Support Forum

Hello all, I am running Forticlient 7.2.2.0753 on RHEL 8. I have successfully installed it using the RPM but when I try to create a new profile, I get the error below. I have installed it as root (which is required) and am running this command as a different user as root is not allowed. This seems to be a permission error but there is no information to see where it is trying to write to, and my user has full access to its home directory. Does anyone know what might be wrong? $ /opt/forticlient/fortivpn edit "CLI VPN"Failed to set up FortiClient directories. 

Hi everyone,  Apart from firmware updates, are licenses and subscriptions required only for signature updates or to be able to use the features themselves (e.g. Antivirus, DNS, SSL inspection) in a Fortigate?

I have two machines that when the firewall is enabled with Domain it disconnects Fortinet Single Sing On Agent Configuration, if I disable the Domain Network firewall it works perfectly. This machine has the same rules as all the other machines. Has anyone experienced this? 

Hi, i'm configuring a new interface on a Fortigate cluster running 6.4.11 using Fortimanager.Part of the process is i need to map to a normalized interface.  I can create a new normalized interface, but the mapped device does not show me the needed mapped interface name (it does show me a bunch of other ones).  It's unclear to me where this needs to be created.  When hovering over the entries it looks like this is a vlan object.  The object needs to be created somewhere else but the question is where?  Or is a policy and device settings push needed before?  Thx!

Hello, I have been looking for information on the subscription prices for the Fortigate remote access feature, but I couldn't find much detail. Could you please provide me with the pricing for the licenses? Specifically, I need the remote access feature to manage my distant firewalls. Which subscription would you recommend me? Thank you in advance.

greetings,Previously we used ping to a single www server from public Internet as the SLA detect method, and some day ISP stops the ICMP to that www server, so SD-WAN rule brought down the member interface.Now we'd like to use DNS as the active probe method since there are robust public DNS service provider for public Internet.So, my question is, what is the SLA Target if using DNS? from the screenshot below, it looks the same as measurement to Ping. Isn't it supposed to measure the response time for a DNS query? Should SLA Target be enabled?Thanks for your any advice！

Hi folks, I'm confused about maximum values supported for Phase2 tunnels by fortigate 300E. (VPN concentrator, mostly dial-up IPsec VPNs) Datasheet said: Client-to-Gateway IPsec VPN Tunnels:50,000, but even TAC don't explain if is related to phase1 or phase2. In my understanding is about total.There are any another way to find out this information?

Hi, One of our laptop keeps connecting on 2.4ghz.We have set 5ghz as preferred band but still it is connecting to that band only.Laptop model - Thinpad E14Wfi adapter - Realtek 8822CELast driver update - 01-Apr-2024.AP - 431F v7.4.3 Regards,Ganesh

Dears, I have two sites1- Main site: 2 HA FG firewall.2- DR site: 2 HA FG firewall. How can I apply a cluster between two different sites to sync configuration?

Hi,I am testing FortiClient EMS and was thinking about if I even need connection to AD or Entra.My goal is deploying on our 50 company devices. I did create an installer which is accessable from LAN only and deploy it via a third party tool.So I do not really see any benefits / needs for adding a connection to Entra... Later on we want to switch to ZTNA - do I need a Entra connection for user authentication for this?

Hello Guys,  A quick question, i wish to archive all files (quarantine and verified by DLP) on fortigate or other platform. Can you suggest me to use Fortigate with SSD or fortimanager/FortiAnalyzer ? Thank you

Hello, I downloaded Forticlient VPN for Linux (rpm package) but the interface (GUI) is still in English. Is there a way that the whole interface (GUI) is set in French ? Thanks. Alan. 

Hi, I'm running FortiClient EMS v7.2.4 and I've deployed FortiClient v7.2.4 to a device, let's call it DeviceA. In EMS I have our Microsoft Entra ID added under Endpoints -> Manage Domains. Within this configuration I am sync'ing in selective groups, for ease, let's call them Device Group and User Group. DeviceA is a member of Device Group and UserA is a member of User Group. I then have various policies (VPN, FW etc) assigned to User Group, with no policies assign to Device Group. This is working nicely in that UserA is getting the correct policies when logging into DeviceA. Also, in EMS under Endpoints I can see DeviceA in Domains -> Entra ID -> Device Group, which again is to be expected. Now to my issue... I have created an installer (for v7.0.13 as a test) and a deployment within Deployment & Installers -> Manage Deployment and assigned this to my Device Group. The assignment appears as domain.onmicrosoft.com/Device Group, so it a

Hello all,I'm having problem with AnyDesk and activated SSL Deep inspection.As soon as this is activated, the AnyDesk client can no longer connect to the AnyDesk server.I've already tried to exclude *.anydesk.com but no luck.I have already created a outgoing policy specialy for service "AnyDesk-AnyDesk" and set it to the top. But even this does not work.

