Support Forum

Does anyone have a recommendation on how to set up two IPsec tunnels? The client sites are using Fortigate-60e (Firmware 7.2), which will be using the home WAN internet with a one IPsec tunnel back to our HQ. But we are hoping to add another tunnel to the client fortigate to another backup HQ site in case the primary HQ goes down. Not sure if there is more than one way of doing this. 

Hi Fortinet Community, One of our clients wants to upgrade their FortiGate (physical appliance), deployed on-prem as an edge firewall. The current running version is v7.4.2, and the client wishes to upgrade to v7.4.3. Could you please confirm if v7.4.3 is a stable version and does not contain any significant bugs or issues? If it is not stable, could you suggest a stable version of FortiGate to upgrade to? 

Hello,  we seem to be converging in the security space with end users and the free version of the FortiClient.Currently deployed via Intune 7.2.2 FortiClient SSL VPN with SAML authentication back to Entra.  When it works its no problem, however we also use the same method inhouse and I'm aware that on occasion you need to restart the FortiClient by shutting it down in the task tray and re-launching it.  So what's the issue? Well moving end user(s) away from local administrative rights whereby this is the only issue we face at present, end users receive a UAC prompt when attempting to close/open the FortiClient otherwise its a full machine restart. Has anyone got around this as yet without sacrificing security?I may have to provide an additional IPSEC tunnel if the situation does not improve. Thoughts?

I am using a VM image of Fortigate version 7.2.7 that I downloaded from the Fortinet website.I have the following problem: I configured VLANs on the firewall to control communication between VLANs. After one hour, the communication between two different devices via the firewall stops.To resolve this, I need to format the firewall and restore the backup, which makes it work for another hour.I am using EVE-NG version 6.2.0 and emulating Fortigate 7.2.7. I have tried other versions as well (EX: 7.0.0, 7.2.0), but the same error occurs.

Intermittently, we have an external user that is unable to establish an SSLVPN connection. When it does occur, he following error message is displayed: "Failed to establish the VPN connection. This may be caused by a mismatch in the TLS version. Please check the TLS session settings in the Advanced of the Internet options. (-5029)."I've verified the user's TLS certificate settings as outlined here: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiClient-TLS-error-5029-failed-to/ta-p/190478?externalID=FD48705  but the issue persists. After further troubleshooting, I created a second profile changing the remote gateway from the website address (vpn.website.com) to the website's IP address (123.123.123.123). The user was able to connect but they had to install the remote gateway's certificate to the workstation's personal and trusted publisher certificate stores.  I then switched back to the profile with the using the remote gateway web ad

Hello everybody,I'm struggling with deep packet inspection. My scope is not to use the FORTINET_CA_SSL certificate. But there is one thing I don't understand:only the certificates under the "Local CA Certificates"section can be used? Can't I use the certificates under the "Remote CA Certificates" section? If not, what kind of certificates can be added to the Local CA Certificates section?It's not deeply clear to me the difference between the two sections. Thank you for your help!  

some Clients gets an Certifcate Error (they use Forticlient Version 7.4.0) we used a working "wildcard" certificate but if i connect with the Forticlient i got an "CERT_COMMON_NAME_INVALID" Error (we use SAML authentication)in the error message i see the IP Adresse instead of the DNS Name. i can make an exception but the Client won't connect to the Fortigate.for me it looks like a Client Problem becuase most of the user don't have this Problem, these probably use older Fortitclient versions.

Hello, I am a user of Fortigate 7.4.4. I have an architecture based on a root VDOM, where my WAN connections arrive, and then interconnection links with my child VDOMs (as shown in this diagram visible in the Fortigate documentation). My infrastructure is shared with a client. My client wants to set up an IPSEC VPN on their VDOM but is encountering problems and needs logs. The logs are not very verbose, and there are even no logs in the FortiGate GUI for their VDOM. I have to use the CLI (still within their VDOM) to provide them with traces. What can I do to give my client more visibility? Thank you for your help.

Hi all In this release notes the bug ID 764679 "enhance" the MIB in a way that our NMS system is not able to discovery in the right way the IPs of the Firewall running FortiOS 7.0.14. How we can bypass this "wrong behaviour" ? Thanks in advance

Hello team.What kind of users can be used in FortiSwitch NAC user policy?:1. local?2. active directory - if so, only via captive portal or another way?....thanks a lot!Michael 

Are you also getting the daily report for your Fortigate from Forticloud by email?What bugs me that these email do not render fine on my iPad. Attached PDF is not visible and the content in the email https://9apps.ooo/ .Not sure what the reason is. Do you know why? A setting? I use the native email app.

