DOCUMENT LIBRARY
DOCUMENT LIBRARY
Products
Best Practices
Hardware Guides
Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
Hybrid Mesh Firewall
FortiGate/ FortiOS
FortiGate-5000
/
6000
/
7000
NOC Management
FortiManager
/
FortiManager Cloud
Managed Fortigate Service
LAN
FortiSwitch
FortiAP / FortiWiFi
FortiEdge Cloud
FortiNAC-F
WAN
Secure SD-WAN
FortiExtender
More >>
Unified SASE
Single Vendor SASE
FortiSASE
Secure SD-WAN
Zero Trust Network Access (ZTNA)
FortiProxy
FortiMonitor
Cloud Network Security
FortiGate Public Cloud
FortiGate Private Cloud
FortiGate CNF
FortiFlex
Lacework FortiCNAPP
Secure Endpoint Connectivity
FortiClient
/
FortiClient Cloud
Web Application / API Protection
FortiWeb
FortiADC
FortiDAST
More >>
Security Operations
Security Operations Automation
FortiAnalyzer
/
FortiAnalyzer Cloud
FortiSIEM
/
FortiSIEM Cloud
FortiSOAR
SOC-as-a-Service (SOCaaS)
Identity
FortiAuthenticator
FortiTrust Identity
FortiPAM
Early Detection & Prevention
FortiSandbox
/
FortiSandbox Cloud
FortiNDR
FortiDeceptor
FortiRecon
More >>
Secure Networking
Hybrid Mesh Firewall
FortiGate/ FortiOS
FortiGate-5000
/
6000
/
7000
NOC Management
FortiManager
/
FortiManager Cloud
Managed Fortigate Service
FortiAIOps
LAN
FortiSwitch
FortiAP / FortiWiFi
FortiAP-U Series
FortiEdge Cloud
FortiNAC-F
WAN
Secure SD-WAN
FortiExtender
Communication & Surveillance
FortiVoice
/
FortiVoice Cloud
FortiFone
FortiCamera
FortiRecorder
FortiCentral
Unified SASE
Single Vendor SASE
FortiSASE
Secure SD-WAN
Zero Trust Network Access (ZTNA)
FortiProxy
FortiMonitor
Secure Endpoint Connectivity
FortiClient
/
FortiClient Cloud
Cloud Network Security
FortiGate Public Cloud
FortiGate Private Cloud
FortiGate CNF
FortiFlex
Cloud-Native Security
Lacework FortiCNAPP
FortiDevSec
Web Application / API Protection
FortiWeb
FortiADC
FortiDAST
Security Operations
Security Operations Automation
FortiAnalyzer
/
FortiAnalyzer Cloud
FortiSIEM
/
FortiSIEM Cloud
FortiSOAR
Endpoint
FortiClient
/
FortiClient Cloud
FortiEDR/XDR
Data Protection
FortiDLP
FortiDLP Agent
FortiDLP Policies
Identity
FortiAuthenticator
FortiTrust Identity
FortiToken
/
FortiToken Cloud
FortiPAM
Email
FortiMail
FortiPhish
Early Detection & Prevention
FortiSandbox
/
FortiSandbox Cloud
FortiNDR
FortiDeceptor
FortiRecon
Expert Services
SOC-as-a-Service (SOCaaS)
Edge Firewall
FortiGate/FortiOS
FortiGate-5000
/
6000
/
7000
FortiGate Public Cloud
FortiGate Private Cloud
Orchestration & management
FortiManager
/
FortiManager Cloud
FortiAnalyzer
/
FortiAnalyzer Cloud
Overlay-as-a-Service
SD Branch
FortiSwitch
FortiAP / FortiWiFi
FortiExtender
/
FortiExtender Cloud
Application Delivery
FortiADC
/
FortiGSLB
Single Vendor SASE
FortiSASE
Secure Endpoint Connectivity
FortiClient
/
FortiClient Cloud
Secure Private Access
Secure SD-WAN
Zero Trust Network Access (ZTNA)
Thin Edge
FortiGate/ FortiOS
FortiAP / FortiWiFi
FortiExtender
/
FortiExtender Cloud
Identity
FortiAuthenticator
FortiTrust Identity
FortiToken Cloud
FortiToken
Application Gateway
FortiGate/ FortiOS
FortiProxy
FortiADC
/
FortiGSLB
Enterprise Asset Management
FortiClient EMS
Endpoint Agent
FortiClient
/
FortiClient Cloud
Agentless Security Posture
FortiNAC-F
FortiSIEM
/
FortiSIEM Cloud
Identity
FortiAuthenticator
FortiTrust Identity
FortiToken Cloud
FortiToken
Wireless
FortiAP / FortiWiFi
FortiAP-U Series
FortiGate Cloud
Switching
FortiSwitch
FortiEdge Cloud
FortiNAC-F
Identity
FortiAuthenticator
FortiTrust Identity
FortiToken Cloud
FortiToken
Privilege Acccess Management
FortiPAM
Next Generation Firewall
FortiGate / FortiOS
FortiGate-5000
/
6000
/
7000
FortiGate Public Cloud
FortiGate Private Cloud
Orchestration & management
FortiManager
/
FortiManager Cloud
FortiAnalyzer
/
FortiAnalyzer Cloud
Expert Services
SOC-as-a-Service (SOCaaS)
Managed Fortigate Service
All
FortiADC Public Cloud
FortiAnalyzer Public Cloud
FortiAuthenticator Public Cloud
FortiDeceptor Public Cloud
FortiGate Public Cloud
FortiIsolator Public Cloud
FortiManager Public Cloud
FortiNDR Public Cloud
FortiPAM Public Cloud
FortiPortal Public Cloud
FortiProxy Public Cloud
FortiSandbox Public Cloud
FortiTester Public Cloud
FortiVoice Public Cloud
FortiWeb Manager Public Cloud
FortiWeb Public Cloud
All
FortiADC Private Cloud
FortiAnalyzer BigData Private Cloud
FortiAnalyzer Private Cloud
FortiAuthenticator Private Cloud
FortiDeceptor Private Cloud
FortiGate Private Cloud
FortiManager Private Cloud
FortiNDR Private Cloud
FortiPAM Private Cloud
FortiProxy Private Cloud
FortiSandbox Private Cloud
FortiTester Private Cloud
