Support Forum

I have a setting with a (cluster of) 1801F, all internal networks are vlan interfaces is on a 2x10G LACP. I have network A which does mostly webRTC to network B. When there is an important traffic between some other vlans (let's say C and D, but not always the same), latency between A and B grows, such that clients see the latency. What should I look for in the configuration ?. The policy for traffic from A to B has full logging, may it cause some latency ? Fortigate 7.0.17

Received complaints from one of our customers because they were unable to reach a service managed by a third party behind their separate FortiGate cluster. (Redirected via static route on lan).Turns out, after upgrading to 7.4.10 you now need to add lan-lan-policies, which wasn't the case before.Changing this sort of default behavior in existing configurations should at least be done with some sort of notification on the GUI.

Dear colleagues, I need help with URL rewriting (fw 8.0.3 if it's important). We have a "bad-coded" local site (let it be site.domain.local. suffix is .local, it's important). A lot of pages of this site contain hardcoded absolute URLs for file download (e.g. https://site.domain.local/storage/filename).Also site has a builtin user authentication form. When user opens https://site.domain.local/ page the site engine checks that user isn's authenticated, calculates special hash and send 302 redirect message with Location: https://site.domain.local/loginform?hash=XXXX header. Now we need to publish this site to internet via Fortiweb. We use public name site.company.com for publishing.  I created HTTP content routing policy for site.company.com -> site.domain.local. I also created web protection profile with URL rewriting policy. Policy contains 3 rules:1. Rewrite request Host header site.domain.com -> site.domain.local (action Stop)2. Rewrite respon

Hello everyone, This might be a basic question, but what is the purpose on integrating FortiNAC with an LDAP server BR,

Received a notice that 7.4.10 firmware is ready for installation. Release notes for 7.4.10 indicate ssl-vpn is being dropped from entry level 50,70,90 series, but does not mention 60 What about 60 series? 7.6+ firmware for 60 series also drops ssl-vpn So what's going on? Is ssl-vpn going to be dropped from other models also? We were considering upgrading, but need ssl-vpn with saml authentication.  

Good day! For monitoring purposes, we set up a custom integration with the Fortigate Cloud API. A couple of months ago, our custom integrations stopped working. Authentication still succeeds so it's not a credential/auth issue. We noticed that the following endpoint does not return any data anymore: https://euapi.fortigate.forticloud.com/forticloudapi/v1/devices  Instead we are hit with the following error:{"error":"invalid_client","error_description":"Authentication failed","error_code":-1} This error indicated invalid_client (we used fortigatecloud as per the docs). Even stranger is the fact that we can query the API enpoints for individual devices by specifying the gate's SN. https://euapi.fortigate.forticloud.com/forticloudapi/v1/devices/FGT40FXXXXXX This proves that my access_token is valid and can authenticate against the API endpoints (again: with client_id: fortigatecloud). The fact we get a valid response also confirms to me that it's not a n

We have a FortiGate 40F with two WAN lines.I know there are knowledge base articles on how to configure fail over without load balancing.However how do I check how it is configured at this time?What I want is fail over without load balancing.

Hi, Was hoping someone may have seen this or knows what is happening, I will do my best to explain: I am in the process of converting legacy firewalls to a VDOM 400F, all has gone successful  except for one conversion from a palo to an Internal VDOM. I used Forti convertor for all the conversions of objects policies etc and put the VDOM into Central NAT to make it easier, (I did some ASA conversions and it converted better this way) My last conversion Palo  > FGT, all worked except, 1 very important traffic flow, so had to "backout" and reintroduce the Palo, so I cant even do live troubleshooting untill I attempt it again. Traffic flow is: Azure Cloud Exchange (51.x.x.x) > External VDOM Firewall destination Public Firewall address (60.60.60.1 as an example) DNAT on External firewall changes 60.60.60.1 to 192.168.1.1 which is located off the INTERNAL VDOM, This all works fine, and at the moment the traffic passed to the PALO and goes on its merry way.

