Support Forum

Hello, I have Fortigate with a lot of sslvpn portals.in the sslvpn settings I have entered local DNS servers which are replaced on the network card of the end device during the Forticlient connection and this is ok.But I have one portal that needs to use different dns than those in settings. does setting split dns replace the DNS on the network card of the computer with forticlient?the problem is when computers with AD are used and have a different DNS than the domain controller, which is sometimes problematicFortios 7.0.14

I am using a FortiGate 40F with version 7.2.8 and I attempted to download a license for FortiAnalyzer Cloud, but when putting in my timezone and clicking "Submit" to proceed, I get this error below: Fail to download license, please give it try later. [Error_code: -3040] I am not sure what may be causing this error but I am curious to know if others may know what this error entails as I was unable to find an answer for this.

Hello !  I'm new witth Forti Technologies and I work at an IT department.I've earned a gift for working a lot of hours straight for weeks and this gift is a FortiGate 200A. I absolutely don't know this firewall, so I just got home, plugged the console port to my computer and launched Putty but unfortunately, nothing appaers, just a black screen. (WTF is this poisoned gift) Reading this forum, I tried to reboot the firewall while watching the putty window.It displays this : FG200A (19:06-02.28.2006)Ver:0400000300000000000000 And then nothing, so I can't go on an eventual maintenance menu or execute a factory reset. Could you help me to access to the firewall or reset it ? Thanks a lot !Have a nice day,Hamza

Hello, We are hosting a client on our infrastructure and have set up VDOMs as follows:  We use FortiManager and have created an ADOM that contains the client's VDOM. The client can manage their firewall rules autonomously. We have assigned them 10 public IPs and I would like them to be able to manage these autonomously as well. How should we proceed? Thank you for your help!

Recently fortisniff2.sys driver has caused multiple BSODs on our Win 8.1 computers when waking from sleep. We have tried to find the cause and ran into this which states different Forticlient driver, but is otherwise very similar issue: https://answers.microsoft.com/en-us/windows/forum/windows8_1-hardware/getting-multiple-bsod-since-upgrading-to-win-81/c84de019-e84e-494e-9ac1-848674e63755 Can someone from Fortinet comment on this please? We use registered 5.2.1.0605 clients. Thanks in advance, Ivan

Dear All,         I'm new in fortigate firewall, and i have a simple question would like to ask regarding on fortigate 100F firewall, and the firewall now are behind a internet gateway. i want to make use of the fortigatae to act a internal firewall, the wan port connect to dmz switch (192.168.81.0/24) and lan port connect to core switch (10.1.12.0/24), so that i can create policy from wan to lan, and lan to wan with security profile ? is this design look correct to you ? and if this look correct, can i use for example create a lan switch (name external) and add interface port 1 connect to dmz switch, and create another lan switch (name internal) and add interface port 10 and connect to core switch ? and create policy from external to internal and internal to external ? or i must use wan port instead ? and if the fortigate are in transparent mode it can not achieve above ? any help would be appreicated  Keith

Hello, I am trying to use our FortiManager to configure SAML (using Azure) for VPN access to our remote FGT's as a "break glass" means of getting access to our FGT should the FMG be offline or the HQ site is destroyed.  The idea is that we can VPN in to the remote FGT and then access the Admin console from the inside rather than have the Admin console facing the outside. I have entered all the Azure url's and certificate per what instructions I have found.  When I go to the VPN Settings and attempt to add the Azure user group I get this error. user/saml/azure/ : datasrc invalid. object: vpn ssl settings authentication-rule.1:groups. detail: <group name>. solution: datasrc invalid I have poured over the user group and I can find nothing that points me to what this error is referring to or how to resolve it.  I understand that the "datasrc is invalid" but I have not found the datasrc that is causing the issue.  I've tried following this link.

While connecting a remote machine(eg: ubuntu) from windows machine via connecting with forticlient vpn for accessing corporate network , it is not possible somehow to get connected to the machine. Please suggest or resolve this case. 

We are unable to reach remote VLAN however VPN seems to be up

Hi All, I need to restrict FMG-Access to a certain IP.Could you please advise if this is what I need?  Or this is the only way to restrict FMG-Access?https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-restrict-FMG-Access-FortiManager-Access-to/ta-p/295120 Thanks in advance.

