Support Forum

Hi.We are going from Zyxel products to Fortinet. I configured first Fortigate 60F whith same NAT of old devices as with the same wan, in testing lab everything is ok. When put in production enviroment nothing works, seeming that firewall is not seen from internet.Configuration (working now with old firewall) is simple: Fortigate 60F connected to lan on port lan1 and connected to router on Wan1. Configured on wan in dhcp ( reserved ip fron dhcp server) and configured ad DMZ on router.In testing enviroment averything works fine. On site since everi lan client can use internet, the device isn't reachable from outside and makes router work very slow first, unraechable neither from lan after some time.Tried to change router (FritzBox) nothing changes.When in test and working fine used same kind of router, same router software version. Different provider, but both with public ip ( fixed in one case, dynamic the other). The old (Zyxel) firewall is still working with the same configuratio

Hello everyoneRecently I installed FortiClient VPN (version 7.2.5.0847 Interim) on Kubuntu 24.04.I realize this is a dev build, but there is no stable version that supports my system yet AFAIK.The screenshot depicts my config.I have exported the logs but I am not sure if it is safe to publish them here. How do I debug what's wrong?

Let me submit one issue ...In my network, I have two FortiGate 201E firewalls (both are same model but different serial numbers) ...one is use for production (it is with licensed) and another FortiGate 201E is no use (just for backup purposed and licensed expired). I have taken configuration from production one and try to put in my backup firewall (backup config is put to backup firewall).  After config received and rebooted the backup firewall, it can't access with web access (normally we have access with https://(firewall iP:44443)) but I can access with SSH. I can see https, ping, ssh, are allowed access from backup firewall's management interface.  So, is there any issue? It is related to licensed expired on backup firewall.  If anyone got same issue..., could you please suggest to me for how to. Thank you.

We are currently experiencing an issue with slow page loading when web filtering is enabled at the policy level. When web filtering is disabled, the page loading speed is normal. The issue occurs on all websites especially first time browsing any websites, with load times ranging from 5 to 20 seconds.

Hi, testing Forticlient 7.2.4.  When using a user authenticated session (FortiAuthenticator 6.4.4) and having an open session like for example putty ssh, when issuing a ctrl-alt-del (lock screen and unlock) the active session is terminated. When checking in the Authenticator monitoring i notice the active authenticated session dissapears when performing the ctrl-alt-del. Version 7.0.8 seems not to have this issue.  Haven't tried any other version yet.  Anyone who encountered same thing and has a workaround?  Need at least 7.2.2 for Azure joined laptops...__PRESENT

Hi community, Under interface there's 2 setting where we could set the estimated bandwidth, however I am not sure sure to understand the difference and/or how they relate to each other or rest of config.  config system interfaceedit "my-inet-iface"set inbandwidth <some_value_in_kbps>set estimated-downstream-bandwidth <some_value_in_kbps>set outbandwidth <some_value_in_kbps>set estimated-upstream-bandwidth <some_value_in_kbps>nextend I do understand the need of those values, but I find them redundant and/or not sure how they relate to other config (QOS/SD-WAN) 

It Posible to manual Block Type FileHash-SHA256?  example  

 Is it possible to RSPAN vlans from managed FortiSwitches...  All the articles I have been able to find are for standalone switches and only talk about mirroring a port not a vlan.  With the Cisco equipment it was possible. See below: 

Hello. I want to ask how to send log syslog from Fortigate On-Prem to Linux VM in Azure or Google Cloud (GCP) ?  I have tried it but it didn't send logs, but ping is reachable from Fortigate to VM. Is is required to use P2P IPSec ? and can some one please give guidence on how to send directly with out P2P ? Thank You FortiGate 

Will below commands be applicable to HA Active Active Cluster for it to failover during conserve mode? config system ha    set memory-based-failover enable    set memory-failover-threshold 62    set memory-failover-monitor-period 300    set memory-failover-sample-rate 1    set memory-failover-flip-timeout 6end Reference: FortiGate HA failover due to memory utili... - Fortinet Community

Hello everyone, i`m trying to set up a VPN tunnel with the native Android 13 (Grapheneos) VPN Client. The connection comes up and goes down directly. IKE Dubug Output:[url=https://filehorst.de/d/eHkcHkhm]Datei von filehorst.de laden[/url] I hope that someone can help me. Thanks in advanced.

Hello, I've built a Hub-and-Spoke lab as I need to deploy SD-WAN, which is my ultimate goal here. The configuration went smooth with no issues I can remember. However, after the configuration is complete, and BGP is up, the spokes are not able to reach each other. I tried troubleshooting, and found that the Hub is not passing the traffic. Below is my topology on EVE/PNet  I'm not sure where the issue is. But the firewalls doesn't pass the traffic through the tunnels! I need to get SD-WAN fully running here. All 3 firewalls are running the same version: FortiOS-VM64-KVM v7.2.4,build1396,23013 (GA.F). For the IPSec Tunnels, I created the tunnels using the wizard using the Hub-and-Spoke Template I'm really not sure what is missing here.

Hi, everyone. I'm curious about the same content as the title, so I post it on the forum.  FortiAP is currently using FP221E and FP231F FortiSwitch is using 124E and 424D I'm trying to patch both AP and Switch FP231F is patched to v7.2.5 and I'm trying to patch FP221E with the same version, but I don't see the latest Firmware Image of FP221E The current operating system version of FP221E is FP221E-v7.2-build0280. I also tried to patch FortiSwitch 124E to v7.4.2 and patch 424D to the same version, but I don't see the latest Firmware Image as above. The current OS version of 424D is S424DN-v6.2.4-build213,200501 GA.https://www.fortiguard.com/psirt/FG-IR-22-038 In particular, fortiswitch is trying to patch it to solve the vulnerability, and if you know the answer to my question, please reply. Thank you.  

