Unanswered questions

After upgrading our FortiGate device from FortiOS version 7.6.6 to 7.6.7, users at the branch lost internet access when the BambiDeep SSL/SSH Inspection profile (Deep Inspection) was used in the firewall rule.Traffic is allowed by the firewall rule, and NAT is working properly. However, HTTPS connections fail when Deep Inspection is enabled.As a temporary solution, we changed the SSL/SSH Inspection profile from BambiDeep (Deep Inspection) to Certificate Inspection, and internet access was immediately restored.  The first rule includes certificate inspection, and internet access works fine, but the second rule is the old one and includes “BambiDeep” SSL inspection; after the firmware upgrade, internet access is not working. Also ı tested the problem on new rule by adding  BambiDeep SSL inspection ant internet acces is not working. Are they any known issue about 7.6.7 version for tihs topic ?

Hi All,I would like to ask your help about BGP with my scenario.I have FG1 connect with some FG Spoke via MPLS and VPN tunnel. I configured BGP peer for each link with the neighbor is the ip of each link.I want to prevent FG1 advertise route learned from MPLS back to FG2 via VPN tunnel and vice versa. I tried with route map out and comminity and it work for mpls because there are separate mpls for spoke but for vpn tunnel I cant because the VPN tunnel is peering with other Spoke.Could someone advise me the solution for the scenario? 

Please tell me.Until recently, the following KB article, which describes a workaround for automatic firmware upgrades after End of Streaming (EoES), was available.However, it now displays "Access Denied." Technical Tip: Disable auto-upgrade for unlicensed FortiGateshttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Disable-auto-upgrade-for-unlicensed-FortiGates/ta-p/414696 Please tell me why it has been made private.

Hi Fortinet team,So, we are upgrading our VPN to the latest software version, and we are changing from SSL VPN to IPSEC VPN, and we are thinking to deploy it via Intune, but we have encountered failures when trying to install the package.We follow the next steps:Changed the encrypted Preshared Key inside the conf file for the actual Preshared key Create Installer.ps1 with the following command: Start-Process -FilePath "C:\Program Files\Fortinet\FortiClient\FCConfig.exe" -ArgumentList "-m vpn -f <"$ConfigFile"> -o import -i 1 -p <"ConfigPassword"> -Wait -NoNewWindow -PassThru!--scriptorendfragment-->!--scriptorstartfragment--> Inside Intune we set up detection rule for the reg key: “HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FortiClient\IPSec\Tunnels\IPSEC VPN” The weird part is that if we try running the Installer.ps1 locally/manually it works perfectly fine and it imports the conf file without issue but if we runs it via Intune, it directly says Installation Failed  Can yo

How do you transfer a call to someone’s voicemail?  In this case, a secretary has her boss’ extension programmed as a soft key on her phone so she can answer it.  A call comes in on her boss’ like, she answers, and would like to transfer it to her boss’ voicemail.  Nothing I’ve found online seems to work (I’ve read dial *9 + extension, dial **9 + extension - neither work)….  Any suggestions?

Hello everyone. We bought a Fortigate 71g (7.6.7). I have experience using OpenVPN on Mikrotik and Pfsense. It was very convenient for remote access and local DNS access. The point is, we need to provide remote access to people without providing a DNS domain and server; we bind users by IP addresses, and that was sufficient. The problem is that I can't get the IPSec Fortigate to work without providing clients with a DNS server. All requests start going through the VPN tunnel, and access to local domains and DNS is lost.Detecting the client's local DNS is not quite right. For example, OpenVPN has this block-outside-dns feature. Is there a solution?Tried:1) config vpn ipsec phase1-interface    edit "test1"        set dns-mode manual        set ipv4-dns-server1 0.0.0.0    nextend2) I tried unset ipv4-dns-server1,2,33) ipsec Mode config - manual4) in the client's config in XML:         <ipsecvpn>            <options>                <enabled>1</enabled>              

