Support Forum

Hello, good evening from here. Please, for days now, I've been struggling to setup the FortiEMS license, and honestly I'm feeling like giving up. I don't know if anyone will be kind enough to assist me through, and I'll greatly appreciate it. Thanks 

I have two ISPs, each one has two links feeding a pair of Fortigate 401 firewalls currenty set up in active-active HA.I've configured the SD-WAN and I believe it's working OK.               Here is what I have in my SD-WAN:However, it appears that if I lose one connection from ISP, then the other connection from the same ISP is no longer used as all traffic goes to the other ISP.So a few questions:Is this normal ?Can I have it set up so that if one port is dropped, the other port is still used?Thanks.

Hi All,i need to connect two building with FortiAP outdoor (Distance = 100M).Which FortiAP model should I choose? Thanks

We are facing issue after upgrading the Fortimanager to version 7.6.1, where no data is visible in Fortiview of Fortimanager and showing error as below. Server Error:DB::Exception: Column 'XXX' is not under aggregate function and not in GROUP BY.if anyone know how to resolve this issue.

We are rolling out the IPSEC VPN delivered to Windows laptops using the EMS client. Right now, we have the LDAP authentication for the IPSEC VPN integrated with Duo MFA. Users receive a Duo push to their mobile phones at every VPN login or reconnect.  Does anyone have a better MFA approach that would allow the device/user to be "trusted" for a period of time, so they don't get repetitive MFA prompts at every VPN login? I know there are lots of SSO/Integration options with the SSL VPN, but that appears to be going away, thanks to all the security issues. I can't find one that will integrate via LDAP/Radius with the IPSEC VPN. Thanks!

greetings all,we've being suffering from SD-WAN solution for a long time. Could someone please clarify some concepts in performance SLA under SD-WAN? 1.what is Probe Timeout under Link Status? how it is calculated exactly?the FortiManager says: Time to wait before a probe packet is considered lost (20 – 3600*1000 msec, default = 500)Is the time a round-trip time (RTT) as mentioned below, the RTT being addressed in a common network context? If it is RTT, then is the RTT in FortiGate the same RTT as being addressed in a common network context? Let's say:"The round-trip time is how long it takes for a request sent from a source to a destination, and for the response to get back to the original source. Basically, the latency in each direction, plus the processing time." 2. what is latency under SLA target? how it is calculated exactly?is Latency the same latency as being addressed in common network context? let's say:"Network latency is how long

since I've upgraded to 7.2.10 (7.2.9) before, my HA won't sync - since 14 days. Complained about the DNS-table and nothing helped, so I did a factoryreset on the secondary unit and configured the HA params only. Did a reboot and connected only the HA cables. This didn't help either, 30 tables out of sync (why???).Did another factoryreset and used the same config as on the primary unit and changed only the hostname and the HA priority before that. Restored the config - HA out of sync, this time "only" rule.fmwp and firewall.internet-service-name. Rebooted many times, executed "diag sys ha checksum recalculate" on both units, nothing!Fortinet, what have you done... Anybody else having such annoying sync-issues or and ideas how to get rid of it?BTW, "exec update-now" on the secondary unit failed with code -6, so I connected the device to the internet (isolated) and did a "exec update-now". No errors there but still the same result...

I have been testing the Forticlient EMS upgrade from 6.4. 7 -> 7.0. 11 -> 7.2. 5 for the past few days.I only want to perform the FortiClient upgrade on clients in the office (on-Fabric), and NOT the connected VPN clients.The only option I see is to temporarily remove the Off-Fabric VPN rule set from an existing Policy, and then use the relevant Endpoint group for Deployment.Please let me know if there is a better way to do thisThanks

Fortinet FortiGuard Threat Intelligence, specifically encountering an "Invalid URL" error. Please find the attachment with additional details. FortiSOAR 

We have almost 195 switches in our domain and we need to migrate our switches to FortiLink Manager to continue to build out our network. The only information i can find online and when talking to consultants is that we need to manually migrate the switches. Any one know of a good way to do this without going in and manually migrating? This is a big project with plans for over 300 switches.

I am trying to create software switch and bind the SSID to tunnel wireless traffic. As I read, it is required to have software switch to perform internally pass traffic between VLANs. However; I have uplink ports added to 803.ad as aggregate links to the switches where access points are plugged in.  When I create an interface as software switch, I cannot add the ports that was already added to Fortlink as management therefore I cannot add the ports which already added to Fortilink to the software switch as member interfaces also to pass traffic to the SSID, do you know it is possible in any way to accomplish this add ports already in 803.ad aggregated link? 

