Support Forum

Please help me block logs saved to the SSD. I'm referring to "Local Traffic" and entries that appear even 2-3 times per second. For now, I've disabled "Local Traffic" logging on the SSD, but I'd like to see traffic from Fortigate (e.g., to globalguardservice, NTP, etc.). The FG61E is in transparent mode, connected to the internet via the Local Interface.This large number of entries concerns local network connections from some devices. These entries include:Source=192.168.3.XX (LAN addresses)Destination=255.255.255.255 or 192.168.3.255Application Name="DHCP/DHCP Relay" or "udp/15600"Destination Interface=[object Object]Source Interface=internalHow can I block this, but still allow other connections, such as those to Fortigate servers and other services, to be visible?

Hi everyone, I need your help.I have a Fortinac device with 200 licenses. However, I've purchased an additional 100 licenses, which should total 300. However, this total isn't displayed in the Fortinet GUI; only 200 licenses are shown. The additional 100 licenses are visible in the Fortinet support section, where the device is registered.  How can I make them appear in the GUI? I understand that the additional licenses should be displayed automatically.

In Administration - Deployment - Collector, there are two available options: “Update Collectors” and “Request Collector Installer.”For Collector (Agent) deployment, the correct option to use is “Request Collector Installer.”       Through the Update Collectors section, you can update the agent version for the relevant operating system by selecting either a single collector group or multiple collector groups.   When deploying a Collector, after selecting the operating system, you can choose either the current version (n) or the previous version (n-1).For server systems, using the n-1 version is generally the safer option.Parameter descriptionsAggregator Address = Refers to the main server in the data collection and transmission layer that centrally processes telemetry collected from endpoints and forwards it to the FortiEDR management console.Organization = Represents the tenant identity and indicates w

Good morning, team,I have been experiencing a recurring issue within my infrastructure for some time.I have already opened a case with TAC; however, no definitive solution has been provided so far.Currently, I manage an environment consisting of approximately seven FortiAnalyzers, each with an associated FortiAnalyzer Collector.Until September 2025, there were no issues within this topology. However, at a certain point, the environment began to exhibit unexpected behavior.FortiGates started losing log visibility across multiple features, including Traffic Forward, FortiView, and any other functionality that relies on logs sourced from the FortiAnalyzer.The issue initially affected several FortiGates connected to FortiAnalyzer 01. After several hours of troubleshooting, we identified that restarting the FortiAnalyzer Collector linked to FortiAnalyzer 01 would temporarily restore functionality, allowing logs to be displayed again on the FortiGates. However, this proved to be only a tempo

FortiManager 7.4.9 Free Trial managing FortiGate 100F on 7.4.9 Config status: Synchronized On FortiManager I've created a new IP reservation under IP Assignment Rules, device global DB status changes to modified, yet when I use the install wizard I'm unable to push the reservation to the FortiGate 100F. The install preview is empty and it doesn't recognize the reservation. Either new one or deleting an old reservation.I have tried to modify a firewall policy along with the reservation but it only recognizes changed policy not the reservation. 

I created a LETS ENCRYPT Cert on my FortiAuthenticator and Fortigate that has the SSID for Guests, always had an issue with GODADDY on Apple devices, so we moved to LE. creating the cert via ACME was ll good, cert is valid , matches the FQDN etc, but now annoyingly the problem is worse, Apple and Android dont trust the cert! when they connect to the GUEST SSID, the phones browser says "Security Warning SSL_UNTRUSTED""This certificate isn't from a trusted authority" but the common name "myfortiauthenticator.mydomain.net" is signed by Lets Encrypt: Issued by:Common name:R13Organisation:Lets Encrypt and the cert is 100% valid.  Fortinet support Lets Encrypt and ACME, and is a perfect solution, but whats the point if Apple and Android dont trust it? or am I missing something?   

Hi, Can somebody please shed any light on this for me. I have configured Application Control to 'Block' the 'Proxy' category and I have 'Deep SSL Inspection' enabled on my firewall policy. When the firewall policy is set to 'Flow-mode' the NordVPN client on the PC is blocked, however when the exact same policy is set to 'Proxy-mode' NordVPN can connect successfully. I can see logged Security Events for Wireguard being blocked when in 'Proxy-mode' but eventually the NordVPN client passes through the UTM and connects. Can somebody please explain why this is the case? I thought 'Proxy-mode' was a more thorough inspection and would expect to see the opposite behaviour. Interestingly just to add to this, I see a lot more granularity in the Applications listed in the Security Event logs when using 'Flow-based' opposed to 'Proxy-based' inspection.  Regards, Jonathan. 

