Support Forum

I have both 441’s and 443 in the same building.  The 441’s will fire up 6GHz just fine, but the 443’s will not assign a channel.Power is OK - Two PoE+ connections - Current   Power Mode: full (2)  Oper Power Mode: full (2)AFC State is downCountry is set to USSupport is asserting that the 443 must have GPS location data in order for the 6GHz radio to operate, although it’s not needed on the 441.  The claim is that since the 443 has detachable antennas, the FCC states it “must operate in SP mode” (Standard Power) instead of LPI (Low Power Indoor) - therefore needing GPS data “proving” its presence in a region allowing such higher power operation.Behavior on the 443’s is consistent regardless of firmware version - we’ve tested on v7.6.4 build1078, 7-1092, and 8-0022 - all the same.cw_diag -c afc status does, however, indicates an LPI power mode:AFC is configured on 6GHz radio 2    AFC State   : down    Cfg Country : US  (841)    Regdomain   : 0x90000    Power Mode  : None    Cur Pwr Mode:

EnvironmentFortiClient VPN version: 7.0.14.0585 Windows desktop PC CPU: AMD Ryzen 9 9900X Motherboard: X870E AORUS PRO ICE RAM: 64 GB Windows 11 x64 FortiClient SSL VPNProblemThe VPN disconnects after around 20 minutes of use It is not exactly 20 minutes, just approximately After it disconnects, I cannot reconnect immediately I usually have to wait around another 20 minutes before it will connect again The problem happens only on this specific PC I installed the same FortiClient / used the same VPN profile on another computer, and it does not disconnect thereWhat I already testedReinstalled FortiClient Tried the newest available FortiClient version The issue still happens only on this machineFortiClient log behaviorThe FortiClient logs repeatedly show messages like:Broken pipe! Client is exited (3) g_hEventExit set FortiSslvpnD: PipeServerProc exitsThis makes me think the client side is breaking locally rather than the FortiGate cleanly rejecting the session.Windows events around the d

Are we able to update an extension display name or description field using API calls? 

Hello everyone, I would like to know, will I have issues with the persistent agent if I use Fortinac’s Self signed certificate ?  BR,

Hello,In the current version of FortiClient VPN-only, the backup and restore function is broken. Although you can select a file and enter the password, nothing happens when you click “OK.”Conversely, when restoring (a backup from before the upgrade), you can select the file, but even then nothing happens (and there's no mention of it in the logs either). Configuration Backup→ nothing happens when you klick OK (menu is closed but no file created) The version numbers don't quite add up either (to me, it just looks like it was thrown together quickly and hasn't really been quality-checked):Tray: Tray Version Info: 7.4.3.4726GUI:GUI Version Info: 7.4.3 hotfix 1.8758 

HelloI have over 100 sim cards in private APN. Between my company network and t-mobile is VPN tunnel. I wonder if is any method to monitor bandwidth ussage per sim over snmp. I used Zabbix to monitor our network infrastructure and I would be happy if it was possible to monitor bandwidth consumption for particular cards in Zabbix. At the moment, only what I can monitor is all traffic through the VPN interface which is not very helpful in diagnosing problems. RegardsJN

I started the upgrade from EMS 7.4.5 to EMS 7.4.6 and am now stuck for more than 24 hours in 50% loop.  And I am getting emails almost every 20 minutes, that the upgrade is scheduled. EMS is scheduled to be upgrade on 2026-March-23 06:01 (EMS server time). The current version 7.4.5.2111 will be upgrade to version 7.4.6.2170 (M). Any ideas how to exit the loop? 

greetings everyonei’m trying to configure the FortiPAM custom launcher for Visual Studio Code SSH extension (Remote - SSH)i tried multiple parameters with no success so fari would really appreciate it if anyone know the correct configuration to make this happen successfullyyour support is highly appreciated

We are planning to replace our current FortiGate device, and we have found that the following configuration is enabled on the existing unit:config system settings      set h323-direct-model enableendWe understand that this option is related to VoIP functionality. However, we would like to know how FortiGate's behavior changes when this setting is enabled.Could you please advise on how we can verify or confirm the behavioral differences caused by enabling this configuration?

