Support Forum

Hi, I want to connect to my Fortigate using its hostname via SSH with PuTTY. However, the documentation only mentions establishing a session via IP address and whenever I try to connect by writing the hostname in the Hostname (or IP address) field, it gives me the error host does not exist. Session is established successfully without any errors if I use the the MGMT port's IP address instead.

Hi,I'm still learning my way around Fortinet products. My FortiAP-231G intermittently goes offline. It has happened 3 times now. The first 2 times I left it (I had to go away) and it came back. This time it went offline on Friday and has yet to come back. I have found and run diagnose wireless-controller wlac -c wtp and can see the last failure : 10 -- Wait Join timer expired. Not sure what this means or how to fix it. The power light goes from solid amber to flashing amber. It have tried restarting the AP but no good. Any help is greatly appreciated. My set up: Fortigate 40F (v7.4.5 build2702 (Mature)),  FortiSwitch 108F-POE (v7.4.2 build0801), FortiAP-231G (v7.4.3 build068). Fortigate and FortiSwitch are connected via Fortilink Below is the full out of the diagnose command: -------------------------------WTP 1----------------------------WTP vd : root, 0-FP231GTF23035041 MP00uuid : 2f582606-e4e5-51ee-94bb-c83fee894696mgmt_vlanid : 0region code :

Hi,I've set the Data Policy for my root ADOM to 120 days for Analytic logs. All my Fortigates are in that ADOM. However, when I view the logs, there are only logs available for the last 61 days. It never exceeds 61 days plus a few hours, even though the ADOM root has 40 % of unused storage. The analytic / archive ratio is set to 75 / 25. Do you know what I'm doing wrong? I'd expect it to fill the storage until it's full or the data policy is met but it doesn't do any of that.I also tried rebuilding the SQL DB. It seemed to be working at first, since logs for analytics reached 61 and 20 hours but after 00:00, it reset itself to 61 days and 0 hours. After the rebuild it freed up some space and ADOM root now even has 55 % of unused storage but is stil not logging according to the policy. Thanks in advance

Hello, I have a fortigate 100 e physical firewall in my firm and when we play some games, we get dropped randomly, but consistently. Sometimes it takes one minute, sometimes 10, 15, but sooner or latter it happens.Some games are fine - nothing happens, others display this behaviour consistently.We are on a domain but the same happens with local users connected through the firewall. I am not sure what settings in the admin panel could interefere with this but help is appreciated.

My issue is that if I have 2 dialup tunnels on a remote gate, each dialup is connected to a seperate ISP, if I lose the primary ISP that is connected to dialup tunnel 1 and dialup tunnel 2 (seperate ISP) picks up the routing, then some routes are discovered on the correct dialup interface, but others show as being discovered via the wan interface.I am not sure what the problem is. See below:  This is in a test environment. The gates are on 7.2.8  Remote Gateconfig vpn ipsec phase1-interfaceedit "advpn_1"set interface "wan1"set peertype anyset net-device disableset proposal aes256-sha256set add-route disableset auto-discovery-receiver enableset remote-gw x.x.x.xnextend config vpn ipsec phase2-interfaceedit "advpn_1_p2"set phase1name "advpn_1"set proposal aes256-sha256set auto-negotiate enablenextend config vpn ipsec phase1-interfaceedit "advpn_2"set interface "wan2"set peertype anyset net-device disableset proposal aes256-sha256set add-route disableset auto

Hello, I am currently attempting a deployment for new Windows 11 PCs; these machines are equipped with Sierra Wireless EM7511 WWAN cards / modems using AT&T physical SIMs. Our deployment requires a split tunnel, using both Netmotion NetMobility Client and Forticlient VPN simultaneously. Over the past weeks we have had nothing but issues, both Windows 11 and Windows 10 based machines (same physical hardware) BSOD / BugCheck a short time after connecting via FortiClient. Initially we were concerned that this could be a Sierra Wireless issue, so as a temporary solution we tested USB modems. These modems perform well until the machines are connected to Forticlient; Once connected within 30s - 5 minutes the USB modem will restart / disconnect albeit no BSOD. This behavior is repeatable and occurs only when Forticlient is connected regardless if NetMobility is connected or disabled. It appears that for some reason when Forticlient is active it causes modems, whether USB or inte

Hi,When SSL-decrypted HTTPS traffic is sent to a mirror port and analyzed using Wireshark on a server connectedto that port, unusual packet patterns are observed.     wan port IP : 1.235.10.153destination IP : 54.84.14.5source IP : 172.30.0.162 It seems like there is wrong with hand shake process, and when I monitor this traffic with Zeek, either the request body or the response body always shows 0. Is there something wrong with my FortiGate configurations, or is this expected situation for mirrored traffic?I need your assist. Thanks.

Im using Fortigate 50E with Firmware FortiOS 6.2.16.FortiOS 6.2 is EOS but Fortigate 50E still supported until 2027 march, what's the reccomendation, should i upgrade my hardware? or it's secure enough?