We need to configure Vdom for our project. but we have only one isp provider.ISP given /30 and /29 ip address. we configured /30 ip with fortigate firewall wan interface and created vlan1 in cisco switch and its worked fine. for vdom wan interface, we need to use this /29 ip address so I create one interface with this ISP /29 Ip address and configured as lan and connect this with cisco switch as vlan 2 and created the policy from vlan2 to wan(/30 ip address) and disabled the NAT and its worked fine. and from another vlan2 interface in switch connected to FortiGate firewall I configured as wan ip address with this /29 ip address and create a separate lan interface Vlan3 for the vdom and created a policy for this and its worked.but in vdom wan ip address /29 ip address, we cant able to access this interface ip address from remote and ssl and ip sec vpn is also not connecting from rem ote network. but sslvpn can connect when the the laptop is in vlan3 segment. i need to know whether

Hi everyone,I’m currently using a FortiGate 30E, which has an end-of-life support date until 2027-03-31. However, I've discovered that the latest version of FortiOS that supports this hardware is 6.2, and its end of support was on 2023-09-28.Given this situation, I’m seeking advice on the best course of action to ensure continued security and functionality for my network. Specifically, I would like to know:Are there any recommended practices or interim solutions for maintaining security on the FortiGate 30E given the end of support for FortiOS 6.2?Would it be advisable to upgrade to a newer FortiGate model that supports the latest FortiOS versions? If so, which model would be a suitable replacement to what the 30E supports?Are there any extended support options available for FortiOS 6.2 or third-party solutions that could help bridge the gap until the hardware EOL in 2027?I appreciate any guidance or recommendations you can provide.Thank you!

I am need of some help, we have a Fortigate 401f that is being utilized for internet off load.  RFC19818 to NON-RFC1918 go out the local internet pipe.   Rubrik support tunnel requires https/443 access to establish a connection to their proxy.rubrik.com site. I have created a firewall rule to all my Rubrik Nodes access to ANY with ANY services allowed with AV, APP, IPS and SSL inspection enabled.  We have asymroute enabled.  On the pcaps, I am seeing a lot of retransmits and I am wondering if this is a possible mtu or mss size issue, but I am not sure how to find that or determine that information from the pcaps.  I think this issue is also causing the same problem with another app that keeps timing out and on it I see retransmissions and a lot of client-rst.  I would I go about detemining the correct mtu/mss size for these applications and I would I make these changes per the policy.  Thanks, 

Hello, I'm running a LACP MCLAG on a couple of FortiSiwtch-1024D (7.4.1). Linked to this MCLAG, I have a computer with 2x10GB interface. LACP is correctly configured and works properly. I can down an interface and all works as expected. I just have a Critical error in FortiSwitch Event and I need you today to understand if this behavior is expected or not and if I have a misconfiguration somewhere. When I unplugged one of my cable in the LACP MCLAG, I can see this in the log :  Critical: MCLAG: ACL failures are detectedNotice : MCLAG: ICL ACL change ingress-port-bitmap=0xFEFFFF01, egress-block-port-bitmap=0x66004000Notice : MCLAG: trk-test all peer link downNotice : primary switch port port1 has gone down What is suspicious is the second notice MCLAG: trk-test all peer link down and the critical event. Do you think it comes form my computer (the way of this machine manage LACP) or should it be related to FortiSwitch ? More globally I don't r

we are noticing that some files do not fully load/open when accessing them from the webpage externally. they tend to load 80% of the way and then just get stuck , is there any settings in fortiweb to check , stuck troubleshooting this and not quite sure where to look other than logs. thanks

Hello all,  i tested here 2 things: Fortigate 60E + Fortiexender 201E and Fortigate 51E + Fortiexender 201E On both it is working fine. With and without  ip-passthrough (capwap). So the goal is in this situation "Fortigate 51E + Fortiexender 201E". But there is big difference between the fortiOS 6.2 and 7.4. On 6.2 i can't find an option for access directly to the fortigate for management over WAN. Please see the attached screenshot. 1 = Capwap to the fortiexender2 = the generated lte interface if i open 2 i can only see the serial from the extender. On the fortigate 60E with OS 7.4.x i can to the same like an normal wan interface. Does it work differently with the 51E? And yes i know with this public ip it will not work (happynet), but if I can't configure it? Or are the settings of WAN2 valid for the release of the Fortiagte Interace? I would then also like to create IPSEC side2side with more Fortigates. Very thanksKind regards

Hi All,when we are calling below API endpoint to get the Webfilter logs from FortiCloud we are getting the error.https://api.fortigate.forticloud.com/forticloudapi/v1/fgt/FGT12345/api/v2/log/disk/webfilterError. - http_method': 'GET', 'status': 'error', 'http_status': 404, 'vdom': 'root', 'path': 'disk', 'name': 'webfilter', 'action': '', 'serial': 'XXX', 'version': 'v7.0.14', 'build': 601}

Hi all, i have a HA (active passive) pair of 100E fortigate firewalls and want to enable 2FA for SSL VPN. Current SetupWe use LDAP auth, with any users in a specific AD group allowed to VPN in, saves us having to create individual users on the firewall. 2FA SetupTwo me it appears i can use either Fortitokens or a Certificate for 2FA, but from reading and testing it appears that for both methods i need to create local users mapped to LDAP users on the firewall. Then i can either apply a token or a cert to each user (LDAP or PKI), is my understanding correct? Is there any way to enable 2FA without the need to create individual users on the firewall? Thanks

