Unanswered questions

Verificar correspondência da policy (Policy Match)diagnose debug flow filter addr <IP_ORIGEM>diagnose debug flow filter addr <IP_DESTINO>diagnose debug flow show console enablediagnose debug enable diagnose debug flow trace start 10 Validar NAT (SNAT/DNAT)show firewall policy <ID> Verificar Roteamentoget router info routing-table all

Hi Fortinet Community,Could you please provide some guidance on the following scenario?I currently have a single IPsec VPN tunnel configured, and the accessible networks include Servers 1, 2, 3, 4, 5, and 6.I have different users who need access to specific servers only:UserA should be able to access Servers 1, 2, 3, and 4. UserB should be able to access Servers 5 and 6 only.Should I create separate firewall policies for each user while using the same IPsec tunnel, or should I create additional IPsec tunnels?I have noticed that when I create another IPsec tunnel, one of the tunnels sometimes goes down. What could be the possible causes of this issue, and what troubleshooting steps should I take?Any advice or best practices would be greatly appreciated.Thank you!

Hello, I apologize in advance if this sounds like a stupid question. I passed the NSE4 Certification Exam on June 18, 2024. I very recently heard that my certification would run out of validity if it’s 2 years old. I have to take the NSE5 Certification Exam, as I was unable to take it before, but I am unsure if my NSE4 Certification is still valid. Please let me know and thanks for your help!

Hi all, I'm rather new to FortiMail and Fortinet products. Trying to configure same wildcard cert (e.g. *.domain.com) for both Exchange and FortiMail, using an internal Windows CA. The topology of email is like: exch.domain.com > fml.domain.com > outside While HTTPS connection is cool, FortiMail keeps complaining "unsupported certificate purpose" when it receives email from the internal Exchange server (FML acts as a server in this case in terms of TLS connection). But when outside sends email into domain.com, FortiMail happily forwards it to Exchange server (FML acts as a client in this case) How do I start troubleshoot this case? If I were to use Secure TLS Profile to enforce, outbound mails would be rejected. Thanks in advance.

Hello all,we have an Exchange Hybrid setup with all our mailboxes on-prem. We need to let graph send emails via Exchange Online but we would need to relay these emails via our Fortimail appliance. So the Exchange Online environment does not send these itself without going through the Fortimail first. We found this in the cookbook:How to integrate FortiMail into Microsoft 365 | FortiMail Appliance and VM 7.4.0 | Fortinet Document LibraryAnd this technical guideline:Technical Tip: Office365 Secure Relay via FortiMail to avoid unauthorized email relay | CommunityAnd it seems like we can’t let graph talk directly to our on-prem Exchange servers:https://learn.microsoft.com/en-us/graph/hybrid-rest-support So we wondered how does the Technical Tip from fortinet make sure that we are not risking the relaying of unwanted emails. The authenticated part in the technical guideline does not apply here, no? Because our user mailboxes are all on-prem? And regarding the cookbook: our concern is that w

The FortiEMS server is running version 7.4.7, while the client version on the workstations and servers is 7.4.5.We plan to upgrade soon.In the clients' "Notifications" tab, I see many "Patching Failed" alerts.The installers were never created with the "Auto update to the Latest Patch" option enabled."Automatic Patching" is also disabled in the Vulnerability Scan settings.We never perform upgrades or patching automatically; we prefer to manage that process ourselves.So, what is triggering these "Patching Failed" alerts?Thanks

Hi,I now create additional dialup tunnels on second wan for failover, but we use ftm to get notifications during login on mobile smartphones, the config looks like:FGT (ftm-push) # show full-configuration config system ftm-push set proxy enable set interface '' set server "PUBLIC_IP_OF_WAN1" set server-port 4433 set server-cert "Fortinet_Factory" set status enableendhow to configure ftm to have it working on WAN1 and WAN2 interfaces, because If I’m trying to configure it on both wan ports I get an error: FGT (ftm-push) # set interface "port24" "port23"command parse error before 'port23'Command fail. Return code -61 

Hey guys,I'm failrly new to terraform and I was curious if fortigate managed app deployment within Azure vWAN is a good option/approach? Keeping in mind that rest of the infrastructure (vWAN, HUB/s, VNETs, NSGs, subnets..etc) is deployed using terraform, would there be any harm if NVAs are deployed manually?ps NVA deployment would be one time setup, no multiple environments (dev, prod, test) nor requirements for NVAs to be deployed more oftenEvery comment is appreciated 

