10 Mbps. After that, some users started experiencing problems accessing Outlook and certain websites. How can I configure Traffic Shaping so that this limit does not affect the availability of these services and sites?#FortiGate, #Shaping #Policy

How to make a sec vpn tunnel failover 2 ISP ( Internet Service Provider ) to azure vpn if primary ISP down automatic switch to secondary  ISP Internet ?

Hello! I'm working on an exciting network improvement project to implement High Availability (HA) in my environment by adding a second Fortigate appliance. Currently, I have a single Fortigate 80F that's efficiently managing two WAN interfaces through SD-WAN. This setup allows me to create custom rules for routing specific devices through different WANs and provides automatic failover if either ISP experiences downtime. I would need to enhance this setup by implementing a second Fortigate appliance to ensure network continuity even if one Fortigate unit fails. I'm curious about the best approach to achieve this - would it require any additional hardware like switches? I'd greatly appreciate any guidance on implementing this redundant setup.  

Dear Members,OS Segregation is required on specific VLAN, which has AP connected. Only android and iOS users can connect to that specific AP but not windows and linux users. 

Hello,I have a new FortiAnalyzer on Azure cloud and I've attached 2 data disk 1024GiB each.On LVM info I can see only the disk 1 with 1024G, why? I expected to see 2 disk with 1024. Note: Another FortiAnalyzer on Azure with 2 disks (Disk 1 1024, disk 2 4096) are visible on lvm info

I would like to monitor the data usage of the SIM cards in our FortiExtender. I can see this in the GUI of the Fortigate Firewall. Does anyone has an idea how I can achieve this? We use zabbix as monitoring tool.

We use VXLAN over IPSEC with multiple VLANs and the current configuration is working. https://community.fortinet.com/t5/FortiGate/Technical-Tip-VXLAN-over-IPsec-for-multiple-VLANs-using-software/ta-p/195488https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-setup-a-VXLAN-over-IPsec-deployment/ta-p/297665Yesterday, I noticed that I make a mistake with the configuration of the ipsec interface.FGT A  set remote-ip 172.16.0.2 255.255.255.0FGT B  set remote-ip 172.16.0.1 255.255.255.255Is it possible to define a /32 subnet for the remote ip on both sites ?Thanks!

 Hi everyone, I could use some help today. We're experiencing some unusual WAN latency issues. We have a setup using a pair of FortiGate-120G and FortiGate-100F devices with a WAN configured in LACP with 2x1Gb links. The network connection is structured as follows: WAN ISP (LACP 2x1Gb) <----> 120G (in Transparent mode on VDOM) <----> 100F <----> LANWhen our WAN traffic increases, we notice a rise in latency, particularly visible with ping probes. Could this be an issue with the ISP, a security profile, or something related to NPU offloading or ASIC processing? Thanks

Please can anyone provide a brief description of what STP MODE within the FortiAP configuration is supposed to do when it is enabled? If it is related to Spanning Tree, how does the mode operate when spanning tree is also configured on the switch port is connected to?

FortiPAM - Is FortiPAM support HSTS settings?

I have done nse 7 public cloud security and nse 7 firewall before as everything is restructured. I am planning to undertake nse 7 public cloud security soon and nse 7 enterprise firewall and SDwan later.  As certifications have been restructured, will nse 7 cloud keep all my other certifications alive? #nse

I would like to block some URL on URL filter , because they are youtube video download tool.I have added 5 URL today , like "freemake.com" , "getyoutube.com" , "zeemo.ai" already blocked successfully.But "yt5s.io" , "x2download.app" , both of them couldn't block successfully.....  BTW, I have tried to use "content filter" to block theses website , but it was not successful too, I don't know why...

Good morning everyoneI recently entered the fortinet world. I have a Fortinet-VM02 that gets the default route via BGP (configured on port3) from our main router. On another interface (port4) the static public IP announced via BGP is configured. Port4 is the WAN port that will provide connectivity to our servers. I have to let the traffic generated by the firewall itself (output) exit from the IP of interface 4 instead of 3 otherwise the firewall does not renew the license or other services that require internet.the firewall obviously exits from 3 indicating the IP of interface 3 as the source addressThe forward traffic is ok, the VMs connected under port 4 navigate with their static IP belonging to the /24 subnet announced via bgp, the problem is only the output traffic of the firewall itself.thanks to whoever will answer me

Good morning, we purchased 2 FortiGateVM-2 licenses On the first machine we purchased the FortiCare / FortiGuard subscription while on the second one we did not.When we put the two VMs in active/passive HA we lose the FortiCare subscription also on VM1 Why?

