Support Forum

Hi, I will be transferring my unit from one FortiCloud account to another.Will the existing licenses and existing configuration be retained once the device is transferred? Thank you! 

I have fortigate connected to 4 fortiswiches, and 10 forti AP'sHow can i get notifications if one of my AP's or switches are down as proactive searches on the fortigate notification email alert but could not find anything about the the switches, and AP's Note:i don't have fortianalyzer 

Dear community, I having troubles deploying a FortiADC in vmware environment. Some interfaces are not working at the start, and sometimes stop working sometime later.  If I check the interface status in CLI with command "diagnose hardware get deviceinfo nic-detail" it appears as connected:  Settings for port1: Supported ports: [ TP ] Supported link modes: 1000baseT/Full 10000baseT/Full Supported pause frame use: No Supports auto-negotiation: No Supported FEC modes: Not reported Advertised link modes: Not reported Advertised pause frame use: No Advertised auto-negotiation: No Advertised FEC modes: Not reported Speed: 10000Mb/s Duplex: Full Port: Twisted Pair PHYAD: 0 Transceiver: internal Auto-negotiation: off MDI-X: Unknown Supports Wake-on: uag Wake-on: d Link detected: yes  I can ping my own interface also, but not the gateway. The interfaces works again if I disable and enable from network configuration in vmware. Maybe someone had the sa

Hi ! After trying to find a solution by myself, and googling as much as I could, I can't really find help on how to proceed with our infrastructure. We have a FortiGate 601E serving as our main DNS, and we recently added 2 Windows Active Directory, that we would like to use also as a secondary DNS. So what we did in our FortiGate is to create a new zone for our domain, non Autoritative, with both DCs as the DNS Forwarders. Also adding A entries with the server names and IPs.Up to that, it worked fine for most Windows machine, with the Fortigate as the main (even only) DNS, they can join the domain and communicate without issues. Now we are trying to create a service on a Linux server, with an LDAP link to our DCs. And we have two points that we can't make work : - If a Linux server has only our Fortigate as DNS, it won't be able to resolve any of our DC domain DNS names. We can tinker it out and make it work by manually forcing a DC DNS inside the configuration

Hello everyone, I am deploying FortiMail-VM01, i registered the VM and license (ATP) in Fortinet's support portal and downloaded the file  I deployed the image on the hypervisor Hyper-V. On the CLI the Fortimail displayed the serial number as the name of the VM My problem, when i try to upload the license file on the GUI it says "Invalid license" and on the general information of the Fortimail the serial number displays "FEVM00UNLICENSED" Does anyone ever had this issue ? if so i'll be taking any advice to resolve this problem Kind regards,

Hello, I need an urgent supportI am doing ztna configuration and fortiems on prem,For off-net and on-net users, I created a record as fortiems.xxx.com for users in both local dns and global dns,I created fortiems.xxx.com for off-net users, the dns record is in the same subnet as the wan ip but it is not a direct wan ip, I need to announce this ip behind the wan interface to get telemetry data, but I do not know how to do this, I entered the wan interface as the second ip, but it did not seem like a correct configuration, I cannot see it in the arp table.Can you help me for this 

Hi, I installed a second VLAN, but no computers from the new VLAN can reach the internet or ping the interface of the Fortinet-Firewall.The new VLAN is in the same IP-Range, so it should be possible to ping it without routing. Is there anything, preventing the Fortinet to accept calls from the VLAN?

