Support Forum

Hello, I tried to search forum, but I didnt get resolution for my problem. Looks like when I want to backup config from CLI it takes first IP from interfaces as source ip address which is not 0.0.0.0. Is there any option how to set correct source ip address for backup config command?There are options fot NTP, LDAP, DNS, PING, etc., but not for backup. Is there some possibility how to set correct IP/interface which should send backup config to TFTP/FTP? Thank you.Boris

Hey all, We have a FortiAuthenticator VM running and would now like to integrate our hardware tokens into it. We were told by our Fortinet sales guy that it would not be a problem to integrate non Fortigate hardware token generators. Unfortunately, I can't find anything about this on the internet. Can you tell me if it is possible to integrate non FortiToken hardware devices?Thank you.Kind regardsMarc

hi, we saw a lot ip connection errors, but firewall rule is "allow", and most of the traffics can pass through. Can anyone please advise why there are so many "ip connection error"? Thanks in advance!

Dear Fortinet Community,We are currently experiencing challenges with a WAF deployment project using FortiWeb version 7.4.3. Our goal is to migrate several web applications behind FortiWeb, but we have encountered a routing issue due to our network configuration.In our setup, we have two different FortiGate physical appliances, each configured for separate ISP connections. One FortiGate is connected to a physical port on FortiWeb with a distinct subnet, while the second FortiGate is connected to another physical port on FortiWeb. We have created two different virtual IPs (vIPs) on both FortiWeb ports where each ISP terminates, and we have linked these vIPs to a single virtual server.Currently, we have configured a default route pointing to one of the ISPs. However, the issue we are facing is that all responses are being routed through the ISP associated with the default route. We have attempted various solutions, including Policy-Based Routing (PBR) and static routes, but none have res

Hello everybody,I have a BIG problem and was start when I decide to upgrade my 200F ( Np6 Xlite cpu )at new release 7.2.8.My scenario is a FGT with multiple a IpSec VPN Dynamic and several SSL VPN Portal .In the initial version 7.2.3 we had no stability and connection problems. After the update we noticed disconnections after a few minutes and constant instability. We were forced to downgrade at the more stable 7.2.5. Even version 7.2.8 that read in the release notes that the problem had been solved was not a solver of the problem.We also have several test FWs that have an NP6 process and also on those we have noticed the same problem. ( 300E , 3000D ).And on these we also put the latest version 7.4.4. with the same result. Below I show you the typical configuration of a VPN connection: config vpn ipsec phase1-interfaceedit "VPN_XXX"set type dynamicset interface "VLAN_7"set mode aggressiveset peertype oneset net-device enableset mode-cfg enableset ipv4-dns-server1 10.12.

Hello everyone,I'm looking for guidance on configuring a network authentication scenario using FortiGate and FortiSwitch devices, along with a FreeRADIUS server. Here's my hardware setup:FortiGate 100F running firmware v7.2.8FortiSwitch 148F running firmware v7.4.2FortiAP 231G running firmware v7.4.0FreeRADIUS server (version 3.0) running in the internal LANAuthentication Requirements:I need to authenticate devices (both on WiFi and LAN) using certificates only, without relying on user credentials or MAC address filtering.Questions:Is it possible to implement certificate-based authentication in this setup for both LAN and WLAN?What would be the recommended approach to configure this scenario using FortiGate and FreeRADIUS?Any guidance, tips, or configuration examples would be greatly appreciated.Thank you in advance for your help!

Hi everyone. I'm new to the community and Fortinet in general. And it's exciting learning about all of the features of the fortigate. This is likely a very simple issue to many of you.I'm facing an predicament where some users are trying to access internal office resources abroad using SSL VPN, but seem to be facing a conflict because their home networks fall into the same subnet (192.168). Rather than re-addressing their entire home, or the office network, I've been following this guide which suggests virtual IP mapping might be an elegant solution: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-with-overlapping-subnets/ta-p/189886 However, when I test it myself, I can connect to the VPN tunnel, but none of the local IP addresses get mapped to the new address ranges that I specify. Admittedly, I get a bit confused by the terminology used in the UI, (such as "External IP address range") I'm not exactly sure which IP range I should put there.

Hi Is there a way, when i guide one of my host into VPN tunnel and it works great.Is there a way, to ping it over a WAN interface also ? 

For our edge switches we are using fortilink over Layer 3, which has been working fine. One of our deployed switches has been acting odd and I noticed that the automatically created fortilink interface on the switch is pointing to the secondary HA fortigate instead of the primary. Same goes for the trunk port. This causes a constant HA sync issue, but otherwise the switch seems to be working Ok. How do I go about correcting this? Is it as simple as modifying the auto-created fortilink interface on the switch or is there some better way? Thank you.

