Support Forum

Hello, I have FortiGate 176 Device using 2 WAN internet link (3BB,NT,MPLS). I want to make internet usage report, customize wan for each link, how to create report in FortiAnalyzer?Thank you.

Hello FCT EMS adminsAnyone tried EMS 7.4.0 and its client FCT 7.4.0 in production environment?As this is a new release, any feedback on the stability would be appreciated. This will help us choose between 7.4.0 and 7.2.4.

Hello, My infrastructure consists of 2 Fortigate 600E and 40 FAP231F.Recently we updated the Fortigate to v7.2.8. The thing is, with this update, we started having trouble connecting to AP. A few users are unable to connect. In the logs of the AP, I see that they are looping in 'DHCP-OFFER DHCP-DISCOVER'. But if the same user moves around and connects to another AP, it can connect correctly. But if it goes the other way to the first AP, the problem of 'DHCP-OFFER DHCP-DISCOVER' gets looped again. This happened randomly to different APs.If I downgrade FortiGate to v7.2.7, it doesn't happen, but I need to stay in v7.2.8.I don't know what to see more. I tried everything but found no solution. Please, can you help me?Thanks. 

Hi Guys,I having some issues understanding how to configure FortiNAC to authenticate and grant access to guest/contractor users connecting via a guest ssid created on fortiGate.This is what i have setup already:FortiNAC has FortiGate in the Network-->Inventory container (SNMP v3c and SSH v2 connections configured)FortiNAC running both local and proxying RADIUS to enterprise ServerFortiNAC connected to security FabricBridge mode SSID created in FortiGate using external authentication captive portal pointing to FortiNAC URLFortiNAC configured for Guest Self Registration (guests can also be created locally by admin/sponsors)I simply want guest users connecting to the SSID to be authenticated by FortiNAC and be granted access to the wireless network so they can browse the internet. I cant seem to find any configuration examples for this. I see documents speaking to creating Logical Networks etc. The term Model Configuration also comes up, but I dont see this tab for the FortiGate in the

how block youtube access to category music, blog, serie, movie, etc  only access except tecnology

Dear All, We have created an IPSec tunnel between our HO and local location. The LDAP servers are hosted on HO Location and are we login the firewall based on AD user ID. But as soon as the tunnel is up, we cannot access the firewall as well as FortiManager using that tunnel. We have to bring the tunnel down manually to access the firewalls through the LDAP user ID. We have checked the configuration and the routes and also we have tried adding the tunnel to our SDWAN rules as per the requirement but we are facing the same issue. Today, one of our ISP was down and the entire traffic was switched to the secondary tunnel and we could not access the firewall as well as FortiManager. Post the ISP was up, we had to bring the secondary tunnel down and then we were able to access both devices. Please align someone on this call as soon as possible.

This program can be accessed on a smartphone or tablet.Such as Android device , iphone , ipad IOS Devicehttps://itunes.apple.com/app/id1077137248 Android Devicehttps://play.google.com/store/apps/details?id=sg.bigo.live [link]https://www.facebook.com/bigoliveapp[/link] [link]http://www.bigo.tv/new_index_pc.html[/link] I want to Block Application "BIGO LIVE" Thank you.

HI ALL,I configured a site to site ipsec tunnel between two fortigates.site A: 192.168.0.0/24 (fortigate is 192.168.0.1, and FortiAnalyzer is 192.168.0.2) and site B 192.168.1.0/24 (fortigate is 192.168.1.1).Configured phase 2 presenting the two networks, created routes and firewall rules. Everything works fine. Clients from site B reach resources from site A and vice versa.problem: the fortigate of site B does not reach the FortiAnalyzer present in site A (192.168.0.2) unless I create a source ip option in the fortigate of site B from cli:FG70F-(setting) # showconfig log fortianalyzer settingset status enableset server "192.168.0.1"set serial "FAZ-VMTXXXXXXX"set source-ip "192.168.1.1"end Same thing for the Fabric ConnectorFG70F (csf) # showconfig system csfset status enableset upstream "192.168.0.1"set source-ip 192.168.1.1set saml-configuration-sync localend Creating these two options the Forticonnecot and Analyzer work.is this normal? did I do something wrong in the creat

I have an existing FGT 200E (Standalone).  I just purchased 2 new FGT 200Fs.  I would like to add the new FGT pair to the existing network, and slowly move each FortiSwitch and FortiAP from being managed by the 200E over to being managed by the new 200F pair.  How do I go about adding the new FGTs to the network, and slowly move each device's mgmt over to the new FGTs?  Here is my topology.  Everything in the diagram is existing EXCEPT for the new FGT pair and 1024E switches they connect to.  Those are still in a box waiting to be deployed based on the direction I get here in this post.    

