Support Forum

Hello all, I'm trying to setup one of my FG's to use iperf3 and the FG I'm trying to use is using port x1 for the WAN connection but I can't pick this port using the command diagnose traffictest client-intf portx1 If I pick any other port it will select that port, but that doesn't help since my fiber is on x1. The port is setup as SD-WAN zone. Thanks  

Hi! On one hand, Fortinet warns "Packet capture can be very resource intensive. To minimize the performance impact .. use packet capture only during periods of minimal traffic ... and be sure to stop the command when you are finished." But, on the other hand, (in 7.0) FortiOS allows almost indefinite execution (only limited by maximum packet count which can take indefinite time to meet.) Using CLI, is it possible to show currently active packet captures on the device (ie. both - those provisioned under "firewall sniffer" or activated using "diagnose sniffer packet")? Thanks, Feren

I want it to work with remote gateway for PS Suite EMR from Telus Health.My laptop is the latest copilot Samsung.I contacted their customer support but they have no answer. ThanksRad

Hi!FortiGate / FortiOS 7.0.0 FortiOS Release Notes introduces:677784Add commands to debug traffic statistics for traffic monitor interfaces (interface), interface traffic in real-time data (peek), and to dump interface traffic history data (history):# diagnose debug traffic {interface | peek | history}without further elucidation. Anyone (esp. Fortinet) can provide clues on use-case and usage? Thanks, Feren.

How to get email alerts of for lost internet connectivity Fortigate 120GI have Two ISP.Pls guide Procedure to configure 

Dear Friends, I am facing the connectivity issue from 172.28.140.10 to 172.47.7.1 w.r.t port 6712.Can you please help  e understand the issue from below debug logs ? 2024-09-18 09:44:15 id=65308 trace_id=35526 func=print_pkt_detail line=5836 msg="vd-root:0 received a packet(proto=6, 172.28.140.10:19311->172.47.7.1:6712) tun_id=0.0.0.0 from Lan-Zone. flag [S], seq 1197133717, ack 0, win 64240"2024-09-18 09:44:15 id=65308 trace_id=35526 func=init_ip_session_common line=6020 msg="allocate a new session-2e378527"2024-09-18 09:44:15 id=65308 trace_id=35526 func=vf_ip_route_input_common line=2612 msg="find a route: flag=00000000 gw-172.28.254.2via wan2"2024-09-18 09:44:15 id=65308 trace_id=35526 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=35, len=13"2024-09-18 09:44:15 id=65308 trace_id=35526 func=fw_forward_handler line=985 msg="Allowed by Policy-345:"2024-09-18 09:44:15 id=65308 trace_id=35526 func=np6_hif_nturbo_build_vtag line=1227 msg="vtag-&

Hi,although I had a talk to tech support, It has developed, that I still have questions to this, while reading  How to control Automatic Upgrades/Firmwar... - Fortinet Community As it says that all FGTs with the free tier forticloudsubscription will get automatic firmwareupdates and you cannot turn this off. You only can set the time, when the firmware will be installed. So in my words: All my FGTs running 7.0.x to 7.2.x with no active but free-tier forticloud-subscription will begin to get firmwareupdates to the latest patchrelease of the installed FortiOS. Atm this would mean I will get the 7.0.15 at my 7.0.x FGTs for example, starting with Nov 2024. (if not installed). They will not do a major  to 7.2.x or 7.4.x (coming from 7.0.x) but will autoinstall 7.0.15, or the latest Patchrelease of the 7.2.x or 7.4.x. I have no option to opt out of this (with the free tier forticloud). Thanks!

I have a foritgate 600E with fortios 7.4.4 used as a proxy, and I created a new proxy policy with web filter security porfile to blocked the webmail and instant message websites. It block the websites with the broswer's block message instead of the replacemnt message (Blocked Page) of the FortiOS for all https website.Below is the case i have try:1.  Web Filter Profile (Flow-Base) + SSL Certificate Inspeaction2.  Web Filter Profile (Flow-Base) + Full SSL Inspeaction3.  Web Filter Profile (Proxy-Base) + SSL Certificate Inspeaction4.  Web Filter Profile (Proxy-Base) + Full SSL Inspeaction the CA cert of foritnet is installed in my computer and the replacement message of Application Control is wokring fine.

