Fortinet Community

Hi,  I blocked the Social Networking category on the firewall but attempted to exempt one specific site, facebook.com, by adding it to the static URL filter with the action set to Exempt. While this allowed the main site to load, certain elements such as logos and images were still blocked.Upon reviewing the logs, I discovered that Facebook relies on additional content delivery domains (e.g., static.xx.fbcdn.net) to fully render the site. Since these dependent URLs were not included in the exemption, they were automatically blocked by the firewall. After explicitly allowing these domains, the website loaded correctly and became fully functional.The challenge is that the firewall’s static URL filter does not automatically recognize or exempt dependent domains when the primary domain is allowed. Each supporting domain must be manually identified and added to the exemption list. Is there any way we can do this so the firewall automatically recognize it and allow ?

i am using macOS sequioa 15 and when trying to install forticlient vpn, faced issue and can't proceed downloading window takes too much time in downloading then got the error can't connect to update server 

Hi EMS adminsFortiEMS 7.4.4, FortiOS 7.4.8.Knowing that, starting from FortiOS 7.4.x, ZTNA gateway info and 2TNA apps are imported by EMS from FGT automatically.The issue comes when my FGT is behind NAT, so my FGT WAN interface has a private IP.So when I configure ZTNA server on my FGT it must have the private IP of the interface, like shown below.  The when imported automatically bu EMS, the gateway IP is the same, and it is pushed to clients as is.So when off-fabric client's want to access a ZTNA app they us this private IP, which is not possible because they are off-fabric.(In scenarios where the public IP is on the WAN interface all works fine).To resolve my issue I had to manually recreate the ZTNA gateway and all ZTNA apps on EMS, which is lot of work to do just because of this IP address, because imported gateway and apps are not editable on EMS.Do you know any simpler way to resolve it? Like is there a way to keep the auto imported info and just replace the gateway IP

Hello I have forticlient free version When connect to vpn session by my credentials if I lock screen or switch user my session still be opened.Is there a way to terminate the session when lock screen or switch user.Be noted that it is free version from forticlient agent 

The scenario:1. I have a web application installed on my server, which is on IP 192.168.31.68 and the application is accessible on local network through link https://192.168.31.68/U_GEAR.2. I have FotiGate 40F firewall who WAN is connected to Internet (as well as on company LAN basically) and has IP 192.168.31.193.3. I do not have a static IP. I want to access this web application (which is an ERP) on an external network. How can I achieve this using the current system? The constraint remains that cannot change the IP configuration of the Server or the other ports in the company. Someone from the ERP team asked to use VPN and enter local network. However, I do not have any idea on how can this be achieved.

I want to understand the concept of Parallel Path Processing (Life of a Packet) for each version. I want to understand how Parallel Path Processing (Life of a Packet) behaves across different versions. Specifically, I’m curious whether it remains consistent across all parent versions or if it changes from one version to another.Unfortunately, I haven’t been able to find proper documentation specifically addressing Parallel Path Processing (Life of a Packet) for versions 7.2.x or 7.4.x. The only documents I’ve come across are for versions 6.0.4 and 6.0.6

Hi,I have 2 firewall rules, if the computer is in "open group", there is no problem, They are working with rule 94. But a computer that is not in the group cannot use rule 95. If I disable rule 94, everyone is working.I don't have this problem with my other firewalls.Thank you 1)edit 94set srcintf "CLIENT"set dstintf "virtual-wan-link"set action acceptset srcaddr "all"set dstaddr "all"set schedule "always"set service "ALL"set ssl-ssh-profile "no-inspection2"set logtraffic allset nat enableset groups "Open Group"nextend 2)edit 95set srcintf "CLIENT"set dstintf "virtual-wan-link"set action acceptset srcaddr "all"set dstaddr "all"set schedule "always"set service "ALL"set utm-status enableset ssl-ssh-profile "certificate-inspection"set av-profile "default"set webfilter-profile "default"set ips-sensor "default"set application-list "default"set logtraffic allset nat enable

So I know how to create an automation stitch and configure it to send email when triggered.I need to configure a trigger on a specific task, which I can't find a specific trigger for, and can't find a trigger that I can customize to perform what I want.I need a trigger that will send an email when a certain deny policy is used. All that I can find is the general traffic violation, which will trigger every deny policy that is present on Fortigate, while I just need the trigger to work when a certain policy is used, not all policies.Is this doable on Fortigate, and if not, is there any work around to do the same function?FortiGate

Hi, can someone please let me know what the latest firmware version is for Fortigate60F? I have Version v7.0.13 build0566 (Mature)thank you!