I'm running a free trial with Okta, and I'm trying to configure Okta as an LDAP server to authenticate Fortigate VPN users. I have the LDAP Interface set up in Okta already. When I go to set up the LDAP server in the Fortigate, I'm getting an error each time I test connectivity:Can't contact LDAP serverAny suggestions? 

Hi all, We are using FAC for Windows MFA login, which is all good. Now, we have some users using Apple Mac OS and we are seeking a solution for Login MFA like Windows.  Is there any solution from Fortinet for Apple MAC OS to perform MFA login like the Windows agent? Thanks! Potato

Add another hair pulling situation to this fiasco of 1-on-1We're running close to 300 Windows 10/11 acer spin B3's using Fortinet for our Wifi solution on 2 physical campuses.I've updated firmware, adjusted radio signal, etc. and not really seeing any improvement. I've gotten with my ISP to check on their end, and we're getting close to 900mbps down at the modem.The "contractor" that is in charge of managing this part of the network suggested we do only a 5g band on the student network SSID, which has helped, but I feel like it's not a complete solution.This morning I got notice that the Faculty network is slow and sluggish...sure enough, running speed test on that SSID i'm getting 31 down and 28 up (huge difference).Have any of you just set your whole network to 5g and dropped the 2.4 band?

Hello everyone,I’m facing an issue with updating my FortiAnalyzer VM, which is currently running version 7.2.3. I am trying to upgrade either to the next major release or to version 7.2.4, but I keep encountering problems. The VM is hosted on XenCenter.Here’s what happens: when I initiate the upgrade, the VM reboots as expected, but then it powers off instead of completing the update. After this, I see an error message. I’m attaching a screenshot of the message for reference.Has anyone experienced this issue or have any suggestions on how to resolve it? Any advice would be greatly appreciated!Thank you in advance!

So I have some questions about BGP community-listsIs a route-map required to use with a BGP community-list? I have a single Data Center with two 10G AWS Direct Connect Circuits and the subnets on both ends are exactly the same, just a redundant path. What would the community-list on a Fortiswitch look like in this scenario taking into account AWS says to use: "Local preference BGP communities"Anyone can share the Fortiswitch commands of a working community-list? BTW Fortinet Documentation on this matter gives few details of how it is supposed to work or be configured. Where are the examples????https://docs.fortinet.com/document/fortiswitch/7.6.0/fortiswitchos-cli-reference/912449/config-router#config12AWS docs sent by AWS Engineer:https://docs.aws.amazon.com/directconnect/latest/UserGuide/routing-and-bgp.html#bgp-communities-private-transitYou can use local preference BGP community tags to achieve load balancing and route preference for incoming traffic to your network. For e

Dear Team, I am testing FortiPAM 1.3.0 version to integrate with Checkpoint Smart console. When i tried to launch the checkpoint smart console from PAM console it just popups loading and not opening.  Could you please help.    

HiWe are getting the below error while login home page for authentication. Your connection is not privateAttackers might be trying to steal your information from www.example.com (for example, passwords, messages, or credit cards). Learn more about this warningnet::ERR_CERT_AUTHORITY_INVALID Please help me how to address the issue. 

Hello All Can I Upload AutoCAD file using the heatmap file

Hello community,   we would like to configure our fortigate 100F SSLVPN Access with SAML and MS Entra. Unfortunately, we get the following prompt    We use the following MS Node: https://learn.microsoft.com/en-us/entra/identity/saas-apps/fortigate-ssl-vpn-tutorial Is it important, that we use a entra Plan or is the free Version okay? We use M365 business St. 