Hi,I'm configuring a FortiGate 400F for VPN authentication via RADIUS with RSA Authentication Manager, but I can't get access to VPN/Admins via groups to work.(If I create a Firewall group that reads all RADIUS it works, but if I create a Firewall group that matches a single  RADIUS group it doesn't work) I've configured the Firewall side:config user radiusedit "RSA-ARLUNO"set server "x.x.x.x"set secret .....set radius-coa enableset radius-port 1812nextendThe group is configured as follows:config user groupedit "Utenti_VPN_RSA"set member "RSA-ARLUNO"config matchedit 1set server-name "RSA-ARLUNO"set group-name "Utenti_VPN_RSA"nextendnextendOn the RSA Authentication Manager side, I created the Radius Client, the Radius Agents and added the Fortinet VSAs. If I create a RADIUS profile on RSA that always returns the value "Fortinet-Group-Name" - Utenti_VPN_RSA works, but it has to be a dynamic field. Can someone help me out?

Hello! We have a Fortigate 60F running latest mature (7.2.8) FortiOS. We would like to inspect (as much as possible) email traffic, ie around 10 users accessing Exchange Online via latest Outlook clients on Windows and using default protocols (MAPI over HTTPS?). We are clear on how to inspect IMAP/POP3/SMTP traffic, but not sure how to handle Exchange Online default protocol. Fortigate docs mention RPC over HTTP (should be deprecated for Exchange) as well as MAPI. Is MAPI the way to go. If so, how should we configure policies, profiles etc. to separate from the rest of HTTP/Microsoft traffic and make sure email and antivirus detections/profiles are applied. Also, while 7.2.8 still makes it possible to enable proxy-based policies and profiles (MAPI inspection not supported in flow-based), what is the way forward for M365 Excange Online inspection on < 2GB RAM devices for smaller networks? Any advice is welcome. Thanks!

Hello expert, I configured a ssl vpn remote and was successful able to establish a remote session  from my laptop.how can i view the entire logs for any attempt from my laptop to resource on the "lan" network behind the FortiGate.I search under log and report  forward traffic unsure if I  am searching the correct place but I am not seeing any  inbound traffic. I humbly request some guidance. Thanks  Regards    

hi all we have an issue with two Fortinet firewall in production mode (Fortinet A and Fortinet B). We followed these manuals: https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-high-availability/HA_VRRPFailover.htmhttps://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-high-availability/HA_VRRPEx1.htmhttps://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-high-availability/HA_VRRPEx2.htm and configuring priority 255 in both routers (Fortinet A and Fortinet B) leads into a split-brain situation. can someone please help us with this issue and explain why this behavior?

Hello,Is it possible to retrieve "All Events" from the Event Monitor in FortiAnalyzer using CLI or API? Ideally, I would like to retrieve events that are not blocked by FortiGate. 

Hi all.In the Company i am working, we are wanting a way to connect Forticlient Vpn without user intervention. We understand the risks, but it is necessary. We tried with a .bat executable file, but it is not working. It execute the forticlient, but it doesn't connect. We asked for help creating a ticket to Forti, but the Technical Support sent us a link with information we had seen previously. If somebody had a similar problem, can tell me how to resolved it? Thanks, i am reading you.

Hi, I have a FG60F with 7.4.4 and 3 Internet Accesses with a SD WAN. I have a SD WAN Implicit Rule with 40-40-20% for Volume. Checking Performance SLAs all of them seem OK but since I have the implict rule, I dont apply SLA. Now I saw that WAN1 just had like 2 sessions all the time so I checked directly on the router and I get like 1GB. Than I disconnected WAN2 and Internal5 which are in the SD WAN and I can ping from the FG but NOT from LAN. Sniffing the ping to 8.8.8-8 I see that traffic is not going out to SD WANXXX-XXX # diag sniffer packet any "host 10.10.14.25" 4interfaces=[any]filters=[host 10.10.14.25]0.131501 lan in 10.10.14.25.57343 -> 10.10.14.1.444: psh 3371949728 ack 42930140730.131567 lan out 10.10.14.1.444 -> 10.10.14.25.57343: ack 33719498140.142213 lan out 10.10.14.1.444 -> 10.10.14.25.57343: psh 4293014073 ack 33719498140.142847 lan out 10.10.14.1.444 -> 10.10.14.25.57343: psh 4293014619 ack 33719498140.142987 lan in 10.10.14.25.57343 ->