FortiVoice Private Cloud
FortiWeb Manager Private Cloud
FortiWeb Private Cloud
Account Management
FortiCloud Services
SAAS Management
FortiGate Cloud
FortiEdge Cloud
FortiEdge Cloud
FortiExtender Cloud
FortiPresence Cloud
FortiToken Cloud
FortiTrust Identity
FortiZTP
FortiCamera Cloud
SAAS Application Security
FortiWeb Cloud
FortiGSLB
FortiCASB
FortiCNP
FortiInsight
FortiPhish
FortiGate CNF
Managed Services
SOC-as-a-Service (SOCaaS)
Managed Fortigate Service
Platform as a service (PAAS)
FortiSASE
FortiAnalyzer Cloud
FortiManager Cloud
FortiClient Cloud
FortiSandbox Cloud
FortiMail Cloud
FortiSOAR Cloud
Other SAAS Services
Overlay-as-a-Service
FortiRecon
FortiConverter
ForiIPAM
FortiFlex
FortiCare Elite
4D Resources
Solution Hubs
Define, design, deploy, demo
4D Pillars
Secure SD-WAN
Zero Trust Network Access
Wireless
Switching
Secure Access Service Edge
Identity and Access Management
Next Generation Firewall
Curated Links by Solution
Cloud
FortiCloud
Public & Private Cloud
Popular Solutions
Secure SD-WAN
Zero Trust Network Access
Secure Access
Security Fabric
Tele-Working
Multi-Factor Authentication
FortiASIC
Operational Technology
MSSP
Next Generation Firewall
FortiAnalyzer
FortiAnalyzer Big-Data
FortiADC
FortiAP / FortiWiFi
FortiAP U-Series
FortiAuthenticator
FortiCache
FortiCarrier
FortiController
FortiDDoS
FortiDDoS-F
FortiDeceptor
FortiExtender
FortiGate-5000
FortiGate-6000
FortiGate-7000
FortiHypervisor
FortiIsolator
FortiMail
FortiManager
FortiNAC
FortiNDR
FortiProxy
FortiRecorder
FortiGate
FortiRPS
FortiSandbox
FortiSIEM
FortiSwitch
FortiTester
FortiToken
FortiVoice
FortiWAN
FortiWeb
FortiWLC
FortiWLM
AscenLink
AV Engine
AWS Firewall Rules
Container FortiOS
FortiADC
FortiADC E Series
FortiADC Manager
FortiADC Private Cloud
FortiADC Public Cloud
FortiAIOps
FortiAnalyzer
FortiAnalyzer BigData
FortiAnalyzer BigData Private Cloud
FortiAnalyzer Cloud
FortiAnalyzer Private Cloud
FortiAnalyzer Public Cloud
FortiAP / FortiWiFi
FortiAP-U Series
FortiAuthenticator
FortiAuthenticator Private Cloud
FortiAuthenticator Public Cloud
FortiAuthProxy
FortiBalancer
FortiBranchSASE
FortiBridge
FortiCache
FortiCamera
FortiCamera Cloud
FortiCare Elite
FortiCarrier
FortiCASB
FortiCentral
FortiClient
FortiClient Cloud
FortiCloud Services
FortiCNP
FortiConnect
FortiController
FortiConverter Service
FortiConverter Tool
FortiCore
FortiCSPM
FortiCWP
FortiDAST
FortiDB
FortiDDoS
FortiDDoS-F
FortiDeceptor
FortiDeceptor DaaS
FortiDeceptor Private Cloud
FortiDeceptor Public Cloud
FortiDevSec
FortiDLP
FortiDLP Agent
FortiDLP Policies
FortiDNS
FortiEdge Cloud
FortiEDR/XDR
FortiEndpoint
FortiExplorer
FortiExplorer Go
FortiExtender
FortiFlex
FortiFone
FortiGate / FortiOS
FortiGate Cloud
FortiGate CNF
FortiGate Private Cloud
FortiGate Public Cloud
FortiGate-5000
FortiGate-6000
FortiGate-7000
FortiGate-as-a-Service
FortiGSLB
FortiGuard Advanced Bot Protection
FortiGuest
FortiHypervisor
FortiInsight
FortiInsight Cloud
FortiIPAM
FortiIsolator
FortiIsolator Public Cloud
FortiLAN Cloud
FortiMail
FortiMail Cloud
FortiManager
FortiManager Cloud
FortiManager Private Cloud
FortiManager Public Cloud
FortiMonitor
FortiNAC
FortiNAC-F
FortiNDR
FortiNDR (on-premise) Private Cloud
FortiNDR (on-premise) Public Cloud
FortiNDR Cloud
FortiNDR Cloud Sensors
FortiPAM
FortiPAM Private Cloud
FortiPAM Public Cloud
FortiPhish
FortiPlanner
FortiPolicy
FortiPortal
FortiPortal Public Cloud
FortiPresence
FortiPresence VM
FortiProxy
FortiProxy Private Cloud
FortiProxy Public Cloud
FortiRecon
FortiRecorder
FortiRPS
FortiSandbox
FortiSandbox Cloud
FortiSandbox Private Cloud
FortiSandbox Public Cloud
FortiSASE
FortiScanner
FortiSIEM
FortiSIEM Cloud
FortiSOAR
FortiSOAR Cloud
FortiSRA
FortiSwitch
FortiSwitch Manager
FortiTap
FortiTester
FortiTester Private Cloud
FortiTester Public Cloud
FortiToken
FortiToken Cloud
FortiTrust Identity
FortiVoice
FortiVoice Cloud
FortiVoice Private Cloud
FortiVoice Public Cloud
FortiWAN
FortiWAN Controller
FortiWeb
FortiWeb Cloud
FortiWeb Manager Private Cloud
FortiWeb Manager Public Cloud
FortiWeb Private Cloud
FortiWeb Public Cloud
FortiWLM
FortiZTP
IPS Engine
Lacework FortiCNAPP
Managed FortiGate Service
Overlay-as-a-Service
Security Awareness and Training
SOCaaS
Wireless Controller
Search documents and hardware ...
Handbook
Introduction
What's New
Key Concepts and Features
Server load balancing
Link load balancing
Global load balancing
Security
High availability
Virtual Domain (VDOM) and Administrative Domain (ADOM)
Getting Started
Step 1: Install the appliance
Step 2: Configure the management interface