Hi, Is there any configuration to activate the "Log Search Task" or "Advaced Search..." in Fortimail 6.4.7 firmware version?We need obtain history logs from more than 1 month last, but these firmware version only permit obtain logs from 1 month last.Could you help me with this, please? Thanks for all.Best regards.

This isn't a production environment.  Just playing around at home, but I can't seem to get it to work. I have a 30E with the two built in mobile Fortitokens.  I assigned a mobile token to a local user.  Loaded the App onto my Android phone and linked it via the QR code.  Configured a basic SSL VPN portal. When I login it asks me for a user/pass, then I enter the token from my app.  It gives me an error "Invalid HTTP request". If I disable two-factor for that local user I can login to the portal no problem and access resources. I can't seem to find any logs indicating any issue. What should I check?  FortiOS 6.2.2 on a FortiGate 30E.

Hello FortiGate Community,I have a question regarding my High Availability (HA) setup with two FortiGate Firewalls configured in Active-Standby mode, along with multiple Virtual Domains (VDOMs).In my configuration, I have established an NPU VDOM link and created a policy to enable internet access, which works correctly. However, I encountered an issue when I reboot the active unit. The active unit goes down, the standby becomes active, and I receive an alarm indicating a loss of connectivity to central management for approximately 10 minutes before it stabilizes.To ensure proper functionality, I would like to confirm if the IP address configured on the NPU VDOM link of the active firewall should be the same as that of the standby unit. Should both firewalls use the same IP address for the NPU VDOM link, or should they have different IP addresses?Thank you for your assistance!

I currently have a campus network with a standalone Fortigate 200E. It uses fortilink to manage 25 FortiSwitches and 35 FortiAPs.  I just purchased 2 Fortigate 200Fs that I plan on configuring in HA.  What is the best way to replace the 200E with the new fortigate pair?  I will need the new Fortigate pair to start managing all of the FortiSwitches and FortiAPs. Another option is to leave the existing Fortigate 200E in place temporarily, and add the new Fortigate 200F pair to the network as well.  Then, move the management of the FortiSwitches and FortiAPs to the new FGT pair.  

I work on a Mac (Apple M1 Max, macOS Sonoma 14.6.1) and use FortiClient.app for VPN  (version 7.4.0.1645) access to my work network. When I enter my credentials, a window (see screenshot) pops up very quickly. Previously, it used to wait for me to enter the requested token or approve it on my mobile device. However, now I cannot connect to the VPN service. I followed the instructions in this video, but they seem quite outdated. I tested it on my older Mac, and everything appears to be working fine. I've tried reinstallation several times.Here's my fortitray.log:   20240924 01:03:34 TZ=+0100 [FortiTray:DEBG] VPNMessageBridge.m:491 Request VPN statistics 20240924 01:03:42 TZ=+0100 [FortiTray:INFO] VPNMessageBridge.m:434 Request VPN connect 20240924 01:03:42 TZ=+0100 [FortiTray:DEBG] VPNMessageBridge.m:465 VPN profile: MEH 20240924 01:03:42 TZ=+0100 [FortiTray:DEBG] VpnManager.swift:228 Ignore Secure compliance Check as FCT is not connected to

Hello Fortinet Community, I've been reading https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Configure-FortiNAC-Tags-with-FortiOS-7-2-4-GA/ta-p/255138 on configuring FSSO tags with FortiOS 7.2.4 and https://community.fortinet.com/t5/FortiNAC-F/Technical-Tip-Connector-based-FSSO-vs-Fabric-Based-with-FortiNAC/ta-p/31610on Connector-based FSSO vs Fabric-based SSO.Is it correct to understand that Connector-based FSSO will be deprecated soon, possibly even removed from CLI configurations? Should we be configuring Fabric-based SSO for new deployments instead? With FortiGate and FortiNAC using a persistent agent setup, how can we propagate AD User/Group information to FortiGate without Connector-based FSSO? Currently, with Fabric-based SSO I only receive Dynamic-FortiNAC Tag. Looking forward to your insights!Thank you! 

HiCan fortigate firewall add a feature?A map of Specify MAC Network access actions and analyze the status of  workfor example 【MAC XXXXX】7:00  XXXX7:15  XXXX 【analyze the status】HTTPS     3HGame online  2HShopping online   2H  From China JiangsuThanks