FG-80FでHA構成を構築したが、「config firewall ssh local-key」の状態がPrimaryとSecondaryで異なるのはなんで？？ #Primaryconfig firewall ssh local-key    edit "Fortinet_SSH_RSA2048"        set password ENC AAAAELE8NqYyMBgEhQ7grTfXnpgDb0j1zQrGm/aSSQ1sqReRT3VeDXYDl6GmJTfjifhoYZqMV94zwzYt3BI8Li3/XhV3YaPXywj7lf2VBcKfDSbZbTvJO/8fw2pN25HAxq6I4/cd3ZX90abcxiEdz3oQ1adKVpy/75tzDx95iKJ04o6uTMByeivFhMvKizbm2xAEE1lmMjY3dkVA        unset private-key        unset public-key        set source built-in    next #Secondaryconfig firewall ssh local-key    edit "Fortinet_SSH_RSA2048"        set password ENC AAAAELE8NqYyMBgEhQ7grTfXnpgDb0j1zQrGm/aSSQ1sqReRT3VeDXYDl6GmJTfjifhoYZqMV94zwzYt3BI8Li3/XhVKqNqqBKwoZqTJvhlyp3Zj30tjCJrI4bRFjiacIgfgGLajHp73E3BtG700kjxkxzUMlTFHFg7OPISbONaK1IoYVL17IOcl6QzL6wR9NJMnLVlmMjY3dkVA        set private-key "-----BEGIN OPENSSH PRIVATE KEY-----b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABCEPyKnpOC7AuAUn8wkg717AAAAEAAAAAEAAAEXAAAAB3NzaC1yc2EAAAADAQABAAABAQC37dLSRQBZoOb49bsDn/YVhLuGlHio5XLLl9Dzy

I am automatically updating FortiClient for Windows from version 7.4.5 to 7.4.6. On about 50% of the test computers, the installation process stops at: “Stop services.” I also tried doing it manually by running the installer file, but in that case it also gets stuck at “Stop services.” How can I work around this issue?I have updated versions 7.0.x and 7.2.x many times before and never had this problem. Now I’m updating to version 7.4.x for the first time. Has anyone had a similar issue?   

I installed FortiClient VPN 7.4.3.1736 (forticlient_vpn_7.4.3.1736_amd64.deb) on Ubuntu 24.04 using the package downloaded from the official Fortinet website.The VPN itself appears to work correctly and I can successfully connect to my VPN gateway.However, every time I start FortiClient VPN, I always receive one or more popup messages reporting conflicts or errors related to NetworkManager. The popup then asks whether I would like to upload the error report.Although the VPN is functional, these error popups appear every time the application starts, which suggests there may be a compatibility issue or a missing component.I have already tried several troubleshooting steps suggested by ChatGPT, but none of them resolved the problem.I was also told that FortiClient VPN 7.4.4 or 7.4.5 might contain fixes for Ubuntu 24.04, but I cannot find these versions on the Fortinet download site.Could anyone please advise:- Is this a known issue with FortiClient VPN 7.4.3 on Ubuntu 24.04?- Are FortiCli

Hello,According to the FortiGate Administration Guide,  https://docs.fortinet.com/document/fortigate/8.0.0/administration-guide/155426web filters are applied in this order:URL filter FortiGuard Web Filtering Web content filter Web script filter Antivirus scanningI'm confused about the last step. Antivirus is a separate security profile, not a web filtering feature. Why is it included in the web filtering order? Is this order only relevant when both Web Filter and Antivirus profiles are applied to the same policy?also i see  that:…...The FortiGate’s WAD daemon sends the URLs to FortiGuard in real-time for category determination.is that the webfilter process by wad even if it in flow or proxy mode?    