Step 3: Configure basic network settings
Step 4: Test connectivity to destination servers
Step 5: Complete product registration, licensing, and upgrades
Step 6: Configure a basic server load balancing policy
Step 7: Test the deployment
Step 8: Back up the configuration
Dashboard
Widgets
Dashboard management tools
Security Fabric
Automation
Creating automation stitches
Configuring Automation Triggers
Configuring Automation Actions
Diagnose commands
Fabric connectors
FortiSIEM Connector
FortiAnalyzer Connector
FortiSandbox Connector
FortiADC Manager Connector
FortiGSLB Connector
FortiClient EMS Connector
External connectors
Amazon Web Services (AWS) Connector
Oracle Cloud Infrastructure (OCI) Connector
Kubernetes Connector
Splunk Connector
SAP Connector
IP Address Connector
FortiView
Logical Topology
Server Load Balance Logical Topology
Global Load Balance Logical Topology
Link Load Balance Logical Topology
Server Load Balance
Virtual Servers
Virtual server details
Real server pool details
Real-server pool member details
Data Analytics
All Sessions
Security
OWASP Top 10
Threat Map
Data Analytics
Viewing the quarantine monitor
Security Logs
Blocked IP
System
Event Logs
Automation
Global Load Balance
Host
Data Analytics
Link Load Balance
Gateway
ZTNA FortiClient endpoint
System
Settings
Configuring basic system settings
Configuring system time
Updating firmware
Configuring an SMTP mail server
Pushing/pulling configurations
Backing up and restoring the configuration
Configuring DNS settings for non-root VDOM
Virtual Domain
Virtual Domain (VDOM) and Administrative Domain (ADOM) overview
Enabling the Virtual Domain feature and selecting the Virtual Domain Mode
Creating a virtual domain
Assigning administrator users and network interfaces to VDOMs
Virtual domain policies
Disabling a virtual domain
High Availability
HA feature overview
HA system requirements
HA synchronization
Configuring HA settings
Monitoring an HA cluster
Updating firmware for an HA cluster
Deploying an active-passive cluster
Deploying an active-active cluster
Advantages of HA Active-Active-VRRP
Deploying an active-active-VRRP cluster
Traffic Group
Administrator
Managing administrator users
Creating administrator users
Creating REST API administrator users
Configuring access profiles
Enable password policies
Global Resources
WCCP
SNMP
Configuring SNMP
Downloading SNMP MIBs
Configuring SNMP v1/v2
Configuring SNMP v3
Replacement Messages
FortiGuard
Connecting to FortiGuard services
Configuring FortiGuard service settings
Debug
Certificate
Manage Certificates
Generating a local certificate
Importing a local certificate
Creating a local certificate group
Importing intermediate CAs
Creating an intermediate CA group
Verify
Validating certificates
Importing CRLs
Creating a CA group
Importing CAs
OCSP
OCSP stapling
Adding OCSPs
Importing OCSP signing certificates
Network
Interface
Configuring network interfaces
Configuring the management interface
Configuring virtual overlay networks
Linking VDOMs for inter-VDOM routing
Transparent mode
Routing
Configuring static routes
Configuring policy routes
Configuring OSPF routes
Configuring ISP routes
Reverse path route caching
Configuring BGP routes
Configuring Bidirectional Forwarding Detection (BFD)
Access list vs. prefix list
Configuring an IPv4 access list
Configuring an IPv6 access list
Configuring an IPv4 prefix list
Configuring an IPv6 prefix list
NAT
Configuring source NAT
Configuring 1-to-1 NAT
QoS
Configuring the QoS filter
Configuring the QoS IPv6 filter
Configuring a QoS queue
Packet capture
Shared Resources
Health Check
Configuring health checks
Monitoring health check status
Configuring health check scripts
Schedule Group
Address
Configuring IPv4 address groups
Creating IPv4 address objects
Configuring IPv6 address groups
Creating IPv6 address objects
Managing ISP address books
Service
Creating service groups
Creating service objects
Server Load Balance
Virtual Server
Configuring virtual servers
Using content rewriting rules
HSTS and HPKP support
Configuring content routes
Using source pools
Using schedule pools
Using clone pools
Application Resources
Configuring Application profiles
Configuring MySQL profiles
Configuring MSSQL profiles
WebSocket load-balancing
TCP multiplexing
Configuring client SSL profiles
Configuring HTTP2 profiles
Configuring HTTP3 profiles
Configuring load-balancing (LB) methods
Configuring persistence rules
Configuring error pages
Configuring decompression rules
Configuring Captcha
Application Optimization
