Support Forum

I’m trying to setup a DNS service on the network interface.  I followed the instructions on this link.  However, it doesn’t resolve anything on the public domain.  It resolves interface domain name.  It looks like Fortigate doesn’t forward the query to system DNS servers.  Anything I need to check?  I used the following link to create DNS service.  Technical Note: DNS resolution not working when DNS Server configured to 'Same as Interface IP' | CommunityBasically, I want a user to use Fortigate interface as a DNS server IP and have Fortigate to resolve internal domain relying on the local dns database but forward to system dns servers to resolve anything outside domain names.

With IPSEC being removed from the new Forticlient and SSL-VPN being removed from the Fortigates themselves, I've been migrating everyone to IKEV2 using EMS.For around 100 users I would say 80 of them are connecting fine using IKEV2, LDAP and 2FA (Fortitokens) however around 20% are consistently having issues and end up reverting back to SSL-VPN.I've created both an UDP and TCP (443) IKEV2 profile for people to try. The TCP did solve some issues but a lot of people just cannot use IKEV2. I'm pretty sure it's likely their ISP/Router blocking it but I'm just wondering if there are any other tips I could check for when setting up the client on the Fortigate?I've forced NAT Traversal and setup IKE fragmention. Any one else had issues which changing any settings helped at all?Thanks! 

Hi! I tried to do an A-P 100F HA Setup where I have assigned the IP to ha1 interface. But there is no switch in between yet. Direct connection only.Everything is the same in Active and Standby firewall. But when I try to check the routing entry for the ha1 ip address, they aren’t the same. The output should show “via LAG1.16”You may refer to the images attached. The secondary firewall outputs the expected route. But on the primary, it says directly connected. It’s actually correct because I configured ha1 in primary and it just cascaded the config to secondary.One thing that confuses me is that , why different routes when they are just configured the same routing entries? 

Hi, We’ve been using the On/Off Fabric feature for our FortiClient users without any issues. However, since updating the FortiClient app to version 7.2.12.1269, the app no longer correctly identifies devices that are on fabric—it now shows all devices as off fabric as. We’re using Public IP as the detection rule. Please advise if there’s a known issue with this version or if any configuration changes are required. 

When sending logs to FortiSIEM using json over HTTP.if the sender can send with more than one IP, What I should use as reptIP in the API?also if I put for example one IP, if the sender send again with diff IP does the CMDB got affected?

I have 2 Fortigate 600F in a HA Cluster that needs to connect to 1 ONU. Currently, both Fortigate is connected to a L2 switch that is then connected to the ONU. However, when the ONU is rebooted, Fortigate is no longer able to obtain an ip address on the port used to connect to the ONU. If I configure link monitor, would Fortigate be able to obtain ip address after rebooting ONU?What is the recommended network configuration when using HA Cluster with ONU?

A MacOS device running FortiClient 7.2.12 is showing this in the EMS:FortiGuard Outbreak DetectionsIran-linked Cyber Attacks(compromised)The EMS is very hard to use to get any more details than that. I eventually found the "FortiGuard Outbreak Detection Rule" called "Iran-linked Cyber Attacks" and found only one MacOS CVE: https://www.cve.org/CVERecord?id=CVE-2025-13223The CVE states that the vulnerability is in "Google Chrome prior to 142.0.7444.175". The device is running 147.0.7727.138.Why is FortiClientEMS showing this false alarm?(At this point I am not trusting the EMS "FortiGuard Outbreak Detections" since it is not accurate.)

Second-hand devices - Does it actually matter if the device you are running is not registered to your forticloud account?This is assuming fortigate cloud is disabled on the unit and there’s no EMS so it cannot be remotely managed.Or should I just create a support ticket, send pictures of the labels to support and wait two weeks and hope fortinet decides to add these to my account?My plan was to test active-active HA pair so automatic updates aren’t what I want to happen.

We have setup a point to point wireless bridge using 2 FAP234's as the parent and leaf AP's. The wireless bridge is intended as a backup route to a fibre connection should it go down. A diagram below shows the setup;Network DIagramWe are however having issues in that the wireless bridge does not pass traffic when the fibre link goes down, and although I do have a TAC case open, I'm hoping a member of the community could review the setup and point out anything that could be causing the problem.One thing to highlight is that spanning tree is enabled on the switches that the AP's are connected to. Should spanning tree also be enabled on the AP's themselves, or is that managed by the switches? Any help is welcome.

Hi All,  We are experiencing an issue with the forticlient VPN client on MacOS 15.5 We are currently planning our roll out of remote access via IPsec and moving away from SSL VPNs, The issue we are having is that after a device cold start/reboot, the initial attempt to connect to the remote access VPN via IPsec always fails and gives an "Connection was terminated unexpectedly" error. Trying it immediately again afterwards, it still fails. The current workaround is to connect to the same remote VPN endpoint but via SSL VPN, and then trying the IPsec once more; however, this does not always seem to work.Another workaround seems to be waiting 5-10 minutes, and trying the IPsec connection seems to work.Once successfully connected via the IPsec VPN, it continues to work until the client device is rebooted/shut down. Looking through the Forticlient debug logs, we are getting an "IPsec error -104"; however, when running an authentication debug on the FortiGate, I can

I am facing an issue where some users in the FortiGate firewall appear with an “orange” status instead of the normal connected (blue) state.When this happens, the affected users experience restricted access, and some applications or websites are blocked.Our environment is integrated with Active Directory (AD) using authentication (SSO). The issue seems to occur especially when users switch between different network connections, such as Wi-Fi, wired (LAN), or VPN. In these cases, the user’s IP address changes, and the FortiGate appears unable to properly recognize or maintain the authentication session.We have already attempted the following troubleshooting steps:Removed the user from the domain and rejoined Reinstalled the FortiGate certificateHowever, the issue persists.Interestingly, when the user connects via a wired network, the status returns to normal (blue), and access is restored.It appears that during network transitions, the user session becomes inconsistent, causing the Fort

When i use IPSEC with IKEv2 and in the forticlient I use DNS on the remote gateway then the client can connect to the VPN but can’t reach to anywhere.If i switch using IP Address for Remote gateway then the client is able to connect to the LAN.Anyone facing same issue with me or this is know issue for IKEv2?