Hi.We are using Cisco ISE with the pxgrid connector to fortimanager and that works fine.but need to create fortigate policies with a user on both source and destination cause our cisco sda uses /19 subnets and seperated with sgt tags (pxgrid).But when im trying to install a policy im only able to do source user, on destination there's no user tab.Is that working as intended? cause then i need to have fortinet to make it work, out local fortinet team said it should work.thx Morten

Hello Community, i have a little problem with my wlan in the office. I manage my FortiAPs over my Fortigate 500E. All is fine, but I have a problem with my FortiAP 231F. They work fine, but I have the problem, that Clients which are connected on the same FortiAP, they cannot reach each other. Clients, who are connected on different FortiAPs, have not this problem. I have the Problem only on the FortiAPs 231F, and only, when the Clients are connected on the same AP. I can´t find the problem. I connected on the AP directly via HTTPS and checked all configurations. I created a new AP-Profile, but it´s the sa Has somebody an idea?

Hello team, We have identified a discrepancy of nearly 5 million session counts in the FortiAnalyzer session data. While the actual data from FortiGate indicates a total of 1,000,000 sessions for a specific time period, we observe only 5,000,000 sessions in FortiAnalyzer for the same period. We need to investigate the factors contributing to this discrepancy and determine whether we can trust the data. Is there real-time synchronization between the devices?

Hi, I'm wondering what is the best way to connect two Fortigates via LAN connection. both boxes are in the same buildingThe purpose is to allow access of resources for example (Printers VLAN) or any other resource I have configured a dedicated port for the link on both Fortigates and assigned an IP of 10.10.90.2 and 3 for both endsI can ping from both, I have created a static route on both to route the traffic to the gateway address on both.I can not ping the resources from workstations on both ends and I do not have internet connectivity.I tried to create policies on both ends to allow the traffic with no luckany idea how this can be accomplishedThank you

Certificate I am trying to send syslog from my Fortigate 40F firewall to a Syslog Server with SSL encryption but I get error "Unknown CA". Certificate GenerationI have generated a root certificate and a server certificate following the guide found here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Send-Syslog-over-TLS-to-a-rsyslog-server/ta-p/248101 I uploaded the certificates to Fortigate Firewall Certificates:  Then I have the following settings on my Firewall:acdc-fortigate # config log syslogd settingacdc-fortigate (setting) # showconfig log syslogd setting    set status enable    set server "34.10.1.5"    set mode reliable    set port 6514    set enc-algorithm high    set certificate "syslog-servercert"endOn my collector server where I run LimaCharlie Adapter I get the following error: Jul 09 10:57:30 dev-colle

what difference between FortiGuard updates and firmware updatesthanks

Hi everyone, I have read that in previous FortiOS versions, for fortigate devices without onboard memory, it was possible to store logs to an external memory. Is this now possible, or do you still need a Fortinet-licensed product (e.g. FortiAnalyzer or FortiCloud) to do so?

Hi Team, I am having trouble with FortiGate connection to FortiGuard server with this error reflecting in the GUI:"Unable to connect to FortiGuard servers" Current topology is:FortiGate (with Issue) ---- Router ---- Another FortiGate ---- Internet I can ping below:exec ping service.fortiguard.netexec ping update.fortiguard.netexec ping guard.fortinet.net Diag Debug Rating:2 Servers Listed and has F flags in it Already changed between protocol 8888 and 53 (no 443 available in my FG)Already enabled and disabled the anycastManagement VDOM is 'root' Config:config system fortiguardset fortiguard-anycast disableset protocol udpset port 8888set sdns-server-ip 208.91.112.220    <-end Anything else which I can try to make the server reachable?  Thanks!

Hi,Does anyone tried to pass internet traffic from a remote site that has VIP configured via IPsec =>without<= using NAT in the policy for the inbound traffic for that VIP?Basically what i am trying to do here is to pass the Public IP source info to various servers in following inbound flow: Internet -> VIP -> FTG-site1 ->IPsec->FTG-site2->ServersDue to local restrictions something like VIP -> FTG-site2->Servers won't be possible, so my only option is the one above via FTG-site1.I have no issues revealing Public IPs via VIP inbound that are connected to local LAN on FTG-site1 by having disabled the NAT on the responsible inbound policies, but when comes to IPsec, such approach does not work only with NAT enabled in the policy so now the servers on the remote site FTG-site2 only sees the IPsec interface IP for each session that is not ideal for security logging purposes.