FortiOS 70G: 7.6.7FortiClient EMS-pushed IPsec SAMLSAML response successGroup claim correctUDP/4500 reaches 70GIKE proposal contains matching AES256/SHA1 and AES256/SHA256 with DH14FortiGate still returns NO_PROPOSAL_CHOSEN

I may have missed this and hope this is not a repost. In the screenshot, we have isolated a custom view of 10 mins and the graph is showing the Bytes in GB. Is this right? 

Fortigate Automation Stich is great! If you have a security fabric configured you can automate a lot of stuff. You can automate a process restart if there is high CPU or memory :) Example:     High CPU event trigger is already existing but for the memory it is called Conservative mode.    You can probably use also Playbooks if FortiAnalyzer is licensed for them or FortiManager to push a CLI script to all firewalls if you have no security fabric configured.  Posts from which I got the idea: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-restart-WAD-process-on-a-specific-day-and/ta-p/329282#M8818 https://community.fortinet.com/t5/FortiGate/Technical-Tip-Execute-a-CLI-Script-based-on-High-Memory-using/ta-p/197758 https://community.fortinet.com/t5/FortiGate/Technical-Tip-Execute-a-CLI-script-based-on-high-CPU/ta-p/195103

As someone who played with the Declarative API here are some tips and tricks. The declarative API can be used for General System settings and creating VirtualServer/RealServer/Pool objects in the default root VDOM or even in specific Vdoms for multitenant systems. You can do manual changes with GUI/CLI or REST-API and they are reflected in the Declarative API when you do GET requests. As the documentation for it is not much I am making this article. First see Does FortiADC support Declarative API for VirtualServers? | Community as I have added some useful stuff there as well. Send all specific vdom real servers and server pools in a single declaration as if not you can get an error that the declarative API is trying delete previously send realservers and pools in a previous declaration.  You can send virtualserver config in the same declarations as the real server and real server pool but the declaration needs to start with the virtual servers first or you can first send all the real s

 I have a printer located in one VLAN and a macOS laptop connected to another VLAN.The printer is connected via Ethernet, while the laptop connects through a FortiAP (Wi-Fi).As both devices are on different VLANs, the laptop fails to automatically discover the printer and displays a “Check Internet Connectivity” message. However, when I manually add the printer’s IP address, it connects successfully. There is a firewall policy to allow traffic between thoses two VLANs (Any services).It appears that the discovery packets (likely mDNS / AirPrint traffic) are not being forwarded between the two VLANs.Can you please help how to solve this issue ? 

Probably the most bizarre IT problem I've ever come across. We are in the process of migrating from Aruba to Fortinet, wired and wireless. One building has now been completely moved to FortiAPs and since day one we've been experiencing random disconnections from our WPA2-Enterprise SSID.The initial symptoms were these: out of the blue, without moving, a device would lose internet connection, showing the 'globe' in the bottom right corner (Windows), claiming to still be connected to the network, but with no internet and with an auto-assigned APIPA address.Having done A LOT of investigation, most of the time with little to no result, I have noticed that clients are very frequently re-associating (often with the same AP), sometimes failing (hence the 'disconnections'). The signal is high, APs are generally a few feet away, it happens on both 2.4 and 5Ghz. We have done a lot of tweaking, including changes recommended by Fortinet Support, which included disabling fast roaming, PMF

how is working this rule executable_windows?? FortiMail Attachment Scan Rules (executable_windows), was catched this file 1.pdf:( detected by Content Filter, filetype application/javascript filename ABC.js in file ABC2 Integration Document - Phase 1.pdf, attachment scan rule: executable_windows). but when downloaded that file to scan by Sandbox, the file was clean result?? Any one had same this problem, and was solved?

