Support Forum

 After upgrading the firewall to FortiOS v7.4.11, I noticed inconsistencies in FortiView. For example, the information displayed in the Source column does not match what is shown in the Device column.As shown, the IP address in the Source column ends with 211.35, while in the Device column it shows 211.62. Additionally, the MAC addresses are also different.What is the problem ?

Hi everyoneWe will soon be upgrading our FAC instance from 6.6.x to (probably) 8.0.2Running a 2 node cluster, both are VMs.From what I can see, it should be a direct upgrade path without any inbetween jumps.I will read through the release notes, known issues etc, but can anyone who has performed this process comment on how it went? Any surprises or hidden 'foot-guns'?

Hello,Currently our Fortiauthenticator is on version 6.6.8, and we have an issue in which usage on the user is not matching actual usage of the firewall - resulting in the user being disconnected due to daily quota consumption. We have Daily limit profiles set on all our users. And most of the cases, the user consumed for example 700MB, and his limit is 1GB, but the Fortiauthenticator reads the usage as 1GB and disconnects him, below is more in depth and has an example.User mrw.user78x has 2GB daily limit quota enforced, below you can see his usage from firewall its self – 1GBUse monitor tab showing correct usageBut in the user profile usage showing fully wrong – 1.9GB - Only after pressing reset usage, it will refresh to the actual correct usage, but if we don’t do this, the user will be kicked out shortly due to reaching 2GB daily limit even though in reality he is not.  

Have an FS108.Reset the FS108 to factory defaults using paperclip + reset button.Manually assigned my laptop Ethernet adapter IP address 192.168.1.1 mask 255.255.255.0 GW 192.168.1.99Connected Ethernet cable between my laptop and port 1 on FS108.Open browser, go to http://192.168.1.99 and nothing. Also tried https...still nothing.Console to FS108 and exec factoryreset and factoryresetfull ….still nothing. I could set this up using the console, but I’d really like to know why it is not working as advertised.I have many more FS108’s to deploy and need to figure out if the “Easy FortiSwitch Setup” is not going to be so easy.

Hi Fortinet Community Fellows!I hope all of you are having a wonderful day. I am thrilled connecting with you fox! Best Wishes,Ehtisham 

Hi everyone,We are using a FortiGate 60F firewall with SSL VPN configured for remote access, and users connect via FortiClient VPN.Issue DescriptionSSL VPN connects successfully every time via FortiClient Users receive VPN IP and session remains connected without disconnecting Internal resources (servers, RDP etc.) are intermittently not reachable When the issue occurs, VPN reconnect does NOT resolve the problem Users must either wait or restart system/network stack, but behavior is inconsistentKey ObservationThe issue does NOT occur on all clients at the same time Some users continue working normally while others lose access randomly Affected clients remain “connected” but cannot reach internal network resources Once the issue occurs, re-establishing VPN session does not fix itWhat we have checked so farVPN tunnel remains up with assigned IP Issue appears random across users and sessions No clear pattern related to user group or time   Has anyone faced a similar issue on FortiGate SSL

Hi everyone,I am testing **inbound SMTP STARTTLS deep inspection** on a FortiGate policy that publishes an internal mail gateway behind FortiGate.I found two Fortinet KB articles that seem directly related to this case: Technical Tip: Inbound email to mail server protected by FortiGate is not logged or inspected by Anti-Spam profileTechnical Tip: Enabling SSL/SSH inspection causes connectivity issues for STARTTLS The first article says that inbound SMTP traffic using SMTPS or STARTTLS, including STARTTLS on port `25`, needs SSL inspection if FortiGate is expected to inspect/log it with Anti-Spam, AV, DLP, etc.The second article says that SSL/SSH inspection in front of a mail security gateway can cause STARTTLS connectivity issues.My case looks very similar.Environment: Internet MTAs → FortiGate VIP → internal SMTP gatewayThe internal SMTP gateway is a Postfix / mail security gateway.The backend SMTP server supports STARTTLS on port `25`.Public side is published through VIPs:1.1.1.1:25

Hi all, I have my own Fortigate and one Fortiswitch from ebay.The switch seems under that seller account. Might I know if I still can use Forti-link to manage that switch without any issue? Thank you!

The  FAC 300F  in picture only  has  200 user but its  showing  license type i belief  FAC  300F  only hardware limited upto 1500 user right  ?? 

I’m trying to configure my 100F for RingCentral, whats the best way to go about this?

I want to reset my password, but the maintener and the bcpb are not  used which  this version of my FGT. What should  i do?

Hi team, I have recently found the neighbor roles feature in the sdwan configuration. I don't really understand the implication of primary and secondary configuration.  Until now, I used parameters such as local preference to control BGP route announcements and receipts. Can I control 2 BGP sessions with both parameters? I explain myself, if one neighbor has the role secondary the BGP session is in "passive" mode until the primary BGP session fails.  Thanks for teh help!

Hi All, I'm implementing SDWAN topology with Dial-Up Ipsec VPNs. I also want to implement traffic shaping for the relevant traffic. I plan to use Shaping profiles on interfaces but I'm a little bit confused about where to put the shaping profile. On the VPN interface, or on the physical WAN interface. Or Both? Never find a documentation about that. Thank you!

i have configured dialup vpn that phase2 selector i configured 0.0.0.0 both src and dst but when it push to spoke it choose only spoke’s tunnel ip only in dst instead of 0.0.0.0 and same is taking spoke src only tunnel ip and destination 0.0.0.0what should i do so it can take 0.0.0.0 is src and dst

I created an IPsec VPN tunnel on Fortinet, but after users connect, they still see their own public IP address when checking on WhatsMyIP. What could be causing this issue, and how can I fix it?

