Support Forum

 Hello,I’m using FortiClient Console on macOS with FortiToken for 2FA, and I have a small suggestion that could improve the user experience. When the Token window opens for entering the FortiToken code, it would be a significant improvement if the input field were automatically focused. At present, the user has to manually click the input field with the mouse, which, while minor, becomes frustrating when repeated multiple times a day. It’s also somewhat redundant, as I’ve already selected to connect to the VPN and am ready to enter the token—why should another action like manually focusing the input field be necessary?

New FortiAnalyzer installation continually restarts the Setup Wizard (FortiAnalyzer Setup) after every reboot. VM Trial License Serial Number FAZ-VMTMXXXX4303 Description N/A Partner FORTINET Product Model FortiAnalyzer VM License Number FLVMSXXXXX91497 GB Logs/Day:1 Registration Date 2024-10-10 IP Address 10.202.10.52   The license number above doesn't match any license number that I have received from Fortinet. When I try to add a Contract Registration Code for the FortiAnalyzer provided to me in Asset Management, it indicates "Contract cannot be applied to this product.", although it is  valid FortiAnalyzer VM Security Automation license.   The FortiAnalyzer Setup continually asks for registering. I will say that the Configure Backup step, I am turning off Automatic System Backup.

Hello everyone, I'm currently optimizing my FortiGate VM02 setup and I'm considering two options to improve network performance. I can have a dedicated physical network card for my VM02 and I'm debating whether it's better to:Use PCI pass-through for the network card.Implement SR-IOV.Currently, my VM02 is using virtual Xen Server interfaces, but I believe one of these two options could provide better performance. Does anyone have recommendations or experiences with either configuration in a similar environment? Thanks in advance for your advice!

Hi We have a few FortiGate appliances managed by 1 FortiManager. i need to create a large number of IP subnet objects, which will be shared by more than 1 of the FortiGate appliances. Is there a way to import objects? I know on a Fortigate itself, I could cut/paste the commands in the CLI. So, is there a way of doing this in the FortiManager cli?Many thanksRoy

Hello everyone, First time posting here, and I did try searching but didn't get any hits on this issue. My agency is preparing to migrate from a primarily Cisco environment to Fortinet. My section, our jail, will be the first of our larger areas to do this, and we are moving our wifi from a virtual Cisco controller first. Our new access points are 431G's and require bt POE power. Due to this and having our Cisco switches still in place, we are setting up some temporary switches in standalone mode to run those. It was either that or having to run a second network cable or install separate power supplies. We have got everything sorted out to do this, but I found a curious issue once that was done. I have a Fluke Link IQ for some time, and love it since it can provide VLAN info along with all of its other benefits. Well, it did anyway. When I read a port on the Fortinet switch, it does not report back a few different things that it did before. It will not provide the IP address of th

I am currently using Railwire internet with a Syrotech router, and when connecting to the VPN through FortiClient, I am encountering an error message that says "Backup Routing Table Failed."Could you please help me understand what this error means and how I can resolve this issue?Looking forward to your assistance.

Hi, I am currently working on SAML authentication using OKTA for our fortigate admin accounts and following this KB:Configuring SAML SSO login for FortiGate ... - Fortinet Community At the bottom part of it, it mentions:If a test is performed via Okta Application directly, it will fail with a 'Bad request' error message. That occurs because the SAML assertion does not have the proper payload. Is there a workaround for this?We want to directly access the FortiGate via Okta application. Thank you!  

Dear all, I have a firewall where I configured SD-WAN on WAN1 and LAN3(WAN2), I was asked to configure the firewall so that it would send an email notification if either of the WAN is down, i tried from the security fabric -> Automation but it didnt work. Any advice?

Good morning , guys I have fortigate in my headquarters , and now I'm going to close a VPN between this headquarters and branch , the question and I believe not but it does not hurt to ask with this tunnel I can use Fortinet Singles Sing On agent configuration that is in my AD . Or will I have to create Webfilter and application Control separately for this firewall ?

Hi, We need to be able to allow connectivity from devices on a Guest network (subnet 192.168.50.0/24) to a server hosted internally on the LAN (subnet 192.168.5.0/24 - server IP 192.168.5.245 port TCP/48082) but it needs to be able to be connected from via. the external IP address (125.x.x.x)How can we set up policies and objects to allow this? We already have a VIP in place to allow connectivity to the server from the Internet and this works well. Appreciate your insights :)  Thank you!

Hi,Could you please provide advice on how to setup an email alert if a local client device on LAN goes offline using automation stitch or similar? Is this possible?Articles that Im looking into.https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creating-automation-stitches/ta-p/190594https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/351998TIA :) 

Dear Team, Anyone can help me the command which I have written here and description is correct. Please guide me. I am writing this post for the sake of knowledge, As I was trying to access https://www.fortinet.com from LAN machine. I just want to check which policy is using.diagnose debug enable (to enable debug)diagnose debug flow filter (addr,clear,daddr,dport,negate,port,proto,saddr,sport) (to filter source/destination address)diagnose debug flow show function-name enable (not aware of this command)diagnose debug console timestamp enable (not aware of this command)diagnose debug flow trace start 100 (it will start capturing 100 packets)diagnose debug flow trace stop (to stop capturing the packets)diagnose debug disable (to disable debug)diagnose debug flow console enable (not aware of this command)diagnose debug reset (to reset debug, may ealier debug command used)Go to LAN machine and try to access - https://www.fortinet.com 

