Support Forum

Hi Team, I am on the process of deploying SDWAN in existing network, and wanting to add a loopback interface while trying to create an sdwan member.  Is my understanding correct that the loopback interface type is not supported before FortiOS 7.4.0?I am only seeing a link related to SDWAN and Loopback as below:Defining a preferred source IP for local-out egress interfaces on SD-WAN members NEW | FortiGate / FortiOS 7.4.0 | Fortinet Document Library We are currently using MPLS network in our WAN, so we prefer to use loopback interface.Also, please let me know if you have any other suggestions for this to work. Thanks!  

Hi, i have download FFW_VM64-v7.6.0.F-build3401-FORTINET.out.ovf for VMWare from https://support.fortinet.com/Download/VMImages.aspx, and after install, the application not show trial license option, only FULL. I already try factoryreset, set via shell account and nothing works. Someone can solve this ?  

Hi everyone,I am relatively new to Forti and networking in generaly and I have one problem i can`t wrap my head around.On Fortigate 100F I have two WAN interfaces enabled with diferent public subnets.WAN1 is my primar interface with default route for my internal users to go to internet.WAN2 is interface i inted to use for publishing web services.I creaed virtual server with WAF for that purpose and pointed it to WAN2.When i tray to access web servise from outside my local network ti works like a charm, but users in internal network can`t access those web services.Domain on which this web service is published is public and DNS records are held by 3rd party registrar.I don`t have split DNS in local network to be able to sent internal trafic directly to local IP of my web server.So far I tryed to add second default route for WAN2 with higher administrative distance and I tryed to configre PBR but with no luck (maybe i`m not doing it right)Is the PBR solution at all for my problem?BR 

Hi.I created web filter and application filter and blocked social media and **bleep**ography catagories.later created the policy and assigned this security fiters to this policy .Problem is that,after assign this security profiles ,i cannot use anydesk app.i d'not any block to remote access catagories.how can i solve this problem? please help me

Hello everyone! I am looking into a FortiNAC implementation and the following question came around. Tried to check documentation but there are some differences on it so would appreciate a third opinion to make sure the right setup is being followed. When deploying multiple isolation networks on FortiNAC (Registration, Authentication and Remediation for example) all of them have different IPs on config wizard, yet all belonging to the same interface port2. On a L3 setup, which IP should be indicated as DHCP relay (helper) on each interface? The main IP for port2 or the equivalent to the VLAN that is being configured? Found this and other examples saying the first is correct:https://docs.fortinet.com/document/fortinac-f/7.2.0/high-availability-fortinacos/377092/layer-3 In the image is possible to see that all helpers, no matter the VLAN, point to 10.10.100.2 and 10.50.100.2 which are the registration port2 IPs for each FortiNAC server.It also says the following:&

Dear Team,We have FortiNAC using as local RADIUS for our Cisco Switch. We have Endpoint Access Policy with using RADIUS RFC Vlan for changing User VLAN based on Access Policy. We have Endpoint Compliance to move user to Non-Compliant VLAN and mark at Risk but when user are changed to Host/Profile (Non-Compliant). Policy detail shown that Host Matched VLAN "Non-Compliant VLAN" but FNAC is not change the port VLAN and Also it is not send RADIUS to Reauthentication User to Non-Compliant VLAN.  It is working only when Host reconnect by itself. It should not be correct flow of how NAC's endpoint compliance work.Note: Switchport membership is Role Based and Remediation.I have do PCAP and i don't see any traffic sending out from FNAC with any RADIUS or RADIUS CoA port.Thank You

After updating our machines to the 7.4 update(VPN only), we noticed a few laptops were getting stuck at "Connecting". After browsing this forum and other sites, we had no luck at fixing the issue. Reverting back to 7.0 did resolve the issue. After checking out the services, I noticed the FortiClient Sys Monitor was not running in the taskbar. I went to start it manually in the Forticlient folder and received an error(mfc*.dll not found). I doubled checked the laptops with the issue and one did not have Microsoft Visual C++ installed and the other had the 32bit version installed. After installing the 64bit version on both laptops, Forticlient shows the percentage and connects fine. Hope this helps someone.

Hello, I'm a beginner and I'm doing a lab I need to update a fortigate to version 7.2.7The adom on the fortimanager is version 7.0 1)Should I first update the adom and then the fortigate, or vice versa? 2)If I don't update the adom and leave it at 7.0, will that cause any problems?3) The fortimanager is in version 7.2.1, do I need to update it too?If so, what order should I follow?Update Adom then fortigate then fortimanager? Thank you very much.   Translated with DeepL.com (free version)

Hi everyone.I've been taking a course on Udemy about infrastructure and security with FGTs. I'm almost done with the course but I'd like to know any website where I can find resources like guides and things to do to practice by my myselft so I can get almost a real experience deploying policies and other configurations which are used in a real company.Thanks in advance.