I am currently trying to see the limits of Terraform in deploying configuration in Fortimanager and Fortigates. My goal is to beable to implement a webfilter on policies and install those policies and the package (FortiManager) related on the required target (Fortigate).Everything was working correctly until I added the webfilter profile. Terraform execution is working correctly. But in Fortimanager the taskfor installing the package results every time in "Error".I tried to push it using manually using the gui with the web filter profile created by terraform. There is no erro. I also tried to implement this partin Ansible and the problem is exactly the same.The module for implementing the firewall policies :resource "fortimanager_packages_firewall_policy" "tunnelInternet" {  for_each = var.InternetPolicies  scopetype = "adom"  adom      = local.get_adom_from_pkg_internet[each.key]  pkg       = each.value.pkg  name      = each.value.name  policyid  = each.value.policy_id  srcintf   = ea

Hi,I recently implemented FPAM and I have a strange behavior with all the web launching sessions.The FPAM is in a subnet dedicated.My pc is on another subnet and the internal services and external(obviously) are on other subnets.In the middle there’s a Fortigate.I have also an ACL for deny the traffic to the internal services from my pc, so I must traverse the FPAM to reach the services.I launch multiple web launching sessions to multiple sites internal and external and after so much time, I can’t define how much, I receive some ERR_CONNECTION_TIMED_OUT from random sites.If I try to reopen the site, I can no longer access it; I have to wait a long time before it starts working again.From what I've gathered so far, connections are more stable if I use the site's IP address directly instead of the FQDN, but sometimes are slowly(But at least they don't time out.)When I have the reset, the FPAM is capable of ping and resolve the destination internal or external site, seems to be a problem

We have FortiManager 7.6.7 and two FortiGates running FortiOS 7.4.11.Under Security Profiles > SSL/SSH Inspection, we have an object named “SSL-EXCEPT” with set cert-probe-failure allow, and this profile is used in several firewall policies.In FortiManager, the same object also has allow configured. However, whenever we make any change in FortiManager, it applies unset cert-probe-failure, which is preventing us from managing changes on these FortiGates through FortiManager.How can we fix this?

    If i connect S1 “Fortiswitch” to S2 “Cisco ”   Using trunk port and in trunk port I allowed VLAN 20 only on FortiGate  i create policy to route between VlAN 10 and VLAN 20 Can PC1 in VLAN 10 ping to PC2 in VLAN 20 and if yes why and if no Why ?      2. Is trunk port control traffic between different Vlan when i allowed VLAN 20 only in trunk or FortiGate will control traffic between different vlan ? 

Now i have Fortinac with version 7.6.5 Fortinac-os and i have agent is 9.4.0.93 i need to know if this is most suitable version for agent or not and if i plan to upgrade it what should i do if i made in the scan policy check latest persistent agent and i also edit the registery key of LoginDialogDisabled

In what FortiOS version did this last work? The AI chatbots of the day insist it should still work, but the CLI is a mess.I need to monitor in real time interface OSI layer1 state change (simplest of requests)What is the best replacement in in version 7.2, 7.4, 7.6? diagnose debug console timestamp enable!diagnose debug disablediagnose debug reset!diagnose debug application linkd -1 diagnose debug application netlink -1!diagnose debug duration 0diagnose debug enable! 

Hello everyone,Can anyone confirm whether FortiNAC-F fully supports (or has been successfully integrated) with the following:Aruba 1930 switches TP-Link TL-SG1016PE switches Sophos AP55C access points UniFi U6 Mesh Pro access pointsSpecifically, I’m interested in understanding:Level of support (CLI/SNMP/API… etc) Visibility and control capabilities (profiling, enforcement, VLAN assignment, etc.) Any known limitations or required workaroundsThanks in advance.

My Fortinac was integrated to Entra ID for 802.1x authentication, now i want to know can we use entra id to login to the web admin of fortinac?

Dears when the hosts in registration or quarantine vlan persistent agent can’t communicate to fortinac because can’t resolve srv record and retrieve info about fortinac ip address but it retrieves portal and i think it is default in fortinacand when i search in this file i can’t find resolution for srv record except the portal.cat /var/named/chroot/etc/domain.zone.reg cat /var/named/chroot/etc/domain.zone.remso how can resolve this problem as when i search i find that for isolation VLANs it should there is record hosted locally in the fortinac

