Support Forum

It appears to be the session that is cleared, so it disrupts everything that device is currently doing for several seconds until the sessions are recreated. I can see these logs under system events:User: from cw_acd clean active IPv4 sessions,( filter:vd:0;source ip:172.30.100.10-172.30.100.10;) And then these logs under WiFi Events:Client 1c:1a:df:82:7b:74 de-authenticated.Action client-deauthenticationReason Previous authentication no longer valid For all devices connected to WiFi and at exactly 00:00 every day. FortiGate is a 61E running 7.0.3 and the FortiAP is a 221E also running 7.0.3, but it has happened on all versions of 7.0.x that I can remember. Anyone have any suggestions how to diagnose or where to look next since I am stumped? Regards, Thomas. 

We have existing Fortiswitch that is connected to a Cisco ASR. The Cisco has the layer 3 interfaces and IP's assigned for WAN and vlan subnets. We want to now install a second FortiSwitch, use the layer3 capabilities and use vrrp to make the link redundant (will convert existing Fortiswitch after configuration for new Fortiswitch is working). We have installed a 2nd circuit and will configure it to this second Fortiswitch that will now handle layer 3.In essence, we want the Fortiswitches to be redundant on the LAN side to handle Vlan's (is that MCLAG?) but also be redundant  but have a unique path out layer 3 to AWS. Each Fortiswitch has a separate layer 3 Circuit to AWS and I want to know if this can be Active/Active to use both circuits or only active/passive. The internet side is 10G for both circuits.Please let me know if this makes sense. Can anyone share a similar config?Redundant

Hello,I want to implement FortiAuthenticator saml authentication for OWA Exchange login. Can I implement OWA MFA using FortiAuthenticator SAML? FortiAuthenticator 

Scenario:I have a network setup consisting of a FortiGate , FortiSwitch and multiple FortiAP . The connections are as follow:FortiGate:Port1 (FortiLink) is connected to Port 24 on the FortiSwitch.I have created VLAN 400 (named "MGMT") on the FortiLink interface, which is used for managing the FortiAPs.FortiSwitch:Ports 21, 22, and 23 are configured in VLAN 400 for connecting the three FortiAPs. These ports are working correctly, and the FortiAPs are connected.SSID Configuration:I have configured three SSIDs on the FortiGate in Tunnel mode.Each SSID is associated with a different VLAN (configured as optional VLAN IDs within the SSID settings).DHCP is enabled on the FortiGate for these VLANs.Issue:When clients connect to the Wi-Fi SSIDs broadcasted by the FortiAPs, they are not receiving IP addresses from the DHCP server, even though DHCP is enabled and configured correctly on the FortiGate for the SSID VLANs.Upon further investigation, I noticed that the VLANs associated

Good Day To any one that can assist me. In my work environment we are operating the pbx phone system FortiVoiceEnterprise 100E with 12 phone lines attached to two fortivoicegateway switch.  The issue currently is that three of the direct phone lines are being cross referenced meaning when i am dialing an external phone one of the other phone numbers are displayed and therefore that phone being used cannot receive calls from outside of the office.  how do i ressolve that issue. i already reentered the entire configuration to no avail. 

Hi I'm struggling to get the VPN connection to work on my work laptop. I'm using the latest version of FortiClient VPN 7.4.0.1658 and all settings are 100% correct as I've tested the same on another laptop where it is working.My laptop: DELL Latitude 5590Windows 11 64bitAll drivers are up to date. Can anyone help me sort this out or provide me with a link to download the 7.2 version to try and see if older version solves the problem? Here is what I've tried already:Reinstalling many timesTried version 7.0Updated all firmware and biosCleared %appdata% and %localappdata% before every reinstallOpened the necessary ports on my firewallTurned off firewall temporarilyPlease help me.

Hello everyone, Can I update the Fortinet AV clients on the client computers via the EMS server? So we currently have version 7.2.4 on the clients and version 7.2.5 on the EMS. The version has been online for a few days and is not being rolled out to clients. Is there a way to roll out 7.2.5?  Thank you very much for your help.

Hello, I'm doing some cleanup in a fortigate environment that has not been kept very tidy. There are a lot of policy openings that i dislike as they have been allowing all protocols far too often.Now i want to crack down on these and limit some policies to only have access to the ports that are actually frequently used.Now the proper way of doing this would be to contact various parties and get lists of ports required for the respective services and applications but i wonder if there is some tool in FMG/Fortianalyzer that might help me? I imagine a tool to list ports accessed by a certain policy and how many hits they each have in a certain timespan.Is that possible? or is there a better/simpler solution? BrJohan

Hello, IPsec aggregation I/F is not seen when I try to input it as SDWAN member.Here is my environment.       (wan1) --- NAT router1 --- (wan2)FG1                                                     FG2       (wan2) --- NAT router2 --- (wan2) At FG1, as VPN tunnel, vpn1_1 and vpn1_2 are createdAnd AGGnat I/F is created as aggregation of the both.At FG2, the situation is similar.In VPN tunnel, AGGnat I/F is up. However, this I/F is not seen as SDWAN member. How can I solve? Any comments are appreciated.  

Has anyone have any success configuring and implementing the Fortimanager SD-Wan overlay template? I am currently running Fortimanager 7.2.7 running Fortimanager 7.2.9 and keep getting an error -999 Odom copy failed error when trying to install preview. I am beginning to think there may be a bug with 7.2 version.

Hello! I have several WLANs in Tunnel traffic mode (FortiAPs) with their own DHCP configuration, using external DNS.Additionally, I have VLANs that use our internal domain DNS/DHCP. The issue is that devices on these WLANs are attempting to communicate with devices on the VLANs (and vice versa).For example, logs related to Windows Delivery Optimization (TCP/7680) show this activity. Since there are no policies allowing communication between these networks, my logs are getting filled with 'implicit deny' entries:Same thing here: I could be mistaken, but since the tunnel is sending WLAN traffic directly to my Fortigate, and the only policy in place is for outbound to the WAN, devices on different networks shouldn't be able to see each other, correct?Where might the misconfig be? Thanks in advance.

