Support Forum

Hi everyone,I noticed Multicast policy to control Multicast stream does not allow granular control for applications. For example, we want only UDP 1781 multicast stream should be allowed through FW. I do not see any command within Multicast Security policies, that will allow me to restrict flow based on UDP port numbers.  VERSION INFO:FortiGate-VM64 # get system status Version: FortiGate-VM64 v6.2.0,build0866,190328 (GA)Hostname: FortiGate-VM64 Operation Mode: NAT Current virtual domain: root Max number of virtual domains: 1 Virtual domains status: 1 in NAT mode, 0 in TP mode Virtual domain configuration: disable FIPS-CC mode: disable Current HA mode: standalone Branch point: 0866 Release Version Information: GA FortiOS x86-64: Yes System time: Sun Jan 26 04:23:32 2020 EXAMPLE:config firewall multicast-policy edit 1 set srcintf "EXT" set dstintf "INT" set srcaddr "A" set dstaddr "all" next end FortiGate-VM64 (1) # set protocol <integer> please input int

Good day,  I'm looking everywhere, but I dont find any answer.. Does the Fortigate 100D support IGMP Proxy ? I'm looking to configure my 100D for use with my IPTV provider, but I need to use IGMP Proxy for it to work. Thanks Frank

Hi, another question about Guest Management! When I create a Guest Pass with an email, if I send the email it uses that email address as the FROM and TO email.  This obviously won't work as we aren't going to be able to spoof guests email addresses. Is there somewhere to specify what FROM address to use for sending the guest credential email? thanks

Hello, i create a new poliy directly on fortigate CLI with: config firewall policyDescription: "My Policy"edit 0set name "MyPolicy"set action acceptset dstintf IFACE_01set dstaddr MyDstServerset srcintf IFACE_02set srcaddr MySrcServerset service HTTPset schedule alwaysset schedule-timeout disableset status enableset logtraffic allend The command does not return the newly created policyid, since i want to create some batch operation where i have to place the policy before a specific other policy, is there an easy way to return the created policyid, i only know the command get firewall policy  where i have to use the last ID.

Hi ,We have encountered an issue with FortiGate devices running version 7.4.7, which we recently upgraded to from 7.2.7. When establishing an OSPF session, the OSPF adjacency fails to come up if the required local-in policy is not present. However, even after creating the local-in policy, the adjacency does not establish until we run the command diagnose firewall iprope flush.  The OSPF process and interface configuration appear correct.OSPF Hello packets are being sent, but no neighbors are learned.From the debug flow logs, I can see multiple OSPF Hello packets being dropped with the message:iprope_in_check() check failed on policy 6, dropChecked known issues for 7.4.7 and can't find any related on this issue.https://docs.fortinet.com/document/fortigate/7.4.7/fortios-release-notes/236526%E0%A4%95%E0%A5%8B For your advise. TIA :) 

Hi Community,I am managing a FortiGate 100E via FortiGate Cloud (Management Tunnel). The device is behind a NAT network.I need to change the Interface Role from "Undefined" to "WAN". However, the Cloud GUI does not allow editing this field.When I tried using the CLI Console on FortiGate Cloud to run the command config system interface, I immediately received the error: "Unknown action 0"Has anyone encountered this issue? Is there any workaround to change the Interface Role remotely without using the CLI Console?Thank you.

Hello team!!! I need create a tutorial for limited users with no Fortigate knoledge to modifý easily the IP address in many VIPs.  This is for manually redirect traffic to another computer (Different IP)If I guide the users to modify manually all VIPs in "Policy & Objects -> Virtual IPs", there are to much posibilities to the user to make a mistake, so I need for example, to create an script to modify the VIPs and guide to the users to execute this script.These is a Fortigate 100F, which I think that have not hard driveActually could be better to create something to be executed from the gui Automation stitch seems not be working to change the Fortigate settings.I have not knoledge about APIs and I have not enough time to learn. Any idea will be apreciated!!Thanks in advance.Regards,Damián

Hi everyone, did anybody here migrate their F5 load balancer layer to FortiADC?If so, can you do everything you were doing with the LTM module? Or did you find anything that can't be replicated?Thanks in advance.

