Support Forum

hi all,Suddenly i got the issue that FortiClient vpn on my company laptop can only work with my mobile hotspot, but if I try with home wifi it gives me the error message as below screenshot when the progress bar reaches 20%. I am not the single one having the issue. FortiClient version is 7.0.11.0569.But if i browse to https://company-vpn-name.company.com:8443 under home wifi (yeah the service port is 8443 in my company), the page can be loaded, and if i do telnet company-vpn-name.company.com 8443， it also succeeded.please help to advice! Thanks a lot!

Hello Team, I'm implementing Fortiswitch topology with McLAG on core side, and I never found an exact document about best practises for Spanning-tree for that type of topology. Both mclag peer should have the same stp priority? Is there anything which I have to configure for STP when I use MCLAG? I know that I have to enable mclag-stp-aware, but nothing else for that. Thank you for your experience!  

We can manage the Forti-APs in fortigate Transparent Mode ?  @nithish.k@snsin.com,@sanjeevi.s@snsin.com

We manage several Fortigates that are utilizing the SD-Wan features to control failover between a primary(WAN1) and secondary(WAN2) internet connection. We have also allowed management on these interfaces, but limited the access to only from our office IP.  While WAN1 is the active internet connection, we have no issues connecting to it for management or sending pings to that interface. This same goes for when WAN2 is active. However, when WAN1 is active, we cannot ping the WAN2 interface, or connect to the management GUI. Again this is also true for WAN1 if WAN2 is active. We have tried to resolve this with several ways including policy routes and SD-WAN rules, but no joy. The inability to ping the inactive interface is particularly frustrating for our monitoring as WAN2 always shows down, unless it becomes the active SD-WAN interface. Any thoughts on how to resolve this?

Hi All, I am having an issue with the SD-WAN performance SLA. The server is pingable from WAN1 and the VPN tunnels, latency is below 10ms.  execute ping 192.168.100.PING 192.168.100.1 (192.168.100.1): 56 data bytes64 bytes from 192.168.100.1: icmp_seq=0 ttl=255 time=0.4 ms64 bytes from 192.168.100.1: icmp_seq=1 ttl=255 time=0.1 ms64 bytes from 192.168.100.1: icmp_seq=2 ttl=255 time=0.0 ms64 bytes from 192.168.100.1: icmp_seq=3 ttl=255 time=0.0 ms64 bytes from 192.168.100.1: icmp_seq=4 ttl=255 time=0.0 ms But it is still showing a dead state.   

Hi All, Please help how to allow only Company URL and Appstore and Playstore apps for mobile devices on Fortigate 60F, Also i need to block everything else. I used webfilter profile and DNS profile for allow company website and *.apple.com for allow only appstore and compnay site.Now via browser I can access only company website but cannot access appstore application from mobile devices. Any assistance is greatly appreciated.

Dears, could you please provide me with destination URL’s and ports required for the fortisandox  and if it bidirectional or not   

Hi guys! Like in the subject we have a Forti 40f with a static public ip over dhcp client from ISP.From the ISP we also get another public IP block/pool which is routed to our fixed IP. The goal would be that I can use my new public IP's on my 2nd Mikrotik router. Many posts about this say that VIP's should be used but as I'm not a Forti native guy can I find some GUI tutorial for that? Thanks!

Hi everyone,  I'd like to modify the password history in Fortigate so that the admin cannot reuse any of  X amount of passwords previously used by the admin. I have read a previous post (see link below) in the forum from 2022 where it was stated that the user could not resuse the last 3 passwords and this amount could not be modified. Since it has been 2 years now, has Fortinet changed this in later FortiOS versions?   https://community.fortinet.com/t5/FortiGate/Technical-Tip-Number-of-last-password-recorded-in-FortiOS/ta-p/205780#:~:text=Technical%20Tip%3A%20Number%20of%20last%20password%20recorded%20in%20FortiOS&text=When%20this%20setting%20is%20configured,number%20of%20last%20passwords%20stored.

Hi everyone, Is it possible to disable USB mass storage in a Fortigate? Or as an extrememeasure disable the USB port completely? 

Hello Fortinet Folks! Is there a CLI Command that shows how many address objects are currently a member of an existing address group?   I know I can view this from the GUI, but I'm just looking for a faster way of verifying if I've already reached my maximum address object members on a given address group, so I can either use a different group or create a new one. TIA!  

Hi,I have multiple VLANs that are working just fine. The last one I created cannot acces some Microsoft website and the username field on iCloud.com won't show up for example. I tried to redo the VLAN multiple times the see where I f*d-up. I cloned the rules from another VLAN that is working fine. I created a rule allowing Microsoft365 Internet services and portal.office.com finaly loads but there is other glitches and you can see a lag when the page load.Any help will be appreciated.Thank you Edit: even with web filtering disabled, iCloud won't workEdit2: FortiGate 601E v7.2.8Edit3: The problem is with the interface, not the VLAN

Hi Team,  I am replacing Cisco ISE with FortiNAC. The Cisco ISE is currently configured to profile the Access Points and send a Cisco Neat attribute. This Neat attribute helps the Cisco switch assign a truck role to the port.  In FortiNAC, Network Access > "Configuration" - It does not provide any option to send radius attribute only and VLAN ID is mandatory. https://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/116681-config-neat-cise-00.html cisco-avpair = device-traffic-class = Switch I want to check if FortiNAC has a way to sort this situation.  Regards, Barry Ghuman 

Hi everyone,  By default Fortigate is set to have a maximum of 3 password attempts and a 60 second lockout. But I want to set the bad logon counter to 15 seconds so that after a user has typed in for the first or second time the wrong credentials (before reaching the password attempt threshold) and waits for 15 seconds, the number of wrongly typed passwords is reset back to 0 and he can retry again. What commands should I run to make this happen?