We are starting to role out Aruba 6300s and are having issues with NAC integration. Currently a switch/port is configured as follows. vlan 50 tagged voice vlan 100 data vlan 210 IOT then each access port will configured as followsint x/x/xvlan trunk allowed 50,100 This works PC and Voice are connected. Now when we enforce this port and connected a rogue PC to that phone. That port configuration is changed from trunk to access and the vlan changes to our isolation vlan. This kills the tagged trunk voice vlan on this port needing us to then reconfig the port manually.  This also happens when say I connected a IOT device the NAC changes the vlan but will change the port to 'access' which then kills the tagged trunk voice vlan.  What is the fix for this on Aruba Switches? I have read FortiNAC cant manage trunk ports and to use access only, but Aruba switch's require trunk port when allowing more than one vlan on port.&nb

Dear All,  We have recently transitioned to a VLAN segmentation configuration from our previous flat VLAN design. FortiGate 201F is in Version 7.2.10.Currently, we have printers located in VLAN 20 and users in VLAN 40. Our network architecture consists of an Internet connection leading to a FortiGate firewall, which then connects to a switch that serves both printers and user PCs. Detailed information:We have an inter-VLAN policy that permits all services between VLAN 20 and VLAN 40, and no security profiles are applied. While devices in these VLANs can successfully ping each other and users can print without issues. The Issue we facing,We are encountering a problem with scanning documents from the printer to the PC using SMB. The strange thing is we don't see any logs at all. We tested within the same VLAN, where both the printer and PC are located within the same VLAN, shows that scanning functions correctly without routing through the FortiGate. Does an

   If you have a source that explains every section in the policies and objects section, please share it with me. The fortinet source should not be shared as the source. I comprehend, but I don't understand. 

Hello,How is it possible that I enable this:Enabled Based on Policy DestinationAnd I still get the IP of the office and not my home WIFI?gameie_Primary # config vdomgameie_Primary (vdom) # edit rootcurrent vf=root:0gameie_Primary (root) # config vpn ssl web portalgameie_Primary (portal) # edit "vpn-rnd"gameie_Primary (vpn-rnd) # showconfig vpn ssl web portaledit "vpn-rnd"set tunnel-mode enableset ip-pools "vpn-rnd-new"nextendgameie_Primary (vpn-rnd) # show full-configurationconfig vpn ssl web portaledit "vpn-rnd"set tunnel-mode enableset ipv6-tunnel-mode disableset web-mode disableset allow-user-access web ftp smb sftp telnet ssh vnc rdp pingset limit-user-logins disableset forticlient-download enableset ip-mode rangeset auto-connect disableset keep-alive disableset save-password disableset ip-pools "vpn-rnd-new"set split-tunneling enableset split-tunneling-routing-negate disableset dns-server1 0.0.0.0set dns-server2 0.0.0.0set dns-suffix ''set wins-server1 0.0.0.0set wins-server2 0.0.

HelloHas anyone tried integrate FreeIPA with FSSO, like by sending syslog from the LDAP to FSSO agent or FortiAuthenticator, or any other method?

Hi,i have these firewall in a test setup (for production) and each has a basic setup.Internal LAN with DHCP, two WAN interfaces, a SD-WAN setup, a single firewall rule for internet traffic.A simple 0.0.0.0/0.0.0.0 static route using SD-WAN and a IP Pool address.IP Pool address 172.17.5.1 with overload and ARP enabled. If i do this on a FG 80F with 7.2.9 i am able to ping this IP from CLI.ICMP is sent from root interface   FortiGate-80F # diagnose sniffer packet any 'host 172.17.5.1' 4 filters=[host 172.17.5.1] 13.410881 root out 172.17.5.1 -> 172.17.5.1: icmp: echo request 13.410891 root in 172.17.5.1 -> 172.17.5.1: icmp: echo request   How would i solve this in a 120G with 7.2.9  FortiGate-120G # diagnose sniffer packet any 'host 172.17.5.1' 4 filters=[host 172.17.5.1] 2.693988 port2 out 85.132.211.22 -> 172.17.5.1: icmp: echo request 3.694028 port2 out 85.132.211.22 -> 172.17.5.1: icmp: echo request   Both, 120G

Hello,I try to configure SAML SSO for WiFi SSID over Captive Portal with Azure AD as IdP.after connecting to the SSID I'm manage to get pup up browser with Azure Login page, after login I received in my Firefox web browser the message "Firewall Authentication Failed" I'm using follow article:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-SAML-SSO-for-WiFi-SSID-over-Captive/ta-p/216020/  What I'm doing wrong ? Please advice. Thanks!

