Support Forum

Hello all, I am looking for some assistance regarding using AD groups in EMS policies. My scenario is as follows: I have created a security group for people allowed to use dropbox and configured the web filter and application filter appropriately. I have also created a security group to be allowed to use certain AI applications only and configured the filters appropriately. Based on what I have read is where I am hitting an issue: “Priority-Based Evaluation: EMS typically allows administrators to assign priority levels to different policies. If a user belongs to multiple groups (e.g., both "Standard Staff" and "Remote Workers"), EMS applies the configuration set by the policy with the highest priority.”If reading this correctly, if I am a member of both security groups, I will use the first policy I match with highest priority. So if I put the “allow dropbox” rule first that also blocks the AI Apps, I will not hit the “allow AI apps profile” that follows. Is there a way to control this

Hello,I have been trying to get into the FortiEDR Workflow, but I can’t seem to create or manage the Collector Groups in the FortiEDR Cloud with a FortiEndpoint license. I know that FortiEndpoint EDR is different from the normal FortiEDR, but I have not found a document which said you can’t manage Collector Groups with FortiEndpoint EDR. Even the Administrator Guide for FortiEndpoint does not mention that you can’t configure Collector Groups.

I work for a school that is requesting us to block the Fornite game from being played. However it appears using the Web Filter and reclassifying the Epicgames.com URL only solves users from browsing to that website. I am trying to block the Fortnite game from connecting to the EpicGames servers, It appears they use Amazon Web services which seems to be tricky when blocking applications. I do see that Fortinet has Epic.Games listed as an Application finally. I have blocked this under application control, now half of the students that try to play cant and the other half still can. I'm new to this stuff so this has been a fun experience. Any one have any luck blocking this? If so what did you do to achieve this? 

Hi All, I have issue with F50G automatically upgrade to the latest patch 7.4.11 to 7.4.12 while the contract is expired.It keep sending Email with message “This installation is forced and cannot be cancelled”. It has failed to install multiple times and keeps rescheduling. I checked the system events, which show that the download failed. Do you have any ideas on how to fix this?I tried with this guide , and no lucks.https://docs.fortinet.com/document/fortigate/7.4.11/administration-guide/320693/required-firmware-upgrades-for-fortigate-appliances-with-invalid-support-contracts-or-that-have-reached-eoesDiagnose log:[989] fds_load_upg_matrix_map_img_id: Same major.minor: Patch 11 leads to Patch 12[999] fds_load_upg_matrix_map_img_id: Auto-upg chooses patch 7.4.12 (b2902)[1002] fds_load_upg_matrix_map_img_id: This upgrade will not be forced upgrade[989] fds_load_upg_matrix_map_img_id: Same major.minor: Patch 10 leads to Patch 12[1013] fds_load_upg_matrix_map_img_id: Auto-upgrade has chosen

Hello,I would like to know whether it is possible to activate service contracts for two FortiGate 121G devices in the same HA cluster using different licensing methods.One device already has an active traditional UTP contract, while the other device's contract has expired. I would like to activate a UTP bundle for the second unit using FortiFlex tokens.Is this configuration supported?Thank you.Farshid

Hi everyone,We are experiencing an issue with FortiClient VPN (free version) and wanted to check if anyone else has encountered something similar.Here is the situation:We have two computers in the same domain, on the same network, using the same internet connection. The same security and domain policies apply to both machines. They are connecting to the same IPsec VPN tunnel using the same user account.One machine connects without any issues, while the other consistently gets stuck on “Connecting” and eventually the application has to be killed from the process.We have tested multiple versions of FortiClient (7.4.0, 7.4.2 and 7.4.3), but the behavior remains the same.We also contacted Fortinet support, and they confirmed that the issue is most likely related to the FortiClient application itself. However, since we are using the free version, they are not able to escalate the case further.Additional note: the same issue occurs with different user accounts and from different networks (tr

Hi, The security auditor came to our office to check the Firewall Policies.  The guy suggests to configure the Firewall Access Rule to "DROP" the unwanted traffic instead of "DENY".  When setup Firewall Access Rule, I can select "ACCEPT" or "DENY" only. Is it possible to configure the Fortinet Firewall do "DROP" instead of "DENY" ?  Regards, 