Hi folks,I have a small but annoying problem with FortiClient.Every day when I connect to the VPN for the first time I get kicked after a few minutes. At first I thought it was a problem with the internet connection, but I ran a ping and WireShark, WireShark shows no errors and the ping has 0% packet loss.  I then reset my network under Windows and finally reinstalled the entire OS - unfortunately without success.The strange thing is that this only happens the first time I connect, if I get kicked off and then connect, the connection lasts the whole day without any problems!The FortiClient log file shows the following message: error sslvpn FortiSslvpn: 1540: error: WSAEnumNetworkEvents FD_CLOSE (10053)info sslvpn FortiSslvpn: 3132: Ras: connection to fortissl terminated I'm using FortiClient v7.0.5.0238. I'm curious if anyone here has ever had the same problem.Thanks in advance! 

Hi everyone, all Fortinet services are down: DNS, security filter, everything is dead. Does anyone know what happened? 

Good morning friends, I need your help. I am having problems accessing different web pages that I used to access normally and today I have had those problems. When I try to access a web page, the following message is generated (see image), the strange thing is that after several minutes it is possible to enter the page, however after another minutes or hours. the same message from the image returns. In short, the problem is intermittent. The connection is not privateAttackers may be trying to steal your xxxxxx.com information (for example, passwords, messages, or credit cards).NET::ERR_CERT_AUTHORITY_INVALID  The policy I am in has all security profiles enabled including the ssl certificate inspection. Checking the firewall, I noticed that the fortiguard servers were down and the following red message "Unable to connect to FortiGuard servers" was displayed. Additionally, the firewall used fortiguard DNS. Could you tell me if my problem accessing the w

This is not a critical issue and do not need a solution for it right now so much as I want the community/devs to know.  It should be known that I just finished a firmware update to v7.0.15 build0632 (Mature). It works just fine when I exclude other countries like United States or Canada, and I was using both with and without a policy filter. It freezes even when I only add Cote d'Ivoire (source country: ! Cote d'Ivoire). 

Hello Everyone, I changed the fortinet device interface settings unintentionally.I have changed the subnet from LAN to WAN and lost access to interface.I got a console cable and can connect to fortigate via Putty terminal.How can I reverse this?Below is my system info; your help is much appreciated.# show system interfaceconfig system interfaceedit "wan"set vdom "root"set ip 192.168.1.99 255.255.255.0set allowaccess ping https ssh http telnetset type physicalset role wanset snmp-index 1config ipv6set ra-send-mtu disableendnextedit "lan1"set vdom "root"set type physicalset snmp-index 2nextedit "lan2"set vdom "root"set type physicalset snmp-index 3nextedit "lan3"set vdom "root"set type physicalRemet # show system interfaceconfig system interfaceedit "wan"set vdom "root"set ip 192.168.1.99 255.255.255.0set allowaccess ping https ssh http telnetset type physicalset role wanset snmp-index 1config ipv6set ra-send-mtu disableendnextedit "lan1"set vdom "root"set type physicalset snmp-inde

With forticlient 7.4.0.1636 on a laptop running a new install of Debian 12, the VPN connection process seems to complete normally but there is no traffic (bytes received remain at zero). Inspection of the logs shows no apparent problems, but I cannot connect to the remote systems ("no route to host"). But if I do "nmcli device status" I see that a fctvpn tunnel has been created. I can manually connect this by doing something like: sudo ip route add 10.100.123.123 dev fctvpnf01234567 After this I can access the specified host as normal, and the traffic counts update. Any ideas why the normal connection process is not completing?

Dear all, do you guys know what is the username and password for " fortimanager.com" ? I have tried username " demo" password " fortimanager" but not success.....

Hi, Does anyone know how to control uninstallation of FortiClient for android devices on FortiClient EMS?Is it doable? Thanks

I have purchased an Asus Vivo Book with the Snapdragon X Elite processor, so i am unable to install the the app through the installer, I've installed the Microsoft store version but am struggling to configure it correctly. The information i have been provided about my jobs VPN is that its using SSL-VPN with a work domain for the remote gateway, with the port 443 and the need to enable SSO for VPN Tunnel, which is supposed to direct me to a login page using my work email and password. Can someone please help me with the configuration of this I need it sorted ASAP. Thank you. 

can we disable a license notification (red icon), we have an ATP license and it is valid, but we don't need the WebFilter license, so it is expired but the alarm still exists, how can we remove the related alarm, note that it is not used in a policy or anywherethanks

Hi, I created a small program that helps firewall admins to create Wireshark comaptible pcap files on diskless Fortigate models. You can find the "fgsniffer" here on Github.It works for me on Windows and Linux, now I need some testers!Feedback is welcome.Cheers, Dirk