Hi everyone,I'm running a FortiGate VM v7.6.2 in EVE-NG and I'm unable to activate the Evaluation License.EnvironmentFortiGate-VM64-KVM v7.6.2 EVE-NG Community Edition Port1 connected to Cloud1 (management network) VM Resources: 1 CPU 2 GB RAM Serial Number: FGVMEVSS0CLPWM3A What I've configuredPort1 IP: 10.136.208.183/24 Default Gateway: 10.136.208.215 Static Route:   0.0.0.0/0 via 10.136.208.215 DNS resolution appears to be working.Connectivity TestsWorking: execute ping 8.8.8.8Working: execute ping 1.1.1.1Working: execute ping google.comNot Working: execute ping forticare.comNot Working: execute ping forticloud.comLicense IssueWhen I go to:System → FortiGate VM License → Evaluation LicenseI enter my FortiCare account credentials and click OK.The GUI shows:"Requesting FortiCare Trial license, proxy:(null)"but nothing happens afterward and the license remains invalid.Current status: License Status: InvalidVM Resources: 1 CPU/1 allowed, 985 MB RAM/2048 MB allowedQuestionsDoes Forti

Hi everyone,I'm running into a frustrating issue with the Device Identification (IoT/OT detection) feature on our FortiGate. Multiple Windows laptops on our network are being incorrectly identified as Samsung Galaxy Android 5.0 devices.Because of this, FortiGate is flagging a randomly list of potential IoT/OT vulnerabilities associated with Android Lollipop, which is obviously a huge false positive (especially since no one is bringing Android 5.0 devices to the network in 2026!). Here are some key details about our environment: The affected clients are purely Windows machines. There are no Android emulators installed on these laptops. This is happening across several different devices, which rules out a simple stale DHCP IP cache/re-use issue. Checking the CLI (diagnose user device), the MAC OUI belongs to Cloud Network Technology (standard for laptop Wi-Fi adapters), not Samsung. Has anyone else encountered this specific false positive recently? Any insights on which common Wind

hi,we’ll loan a FG 100 F from our DC colo vendor to build a temporary IPSec VPN back to our HQ.this might run for 2-3 months that’s why we’ll only “rent’ the FW.my questions are:1.do i need to register the device to our FortiCloud asset?2.do i need to apply FortiFlex license for HW/OS coverage in order to use “higher” crypto protocols, i.e. AES 256, SHA 256, or do these come free?can i just skip items 1 and 2 since this is just a “loan” and temporary build?

I updated the FortiGate from FortiOS 7.6.6 to 7.6.7 and am experiencing issues with SSL inspection certificates.After the update, the firewall started dropping all traffic. Even traffic matching firewall policies without SSL inspection enabled is being dropped.As a temporary workaround, you can disable SSL inspection globally to restore connectivity.Has anyone else encountered this issue after upgrading to version 7.6.7? Is there a known bug or a recommended fix?Update:Not logging dropped packetsFirewall memory usage reaching 90%Thousands of active sessions (compared to normal levels)

Hi,I have an issue with the evaluation license of my new FortiGate v7.4.1 VM, I am trying to license my new FortiGate and I am using my account credentials to connect to the forticare server but it fails, I did some troubleshooting and I notice that I can't ping the forticare.fortinet.com but instead the service.fortiguard.net and update.fortiguard.net were pinged successfully. can you please assist me with this problem.

Environment:FortiClient VPN 7.4.3.4726 (free/standalone)SSL-VPN to remote gateway: vpn5.go.com.mt:443OS: WindowsVPN Configuration:Type: SSL-VPNPort: 443 (custom)Authentication: Prompt on loginSingle Sign On (SSO): DisabledClient Certificate: NoneIPv4/IPv6 dual-stack: DisabledIssue:When attempting to connect via SSL-VPN, the connection progress bar reaches 48% and then fails with a popup: "SSL connection is down".Credentials have been verified and reset multiple times. MFA is active and functioning correctly. VPN configuration appears correct.Errors observed in Notifications log:Too many bad login attempts. Please try again in a few minutes. (-455) — repeated multiple times throughout the dayToken denied or timeout. (-7105) — appeared earlier in the sessionWhat was already checked/tried:Password confirmed correct and reset multiple timesUsername confirmed correctMFA (token) is active and generating codes normallyVPN gateway and port (443) confirmed correctNo FortiClient EMS in use (stan

Sporadically our Fortianalyzer (7.4.9) will stop sending logs to our main syslog log collector (Is still collecting from other systems).  The “Log Insert Lag Time” will get up to 18 or so hours and keep climbing, when it should be like 20-30 seconds.   When the analyzer is rebooted, logs start to flow and the time slowly starts to normal, and everything is ok. I’ve been trying to get that value via a command line, or SNMP to feed our PRTG system to monitor when it happens before it gets out of control.  But, it seems to be allusive.  Maybe I’m missing something?  Perhaps there is another tell sign that I can look at?  Or is it a feature request?Thanks!

Hi,What's the deal with the free version of the VPN agent? According to the documentation, it should be 7.4.3.4799, but only version 7.4.3.4726 is available.What's the deal?