Support Forum

I need to know how to configure the policy to provide email access with an attachment filter in FortiMail.

Hello Team,Our FortiClient EMS uses a manually uploaded Let’s Encrypt server certificate containing two DNS SANs.Certificate renewal is already automated through our Salt master. After each renewal, we currently download the certificate and manually upload and apply it in EMS.We want to automate only the certificate deployment and activation steps while keeping certificate renewal managed by Salt. Or happy explore option auto renwal in EMS with two DNS SANs.Please provide the supported API or CLI procedure for importing the renewed certificate, matching private key, and intermediate chain, and assigning it to the applicable Web server and Endpoint control services.Please also confirm the required authentication and permissions, any service restart requirements, and whether this operation can run unattended on our EMS version. Thanks,

Hi Team,We plan to deploy a FortiPortal Scalable Cluster with two nodes in one DC and one node in the other. If the DC with the two nodes goes down, the single node can operate independently per the configuration:config system ha set min_nodes 1endWhat will happen when the two-node DC is brought up? Will it be enough to change the single configuration to a scalable cluster? Will the changes made on the single node during the outage be replicated to the other nodes?

Good morning teams 😊;For FortiClient EMS Trial, I created an IPsec VPN tunnel.However, I cannot export the XML configuration file with the VPN password included.Is there a way to export the VPN XML configuration with a password?What I would like is that when the user imports the XML configuration file (with forticlient) , they are required to enter a password before they can access the VPN.thanks for you support 😊

im having an issue with our FortiClient IPsec VPN randomly disconnecting users. we are running a FortiGate 60F, using IKEv1 with xAuth.The VPN connects and works fine, but sometimes it disconnects after just 4-6 minutes, while other times it stays connected for hours. I've tested this on different Windows laptops with FortiClient VPN-only 7.0.8 and 7.2.14, and both versions have experienced the issue.I've spent quite a bit of time checking the logs and running IKE debug on the FortiGate, during one of the disconnects, I noticed these messagesrecv IPsec SA delete, spi count 1recv ISAKMP SA deleteFrom what I understand, this means the client itself is requesting the disconnect, but I cant figure out why. There was no DPD failure, and Windows didnt report any Wi-Fi disconnection at that timeHas anyone experienced something similar? Is there anything else worth checking or changing in the current IKEv1 setup? I'm also considering switching to IKEv2, but Id rather understand whats causing t

Hello, I would like to use my 300D as some kind of ipsec concentrator.It will be used for a lot of dialup connections. Every connection is authorised by configured radius server. Till now everything is ok and configurated (phase 2 is established). Next thing is to assign ip taken from radius, which is connected to customer's mac address in radius database.Unfortunatelly i have no idea how to configure it. If i change anything phase 2 is falling down. May i ask you to give me advice how to move it forward please? It is my first post here, i couldn't find such problem using search mode :)

FortiGate-VM64-HV Trial Issue on Hyper-VPlatform:- Hyper-V (Server 2019) Gen 1 virtual machine- FortiGate-VM64-HV v8.0.1 build0245 (GA.F)- Trial LicenseIssue:The trial license activation completed successfully and the CLI shows "License Status: Valid". However, after logging into the web GUI, I logged out immediately.CLI access works normally.Network Connectivity:- Can ping 8.8.8.8 successfully- Default route configured via 192.168.1.254 on port1Relevant Output:FGT-VM64-HV-NZVQOU # get system statusVersion: FortiGate-VM64-HV v8.0.1 build0245 (GA.F)First GA patch build date: 260421Current Security Level: HighFirmware Signature: certifiedLicense Status: ValidVM Resources: 1 CPU/1 allowed, 1694 MB RAM/2048 MB allowedHostname: FGT-VM64-HV-NZVQOUOperation Mode: NATCurrent virtual domain: rootMax number of virtual domains: 10Virtual domains status: 1 in NAT mode, 0 in TP modeCurrent HA mode: standaloneBranch point: 0245Release Version Information: GAFortiOS x86-64: YesRouting Table:S* 0.0.0.