Hello, I have a problem with establishing SSL VPN connection and I had the same error in var/log/forticlient/sslvpn.log for few versions of forticlient (latest, this one i.e. 7.2.3.0790 and some other 7.4.x versions) [sslvpn:DEBG] vpn_connection:307 SSL error: error:0308010C:digital envelope routines::unsupported[sslvpn:EROR] vpn_connection:463 Failed parse PKCS#12 file[sslvpn:EROR] vpn_connection:1528 Failed create SSL I found this article https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-verify-the-ciphers-used-in-a-PKCS-12/ta-p/327734 but i can not apply the suggested workaround since i can not import public an private part of the p12 separately in forticlient vpn ( the article explains similar problem for fortianalyzer) I would isolate these errors as the most important, but i would like to mention another one appearing, also which is:ns:203 Failed to open /etc/nm_resolv.forticlient.backupI tried installation from repo and dpkg also. The

Hello Fortinet Community,I’m currently looking for a solution that can manage multiple firewall vendors, including Fortinet, and others. My goal is to streamline firewall policy management across different platforms from a single console. Unfortunately, I can't purchase FortiManager or Panorama as I don't have the budget for either of them. Does anyone have any recommendations or insights on tools or platforms that can handle this multi-vendor management effectively?Thank you in advance for your suggestions!

Hello, I have an odd problem.  A user (and SSLVPN users generally) were able to access a network segment which they are no longer able to while using a split tunnel.  All of a sudden, traffic appears to be timing out when trying to access certain addresses on a portion of the exported subnet that should be accessible. Shown above in the 1st 4 are the configuration on the fortigate for the SSLVPN.  shown below in the last 3 are the route table on the user's device, as well as the output of their ipconfig /all showing both their Forticlient virtual adapter, and their physical wifi adapter.the user can ping 10.55.4.* addresses, but not 10.55.5.* addresses Thank you,Matt

Hello team, This is a stack with 2 Fortigates 100F (A-P)We found in "FortiView - Sources", a machine with "30" in the column "Threat score", all the others had 0When I drill down, I found the followingThis was: biserka.xyz (phishing).I have tried to find any log with more information about this but without luck.¿Do you know where can I find more information? Thanks in advance.Regards,Damián

Hi all, I am adding an SDWan overlay onto remote sites, and so I had hoped to build a secondary VPN ipsec tunnel and add to the SDWan zone, and then shut the original tunnel and bring up the new. Both tunnels are therefore using the same ISP, to the same destination core site.  Both have different passwords and different ike versions My problem is that, the new tunnel will not connect to the core at all.  I see no port 500 connections even being initiated. I cannot understand why the new one won't even attempt to reach the core, even if I disable to original VPN interface 

Whilst working on some VPNs, I noticed something odd, I have my FortiGate acting as a Hub for some branch sites, using BGP over the tunnels. I added a new site to site VPN for some other traffic and I noticed it got added as a spoke on the Hub and Spoke config? I deleted it from there but it then deleted the BGP config as well! its nothing to do with the hub and spoke set up, so why is the site to site VPN peer going in there?

I have a fortigate 100f and a fortigate 201F , Fortigate 100F has a 2 vdoms root,QA1 . Under QA1 there is a loopback interface Test created and I want to perform IPsec tunnel between these 2 firewalls using test interface as source , Please help me to achieve this

Hi,I'm new with Fortigate and migrating from ASA world.  I'm a little surprised that the fairly basic configuration causes difficulties even for vendor.The question is: Does version 7.x support setup where traffic should travel from policy-based tunnel to policy-based tunnel and where the NAT should be used for source address. If so, is there any document to follow so that the implementation would be done correctly?  Already found some articles but still wondering do I need VPN Concentrator config to enable traffic flow between tunnels?  