Youtube now has a solution to allow only the education side. The solution is to add an HTTP header.https://support.google.com/youtube/answer/2695317?hl=en I searched for HTTP Header in the FortiOS documentation and it pointed me at "Proxy Header Control": http://help.fortinet.com/fos50hlp/52/index.html#page/FortiOS%25205.2%2520Help/wanopt.016.4.html Unfortunately it doesn't mention the impact of any of this (will it screw up existing traffic?) and the options are confusing ( 5 different kinds of headers, none of which match the language in the google page) We currently do not have anything like that defined, has anyone set this up? Of course there isn't anything in the GUI named "Proxy Header Control"  Do I set that up in "Explicit proxy" or "Proxy Options" GUI or do I have to do it in the CLI?  

I am going to be installing a Fortigate in a small secondary school. Can you guys give me a rundown of tips and best practices for content filtering in this environment? I would love to get a list of recommended config options along with instructions on how to set it up. Setting up filtering for a school seems like a bigger challenge as opposed to setting them up for a business which is where most of my experience with Fortigate is. Thanks!

Hi, According to config guide you should be able to have up to 8 SSIDs per radio. But the GUI and the CLI do not let me add an eighth one?  

Hi Team, I am swapping from Cisco ISE to FortiNAC. Currently, ISE permits access with EAP-TLS and LDAP user groups (Domain users and domain computers) In FortiNAC, EAP-TLS authentication is possible but I don't see any option to permit access based on user/computer account at LDAP/AD.  Regards, Barry Ghuman  

Hi there,I am using Forticlient v7.0.10 in MacOS (Sonoma) to connect to an VPN, but everytime I try to connect, It just stays forever and no connection is stablished. According to the documentation Forticlient v7.0.10 has support for MacOS Sonoma.This same VPN configuration works without problem in an Android using Forticlient.I already tried some of the solutions the community has provided with no luck at all. fctservctl2 and fmon2 have both full access to the disk.I am using Applivery as MDM so I'm not sure if that could be causing the problem. Any tips?Thanks in advance.

Hi everyone ! I am currently setting up SAML SSO with Azure AD to connect to the SSL VPN (I am using fortios 7.0.11). So I followed these steps :  I created an application on Azure AD, and I specified it the fortigate information (as specified by the fortigate) :  The redacted text is an FQDN pointing to my VPN (a realm with a virtual-host is of course created) Then I added the following claims to Azure :  From here I added the information provided by Azure to the Fortigate : I've shorten the url so the end is visible. Then I created a group containing my SSO connector : And linked it to my VPN portal :  Finally, I added a user to the Azure AD application. From here I have two different result  :  From Azure ADWhen I click the "Test connection" button I am automatically redirected to this page :          And from the fortigate going on the FQDN or on th

Hello .I have a project to migrate from Palo Alto firewall to Fortigate. Unfortunately, we don’t have the FortiConverter tool, so I proceeded to migrate the configuration manually. I have a problem with some NAT rules and need your help.

I'm curious to how far this breach stretches.  Can't find any info on the newsroom page yet.   https://www.bleepingcomputer.com/news/security/fortinet-confirms-data-breach-after-hacker-claims-to-steal-440gb-of-files/ 

Hi,So there’s a limit on file scan size whereby a file beyond a certain size will be rejected, and from what I understand, the original file gets deleted and a record is created to say the file was too large to scan.Is there a solution whereby the Sandbox identities these files it cannot scan and move this file to an “unscanned” directory for manual intervention?

Hello everybody, I am making a list of the "recommended/important" fortigate log types for our customers. however i do not have access to a fortigate firewall and i cant seem to find any "good" documentation. so far what i have found has been contradicting itself by other searches. so now i have taken to the community:) would anyone share what log types are available from the fortigate firewall and what those logs contain

Hello all,I am new user of Fortinet VPN(version 7.4.0.1645)，but i fond some issue on install and open the software.Specifically, the software will Crashed when i open the software.my M1 mac information:Apple M1/macOS Sonoma 14.6.1 (23G93). I checked the report message when the software Crashed:     

Hello Experts, In site-to-site VXLAN under SDWAN IPsec over NAT,does Fortigate at NAT outside need to specify WAN IP address of the other Fortigate?Here is my network environment.    Inside    Outside  |---| -- NAT1 -- |--------| --- |---||FG1|            |Internet|     |FG2||---| -- NAT2 -- |--------| --- |---|   Inside    Outside   Both network I/F of FG2 are configured as "Dialup User".FG2 does not know WAN IP address of FG1 before FG1 connects to FG2.In order to establish VXLAN between FG1 and FG2, after getting FG1 network I/F IP addresses I needed to specify static route to the IP addresses at FG1. Are there any other solutions? Any comments are appreciated.

Need to amend slightly how guests register, and I don't think its possible, with a Meraki solution, you get a webpage and it asks for the email address of an approved person, you click submit. The approver gets an email, and authorises it. That's it.. you then get an email on your phone or whatever, and you can now access the network Fortiauthenticator needs either a group of approvers, or a freeform user typed in on the admin settings, Cant the guest user in the captive portal freeform type the person he wants to approve?

Hi everyone,We are facing an issue with virtual IP, it works normally, but all at a sudden stops responding to any request, there are no indications of high CPU or memory usage, neither sessions.One solution we have with this is, manually change the IP address of VIP to some random IP and vice versa.Any permanent solution will be highly appreciated