Creating a Page Speed configuration
Creating Page Speed profiles
Configuring compression rules
Configuring caching rules
Real Server Pool
Using real server pools
Configuring real servers
Configuring real server SSL profiles
Scripting
Using HTTP scripting
SSL-FP Resources
Configuring an L2 exception list
Creating a Web Filter Profile configuration
Viewing Web Filter categories
Configuring certificate caching
Link Load Balance
Link Policy
Link Group
Configuring a link group
Configuring gateway links
Configuring persistence rules
Configuring proximity route settings
Virtual Tunnel
Global Load Balance
GLB Wizard
FQDN
Configuring hosts
Configuring virtual server pools
Configuring location lists
Configuring GLB settings
Zone Tools
Configuring a Global DNS policy
Configuring DNS zones
Configuring general settings
Configuring DNS over HTTPS and DNS over TLS
Configuring the trust anchor key
Configuring DNS64
Configuring the DSSET list
Configuring an address group
Configuring remote DNS servers
Configuring the response rate limit
Global Object
Configuring servers
Configuring a global load balance link
Configuring data centers
Web Application Firewall
OWASP TOP10
WAF Profile
Configuring a WAF Profile
Configuring WAF Action objects
Configuring WAF Exception objects
Known Web Attacks
Configuring a Web Attack Signature policy
Using the Signature Creation Wizard
Common Attacks Detection
Configuring an Advanced Protection policy
Configuring an HTTP Protocol Constraint policy
Configuring an SQL/XSS Injection Detection policy
Configuring a CSRF protection policy
Sensitive Data Protection
Configuring a Sensitive Data Type object
Configuring a Data Leak Prevention policy
Configuring a Cookie Security policy
Configuring an HTTP Header Security policy
Input Validation
Configuring an Input Validation policy
Configuring a Parameter Validation rule
Configuring a Hidden Field rule
Configuring a File Restriction rule
Access Protection
Configuring a URL Protection policy
Configuring a Brute Force Attack Detection policy
Configuring a Credential Stuffing Defense policy
CORS Protection
Configuring a CORS Protection Rule
Configuring an Allowed Origin List
Configuring a CORS Headers List
API Protection
JSON Protection
Configuring JSON detection
Importing JSON schema
XML Protection
Configuring XML Detection
Importing XML schema
Uploading WSDL files
OpenAPI Validation
Configuring OpenAPI Detection
Importing OpenAPI schema
API Gateway
Configuring an API Gateway policy
Configuring an API Gateway User
Configuring an API Gateway Rule
API Discovery
Configuring API Discovery
Understanding the API endpoints database in API View
Bot Mitigation
Configuring a Bot Detection policy
Configuring a Threshold Based Detection policy
Configuring a Biometrics Based Detection policy
Configuring a Fingerprint Based Detection policy
Web Vulnerability Scanner
Scan Profile
Configuring a WVS Profile
Configuring a WVS Login
Configuring WVS Exceptions
Scan History
Scan Integration
Web Anti-Defacement
Advanced Bot Protection (ABP)
Enabling the Advanced Bot Protection connector
Obtaining the Application ID from the FortiGuard ABP User Portal
Configuring an Advanced Bot Protection policy
Advanced Bot Protection troubleshooting and debugging
Network Security
Firewall
Configuring an IPv4 firewall policy
Configuring an IPv6 firewall policy
Configuring an IPv4 connection limit policy
Configuring an IPv6 connection limit policy
Intrusion Prevention
AntiVirus
Creating an AV profile
Setting AV quarantine policies
Setting the AV service level
IP Reputation
Managing IP Reputation policy settings
Configuring an IP reputation exception
Configuring an IP reputation block list
Geo IP Protection
Using the Geo IP block list
Using the Geo IP allowlist
Special Geo codes
Zero Trust Network Access (ZTNA)
How device identity and trust context is established with FortiClient EMS
Configuring FortiClient EMS Connector for ZTNA
Verifying client certificate, FortiClient endpoint and ZTNA tag synchronized from FortiClient EMS
Configuring a ZTNA Profile
ZTNA troubleshooting and debugging
DoS Protection
DoS Protection Profile
Application
Configuring an HTTP access limit policy
Configuring an HTTP connection flood policy
Configuring an HTTP request flood policy
Networking
Configuring an IP fragmentation policy
Configuring a TCP SYN flood protection policy
Configuring a TCP slow data flood protection policy
Configuring a TCP connection access flood protection policy
User Authentication
Authentication Policy
User Group
Configuring user groups
