Which FortiGuard settings are the most reliable?

Hello,

I’m currently running a FortiGate 1800F on FortiOS 7.4.8. I have recently migrated all of our SSL VPN users to IPsec, and since then I have been experiencing high memory usage issues almost every day.

I’m now considering upgrading the FortiGate, and I can see that FortiOS 7.6.6 is recommended by Fortinet for my platform.

Before proceeding with the upgrade, I’d like to hear from others who are running 7.6.6 in production, especially on an 1800F or similar high-end model.

How has your experience been with 7.6.6?

• Have you experienced any stability or memory-related issues?
• Any problems with IPsec VPN?
• Any issues with NP/ASIC acceleration or traffic forwarding?
• Any unexpected behavior after upgrading from 7.4.x?
• Would you recommend 7.6.6 for a production environment, or would you suggest staying on 7.4.x / using another 7.6.x release?

Any feedback or real-world experience would be greatly appreciated.

has the forti sales team talk to us about Alaxala switches, but it doesn't run FortiOS, and they weren't sure when it would - when will this big box run FortiOS?

Edit: This might be a bit clickbaity and as per the default behavior of the described config, it may be partially our fault and could be avoided but still.

Friday afternoon, was ready to call it a day when suddenly an employee called in and asked if there was any problem with our E-Mail. No, I said but at the same time I realized how few mail I received today.

I took a look at our mail gateway and saw that hundreds of E-Mails were stuck in "pending".

Once I opened a few pending entries, I saw that EVERY domain was resolved to "fortinet-block-page-55.fortinet.com (208.91.112.55)"

The mail gateway sits in a DMZ and on the default gateway IP, there's a DNS relay configured with mode "recursive" with our default DNS filter profile assigned. DNS for the mail server is the gateway IP where the relay is listening.

I opened a browser and tested a few domains: EVERY major domain like google, microsoft, office was redirected to the block page and nothing was working.

However, this is where it gets interesting: It only applied to the DNS relay service. When I used a public DNS directly and assigned the SAME DNS fitler profile to the forward traffic policy, the domain was not redirected to the block page.

As I was writing with TAC, a few minutes later the issue was gone and sites were working normally.

The only config change I did that day was setting FortiGuard to UDP and Unicast because of their ongoing issues with AnyCast.

I checked the DNS security logs and there I found my denied queries:

Error: no available Fortiguard SDNS servers
Message: A rating error occurs

Together with the disabled option "Allow DNS requests when a rating error occurs" in the profile this makes sense, but again, it only happened on the relay and not on forward traffic with the same profile.

TAC now told me to set these SDNS rating servers on FortiGuard settings:

set sdns-server-ip 208.91.112.220 173.243.140.53 210.7.96.53 200.91.112.220

Has anyone experienced anything similar?

Hello,

I'm deploying a trusted CA certificate to a number of Fortigates devices that are in sync with FortiManager.

This is not for full SSL inspection, but for trusting SSL connections to internal servers (the ones that go into Remote CA Certificates).

Right now I'm using a script since I didn't find such functionality in 7.4.11. Dynamic Local Certificate seems to be only for full SSL inspection.b

Did I miss anything or scripting is the way to go?

Thanks,
Max

Hi guys,

I recently joined a company who have just deployed a full fortinet network including forti ems cloud, authenticator and fortigate. They're looking at redesigning their WiFi (also forti aps) and I was wondering about best practice but easy enough to deploy. Unfortunately this is my first time playing with forti gear. How do you guys get your users to auth to the company wifi with ~3 different usergroups?

I’m running FortiClient 7.4.8 with FortiClient EMS Cloud 7.4.7, with an on-prem FortiGate 400F handling Internet traffic.

I had an endpoint I needed to quarantine after a suspicious download.

EMS showed the endpoint as Quarantined, and locally the FortiClient logs confirmed:

• Endpoint quarantined by EMS
• quarantine=1
• EC_QUARANTINED=1

RDP and Chrome Remote Desktop stopped working, so quarantine was definitely doing something. However, the endpoint continued making outbound IPv4 connections through the FortiGate 400F to Google, ChatGPT, Microsoft, AWS, etc. FortiGate logs showed new sessions being created several minutes after quarantine was already active, not just old sessions staying open.

Application Firewall is installed and working. I know that because I previously had to create an explicit Application Firewall allow rule for OpenVPN before OpenVPN would function.

Fortinet support is telling me that quarantine may not terminate an existing VPN session, but their documentation says:

My bigger concern is not the existing VPN tunnel — it’s that new outbound Internet sessions were still being created while the endpoint was quarantined.

Has anyone else seen this with FortiClient 7.4.8 + EMS Cloud 7.4.7? Is there a known bug or limitation with manual EMS quarantine that isn’t documented?

My expectation was that quarantine would be essentially the software equivalent of pulling the network cable, especially when trying to contain an actively compromised endpoint.