DOCUMENT LIBRARY

FortiGate / FortiOS

FortiManager

FortiAnalyzer

Administration Guide

Getting started
- Summary of steps
- Using the GUI
- Using the CLI
- FortiAI assistant and CLI Code Lab NEW
- Configuration and management
- Product registration with FortiCare
- FortiGate models
- FortiData
  - Connecting FortiData to FortiGate
- FortiSASE-Sovereign
- FortiTelemetry
  - Configuring a FortiTelemetry Controller
Dashboard
- Status dashboard
- Assets and Identities dashboard
- Network Monitor dashboard
- FortiView dashboard
- WiFi dashboard
  - FortiAP Status monitor
  - Clients by FortiAP monitor
- Monitors and widgets
  - Widgets in VDOM mode
- Using dashboards of widgets and monitors
- Examples
Network
- Interfaces
  - Interface settings
  - Physical interface
    - Transceiver status information for SFP and SFP+ interfaces
    - GPON support for FortiGates with SFP/SFP+ ports NEW
  - VLAN
  - Aggregation and redundancy
  - Loopback interface
  - Software switch
  - Hardware switch
  - Zone
  - Virtual wire pair
  - Enhanced MAC VLAN
  - VXLAN
- DNS
  - Important DNS CLI commands
  - DNS domain list
  - FortiGate DNS server
  - DDNS
  - DNS latency information
  - DNS over TLS and HTTPS
  - Transparent conditional DNS forwarder
  - Interfaces in non-management VDOMs as the source IP address of the DNS conditional forwarding server
  - DNS session helpers
  - DNS troubleshooting
- Explicit and transparent proxies
  - Explicit web proxy
  - FTP proxy
  - Transparent proxy
  - Proxy policy addresses
  - IPv6 proxy address and address group objects New
  - Proxy policy security profiles
  - Explicit proxy authentication
  - Transparent web proxy forwarding
  - Transparent web proxy forwarding over IPv6
  - Upstream proxy authentication in transparent proxy mode
  - Multiple dynamic header count
  - Restricted SaaS access
  - Explicit proxy and FortiGate Cloud Sandbox
  - Proxy chaining
  - WAN optimization SSL proxy chaining
  - Agentless NTLM authentication for web proxy
  - Multiple LDAP servers in Kerberos keytabs and agentless NTLM domain controllers
  - Learn client IP addresses
  - Explicit proxy authentication over HTTPS
  - mTLS client certificate authentication
  - CORS protocol in explicit web proxy when using session-based, cookie-enabled, and captive portal-enabled SAML authentication
  - Display CORS content in an explicit proxy environment
  - HTTP connection coalescing and concurrent multiplexing for explicit proxy
  - Secure explicit proxy
  - Secure explicit proxy with client certificates
  - Explicit proxy logging
  - Configuring fast fallback for explicit proxy
  - Forward HTTPS requests to a web server without the need for an HTTP CONNECT message
  - Specifying outgoing interface and VRF for a web proxy forward server or isolator server
  - Isolator servers in proxy policies
  - Secure explicit proxy with client certificate blocklist enforcement NEW
  - Session and user limits
- IPAM
  - IPAM introduction
  - Advanced configurations
  - Configuration examples
  - Diagnostics
- DHCP servers and relays
  - Basic configuration
  - DHCP options
  - DHCP addressing mode on an interface
  - VCI pattern matching for DHCP assignment
  - DHCP shared subnet
  - Multiple DHCP relay servers
  - DHCP smart relay on interfaces with a secondary IP
  - FortiGate DHCP works with DDNS to allow FQDN connectivity to leased IP addresses
- Static routing
  - Routing concepts
  - Policy routes
  - Equal cost multi-path
  - Dual internet connections
- Dynamic routing
  - RIP
    - Basic RIP example
    - Basic RIPng example
  - OSPF
  - BGP
  - BFD
    - BFD for multihop path for BGP
  - Routing objects
- Multicast
  - Multicast routing and PIM support
  - Configuring multicast forwarding
  - Using IPS inspection for multicast UDP traffic
  - Including denied multicast sessions in the session table
  - IPv6 multicast routing BSR support New
- FortiExtender
  - Adding a FortiExtender
- Cellular modems
  - Automatic LTE connection establishment
  - Direct IP support for LTE/4G
  - Cellular interface support for IPv6
  - Active SIM card switching
  - Airplane mode and LTE/BLE
  - Upgrade LTE modem firmware directly from FortiGuard
- LLDP reception
- Virtual routing and forwarding
  - Implementing VRF
  - VRF routing support
  - Route leaking between VRFs with BGP
  - Route leaking between multiple VRFs
  - VRF with IPv6