Hello everybody,I want to perform custom deep inspect, but I don't wanto to use the default FORTINET_CA_SLL certificate, so I decided to create a custom profile.(I'm working on FortiOS 7.2.8)I generated my certificates with Let's Encrypt, and I have 4 files:cert.pemchain.pemfullchain.pemprivkey.pemSome informations inside them are:1) cert.pem{ "name": "\/CN=xyz.com", "subject": { "CN": "xyz.com" }, "hash": "xyz", "issuer": { "C": "US", "O": "Let's Encrypt", "CN": "E5" }, "version": 2, "serialNumber": "xyz", "serialNumberHex": "xyz", "validFrom": "240628134133Z", "validTo": "240926134132Z", "validFrom_time_t": 1719582093, "validTo_time_t": 1727358092, "signatureTypeSN": "ecdsa-with-SHA384", "signatureTypeLN": "ecdsa-with-SHA384", "signatureTypeNID": 795, "purposes": { "1": [ true, false, "sslclient" ], "2": [ true,

I have fortigate 100E firewall at our Head office (10.10.10..0/24) with multiple branches connected to it via ipsec tunnel. Cloud infra on azure (172.16.10.0/24) is also connected to Head office firewall. Users in Head office can access the Azure cloud server. But now I want to provide Azure connectivity to one of the branch office (10.10.20.0/24) which is already connected to head office firewall.What configuration i need to do on branch and head office firewall? For azure cloud configuration, their support team will help.

Hi guys, I've been struggling with this issue for months and figured I'd ask for help here. Fortigate 60Es are rated as 3/3/3 Gbps on their spec sheet: https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiGate_FortiWiFi_60E_Series.pdf - Does that mean that they can forward 3 Gbps from vlan to vlan? Also, does that work with Link Aggregation? I can't seem to get my LACP/Link Aggregation to work properly with an SG550, or at least I think. I've attached a network diagram. I've configured two ports as LACP in SG550 and connected them to the 60E, using IP/MAC Address Load Balance Algorithm.[ul]I've configured an 802.3ad Aggregate on the 60E and created vlans under the Aggregate interface.Static routes on both devices for vlans are pointed at each other.It seems like the network speed is sharing 1 Gbps when I Iperf from two devices on vlans 5 and 6 to two other devices on vlans 1 and 3.[/ul] My Tests[ul]Vlan 1 Device (Firewall Interfaced) - 192.168.10.1V

Hi,i have problem with correct settings for VLAN mangment.I have two subnetsLAN (192.168.0.0/24) VLAN1 (connected to D-LINK Switch)MGM (10.10.5.1) VLAN5 (FortiSwitch) Two switches are connected to my Firewall SonicWall on separete port (PORT0 for D-LINK, PORT4 for FortiSwitch tagged 5) Fortiswitch is connect to my firewall on port 23 (native VLAN 1, Allowed VLAN 5) I Create VLAN interface on Firewall and set access rules for allow all traffic (temporary) between VLAN 1 and 5 On Fortiswitch i connect two devices on port 7,25 (Native VLAN5, Allowed VLAN 5)Communication work, i can access from LAN to MGM via ping and https and vice versa, devices inside VLAN5 also have communication beetwen each otcher. Problem is when i try connect from LAN to FortiSwitch to managment access. I can't any ping or HTTPS.In FortiSwitch i create VLAN5-MGM with ID 5 with ip 10.10.5.1/24 and access HTTPS,PING,SSH as physical interface select only one available internal (on System->

FortiOS 7.2.8 Main Lan 10.1.10.0Dialup Users 10.20.30.0Fortinet IP 10.1.10.1 Secondary LAN 192.168.0.0 Why can't dialup vpn user see all subnets, I have some IPs 192.168.0.0/24 on the same switch lan as 10.1.10.0 Dialup VPN users can browser 10.1.10.0 just fine but can't see 192.168.0.0, Since VPN takes 10.20.30.0 to 0.0.0.0. Shouldn't they see anything plugged into LAN port 1? So LAN port 1 goes to switch, some machines have 10.1.10.0 and some have 192.168.0.0 on them, dialup vpn users can not see the 192.168.0.0 ip's RulesStatic Route10.0.20.0 lt2p interface Dialup -> WAN1 - All All Lt2p Servicel2t.root -> LAN  -  Dialup Range to ALL  