We found the issues about httpsd process. I can't to access gui process and I try to restart the httpsd process is not working. because when I entry command  #diagnose sys top // It not show httpsd process.  And I try to kill the httpsd process with command below, but It's not work. I can't access to the gui management of FortiGate  

Hi.i'm doing a poc on forticlient ems for the purpos on using it as remote ipsec vpn and ztna.I'm having problems with the vpn part.right now iv don't the vpn before login (auto part) with the machine certificate and that works fine and when i log in the user certificate takes over, that's fine and working. But when i close the lid on my laptop the computer lock, and when i come back and open it again it's lock and the vpn before login starts and when i use my windows hello and log me in it's stuck with the machine certificate and the user dont takes over.Anyone of you having solved that? Morten

Hello, I aim to get all the traffic of my VPN users on the firewall, except meeting, YouTube, etc. traffic. I proceeded with the information I found on the internet, set my sslvpn portal settings to "Enabled for Trusted Destinations", and left the "routing address override" field blank. I created policies to manipulate the IPs through the policy for the traffic that I want users to not come to my firewall. I wrote youtube etc addresses with negate destination in the policies. When I did these, I expected it to work correctly, it worked but it worked with problems. When I ask for a route to any IP address on the client, it enters the tunnel. When I ask for YouTube, the client uses its own internet output. The problem is that clients are starting to hear our company's 10.0.0.0/8 network from their own internet output. When the "routing address override" section is left blank, do these IPs appear by default? Is there a field to reset this area? No matter what I did I couldn't fi

Hey everyone,I'm working with a FortiGate 40F setup, using an ADVPN with IPsec to connect 1 hub and 2 spokes. For routing internal traffic through the ADVPN tunnel, I'm relying on SD-WAN rules and SLA checks.Just to add some context, I'm using my ISP’s WAN interface as the ADVPN tunnel interface, and it’s set up to get an IPv6 address from FortiGuard. That part is working smoothly—no issues with IPv6 or IPv4 internet connectivity at all.The problem:I’m experiencing a consistent packet loss between 30% and 70% on the ADVPN tunnel interfaces, as indicated by the SD-WAN SLA ping checks. This packet loss is specific to the ADVPN tunnel interfaces, while other connections seem unaffected.What I have tried out:MTU adjustments (to 1380) ~~not workingEnabled FEC on one of the device ~~not workingAre there anything else i should try? I’d really appreciate any insights or advice!

Hi All, I have dual wan setup on my fortigate. Is there a way to set the "WAN IP" in the system information that always uses wan1 or wan2 ip? Thanks regardsJimmy

How can I see all IPs assigned by DHCP for all Firewall vLans? I used pfSense a lot and there is an option in the Menu with DHCP leases. Is there this option in Fortigate?

Hello everyone.I am encountering difficulties with our FortiGate 200E device at the company.We are utilizing the web filter to control content access, however, we are observing inconsistent blocking behavior.Specifically, when Proxy mode is enabled, certain categories of content are not being blocked as expected, despite being configured to do so. Conversely, when switching to Flow mode, the device is over-blocking content and miscategorizing websites. For instance, OneDrive is being classified as an abortion site, and YouTube is categorized as unknown.I have already attempted to resolve this issue by updating firmware, cleaning the cache and implementing new rules, but the problem persists.I would appreciate any insights or experiences that you may have regarding this matter. Thank you.

We’ll be upgrading two FortiGates configured in Active-Passive HA. Is it possible to have one FortiGate running on the upgraded version for testing while keeping the other on the previous version? Or is it necessary to upgrade both FortiGates to the same FortiOS version for HA to function properly? This is a production environment, so I'd like to know if I can upgrade one FortiGate first to test the stability of the upgrade and HA with the FortiGate running on the original version.

Is there a config parameter that I'm issuing that will shut down an existing traffic flow when a firewall policy is disabled?  Disabling the policy stops any new connections but doesn't shut down traffic for an existing session which is what I'm trying to do.  Thanks. 

Hello,I'm having an issue where I'm unable to install both FortiClient VPN and FortiClient PAM on the same device if the customer does not have a FortiClient EMS Server. It seems like there is a conflict between the two installations. Has anyone else experienced this? Is there a way to have both running without needing an EMS Server, or is it a strict requirement for using both features together? Any guidance or workarounds would be greatly appreciated! Thanks.  

Hi!In ACME certificate support see "It must not have any VIPs, or port forwarding on port 80 (HTTP) or 443 (HTTPS)". Since port-forwarding and Virtual Servers are a feature of VIP object, this text is unclear (to me).Does the requirement refer to ALL VIPs (ie. config firewall vip), or only those with portforward=enable?Does the requirement also include VIPs configured with realservers?Thanks!

Hello FortiPAM adminsIs there a way to hide passwords of users' secrets from being seen by the admin?

Recently upgraded our FAZ to 7.6.1 from 7.4 and finding that there are two prominent FortiAI buttons in the GUI. How can this be turned off/disabled at the system level? We are not planning on using it and don't want it showing up in the interface.

Hi, I have three mac airport express and they are in bridge mode connected to my switch, they are working like access point, and we want to use the guest network, is there a way to use it with a fortinet? We have a fortigate 60D. I will appreciate the help, thanks.