Hi All,Long back I was using fortigate 600C firewall. Now i want to login that device. but i have no password.So, for resetting the configuration it require TFTP along with suitable firmware. based on boot-louder.But while re-loading the firewall, could not see Boot-room version, Only i can see below. HOSTNAME login: FortiGate-600C (15:49-10.24.2012)Ver:04000010Serial number:FG600CXXXXXXX. Please anyone can help for resting the configuration and is there any better way for the same. 

How to apply the Replacement Message in Security Profile in your Policy when accessing the blocked websites?

Is there a method to update a batch of FortiWiFis using a TFTP server?I know i can use a TFTP server to recover bricked FortiWiFis, but is there a method or tool that does the same but for a batch of FortiWiFis?In my case I want to update as many as possible and then put them aside as stock for future device deployments. And so I think adding them to FortiManager is. not ideal.  Basically I intend to downgrade from 7.0 as that is what they now come out of the box to 6.4.14.  

Hello,I’ve trying for a long time this kind of upgrade.GUI doesn’t upgrade, and i tried using CLI i got this error.After updating the linux package i got this another one.I’ve seen this Bulletin → CSB-260410-1In my case, i installed this EMS as VM not using Linux, so i can’t make any changes in the Linux shell as it says.Could anyone help me?thank you

IntroductionAre you alerted when or if a rogue AP broadcasts your companies SSID? Are you alerted when or if large volumes of de-authentication packets are sent to your wireless clients? These are some questions I've been asking recently as I've researched WIDS and how Fortinet can help. This isn't really a support request for the forum; it's more of an information sharing post for those interested.  Generally, most wireless deployments I see using Wireless Intrusion Detection Systems (WIDS) or Wireless intrusion Prevention System (WIPS) are using default vendor setting rather than fine tuning the settings to suite your business needs or align with your company cyber security policies. In some cases, WIDS may be disabled all together due to concern of resource usage on the AP hardware itself or limiting the available radios of the AP by using radios as dedicated monitors. Most of what can be found via a quick google search regarding wireless security is more centered around u

On FortiAnalyzer, the devices added under Device Manager show "Last Log Time: N/A". However, when checking the dashboard, logs appear to be arriving normally. At the same time, the Log Viewer cannot be opened, and the Reporting section is also inaccessible.The currently used version is 7.4.2, and it seems that there are known issues related to this behavior in this release. Could you please confirm whether this is a known bug and advise on any available workaround or recommended upgrade path?  

 Hi,after installing the FortiClientVPNSetup_7.4.3.4726_x64.msi with option “Enable Local Lan” and after established ipsec connection the client loose connectivity to local installed HP Network printer with address 192.168.8.105 (pings are not working, and all prints stay in the queue).After disconnect from the tunnel printer is working ok.I see on print route something like this: Config of the tunnel:  

Hello Guys,i’m moving from a Fortigate 500E to a 400F and need to copy all the configuration through Fortimanger (version 7.4.10).The customer is using the Vpn Manager tool on Fortimanger to manage all the Vpn, where i’m stuck, is that i can’t understand where i can add the new firewall to setup the vpn.I’m only able to edit the existing tabs but not able to insert the new firewall, how can i do it?I’d like to do something like for the policy package, insert the new firewall in the installation target and fortimanger will install everything smoothly.For now i’ve imported all the vpns configuration manually via cli, but would like to allign the vpn manager…..Any tips? Thank youRegards

Hello everyone, I would like to know if there is an available read only demo for FortiSASE, i would like to see whats on the interface, the available functionnalities etc. BR,

Hello everyone, Fortinet used to provide demos of Fortinet solutions in read-only mode. You would simply submit your information and receive the access credentials by email. However, for the past couple of months, I’ve no longer been able to do so.I always receive the automated email saying :“We've received your request for a product demo! A Fortinet sales rep will contact you soon to confirm your demo and find a time that fits your schedule.”But after that, I never get any follow-up or credentials.Could someone from the staff please confirm whether the read-only demos have been discontinued?Thanks in advance.BR,

Configs "RealVNC" or "fmwp" have been added without noticing. Such as..“RealVNC-Other”, “RealVNC-Web”, “RealVNC-ICMP”, and so on.“config rule fmwp FortiOS.SSL-VPN.Enc.Buffer.Overflow”, “config rule fmwp FortiOS.SSL.VPN.Custom.Information.Disclosure”. Why did this happen?