Hi all, so I've gotten a training kit from my new employer, which includes a FortiGate 60F, FortiSwitch 108FPOE and a FortiAP 231F. Setting up the basic stuff was more of less painless, but now i'm struggling with some VLAN configuration issues.  Let me start of by describing the topology. The FortiGate is connected on wan1 to the internet. Port A and B are connected to the FortiSwitch through FortiLink on ports 9 and 10 (SFP RJ45).  What i'd like to achieve is create two access ports for VLAN30 on port 2 of the FortiGate and port 8 of the FortiSwitch.  Tried a million different configurations but the one that makes sense is this one:- Get port 2 out of the internal VLAN Switch on the FortiGate.- Create a new VLAN Switch and assign it VLAN ID 30, and use port 2 as it's member. - Create address object matching subnet - enabled- DHCP server - enabled On WiFi & Switch Controller -> FortiSwitch VLANs- Create VLAN 30 - Set IP/Netmask

Hey there,I am having the same, or at least very similar issue, with the FortiNet VPN. I am running Starlink Residential and have 100-200 Mbps when testing through the app, 150Mbps when going through my iPhone and WiFi (AC2200 Orbi), and 30Mbps with my 11 year old desktop. All with pings in the 30ms. However, on my 'work' computer, a nearly new HP, I am getting 15Mbps with 30ms pings.  So pings are not delayed, but data is severely restricted. Through many tests it is usually 50% or less of what the computer next to it not on VPN is getting (again the desktop is 10+ years old with a card that old). The only thing I can guess is that the VPN tunnel does not handle intermittent packet losses well. But that is a guess and way above my knowledge. Our office IT is run out of LA, so I do not know all of the details as to what is happening. And yes, the VPN tunnel goes from Las Vegas to Los Angeles. 

I have created a two IPSec tunnel for two ISPs between FGT1 and FGT2 as Site to tunnel with SDWAN Enabled.   Both Tunnels are added as members in SDWAN zone.  Static route is configured with the remote site networks in both the sites. In bound and outbound policy from LAN to SDWAN zones and vice versa is in place in both FortiGates. Have place LAN PCs behind both the FGTs Ping is working from FGT2 LAN PC to FGT1 LAN PC. But vice versa(FGT1 LAN PC --> FGT2 LAN PC) is not working where as if I use ping from FortiGate using execute ping-options source <LAN interface IP> it is reaching remote site. Phase1 and Phase2 are up for the tunnel in both the fortigates.   Topology  LAN PC[192.168.170.20]--FGT1 ------------------FGT2 ----------------LAN PC[192.168.160.20] ping 192.168.160.20 ---> 192.168.170.20 -Working ping 192.168.170.20 ---> 192.168.160.202 - Not Working    Same If I try through performance SLA in FGT is working. Can you help me w

Error: Unable to establish the VPN Connection. The VPN server may be unreachableQuestion: How do you solve this to get the user connected?Version: Forti Client VPNSetup_7.2.4.0972_x 64 

Is it possible to configure FSA to do a dynamic scan on a certain VM clone based on the user or machine the file came from ? For instance, if the file came from a Windows 11 user, is it possible to force the dynamic scan to a Windows 11 clone only ? 

WIFI users of the network can connect to the FortiExtender 101F-AM device ?

Hello everybody,I am facing an issue with my FortiGate firewall i have activated LDAP there is no problem the test of connectivity is successful, but whenever i tick the secure connection and activate the LDAPS the test of connectivity replies with can't contact LDAP server what is the problem ? (am not using any certificate as the option is untick)regards

Hello,Lately i have been trying to add my virtual FGT into fortimanager in EVE-NG platform. However it doesnt work, here is the error that i got on Fortigate web interface. i checked in Fortimanager CA certificates, serial number is 00 which different from original serial nubmer of FM but i can not modify it. Anybody has a solution ? Also when i try to add device on FortiManager web interface it also doesnt work, somehow FortiManager can not reach device and it shows me "Probe Failed" error. Device interfaces are pingable in same network...(FMG acces enabled on FGT) Both appliances running with evaluation license and it is totally okay. 

hi,hope all fine. im using win 11 with all latest update.i was using forticlient VPN so far with no prob.recently my compnay enabled 2fa FortiToken for remote work.but when i try login, it stuck at 48 and entring token not show up.have no idea wts goin on.appreciated if u can help me.