Hey guys! just wanted to share I passed my FG Admin exam on my first attempt. Not gonna lie, there was a few tricky questions but it was sort of check the possible answers and check which ones matches best.Now I am going to aim for the FortiManager one to be, hopefully FCP certified.Any advice on those who've taken FMG exam, would be greatly appreciated!Thanks guys!

Hello Fortinet Community,I am trying to implement cumulative traffic quotas per IP on a FortiGate device. The goal is to:Limit each server or IP to 6 TB per month.After reaching 6 TB, throttle traffic to 15 Mbps.Reset quotas automatically at the start of each month.I understand from Fortinet TAC that FortiGate does not natively support data-volume-based traffic shaping over a time period. I have explored web-filter quotas, but they are daily, category-specific, and require proxy mode, which is not suitable for our use case.My question is:Is it possible to achieve this using Forti Analyzer automation or event handlers?If yes, can someone provide guidance or example configurations?Are there any recommended best practices or workarounds to enforce per-IP monthly data quotas?Note: FortiGate Version is 7.4.8 and so is FAZ.Thank you in advance for any advice or guidance.Best regards,

impress me.sell me! 

any reason that you'd put a 30e between the modem and the 101f???? i'm new to this manufacturer 

I have a Fortigate, a remote Microsoft NPS server with an Azure AD extension.  Azure AD MFA is enabled.  The goal is to use my AD domain credentials as an admin on my firewalls and use the same MFA as I use for Microsoft 365.I followed the instructions here: https://kb.fortinet.com/kb/viewContent.do?externalId=FD36127If I have the Microsoft Authenticator app pulled up and open, I get my authentication push and it works just fine.  However, if my phone is locked and I am not in the app, buy the time I unlock my phone, open the app, get the prompt, the Fortigate authentication fails.  The timing is right around 15 - 20 seconds. Debug logs indicate some kind of a timeout, but I cannot find where.  If test with others systems like a Remote Access Gateway, I don't have this issue.  I have attached some notes.

I am preparing to update our Fortigate 100F and when I run the command >diagnose sys flash list<enter> I see that there are 2 partitions with different versions. It is my understanding that when an upgrade is initiated the secondary partition will get the upgrade and become the new primary partiton after the upgrade.  My question is: How can I update the now ... secondary partition ...  so that both partitions have the same version? Can someone explain to me how the upgrade process works?  If I have to update a couple of versions to get to the desired version and the upgrade always goes to the alternate partition which had the older version.. how does that work?  Or does the version upgrade always upgrade the primary partition?My concern is what if the primary partition is no longer bootable and the Fortigate reverts to the secondary partition and t is at a earlier version?  I would prefer to upgrade the fortigate then after 3 months upg

Hello team!!! I have the following issue:We have many Fortigates in many different places, some Fortigates have a L2TP/IPsec VPN, which I can connect ussing the Windows native client, and anothers Fortigates have an IPsec VPN, which I can connect through FortiClient VPN.I have FortiClient VPN 7.4.3 in my Windows.When I restart my computer, I can connect to any VPN, but after connect and disconnect to any IPsec VPN with FortiClient, I cannot connect to any L2TP/IPsec VPN, until I restart the computer again.The same with 7.4.1A co-worker installed also 7.4.3 in his computer (Different computer and user, of course) and get the same issue.I cannot use 7.4.4 because we still have many IKEv1 IPsec VPNsIs there a way to workaround or solve this issue instead of restarting the computer?As this is happening in more than one computer, I think this is a bug in FC 7.4.1-7.4.3 Thanks in advance.Regards,Damián

HiWe have a Fortigate that is managed by Fortimanager. We want to block the large number of random IPs that are attempting to login to our SSL VPN.I have created an automation stitch to dynamically create address objects and put these in to an address group, which is then referenced in the local-in policy. The local-in policy is created on Fortimanager because if it was create locally on the Fortigate, it would get overwritten. I now have a similar issue with the address objects and group created by the automation stitch. Each time I install policy, it overwrites the group and removes the address objects, since these don't exist on Fortimanager.  So, is it possible to prevent local address objects from getting overwritten by Fortimanager? If so, how do I do this? ThanksRoy

