Support Forum

I have a 511G in standalone mode. I have a local wifi and lan network that I have on a site to site vpn tunnel to my DC. I can send traffic to 511G, but can't get any traffic through the 511G to the devices behind the extender. Running a diag sniffer on the gate, I see the traffic from the 511G and the return, but I see 0 packets in on the site to site tunnel on the 511G. Do I have a configuration incorrect or does the 511G not support this?  

Hello all. Apologies if this has been discussed before and I failed to locate it. I just received a used FG-60F and registered it without any issues. When looking at my assets section, all subscriptions appear to be expired on this device, which I was expecting. Once I reset the unit with the button on back and went to the GUI, I noticed something odd. Being new to the FortiGate, I thought I should ask if this is going to be a problem before purchasing a license. On the 60F GUI, it shows that there is FortiCare coverage to an account that isn't mine. I would have thought that my ability to register the 60F indicates that the device has been unregistered from other accounts although I could certainly be mistaken due to my ignorance on such matters. My question is: If I purchase a UTP or ATP license, is this going to create a licensing problem with FortiCare coverage or will it simply apply the new license and show it as covered with FortiCare under my account?I would very much appreciat

A client is requesting that the secondary LAN port on a FAP231G be used for a wired printer connection. I’ve never done this before, but relevant documentation has pointed me in the right direction (I hope). Before making any configurations, the printer pulled an IP from the VLAN the APs are on.Based on the documentation, I went into the “FortiAP Profiles” tab and changed the port mode to Uplink & Bridge, and the port bridge Bridge to SSID, and then selected the desired SSID, the intent being that wireless devices on said SSID will be able to print from that printer. What I expected would happen is that the printer would pull an IP from the SSID pool. It did not.Next I went into the specific AP in the “Managed FortiAPs” tab, enabled Override LAN Port, set Override Port Mode to Uplink & Link, and enabled Bridge to SSID and selected the desired SSID. This also failed to pull and IP from the SSID pool. Am I missing something/misunderstanding how this works?

We are attempting to sync MS entra devices into FortiAuthenticator 6.6.2 so that we can then complete certificate based authentication for these devices.We have on-prem AD devices syncing via LDAP and this is working fine. Has anyone managed to sync entra devices in? I am struggling to find any clear documentation for this process...Thanks in advance

Hello, I know that normaly there should be one rule allowing a connection. In my case we are experiencing with Firewall Authentication, we configured FortiAuthenticator do allow access to devices behind the Firewall based on AD Groups.Users have to sign in on Authenticator using the SAML URL: /saml-sp/CDS_SegSecServ/login/, the session is valid for 10 hours, afterwards users have to relogin. So at this time we have rules which need authentication and older rules for similar access without authentication, based on IP Adresses.The Authentication rules map users to ip’s, so at the end it is also an IP to IP rule.Now my question, what happens when the authenticated sessions runs out, since there is also the old rule which also serves the same IP, should the TCP session continue to work without interruption or does it mean that a new session is initiated and the old one get stuck.It looks like there are at least database disconnections and i am not sure if this is because the rules allowing

I’m seeing an issue in my FortiSASE v26.1.92 where an endpoint is assigned the correct profile (IT Infra), but the group is showing as “Non-AD Endpoints”, which is not expected.The device is domain-joined and should be part of the appropriate AD-synced group, but it’s not reflecting correctly in the console.Details:Endpoint status: Online & managed Correct profile applied: IT Infra Group shown: Non-AD Endpoints (incorrect) AD sync is already configuredQuestion:What could cause an endpoint to fall under “Non-AD Endpoints” even when it’s domain-joined?Any guidance would be appreciated. 

We’re running FortiClient with Cloud EMS and deploying via Intune (Win32, SYSTEM).For most users we use SAML authentication, which works fine.But we also have som shared PCS with no primary users.We want the device to be registered in EMS automatically, without requiring any user to log in.What is best practice?

Hi everyone,I’m currently using FortiManager Cloud to manage my FortiGate devices.When I was configuring static routes directly on the FortiGate, I used to rely on address objects and especially address groups as route destinations (Named Address with allow‑routing).This approach was very convenient to group multiple networks behind a single static route and keep the routing configuration clean and readable.With FortiManager (Static Route Templates), I understand that this option is not available:Destinations seem to be limited to Subnet / Internet Service / Internet Service Custom. There is no way to select an address object or an address group as a destination, unlike local FortiGate configuration.I’ve seen that meta‑fields (variables) can be used to inject subnets into route templates, but:This does not really replace the concept of address groups. It doesn’t fully meet the use case I had before.So I’m wondering how you deal with this in practice:How do you handle static routing in