Hello,I’m experiencing an issue with serial console access on FortiGate 80F appliances, where the console displays continuous garbled and unreadable characters.This issue has occurred on more than one FortiGate 80F. EnvironmentModel: FortiGate 80FFortiOS version: 7.4.8Access method: Serial console (RJ45)Terminal software: PuTTY (Windows)Serial settings testedAll combinations below were tested, including during cold boot:9600, 57600 and 115200 baudData bits: 8Parity: NoneStop bits: 1Flow control: None In all cases, the console outputs unreadable characters continuously. Troubleshooting already performed:Tested multiple baud ratesTested different serial cablesTested different USB-to-Serial adaptersTested on different computersIssue reproduced on multiple FortiGate 80F unitsTested console access during boot sequence  

Hello everybody. New to Fortigate NGFW solutions and need some help. I'm running Fortigate 120G HA Active-Passive cluster as a hub and a 70G HA Active-Passive cluster as a spoke. There are two WAN links connecting hub and spoke which are in the SDWAN Global zone + two IPSec tunnels over these underlays which are in the SDWAN Local zone. BGP on loopbacks is the routing protocol I'm using. Point is, I expect RDP between hub and spoke to failover seamlessly when the primary link fails, but each time I try I see session drop, as if conn-reset was sent, although we have quite moderate reconnect timings. As far as I read from fortinet community, when there's a link fail, existing sessions first are being flagged as dirty, then re-evaluated and then considered may-dirty again, no asymmetric traffic issue. How to even approach this problem and where to start debugging? Any suggestions?

I'm trying to find a DLP solution that stores tags within the metadata of individual files, rather than in a separate database. I haven't been able to find an answer for FortiDLP, so I wanted to check here to see if anyone knew the answer.

I can connect without any problem to our FortiGate FG‑60F using FortiClient 7.2.0864 on an Intel / Windows 11 device.However, this older version is not supported on ARM / Windows 11, so I upgraded to FortiClient 7.4.3 hotfix 1.8758 (ARM64) on a Surface Pro with Windows 11 ARM.The installation succeeds, but when starting the IPsec VPN I immediately get:“FortiClient – IPsec connection is down”I also noticed that the FortiClient VPN Service / SSLVPNDaemon services are missing on the ARM device, which suggests that the VPN engine is not being installed correctly.It seems other ARM users resolved this by installing the MSI version of FortiClient (instead of the EXE), but the MSI installer is not available for download in the normal Product Downloads section.Where can I obtain the MSI installer for FortiClient 7.4.x ARM64?Do I need to request it through Fortinet Support, or is it available somewhere in the download portal?Thanks for any guidance.

Please recommend troubleshooting for this problem

Hi all, I've got the opportunity to purchase a new sealed Fortinet FG-3700D from a liquidation sale and wanted to get an idea on its value, looking on eBay some are listed for $8k and others sold for $50-900 so is it purely a licence thing?Roughly what would you pay for one of these?Sorry for this being a first post. Any pointers appreciated, thanks.

Dear All, SSL VPN users are facing issue while receiving token If email based token is configured for SSL vpn users. Please correct me if I am not correct - I have configured SSL VPN users (Users name is Test) and test user is part of multiple group under local user - Group name  Name - TestType - LOCALtwo-factor - abc@gmail.com (email based authentication for SSL VPN test)Group - XYZ, vendorstatus - enabled My question is If user is part of two group it means token will be received two times for test user on his email email id - abc@gmail.com  Thank you for immediate response.     

Hi, I'm trying to setup the FTM with FortiToken Cloud. User login in FortiClient IPsec VPNFortiGate sends push request to my phoneTapping Allow Getting notification on my phone “request sent”And nothing happen fortigate debug:diagnose debug resetdiagnose debug console timestamp enablediagnose debug application forticldd -1diagnose debug enable2026-02-05 20:51:20 [263] fds_resolv_addr: resolve 'eufctupdate.fortinet.net' 2026-02-05 20:51:20 [189] fds_get_addr: name=eufctupdate.fortinet.net, id=10208, cb=0x5555ff9c60 2026-02-05 20:51:20 [185] fds_svr_default_timeout: try to get IPs for Forticlient-svr 2026-02-05 20:51:20 [52] dns_parse_resp: DNS resp-id=10208 2026-02-05 20:51:20 [74] dns_parse_resp: eufctupdate.fortinet.net: rcode=3 2026-02-05 20:51:20 [52] dns_parse_resp: DNS resp-id=10208 2026-02-05 20:51:20 [74] dns_parse_resp: eufctupdate.fortinet.net: rcode=3 2026-02-05 20:51:21 [4089] fds_handle_request: Received cmd 117 from pid-1328, len 4

Hello, community members. I'm currently testing a migration from SSL VPN to IPsec on FortiGate v7.4.9.Client: FortiClientFortiClient 7.0.9: IPsec connects successfully (no issues)FortiClient 7.4.3: IPsec fails - appears to connect for a moment but then immediately disconnectsThe FortiGate CLI (diagnose debug application ike -1) reveals the following:IKEv2 authentication succeededPhase 1 (IKE_SA) is establishedThe client appears to receive an IP address (mode-cfg), but the tunnel immediately goes downSSL VPN from the same client to the same FortiGate works fine. Has anyone experienced this issue with FortiClient 7.4.3 and FortiGate 7.4.9?Are there any known interoperability changes (EAP settings, Phase 2 proposal/TS selector behavior, DPD/NAT-T, IPsec-over-TCP specifics, etc.) that could cause Phase 1 to be fine, but Phase 2 to immediately drop? If you have any suggestions or ideas, please let me know. Thanks!