I wanted to connect a FortiManager with pxGrid ISE according to the following Installation Guide: https://docs.fortinet.com/document/fortimanager/7.4.2/administration-guide/466394/creating-cisco-pxgrid-connectors We have uploaded the certificate in FortiManager and created the pxGrid Connector under Fabric Connectors. The FortiManager is also already listed on the ISE server. But when I go to External Connectors -> the pxGrid Connector Apply & Refresh I get 2 errors (see screenshots). Does someone know what could be the reason for this error? In addition, the screenshots in the Administration Guide show an older software version of the Manager and the extra function "Single Sign On" is no longer available on the Manager V.6 & V7. Thank You  

I have recently setup syslog logging from us to Crowdstrike, I would like some ways to view the logs and do query's 

Hello,Very happy with the ForitClient VPN for the purpose of remote desktop to my office computer.Lately, after updating the Client to version 7.0.1.0083 , I noticed that every time I leave my PC for few minutes (making me some coffee) when I return the VPN is disconnected. This is something new that didn't occur while using the previous version.I attach a logfile with few occurrences of disconnection. Basically what I see in the log file is:10/1/2021 10:17:33 AM error sslvpn FortiSslvpn: 36320: error: poll_send_ssl ->SSL_get_error(): 5, try:1 10/1/2021 10:17:33 AM error sslvpn FortiSslvpn: 36320: error: poll_send_ssl -> [style="background-color: #ffff00;"]WSAGetLastError():2745[/style], try:1 10/1/2021 10:17:33 AM error sslvpn FortiSslvpn: 36320: error: poll_send_ssl ->data size: 51, try:1 10/1/2021 10:17:33 AM error sslvpn FortiSslvpn: 36320: [handle_driver_read_event]: error: poll_send 10/1/2021 10:17:35 AM info sslvpn FortiSslvpn: 26580: Ras: connection to fortissl te

Hello, Our FortiAuthenticator HTTPS certificate is close to expiring, and I would like to know what the impact would be if we continue using the expired certificate. Our FortiAuthenticator manages WiFi access and VPN MFA tokens. Thank you.

Hello Team, I have a customer with a firewall policy that grants access to the internet based on membership in an AD Group.The policy works fine except for when a user logs into their PC before connecting to the wifi - in this case the user connects to the network but Fortigate doesn't grant access to the Internet until the user locks and unlock their machine; sometimes the user doesn't even notice for an hour if they just check internal systems. Is this working as intended or is there a way of checking the membership even after the first login? thanks in advanceF.

I have a problem when i try to up a IPSec VPN deployed from EMS Forticlient 7.4.4 on PC Core I3.I have 2 PCVPN Type: IPSec IKE V2 Deployed by EMS.i5 13420H 24GB RAM -> VPN get up easy and fast.I3 10110U 12GB RAM -> VPN Never get up.  The two PC have the same configuration de VPN IPSec. I Can't get log information because its empty, not save the IPSec VPN logs. 

Hi everyone,Our system uses Collector and DCagent for authentication.My problem is when clients change networks (for example, from wired to Wi-Fi or to a different subnet), they lose their authentication.The root cause is that, as I investigated, after changing the network, DHCP could not request to delete the PTR record from the old subnet, so sometimes DCagent still picked those old records for the IP/hostname sent to the collector, and it took a long time to get the right DNS record.As I know, DHCP servers do not perform request updates/deletes for the reverse zone to delete old PTR records because the new IP is in a new zone subnet, and they keep the old PTR record until scavenging does the work.How to fix this problem? Are there any options to prevent DCagent from picking the PTR record?  

How Attackers Masquerade and Abuse Digital Signatures in DLL Side-Loading   By: Dor Neemani and Dan Antonov   Overview DLL side-loading is a long-standing technique leveraged by threat actors to execute malicious code under the context of trusted, digitally signed binaries. By abusing the Windows DLL search order, attackers can trick legitimate executables into loading their own malicious libraries instead of the intended system DLLs. This allows execution to appear legitimate and often bypasses application whitelisting, EDR heuristics, and user suspicion.   Infection Chain The attack chain began with a phishing email linking to what appeared to be a .docx document. The downloaded “docx” was actually a ZIP archive containing multiple files, several flagged as Hidden and System. After extraction, these files remain invisible in File Explorer unless the user enables “Show protected operating system files”. This simple trick conceals the malicious components from casual ins