Hi All, Anyone have any idea for Grey-noise deployment in FortiGate?And hope it is third party, so can we trust them? 

Hi, I have installed Fortianalyzer-VM on my Server with 50 GB storage for trial. Then I extend my storage to 500 GB and purchased 500 GB storage license from fortinet. After the license applied my storage is not increased its showing me 50 GB only. I restarted my server several times but no result. Anyone guide me what I'm doing wrong. I attached snapshot of my storage as well as license for reference.

I have problems with a policy where I include an application control where I block access to facebook, youtube and others, one of the applications that I allow within the control is whatsapp but it has presented problems since yesterday, the attached files are not They send and the messages are sent several minutes later, the same as when receiving. I have been doing tests and by allowing the known applications the whatsapp starts working correctly, someone could help me know what the problem is if everything was working well until yesterday that I present this inconvenient.   My device is a Fortigate 90D The only categories that I have blocked in the control of applications are: Botnet, Game, P2P, Social.Media, Update, Video/Audio and Unknown applications (now in monitor mode for whatsapp work) The other categories are in monitor mode

Dear All, I have question about FortiProxy Authentication Timeout. My customer need scenario like this :User group SERVER doesn’t have timeout. There is traffic or not, once authenticate the server can connect forever User group EMPLOYEE have timeout 12 hours. So, after 12 hours they must authenticate again using captive portalCould anyone suggest me what I need to configure? I don’t understand guidance from documentation clearlyThank you

Hello.We have an FG-401F firewall, divided into a few VDOMs, all in profile-based mode. Now we need to convert one of the VDOMs to policy-based mode, and as I know in this case all policies are removed. Is there any way to automatically migrate policies from profile-based mode to policy-based, so we don’t have to recreate all of them manually? Maybe some sort of tool or script?Thanks.

Hello everyone, my company is using a fully licensed FortiGate 100F firewall and I need to block Telegram. I've searched in FortiGuard and classified it as Collaboration. Now, to effectively block it and optimize my firewall's performance, should I block it via Application Control or Web Filtering? What Inspection Mode should I set? Flow or Proxy Based?Please give me your advice. Thank you!

Have the following config problem:Fortigate 1 (VLAN400) -----EPLAN LINK-----> Fortigate 2 (VLAN300) traffic works fine. Foritgate 2 (VLAN300) -----EPLAN LINK -----> Fortigate 1 (VLAN400) traffic fails. Have checked all firewall rules, static routes, etc. Can't find the problem.  Looked through the docs, only finding examples of VLAN routing on the same Fortigate.  I have that working just fine.

Hi guys,I'm trying to make a report in FortiAnalzer that will give me monthly report for SSLVPN login and logoutI know that there is a report for VPN login which can show you top-15 and even more. what I want is Source IP  -  username  - even (login or logout)  - timeIt is needed to be for each connection that users  do i know its going to be a long report. Do you guys have any idea what dataset code can create that ? I couldn't find in the templates and tbh i dont know much about coding this. 

Hello,We are experiencing a recurring issue with DHCP snooping on several firewalls running FortiOS version 7.4.x, specifically on the FortiGate 40F and 60F models.When DHCP snooping is enabled, the DHCP server appears to stop assigning IP addresses to clients. This behavior occurs consistently on these models and is resolved immediately when DHCP snooping is disabled, which indicates that the feature is not functioning as expected in this FortiOS version.We would therefore like to know whether this is a known issue or limitation in FortiOS 7.4.x, and if there are any recommended workarounds, configuration adjustments, or planned fixes in upcoming patch releases. 

Looking for expert advice on Fortinet firewall security devices for enterprise environments. I’m evaluating deployment of Fortinet solutions, especially FortiGate Firewall, for high-traffic networks, zero-trust security, and centralized management.Has anyone implemented FortiGate at scale for data centers or multi-branch enterprises? I’d appreciate real-world insights on performance, licensing, VPN stability, and long-term reliability. Also open to recommendations for best configuration practices and common pitfalls during large-scale deployment.

Does FortiManager 8.0 resolve compatibility issues with FortiOS 7.4.10/7.4.11 on FortiGate 40F and 60F? Hello,After reviewing the FortiManager 8.0 compatibility chart, I understand that it is compatible with all FortiGate versions from 7.2 onward without any issues.Has anyone already upgraded to FortiManager 8.0 and can share their experience?https://docs.fortinet.com/compatibility-tool/fortimanager/fortigate

HelloChatGPT is already in FortiSIEM 7.1.I guess many of you already asked ChatGPT to help with building some FortiGate configuration or in troubleshooting issues.I dare suppose that Fortinet is working to include it directly in the next release of FortiOS and other Fortinet products.

FortiGate-100F. I am getting this warning : Conserve mode activated due to high memory usage. Internet is not working, but if i reboot the firewall, it starts working.