Support Forum

Hi,For some reason, everyone using edge at my company is suddenly getting nonstop notification from FortiClient System Tray Controller saying: "Microsoft Edge" extension policy anomaly detected, please restart the browser.This happens anytime you try to open any websites and they just get stuck in loading until it fails. I restarted the browser and I even shut all Edge operations in task manager, nothing works. I cant seem to find any solutions online so was wondering if anyone was familiar with this issue and if they managed to resolve. Thanks!

I need to replace a firewall, and now have to decide between Fortigate 70F and 70G. The price for a HA cluster is pretty much the same. According to the datasheets, the 70G offers way better performance. However, I got an other G-Series firewall last year, and it was delivered with an old, vulnerable firmware. We had no chance to upgrade at first, and later couldn’t follow a supported upgrade path.But this was about 6 months ago, so I’m wondering if the G Series is ready for production now, or if we should still stick with the F-series.

Hello, I am trying to setup the LDAPS connection between the FortiMail and the AD for the admin accounts. I would like to use the LDAPS setup and the certificat is required.The only way to import the AD CS Root CA is in System -> Certificate -> Local Certificate but the password/key is mandatory. The AD Root CA has no private key exportable.Is there a different way to import the certificat in the FortiMail and setup the LDAPS profile ? Following this KB previously : https://community.fortinet.com/t5/FortiMail/Technical-Tip-How-to-create-LDAPS-with-exchange-server/ta-p/240992 Thanks

Hi there! I’m part of a student design research team from Simon Fraser University, working on building a design solution for the documentation experience, specifically with FortiOS/FortiGate. We’re currently conducting user research and looking for insights directly from people who actually use it!If you have a few minutes to spare, we’d really appreciate your thoughts through a short 6-8 minute anonymous survey. It focuses on topics like navigating documentation, handling version differences, and finding the relevant information you need. Your perspective would be super valuable to our research process. Thank you for your time, and no worries at all if you’re unable to participate! Feel free to ask any questions if you have any!Here is the link for our form: https://forms.gle/ieEcwqVFzu2i8yZQ8

How to configure Dynamic Wi-Fi VLAN Assignment with FortiAP & FortiAuthenticator In this video, I walk you through how to dynamically assign Wi-Fi users to VLANs using FortiAP and FortiAuthenticator. Instead of creating multiple SSIDs for different user groups, you’ll learn how to use identity-based policies to automatically place users into the right VLAN based on who they are.https://youtu.be/jKsDymddwlc

Hi. Is it possible to configure the system for FG-60E so that in transparent mode it can download signatures for security services. FG-60E would be between the optical modem (also in transparent mode) and another main firewall (NGFW). In this other NGFW there is the IP address of the WAN gateway to the Internet.

 I have followed this as much as possible,  I am using sAMAccountName on the config user ldap so it looks at every account, but NTLM doesnt work at all,  So I set up basic Auth to the same LDAP server, and that works fine, user has to log in with current credentials and they can hit the proxy policy and surf the web etc, can see them under "diagnose wad user list" as "basic auth" I need the behaviour to be transparent, so NTLM seems to be the answer (Not using FSSO yet!)but the login box appears, you type in creds, then it just appears again. config user ldapedit "ldap-server"set server "x.x.x.x"set cnid "sAMAccountName"set dn "dc=lab,dc=local"set type regularset username "myadadmin"set password ENC blah blah blahnext config authentication schemeedit "MYAD-LDAP"set method nlmset domain-controller "MYDC" (LDAP SERVER ABOVE) config authentication ruleedit "auth-web"set srcintf "proxy-int"set srcaddr "all"set active-auth-method "MYAD-LDAP" Any advic

I'm new to the Fortigate product. The FG80F's SSL VPN portal is unavailable at Firmware 7.6.5. How do I activate the GUI? I try different approaches, but they don't work.

Na madrugada de sábado (24/01), foi executada a atualização do firmware do Firewall Fortigate 100F da versão 7.4.9 para a 7.4.10.Após a conclusão do processo, identificou-se a interrupção de tráfego entre as demais Unidades e o Administrativo. O problema impactou diretamente o acesso aos sistemas internos hospedados na sede.Observação: Não foram identificados logs de bloqueio ou alterações de configuração que justificassem a queda de conectividade na nova versão 7.4.10, seguindo recomendação técnica, foi realizado o rollback para a versão 7.4.9. Após o reboot do dispositivo, a conectividade foi restabelecida e todos os sistemas voltaram à operação normal.