  - IBGP and EBGP support in VRF
  - Support cross-VRF local-in and local-out traffic for local services
  - Support specific VRF ID for local-out traffic
- NetFlow
  - NetFlow templates
  - NetFlow on FortiExtender and tunnel interfaces
  - Allow multiple NetFlow collectors
  - Netflow sampling
  - Filter NetFlow sampling
- sFlow
- Link monitor
  - Link monitor with route updates
  - Enable or disable updating policy routes when link health monitor fails
  - Add weight setting on each link health monitor server
  - SLA link monitoring for dynamic IPsec and SSL VPN tunnels
  - HA remote link monitoring
- IPv6
  - IPv6 overview
  - IPv6 quick start
  - Neighbor discovery proxy
  - IPv6 address assignment
  - NAT66, NAT46, NAT64, and DNS64
  - DHCPv6 relay
  - IPv6 tunneling
  - IPv6 Simple Network Management Protocol
  - Dynamic routing in IPv6
    - OSPFv3 and IPv6
    - BGP and IPv6
  - IPv6 configuration examples
- FortiGate LAN extension
  - Example CLI configuration
  - Example GUI configuration
  - DHCP client mode for inter-VDOM links
  - FortiGate secure edge to FortiSASE
  - WiFi access point with internet connectivity
- SCTP packets with zero checksum on the NP7 platform
- Industrial Connectivity
- Diagnostics
  - Using the packet capture tool
  - Using the debug flow tool
SD-WAN
- SD-WAN overview
  - SD-WAN components and design principles
  - SD-WAN designs and architectures
- SD-WAN quick start
- SD-WAN members and zones
- SD-WAN performance SLA
- SD-WAN rules
- SD-WAN Underlay Bandwidth and Quality Monitoring service
  - Application performance and configuration
  - Speed tests
- Overlay
- Routing
- Security
- Advanced configuration
- Troubleshooting SD-WAN
- SD-WAN cloud on-ramp
Zero Trust Network Access
- Zero Trust Network Access introduction
- ZTNA advanced configurations
- ZTNA configuration examples
- ZTNA troubleshooting and debugging commands
- ZTNA troubleshooting scenarios
- ZTNA troubleshooting with error messages
Policy and Objects
- Policies
- Address objects
- Custom tags NEW
- Protocol options
  - Configuring handling of unknown content types
  - Stripping the X-Forwarded-For value in the HTTP header
- Traffic shaping
- Internet Services
Security Profiles
- Inspection modes
  - Flow mode inspection (default mode)
  - Proxy mode inspection
  - Inspection mode feature comparison
  - Proxy-based inspection for email protocols supported on models with 2 GB RAM
- AI protection
  - Protecting GenAI access using web filter
  - Protecting GenAI access using application control
  - Protecting GenAI Access using DLP
- Antivirus
  - Antivirus introduction
  - Advanced configurations
  - Configuration examples
- Web filter
  - Web filter introduction
  - Advanced CLI configuration
  - Configuration examples
- Video filter
  - Filtering based on FortiGuard categories
  - Filtering based on YouTube channel
  - Filtering based on title
  - Filtering based on description
  - Configuring a video filter keyword list
  - Replacement messages displayed in blocked videos
- DNS filter
  - Configuring a DNS filter profile
  - FortiGuard category-based DNS domain filtering
  - Botnet C&C domain blocking
  - DNS safe search
  - Local domain filter
  - DNS translation
  - Applying DNS filter to FortiGate DNS server
  - DNS inspection with DoT and DoH
  - DNS over QUIC and DNS over HTTP3 for transparent and local-in DNS modes
  - Troubleshooting for DNS filter
- Telemetry profile
  - Creating telemetry profiles
- Application control
  - Configuring an application sensor
  - Application matching signature priority
  - Basic category filters and overrides
  - Excluding signatures in application control profiles
  - Port enforcement check
  - Protocol enforcement
  - SSL-based application detection over decrypted traffic in a sandwich topology
  - Matching multiple parameters on application control signatures
  - Application signature dissector for DNP3
  - Domain fronting protection
- Inline CASB
  - Inline CASB examples
- Intrusion prevention
  - Signature-based defense
  - Configuring an IPS sensor
  - IPS configuration options
  - SCTP filtering capabilities
  - Diameter protocol inspection
  - IPS signature filter options
  - IPS with botnet C&C IP blocking
  - IPS signatures for the operational technology security service
  - IPS sensor for IEC 61850 MMS protocol
  - IPS Modbus TCP decoder
  - AI and ML-based IPS detection