Hi Team,    I am applying Secure communication between FortiManger and FortiGate. The certificates are good and tested properly.    Here are the errors and debugs: FortiManager: 2024-10-28 22:07:06 { "client": "dmserver:907", "id": 30, "method": "exec", "params": [{ "data": { "device": 164, "force": 0, "sn": "FGT70FTK220----9", "sn list": []}, "target start": 3, "url": "start\/tunnel"}], "root": "fgfm"}2024-10-28 22:07:06 FGFMs(FGT70FTK220----9-164-172.16.1.1): server:send:2024-10-28 22:07:06 put authuser=adminpasswd=****** 2024-10-28 22:07:06 FGFMs(FGT70FTK220----9-164-172.16.1.1): server:2024-10-28 22:07:06 reply 501request=auth 2024-10-28 22:07:06 Response:2024-10-28 22:07:06 { "id": 30, "result": [{ "status": { "code": 2, "message": "no permission"}, "url": "start\/tunnel"}]}2024-10-28 22:07:06 Response [unknown]:2024-10-28 22:07:06 { "id": 30, "result": [{ "status": { "code": 2, "message": "no permission"}, "url": "start\/tunnel"}]}2024-10-28 22:07:06 Request:2

Hi i want to know that how can i configure url redirection mean for example if my any client open in we browser www.continentalbisucits.com so he should redirect to www.continentalbisucits.com.pk i have configured Dns server in fortinet but its not working any suggestion what should i do?

Hi Guys, i am have a hard time with looking up specific logs for network events. recently we had few minutes of ISP outage, i can see that in the bandwidth widget (graph showed 0 mbps) but i can't see it in logs. i need something more than a widget screenshot to take it up with our ISP provider. same issue with VPN logs. i can't see clear logs for why user got disconnected, is it drop in internet connection at my end or user's internet? user disconnected? among other such logsis there any way to see this information?thanks,Taimur

it is possible with my u231f access point to use the lan1 and lan2 port in aggregate mode. and take advantage of 2 gbits of bandwidth?? what do I have to do on the Access point side and what do I have to do on the fortiswitch side to do this???

Dear, Is there an option to configure Web Filter Profile and Video Filter so it cannot be always on for BYOD or off fabric devices ? I want to be enabled only while the user is connected to VPN.

Dear all,I'm following the guide in order to setup for the first time the FortiClient EMS with my existing architecture ( FortiGate + FortiAuth).  In the docs (https://docs.fortinet.com/document/fortigate/7.2.5/ztna-deployment/374384/connect-the-fortigate-to-ems) is telling that: 1- I need to generate a cert. By i do have already EMS Server Certificates (FortiCare). Do i need to generate again using a third party such as godaddy since i do not have an CA ? Or this are the defaults one ? 2- How i can publish in the DMZ the FortiEMS ? Thank You in advance#FortiClientEMS 

Hello, I have a problem with simple setup i think it could be a limitation of evaluation license but i wanted to confirm it.     Goal was to monitor and add some polices to home network with forti in Vm   Network Setup and Topology Forti 7.4.5 • ISP Router: This is the primary internet gateway provided by the ISP, operating on its own subnet with DHCP enabled. The ISP router is connected to an ASUS Access Point.i can’t change config of this device • ASUS Access Point (AP): Connected to the ISP router, the ASUS AP  has local network (LAN) on subnet 192.168.50.0/24. It broadcasts Wi-Fi for local devices and is directly connected via Ethernet to a machine with VMware server • FortiGate Firewall (VM): Running as a virtual machine on the server, FortiGate is configured with port1 as the primary interface, acting as both LAN and WAN within the 192.168.50.0/24 subnet. It has the IP address 192.168.50.10 and provides DHCP services, assigning itself as the default gateway fo

We have a site localcounciljobs.gov.uk When going through the web profile for the LAN it doesn't work.When we attempt this on the guest web profile it works. I have allowed this through the web filter - added to custom categories (even though its not a blocked site through the rating anyway) if we access localcounciljobs.co.uk (which is the same site) it works fineBut we need this gov site accessible The error is net::ERR_CERT_AUTHORITY_INVALIDand we cannot advance - it just reloads the page. Any ideas what im missing here?works fine OFF the web profile Thanks

In principal, who should be in charge of PKI infrastructure / CA server? The customer, the MSSP, or some third party providing PKI as a service?The customer (1000 employees) has an IT department, and has until now managed their own CA server for issuing client certificates used for client VPN and WiFi authentication. As part of downscaling their IT department, they're planning to get rid of their CA server. They want WiFi with EAP-TLS authentication delivered by our company, but they don't want to handle the PKI infrastructure themselves.Should we as an MSSP provide PKI as a service to the customer, or should we tell the customer to get PKI as a service from a third party? We are currently testing FortiAuthenticator, but as far as I can tell, FAC cannot be used as a CA server in a multi-tenant environment. There are PKIaaS providers online that could be used, but we currently don't have the resources to handle PKI for customers, even if utilizing PKIaaS on the customer's behalf.Does an

HI, I am planning to move my FortiGate SSL VPN to an external DHCP Server and have the following plan using a loopback interface following the FortiGate document link below. I am unsure if my plan will work and if I have the correct Firewall Policies etc, does it look good? https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-with-external-DHCP-Server/ta-p/215644