Configuring customized authentication forms
Local User
Remote User
Using an LDAP authentication server
Using a RADIUS authentication server
Configuring Duo authentication server support
Using an NTLM authentication server
Using a TACACS+ authentication server
Using Kerberos Authentication Relay
Using HTTP Basic SSO
SAML
Configure an SAML service provider
Import IDP Metadata
AD FS Proxy
Adding an AD FS Publish
Adding an AD FS Proxy
OAuth 2.0 authentication
Log & Report
Using the traffic log
Using the security log
Using the script log
Log Setting
Configuring local log settings
Configuring syslog settings
Configuring OFTP settings for FortiAnalyzer logs
Configuring fast stats log settings
Report Setting
Configuring reports
Configuring report emails
Configuring report queries
Configuring fast reports
SSL Advanced Services
SSL offloading
SSL decryption by forward proxy
SSL profile configurations
Certificate guidelines
SSL/TLS versions and cipher suites
Exceptions list
SSL traffic mirroring
HSM Integration
Best Practices and Fine-tuning
Regular backups
Rebooting, resetting, and shutting down the system
SCP support for configuration backup
Security
Performance tips
High availability
Troubleshooting
Logs
Tools
execute commands
diagnose commands
System dump
Diff
Solutions by issue type
Resetting the configuration
Restoring firmware (“clean install”)
Additional resources
Appendix A: Fortinet MIBs
Appendix B: Port Numbers
Appendix C: Scripts
Scripting application
Events and actions
Predefined commands
Predefined scripts
Control structures
Operators
String library
Function
Special characters
Examples
Appendix D: Maximum Configuration Values
Change Log
Home
FortiADC 7.4.1
Handbook
7.4.1
7.4.5
7.4.4
7.4.3
7.4.2
7.4.1
7.4.0
7.2.7
7.2.6
7.2.5
7.2.4
7.2.3
7.2.2
7.2.1
7.2.0
7.1.4
7.1.3
7.1.2
7.1.1
7.1.0
7.0.5
7.0.4
7.0.3
7.0.2
7.0.1
7.0.0
6.2.6
6.2.5
6.2.4
6.2.3
6.2.2
6.2.1
6.2.0
6.1.6
6.1.5
6.1.4
6.1.3
6.1.2
6.1.1
6.1.0
6.0.1
6.0.0
5.4.3
5.4.2
5.4.1
5.4.0
5.3.6
5.3.5
5.3.4
5.3.3
5.3.2
5.3.1
5.3.0
5.2.7
Tools
Tools
This section gives an overview of the following troubleshooting tools:
execute commands
diagnose commands
System dump
Packet capture
Diff
Previous
Next
Tools
Tools
This section gives an overview of the following troubleshooting tools:
execute commands
diagnose commands
System dump
Packet capture
Diff
Previous
Next
Home
Product Pillars
Network Security
Network Security
FortiGate / FortiOS
FortiGate 5000
FortiGate 6000
FortiGate 7000
FortiProxy
NOC & SOC Management
FortiManager
FortiManager Cloud
FortiAnalyzer
FortiAnalyzer Cloud
FortiMonitor
FortiGate Cloud
Enterprise Networking
Secure SD-WAN
FortiLAN Cloud
FortiSwitch
FortiAP / FortiWiFi
FortiAP-U Series
FortiNAC-F
FortiExtender
FortiExtender Cloud
FortiAIOps
Business Communications
FortiFone
FortiVoice
FortiVoice Cloud
FortiRecorder
FortiCamera
Zero Trust Access
ZTNA
Zero Trust Network Access
FortiClient EMS
SASE
FortiSASE
Identity
FortiAuthenticator
FortiTrust Identity
FortiToken Cloud
FortiToken
Cloud Security
Hybrid Cloud Security
FortiGate Public Cloud
FortiGate Private Cloud
FortiFlex
Cloud Native Protection
FortiCNP
FortiDevSec
Web Application / API Protection
FortiWeb
FortiWeb Cloud
FortiADC
FortiGSLB
FortiGuard ABP
SAAS Security
FortiMail
FortiMail Cloud
FortiCASB
Security Operations
SOC Platform
FortiAnalyzer
FortiAnalyzer Cloud
FortiSIEM
/
FortiSIEM Cloud
FortiSOAR
FortiPhish
Advanced Threat Protection
FortiSandbox
FortiSandbox Cloud
FortiNDR
FortiNDR Cloud
FortiDeceptor
FortiInsight
FortiInsight Cloud
FortiIsolator
Endpoint Security
FortiClient
FortiClient Cloud
FortiEDR
Best Practices
Solution Hubs
Cloud
FortiCloud
Public & Private Cloud
Popular Solutions
Secure SD-WAN
Zero Trust Network Access
Secure Access
Next Generation Firewall
Security Fabric
Tele-Working
Multi-Factor Authentication
FortiASIC
Operational Technology
MSSP
4-D Resources
Secure SD-WAN
Zero Trust Network Access
Wireless
Switching
Secure Access Service Edge
Identity and Access Management
Next Generation Firewall
Hardware Guides
FortiAnalyzer
FortiAnalyzer Big-Data
FortiADC
FortiAP / FortiWiFi
FortiAP U-Series
FortiAuthenticator
FortiCache
FortiCarrier
FortiController
FortiDDoS
FortiDDoS-F
FortiDeceptor
FortiExtender
FortiGate
FortiGate-5000
FortiGate-6000
FortiGate-7000
FortiHypervisor
FortiIsolator
FortiMail
FortiManager
FortiNAC
FortiNDR
FortiProxy
FortiRecorder
FortiRPS
FortiSandbox
FortiSIEM
FortiSwitch
FortiTester
FortiToken
FortiVoice
FortiWAN
FortiWeb
FortiWLC
FortiWLM
Product A-Z
AscenLink
AV Engine
AWS Firewall Rules