Hello, I set up an explicit proxy a proxy on a fortigate 80F version 7.4.4. My configuration: Interface 4: 10.0.100.1/24, Explicit Web Proxy EnabledExplicit Proxy: Internal4 listener, HTTP port 8080Authentication scheme: Basic, localAuthentication rule: src all, Int4 inbound interface, HTTP protocol, auth scheme "test_proxy_schema"Proxy policy: wan1 egress interface, src all, dst all, webproxy service The IP of the proxy interface has been configured on a pc directly connected to the firewall port.My colleague who has control over this pc runs a continuous ping to 8.8.8.8.I don't see any traffic that matches with my proxy Policy. Can you help me, please?  

Hi All,I would like to get a list of all the BSSID's on a FortiGate, with the name of the AP it's assosiated with, so in essens a list like:AP1,BSSID1AP1,BSSID2AP1,BSSIDnAP2,BSSID1AP2,BSSID2AP2,BSSIDnetc.. Is there a way to do that, seems like CLI is needed, or do I look in the wrong place in GUI?

Hello team what is the course for the BGP not form neighbor between HQ and branch

I have two FortiGate 200D in HA mode currently and need to transfer one of them to the DR location. DR Site IP range and HO IP ranges are the same. Core Switch with different VLAN is having a gateway set to firewall LAN IP. Is it Possible to have an HA configured using Datalink connectivity between 2 different geographic locations?Do any other Changes are required on the Core switch?

Hi Team, I have a question about using DNAT and SNAT simultaneously. For example, my global IP is 100.100.100.100/32. I want to enable RDP (port 3389) access to a local host with the IP address 192.168.10.10/32 from the Internet.When a user connects to 100.100.100.100:42424, it should be forwarded to 192.168.10.10:3389 and also be SNATed to 192.168.20.10/32. Is the configuration below workable?------------------config firewall vip edit "vip_192.168.10.10_Office-RDP"  set service "TCP_42424"  set extip 100.100.100.100  set mappedip "192.168.10.10"  set extintf "WAN_v2000"  set portforward enable  set mappedport 3389 nextend config firewall ippool edit "192.168.20.10/32_LAN-Office"  set startip 192.168.20.10  set endip 192.168.20.10 nextend config firewall policy edit 10  set name "Internet->Office-RDP_allow"  set srcintf "WAN_v2000"  set dstintf "LAN_v2002"  set action accept

I have acquired a 60 day trial license for a fortigate VM with 1 vcpu.Can someone tell me what happens if the 60 day trial license is over? Will everything stopp working?With everything I mean VIPs and Virtual Servers with Full Deep Packet Inspection + IPS + WAF and some basic outbound firewall rules without UTM.

I'm a network guy, familiar with Juniper SRX and Palo a bit. I've installed FortiGate in Eve-NG  but the licences have now expired. What's the best root here for licencing? Ideally, I would like something permanent Performance is obviously not important. But it is really great to be able to simulate scenarios similar to the live ones we are deploying. I have asked our SE for temporary licences, but now, at the 3rd request, I've been politely asked to find a different solution. What is my best bet here for a permanent solution ? or is there a easy route to just keep renewing temp licences. Most vender seem to make trial licences freely available. Thanks in advance,  

Hi all! Still learning the FortiOS and have run into a issue and its time critical i get it fixed ( Sites need to print Paychecks tomorrow )  So 2 of my 3 tunnels when down and i started with trying to ping the Public IPs and sure enough from CLI Fortinet/windows i can not ping those public IPs but if i log into the comcast modem can ping the public IP addresses and if i go to the other 3 sites and ping the Main sites IP that come back as responding from Fortinet/Windows and the Modems. Any ideas on what may have gone down or broke? Any help is appreciated! 

Hi all,Fortinet 200f running 7.2.7Cisco CBS350Set up a LACP LAG on both the 200F AND THE 350. Refuses to come up. Anyone have any insight on this?Are there non compatible settings set by default on the Forti that need to be changed in order for the lag to come up? The lag on the Cisco side is a plain jane LACP LAG. Nothing special https://vlc.onl/ .Thanks

Hi everyone, I want to prevent anyone from being able to shutdown the Fortigate from GUI or CLI. Is there a command which can allow me to implement this on the Fortigate 100F?

I have ems server version 7.0.6 build 0358.my vpn client running version 7-0-7need to now if i can upgrad the server without the need to upgrades  all the  my vpn clients?thank youShahar