I am facing an issue while trying to bring Two FortiSwitch-108F switches under FortiLink managed mode with a FortiGate-40F.The switches are discovered and authorized, but they never come OnlineEnvironment DetailsFirewall: FortiGate-40FFortiOS: 7.4.9 (GA)Switch Model: FortiSwitch-108F (2 units)FortiSwitchOS: 7.4.5Management Method: FortiLink (single FortiLink interface)Topology:FortiGate Port A → FSW1FSW1 port 8 → port 8 FSW2 (ISL)

Hi everyone, We’re running into consistent performance and internet connectivity issues when using a Fortigate 40F firewall behind a Draytek Vigor 3912 router. The WAN connection (with a dedicated public IP address) is managed and delivered by a third-party IT provider. So far, they’ve only been able to make the setup functional by using a double NAT configuration.Unfortunately, we don’t have administrative access to their VPN router, meaning all network and routing configurations can only be modified on our Fortigate side. This limits our ability to optimize or troubleshoot the setup beyond our local network. Has anyone experienced similar performance degradation or connectivity problems in a comparable setup (Fortigate behind Draytek / double NAT scenario)?Any advice on best practices or alternative configurations that could help improve throughput, latency, or overall stability would be greatly appreciated. Setup overv

Dear All, Recently I have upgraded my FW from 7.2.12 to 7.4.11 and since then my AWS site to site VPN is not working even though tunnel is showing up but not able to send/receive the traffic. I have even disabled the NAT but not working and as soon as i downgrade to 7.2.12 it starts working. Please suggest what should I do here. FW - 80e 

I am trying to set up a IPSEC Dialup ikeV2 VPN using OKTA SSO and get the okta prompt and goes through but the okta prompt comes back up and VPN isn't connecting.  Okta is showing the login successful.  I followed the article in the forums and am having no luck.  

Okay here's the deal, I was trying some new items and ran into an issue that led to more ideas. Does FortiOS/provider have a default timeout? So if I'm applying code and Terraform can't reach the host, can we define the timeout in the provider.tf? AI search says yes, but anytime I do a validate, it complains about that not being supported. here's what I'm running kfelix@proto fortios % cat .terraform.lock.hcl | grep -i ersion  version = "1.24.1" I even tried to defined the time-out under the resource, and validate still complains   

I am running a SDWAN infrastructure with one Hub and several spoke (15 spokes). All sites are equipped with FGT  clusters running 7.2.x. we have ADVPN configured with iBGP running over it for route advertisement .On 4-5 spoke sites  I have a strange behavior that is every 2-3 days   have this error in router events logs as below: BGP: %BGP-5-ADJCHANGE: VRF 0 neighbor 192.168.88.254 Down Hold Timer ExpiredBGP: %BGP-3-NOTIFICATION: sending to 192.168.88.254 4/0 (Hold Timer Expired/Unspecified Error Subcode) 0 data-bytes []BGP: %BGP-5-ADJCHANGE: VRF 0 neighbor 192.168.88.254 Down BGP Notification FSM-ERRBGP: %BGP-5-ADJCHANGE: VRF 0 neighbor192.168.88.254 Up The problem is that during this event all connections from spoke to hub are shut during roughly 60 or 120 sec

Good morning friends, how are you?One question, what is the difference between these inspection modes: flow based and proxy based, when creating a policy?

due to the VPN traffic possibly coming in or going out via one of three interfaces (due to BGP) i felt i should configure the VPN on another interface of the FortiGate. only the VPN process doesn't want to start the VPN now, the debug logs shows: 2021-06-19 14:41:49.269526 ike 0:p1-01:91: could not send IKE Packet(SA_INIT):x.x.x.x:500->y.y.y.y:500, len=248: error 101:Network is unreachable it set ups the VPN tunnel fine for incoming VPN requests, but it refuses to initiate a VPN itself. tried on both 6.0 and 6.4. i can sort of understand it, but it feels not needed, if i do ping-options for the same source IP x.x.x.x i can ping y.y.y.y fine. i can workaround it with a loopback interface, but that means no IPsec traffic offloading. another option is a second VDOM with the network used in the routing direction but that feels adding quite some config. anyone encountered this and has an another solution to make it work in both directions?