Hi everyone,I'd like to better understand, from a real-world operational perspective, which parsers you consider essential/recommended for Windows and Linux devices in FortiSIEM (7.4.x / 7.5.x), especially considering: Better security visibility Reduction of unnecessary logs Storage optimization Environment performance Better cost-benefit of event ingestion We are currently reviewing the parsers enabled across our environments and noticed that many deployments tend to enable too many parsers, generating a huge amount of events with limited operational value.Today, we are using something similar to the following:Windows: WinDHCPParser WinDNSParser WinDefATPParser OSQueryWindowsParser Linux: SyslogNGParser LinuxDHCPParser LinuxInotifyParser LinuxAuditdParser UnixParser I’d like to hear from the community: Which parsers do you consider indispensable for Windows environments? Which parsers truly add value for Linux servers? Are there any parsers you usually avoid

after Upgrading From 7.4.12 to 7.6.7 on FGT70G all users with Fortitoken Cloud cannot connect IPSEC VPN IKE2 , the only way is to remove the token.

Hello everyone,I’m encountering an issue regarding batch account creation. I am using version v2.4.1-build0468. When I create a batch of users and try to email the created credentials, the email is sent correctly, but the attached Excel file is empty. It only contains the headers ('Username', 'Password') without any actual account data.%ACCOUNTLIST% in the email template doesn't seem to work either (it's blank in the email)In "Manage Account Batches", if I "Print account" it results in an error : "Unable to print/send details! Password not found for the user".So I literally have no way to get the password of the users.Surprisingly, “Random User Account Batch” works way better. The .csv contains the passwords & “Print account” actually works… Has anybody figured out how to create account batches using a .csv file (and get the list of the login/passwords)? Thanks in advance !

Hi All,We just opgraded a few sites to FortiOS 7.6.7 on the Gates running as Wireless Controllers (VMs), and then a few FortiAP 23JK (Inroom) to FW 7.6.5.That breaks PoE Passthrough on port3.Downgrading the AP to 7.6.4 again, brings back the PoE passthrough on port3. 

Can we use forticasb solution as standalone without fortigate, sase, or others?

Hello everyone, I encountered issue where after I reload on of my core switches I lose connection to Access Switch even tho its connected redundantly to my other Core switch. This is diagram of the connection:Network diagramI am running 400F in HA cluster in Active-Passive mode. From both Fortigates I have Fortilink towards my Core switches. The switches are in MCLAG stack with Fortilink split interface disabled. We connected multiple access switches to the Core stack and they all link up correctly, they have been discovered by Switch Controller on 400F and they created the trunk interfaces towards the Core switches. (automatically)When we reload CORE1 for example we lose connection to the access switch for the time the CORE is being reloaded. We did some troubleshooting and were checking STP states on CORE2 and state of the trunks during the reload. We noticed weird thing when connected to CORE2 via CLI while CORE1 was reloading → We ran some diag commands for trunks and the trunk inf

Could you help me with a suggestion?We have a FortiGate HA setup with two ISP links. The customer wants the SSL VPN service to remain available regardless of which ISP link goes down, so that user connectivity is not impacted.One option is to configure SSL VPN access on both ISP connections. However, I have a question regarding routing behavior. If I configure two default routes for WAN1 and WAN2, with WAN1 as the preferred route, what happens when a user connects to the SSL VPN using the public IP address associated with WAN2? edit 1set dst 0.0.0.0/0set gateway <ISP1_GW>set device "wan1"set distance 10nextedit 2set dst 0.0.0.0/0set gateway <ISP2_GW>set device "wan2"set distance 20next Will the SSL VPN connection work correctly, or could there be issues due to the return traffic being routed out through the preferred WAN1 interface instead of WAN2, or it will be return via wan2 maintain symmetry.similarly., customer want to have DNAT polices for internal services to remain

I have a FortiWeb that is used for our QA environment that is not exposed to the internet.   I need to be able to manage certificates on it automatically to avoid having to manually replace them every month as the lifecycle shortens.   DNS-01 is completely manual so that's out.   I tried HTTP-01 using an internal private ACME server, but the Fortiweb rejects the certificate when making the https request to the ACME server because it is signed by our internal CA. Does anyone have a method they are happy with for managing certificates in this situation?