Support Forum

I am just looking for any insight and tips to focus on that don’t violate anyone’s NDAs. I have some practice exams that I have been spamming on Udemy. I note down anything I have no idea about and do a deep dive on it via YouTube, Google etc. just as much reading as I can to learn about the concept. Practice exams are scoring anywhere between 48-59% so not insanely far off the passing mark but definitely not in a position to sit for this exam (if I want to not lose my money and pass it on the first go). Any advice on GNS3 lab images that helped shore things up for you all or really any resources that helped you all dial in to get to a point where you were ready and passed the exam, please send them my way. Been playing in FortiGates for 6+ years for various outfits and I know I am close to really nailing this thing. There are just a lot of features in these things that I never touch because the customers I am working for aren’t using them. Honestly never really saw a customer use a Fo

So we finally pulled out the fortiwifi 40f that's been causing so much grief and replaced it with a consumer router that actually works and before binning the fortiwifi decided to factory reset, upgrade to latest firmware and see if a fortigate device can actually do something useful. First thing I noticed was it's now claiming to be on the 'Latest' update v7.0.12 and furthermore it won't do any firmware updates without a paid subscription (which is odd because it was running without a subscription prior to the resel and was always complaining about needing updates).Now since it is April Fools day I just wanted to clarify I'm not imagining this or misunderstanding something.  Fortigate sells devices chock-full of security holes and withholds the fixes unless you pay in perpetuity for a subscription? Really? Or did the factory reset update to the latest stable version of the 7.0 branch and is merely refusing to update the major version? Which would be slightly more reasonable albei

Anybody doing any multiple ISPs with DHCP-PD for IPv6 and SD-WAN with failover and NATting on the fother PPPoE + DHCP-PD interface?Seems that 7.6.3 don't have NAT66 options (or I'm blind) and the "problem" is that my WAN/ppp interfaces don't have IPv6 IPs assigned from the PPPoE/DHCP and the gateways are the link-local FE80::1 IPsLooking for more/detail information to peruse on the FortiGate 7.6.x to configure... or is there a IPv6 "working group" I could join to assist in test case debugging?

Hello  Hi Community, please I want to know if anyone has integrated misp feeds to Fortigate (I already have feeds for IP and URL from other sources) How can I consume this IOC from misp events.? Thank you! Regards.

Hi,Has Anyone deployed FortiDDoS in prevention mode? We will be switching the DDoS from Detection mode to prevention mode tomorrow. I have generated thresholds multiple times and now thresholds are not getting updated. SPP Profiles for DNS, NTP, ICMP, TCP and HTTP are applied after reviewing the Handbook. I'm seeing some drops in the incoming traffic against DNS data anomaly, DNS UDP Header anomaly, DNS query anomaly, DNS exploit anomaly. Should i uncheck these options in the field and then switch the mode of the DDoS? Any guide on how you guys worked your way toward switching from Detection to Prevention will be helpful.

I'm curious about how much of firewall throuput is consumed when UTM features are enabled. (IPS, AV, App Control, Web Filter) How much of a precentage from total firewall throughput consumes each feature ?  

Good morning, when I try to install the program, it tells me that I must uninstall the current version. But the problem is that there is no program, no folder. I don't know what else to try. I tried with cdm or powershel and nothing worked either.

"Thank you all for your responses.Following up with additional questions:When is FortiOS 8.0 expected to be officially released for FortiGate hardware?Which FortiGate models will be supported?Will this upgrade have any impact on connected FortiSwitch and FortiAP devices? Will they require firmware updates as well?Thanks in advance 

Hello everyone, I would like to know what's the network's behaviour when FortiNAC is down (unrecheable) or doing a firmware upgrade ? Are the users stuck in the isolation VLAN or the behaviour is as if FortiNAC never existed ? Is FNAC 7.2.7 version stable, or should I upgrade to the latest versions 7.6.x ? BR,

Environment DetailsModel: FortiGate-VM (KVM)Firmware Version: 7.2.11Hypervisor: KVM (QEMU/Libvirt)Setup: Standard LAN-to-WAN routingProblem DescriptionI am experiencing a recurring issue where LAN-to-WAN connectivity functions perfectly upon initial configuration but fails consistently following a system reboot.Symptoms include:FortiGuard Disconnect: The dashboard shows a "Time Sync Error" or "Unable to connect to FortiGuard."Traffic Interruption: LAN users lose the ability to route traffic to the WAN.DNS Failures: DNS resolution via FortiGuard or system servers fails.Troubleshooting PerformedVerified basic firewall policies and static routes (all appear correct).Confirmed that the issue specifically triggers after a reboot.Attempted to manually set the time, but the error persists or returns. RegardsSantosh

Hello!I have recently begun to use FortiGate 7.2.13 for a school project and I might need some help.I want to create a policy on the GUI that blocks zip-files but so far I have not managed to get it to block any zip-files I download. I would really appreciate some help in any way for this problem, and if I need to upload more information regarding this please let me know.

If the device authenticated based on Entra ID using Captive Portal, then can we assign the vlan based on the Entra Group?