I have configured a Public IP to access a server in my Lan (VIP mapping to internal server), it's working fine: from my home I can access the server, through the internet, by the Public IP. Now I want to access that same Public IP by a hostname (DNS), how do I achieve that? In the LAN there are DNS servers (BIND in split-horizon internal_IPS/public_IPS) which, when used by the previous firewalls, did that resolutions ok, but when used with Fortigate FG100F, v7.2.8, in "Network" -> "DNS" -> "DNS servers" -> "Specify" they just do internal resolution, including to the internet(!), what I mean: From the internet the hostnames are resolved to the internal_IPS zones from BIND servers. I know this must be a super simple question but I only find information about setting internal DNS for internal queries in a Lan. I followed the "technical tip" https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-FQDN-based-VIPs-from-GUI/ta-p/193165 but to no a

I have several FAP233G's (running a mix of 7.4.2 & 7.2.5) managed buy a Fortigate (running 7.2.8). I have configured a new SSID to run on Radio3. I configured the SSID to use WPA3 Enterprise and added it to my AP Profiles. However, the new SSID is not broadcasting.  What am I missing?

I have a very basic setupRemote LDAP server defined, perfectly accessible fine.Local group (Firewall) with members being specified as AD security groups System / Administrator defined as Remote User, Remote User Group the one above (LDAP) But what actually seems to be used is RADIUS (I can see that in debug log) and not LDAPI had to make changes to NPS RADIUS setup to be able to login That is on v7.4.4 build2662 (Feature)  Anybody else noticed? Seb

Hi, i am trying to set up a Web Filter Profile on my FortiEMS and am struggling with the "warn" Action.Everything works fine when using the the action "block", no issues at all, but once i change it to "warn" nothing happens anymore.It doesn't matter if it's what line i change, the problem always occurs.I'm using FortiClient 7.2.4.0972.Does anyone have an idea what might be causing it or how i can solve my problem? Thanks!

Hi, Was wondering if it's possible to use Radius authentication on the Fortigate ports, and send back Dynamic VLANs from the Radius server?I wan't to use the Fortigate ports as switched dot1x ports to authenticate different types of devices.

Hello guys,Please excuse me if I am in wrong place.I am using forticlient for my university VPN to connect to the intranet. However, it is very slow for the other websites. Is there anyway I can exclude other websites/applications from the VPN?

Hi, I need to access a website, but even though I have listed it as "Exempt" in the web filter profile, the stations still time out. How can I fix this? I have an outbound policy that allows all traffic with specific countries permitted. The website I need to reach is "scopus.com." How can I ensure access without creating a dedicated policy?Kind Regards,Sisma

I have a working (99%) Captive portal, User gets a captive portal registration page, fills in a few details and then it is set for admin approval, the problem is, the user never gets sent the random password?  I have left the admin email address out on this screenshot, but, my understanding is, the admin gets an email to say "approve" and then the details get emailed to the guest? when I hover over the "Account Delivery options available to the user" it says "Account information can not be displayed when admin approval is required" does this mean, as soon as the admin approves, they have access?  how would they know what the random password is? very confusing!Thanks   

Hi All, We've seen some issues with the Android Forticlient version 7.2.3.0136 that was release on the google play store recently, where users are unable to sign in where saved credentials are not working (specifically the username) and the fortigate telling me invalid credentials. Tests seems to indicate that it looks to be directly linked with the saved username, as older versions of the client don't seems to have this issue and if we specify the username users can log in with this version. Anyone else seen any issues with the new forticlient version available from the play store? I suspect a bug, but Fortinet TAC don't support the free version of forticlient. Thanks!

Hello Fortinet Community, I'm seeking advice on the best approach to secure our network. Our goal is to allow access only to domain-joined PCs and implement compliance checks.We currently have FortiClient installed on all user devices, and I’m trying to determine if we also need the FortiNAC Persistent Agent, or if integrating FortiNAC with EMS would be sufficient.Is there a comparison matrix available that highlights the features of the Persistent Agent and FortiClient specifically related to FortiNAC?Any insights or best practices would be greatly appreciated. Thank you!FortiNAC FortiClient 

I'm looking at some firewalls and their security ratings , trying to clean some things up and I'm seeing several firewalls with what seems to be out of date IPS Definitions . Are they not supposed to be updating Automatically or is this something I need to do Manually? Thanks,   

HelloIn FortiMail, we can configure for each domain only 2 SMTP servers (primary & failback).I need to configure a third one (another failback server) but I couldn't find a way to do from GUI or CLI.Any help would be appreciated. Otherwise why this limitation?