  - Support Ethernet layer protocols in the IPS engine
- File filter
  - Supported file types
  - Configuring a file filter profile
  - Configuring a file filter profile with the warning action NEW
- Email filter
  - Configuring an email filter profile
  - Local-based filters
  - FortiGuard-based filters
  - Third-party-based filters
  - Filtering order
  - Protocols and actions
  - Configuring webmail filtering
  - Spam email header
- VoIP solutions
  - General use cases
  - NAT46 and NAT64 for SIP ALG
  - SIP message inspection and filtering
  - SIP ALG and SIP session helper
  - SIP pinholes
  - SIP over TLS
  - Voice VLAN auto-assignment
  - Scanning MSRP traffic
- ICAP
  - ICAP configuration example
  - ICAP response filtering
  - Secure ICAP clients
  - ICAP scanning with SCP and FTP
  - Domain name in XFF with ICAP
  - Protocol transparency for ICAP
  - Selective forwarding to ICAP server
- Web application firewall
  - Protecting a server running web applications
- Data loss prevention
  - DLP techniques
  - Basic DLP settings
  - Advanced DLP configurations
  - DLP fingerprinting
  - FortiGuard DLP service
  - Sensitivity labels
  - Exact data matching
  - DLP examples
- Virtual patching
  - OT virtual patching basic examples
  - OT and IoT virtual patching on NAC policies
- SSL & SSH Inspection
  - Configuring an SSL/SSH inspection profile
  - Certificate inspection
  - Deep inspection
  - Protecting an SSL server
  - Handling SSL offloaded traffic from an external decryption device
  - SSH traffic file scanning
  - Redirect to WAD after handshake completion
  - HTTP/2 support in proxy mode SSL inspection
  - Define multiple certificates in an SSL profile in replace mode
  - Disabling the FortiGuard IP address rating
  - Block or allow ECH TLS connections
  - Configuring certificate probe failure option
  - Hybrid PQC support in proxy mode SSL deep inspection
- Custom signatures
  - Configuring custom signatures
  - Blocking applications with custom signatures
  - Filters for application control groups
  - Application groups in traffic shaping policies
- Overrides
  - Web rating override
  - Using local and remote categories
  - Web profile override
- IP ban
  - IP ban using the CLI
  - IP ban using security profiles
  - Configuring the persistency for a banned IP list
- Profile groups
IPsec VPN
- General IPsec VPN configuration
- Site-to-site VPN
  - FortiGate-to-FortiGate
  - FortiGate-to-third-party
- Remote access
- Aggregate and redundant VPN
- ADVPN
- Fabric Overlay Orchestrator
- Other VPN topics
- VPN IPsec troubleshooting
  - Understanding VPN related logs
  - IPsec related diagnose commands
Agentless VPN
- Agentless VPN portal configurations
- Quick Connection tool
- Agentless VPN bookmarks
- Agentless VPN for remote users
- Customizing the RDP display size
- Showing the Agentless VPN web portal login page in the browser's language
- Agentless VPN custom landing page
- Agentless VPN protocols
  - TLS 1.3 support
  - SMBv2 support
- Agentless VPN security best practices
- Agentless VPN authentication
- Disable the clipboard for Agentless VPN RDP connections
- Post-Quantum Cryptography for Agentless VPN
- Agentless VPN troubleshooting
  - Debug commands
  - Troubleshooting common issues
User & Authentication
- User definition, groups, and settings
- Basic authentication with cached client certificates
- LDAP servers
- RADIUS servers
- SAML
- TACACS+ servers
- SCIM servers
  - FortiGate as SCIM server and FAC as SCIM client
  - Using SAML with a SCIM group in a firewall policy NEW
- Bearer token authentication for SCIM servers
- FortiTokens
- PKI
  - Configuring a PKI user
  - Using the SAN field for LDAP-integrated certificate authentication
- FSSO
- Include usernames in logs
Wireless configuration
Switch Controller
System
- Administrators
  - Local authentication
  - Remote authentication for administrators
  - Administrator account options
  - REST API administrator
  - SSO administrators
  - FortiCloud SSO
  - Allowing the FortiGate to override FortiCloud SSO administrator user permissions
  - Password policy
  - Public key SSH access
  - Separating the SSHD host key from the administration server certificate
  - Restricting SSH and Telnet jump host capabilities
  - Restricting local administrator logins through the console
  - Remote administrators with TACACS+ VSA attributes
- Administrator profiles