Hello, i created a Test-LAB with FortiManager v7.6.6 build3654 (Mature) VM Trial licensed and FortiGate v7.4.11 build2878 (Mature) VM Trial licensed. Now ill try to Join my Gate into my Manager and got the Error. I checked with the "Compatibility Tool" and it looks good for my Case. I use Windows 11 Pro with Hypedr V and booth VM Imgaes are HyperV from Download Center. The Screenshots are attached. Thanks for help. I tried a lot of proposed solutions FortiGate = 192.168.178.241FortiManager = 192.168.178.240  Log Spoiler (Highlight to read)ConnectedFMG-VM64-HV # diagnose debug application fgfmsd 255fgfmsd debug filter: disableFMG-VM64-HV # diagnose debug timestamp enableFMG-VM64-HV # diagnose debug enableFMG-VM64-HV # 2026-02-23 05:41:29 proxy_session.c,__session_frontend_accept,833: 192.168.178.241:1156 -> 192.168.178.240:541.2026-02-23 05:41:29 __use_cert,734: start idx = 02026-02-23 05:41:29 use certificate issuer = /C=US/ST=California/L=Sunnyval

Fortigate 5.6 Fortimanager 5.6.8 Lower version but in use I've been using it well for over five years, but suddenly I can't see the policy Reboot / fmg 5.6.11 patch / db check and it only loads Have you ever seen cases like this? 

Hello everyone,I would like to clarify how FortiGate handles dynamic BGP neighbors in relation to the print tablesize output.In our environment, we use a hub-and-spoke topology. On the hub, BGP peers are not configured statically one by one under config neighbor. Instead, we use:neighbor-group neighbor-rangeThis allows spoke peers to establish BGP sessions dynamically. When running print tablesize, we see:router.bgp:neighbor: 0 0 1000 My doubt is about the meaning of this value in a dynamic BGP scenario. I understand that max-neighbor-num under neighbor-range is a per-range configurable control, not necessarily the total platform limit. For example, the CLI allows: set max-neighbor-num <1-1000> or 0 and documentation mentions that 0 is the default special value. Because of that, I would like to understand the following:Does router.bgp:neighbor in print tablesize apply only to statically configured neighbors, or does it also include dynamic neighbors created through neighbor-range

Trying to set up an IKEv2 client-certificate-based IPsec connection from a FortiClient 7.4.4 to a FortiGate VPN Gateway results in the following error in the FortiGate log when evaluating the received IKE_AUTH request:ike V=root:0:IPSec-Client:176: certificate validation succeededike V=root:0:IPSec-Client:176: signature verification failedike V=root:0:IPSec-Client:176: auth verify doneike V=root:0:IPSec-Client:176: responder AUTH continuationike V=root:0:IPSec-Client:176: authentication failed Parsing the received IKE_AUTH request sent by the FortiClient, we see that the AUTH payload of type Digital Signature (14) defined by RFC 7427 is missing the one octet ASN.1 length field and the following ASN.1 OID of the Algorithm Identifier. Only the raw 64 octet ECDSA 256 Bit Signature has been added:2F     Next Payload: 47 - CP00     C/Reserved0048   Length: 72 Octets = 8 + 64 Octets (2*256 Bits)0E     Auth Method: 14 - Digital Signa

Hello guys, What will happen to my fortimail once licenses expire?Will it be able still to send/relay emails?What about protection, antispam, content and URL filtering? Thank you in advance.

 Hi,I am looking at multiple customer scenarios where thee have more than 300 switches , or have an expansion plan in the future exceeding total of 300.If I am interested  in proposing a fortilink fabric to maintain and operate them, what options do I have to increase capacity. As I understand an HA unit in A-A or A-P will not help to double switch capacity.Do we think of adding two HA pairs and then manage the whole show through Fortimanager ?

Hi, I recently started working In FortiSOAR.In playbook I am using the splunk connector with FSR: rest API call action and GET HTTP method to collect the kvstore lookup data.The kvstore lookup contains fields including Date field (which contains ephoc format of date).The Playbook is picking all the data without any issue.But I have to pick data based on condition (if date is beyond 1 month I have to pick those data)Could anyone help me how to achieve this.Thanks.

Hello,I am currently working with FortiManager Cloud (7.4) and FortiGate devices running in multi‑VDOM mode.I would like to know whether it is possible to hide or exclude specific VDOMs on FortiManager Cloud, so that:they are not visible in the Device Manager,  they do not consume a device / VDOM license, while still existing on the FortiGate (i.e. without deleting the VDOM on the device itself).From what I understand so far, it looks like:all Traffic‑type VDOMs present on a FortiGate are automatically visible in FortiManager Cloud, each of them is counted as a managed device/VDOM for licensing purposes, and there is no supported way to “unmanage”, hide, or exclude a single VDOM only on the FortiManager Cloud side.Can someone please confirm whether this is indeed not possible on FortiManager Cloud today?And if so, is there any official Fortinet documentation or statement that explicitly confirms this behavior or limitation?Thanks in advance for your clarification.Best regards,B-W

Hi Team, I am looking at multiple customer scenarios where thee have more than 300 switches , or have an expansion plan in the future exceeding total of 300. If I am interested  in proposing a fortilink fabric to maintain and operate them, what options do I have to increase capacity.  As I understand an HA unit in A-A or A-P will not help here.  Do we think of adding two HA pairs and then manage the whole show through Fortimanager ? Your views would be appreciated. Thanks !