Hi All,If we configuration User SSL-VPN, Can we configuration One ID per One user concurrent access? Example:I just only can login my SSL-VPN with my laptop only.  If i have TAB/IPAD, I can't login with TAB/IPAD.**The configuration without enable MFA. Fortigate Version 7.2.7

Operating EnvironmentFortiGate-91G v7.0.15 build7342 (Mature)FortiClient VPN 7.4.0.1658Currently, when using SSO to connect to the SSL VPN, if there has been a period of inactivity, the SAML login may fail. There are no issues with the Microsoft authentication window during the verification process, and the FortiGate SSL VPN application on Entra shows a successful authentication. However, after the Microsoft authentication window successfully closes, FortiClient remains on the pre-login screen without displaying any progress percentage or pop-up window. The user needs to click connect again and go through Microsoft authentication once more. On the second attempt, FortiClient successfully shows the connection progress percentage, and the login is successful.When this issue occurs, the user must repeat the same steps and complete the authentication process twice, as the first connection attempt does not result in any progress.I enabled debugging on FortiGate using the following comm

Hello.I want to increase fortigate disk capacity. (/data)The disk is full as shown in the picture below.(The equipment is Fortigate 40F, and the version is v7.0.9_build0444.)  How can I do this?Please help me, Thank you.

Hi Team, I would like to rename the HA cluster members' hostnames. I plan to do this as below: Primary:System > settings > Hostname Secondary:System > HA > Edit > Peer  Is the above plan correct?Will this cause any impact/downtime on the network? Thank you! 

FortiClient VPN 7.4 Does not connect after Password and Token input We have Uninstalled the program and reinstalled it. Installed on a diffrent computer.The Client immediately states VPN connection down after token input, with No 

How to find out the FortiAP firmware from CLI? I am testing the MR3 Beta on my FortiGate and can not connect to the FortiAP. Does anyone know how I can check the firmware on my FortiAP from the CLI to ensure I am using the correct image supported by MR3?

Hello, Recently acquired a FS 108E-POE.  I factory reset the switch to ensure I was starting from scratch.  I connected it to my Fortigate 70f through a dedicated fortilink port.  The fortigate detects the switch, I was able to register the switch, but the switch is still showing offline.  I ensured that the time was synced, rebooted several times, but cannot get it to come "online".  Below is what I get from the fortigate when diagnosing: FortiGate-70F # execute switch-controller get-conn-statusManaged-devices in current vdom root:FortiLink interface : fortilinkSWITCH-ID VERSION STATUS FLAG ADDRESS JOIN-TIME NAMES108EP5920004250 N/A Authorized/Down - 0.0.0.0 N/A -Flags: C=config sync, U=upgrading, S=staged, D=delayed reboot pending, E=config sync error, 3=L3Managed-Switches: 1 (UP: 0 DOWN: 1)FortiGate-70F # execute switch-controller get-conn-status S108EP5920004250Get managed-switch S108EP5920004250 connection status:Admin Status: AuthorizedConnectio

I'm new to Fortinet certification (completed FCA -NSE3) program and now looking into FCP (Network Security).The page states that one has to Take 1 Core and any one Elective within 2 years. Does one have to take Core exam before Elective? or... it could be in any order but both must be completed within 2 years? Thanks...

Im currently on FortiOS 7.2.8. Traffics are being dropped by FortiGate when asic-offload is enabled. To work this out, we are currently set the asic-offload to disable but this is not a long term solution. Is this a bug on 7.2.8? https://docs.fortinet.com/document/fortigate/7.2.8/fortios-release-notes/236526/known-issues Does this issue will be resolved in what FortiOS? 7.4.x or 7.2.x ? Appreciate your feedback. TIA :) 

greetings,we'd like to access Internet, say, google.com with ssl vpn establised to Fortigate, but we got the error like below.but the user without ssl vpn connection has no such problem.ssl vpn connection is used for laptops from another country.the connection path is:laptop connected with fortigate via ssl vpn, split-tunneling is disabled.an SD-WAN rule is configured on fortigate for Internet bound traffic. 1. ssl vpn portal:fw-01 $ show vpn ssl web portal "test_townhall"config vpn ssl web portaledit "test_townhall"set tunnel-mode enableset forticlient-download disableset ip-pools "sslvpn_test_townhall"set split-tunneling disablenextend 2. ssl vpn settings:fw-01 $ show vpn ssl settingsconfig vpn ssl settingsset ssl-client-renegotiation enableset servercert "sevpn.companydomain.com"set auth-timeout 36000set login-block-time 120set login-timeout 60set tunnel-ip-pools "SSL-VPN-sitename-10.77.252.0/22" "sslvpn_test_townhall" !!we are using "sslvpn_test_townhall" as the address p

Hi, how do I configure Automation Stitch for the Forti extender if it loses connectivity with FortiGate? What is the correct event in the FortiOS event log?

Hello team!!! We have 2 Fortigates 100F in HA, we have connected the management VLAN (VLAN 30) on "Mgmt" interface on both Fortigates (VLAN 30 is untagged on ports where Mgmt interfaces are connected) and configured HA to use Mgmt interface as "Out of band", with dedicated IP for both Fortigates (A boss wanted to configure this as out of band)Now, we have many other devices on the management VLAN.We cannot access to any device on the management VLAN, from a computer in another VLAN, but we need to this to be possible.  Also, we need to access Fortigates from another VLAN.I think I can add routes in FGTs, because the mgmt network segment is not on the routing table, but this seems dirty to me.  It sounds like "out of band" doesn't make sense in that case.I think I can add VMs in the management VLAN for this purpose, but I am adding steps to access to Fortigates and switches Which is the common scenario for management VLAN?All people who needs to access any device in