- Firmware & Registration
  - About firmware installations
  - Firmware labels
  - Upgrading individual devices
  - Upgrading all devices
  - Registering devices
  - Enabling automatic firmware upgrades
    - Required firmware upgrades for FortiGates with invalid support contracts or that have reached EOES
  - Upgrade prompt when a critical vulnerability is detected upon login
  - Viewing firmware upgrade reports
  - Authorizing devices
  - Firmware upgrade notifications
  - Downloading a firmware image
  - Testing a firmware version
  - Installing firmware from system reboot
  - Restoring from a USB drive
  - Using controlled upgrades
  - Downgrading individual device firmware
  - Downloading the EOS support package for supported Fabric devices
  - How the FortiGate firmware license works
  - Enhanced firmware upgrade management for extension devices
- Settings
  - General tab
  - Access tab
  - Device tab
  - Preference tab
  - Trusted platform module support
  - Configure TCP NPU session delay globally
- Virtual Domains
  - VDOM overview
  - General configurations
  - Configuring global profiles
  - Backing up and restoring configurations in multi-VDOM mode
  - Inter-VDOM routing configuration example: Internet access
  - Inter-VDOM routing configuration example: Partial-mesh VDOMs
- SNMP
  - Basic configuration
  - MIB files
  - Access control for SNMP
  - Important SNMP traps
  - SNMP traps and automation-stitch notifications for DIO module
  - SNMP examples
- Replacement messages
- Replacement message groups
- FortiGuard
  - Subscriptions
  - FortiGuard settings
  - Anycast
  - Anycast and unicast services
  - Online security tools
- Feature visibility
- Certificates
  - Automatically provision a certificate
  - Generate a new certificate
  - Regenerate default certificates
  - Import a certificate
  - Generate a CSR
  - CA certificate
  - Remote certificate
  - Certificate revocation list
  - Export a certificate
  - Uploading certificates using an API
  - Procuring and importing a signed SSL certificate
  - Microsoft CA deep packet inspection
  - Administrative access using certificates
  - Creating certificates with XCA
  - Enrollment over Secure Transport for automatic certificate management
  - ACME External Account Binding support
- Security
  - BIOS-level signature and file integrity checking
  - Real-time file system integrity checking
  - Running a file system check automatically
  - Built-in entropy source
  - FortiGate VM unique certificate
  - Closed network VM license security
  - Encrypt configuration files in the eCryptfs file system
  - FIPS-CC mode and OpenSSL FIPS provider
  - Enhanced administrator password security
  - Black box for FortiGate
  - DoS protection
- Configuration scripts
- Workspace mode
- RAID
- FortiGate encryption algorithm cipher suites
- Conserve mode
- Using APIs
- Configuration backups and reset
- Fortinet Support Tool for capturing incidents
High Availability
- FGCP
- FGSP
- Standalone configuration synchronization
  - Layer 3 unicast standalone configuration synchronization
- VRRP
Fortinet Security Fabric
- Components
- Security Fabric connectors
- Using the Security Fabric
- Configuring the Security Fabric with SAML
- Security rating
- Automation stitches
- Public and private SDN connectors
- Endpoint/Identity connectors
- External feeds
- Generic connector for importing addresses
- Troubleshooting
  - Viewing a summary of all connected FortiGates in a Security Fabric
  - Diagnosing automation stitches
Log and Report
- Forward Traffic log page NEW
- Viewing event logs
- System Events log page
- Security Events log page
- Reports page
- Log settings and targets
- Logging to FortiAnalyzer
- Advanced and specialized logging
- Sample logs by log type
- Troubleshooting
WAN optimization
- Overview
- Example topologies
- Configuration examples
VM
- Amazon Web Services
- Microsoft Azure
- Google Cloud Platform
- OCI
- AliCloud
- Private cloud
- VM license
- Permanent trial mode for FortiGate-VM
- PF and VF SR-IOV driver and virtual SPU support
- Using OCI IMDSv2
- FIPS cipher mode for AWS, Azure, OCI, and GCP FortiGate-VMs
- Cloud-init
- TPM support for FortiGate-VM
Hyperscale firewall
Troubleshooting
- Troubleshooting methodologies
- Connectivity Fault Management
- Troubleshooting scenarios
- CLI troubleshooting cheat sheet
- CLI error codes
- Additional resources
Change Log

