Support Forum

FortiGate appears offline in Forti Manager. Both Internet connections are online, but if I disconnect and reconnect the LAN cable between the FortiGate and Forti Switch, it shows as online in Forti Manager. However, after a few hours, it goes offline again.

Hello! I just got this firewall used.I am wondering if it is possible to get the WAN1 port to give internet to the internal LAN ports.Is this possible? I haven’t been able to get it after hours of trying. Thanks!

Hello, I had Virtual Fortigate in Azure VM02, Version was 7.2.5Then I did upgrade up to 7.4.0 and now see this message: And I can't disable. Even if I'm trying to click "Begin" I can't do any migration, but If I click "Later" Fortigate is working as normal.  Very annoying message, how I can disable it?

Hallo, last week I updated the Fortigate to the new firmware. We use Fortinet and 2FA with Tokens. After the update no VPN-Token worked anymore. Noone could start a VPN anymore. I had to create new Tokens for everyone. Then it came into my mind, what if the Tokens for the Admin-Logons would not work anymore either. Would we be screwed or is there a possibility to logon without 2FA?

We have recently been provided with the free version of FortiClient 7.4.4.  After installing the software and importing our VPN config, we noticed that the VPN list was still empty.   We have uninstalled 7.4.4, manually removed any FortiClient folders and registry entries left behind. After a restart and reinstalling the software, the same issue occurs, and it's the same if we manually create a VPN.   Registry locations show that the VPN config has been successfully imported, and when we export the config from 7.4.4, it shows the same VPNs.  Right-clicking on the software in the system tray also does not show any VPNs to connect to. Is this a bug? Screenshot after the config import or a new VPN is manually created.

I've installed forticlient VPN client and opened the app and got white blank screen FortiClient 7.4.0macOS Sonoma 14.5

Hello! I wanted to ask for people who are using fortinac for authentication with radius and mac traps alongside persistent agent. How long does it take for a user to go from isolation vlan to production?

For C9300-48T-E with NM-8X connected to the Fortinet 401FSFP-10G-SR-S is compatible on both the sides?Both firewall and switch side....

Hello, I have a Zabbix Monitoring Server, and various Fortinet Products. All I can find is a FortiGate template. I can't find templates for the below: FortAuthenticationFortiMailFortiManagerFortiAnlyzerFortiWeb Does anyone have the relative templates or have successfully monitored the devices using Zabbix?

Hi All We have successfully integrated with RADIUS, and all user authentications are working fine. However, we need to import user groups from Active Directory into FortiSASE users and groups.The RADIUS Group ID value is required for this. Could you please let us know where we can find this value?   Thankz 

Hello,We are using FortiGate 60F with SSL-VPN (tunnel mode), running FortiOS 6.4.14 build 2093 (GA).VPN connects and assigns IP, but users cannot communicate with LAN devices.What GUI settings should be checked to allow VPN users to access LAN?Thanks.

Hi to all, I am quite confused because I have asked the support  department to help me to protect our VoIP system at home. The first agent told me that the FortiGate can not protect against SPAM calls and that the best approach is "to disable SIP ALG on the FortiGate, as it may interfere with VoIP signaling and is not required in most modern deployments".  Then, the ticket went to another agent (I do not know why) and this one told me the following:  "Please note that, to protect your VoIP services, the best approach is to use the Fortigate SIP ALG inspection feature". in addition: "With the above configuration, you will not have ghost calls nor unwanted call forwarding nor spam calls". So, one says Yes SPAM and No SIP ALG and the other one, the opposite: No SPAM and Yes SIP ALG. The second agent asked me to run the following: 1. Delete the SIP Session-Helper: config system session-helper delete 13 end  2. Set the ‘defaul

Hi everyone,I am finalizing a network deployment and looking for validation on my topology design to ensure I amfollowing Fortinet Best Practices for High Availability. My Environment:Management: FortiGate (FortiLink mode).Core Layer: 2x FortiSwitch 1024E configured as MCLAG Peers (ICL link is up and healthy).Access Layer: 2x FortiSwitch 100 series (Standalone access switches).Current Physical Topology: I have connected two separate access switches to the Core pair in a "triangle"(dual-homed) topology. Here is the exact cabling map: Access Switch 1:Port 23 -> connects to Core Switch A (1024E) Port 10Port 24 -> connects to Core Switch B (1024E) Port 10Access Switch 2:Port 23 -> connects to Core Switch A (1024E) Port 11Port 24 -> connects to Core Switch B (1024E) Port 11(Note: The 100-series switches are not stacked/ringed together).The Goal & The Question: My primary objective is redundancy: if one of the Core switches (1024E) fails, the Access switches must ma

Hello fellows, I just want to get your feedback on an ongoing issue I've had for years.I often log in to FortiCloud, use 2FA, and work on multiple support cases, download firmware images etc.While I have several browser tabs open in FCloud, I often get silently kicked out for being "idle".I am not! For the life of me I cannot find any idle timer setting. Getting kicked out several times a day not only costs time but nerves. Q to my fellow mates (power users for sure): do you experience this as well? Is it an issue during your day-to-day work?and a question to our FTNT team: is there any way to make the idle period longer, or better still, make the software aware that one is working while being logged in, just not in all open browser windows at the same rate? Best regards

Logs from FortiGate firewall is not getting forwarded to syslog server and when checking the route, it is going to wrong firewall port no. After clearing the session for the syslog server as destination, the issue gets resolved. This is an intermittent issue but need a clear suggestion for this behavior.