Can you give me step by step on how to do this?

Hello.When I try to add a rule to local-in-policy in the following environment, I get an error saying wan1 doesn't exist.What should I do? atgfw-01 # get system statusVersion: FortiGate-80F v7.4.9,build2829,250924 (GA.M)・・・・・・・・Omitted・・・・・・・Virtual domains status: 1 in NAT mode, 0 in TP modeVirtual domain configuration: disable・・・・・・・・Omitted・・・・・・・atgfw-01 #atgfw-01 # show system interfaceconfig system interfaceedit "wan1"set vdom "root"set ip xxx.xxx.xxx.xxx 255.255.255.252set type physicalset description "XXX"set alias "WAN-XXX"set snmp-index 1nextedit "wan2"set vdom "root"set ip yyy.yyy.yyy.yyy 255.255.255.252set type physicalset description "YYY"set alias "WAN-YYY"set snmp-index 2next・・・・・・・・Omitted・・・・・・・endatgfw-01 #atgfw-01 # config firewall local-in-policyatgfw-01 (local-in-policy) # edit 110new entry '110' addedatgfw-01 (110) # set intf "wan1"node_check_object fail! for name wan1value parse error before 'wan1'Command fail. Return code -651  

Hello everyone. Our company wants to provide an IP list through an internal webserver which we should import in our FortiManager to be used in Firewall Rules. (like http://10.10.10.10/list1.txt, .csv etc.)The use case is they want to manage a list which we will block on our internet facing firewall.Is there a way to do this? We have the 7.4.6 firmware installed currently.

After upgrade FOS v7.6.4 to v7.6.5, All VLANs were unable to reach VLAN1 by Core switch. It only reach 1 IP that assign to fortinet port and link to core switch. From VLAN1, we can access to another VLANs

Hi, We have recently taken delivery of a number of FortiSwitch-124G-FPOE, which is to provide the switching platform for new Wi-Fi points that we are deploying (231Gs).   We run on the majority of our Fortigates 7.4.8 Firmware as this is now the recommended version for our models (mix of 60 and 80Fs).   When I come to add the switch to the Gate via the GUI, either locally on the firewall or via FortiManager I am presented with an error to say its an invalid serial number.  I have tried several different serial numbers and they all provide the same error. Support are saying I need to have the gates on 7.6 firmware to support these switches which I cannot find any reference of and I am not keen to run that firmware branch as it also means we will have to migrate off SSL VPNs for some of the gates.   Has anyone else got these switches running on 7.4.x firmware and if so how did you do it ? Just connect the switch up and manually autho

Hi, I wanted to ask is there any configuration to setup for internal network and ports for accessing the cctv?Because I can view the cctv outside the local network (using mobile data or network outside the office) but I cannot view the cctv when im in the office using local network. Below is the VIPs I created, is there any other configurations need to be made? 

I have topology like below picture. Why azure see prefix 10.100.0.0/16 from AS65100-65103?In the hub i have prefix list only subnet 10.103.0.0/16 will be advertised to azure and in the spoke will advertise subnet 10.100.0.0/16 

Hi,I am trying to register for the FCP_FGT_AD-7.6 (FortiGate Administrator) exam via Pearson VUE in Japan.The exam language is fixed to Japanese, and I do not see an option to select English, while some other Fortinet exams appear in English by default.Could someone please confirm whether this exam is Japanese-only in Japan, or if there is any supported way to take it in English ? Thank you.    

Received complaints from one of our customers because they were unable to reach a service managed by a third party behind their separate FortiGate cluster. (Redirected via static route on lan).Turns out, after upgrading to 7.4.10 you now need to add lan-lan-policies, which wasn't the case before.Changing this sort of default behavior in existing configurations should at least be done with some sort of notification on the GUI.

FortiMail 3000FFirmware version: 7.4.2 I manage two FortiMail 3000F units.It has been just about a year since I purchased them.During that time, I have rebooted and turned off and then on FortiMail several times to work and check its operation.Normal startup time is about 5 minutes. However, four months ago, one of the two FortiMail systems was turned off and then on, and it took 30 minutes to boot up.We had our hardware vendor investigate but could not determine the cause.Today, we restarted a different FortiMail and it took 30 minutes to start up as in the previous incident. We are wondering if there is some structural defect in the hardware or software that is causing this, and would appreciate any information you may have on this.