Hello Fortinet CommunityWe're facing a connection problem with an Fortigate60, on which no connection to any rusdesk Relay is possible. On the Firewall of the Target there is no traffic at all from the source, which means somehow the connection is still blocked.       Does anyone know what could cause this? 

Hi, We are investigating a strange failover issue with managed FortiSwitches by a HA pair of Fortigates 601F.  We are having strange issues with traffic loss if we failover to the passive Fortigate. The issues are only on vlan's were we have intra vlan blocking enabled. If we disable this feature everything is working fine.  The problem is that we have traffic loss from the clients to the gateway/fortigate for 2 minutes and 30 seconds after failover. Support found out that the mac adress for that Fortigate vlan is learned on the wrong trunks.  We have switches in a ring connected to a pair of 1024E MCLAG core switches.  I'm analyzing this issue and in the core switches logging I see the following messages during the failover/issue: 10: 2026-01-08 10:14:49 log_id=0103030700 tz=+0100 type=event subtype=system pri=information vd=root action="daemon-startup" user="init" ui="None" daemon="l2dbg" pid="2589" msg="Daemon l2dbg started"11: 2026-

I have a load of Proxy rules, and have placed them in a specific order, So that all the "UNAUTH" Rules are at the top and then the AUTH rules, Problem I have,  I need an UNAUTH rule to catch the rest of the traffic using a webfilter, to block things, but if I place this rule at the end of the UNAUTH rules, the people who need to AUTH to certain sites will now hit this rule first, which i dont want, its for Apple IPHONE users, that cant AUTH but need to be allowed out. The Auth Rules are important to allow certain groups to certain sites, but as they will be below this UNAUTH catch all policy, they will hit that? I cant figure out how to arrange the rules! any advice appreciated.

Hardware: FortiGate 101F paired with FortiAP.Account: I have created a local user on the firewall.Goal: I want an Android tablet to connect to the Wi-Fi using TLS authentication.How do I generate the necessary client certificate for the Android tablet to authenticate and connect to the Wi-Fi? I've already asked Gemini and ChatGPT, but neither provided the correct procedure. Both of them just gave me AI hallucinations.

Hello,I am currently using FortiClient EMS version 7.2.4, while our field users are running version 7.2.5. Occasionally, some users encounter the 'Endpoint blocked by EMS' error.There are no issues regarding the device license status. I can resolve the issue temporarily by manually unblocking the user from the console, but this is not a permanent solution as the problem recurs. What could be the underlying causes of this issue?

Hi Community,Can anyone share me the configuration guide to configure Hub and spoke dialup VPN with BGP with Fortimanager.I wanted to configure this on Fortimanager.Issue is my Spokes are not getting a IP from Hub during Negotiation.I found the guide to do this via Firewall but not able to find any documentation to do this via fortimanager.

Hi, When trying to renew the server certificate (or create a new one) using the automated option.  I get this error: "EMS Invalid certificate and private key: argument 'data' Cannot convert "<class 'str'>" instance to a buffer. Did you mean to pass a bytestring instead?"  EMS 7.4.5 build2111 (Mature) Any ideas on what could be causing this? thanks

hi there,I need help please.I use FG60F with firmware 7.2.x I've created firewall policy with webfilter and ssh inspection. suddenly, some computers can't access certain https website, but the other PC still can access the web without issue. if the -problem computers- use direct internet (not via fortinet), they can access the website. where is the issue? anyone has same experience? thank you

I'm trying to allow CoPilot in office.outlook.com sessions, but block copilot.microsoft.com in general browser sessions, as well as all other LLMs My web filter has Artificial Intelligence Technology blocked in the Fortiguard category based filter, and a URL filter: *.google.com/*udm=50**.google.com/*udm=14*m365.cloud.microsoftbing.com/chatcopilot.microsoft.com*.bing.comcopilot.microsoft I also have an application control profile on the proxy policy, with the  GenAI category blocked. The only way I can get it working is to have the AI blocking web filter in both the the firewall and proxy policies. Having the web filter in just the proxy policy works for most LLMs via browser, except CoPilot. It works, but I'd like to know why, as this goes against the admin guide on transparent proxies. https://docs.fortinet.com/document/fortigate/7.6.6/administration-guide/15908/transparent-proxy I don't like not understanding my firewall's config :( &nbsp

