Support Forum

We are considering migrating users from dialup SSL VPN to dialup IPsec VPN. Curious about best practices for optimum security as well as client ease of use. One question involves tunnel vs. split tunnel access. Is this an option when using IPsec VPN. Does all traffic go first to the FortiGate that the IPsec connection is made through, then to the web if the traffic is not local to the FortiGate?

Hello, I need to setup a rule that does this:I have a device with this IP 192.168.250.1 (it cannot be changed) connected to LAN I need to "associate"  IP 192.168.250.1 with a local IP 10.0.3.115.  So when the http://10.0.3.115 is opened the really IP 192.168.250.1 have to respond 10.0.3.115 -> 192.168.250.1.I guess 1:1 NAT and vrtual IP is not right way. Any hint about this? 

Hi, I think I have done something wrong but I'm not sure what was the fault. I have try to authorize a fortiap u421ev on a Fortigate 60D with 6.05 OS, and after I click on the authorize button the FGT tell me connecting and after that disconnected. The problem is that the FAP unit change the led color from blinking green in permanent white, and after this was happens the wan;t boot anymore, no IP in the network, nothing. I connected the console and he is booting in a strange mode. I did not found any specs about recovery. Please help with any idea. This is what is he doing when is booting after "reset" command.   u-boot> reset resetting ... U-Boot 2012.10.esdk.7 (May 25 2016 - 23:26:43 - root@fap-bcm-dev.fortinet.com) DEV ID = 0xcf1e PCIE CFG DEV ID = 0x8025 OTP offset(0x8): 0x78f01c01 OTP offset(0x9): 0xfe200818 OTP offset(0xa): 0xc01b0 OTP offset(0xb): 0x0 OTP offset(0xc): 0x4a00000 OTP offset(0xd): 0xffede230 OTP offset(0xe): 0x1035d17f OTP offset(0xf): 0x3406 NSP25 32bit D

I' m trying to deploy an HA pair of FortiGate-VM appliances under Hyper-V. Standalone they work fine, but as soon as I change HA mode to a-p or a-a, they lose network connectivity on everything except the cluster management port(s), and the cluster never forms. Changing HA mode back to standalone instantly restores connectivity. MAC addresses don' t appear to change, ARP works, but intermittently. I tried all kinds of virtual switches and vNIC settings, but nothing seems to help. I' ve reproduced the issue using build 5.0.6 on Windows Server 2012, and 5.0.7 on Windows 8.1, different host hardware as well. Am I missing some setting that must be configured to make it work?

Hi, i trying download backup a fortinalyzer but i dont see where is the option

Dear Members, can you support, the newly purchased Asus VIVO Book S (Snapdragon) laptop not support Forinet VPN service. while I used windows VPN service it connected but after

Hi,FOS  7.2.8I'm testing my SDWAN overlay link failover and it takes around 3 minutes most likely due to BGP holddown timer 180secs. I've tweaked the BGP timers based on the link below and It takes about 15seconds now for failover. Is there way I can have a failover of 500ms, what timers should I set? Facilitating the fastest BGP route failov... - Fortinet Community Appreciate your feedbacks. Thank you :)

Hi Everyone,I've set up SAML for our SSL VPN, and it's working well. However, I need to restrict access to only domain-connected laptops. Is it possible to achieve this using SAML? If so, could someone guide me on how to configure it? Thanks!

After upgrading from FortiOS 7.4.4 to FortiOS 7.6.0 on Fortigate 100F I cannot modify an interface by GUI because of the following error message:"Invalid DHCP range. Start address is greater than end address."The interface IP address is 192.168.68.2/23 manual mode and DHCP range is 192.168.68.100-192.168.69.254 with subnet 255.255.254.0. On the other hand, I can modify its configurations in CLI. Have no idea what's wrong here?

Hello,Having the following error with FortiClient 7.0.0.0022 apps for MacOS. Connection was terminated unexpectedly. Error -111Thanks to advise.

HelloI have FortiGate 100F I use only one LAN Network 172.20.0.0/16  (PORT1)- clients and servers in same range can I block ping between clients and servers IPI know by create VLANS I can solve this problem but I need to know if there is any way to solve this problem 

Why am i getting this error when i have logged in into forticlound"{"result": {"retval": -5, "message": "Local signin is not available in EMS Cloud"}}

Dear all, I wonder what is the use of the "authoritative" for Fortigate DNS Proxy? Is that feature just stopping users from IP changed with the same Domain name? Thanks!  