I know it's the neglected middle child of the Forti stack, but I'm getting ready to bump our FortiAuthenticator VM from 6.4 to 6.5. Reason being: We've stopped domain joining Macs and started using Entra Platform SSO and my internet lurnings have led me to believe 6.5's "Use for FSSO" checkbox on a remote oauth server is the secret sauce that makes it work.Question: Has anyone done this? I'm fine jumping higher than 6.5 if needed I'm just very conservative when it comes to FAC because we're SSOMA everywhere and it's literally the only thing that can actually break our network.

My phone keeps telling me the server for google.calendar.com is not trusted. The certificate is apparently valid through 2056. What is going on and how do I prevent this message from recurring endlessly on my iPhone? 

We have recently upgarde the fortiswitch and fortiswitches are managed by fortigate, after upgrading fortiswitch and it got rebooted, we have observed that HA got out-of syn for sometime. is this a normal behaviour ?? FortiGate FortiSwitch  

After upgrading my OS from version 7.2.11 to 7.4.11M. All users are facing a NET error page when accessing some sites. Especially with Microsoft Edge browsers. Support has recommended I download the Fortinet CA Cert and import into my trusted root certificates. But in an enterprise environment how do I get it onto the PC for all users. Attached is a screenshot of error.   

Hi,can some one check if have this same problem like me, with fortiguard servicesi check in 2 different network and FG 6.4 find only one fortiguard server and there is large ping about 700~900 msdiagnose debug ratingLocale : englishService : Web-filterStatus : EnableLicense : ContractService : AntispamStatus : EnableLicense : ContractService : Virus Outbreak PreventionStatus : DisableNum. of servers : 2Protocol : httpsPort : 443Anycast : EnableDefault servers : Included-=- Server List (Fri Jul 9 10:48:18 2021) -=-IP Weight RTT Flags TZ Packets Curr Lost Total Lost Updated Time173.243.140.16 0 352 DI 0 2323637 0 4497 Fri Jul 9 10:46:44 20212620:101:9000:140:173:243:140:16 0 0 D F 0 4443 4443 4443 Bleblas

Been witnessing an issue where spoke to internet traffic via hub would see excessive latency via Tunnel 1 (WAN 1) despite the rule failing over to Tunnel 2 (WAN 2) based on SLA metrics.Traffic between spoke and internal subnets behind the hub is fine as those do switch to Tunnel 2.Traffic from spoke to local WAN 1 internet break out is also fine.Anyone familiar with this issue?

I just purchase a FortiAthenticator cloud and i want to integrate it with FortiGate using Radius for VPN users authentication. I have the AD on Azure. How do I integrate for a seamless authentication process

Hello all, in the context of migration from SSL-VPN I am facing the following problem.Many of our client deployments include a mix of SAML users (dial up for company users) and locally defined users (contractors for instance)In SSL-VPN it was as simple as enabling or disabling the SSO checkbox in Forticlient. If SSO was enabled, the connection flow would go through SAML authentication, and if disabled it would connect directly using local users.I tried this with IPSEC dial up configuration, and unchecking SSO in Forticlient has no effect, it will always ask for SAML authentication.Anyone tried this and got success? Any workaround?

hi, this is not quite a Fortinet problem since we have lots of users without problems but we get more and more problems with some PCs with Win11 and 25H2. Versions of 23H2 we dont even bother anymore.  So now we have another laptop which cant connect via SSL o IPSec with Forticlient. The same laptop as all remote users and we have it in out office to check out and besides of checking all we could find in community sides, there is no way that the SSL Network adapter becomes active. The user connects with his user credentials, he even puts his token and than it get stuck by 98%. On the firewall I see SSL VPN User error but since we are doing the testing we know 100% that user credentials and token is correct. With the IPsec is the same and I have the same problem on my new laptop with the Forticlient ARM version. Not a chance that IPsec starts rolling. Any new ideas or similar cases that got solved by a miracle? Thank you so much!!!  

’m planning to transfer a device to another FortiCloud account and would like to clarify the impact.What happens to the device licenses (FortiCare / FortiGuard) after the transfer?Do they move with the device, or stay with the original FortiCloud account?What happens to the device configuration?Will the existing configuration remain intact after the transfer, or is a reset required?Any guidance or best practices would be greatly appreciated.Thank you!