Hi Folks, This new thread is created to clarify if it possible to use the functionality Fortiguard DDNS to implement a domain name once that name is configured, that be use in a remote access VPN. As example:I configure and activate the DDNS domain XYZcompany.fortiddns.com in the fortiguard ddns. (Image Attached)Later, I want to use that DNS XYZCompany in our FortiClient. (Image Attached)   Thanks for your answer. Best Regards,Joel   

Fortigate firewall FG90G HA what are the must keep requirements to be kept ready before HA config including Licenses do I require single or two licenses 

As part of investigation by checking sample of 100 Fortigate sites from 800+ sites. The data showed that 48 Fortigate sites out of 100 sites having memory conserve mode based on crashlogs. It appears that it took a second when entering and then existing memory conserve mode. Some nodes showed multiple conserve mode instances.  Example:29: 2026-03-09 17:47:57 green="1572 MB" msg="Kernel enters memory conserve mode"63: 2026-03-09 17:47:58 service=kernel conserve=exit total="1918 MB" used="1541 MB" red="1687 MB"   The customer has 800+ Fortigate sites. I'd like to be sure that no impact to the customer given their large deployment. I was told that the configuration below will help to resolve the conserve mode.  Two questions are:Can someone help to explain what the configuration below does and how it will help? Is it the best solution to resolve or eliminate conserve mode? Are there any impacts and drawbacks?#----------------------------------------

Hi guys,I have a question about FCSS after july 15 2026.I was planning on FCSS Secure Networking.I passed NSE 7 - Enterprise Firewall Administrator 7.6 and was planning on NSE 6 - Network Security Support Engineer 7.6.After July 15 both of these exams being canceled.I couldn't figure out what will happen according to their new mappinghttps://www.fortinet.com/nse-training-updateWill it count for something ?  am I gonna receive NSE 6 ? or I will need to do NSE 4 to get NSE 7?      

Just a simple inquiry. We have a setup for Active-Passive (HA) in our remote site. Since fortiguard services are shared from Master, does it really necessary to avail full license to both primary and secondary firewall?

Hello, I'd like to move the WAN connection from WAN2 to WAN1 on some FortiGates managed by a FortiManager, just so the physical installation is the same on all gates. While I am aware that this will bring an outage, and that's OK as long as it is planned, I want to make sure that when the cable is connect to WAN1, internet traffic goes out as it should.So, ideally, I would prepare the following configuration on FortiManager:deconfigure IP of WAN2 (which is actually used as internet connection)reconfigure IP of WAN1 with the old IP of WAN2modify the gateway in SD-WAN BUT, logically, if you do step 1 above, connectivity of the FortiGate is lost, so, my question:Will the above configurations be fully loaded on the FortiGate, before getting fully applied, or will the each step be done one by one by the FortiManager, connectivity lost after step 1 and my install fail, requiring an on-site intervention of a FortiGate administrator? If it would be the first situation (conf

Hi,I am writing to request a review and whitelisting of my domain. Previously, my website had some security issues; however, I have completely rebuilt the website from scratch (+ better host, + new PHP version + FTP fix) and ensured that all malware and vulnerabilities have been fully removed.All necessary precautions have been taken to ensure that the website is now clean, secure, and compliant with best practices.URL: https://lesbateauxagathois.comI kindly request you to review my domain again and whitelist it at your earliest convenience.Please let me know if any further information or verification is required from my side.Thank you for your time and support.

I am working on relaxing our SSL VPN with IPSEC. currently running 7.2.12 on the FG (azure vm) and using the free FTC 7.4.3.IPSEC is configured with split tunneling, accessible networks is using an address group and all members are subnets. Connection on all FTC apps was imported from a config file.ISSUE: some devices are getting a 0.0.0.0 route pointing to the ipsec tunnel. other devices are getting the correct routes when connecting.any ideas what would cause some devices to not get the correct routes?

We have a Fortigate 200E, running firmware 7.6. IP address of 10.10.0.1 (Internal Software Switch).I deployed a Freeradius Server, IP 10.10.0.11, for RADIUS based 802.1x WPA-Enterprise authentication for Wifi. The Radius Server is up and running, I can run a radtest from my local machine on the network behind the Fortigate and get successful connections.This issue is when I go to add the FreeRadius information to the Radius Server section on the Fortigate, I am constantly hit with "Can't contact RADIUS server". My secret and IP are correct. I have tried to make a firewall allow rule from internal to internal, source all, and destination 10.10.0.11 with Radius services, but it didn't make any difference.I've gone through all the Googling I can, tried setting the Source-ip to the Fortigate, nothing I do is letting the Fortigate connect to the Radius Server.Any help would be appreciated.Thanks.