Hello,I use fortigate and fortiauthenticator and my configurations are correct,but some users can establish a connection after a few tries while vpn,When I look at the fortiauthenticator logs, it says that the user was previously authorized and remains in the cache, remove itlogs as below how can I solve this problem ) facauth: Sending email token code (timeout 180) to firat.gazel@cnbce.com 2024-06-13T13:56:29.921757+03:00 FortiAuthenticator radiusd[24056]: (34) facauth: Updated auth log 'firat.gazel' for attempt from 10.100.100.1~176.236.73.154: Remote LDAP user authentication partially done, expecting email token 2024-06-13T13:59:18.771835+03:00 FortiAuthenticator radiusd[24056]: (35) User-Name = "firat.gazel"2024-06-13T13:59:18.772239+03:00 FortiAuthenticator radiusd[24056]: User-Name = "firat.gazel" 2024-06-13T13:59:18.772331+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: ===>Username:firat.gazel 2024-06-13T13:59:18.773880+03:00 FortiAuthenticator radiusd[24056]: (3

Hi, I need a way to receive an email alert when the FortiGate itself goes offline. I have FortiManager & SMTP Email server is configured on the FortiManager. Is it possible to create an alert to trigger a notification when FortiGate devices go down and an email is sent via Fortimanager to a recipient?

Hello everybody, i would highly need your assistance in preparing for FCP Network Security Exam, i can see that there's a core exam which is NSE4 and one elective exam my question is how to prepare to the exam ?there're alot of topics in FCP network security, may i know which topics is mandatory for the exam and what should i start to study as i must take the exam in a month from now ??where the NSE-4 topics?! how can i get it ?please assist!    

Dear team, could you help me with the following scenario. We have a PC that is used by two users (each has their own VPN account). However, when user X wants to log in to the VPN with his account, he cannot because the other user's account is saved. In this case, the first time they logged in, the access to the person who logged in to the VPN was saved. The problem is that now that another user wants to use the same computer with his account, he automatically logs in with the other account that he logged in the first time at the Forticlient level and the login interface does not appear. Could you tell me where I can configure Forticlient EMS so that it can request credentials from the user who is going to connect each time he logs in?

Long time lurker, first time poster. Hi everyone.We’re upgrading some FortiAP 221C access points with FortiAP 223E access points. Straight swap I thought and plugged the 223E into the same PoE injector which was powering the 221C, a Ubiquiti branded PoE-AF injector - UniFi PoE Adapter (15W) - Tech Specs (ui.com). The document that came with the 223E AP says to use a PoE AF injector.This worked fine on my test bench. The 223E powered up and I was able to add it to the controller, then took it to its permanent location where is failed to power up at all. Now it won’t power up on my test bench either.I contacted my reseller who said I needed to use the GPI-130 PoE injector which is a PoE AT specification? I purchased one which has worked with a second 223E on the same cable that the first one failed on using the AF injector but I can’t understand why?

We have been using Forticlient and EMS for the last 16 months. We have had a very mixed experience with Blue Screens, failure to connect, UI issues etc. In general support tell us to update to the latest client version. We have just started updating to 7.2.4 to addres another blue screen issue in Windows 10. Our confidence in this product is low and one of the key factors is the vagueness of the known issues on the release notes. I look at the latest release notes for 7.2.4 here Known issues | FortiClient 7.2.4 | Fortinet Document Library and here Known issues | FortiClient 7.2.4 | Fortinet Document Library I could argue we are being impacted by at least the following but there is no detail into what causes this (spefici conditions or otherwise :(:( 994884: SSL VPN connections get stuck on 40%.909755: SSL VPN split tunnel does not work for Microsoft Teams.961079: New Microsoft Teams application does not work if application-based split tunnel is used.1002294: Fo