Hi!Whilst I can see in historical logs and by real-time IKE debugging, I want to see whether existing Child SA was locally initiated (Role: initiator) or remotely (Role: Responder) using CLI command. This fundamental information - perhaps I missed it. Is there such.Thanks!

Dear All, I was trying to delete Ipsec tunnel which was earlier configured with SDWAN. The below procedure which I have used during the deleting all the reference from IPsec tunnel. 1. Tunnel was member of SDWAN Zone. I have removed the tunnel interface from SDWAN ZONE.2. Deleted static route.3. Deleted phase 2 selector.Next I was unable to delete tunnel. What I have observed during the tunnel. After all the deleting references. tunnel itself moved into default SDWAN ZONE which was created for WAN interfaces (Virtual-WAN-ZONE). My question is which tunnel moved into default virtual-wan-zone after deleting the references.  Thank you. 

i am using fortinet 40f . bridging has done from my isp. but while creating VIP for my yeaster s20. RTP port 10000-12000 i cant put this value on my port specifying area

Hello, thats a strange issue we have some time now after updating from FG81E to FG90G and it also only happens in one office. It is true, that there are main users (max 40) using Teams. Before with the FG81 we didnt have the problems. Now we use SD WAN for the FG90G and implicit SD WAN rule with Volume and 99% using our Internet Access A.  Though we have also above a SD WAN Rule with destination Microsoft-Skype_Teams, Microsoft-Teams.Published.Worldwide.Optimize and Microsoft-Teams.Published.WorldwideOptimize.Allow for Internet Access A. We tried with dedicated Firewall Policy with ALL services and no Security Profile for these 3 destinations - with no better results. Than  we tried to Bypass our DoS Policy with new policy above to only Monitor Teams UDP Ports (3478-3481 - 49152-65535) - with no better results. Only disabling the DoS Policy for out Internet Access A seems to solve the problem but since I dont want to have no DoS on this

Hello WiFi adminsIn FAP-231K datasheet, the AP supports 802.3bt (PoE++), 802.3at (PoE+) and 802.3af (standard PoE).What is the exact impact (on all aspects) if using .3at or .3af instead of .3bt?

 Hello,I would like to share an issue we are currently experiencing with a FortiGate HA cluster after upgrading to FortiOS 7.6.6. I'm also interested to know if anyone else has encountered similar behavior.Environment:2× FortiGate 200FHA cluster originally running in A-A mode550 firewall policies40k sessions/s during peakUTM enabled (AV, IPS, Web Filtering, WAF)Full SSL inspection500 users20 site-to-site IPsec IKEv2 tunnels50 IPsec dial-up users (IKEv2 + SAML via Entra ID + MFA)FortiClient EMS 7.4.5FortiAnalyzer 7.6.63 Gbit internet connectivityBefore the upgrade:The cluster was running on FortiOS 7.4.11 and had been completely stable for a long time.Upgrade timeline:Upgraded from 7.4.11 to 7.6.6 on Saturday (21 Feb 2026).Everything initially appeared to be working correctly.On Monday around 11:00, when normal traffic load started, the first cluster failure occurred.Observed symptoms:The failures appear to start with HA communication issues (HA ports dropping). Shortly after that

Please how i check current fortinet version 7.2.12 when will expire and also confirm If i upgrade to new version fortinet firewall 201 will support SSL-VPN?

