Support Forum

I am trying to deploy an ADVPN environment via BGP. In my lab everything works as you would expect it to, but as I start deploying it in the live environment, it just seems to die. I contact Fortinet support, spend a few hours with them and they seem to have no idea why it's failing.  This is what is happening. Once deployed, it works fine, but then after a couple days, it just stops. I run sniffers, and diags. The diags show the traffic trying to go out, but then I get "SA is not ready yet, drop", which means the Phase2 is down. Then for whatever reason it starts working, then again I get "SA is not ready yet, drop", then starts working again, then it stops. Sometimes it just doesn't work anymore until I reload the config in the firewall, but then it'll work for a while and then stop again. This just doesn't happen on one Fortigate. I have 192 fortigates and have deployed this on 52 of them and this issue happens on all of them. Why are the Shortcuts Failing?? I have ha

Hello Guys,I am facing a big problem with our Fortigate 60F. I cannot access it. When I plug in the console cable, I cannot access the interface. Also, when I plug an Ethernet cable directly into my laptop, I still cannot access the Fortigate interface. The lights do not light up. I tried resetting it using the button, but nothing happens.I appreciate your assistance.

I have read many helpful posts concerning SSL VPN security and different approaches that can be used to improve security. So far we have unique usernames, strong unique passwords, and geo filtering from the SSL-VPN Settings / Restrict access to specific hosts field, security measures in place. Most firewalls are running FortiOS 7.2.7 or 6.2.16. We see a lot of messages that say:The following critical firewall event was detected: SSL VPN login fail. I would like to improve security and would like to have a much shorter list of SSL VPN login fail messages to review. The shorter list would help us to verify if attempts are being made using actual SSL VPN users on the firewall (more likely to be able to log in) or of a bad actor is simply guessing random usernames (unlikely to be successful in logging in). Does using geo filtering in a local in policy work the same way that it works on the SSL-VPN Settings / Restrict access to specific hosts field? In other words, do bo

Hi All, I have not been getting IPs logs alert ever since I had upgraded firmware of Fortigate from 6.4.4 to 7.0.15. it seems to be issue in this release, Can someone help regarding this issue.  Thank you.

Hello,I have FGT cluster and connected to it 10 FortiSwitches by Fortilink - and it's working as should.  I added new FortiSwitch, and strang issue I have. When I diconnect my laptop from old switch and connect them to new switch, link is up but no traffic is working. I mean i even don't recieve IP from DHCP.But when I connect different laptop is working.Is by default some MAC Address remembering on old Switch and don't allow use my laptop by new swtich to by use??  If yes is it possible to check , purge etc ?? Thnks 

Dears, Can someone explain why FRANCE IP subnet denied while other country is OK. Im whitelisting geographical onfirewall policy to allowed which country can access our external MAP IP with assign port. Below logs shows for references.  regards,

Hi,I noticed when resolving one of our sites (e.g. certassur.be.75513.fortiwebcloud.net), I get different IP's depending on the DNS server. There are 2 results returned depending on the DNS server:3.123.216.247 <- when this is returned, the site is not working18.156.16.255 <- when this is returned, the site is working What is going on here? 

Hi, I have a new FortiMail Cloud license in Gateway mode, and I want to migrate the old one to the new one, but it is expired. Can I do that?

In FortiWeb 1000e monthly report, there are a lot of "others" in each section including in the diagram. What are the others and how are they classified?    These are the example of the table and graph. In table and graph, there are "other". Can I know what are those?

Hi, we started getting packet loss through one interface of our 601E, SSH sessions on the far side of the fortigate are very slow and lagging, pinging to those ssh hosts results in around 5-20% packet loss, pinging from either side of the fortigate to the fgt IP address results in loss also. Pinging from the Fortigate outside interface to the internet is 100% clean. I did a debug whilst running a ping, in the below example, 20 pings were sent, 3 failed with this pattern - ...!!!!!!!!!!!!!!!!!Interestingly, I see 3 act-drops in sequence (just not the same sequence). Any explanation on what is going wrong here?   id=20085 trace_id=5289 func=print_pkt_detail line=5867 msg="vd-root:0 received a packet(proto=1, 10.10.4.50:126->10.9.4.1:2048) tun_id=0.0.0.0 from vlan.3200. type=8, code=0, id=126, seq=3."id=20085 trace_id=5289 func=init_ip_session_common line=6046 msg="allocate a new session-0009ca72, tun_id=0.0.0.0"id=20085 trace_id=5289 func=iprope_dnat_chec

 【background】　I'M TRYING TO CONNECT THE THREE LOCATIONS WITH IPSEC AND ROUTE THEM USING BGP.【Prerequisite configuration】　All locations are Fortigate 50E using OS 6.2　- FOR A DIRECT IPSEC ROUTE WITH AS65001<->AS65002, ALL SUBORDINATE SEGMENTS ARE LISTED IN THE ROUTING TABLE.　- IPSEC routes between AS65001<->AS65010 / AS65002<->AS65010 are also listed in the routing table for all subordinate segments.　- When going through a AS65010 such as AS65001<->AS65010<->AS65002, routing information should not flow to AS65001 and AS65002.【question】　- Assuming that BGP is used for routing, what kind of settings should be made to "When routing via AS65010 such as AS65001<->AS65010<->AS65002, routing information should not flow between AS65001 and AS65002."?