Hi,I want to generate a specific FortiAnalyzer report as a PDF file, which contains all policy changes of my in total 10 fortigates. Each fortigate has in total 5-10 policies. My ambition is to get an monthly automatic generated PDF report of all policy changes from all policies and fortgates I've done during this time. The report should list the following issues: Policy ID, Device ID, Device Name, Source IP, Destination IP, Source Interface, Destination Interface, Action, Log ID & the Timestamp of the change. So I've seen in the FortiAnalyzer, that there is no pre-generated report like that.I know this report is possible with SQL code/ dataset only. So I've started a small and non finish SQL code because I'm a SQL beginner. This ist my SQL code currently:  My question is, can anybody complete my SQL code so that all issues are included and the validation without any warnings?And can anybody explain me the nessecary steps and settings I've to do in FortiAnalyzer

Hello When my Fortimail 200E device boots, I only have an option to press F2 or F10 and nothing else.Seems like the HDD and Cache was formatted. How do I go about reloading the .out file if no TFTP menu option is available? Thanks

need to change the password policy on some FortiGates.  That part is pretty straight forward.  Am curious as to what occurs after.  Are existing passwords still accepted, or is the user forced to change their password on the next login?  Mainly curious as to how this affects the local admin account.

Hi,I have configured an Application Control profile and applied on a firewall policy. The application control profile have "block applications detected on non-default ports" enabled. However, when I run Telnet on other ports than 23 the traffic is allowed and it's also detected as application Telnet according to the logs on FortiGate.I have verified that the traffic is hitting the correct firewall policy.I am running FortiOS 7.4.5.Please see my configuration on attached pictures.What am I doing wrong? Shouldn't this traffic be blocked?

Hi all, I have a requirement to connect multiple VRFs using PPPoE credentials on different vrfs. The issue is that the PPPoE all need to be in the same VLAN and VDOM if possible. How can this be done as I've come against duplicate VLAN ID errors when trying to set it up?

Hello Fortinet Community!We’re experiencing some intermittent and location-specific issues with FortiClient EMS (v7.2.4 build 0983) and FortiGate 60F (v7.2.10 build 1706) after upgrading our FortiClient licenses from the free to the paid version with EMS implementation. All endpoints are macOS devices running different OS versions. I’m hoping to get insights or solutions from anyone who has encountered similar issues.Current Setup:Implemented FortiClient EMS with endpoint profiles configured for Remote Access, Web Filtering, Malware Protection, and Vulnerability Scanning.Both On-Fabric and Off-Fabric rules are configured, primarily distinguishing internal subnet access (10.10.X.X/24 for internal users).All endpoints are Mac devices and are not connected to an AD or DC; endpoint management is done solely through FortiClient EMS.Issues:Google Chrome Profile Logouts & Missing Bookmarks: Some remote users report that, when the issue occurs, they’re logged out of their Google profile in

hi we are using 2 600E in ha cluster, and today lot of complaint were received from end users that services got stop working. when i login on firewall the error was displayed as per subject and memory graph was in between 82-85%. We never faced this issue before so after few googling we tried to disable IPS but this did not help out (may be take some time to get memory down), so finally firewall was rebooted and secondary firewall becomes primary, memory goes at 67%.and everything start working fine.  can somebody please suggest1) how can we prevent this in future as our env is a very critical and cant afford any downtime due to this issue2) how can we generate an email alert if conserve memory threshold value exceeds 75% or is there any way to prevent this error occurring again?2) can we add more memory to device?

Dear all, Is there any option to configure in order to automatically fill the field for the Zero Trust Telemetry after installing FortiClient EMS Agent without entering it manually ? Thank You#FortiClientEMS 

Hi allI have a problem with the FortiAP 221EI have a fleet of 50 FortiAPs on different networks interconnected in MPLS.FortiAP management is done via a FortiGate 600E and a FortiManagerThe FortiAps are all in 7.0.6The FortiGate is in 7.0.11The FortiManager is in 7.0.7Here is the problem :For some reason that I cannot identify, from time to time (on average one to two terminals per week), the terminal no longer responds to a ping with a packet size > 1500. Example ping –l 1800When the problem occurs, I test the ping from the terminal's LAN, to rule out any MPLS fragmentation problem.This makes the terminal unusable for customers (out of service captive portal, out of service PC authentication, etc.) anything that uses SSL no longer works. They therefore become unusable. On the other hand, a normal ping (< 1500) continues to work.When this happens, I reboot the terminal (via the FortiManager or via the web interface of the terminal) and after restarting, the terminal is OK, the fra

Hello, I have a FortiAP 431F. I would like to use 5Ghz for both radios but it doesn't appear to be possible. I tried to create a new profile with the same and a different platform to see if that would work but then I can't apply the different platform profile to the 431F. Any ideas?