Support Forum

Hi. Does anybody have an opinion about FortiGate appliances setup in a design where all routing is between sub-interfaces on the Fortilink interface? I call this a "FortiGate-on-a-Stick" design.I am considering the ISP connections for a new install consisting of three FS448E switches in a FortiLink design with two FG121G appliances in HA mode. I will use Vlan sub-interfaces on the FortiLink interface for two ISP DIA circuits as well as Vlans in my LAN.FortiGates-on-a-Stick design Is this a bad idea? Is FortiLink stable enough for this design to be reliable? Does FortiOS prefer to separate Inside and Outside on different physical interfaces for NAT and SDWAN features? 

Maybe other users can take advantage of it, i've created a FortiWeb API Package, downloadable via PyPi "pip install fortiweb-api". Doc/Code on Github: https://github.com/thom-gyger/fortiweb_api.git. I also created an Fortiweb API Agent (MCP server ) to be used with an LLM. Github: https://github.com/thom-gyger/fortiweb_api_agent.git have fun, Thom#api #automation #ai FortiWeb 

HelloIs it normal that FAC 6.6.9 has more known issues that 6.6.8, which in turn has more known issues thank 6.6.7, which in turn has more known issues than 6.6.6?From what I understand, normally each new patch should fix known issued from the previous version, right?

is there way to create script for Windows machines that would make the station to connect to cloud based EMS?There are articles about on prem EMS script that uses the IP of the EMS but in our case we have the EMS in Fortinet cloud and we use invitation code to connect. Sometimes it happens that the station disconnects from EMS and we would like to run the script from GPO to autoconnect to the station. https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-create-a-script-to-connect-Windows/ta-p/271163Any help appreciated.

Hello, we have two FS-424E-Fiber as core switches and two FG-90G as active/passive. As we don't have enough 10G ports, we can only connect each Forti with 1x10G + 1x1G to the two core switches via MCLAG. The problem is that the traffic should of course primarily run over the 10G connection, the 1G only as a passive backup. If I add both interfaces to the Fortilink and deactivate the FortiLink split interface, it is not guaranteed that the 10G connection is actively used.If I activate the FortiLink split interface, both are actively used. Is there a possibility that I have overlooked? Thanks and regardsBjörnar

Background: we've run out of 10gb ports on our switches and need to use on one the Fortigates.Was wondering if it's possible to bridge an existing Fortiswitch VLAN to one of the physical ports on the Fortigate.That way we can take advantage of the extra ports on the Fortigate.

Hello,The Per-Device pane in SSID(AP Manager) have very limited options on what you can set per Mapped Device.The case is that there is multiple location using same SSID name, call it "ABC", on location 1 this does not use IGMP Snooping, Multicast Enhancement and Fast BSS Transition, but on Location 2 these are enabled.Is this possible to do in FortiManager somehow without changing SSID Name? The reason this is wanted is to get multiple location in sync, but they don't necessary have the same settings.

Hi,We are moving to a new ISP, and they have provided us with WAN and LAN network blocks. Normally when we order a new circuit, we get one block with however many available IPs we need.From what I can tell, the WAN block gets configured in our WAN interface(tested this, verified working), and we pick out a LAN IP from our LAN block to use for our VIPs.Is this correct? It sounds like the ISP routes the LAN block to our WAN block if i am understanding this correctly.

Background: we've run out of 10gb ports on our switches and need to use on one the Fortigates.Was wondering if it's possible to bridge an existing Fortiswitch VLAN to one of the physical ports on the Fortigate.That way we can take advantage of the extra ports on the Fortigate.

Hello everyone,Have you ever used Forticonverter Free?https://docs.fortinet.com/document/forticonverter-service/25.1.0/online-help/724941/get-free-license-for-fortigate-conversionIs it reliable?Are there any account limitations?

Recently we noticed the particular firewall traffic received a huge receive date. Is it possible for a single traffic to send around 30 GB of data? 

Hello, after my last Fortimanager Upgrade Source and Destination in Firewall Policy rules only show a few entries, to show all i have to mouseover a "+" character/symbol.This is good for a better first overview, but from time to time a need a screenshot of some definitions, in this case it is anoying since i have no possibility to capture all Hosts/Services/...Is there a way to make it work like in older Fortimanager versions??

When migrating configurations from one firewall to another, do the certificates have to be signed again?

When i try to use the latest version on my Windows 11 Machine or macOS Tahoe machine The FortiClient returns SSL VPN Connection is down, or login failed, access denied I changed the password many times, but the same issue persists.

Dears, I am currently facing an issue while attempting to add a FortiGate VM to FortiManager in my lab environment (EVE-NG).During the probe process, I receive the following error:"FGFMs(probing...): serial number (FGVMEVRAKOOY7JB3) in 'get' message doesn't match the subject CN (FortiGate) in peer's certificate."Based on initial troubleshooting, this appears to be a mismatch between the FortiGate serial number and the certificate CN presented during FGFM communication.Could you please advise on the recommended approach to resolve this issue in FortiManager 7.4.10, particularly in a virtual lab environment?Your support is highly appreciated.

Hello Fortinet Support, We are facing an issue where EMS logs are not being ingested into Forti Analyzer. At present, only FortiClient logs are visible, but EMS server activity/logs are not showing up.Details:Product: Forti Analyzer & FortiClient EMSIssue: EMS logs not ingesting/forwarding to Forti AnalyzerObserved: Only FortiClient logs are displayedExpected: Both FortiClient and EMS logs should be ingested for full visibilityRequest:Could you please assist us in troubleshooting and resolving this? If any specific configuration or version requirements are needed for EMS log forwarding, kindly provide guidance.