Connecting FortiExtender and Fortigate (FortiWifi)Hello. I am trying to connect the other party's FortiWIFI-40F through FortiExtender 511F and FortiWifi-61E.FortiExtender 511F is equipped with a SIM to enable 5G communication.What I am curious about is the Ethernet connection between FortiExtender-511F and FortiWifi-61EI need to connect AWS's TGW to VPN using the 5G network, and the other party also needs to connect to VPN through FortiWIFI-40F.AWS's TGW has already been created and tested for connection to FortiWIFI-40F and VPN, but the connection between FortiExtender-511F and Fortiwifi-61E is not working well, so I am asking the community.Current situation isMeFortiExtender-511F-> 5G network connectedFortiWifi-61E -> PC connected to the lower level and management access possibleBoth devices are connected to the lower level PC with serial consoleOpposite partyFortiWIFI-40F -> Connected to the ISP and internet network and there is a lower level PCManagement access is set betw

Hello, we are using Fortiweb VM version 7.0.8 and i'm not specialist in the system. Our Exchange server is behind the fortiweb. We have a lot of attempt to connect to the exchange using EWS.  I can see in the Traffic (Log & Report) for attempts and the return code is 401 (forbidden). My question : Is it possible to create a rule/policy to automatically block IP for all attempt getting the Return code 401? Thank you

Hello.I have a question.There are some traffic in Fortigate Forward traffic where the result is blank, is there a reason why that part is happening? 

Hi, i want to hide my local FortiGate IP with remote PF_Sense located in Germany. i already created the tunnel between them and the tunnel is up, moreover i also configured Central NAT for IPsec tunnel policy and allowed NAT. I need my local site users to use public IP of remote firewall, what is the possible solution.

Hello TeamI am new to this forum but have a big issue.We have FG200E running on Firmwarev7.2.8 build1639 (Mature)The ISP provides 30Mbps, and when we test with a laptop connected directly to the ODU, we get over 25Mbps; however, on Wi-Fi and LAN through the FortiGate, we get less than 5Mbps. There are not many configurations on the firewall, it is only working as a router and 1 site-to-site VPN which is not active.Kindly guide me on how to solve this.

I’m a brand new Fortinet partner MSP and I’m trying to understand the best method for handling FG Cloud. From what I understand, the MSP needs to purchase the multi-device license instead of the individual SKUs, then purchase the multi-tenancy license and create a sub account for the client, then register the device to that clients sub account.Am I understanding this correctly?

when configured captive portal some sites didn't work  with error :err1 - ERR_QUIC_PROTOCOL_ERRORerr2 - ERR_SSL_VERSION_OR_CIPHER_MISMATCH like : YouTube , google , LinkedIn  and google search else some sites works normally and redirect to captive portal AUTH page . when I remove or authenticate all sites works normally  I try it with (chrome , brave and IE browsers) (version 7.0.9 VM) FortiGate 

I'm looking for a solution to restrict actions that can be done by a user who has an access to a secret through web RDP, for example on a web SSH session we can use SSH Filters but i didn't find something similar while using web RDP 

Good day, I am getting a lot of Microsoft URLs being re-signed as untrusted see below, I have a FGT200F running firmware 7. I have noticed that the Destination is not the same as the hostname, any thoughts as to what is happing? Server certificate is re-signed as untrusted, certificate-status: untrusted.Destination                                                                                    hostnamev10.events.data.microsoft.com                                                      uk-v20.events.data.microsoft.comteams.events.data.microsoft.com                        &n

hey guys.I have passed in january fortigate administrator 7.2I want to complete now the fcp and I studied faz.which exam can I pass to complete the fcp.there is on pearson vue two exams :Fortinet Analyazer 7.4 or Fortinet Analyazer 7.2is that matter which one I will pass ? thanks for the help :) 

These models will not complete the firmware upgrades successfully. We have several 248,224,148, etc. models that worked just fine. I've attempted to do the upgrade via the GUI and CLI.Wondering if it's a lack of usable memory?

Hello, I am trying to understand how the "VLAN assignment by FortiAP group" works. I can understand that this function allows using one SSID in multiple locations, and each location can be configured with a different VLAN with this SSID.I would like to understand how this configuration is working when the SSID is in tunnel mode and has an IP address configured in it.The plan is to have 5 locations with 1 SSID for corporate users. Each location will have it's own VLAN for corporate users and the DHCP scope will be individual per each location.How FortiGate will be able to use one SSID and switch between VLANs, route the traffic and forward requests to the DHCP server based on the VLAN configured to the specific AP group? Will be grateful for any hint.

Hi, I downloaded and installed latest version of FortiClient VPN from https://www.fortinet.com/support/product-downloads#vpn. The shown installed version is 7.2.2.I entered the server's SSL VPN settings, but when I click the button "SAML Login", nothing happens.The window shows the label: "Status: Connecting" and keeps waiting forever.Any idea about something I'm missing?

Hi. I'm new to this so please bare with me... So, I have a small lab-setup at home with a FortiGate 70F and a FortiSwitch 108F-POE. The FW is located in the livingroom where my incomming internet is, and the SW is located in my home office. Between the FW and the SW is a small office-SW (located on the 2nd floor) with no support for vLAN. If I connect the fortilink interface on the FW to the fortilink interface on the fortiSW, everything works as expected even over the officeSW. However, the other devices connected to the office-SW then doesn't work since they don't get a vLAN (obviously). My question is if it's possible to send BOTH the vLAN AND the fortilink traffic, with the vLAN as "primary" (or "untagged") over the same FW-interface so that I can use a single TP-cable. Is this at all possible?

Security Rating it appears you need to buy subscriptions to upgrade your grade. Is there any other way?

How often does forti-web update its firmware, and when it does would it cause disruption to a live Fortiweb Cloud operation that is protecting web servers. Typically explain how it works and if there would be down times Thanks