 Hiwe want to monitor our FortiAP221E ,we tried to search for it but couldn't find any document from where to enable SNMP keep in mind we use Zabbix to monitor everything is there any documentation or anything that can help me ?anything any video is appreciated regards

Hello Everyone,Todays morning wasnt as good as yesterday. I just have been triggered that FortiWeb 600D has high CPU usage and some services arent running. So I started SSH session to check basic debug commands and saw that "7402m 46.6   0 77.5 /bin/proxy" <--- this process was taking most of CPU load peak were to 90%. Im wonder what could be the issue. There was no high traffic, a few hundreds of sessions which nothing for this WAF model.Lastly I did software upgrade  from 7.0.x to 7.0.10 so it wasnt big upgrade. Im not sure if there is a bug in this version, release note didnt mentioned anything that would indicate problems with proxy process or high cpu usage. So I started to disable security profiles - "cookie security" and suddenly CPU load dropped to few %. Do you have some advice how to troubleshoot it further? what commadns are useful? 

I am having an issue with FAP 231F, they are showing offline/disconnected. They are connected to a FortiSwitch and have VLAN for AP assigned to them. They are not attaining an IP from the FG as well, the DHCP server is working fine as there are other devices on the FG.Fortigate has been rebooted multiple times, FortiAPs have been factory reset. FSW have been rebooted.They have all the setting recommended by Fortinet.FortiGate Version 6.4.15FSW 7.4.2Troubleshooting:-------------------------------WTP 12----------------------------WTP vd : rootvfid : 0id : FP231FTF2309E48Tuuid : 3616ddf2-1eba-51ef-9777-531c42d0d742mgmt_vlanid : 0region code :regcode status : validrefcnt : 2 own(1) wtpprof(1)apcfg status : N/A,N/A cfg_ac=0.0.0.0:0 val_ac=0.0.0.0:0 cmds T 0 P 0 U 0 I 0 M 0apcfg cmd details:plain_ctl : disableddeleted : noimage-dl(wtp,rst): yes,noadmin : enablecfg-wtp-profile : FAP231F-defaultoverride-profile : disabledoper-wtp-profile : FAP231F-defaultwtp-mode : remotecfg-apcfg-prof :oper-a

The FortiAPs i have connected to a Fortigate show offline.The AP vlan has security fabric enabled, the FG version is 6.4.15 and the Switch version 7.4.2.I have tried to factory reset the APs, reboot the fortigate and switch with no luck.The APs are not getting an IP.The dhcp server of the FG works as it should, as there are other devices connected and getting an IP from it.I seen another post stating that I need to either upgrade or downgrade the AP firmware from the console access of the AP.can someone tell me the process for this? I have looked online to no luck.Just one of the diagnose outputs of an AP:-------------------------------WTP 12----------------------------WTP vd : rootvfid : 0id : FP231FTF2309E48Tuuid : 3616ddf2-1eba-51ef-9777-531c42d0d742mgmt_vlanid : 0region code :regcode status : validrefcnt : 2 own(1) wtpprof(1)apcfg status : N/A,N/A cfg_ac=0.0.0.0:0 val_ac=0.0.0.0:0 cmds T 0 P 0 U 0 I 0 M 0apcfg cmd details:plain_ctl : disableddeleted : noimage-dl(wtp,rst): yes,noadm

Hi, We have a Windows Server 2019 Datacenter Edition AD Server integrated with Fortigate for VPN users, and we are planning to change the version of the AD Server to Standard Edition. Everything will be the same as the original except the version. My question if the LDAP integration will remain intact or will it need to be reconfigured in Fortigate again, and what about the users, will they have to be imported again from the LDAP ? Thank You

Hi,Got a bit of a weird issue with our EMS. Users are somehow generating a link that looks like data[:]application/9IZCADpxCi (random text follows) (without square brackets). I can see in our FortiAnalyzer there's a log for them looking up the "rating" of this URL, and it comes back as unrated (obviously, it's not a real, reachable or resolvable FQDN). I've tried exempting both data[:]application (without square brackets) and http://data/* from the web filter, which syncs from the FortiGate to EMS (as this is the URL that FC EMS actually logs as being blocked) but FC EMS is still blocking the URL locally on the user's device. I'm no expert with this stuff, but this seems like a URL used to access a local server/filestore or something like that? I'm really not sure, it's obviously not resolvable over the internet, I've run Wireshark capture and can see that my network adapter doesn't send a DNS query when I enter this URL into my browser. Any advice would be greatly appre

I want to download the FortiClient VPN software which version is 7.0.10.0396, how could I find the version. Also want to know could this version compatible with macOS