Hello Fortinet Community,I am working on a lab / design scenario and would like to ask for guidance on whether this setup is technically supported or if there is a recommended workaround.A FortiGate External is deployed at the edge (Internet-facing)A FortiGate Internal is deployed behind itThe Internal FortiGate is intended to terminate IPsec Remote Access VPN (FortiClient)The External FortiGate acts only as a border firewall (NAT / routing)So i wanna ask you whether my topology working normally, if yes, can you guide me how to deploy, thanks very much

I have prefix list to filter which prefix will be send to azure.Previously ID no 4 is not exist and i can see in the advertise route only showig 10.103.0.0/16 and 172.30.30.0/24 FW01 (Internet) # get router info bgp neighbors 10.201.0.4 advertised-routesVRF 0 BGP table version is 43362, local router ID is 10.103.103.103Status codes: s suppressed, d damped, h history, * valid, > best, i - internalOrigin codes: i - IGP, e - EGP, ? - incompleteNetwork Next Hop Metric LocPrf Weight RouteTag Path*> 10.103.0.0/16 10.210.0.103 100 32768 0 i <-/->*> 172.30.30.0/24 10.210.0.103 100 32768 0 i <-/->Total number of prefixes 2 But when i add ID number 4 above why the fgt still advertise 2 prefix and not advertise 10.105.0.0/16?

Hello Fortimail admins,  I created a user alias that forwards to multiple people including me.When I send/reply with that alias in CC, I also receive the email.Is there a way to prevent that? Kind regards,

Hi everyone, I'm having a problem with one of my 431F APs.We have a 600F firewall on 7.2.12 and a 431F AP on 7.2.6. At one site, the AP randomly stops sending out SSIDs, so clients can't connect. The strange thing is that the firewall can still ping the AP's IP without any issues.

I have a second-hand FortiGate-110C, but it seems that the firmware is damaged and it can't start normally. Since it's a second-hand device, I can't download the firmware from the Internet now. Could anyone provide me with the firmware? Thank you very much. Email: 404000768。@。163.。com#FortiGate-110C

I have started to set up FortiAP 23JF devices on our network using Fortigate 3200D as the Controller. They are working fine but what I am trying to do is make the POE port LAN3 on the FortiAP to only accept the Avaya Phones on that port so Guests cant unplug the phone and plug their laptop in and get on the Voice network. I have created a Firewall Object Address called "Avaya" with a list of all the MAC addresses of the Phones in each room. Then under SSID's created a SSID called "AvayaVOIP" with the Address Group Policy set to "allow" and chosen the object created above. Then I created a FortiAP Profile called "AvayaFAP23JF" and assigned it to one of the FortiAP's which all worked fine but when testing and plugging in my laptop to Port3 I still get assigned an IP on that port. The Cisco AP's that I am replacing with the FortiAP's were VLAN aware so I could untag the Guest VLAN (2201) and Tag the VOIP network (2065) so if a client unplugged the phone and plugged in they would be put on

  It's really exhausting dealing with Fortinet on GNS3. I've watched 80,000 YouTube videos, but none of them work; it always asks me for a license. In FortiCloud, in my Asset Management section: Registration Code. Enter your product serial number, service agreement registration code, license certificate number, or asset transfer token to start registration: Where can I get the serial number?

FortiAuthenticator is showing a lots of Fortitokens with pending status. Some users with tokens with this status are reporting problems to authenticate by VPN and some others users with tokens with this status are reporting that it is working well. The same actual today's configuration worked in the past and we don't have new configuration and with no changes in the IT infrastructure. See pictures bellow for a better analisys.Does anyone here have any experience solving a similar problem? 

Hello everyone,I am downloading logs from my FortiAuthenticator device that has version 6.6.2, however when downloading the logs from the download options, it downloads them with a .dbg extension. How can I download the logs in CSV or in readable text to be able to review the user authentication logs?

We are setting up two factor authentication using FortiAuthenticator and enable Push Notification. We need to be able to do this on the internal network, guest network and public WAN. Is the best way to do this is to use a FQDN in the public IP/FQDN setting and use DNS routing for each of those to get it to work? Using a public IP address only works on the Public WAN.