Container FortiOS
FortiADC
FortiADC E Series
FortiADC Manager
FortiADC Private Cloud
FortiADC Public Cloud
FortiAIOps
FortiAnalyzer
FortiAnalyzer BigData
FortiAnalyzer BigData Private Cloud
FortiAnalyzer Cloud
FortiAnalyzer Private Cloud
FortiAnalyzer Public Cloud
FortiAP / FortiWiFi
FortiAP-U Series
FortiAuthenticator
FortiAuthenticator Private Cloud
FortiAuthenticator Public Cloud
FortiAuthProxy
FortiBalancer
FortiBranchSASE
FortiBridge
FortiCache
FortiCamera
FortiCamera Cloud
FortiCare Elite
FortiCarrier
FortiCASB
FortiCentral
FortiClient
FortiClient Cloud
FortiCloud Services
FortiCNP
FortiConnect
FortiController
FortiConverter Service
FortiConverter Tool
FortiCore
FortiCSPM
FortiCWP
FortiDAST
FortiDB
FortiDDoS
FortiDDoS-F
FortiDeceptor
FortiDeceptor DaaS
FortiDeceptor Private Cloud
FortiDeceptor Public Cloud
FortiDevSec
FortiDLP
FortiDLP Agent
FortiDLP Policies
FortiDNS
FortiEdge Cloud
FortiEDR/XDR
FortiEndpoint
FortiExplorer
FortiExplorer Go
FortiExtender
FortiFlex
FortiFone
FortiGate / FortiOS
FortiGate Cloud
FortiGate CNF
FortiGate Private Cloud
FortiGate Public Cloud
FortiGate-5000
FortiGate-6000
FortiGate-7000
FortiGate-as-a-Service
FortiGSLB
FortiGuard Advanced Bot Protection
FortiGuest
FortiHypervisor
FortiInsight
FortiInsight Cloud
FortiIPAM
FortiIsolator
FortiIsolator Public Cloud
FortiLAN Cloud
FortiMail
FortiMail Cloud
FortiManager
FortiManager Cloud
FortiManager Private Cloud
FortiManager Public Cloud
FortiMonitor
FortiNAC
FortiNAC-F
FortiNDR
FortiNDR (on-premise) Private Cloud
FortiNDR (on-premise) Public Cloud
FortiNDR Cloud
FortiNDR Cloud Sensors
FortiPAM
FortiPAM Private Cloud
FortiPAM Public Cloud
FortiPhish
FortiPlanner
FortiPolicy
FortiPortal
FortiPortal Public Cloud
FortiPresence
FortiPresence VM
FortiProxy
FortiProxy Private Cloud
FortiProxy Public Cloud
FortiRecon
FortiRecorder
FortiRPS
FortiSandbox
FortiSandbox Cloud
FortiSandbox Private Cloud
FortiSandbox Public Cloud
FortiSASE
FortiScanner
FortiSIEM
FortiSIEM Cloud
FortiSOAR
FortiSOAR Cloud
FortiSRA
FortiSwitch
FortiSwitch Manager
FortiTap
FortiTester
FortiTester Private Cloud
FortiTester Public Cloud
FortiToken
FortiToken Cloud
FortiTrust Identity
FortiVoice
FortiVoice Cloud
FortiVoice Private Cloud
FortiVoice Public Cloud
FortiWAN
FortiWAN Controller
FortiWeb
FortiWeb Cloud
FortiWeb Manager Private Cloud
FortiWeb Manager Public Cloud
FortiWeb Private Cloud
FortiWeb Public Cloud
FortiWLM
FortiZTP
IPS Engine
Lacework FortiCNAPP
Managed FortiGate Service
Overlay-as-a-Service
Security Awareness and Training
SOCaaS
Wireless Controller
Ordering Guides
Download PDF
Table of Contents
Introduction
What's New
Key Concepts and Features
Server load balancing
Link load balancing
Global load balancing
Security
High availability
Virtual Domain (VDOM) and Administrative Domain (ADOM)
Getting Started
Step 1: Install the appliance
Step 2: Configure the management interface
Step 3: Configure basic network settings
Step 4: Test connectivity to destination servers
Step 5: Complete product registration, licensing, and upgrades
Step 6: Configure a basic server load balancing policy
Step 7: Test the deployment
Step 8: Back up the configuration
Dashboard
Widgets
Dashboard management tools
Security Fabric
Automation
Creating automation stitches
Configuring Automation Triggers
Configuring Automation Actions
Diagnose commands
Fabric connectors
FortiSIEM Connector
FortiAnalyzer Connector
FortiSandbox Connector
FortiADC Manager Connector
FortiGSLB Connector
FortiClient EMS Connector
External connectors
Amazon Web Services (AWS) Connector
Oracle Cloud Infrastructure (OCI) Connector
Kubernetes Connector
Splunk Connector
SAP Connector
IP Address Connector
FortiView
Logical Topology
Server Load Balance Logical Topology
Global Load Balance Logical Topology
Link Load Balance Logical Topology
Server Load Balance
Virtual Servers
Virtual server details
Real server pool details
Real-server pool member details
Data Analytics
All Sessions
Security
OWASP Top 10
Threat Map
Data Analytics
Viewing the quarantine monitor
Security Logs
Blocked IP
System
Event Logs
Automation
Global Load Balance
Host
Data Analytics
Link Load Balance
Gateway
ZTNA FortiClient endpoint
System
Settings
Configuring basic system settings
Configuring system time
Updating firmware
Configuring an SMTP mail server
Pushing/pulling configurations
Backing up and restoring the configuration
Configuring DNS settings for non-root VDOM
Virtual Domain
Virtual Domain (VDOM) and Administrative Domain (ADOM) overview
Enabling the Virtual Domain feature and selecting the Virtual Domain Mode