When deploying FortiSOAR the configuration wizard reset the database password to a unique value.is there a way to know this password or reset it to a known one?

So i've recently acquired two FortiAP-221c's with POE injectors and I am having a little bit of trouble finding out what seems to be simple information. Maybe one of you can help me out. If I were to put one (or both) of these AP's in my home, what would I NEED to make them work. Is a Fortigate required because of the built in Wireless controller? I know they need to be authorized to enable the antennas, is a fortigate or VM software the only options I have?

Hello, I have a 40F.Default config has a virtual hardware switch called "lan" whose member interfaces are: "lan1", "lan2" and "lan3".I would like to remove those member interfaces from the "lan" switch using Ansible. Do you know how to do that ? https://docs.ansible.com/ansible/latest/collections/fortinet/fortios/fortios_system_virtual_switch_module.html#examples I tried the tasks bellow, leaving the port empty, but no success.If I specify just one port, like lan1, it removes the others. I need to remove them all. task1- name: Remove member interfaces from "lan" virtual hardware switch  fortinet.fortios.fortios_system_virtual_switch:    vdom: "{{ vdom }}"    state: "present"    system_virtual_switch:        name: "lan"        port: task2- name: Remove member interfaces from "lan" virtual hardware switch  fortinet.fortios.fortios_system_virtual_switch:    vdom: "{{ vdo

Hi Everybody,I just installed a new Forti Client EMS 7.4.6 installation with a trial license on VMWare.EMS is nicely setup, using a signed cert etc.Now when trying to make a installer package i'm unable to do that.According to the documentation and EMS training I should be able to select between "Create installer " and "Create installer config" but don't get that option.It just let's me go through the creat installer wizard and at teh end I just can do a "download".Is it something i'm doing wrong or is it some bug/feature on a newly released version (released at 17-3-2026) as usual with FortiNet? referenced documentation was the ems 7.4 training and the EMS 7.4.6 quickstart guide: https://docs.fortinet.com/document/forticlient/7.4.6/ems-quickstart-guide/942839 Kind regardsRoger Beurskens

I have performed multiple FortiEMS upgrades over the past year,s tarting from 6.4.7, and the FortiEMS server version was always the same as the Forticlient installer package version.That is not the case with 7.4.7. The installer package version is 7.4.6.I find that confusing..Is an installer package 7.4.7 in the works?

Hello,following yesterday’s application of the EMS 7.4.6 patch on the VM (https://docs.fortinet.com/document/forticlient/7.4.6/ems-release-notes/832484), we have identified today that the majority of PCs/laptops with FortiClient versions 7.4.5 and 7.4.6 are experiencing an issue where the FortiClient Network Access Control process is utilizing 100% of the disk. Before applying the CVE patch, we did not observe this issue.A simple restart of the affected PCs did not resolve the problem. We also attempted to restart EMS, but the issue persisted. On the endpoints we are only using Telemetry, Vulnerability Scan, and VPN access.As a workaround, we tested disconnecting telemetry, generating a new invitation, and reconnecting telemetry — after which the disk utilization returned to normal.Are others experiencing similar issues?Jirka

I have a FortiExtender (FEX) connected to my Fortinet FortiGate, with no other LAN or Internet connections, and in that scenario the device connects to FortiManager Cloud without any issue.However, when I connect the MPLS links (used for LAN/Internet), the FortiGate is no longer shown as connected to FortiManager Cloud.I already created:A static route An SD-WAN/static rule forcing FortiManager Cloud traffic to use the FEXBut the issue remains.Tests PerformedOnly FEX connectedping 8.8.8.8 → Works ping fortimanager.forticloud.com → WorksMPLS connectedping using source interface = FEX → FailsQuestionHas anyone seen a similar issue where adding MPLS changes routing/return traffic behavior and breaks connectivity to FortiManager Cloud, even when policy routes/static routes are forcing traffic through the FEX? Any suggestions would be appreciated.

Hello everyone, After update FortiEDR 5.2.8 to 6.1.0.1455 in dc server , there is a problem in  the collector. The collector always off and workaround is disable in console then control panel remove and restart.After restart, the EDR collector continuons. In the internet, the solution is remove this folders:!--scriptorstartfragment-->rmdir /s /q "C:\Program Files\Fortinet"rmdir /s /q "C:\ProgramData\Fortinet"!--scriptorendfragment-->But i can’t. So, there is tools to remove it, the same fcremove ( to forticlient)?