Support Forum

Hi So we had a test AP setup in Fortigate under a physical interface with a guest and a staff WIFI setup - all worked correctly and correct DHCP IP assigned. I have since connected a Fortiswitch, i have created a new VLAN and took the IP address and range from the existing physical guest VLAN and used that on the new fortiswitch VLAN (then changed the address on the physical)the AP is up + online, I can see both SSID's, but when I attempt to connect to the guest WIFI I get a random IP address on the wrong subnet an the device never connects.....log states 'Wireless station DHCP process failed with no server response'  I have adjusted all policies to allow traffic as far as I can see. Any ideas? Thanks.  

Hello All,Could you kindly assist with a document or guide from Fortinet outlining best practices and recommendations for hardening the configuration of a FortiGate firewall, specifically for the 60E model? I'm particularly interested in configurations involving services such as Malware Protection, IPS, Antivirus, URL filtering, DNS filtering, VPN, Policies and other security features.Your assistance is greatly appreciated.

Hi, After configuration, I would try to login to the Forticlient VPN 7.4.0 with my account. But the sign in pop-up is redirecting to the email login again and again. My PC is Windows 10.What should i want to do. Redirecting pop-up Thank you,Chaniru Manamperi

Dear All,I would like to migrate to a stacked vdom with the root learning a BGP default and relaying this to around 10 sub-vdoms via an inter-vdom link with an iBGP peering across the inter-link. I need to get around 10-15 Gbits though the platform as a whole with Jumbo frame support and I'm running the v6.0.3 train. Having prep'ed the config, then I read that my 1500D platform would not be hardware accelerating any more than 2x links.  As an alternative, I believe I can patch fibres between some of the physical ports and land these into different vdoms using 1.q subinterfaces. For resilience and improved speed, I would also like to make this a LAG. Could anyone tell me please:1. Is this approach of trunking multiple vlans across a physical cable for the physical inter-vdom link viable?2. Is LACP possible between the vdom and are there any concerns like mac address or system id?3. I use FGSP (and have a longer AS_PATH via the standby unit), is this compatible? 

Dear Hi,Fortimanager 7.4.4 VPN manager Portal settings changes are not shown in the install wizard the changes are not shown in the install wizard unless I remove the SSL VPN portal from the device in the SSL VPN settings edit the portal then add it again to the firewall. 

Good morning, We have an issue that showed up this week (Tuesday) with two users VPN'ing from home.  They are getting a "The server want to connect to requests identification, please choose a certificate and try again. [-5]" error.  Interesting thing is that I don't require nor have we set up client certs for SSL VPN and it's only 2 users out of about 15 right now that are getting the error.  We are running a mix of Forticlient versions (6.0.9, 6.0.10 and some 7.2 versions) and don't have a support contract on the clients.  Another interesting thing is if we uninstall and remove it completely from their PCs  (Windows 10 and 11 are the two OS's) and install a new version as a test, it gets the same error.  Also...using a different Windows profile fails as well.I found this article and followed the instructions and it's still not working: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-solve-The-server-you-want-to-connect-to/ta-p/1

This is lab work. I'm clustering 2 VM to simulate a customer environment. I have some 60day licenses of FGWhen I bring them together, they do not sync due to some config differences on the new unit ( dns and a few interfaces ).1) is the a way to force the established unit just to overwrite the new one ?2) In accordance with FortiGate's guidelines, I factory defaulted the new unit, but at this point, the serial number changed and the licence was lost. Any attempt to restore the licence now fails ( probably as a result of the new serial number ).  Any guidance on how I can progress is much appreciated. FortiGate-VM64-KVM # execute ping service.fortiguard.netPING guard.fortinet.net (208.184.237.61): 56 data bytes64 bytes from 208.184.237.61: icmp_seq=0 ttl=45 time=146.8 msRequesting FortiCare license token:xxxxxxxxxxxxxxxxxx proxy:(null)Forticare response error 58.Failed to download VM license.

I can not get this figured out.  I’ve got a FortiGate running v7.2.9 (also tried with v7.2.8) and I’m trying to configure our SSL VPN to use an external DHCP Server to assign our clients IP addresses.  I followed the instructions outlined here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-with-external-DHCP-Server/ta-p/215644 The SSL VPN Clients are able to connect to the VPN and do successfully obtain an IP address from our DHCP server, along with the correct DNS servers, however, the clients are not able to access anything at all once connected.  The clients get assigned the proper routes to get to our internal LAN and WAN (confirmed by checking print route on the clients), so no problem there.  I have firewall policies in place to allow traffic from the SSL root to the LAN and WAN.  Nothing is showing up in the firewall logs as being blocked and the hit count/bytes are increasing (indicating the policies are being hit).  If I d

I have a Fortigate F2K60FTK21900432 Fortigate proxy.We have explisit-web-proxy policies that we normally use and its logs are sent to FortiAnalyzer . example : But we also have the Implicit Deny policy found in Firewall Policy. My problem is that the logs of the latter (Implicit Deny - Firewall Policy) appear in FortiAnalyzer and I do not want to have them because they generate confusion when analyzing the traffic in Fortinalizer.Question: how can I prevent these logs from not being sent to Fortianalyzer.Thanks for your help team   

Hello,How can I block only FaceBook Games and not entirely FaceBook? It is running latest FortiOS v6.2.3 build1066 (GA)Thank you!

HelloI see in admin guide that ZTNA tags can be with with SSL VPN to filter the traffic based on tags, but I don't find the same with dialup IPsec VPN.Is it officially supported?