Hello,  My Firmware is 7.4.11 I managed to get SSO authentication working correctly via EntraID. The last thing I wanted to do was connect it to the FQDN and run it via my own SSL certificate. I have the certificate imported and it works correctly on the Fortigate login page. I can't get this certificate to work on the authentication port. The default certificate is still visible.FortiGate-60F # get vpn certificate local== [ Fortinet_Factory ]name: Fortinet_Factory   == [ Fortinet_Factory_Backup ]name: Fortinet_Factory_Backup   == [ Fortinet_CA_SSL ]name: Fortinet_CA_SSL   == [ Fortinet_CA_Untrusted ]name: Fortinet_CA_Untrusted   == [ Fortinet_SSL ]name: Fortinet_SSL   == [ Fortinet_GUI_Server ]name: Fortinet_GUI_Server   == [ Fortinet_SSL_RSA1024 ]name: Fortinet_SSL_RSA1024   == [ Fortinet_SSL_RSA2048 ]name: Fortinet_SSL_RSA2048   == [ Fortinet_SSL_RSA4096 ]name: Fortinet_SSL_RSA4096   == [ Fortinet_SSL_DSA1024 ]name: Fortinet_SSL_DSA1024   == [ Fortinet_SSL_DSA2048 ]name: Fortinet_SS

I create intune policy to push 802.1x wired configuration but after more than one week the policy not pushed any devices. Anyinw know why? 

Hello Fortinet Community,I would like to understand more about MFA implementation on FortiGate.When a customer purchases a FortiGate and the corresponding licenses, is any additional license required to enable MFA, or is MFA functionality already included?I would also appreciate clarification on the following points:What are the most common use cases for MFA in FortiGate environments? Is Active Directory integration required, or can MFA be deployed with local users as well? What authentication methods are typically used (FortiToken Mobile, email, third-party MFA, etc.)? Are there any limitations or best practices to consider when planning an MFA deployment?I am interested in hearing from community members who have already implemented MFA in production environments and can share their experience and recommendations.Thank you in advance for your insights.

I'm using a FortiGate device, but I can't make calls to others via Zalo. I can still send messages, upload files, and others can call me via Zalo. I've checked the logs and debugged, and everything seems to be allowed; there are no logs of rejected or blocked calls.The behavior: When I try to call someone, the call disconnects immediately.Can you give me some advice on this issue?

I have a Fortinet 101F firewall setup with VPN IPsec running. I have a FortiVoice 101, and I want to setup Fortiphone Softphone through the VPN. The Fortiphone Softphone runs fine with the LAN network, but when I try logging in through the VPN. I need some guidance to get it implemented please.

I am working on establishing vpn from android device using forticlient app with no avail. However, everything works fine with windows 11 machine.  Forticlient app version : 7.4.3VPN type : IKEV2 (EAP-MSCHAPv2 with Certificate as authmethod) Android Device: Honor MagicOS 8 (Android version 14) From the forticlient android, the error immediately shows "IKE authentication failed" where in fortigate debug last log says sent IKE msg (AUTH_RESPONSE). Appreciated any help on this, thanks

Hello everyone,I'm deploying 2 VPN configs in EMS to a group of devices, users have no control over Forticlient, I want to force connection to both VPNs automatically once connected to the network.It seems that only one VPN can connect automatically, while the user has to click on connect for the second VPN to come UP. Already enabled Multi VPN Auto connect option in Forticlient EMS but it has no effect (both VPNs are IKE v2)We are using Forticlient EMS 7.4.5 Any idea ?