Hi Everyone.I have been blocking malicious domain and ip using firewall policy. Recently I configured external threatfeed for ip but couldn't figure out how to do it for domains. My requirement is to call domains in source and destination of the policy for blocking.Is there any way I can do it??

Hi,we have problems to register the trial license for the FortiAnalyzer VM.The device is registered in our assets. But when I try to registered it in FortiCare during initial setup it fails with the error "The product serial number has already been registered". I found out, the the FortiAnalyzer has problem with the connection to server usfds1.fortinet.com.We must use a web-proxy within the company network. Our Fortigates working fine with it but not the FortiAnalyzer. DNS is working correctly.Web-Proxy is set up and the VM is permit in the firewall to communicate with it.The date/time is correct.I also uploaded the license manual.And any other connection seems to be working. Any Idea to solve the problem.

Hi Fortinet Community,We manage FortiGate firewalls for one of our customers with a multi-site setup consisting of one Main Plant and four Branch Plants. In the Main Plant and two of the Branch Plants, there is an additional isolated/internal FortiGate used only for internal communications.RequirementWe need to generate a historical bandwidth utilization report for traffic from one specific Branch Plant to the Main Plant, passing through a VRF interface, for the below specific date/time windows.Required Time Ranges27 January 2026: 9:15 AM – 9:45 AM28 January 2026: 9:20 AM – 9:40 AMTraffic DetailsTraffic Path: Branch Plant → Main PlantConnectivity: Site-to-site IPsec tunnel, running over a VRF interface (specific interface)Reporting Scope: Bandwidth utilization for the specific VRF/interface and IPsec tunnel traffic between these two sitesTools Available: FortiGate + FortiAnalyzer (logs are available in FortiAnalyzer)Output ExpectedWe are looking for a report that includes:Inbound and o

I have my first user trying to connect with her brand new Macbook (home machine) to our Fortigate SSL-VPN. I have a couple dozen Windows users (home machine) connecting in successfully. She gets through I think to the 98% level, then gets an error: Connection error. Can not connect to VPN server. When I look on the Fortigate VPN log, I don't see anything referencing this user. Any help would be greatly appreciated.

Hi everyone, Does anyone already encountered this error "Incorrect certificate file format for CA/LOCAL/CRL/REMOTE cert." when uploading CA root certificate to fortigate? Certificate is from may lab setup Win Svr 2019 as AD/DNS with enterprise root security authority service installed.I'm running 6.2.7 fortigate version.  What I'm trying to achieve is to authenticate thru LDAP server my ssl vpn users thru a secure connection.  I'm just wondering since I already achieved it on latest fortigate version 7.0 smoothly without errors. Am I missing something or any compatibility issues with 6.2.7 versions? Appreciated much your advises and feedback, what causing the error, I'm kinda stock to it. Thank you.

Hello Fortinet team,Could you please help me with my question? I need to configure SD-WAN on a FortiGate, as we have two active WAN links. The goal is for one to function as the primary link and the other as a backup, so that if the primary link goes down, the secondary link automatically assumes internet connectivity. Currently, we have the following configured on the firewall: SSL VPNSite-to-Site VPN (IPsec) Both configurations are associated with the primary WAN. My questions are as follows: SSL VPN: What configuration should be implemented so that, in case of a WAN1 failure, the SSL VPN service automatically switches to WAN2?Considering that the clients have configured their agents with the remote gateway corresponding to the public IP address of the primary WAN. Site-to-Site VPN (IPsec): In this case, the remote devices are pointing to the public IP address of the primary WAN1.What would be the best practice to ensure automatic failover to WAN2 i

Hi Guys, I´m looking for a solution for IPv4 and IPv6 traffic via IPSec that only allows certain clients. (Interfaces are WLAN, LAN or LTE) The prefered soulution is that I can filter the clients with there MAC addresses. I tried it once with this guide: https://docs.fortinet.com/document/fortigate/6.2.0/new-features/485133/mac-address-based-policies But here I cant get a simple ping through the tunnel if I have address group with the mac. (i dont blacklist or something like that) What do I have to do to get this working? (for IPv4 and IPv6)

Hi team,I'm working directly on my Serveur. On this serveur, we deployed a web solution for others users in my office. Sometimes, I need to access to customers's serveurs and I'm using FortiClient 5.4.3.0870 for that.During the remote connection, my Serveur is inacessible for others users in my office ; that means they can't working.This situation didn't exist before we changed the Server's position. (We moved it from building A to building B). I'm not pretty sure this is cause by Forticlient.Do you have some idea? Any helps is welcome.Thanks in advance.Regards**************Bonjour l'équipe, Je travaille directement sur mon Serveur. Sur ce serveur, nous avons déployé une solution web pour les autres utilisateurs de mon bureau. Parfois, j'ai besoin d'accéder aux serveurs des clients et j'utilise FortiClient 5.4.3.0870 pour cela. Lors de la connexion à distance, mon Serveur est inaccessible pour les autres utilisateurs de mon bureau ; cela signifie qu'ils ne peuvent p

When configuring remote_sites.txt for Azure Virtual WAN, the sample file format doesn't seem to make sense.I was wondering where can I get additional info?