I have Tunnel VPN IPSec site to site with SAP in cloud and the tunnel turn down if no trafic .I'm not able to turn it up from my side. when SAP do ping the tunnel turn UP.please any idea in this issue.for help: My FGT is route based and SAP have Cisco and is Policy Basedplease any help

iPhone iOS used QUIC  PORT how to stop that ?

Hello everyone,I am currently testing FortiClient EMS with the trial license.So far I did set up everything and worked fine. I did deploy FortiClient EMS on my personal notebook.Today I was working from home and the SSL VPN worked fine. After lunch the SSL VPN didn't work any more. When trying to reconnect the SSL VPN tunnel, the connection gets established and immediately aborted again. In the forticlient logs I can find following lines (debug log): 10.06.2024 13:37:33 error sslvpn error: poll_recv_ssl -> SSL_get_error(): 610.06.2024 13:37:33 error sslvpn error: poll_recv_ssl -> WSAGetLastError():010.06.2024 13:37:33 info sslvpn error: polling recv, try:1I can't find any more informations, I did not set up Forticlient or the SSL VPN to connect with certificates, so I do not have a clue where this issue suddenly comes from.Anyone having an idea? Edit: Connecting with a non-EMS FortiClient works without any problems.

Hello Everyone, I have a quick question for a scenario that I am working on with Fortigate Firewalls.we have two sites, Site A has one 100F standalone FW and Site B has a cluster of 2 400F firewalls in active-passive mode. The thing is, Internet connection for site A is through Site B with two physical links (LAG interface on FWA, one to each firewall of site B). the IP connectivity wouldn't be a problem as the WAN interface for Site A would be an interconnexion subnets to an another LAN interface in Site B and static routes would redirect those to internet connectivity, However I want to configure the links to have autonomous redundancy; if link 1 to FWB-Active fails, link 2 takes over; I have checked the link-monitor configuration fortinet offers but would that be possible in the active-passive setup of site B!FortiGate 

I am wondering how Fortimail Cloud customers are managing your license count, specially when your mail system allow single user mailbox have multiple email addresses? For example, we can have same mailbox with following allowed email addresses : jsmith@mycompany.comjohn.smith@mycompany.comjohn@mycompany.comjsmith@mycompanyalternativename.com... We have already enabled "Recipient Address Verification" via SMTP, but all those addresses are valid recipient. Fortimail Cloud is treating them as different mailboxes.  We have tried to setup "user alias", but it doesn't seem reduced Fortimail's license count, also it's a lot of work to manage so many email alias trough Fortimail Cloud UI.     Fortimail Cloud Console doesn't allow paste; also REST API seems can not be enabled on Fortimail Cloud.  Thanks for any feedback.        

Hi Team, I have 5 Forti access points, and all devices are connected directly to the Fortigate firewall. In last one month, is the internet getting slow?    

Hello experts,I would like to ask a question. I currently have a Fortigate 100E device. It was acquired through resale. The original manufacturer’s account information exists, and I have logged out.However, the warranty period is until August 2025. Can I ask customer service to directly assist in transferring the License Number to my cloud account? Or do I have to find the original registered end user? Thanks #Fortigate 

Hello,I want to create a VIP to be able to access my Internal server Web GUI from External - but i don't know how to do.I've Few Public IP free from my site.Someone can explained it to me please?Regards

It's a pleasure to greet the Fortinet community, Can you tell me what firmware version is available for the FortiAP 431F and 231F (FP431F, PU431F, PU231F), I currently have them with the firmware (FP431F -> v7.0 build0134, PU431F -> v7.0 build0125 and PU231F -> v7 .0 build0125) Greetings

Hi Team,We are trying to use the free style and exclude the traffic from the logs. Though we configured using the below link we still see the logs in the syslog. May i know if this config is correct at all?Configuring advanced syslog free-style fi... - Fortinet Community We need to exclude complete subnet.  config log syslogd filterconfig free-style   edit 1     set category traffic     set filter "srcip 10.0.0.0 255.255.255.0"     set filter-type exclude   nextendend

I have an ADVPN setup with 2 hubs and several spokes.The spokes have 2 WAN connections, the Hubs each have 1.  With standard site-to-site VPN, you can have 2 tunnels active to the same location as long as 1 interface on either side is different.  IE: both WAN 1 interface and WAN 2 interface from the spoke connect to the same WAN interface on the Hub.When I try to do this with ADVPN, it seems to integrate some of the backup tunnel settings into the existing phase 1 settings, and there is no new phase 1 entry in the IPSEC monitor.Can ADVPN do point to multipoint without SDWAN?

Can't open one URL ( vendor.myhoh.in ) after updating firewall firmware 7.4.4

Hello Expert, I have a FortiGate 400e that is been configured for remote access.I have two telco (GTT AND DIGICEL) and was assigned three public ip address from each.To seamlessly failover from one telco to the other telco during line disruption I  am using “SDWAN”.On the client workstation  I configured the client to use an ip address from GTT (telco) to access the network via remote access.  If the GTT link goes down and DIGICEL becomes the primary link how can I  still remote into network using GTT ip address ?Unsure what is my next steps                                                                       &n

Hi FG adminsI thought at one point that it can be a good substitute to FSSO. I didn't try it yet but if I'm not misunderstanding the Kerberos authentication doesn't work in flow based mode. Can anyone explain why?