Im trying to find a FAC API endpoint to query what users are in a specific LDAP Group. This is as close as I could get. Unfortunately this only returns groups that are local groups, not LDAP groups. Anyone else figured out how to do this or if its possible with the current API?https://docs.fortinet.com/document/fortiauthenticator/6.6.2/rest-api-solution-guide/583007/local-user-group-memberships-localgroup-memberships

Hi, I am facing a issue when trying to setup a radius policy on Fortiauthenticator cloud for use with our fortigate ssl vpn, where it is not allowing me to set a realm with a saml assignment. The realm is created but is blank and no option to set in the radius policies.  We are importing our users in via Entra.   Thanks 

So I have been struggling for a bit to figure out why my SSL VPN configuration with Azure SAML doesn't work with FortiClient 7.4.2.  Older FortiClient version seem to not have this issue.  The most telling thing I see in the server debug log is: [394:root:5b4b]SSL state:fatal decode error (x)SSL state:fatal decode error (x) then: [394:root:5b4c]saml login [394:23372] SAML_ERROR: Error occurred during remote login 'could not found corresponding saml session (101)' If I use the option in FortiClient "Use external browser as user-agent for saml user authentication", I get no such error and everything works just fine. Any guesses as to what might be causing this issue?  When I searched on this issue, I only found similar issues  but where the opposite was true - using external browser for saml user authentication did not work as expected. I am a little reluctant to upgrade the users to such an unstable situation.

I need help from the #Fortinet community. Our legitimate healthcare business has been incorrectly flagged by #FortiGuard for over 4 weeks, and standard appeals have been completely ignored.The Facts: • Domain: menswellnesscenters.com • Business: Licensed medical clinics in Virginia • VirusTotal: 91 out of 92 vendors say CLEAN • Only Fortinet flags as malwareThe Impact: • Millions of Comcast/Xfinity customers blocked via Akamai ETP • Patients cannot access healthcare services • 4+ weeks of appeals with ZERO responseThe Evidence: We're a LegitScript-certified healthcare provider. Our site runs on WordPress/Hostinger with Cloudflare DNS. Multiple security scans show no malware. Every other major security vendor (ESET, BitDefender, Kaspersky, etc.) rates us as clean.Why This Matters: This isn't just affecting our business - it's blocking patient access to medical care. FortiGuard's reputation depends on accuracy, but we're seeing a clear false positive that's been unresolved for a month.Re

We did implement FortiClient EMS in our company and since we did not have a windows server license to spare we directly went for version 7.4 because it is running on linux. I did not find any informations on recommendations from FortiNet how to update the linux system.Does running "unattended-upgrades" in default configuration may break something?  

Hi,We introduced mandatory TLS (Security -> TLS -> TLS-Profile -> TLS-option = secure) a few months ago, which unfortunately has the disadvantage that connections are not only rejected when TLS is not an option on our connection partner but also get rejected if a TLS certificate on the receiving server has expired. Although encryption is still possible with an expired certificate, we then reject the SMTP connection. As far as I could find out, there is no possibility to configure a gradation in FortiMail. For example, if the server does not offer TLS, then reject the connection. But if it does offer TLS and only the certificate has expired, then connect.Does anyone have any ideas on how we could implement this? It's quite annoying to keep an exception list for all customers who don't pay attention to their certificates... Thank you!

We have a scenario in which we need an ssl vpn to our local network. The topology consists of two FortiGate FG-100F (HA) connected to two FortiSwitch FS-124F on port X1 and X2 of the Fortigates to SFP ports of the fortiSwitches. The fortiswitches are connected to each other on two MCLAG ports as well. We have a VLAN120 (10.60.100.0/24).The ports X1 and X2 are under a fortilink interface. All local VLANs have been created under the FortiLink interface. We also setup SSL VPN (IP range 10.60.101.0/24). We have Policy to allow incoming traffic from ssl.root interface to VLAN 120. The users can successfully connect to the SSL VPN using FortiClient, and they receive ip from 10.60.101.0/24 range, however they can not ping a resource under VLAN120. FortiClient also shows zero Receive but it has sent traffic. I can confirm that traffic hit the firewall policy.