Home FortiGate / FortiOS 8.0.0 Administration Guide

8.0.0

Change Log

Date	Change Description
2026-04-21	Initial release.
2026-04-27	Added IPv6 proxy address and address group objects New and BGP next hop self-support for VPNv4 and VPNv6 route reflectors New.
2026-05-08	Added Ensuring SD-WAN prioritizes healthy SD-WAN members, BGP neighbor naming support New, and IPv6 multicast routing BSR support New. Updated Configuring PCP port mapping with SNAT and DNAT.
2026-05-11	Added IPAM firewall address New.
2026-05-14	Updated Post-Quantum readiness.
2026-05-22	Added Certificate verification for real servers and ZTNA web proxy with load balancing example. Updated ZTNA troubleshooting and debugging commands.
2026-05-27	Added Session and user limits and Configuring handling of unknown content types. Updated IPsec DNS suffix.
2026-05-29	Added Enhanced multicast session key for virtual wire pair New, EVPN support for VXLAN Anycast gateway and type-5 routing New, IPAM DHCP templates New, Dynamic BGP learning of ISDB reputation IPs New, Remote access VPNs with IPAM addressing New, VPN with FortiClient Standalone and FortiIdentity Cloud New, and SSO integration with FortiIdentity Cloud.
2026-06-02	Added ZTNA tag caching and direct tag synchronization.
2026-06-15	Updated PTPv2.
2026-06-17	Updated NAT46 policy and NAT64 policy and DNS64 (DNS proxy).
2026-06-23	Added Use underlay bandwidth to make traffic steering decisions New, ToS-based SD-WAN duplication matching New, Selective SD-WAN duplication New, Stop packet duplication upon reaching bandwidth utilization threshold New, Confine packet duplication across multiple overlays to the same spoke New, and On-demand duplication at the Hub using remote health-check New.

Change Log

Date	Change Description
2026-04-21	Initial release.
2026-04-27	Added IPv6 proxy address and address group objects New and BGP next hop self-support for VPNv4 and VPNv6 route reflectors New.
2026-05-08	Added Ensuring SD-WAN prioritizes healthy SD-WAN members, BGP neighbor naming support New, and IPv6 multicast routing BSR support New. Updated Configuring PCP port mapping with SNAT and DNAT.
2026-05-11	Added IPAM firewall address New.
2026-05-14	Updated Post-Quantum readiness.
2026-05-22	Added Certificate verification for real servers and ZTNA web proxy with load balancing example. Updated ZTNA troubleshooting and debugging commands.
2026-05-27	Added Session and user limits and Configuring handling of unknown content types. Updated IPsec DNS suffix.
2026-05-29	Added Enhanced multicast session key for virtual wire pair New, EVPN support for VXLAN Anycast gateway and type-5 routing New, IPAM DHCP templates New, Dynamic BGP learning of ISDB reputation IPs New, Remote access VPNs with IPAM addressing New, VPN with FortiClient Standalone and FortiIdentity Cloud New, and SSO integration with FortiIdentity Cloud.
2026-06-02	Added ZTNA tag caching and direct tag synchronization.
2026-06-15	Updated PTPv2.
2026-06-17	Updated NAT46 policy and NAT64 policy and DNS64 (DNS proxy).
2026-06-23	Added Use underlay bandwidth to make traffic steering decisions New, ToS-based SD-WAN duplication matching New, Selective SD-WAN duplication New, Stop packet duplication upon reaching bandwidth utilization threshold New, Confine packet duplication across multiple overlays to the same spoke New, and On-demand duplication at the Hub using remote health-check New.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

Web Application / API Protection

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

All Products

Administration Guide

Change Log

Change Log

Change Log

Change Log