Hello, I created custom role for users in FortiPAM. I only allow to that role of users permission for secret list and secret folder (everything else is hiden). When i log with user and with that role, user see secrets and folders which is good. But the problem is because it also see secret settings (Policy,Launchers,Templates,Clasification Tags) which shouldnt see. Is there way to hide that settings from user also?Thank you.

Hello,I have a question regarding the Quarantine Release Re-scan feature in FortiMail 8.0.0.During testing, I noticed that the re-scan mechanism appears to work only for attachments/content scans, while URLs inside the email are not re-checked during message release from quarantine.Test scenario: A message containing a phishing URL was quarantined. Quarantine Release Re-scan was enabled for AntiSpam, AntiVirus, FortiSandbox, Content. After clicking Release, the email was delivered successfully. No new URL reputation lookup or antispam URL scan events appeared in the logs. It seems that the phishing URL was not re-evaluated during release. Could you please clarify whether Quarantine Release Re-scan is intended to work only for: attachments, content inspection, antivirus and not for: URL reputation checks, FortiGuard URL filtering, final URL inspection, Thank you.

Environment: Cluster (Supervisor & Workers): Residing in VDC-A using private IPs. A Public IP pool is assigned to the VDC with NAT and Firewall rules mapping to the Supervisor and Workers. Collector: Residing in VDC-B. It has a Public IP associated via NAT and is intended to communicate with the cluster over the internet. Connectivity Status: Initial connectivity (Telnet/Curl) is verified and functional between the Collector and the Supervisor's Public IP. The Problem: Although the Collector was provisioned successfully, it failed to appear in the Supervisor's Collector Health tab. Investigation of the logs revealed that during the registration handshake, the Supervisor provided its internal private IP (and the workers' private IPs) to the Collector. Consequently, the Collector attempted to establish a heartbeat using the unreachable private IP.Current Progress & Obstacles: Partial Fix: I manually updated /opt/phoenix/config/phoenix_super.txt on the Collector, replacing the

Dear Community, I have three question about changing parameters in a production environment ha cluster. This cluster has two hw fortigate on one location, which work nicely. Now I have to add a third one but in this time this should be an another location. So I have to prepare the working cluster to add a far third one. 1) I would like to make the Ha cluster more latency tolerant. Current config:  hb-lost-threshold 3 hb-interval 2 hb-interval-in-milliseconds 100ms Is it enough to raise only the hb-lost-threshold, or should I change the hs-interval as well? And more importantly what should be the changeing sequence of these parameteres? Should be change one parameter at once on the primary and secondary member? 2) My dedicated hb interfaces direct connected with cable, and set up that the sync packets use this ha intercae. Now I would like to change this that every packets related to ha goes through a switch/vlan. So I have to add a new ha interface (port1 through switch) with lower pri

Hello community,I am currently configuring FSSO in FortiGate to create identity-based firewall policies using Active Directory usernames/groups, and I have a question regarding two different configuration sections that seem related to AD integration.I noticed there are two separate options in the GUI:Security Fabric > External Connectors > FSSO Agent on Windows ADUser & Authentication > LDAP ServersAt the moment, I configured only the FSSO option and it is already learning users/groups correctly from Active Directory.My question is:What is the functional difference between these two configurations? What is each option specifically used for? Is it necessary to configure both for identity-based policies? In which scenarios would LDAP configuration still be required if FSSO is already working?From my understanding so far:FSSO is mainly used for transparent user identification (User ↔ IP mapping) based on Windows logon events. LDAP seems more focused on direct authentication a

We use multiple dial up IPSec vpn's on our vm Fortigate (7.2.9) for remote support.  But for windows 11 devices (forticlient 7.4.2) the split tunnel routes are not installed, only default route over the VPN. Because of this user do not receive 2fa token on the windows device as internet is not permitted. work around is to use a secondary device to receive 2fa token (mail). VPN is working for the rest, just not split tunnel. config vpn:config vpn ipsec phase1-interfaceedit "xxx"set type dynamicset interface "port5"set local-gw xxxset mode aggressiveset peertype oneset net-device disableset mode-cfg enableset ipv4-dns-server1 xxset ipv4-dns-server2 xxset proposal aes256-sha256 aes128-sha1set xauthtype autoset authusrgrp "xxx"set nattraversal forcedset peerid "xxx"set ipv4-start-ip 172.29.2.0set ipv4-end-ip 172.29.2.7set ipv4-split-include "Remote-Access-VPN-Split"set save-password enableset psksecret xxxnextendconfig vpn ipsec phase2-interfaceedit "xxx"set phase1name "xx"s

This same question was asked over a year ago, but never found resolution. I send invites to users following the Technical Tip: How to send email notification which contains FortiClient installer package that embedded with invitation code post. Forticlient is installed and connects to the fabric as expected. If a user disconnects from the fabric they are unable to reconnect without using the invite code. The invite code is supposed to be short-lived and only used to register the endpoint. I thought FCEMS Cloud sent an identity cert to the client machine upon registration. I cannot find any settings for client certs or similar. How are users supposed to reconnect after the invite code expires?

So i deployed fortiweb as a node in eve and u get unlicesed and there is no way to connect to fortiguard and get trial licesne activated so is there a solution and for the unclicensed status does it function just as a dump switch no inspection nothingI tried with transparent mode and created a vzone and nothing happens no sql injection protection nothing 

I have requirement to restrict our devices to be authenticated via entra id before the devices connected to the network.Form what i know this can be fullfilled by enable the 802.1x, but also i heard this can be done even not use 802.1x. ANyonw one know what is proper way, using 802.1x or not?

There is a bug - FMG does not recognise radius server config change in the install process. How to fix this? Is it fixed in version 7.4.4 and it is 60F model