Hello, we currently run FortiMail VM01 on‑prem and have purchased 110 FortiMail Cloud licenses.What’s the recommended way to transition—can existing settings, policies, and configurations be migrated to the cloud?Or does everything need to be rebuilt manually from scratch in FortiMail Cloud?Looking for best practices, steps, or guidance from anyone who has done this migration.

Hello.Within our proxmox environment we have several vlans.  The proxmox has several bonds with some of the interfaces configured as active/failover - such as the mgmt, and a separate bond for the vlan traffic. As it happens one of the vlans within the proxmox environment has the same vlan number as the switch.  By this I mean, the interface on bond0 is configured as the same vlan # that the servers have.  Obsivesily, the servers are 'tagged' within the proxmox environment to 'tag' traffic to/from other devices on that network.Here's a breakdown -Proxmox environment - native vlan is 10.  with an address of 10.0.1.xOn the switch network, which I'd like to configure the 'trunk', the default vlan is 10.The proxmox manages traffic in/out off of the 2nd bond or interfaces, but as the servers are also 'set' to use vlan 10, how will this work? It's almost like a 'nested' configuration with both interfaces using the same network - but not so as the proxmox handles

I think I have the answer, and it's yes - but wanted to confirm with everyone. new system running 7.4.8M 6484logged in and got a msg about upgrading to 7.4.9. since auto upgrade was turned off i have the option to upgrade.  trying thru clicking to upgrade doesn't work so the process should be manual, i presume.banner message says there's a (nother) issue with this firmware and i need to upgrade to 7.9M.  reviewing the document - Fortinet Document Library | Upgrade Path Toolit seems like there are 2 upgrades to get to this firmware, 7.4.8M2795 then 7.4.9M2829. Does this mean that i have to do 2 download/upload/reboots to 'jump' to the recommended level.  Again, i think the answer is yes - but wanted to confirm. 2 questions:1 - If this is the path and procedure for upgrades from 1 version to another, higher version? ie no 'jumping' to the latest version? trying to click on upgrade from my console didn't work as the gui seemed to indicate.2. since 7

Looking for some assistance on setting up GRE tunnels to Zscaler from our FortiGate 201F firmware version 7.4.9.  I found the following community post Configuring a failover scenario using a r... - Fortinet Community and used it as a guide but was advised I would need to use a policy route instead of static routes as I only want traffic coming in from a specific interface to go over this GRE tunnel, not all traffic on the FortiGate.  This is for some SSIDs available to teammates for personal WiFi.  Below is the config for the GRE tunnel and interface, policy route and firewall policy.  I do not see any logs on Zscaler to indicate any traffic is making it to that side.  I have tried modifying the policy route but any changes I make there cause no traffic to log on the FortiGate.  How it is set now at least shows DNS requests from devices in the FortiGate logs but nothing in Zscaler. GRE Tunnelconfig system gre-tunneledit "Zscaler"set interfac

Hi everyone, I’m trying to drop all CrowdStrike logs except those that contain the tag SensorGroupingTags/ABC.I’ve configured an event-dropping rule as shown in the screenshot, but I’m still receiving all CrowdStrike logs instead of only the ones with the specified tag.Has anyone encountered this issue or can point out what might be wrong with the rule logic? Regex: ^(?!.*SensorGroupingTags/ABC).*@Gabe_FTNT  @Secusaurus @AEH     

Hi everyone, I’m currently testing automation-based configuration backups to my SFTP server.This setup works correctly on FortiSwitch 7.4.8,but after upgrading to 7.6.6, the automation no longer completes successfully — with the same configuration and the same SFTP server.Below are the configuration and logs for reference. Config:config system automation-triggeredit "backup"set trigger-type scheduledset trigger-hour 10set trigger-minute 40nextend config system automation-actionedit "backup"set action-type cli-scriptset script "execute backup config sftp %%log.date%%_FSW-124F_Backup.conf [my sftp server ip] [account] [password]"set accprofile "super_admin"nextend config system automation-stitchedit "backup"set trigger "backup"set action "backup"nextend Logs: 7.4.8:FSW-124F # execute log display1: 2026-01-20 10:40:23 log_id=0103030515 tz=+0800 type=event subtype=system pri=notice vd=root user="unknown" ui=auto-script action=backup msg="User unknown backed up