Hi everyone,I manage like 30 fortigate devices and I updated them to 7.2.13 when it was released.Since I got users complaining about slow SMB traffic inside IPSEC tunnel s2s. The users are all behind this 101E model and they are thé only ones to complain.Bandwidth is like 300KB/s during transfer in 7.2.13I tried to check ipsec config (encrypt. algo.) Changed and adjust MTU but the traffic is still slow...Since the users told me it started since last update I tried to rollback to 7.2.12. same issue. I remember that I updated 7.2.12 and 7.2.13 a week after. So I checked to rollback to 7.2.11 and now speed is back to normal like it was before 8MB/s.I'll open a ticket but it seems linked to this model. Anyone has the same behaviour ?

we are using forticlient v7.4.7, today our users brought down their latest updates. Our VPN users are coming back down the VPN tunnel to download their updates, this maxed out our 1GB line. We have Windows updates set in the forticlient to go direct instead of using the tunnel. We also have the .exe and microsoft domain set to got direct. We are still seeing all this traffic coming down the VPN tunnel and then using our web filtering policies on the Fortigate to go out. Can anyone help with this?

Hello, good evening! I've been having VPN connection problems for a few days now. I've already tried reinstalling and configuring it, but without success. Currently, my connection is timing out and I can't access it. Could someone tell me what might be causing this? Thank you in advance. 

I updated the FortiGate from FortiOS 7.6.6 to 7.6.7 and am experiencing issues with SSL inspection certificates.After the update, the firewall started dropping all traffic. Even traffic matching firewall policies without SSL inspection enabled is being dropped.As a temporary workaround, you can disable SSL inspection globally to restore connectivity.Has anyone else encountered this issue after upgrading to version 7.6.7? Is there a known bug or a recommended fix?Update:Not logging dropped packetsFirewall memory usage reaching 90%Thousands of active sessions (compared to normal levels)

I am French, I bought a MacBook in July from an individual. He told me he won it thanks to his company that gives gifts, so with an Apple care guarantee. Nothing alarming, everything seemed normal, up to a few days. It is written that the MacBook belongs to this company. With attached a proof and a code requested. I can't get anyone from the company who can contact me, to learn more and get more information.It says it belongs to Fortinet France, but I only find sites in English and no French interlocutor can anyone help?  

I have problem with my NAC where sometime the endpoint is loss connectivity both for wired and wifi. Previously i post error from client side here and now after i enable authentication log from FNAC then we can see for same endpoint the authentication can be success and sometime is fail.The fail message is ‘No EAP session macthing state’ View from authentication step then i got message ‘outer-method failed to authenticate Switch_IP → FNAC IP’The issue is from FNAC?

firewall Remote-IPsecVPN not able to get ping WAN ip,rest of the all services is okay including router IP.which is same series. 

Hi , i have Question about Using Multiple IKEV2 Dial-up VPN with PeerID is that possible ? i note in the FortiGate_7.6_Administrator_Study_Guide-Online page 363 saying:“When you configure multiple dial-up IPsec VPNs, IKEv2 makes it simpler to match the intended gateway bypeer ID. With IKEv2, you can either use the standard peer ID attribute or the Fortinet proprietary network IDattribute to indicate the phase 1 gateway to match on the dial-up server, regardless of the authentication modein use.”while the technical tips i saw saying you can only use network id   

Hello,We're currently migrating users from EMS to FortiSASE and have run into an issue with pre-logon VPN connectivity.The customer requires a pre-logon tunnel using machine certificate authentication (PKI), allowing the endpoint to connect before the user signs in.What we observe:The endpoint initiates the pre-logon connection. FortiSASE indicates that the connection is successfully established. Shortly afterwards, the session is terminated. The FortiClient on the endpoint never shows the pre-logon tunnel as connected.We have tested multiple certificate configurations, including certificate chains with and without an intermediate CA, but the results are identical.A Fortinet PS engineer is involved and a support case has already been opened, but so far we have not found the root cause.Has anyone experienced this before or successfully deployed pre-logon PKI-based tunnels with FortiSASE?