Hi, I have an issue where I create an IPSEC Tunnel to a Cloud server, the tunnel is up but local LAN cannot reach and ping to remote site. After checking the traffic, somehow the traffic is going through the DMZ interface which we currently not using and down. After we add the DMZ IP segment to local address on FortiGate, and add to remote on the Remote cloud, we can reach and ping between the sites. I want to know why it still going through DMZ IP segment even though we are not using the DMZ port and it currently down? Our device is Fortigate 100F, version 7.4.4

I recently bought a Fortigate 60F, two FortiSwitches and a number of FortiAPs to upgrade a small Dell/Sophos network at a small campus. While setting up the devices in the lab, I found that I can't use both A and B ports (with the Foritlink symbol) on the Fortigate at the same time. Regardless of which port (A or B) and which switch you connect first, the second port will not light up. Therefore  Fortigate System - Fabric Management can only see one switch at a time.  I was using port 24 of the switch to connect to the firewall per instruction label on the switch. I also tried just connecting to any port on the Fortigate and changing the port mode. I don't have the firmware versions at hand but they should be fairly recent. What's going on? Can't image  something this simple to not work. Can someone help?

Hello Experts, This may be a basic item.Why is Loopback Address necessary at SD-WAN?Is it used for SLA? If SLA is not important, can we omit it? Thanks in advance, 

Currently we are having Fortigate VM deployed in AWS in different regions.We have only one port configured for HA-SYNC between two fortigate VM as shown in this diagram. https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/aws-administration-guide/229470/deploying-fortigate-vm-active-passive-ha-aws-between-multiple-zones On the diagram it was given with 10.0.2.11 to primaryand 10.0.12.11 to secondary Question :Can we configure another HA-SYNC interface (for eg: port6) on the same subnet range as Port4 as shown in diagram above. Below will be the configuration 10.0.2.12 to primary with port 610.0.12.12 to secondary with port6  

Hi,I'm trying to use: "Diagnose debug traffic interface" to see which interface got monitor-bandwidth enabled.it gave me 25 interfaces(the limit numbers bandwidth monitor can enable) but some of the interfaces that don't exist on the Firewall. 

In this post, we attempted to create, collect, and integrate all aspects related to FortiGate and FortiWeb equipment updates. We explored which databases are used in which modules, how updates are performed, what logs are generated during updates, how to check for the latest update version, and the associated risks of these updates. High resolution file in this link:https://www.linkedin.com/posts/nadiamirhossein_fortigate-fortiweb-update-activity-7250886613818392576-ULj9?utm_source=share&utm_medium=member_desktop   

Hi all,  I am having issues syncing configuration to my managed FortiSwitch devices. Currently, I am running FortiOS 7.4.4 and FortiSwitchOS 7.4.2 and when issuing a execute switch-controller get-sync-status all I get the below status, MAC and REST API login error.  FGT01 # execute switch-controller get-sync-status allManaged-devices in current vdom root:FortiLink interface : fortilinkSWITCH-ID (SERIAL) STATUS CONFIG MAC-SYNC HTTP-UPGRADESwitch-A (SN12345667785654) Up Error Error -[1] command: https://10.10.10.1:443/api/v2/login payload: result : REST API login failed with error 60Switch-B (SN41233434554657) Up Error Error -[1] command: https://10.10.10.2:443/api/v2/login payload: result : REST API login failed with error 60 I have another setup in a different location running the same version except the only different is that the tunnel-mode is set to com

I'm trying to set up one-to-one source NAT policies in Fortigate 7.0.12. Unfortunately, I'm unable to use the interface IP Address or dynamic pool. It specifically needs Stay Updated on the Latest Development: At GBGenie, https://www.gbgenie.com/ we keep a keen eye on the latest advancements in the world of WhatsApp mods. Our dedicated team ensures that you have access to the most up-to-date and feature-rich versions available. Stay ahead of the curve with our regular updates and news on WhatsApp mod development. to be a one-to-one NAT as per the destination network policy.Could someone provide guidance on how to achieve this? Your insights would be much appreciated!

I run a small MSP, I have about 15 FortiGates out in the field, a mixture of 40F's and 80F's. Since upgrading to 7.4.5, I've seen 3 of the 40F's go into conserve mode and stop routing traffic until they're rebooted.Any confirmation from others?May have to back these down to 7.2.10.

Hey guys, I'm in the process of creating a new website for my agency. I'm using Framer to do that, the website is hosted on porkbun. I've just sent the draft to my friend to get his feedback and he's told me, that he cannot access the website, because it is being blocked by Fortinet.  The whole message is as follows:"the domain is in the category Newly Observed Domain. Your FortiGate Administrator has blocked this category". And then another pop-up, saying: "You have tried to access a web page that is in violation of your Internet usage policy".Since we are just building a marketing agency web page, it's important to me as a business owner that all of my potential clients can access our website. Please help me to fix this issue.

Hello, I'm trying to create a VTI VPN Tunnel between Stormshield and Fortigate. My VPN is up but I can send other traffic than my trafic selectors. I have attached a schema which explain the architecture and network traffic capture in forti's port1 and ipsec vpn tunnel. I see echo request and echo reply in tunnel but the echo reply don't appear in outgoing ESP traffic Thank you for your help ! AhmedT

Hi, I have an HTTPS virtual server using HTTP load balancing. I have 2 addresses directing to 2 different web servers on the same port, pass.domain.com to 192.168.1.1 and ssl.domain.com to 192.168.1.2 .Each server has its own certificate but under virtual server I can only choose 1. Is there a way to add multiple certificates? Or any other way?

Hi, is there any way to edit or make a copy of the Default Incident Email Template? and secondd question about it, this Default Incident Email Template dissappear form the list on Settings->System->Email and i am finding a way to restore, maybe is a file but i dont know where is and the name.Any suggestion??