Hi,I would like to manage my switches from the FMG but many options are lacking, especially the "Block Intra-VLAN traffic". Same for SSIDs and "Block Intra-SSID traffic". How to enable these from the FMG ?Thank you.

Hello Fortinet Community, I’ve deployed the FortiNAC Persistent Agent and implemented compliance scans to ensure our systems are secure. Our policy is to delay operating system updates by one month, but we want antivirus signatures to always be up-to-date. I understand it's possible to delay OS definitions downloads, but this also delays AV updates.Is there a way to configure compliance scans to check that the OS has all critical updates with a one-month delay while ensuring AV signatures are always the latest? Any guidance or best practices would be appreciated!Thank you!FortiNAC 

I want to do wireless mirroring from laptop to TV in the organization. but the connection is constantly dropping. Or there is a lot of loss. This does not happen when I try on a different device. What settings should I look for in the firewall for broadcasting?

Hi, we use this HA FG81 cluster in one office with 30-40 people (no VPN, normal usage, % 2000 sessions, etc.). We experienced now that with every new 7.4.X update we increase memory usage so that now we have like 75% memory usage.We did already some changes with some CLI commands but only disabling IPS would affect the memory and now we are at 68% with no IPS in all polices. We kind of can live with that, but can we expect now with every update more memory usage? Thanks,  

Hi I'm setting up a new fortigate and fortiswitch.  Actually upgrading from 100e 100f.  we are able to convert fine and 100f is working fine. the network is on hardware switch and contains the dhcp.  we have about 40 users connected to the fortiswitch and are actively getting internet and dhcp from fortigate is working.  The issue is fortiswitch is showing offline although all ports are on.  We tried everything from ntp ect....but nohing is working.Also when I do troubleshoot on fortiswitch i get the following  "Failed to fetch registration information"Any idea? Thanks

Windows 11 (intune enrolled), FortiClient 7.4.0.1658.If I setup a VPN that doesn't have a certificate associated with it, I have no issues.But if I associate a certificate with a connection, about 2 seconds later the console crashes. If I open it up again, it will crash a couple of seconds later.It doesn't log an error at the time it crashes.I have to uninstall and reinstall again to get it stable again but can't associate the connection with a certificate.Anyone got any thoughts? 

Hello,Not sure if this is the right place to put this, but I've noticed major issues with FortiClient SSL-VPN connections from MacOS on FortiGates running 7.2.8.Right after the upgrade, users started getting disconnected every 5-10 minutes with no disconnections or errors showing in the FortiGate logs. I tested with various FortiClient VPN versions (as low as 7.0 versions and as high as 7.4 versions), but had the same behavior for all.Eventually I've had to downgrade to FortiOS 7.2.7, and SSL-VPN works without a problem for the same users, with no changes on the endpoint side.Is this issue on Fortinet's radar? If so, any fixes in the works?

I am trying to make authentication using free radius server with fortigate , I can send ping between fortigate and ubuntu machine which freeradius run on it , but when I trying to add radius server from USER,Devices section the server can not be reach , and there  is no any request coming to free radius from fortigate ,I don;t know why is that , I can send ping but can not reach radius server

 I am trying to get SSO for my WIFI with Azure AD. I created an Azure Enterprise Application and assigned Users. I set up SSO in Fortigate.I created a usergroup in Fortigate.I created Policies to use that group for Wifi accessI added that group to the SSIDI set the Captive Portal to Disclaimer (for debug reasons) and when I accept the disclaimer, I am forwarded to login.microsoft.com - but there I get a certificate error because for some reason, Fortigate seems to replace the IDP certificate (that I of course added to the appliance) with the Fortigate Factory Certificate. I am at a loss here as I do not understand, where and why the certificate gets replaced... Can't find anything in the forums or anywhere online, I have been searching for 3 days now...