Creating a virtual domain
Assigning administrator users and network interfaces to VDOMs
Virtual domain policies
Disabling a virtual domain
High Availability
HA feature overview
HA system requirements
HA synchronization
Configuring HA settings
Monitoring an HA cluster
Updating firmware for an HA cluster
Deploying an active-passive cluster
Deploying an active-active cluster
Advantages of HA Active-Active-VRRP
Deploying an active-active-VRRP cluster
Traffic Group
Administrator
Managing administrator users
Creating administrator users
Creating REST API administrator users
Configuring access profiles
Enable password policies
Global Resources
WCCP
SNMP
Configuring SNMP
Downloading SNMP MIBs
Configuring SNMP v1/v2
Configuring SNMP v3
Replacement Messages
FortiGuard
Connecting to FortiGuard services
Configuring FortiGuard service settings
Debug
Certificate
Manage Certificates
Generating a local certificate
Importing a local certificate
Creating a local certificate group
Importing intermediate CAs
Creating an intermediate CA group
Verify
Validating certificates
Importing CRLs
Creating a CA group
Importing CAs
OCSP
OCSP stapling
Adding OCSPs
Importing OCSP signing certificates
Network
Interface
Configuring network interfaces
Configuring the management interface
Configuring virtual overlay networks
Linking VDOMs for inter-VDOM routing
Transparent mode
Routing
Configuring static routes
Configuring policy routes
Configuring OSPF routes
Configuring ISP routes
Reverse path route caching
Configuring BGP routes
Configuring Bidirectional Forwarding Detection (BFD)
Access list vs. prefix list
Configuring an IPv4 access list
Configuring an IPv6 access list
Configuring an IPv4 prefix list
Configuring an IPv6 prefix list
NAT
Configuring source NAT
Configuring 1-to-1 NAT
QoS
Configuring the QoS filter
Configuring the QoS IPv6 filter
Configuring a QoS queue
Packet capture
Shared Resources
Health Check
Configuring health checks
Monitoring health check status
Configuring health check scripts
Schedule Group
Address
Configuring IPv4 address groups
Creating IPv4 address objects
Configuring IPv6 address groups
Creating IPv6 address objects
Managing ISP address books
Service
Creating service groups
Creating service objects
Server Load Balance
Virtual Server
Configuring virtual servers
Using content rewriting rules
HSTS and HPKP support
Configuring content routes
Using source pools
Using schedule pools
Using clone pools
Application Resources
Configuring Application profiles
Configuring MySQL profiles
Configuring MSSQL profiles
WebSocket load-balancing
TCP multiplexing
Configuring client SSL profiles
Configuring HTTP2 profiles
Configuring HTTP3 profiles
Configuring load-balancing (LB) methods
Configuring persistence rules
Configuring error pages
Configuring decompression rules
Configuring Captcha
Application Optimization
Creating a Page Speed configuration
Creating Page Speed profiles
Configuring compression rules
Configuring caching rules
Real Server Pool
Using real server pools
Configuring real servers
Configuring real server SSL profiles
Scripting
Using HTTP scripting
SSL-FP Resources
Configuring an L2 exception list
Creating a Web Filter Profile configuration
Viewing Web Filter categories
Configuring certificate caching
Link Load Balance
Link Policy
Link Group
Configuring a link group
Configuring gateway links
Configuring persistence rules
Configuring proximity route settings
Virtual Tunnel
Global Load Balance
GLB Wizard
FQDN
Configuring hosts
Configuring virtual server pools
Configuring location lists
Configuring GLB settings
Zone Tools
Configuring a Global DNS policy
Configuring DNS zones
Configuring general settings
Configuring DNS over HTTPS and DNS over TLS
Configuring the trust anchor key
Configuring DNS64
Configuring the DSSET list
Configuring an address group
Configuring remote DNS servers
Configuring the response rate limit
Global Object
Configuring servers
Configuring a global load balance link
Configuring data centers
Web Application Firewall
OWASP TOP10
WAF Profile
Configuring a WAF Profile
Configuring WAF Action objects
Configuring WAF Exception objects
Known Web Attacks
Configuring a Web Attack Signature policy
Using the Signature Creation Wizard
Common Attacks Detection
Configuring an Advanced Protection policy
Configuring an HTTP Protocol Constraint policy
Configuring an SQL/XSS Injection Detection policy
Configuring a CSRF protection policy
Sensitive Data Protection
Configuring a Sensitive Data Type object
Configuring a Data Leak Prevention policy