Dear all, We get the "problem with SSL comm layer" when try to add FortiToken to my FAC.  We confirm thatwe can ping "fortitokenmobile.fortinet.com" without any SSL inspection here.  Thanks, please advise!  

Recently, mac OS 15 (Sequoia) was released, and I would like to know if Forticlient 7.4.0 version will work normally on that OS.Looking at the Document Library, I still only have mac OS 13,14.Unfortunately, I can't test because I don't have a MacBook.If anyone is using Forticient 7.4.0 for macOS 15 (Sequoia), please replyThank you.  

I have some unused FortiTokens in one of my FortiGate devices, and I want to transfer them to another FortiGate device. How can I do that?

Hello Everyone  I am using 2 x Fortigate Firewall 100F firewall in HA Active-Standby with latest firmware. Both the devices are sync with each other. I have configured both the firewall with Dedicate Management Interface and also enabled SNMP service on it, so Can access both the firewall at the same time. I configured SNMP V1,2,3 and trying to add that device in NMS tool WhatsUp Gold, but always saying credentials failed, I have verified the NMS credentials with FIREWALL and checked with Multiple Auth and Priv and with no Auth-Priv as well, without luck. What might be the issue. 

Was just running through some clean up and auditing some processes and wanted to get some thoughts of what others might be doing in regards of having both ISDB (https://community.fortinet.com/t5/FortiGate/Technical-Tip-Blocking-Potential-threats-over-Internet-service/ta-p/249760?lightbox-message-images-249760=19852iE55DA05DD8C258A4) and Threat Feeds applied to policies and profiles? As inferred by the link provided, I have deny policy tied to those ISDB services but I also have Threat Feeds to my local ISAC (https://www.cisecurity.org/) I am a member of as well as Cisco Talos, for example, that I tie to policies and profiles.  So in a nutshell, do you think FortiGuard is enough for you or do you "cover your bases" with 3rd parties... just in case? (and this is assuming you don't have any resource concerns).   

I have followed the steps from the video tutorial https://youtu.be/YKKKlChsVVY?si=Zn7R65ElK76dbgkkHowever, despite having followed all the steps I get the following error when trying to update time from Internet Time Settings: An error occurred while Windows was synchronizing with X.X.X.X. This operation returned because the timeout period expired. The clock was most recently synchronized on 9/19/2024 at 12:02PM. Every time I click on Update now, I get the same message and the part where it says the clock was most recently synchonized on X day at Y time gets updated to the current date and time. Could somebody tell me what have I done wrong or what do I have to change?

Hi,Are there any way to set it up so that specific users can only log in to the VPN at specific time range?

Is FortiGate 7.2 stable enough for production environment?  Any known major bugs?  I have a simple 4 site implementation using FortiAnalizer, FortiManager, WebFiltering, FortiAP, and FortSwitches.

I feel like I've checked every guide, but not having success.  I'm trying to have DHCP via tunnel interface so I can assign a static IP to a user.  Users are connecting via native iOS client on iPhone/iPad.  When I have phase1 give out the IP, it works fine, I just can't find a way to reserve them.  Any insight would be great!config system interface    edit "MobileVPN"        set vdom "root"        set ip 192.168.50.1 255.255.255.255        set allowaccess ping        set type tunnel        set remote-ip 192.168.50.1 255.255.255.255        set snmp-index 25        set interface "wan1"    nextendconfig system dhcp server   edit 4        set dns-service

I have FortiGates in HA (A-P) but recently when a failover happened, I noticed on the the vdom didnt failover also noticed when looking at the route monitoring on the secondary FG that the connected routes were deleted. only two or three were left.  Not sure what the reason is for this because the FGs are in sync.#fortigate #ha #failover

I've upgraded to FortiGate Cloud Premium and seem to have lost the ability to manage firmware profiles. Is this a 'coming soon' feature or do I need to manage this differently now that I've upgraded?

I am looking for Fortinet documentation on installation and maintenance in a non-persistent multi-session (RDS) VDI environment of Forticlient EMS. Any help would be greatly appreciated!