Hello community. We are implementing fortigate in the OCI cloud. We have seen several tutorials that indicate that for each network I want traffic to be sent over the fortigate I need a VCN.My question is, can I create 1 single VCN Spoke and there have all the subnets I need making the traffic go through the FW. I have tested with the above configuration and sending traffic between subnets in the same spoke VCN but the FW does not do policy validation, it sends the traffic directly.

Hi! we migrate our PaloAlto firewall to Fortigate this summer (VM64 in a VMware environnement with OVH)We have some tickets already open with the fortinet support. One of the biggest problem is corrupted files over VPN.We have programmers that make backup of SQL BD, then download it to the workstation to work on it.Sometimes, the file can get really big, 20GB - 30GB or even 50GB. When we try to download over VPN there's a 50% chance that the file is corrupt. The download is completed but the checksum give an error.We try different version, 7.2.3, 7.2.4, 7.2.5, 7.4 , with or without EMS, even the free version. The policy on the firewall dont have any security activated or shaper. We have a site with a IPSEC-VPN tunnel to the same server, and there's not corruption with the same files and the same computer. Fortinet says that they never seen this! We think there's a problem between the VM and the VMware setup but not sure. Does someone had this kind of

I am facing an issue with the captive portal after updating Google Chrome. I am attaching a screenshot for reference.Help please for solving the issue.Regards,Ashik

Hello all,Our Fortigate 101E is running FortiOS 6.4.15. I understand that 6.4 is end-of-support soon, if not now. I'm wondering which version of 7.x to go with. Any recommendations? Which one is the most stable? Thanks for any input. Rod

Hi Community,I am trying to set up HA for my two FortiGate VMs running on VMware environment on OVH cloud dedicated servers. The FortiGate VMs are running on diffrenet datacenters in OVH.Problem I am running is automatic move of the WAN/failover IP from one dedicated server to another. OVH recommends use of:Custom script to detect downtime on one firewall and move the IP  via API (API failover IP move takes about 50-55 seconds to finish which means i will have up to 1minute downtime)Common Address Redundancy Protocol or CARP. (They don't seem to know if this works with FortiGate or how to set it up)My goal is to achieve active-passive failover between the two FortiGate while maintaining the same public IP.There is no issue is configuring the VMs from the VMware side to accept promiscuous mode, issue is on the cloud provider on how they handle the WAN/failover IP.Question: Has anyone encountered such a design? Is CARP feasible? Any

Hello,How we can enable automatic backup for fortinet firewall?

Hello, How we can enable the Remote Access VPN to be always ON without use Forti paid version?

We were trying to configure a Fort-Extender to our Fortigate for a project and could never get things working. So now we just want to use it in Standalone mode.  Despite doing multiple factory resets, the LAN switch settings cannot be changed from the default and one of the ports we used to connect it originally to the Fortigate cannot be changed in the web config. For references, I am seeing for example "system/management/fortigate" which it looks like I cannot remove.  Should not a factory reset remove all of this?

Hi Team, I want to setup the server for FSR Agent on Rocky Linux 9.3 version and there it has three ISO image options  1. Minimal ISO2. Boot ISO3. DVD ISO Which one will be preferable to use for FSR Agent machine spin up.   Shashank

How to access Gui Fortigate using FMG IP, just change the port on URL according to FortiManager IP

how to configure fortilink nac quarantine vlan?Configuration with fortilink nac works fine wireless and wired. onboarding vlan does the job well. But here is the point I can't understand. we are broadcasting single ssid. The device I define nac policy with the device mac address gets ip from the relevant vlan and accesses it. But how do I ensure that the device that I have never defined automatically receives ip from the quarantine vlan. because the device that we do not define cannot receive ip when connected to the relevant ssid. 

Hi there I've set a new setup up and created the SSID, and allowed access with the checkboxes.Also in the Fortigate Settings allowed listening to the services and SSID. Somehow i can't access the fortigate when i'm over FortiSwitch and FortiAP. Do i have to allow something else? my goal is, that from the internal SSID we should have access to the fortigate. And the SSID Guest don't. Kind regards

Hi, I just like to seek a help regarding on my ongoing troubleshoot about using the FortiNAC Captive Portal Login using azure AD athentication. I already follow up this steps but its seems is not working on my end Overview | FortiNAC-F 7.2.0 | Fortinet Document Library . The scenario was if the user wants to connect on Wireless connection user must have their AD account to join on the network. BTW our all product are Fortinet, Fortigate Firewall FortiAP,Fortiswitch, and FortiNAC. @ebilcari Thank you!@.>

to IT gurus.   What must be done on the Aruba switch port in order for Fortiswitch to initiate?As of right now, the Aruba switch serves as our lone connection to FortiGate while we work to manage a new Fortiswitch. See the following quick topology. Fortigate connected to Aruba ( Trunk port  Native Vlan1 ,)Aruba  ( Trunk port  Native Vlan1 ,) connected to Fortiswitch (Port 49 trunk, Native vlan1)Fortigate sees the Fortiswitch and Athorises it however its status : "offline",  "port disconnected" Logs from Fortigate:  Switch-Controller authorizedCAPUTP session status notificationSwitch-Controller Tunnel UpSwitch-Controller Switch Sync Error    - Message global-lldp-settings failed:-13Switch-Controller Switch Sync Error - Message global-lldp-profile failed:1Switch-Controller Switch Sync Error -Message qos.dscp-map failed:-7621NAC MAC cache sync - NAC MAC cache cleared on switch S14xxxxxxxxx port (null