Fortigate firewall didn’t connect by remote users when using remote ipsec vpn 7.6.6 OS. But client getting all other services after created policy remote user interface to wan. Please help me if any other solution for it. I follow the below link remote access vpn for AD users through LDAP server  

Hi everyone,we using a Fortigate G900 with v7.6.7 as explicit proxy.Since a couple of weeks, we have the problem that, when using Firefox, we can’t use the Google Search.After we type anything in the search bar, we get the following error:502 unknown content-encodingThe webserver reported that an error occurred while trying to access the website. Please return to the previous page.URL     https://www.google.com/search?client=firefox-b-d&q=fortigate Other Websites / Search-Engines with Firefox are working fine. With Edge or Chrome Browser Google works as well.Have somebody an idea? Regards, Michel

I integrated my Cisco C1300 to NAC and all is working fine except for CoA. When i manually execute send CoA then in the switch i got message ‘13-Oct-2026 13:37:21 %RADIUS-I-CoAREJECT: CoA Request from 10.10.10.9 rejected. Reason: Missing NAS identification attribute’I try add NAS-Identifier in Radius Attribut with value %AUTH%, %ACCESS_VALUE”, %SYSTEM% and %ACCT% with no success. Anyone know why?Same radius attribute is working fine for Cisco Catalyst switch even in the radius attribute no NAS-Identifier. 

itle: FortiGate 100F – EMAC-VLAN across multiple VDOMs with a routed /28 subnet over /30Hello Fortinet Community, We are testing a FortiGate 100F running FortiOS 7.6.6 with two VDOMs (root and Production), using EMAC-VLAN interfaces. Our configuration: - Physical "wan1" interface belongs to the root VDOM.- "wan1" has an IP address in the ISP's "/30" transit network.- Two EMAC-VLAN interfaces ("outside_Root" and "outside_Prod") share "wan1" as their parent interface.- Each EMAC-VLAN belongs to a separate VDOM and has its own public IP address from the same "/28" subnet.- Both VDOMs have independent IPsec VPN tunnels. What works: We have successfully tested EMAC-VLAN when the upstream router or Layer 3 switch has an IP address in the same public subnet as the EMAC-VLAN interfaces. In this setup, the router can resolve each EMAC-VLAN interface's unique MAC address using ARP, and traffic reaches the correct VDOM. Our problem: Our ISP provides two separate IPv4 networks: - A "/30" transit n

Currently we have a Microsoft Server 2016 server as our radius server.We intent to upgrade to Server 2025.is there anything for us to take note when we upgrade to Server 2025 ?

Am final year in college I already have CCNA.My next goal is Security fundamental for Network Security, What about NSE4 and Sec+?, What i should focus on and worth for Entry level in Network security ? 

I’m on a FortiGate 61F version 7.4.11 and FortiClient Windows version 7.4.3.I am trying to set up IPSec VPN for my remote users so that I can upgrade the FortiGate (knowing that SSL is no longer supported).  I’m running into trouble with Authentication when it comes to PSK vs Peer ID from dialup group.  What I want is for the tunnel to accept users from a specific local user group on the FortiGate.  My problem is that if I change the Peer Options to Peer ID from dialup group, the Pre-shared Key box goes away.  That’s then a problem on FortiClient since I can't leave the PSK box blank.  Any help on how to solve this?  Thank you! Side Note: I have an IPSec VPN for remote users set up on a different box running 7.6.6 doing exactly what I want.  There are more options for Authentication on that version and I can have a PSK and the tell it to use user group I want.

Hello, the content on the fortigate management interface doesn't load because fortinet's cdn certificate seems to have expired.For example the browser doesn't load the content at https://fos-cdn.fortinet.com/artifacts/fos/7.2.10/b1706/3655.js, if I try to open the url directly in the browser I see  that the domain SSL expired one Oct 30thAnd the cert Is indeed expired

Where we can find supported device by FortiNAC?