Centralized Control: Adding Remote FortiGate firewall to FortiManager  In this video, we dive into the specifics of FortiGate SDWAN and demonstrate how to integrate your FortiGate devices with FortiManager. We cover the entire fortinet configuration process, ensuring a smooth setup for your network management. This guide is perfect for anyone looking to optimize their fortinet firewall setup within an SD-WAN environment. https://youtu.be/jw84ZuOn8zw

Hi everyone! I've been reading some articles and guides. But I am still not confident with what I have gathered. So I would like to kindly ask your experiences on proper setting up of HA for 100F (or any model if applicable)Long story short we will just reuse 2x 100Fs from one of our site which has been decommissioned to a new existing site.  This is my plan: 1. Turn on Firewall-A2. Factory reset the firewall.3. Configure management interface IP via CLI4. Once reachable via GUI, configure the HA (mode, priority, group ID, group name, password, heartbeat interfaces, heartbeat interfaces priority, mgmt interface reservation and gateway)5. Save, turn off the firewall A.6. Turn on Firewall-B. Repeat all the steps above.7. Turn off firewall-B.8. Connect the HA1 interfaces of the cluster units together9. Connect the HA2 interfaces of the cluster units together10. Power on both of the FortiGates11. configure everything in the cluster as if it is a

Te lo dejo mejorado para foro (más claro, técnico y natural :backhand_index_pointing_down::(Hi all,I’m working on a Hub-and-Spoke IPsec VPN setup where the Spoke site is using a FortiExtender (LTE) as the WAN interface.I would like to know if there are any special considerations or required configurations when using a FortiExtender on the Spoke side.Currently, I’m facing the following error:"fext_wan IP is 0"It seems related to the LTE interface, which is expected to obtain its IP dynamically. Thanks in advance.

Hi.Here we are looking for a replacement of our working firewall 1200D model.last few days based on my firewall performance details• Inbound Traffic: 2.12 Gbps• Outbound Traffic: 1.1 Gbps• CPU Utilization: 12%• Memory Utilization: 47%• Session Rate: 91 sessions/sec• Concurrent Sessions: 88,562, New Sessions 1000+• HA A-A (Active to Active)• Firewall Policies: 245In this performance-based context, can you give me the best suggestions for which model I replaced it with?Note: Last year's renewal purchased the FortiCare Premium Package. This is based on the firewall running.

Hello,We are using a FortiGate with explicit proxy. It forwards requests to an upstream proxy.How can I exclude certain URLs so that they are not sent to the upstream proxy, but instead the FortiGate establishes the connection directly?I tried using the URL match list, but the FortiGate still sends the requests to the upstream proxy. We are on version 7.4.11

I have are two Fortigate firewall between model 50G and 50G-WIFI. Also use SD-WAN to created dual internet and its through SD-SLA mark the auto fail-over. In my case has an interesting problem occurred:***also use the same as police & static route  Model 50G-WIFI:SD-WAN member: VPN_01, VPN_02 => enableWan, A=>enable that are two VPN tunnel & internet service also work as well.===============================Model 50G:SD-WAN member:VPN_01, VPN_02 =>enableWan, A=>enableVPN with Phase1 =>lost====SD-WAN member:VPN_01, VPN_02 =>enableWan, A=>disableVPN service work as normal====SD-WAN member:VPN_01, VPN_02 =>enableVPN service work as normal, internet service not workingas above case problem, how can to resolve it?  

在 Fortinet 的 SASE 解决方案中，我看到主组件 FortiSASE 拥有自己的控制平台，也称为 FortiSASE，可用于管理 FortiGate、SD-WAN 等设备。我还注意到 FortiManager 也包含在 Fortinet SASE 解决方案中。FortiManager 是否也提供自己的控制台界面？它和 FortiSASE 控制台有什么区别？FortiSASE是否提供对设备本身（例如交换机）的配置控制？据我所知，FortiSASE可以配置和管理FortiGate设备。您的客户目前在部署 Fortinet SASE 解决方案时，主要使用 FortiSASE 控制台还是 FortiManager？

I'm unable to activate my trial license with my email address jmujica@outlook.com,  I have an trial license assigned but unable to reuse the license

Hi everyone! We have an existing FG 501E which we'll be decommissioning in a few weeks. We plan on replacing it with FG 100F. In order to lessen the risk and errors, I plan on backing up the old firewall config and just restore it to a newly factory-reset FG100F.However, our existing 501E has Global, and 2 vdoms(including root). On the 100F, we plan on NOT using a vdom. Just put everything in global configuration. Question:1. Is it possible to backup and restore this properly?2. Is it possible to not use a VDOM and just put everything in global config?

This is the most frustrating experience that I ever had with a 30day eval license registration. My customer wants to evaluate Fortigate against another solution and I can't create a PoC without using 1vCPU and a 2GB ram?I have registered the license and the instance still requires a licenseDescriptionPartnerProduct ModelFortiGate VM TrialRegistration Date2026-04-03Lost more than 2 hours as the documentation is not clear (does not even have a link on what is the portal to create a user on how to get a 30 day license - I actually need it for a week)

How can I avoid issues with security profiles after the license expires?Web filter, IPS, DNS filter Is there a way for them to work offline without updating? 

I'm using clearpass accounting with rsso to a fortigate 200g using aruba wifi. also have intrium updates enabled on clearpass.Athentications are working and RSSO is picked up correctly on the firewall however when roaming between access points I am prompted for captive portal. The connection doesnt drop and im using fast roaming on the wifi which would say its a firewall issue any settings to tweak on the firewall so it doesnt distrupt roaming.?

I installed FortiClient EPP/APT Edition for testing purposes, but I am now unable to uninstall it from my system.When I try to uninstall it from Control Panel → Programs and Features, the uninstaller only shows a Repair option and does not provide an option to uninstall.I also attempted to resolve this by downloading the FortiClient removal tool from the Fortinet Support Portal. However, I am facing issues there as well.When I navigate to:Support → Firmware Download → Product SelectionI encounter the following message:"Sorry, you don't have any product covered by a Fortinet support contract."Additionally, the product selection button is not working, so I am unable to select any firmware image or proceed further.For context:I downloaded FortiClient EPP/APT Edition(windows) online for testingI do not have a serial number or active support contractThe uninstall option is not available (only repair is shown)FortiClient #Windows #Uninstall #EPP/APT