Configuring a Cookie Security policy
Configuring an HTTP Header Security policy
Input Validation
Configuring an Input Validation policy
Configuring a Parameter Validation rule
Configuring a Hidden Field rule
Configuring a File Restriction rule
Access Protection
Configuring a URL Protection policy
Configuring a Brute Force Attack Detection policy
Configuring a Credential Stuffing Defense policy
CORS Protection
Configuring a CORS Protection Rule
Configuring an Allowed Origin List
Configuring a CORS Headers List
API Protection
JSON Protection
Configuring JSON detection
Importing JSON schema
XML Protection
Configuring XML Detection
Importing XML schema
Uploading WSDL files
OpenAPI Validation
Configuring OpenAPI Detection
Importing OpenAPI schema
API Gateway
Configuring an API Gateway policy
Configuring an API Gateway User
Configuring an API Gateway Rule
API Discovery
Configuring API Discovery
Understanding the API endpoints database in API View
Bot Mitigation
Configuring a Bot Detection policy
Configuring a Threshold Based Detection policy
Configuring a Biometrics Based Detection policy
Configuring a Fingerprint Based Detection policy
Web Vulnerability Scanner
Scan Profile
Configuring a WVS Profile
Configuring a WVS Login
Configuring WVS Exceptions
Scan History
Scan Integration
Web Anti-Defacement
Advanced Bot Protection (ABP)
Enabling the Advanced Bot Protection connector
Obtaining the Application ID from the FortiGuard ABP User Portal
Configuring an Advanced Bot Protection policy
Advanced Bot Protection troubleshooting and debugging
Network Security
Firewall
Configuring an IPv4 firewall policy
Configuring an IPv6 firewall policy
Configuring an IPv4 connection limit policy
Configuring an IPv6 connection limit policy
Intrusion Prevention
AntiVirus
Creating an AV profile
Setting AV quarantine policies
Setting the AV service level
IP Reputation
Managing IP Reputation policy settings
Configuring an IP reputation exception
Configuring an IP reputation block list
Geo IP Protection
Using the Geo IP block list
Using the Geo IP allowlist
Special Geo codes
Zero Trust Network Access (ZTNA)
How device identity and trust context is established with FortiClient EMS
Configuring FortiClient EMS Connector for ZTNA
Verifying client certificate, FortiClient endpoint and ZTNA tag synchronized from FortiClient EMS
Configuring a ZTNA Profile
ZTNA troubleshooting and debugging
DoS Protection
DoS Protection Profile
Application
Configuring an HTTP access limit policy
Configuring an HTTP connection flood policy
Configuring an HTTP request flood policy
Networking
Configuring an IP fragmentation policy
Configuring a TCP SYN flood protection policy
Configuring a TCP slow data flood protection policy
Configuring a TCP connection access flood protection policy
User Authentication
Authentication Policy
User Group
Configuring user groups
Configuring customized authentication forms
Local User
Remote User
Using an LDAP authentication server
Using a RADIUS authentication server
Configuring Duo authentication server support
Using an NTLM authentication server
Using a TACACS+ authentication server
Using Kerberos Authentication Relay
Using HTTP Basic SSO
SAML
Configure an SAML service provider
Import IDP Metadata
AD FS Proxy
Adding an AD FS Publish
Adding an AD FS Proxy
OAuth 2.0 authentication
Log & Report
Using the traffic log
Using the security log
Using the script log
Log Setting
Configuring local log settings
Configuring syslog settings
Configuring OFTP settings for FortiAnalyzer logs
Configuring fast stats log settings
Report Setting
Configuring reports
Configuring report emails
Configuring report queries
Configuring fast reports
SSL Advanced Services
SSL offloading
SSL decryption by forward proxy
SSL profile configurations
Certificate guidelines
SSL/TLS versions and cipher suites
Exceptions list
SSL traffic mirroring
HSM Integration
Best Practices and Fine-tuning
Regular backups
Rebooting, resetting, and shutting down the system
SCP support for configuration backup
Security
Performance tips
High availability
Troubleshooting
Logs
Tools
execute commands
diagnose commands
System dump
Diff
Solutions by issue type
Resetting the configuration
Restoring firmware (“clean install”)
Additional resources
Appendix A: Fortinet MIBs
Appendix B: Port Numbers
Appendix C: Scripts
Scripting application
Events and actions
Predefined commands
Predefined scripts
Control structures
Operators
String library
Function
Special characters
Examples
Appendix D: Maximum Configuration Values
Change Log