u/mebspace

Hi everyone,
I’m looking for best practices for configuring FortiGate SD-WAN spillover between two WAN links.
The goal is to prefer the primary WAN and only send traffic to the secondary WAN when the primary reaches a certain bandwidth threshold, or if the primary link fails/degrades.
A few questions:
Is spillover still the recommended approach for this use case, or would you use another SD-WAN strategy?
How do you normally calculate ingress/egress spillover thresholds?
Should thresholds be set close to the ISP speed, or lower to avoid congestion?
Do you combine spillover with Performance SLA checks?
Are there any issues with existing sessions, NAT, VPN, VoIP, or failback behavior?
For critical traffic, do you recommend separate SD-WAN rules instead of relying on the default spillover rule?
Any common mistakes or lessons learned from production deployments?

Hi everyone,
I’m looking at implementing 802.1X authentication for macOS devices with FortiNAC.
I know macOS supports 802.1X natively, but I’d like to hear from anyone who has deployed it successfully in production.
Are you using EAP-TLS (certificates) or another authentication method?
How are you managing certificates (Jamf, Intune, another MDM)?
Does FortiNAC work well with macOS over 802.1X, or are there any known issues or limitations?
Are there any special configuration steps or best practices for Macs?
If you’ve implemented this, is there anything you wish you had known before deploying it?

Hi everyone,
I’m planning to migrate an existing FortiClient EMS 7.0.2 deployment to a fresh EMS 7.4 installation and would appreciate advice from anyone who’s been through this process.
My current understanding is that restoring the old EMS database isn’t an option in my case, so I’m planning to build a new EMS and migrate everything over.
My current plan is:

Deploy a new EMS 7.4 server.
Install a fresh EMS instance.
Manually migrate the configuration by:
-Exporting/importing Endpoint Profiles (where possible).
-Recreating Endpoint Policies.
-Recreating On-fabric Detection Rules.
-Reconfiguring system settings (SMTP, certificates, LDAP/ AD integration, assignment rules, tags, etc.).
Transfer the EMS license by requesting a Hardware ID change through Fortinet Customer Service.
Migrate endpoints using Switch EMS.
Verify all endpoints are communicating with the new EMS.
Decommission the old EMS once the migration is complete.

My questions are:
Is this the recommended approach, or is there a better way?
Since restoring the old database isn’t possible, is there any supported way to migrate the configuration besides manually recreating it? For example, are there tools, scripts, APIs, or export/import methods that can help preserve policies and other settings?
Which parts of the configuration can actually be exported/imported, and which ones always have to be recreated?
Are there any common pitfalls or lessons learned during this migration?
Any tips for making the endpoint migration with Switch EMS as smooth as possible?
Finally, if you were deploying a new EMS today, would you choose Windows or Linux, and why? I’m open to either if one provides a better long-term solution.
I’d really appreciate any recommendations, best practices, or real-world experiences. Thanks!

Hi everyone,

We’re currently evaluating an upgrade to FortiADC version 8 and would like to hear from anyone who has already deployed it in production.

We are using both the load balancing capabilities and the WAF (Web Application Firewall) features, so we’re especially interested in feedback related to WAF performance, security policies, false positives, stability, and any changes compared to previous releases.

Have you encountered any significant issues, bugs, or compatibility concerns after upgrading? How has the overall stability been? Would you recommend upgrading now, or waiting for a more mature release?

Any real-world experiences, lessons learned, or best practices would be greatly appreciated.

Thanks in advance!