Hello everyone, I’ve got RADIUS set up for FortiNAC, with FortiGate managing FortiSwitch via FortiLink.What’s the easiest way to apply security policies in bulk to multiple switch ports?  Thanks in advance,BR,

Dear All,How can I create an Automation alert on FortiPAM, if user launched 1 secret more than 10 times per day, to raise an alarm to delivered to my Email

Hi everyone,!I'm working on optimising my FortiSIEM reporting, and I have two specific questions for the community:1. Daily Global Report ConfigurationI want to generate a "Daily Global Report" that covers everything (incidents, config changes, and system health, etc) for the last 24 hours.What is the best way to group this into a single automated task? How can I ensure it runs at a specific hour and exports correctly every day?2. AI Integration (Inside or Outside FortiSIEM)I'm interested in using AI to analyze or summarize these reports.If you use an external AI, how do you securely connect it to FortiSIEM to pull data automatically?Thanks in advance for your insights!

I have a site to site vpn lab running in vmware workstation pro2x FortiGate Firewalls     2x  Windows 10 vmsFortiGate 1 WAN Address(192.168.100.1) LAN Adress(10.1.1.1)           FortiGate 1 WAN Address(192.168.100.2) LAN Adress(10.2.2.1)PC-1 (10.1.1.10) PC-2 (10.2.2.10) ip addresses of the pcs are fixedthe WAN Interfaces are on vmnet1the lan interface of fortigate 1 on vmnet 2         the lan interface of fortigate 2 on vmnet 3pc 1 can’t ping pc 2

Hi everyone!We current have a HA Setup for FG 501E. The physical HA ports are interconnected via switch in between. The switch ports are on the same vlan.The physical HA port also has an IP Address set with it. Assume 1.1.1.1 As I have checked, 100F does not have this single HA port same as 501E. It uses HA1 and HA2. Now I am thinking, to replicate our current setup to this new 100F firewall pair, can I use the same switch interconnectivity for the HA1 and assign an IP Address to the HA1 interface? Can i also leave the HA2 interfaces directly connected (w/out switch) to each firewall? The reason why I want to replicate this is because I have found out that:The communications between Fortiguard servers and our existing 501E Firewalls are using a security policy; in which the HA IP address (1.1.1.1) was being referenced. Regards,Renz 

Hi everyone, somebody can help me with this error, my SSD go to 100% of use, searching; windows write and read the file push.conf forever, i erase the file and reboot and works but, later the problem start again. thanks and sorry for my bad english.

I have moved a VIP from a load balancer to an internal Fortigate as its not doing anything special, just a basic round robin.It allows a handful of public IPs to access the Virtual Server, The setup is like this:EXERNAL SOURCES > External VDOM > DNAT TO VS > Route to Internal VDOM > VS Configured on DMZ interface > Real Servers on Inside Interface.It gets as far as the VS on the DMZ Interface, I can see the hits on the VS, but that it, it does not forward anything, no denies, no blocks, it just doesn't go any further that the VS? there is no health check, does it need one? it is doing SSL offload for the external certificateThanks

Hello Group:  Issue:  inherited an EOL FG 30E from a business with no documentation or guides of the unit.  Priority: CriticalTime to Resolution: ASAPContext:Business is a small Family Pharmacy and all critical devices/users requiring secure internet access for Pharm operations.  Problem Statement: Client web access is kb/ps to websites and timing out.  External clients were experiencing the same attempting to remote to site.  Unsure if unit is cabled or correctly configured correctly from LAN to WAN currently.  They do have internet access connecting directly to AP bypassing Fortinet 30G with fast response.  This device/configuration has functioned fine in past and operation only been in existence for a year.  NO configuration documentation, no 30E installation or configuration guides, and can’t locate specific due to Support expired 2019 and EOL March 2027Need:Pay for configuration troubleshooting services as required.Documentation of Installation/Configuration of device.Recommendati

I have a firewall that has a few VLANs and physical interfaces that I have turned on the Multiple interface feature and creating those subsequent policies. Working through some oddities (or maybe I just have not dug deep enough into) that seem to choosing a “catch-all” at the bottom of my list before it processes the policy above it that’s specific to the traffic. Like said, still digging some into this. Just wanted to get some feedback on how or if people like this feature, caveats I might want to watch for, etc…  Thanks.