Fortinet Community

I met an experienced network engineer/executive recently in the financial sector and he said he would never use Fortinet firewalls due to the amount of CVE's. As a long time Fortinet customer, I'd love to hear your thoughts. 

Is there a way to see wich users are attached to a certain invitation code?In our EMS under endpoints, we see two invitation codes:We would like to see wich 10 users are using the bottom invitation code. I can't seem to figure out where. Is this possible? If so, can someone point me in the right direction?Thanks in advance.

Hello, I'm testing how to bypass web filtering using a browser in portable mode, for example, with the Brave browser. The plugin is therefore not installed. The "DNS Cache" function in the settings is not enabled. To facilitate testing.   I found several accessible adult or piracy sites. I'm use Forticlient 7.4.4.1887 - Feature   Example with www[.]playboy[.]fr   Have you encountered the same problem, and have you found a solution on your end?   Thank you in advance.    

I want to block Quick because I see a user is generating a lot of UDP 443 traffic. I blocked Quick from the Application Control, but I'm still seeing traffic. How can I block this traffic? I have a FortiGate 120g, Fortios 7.4.9..  I detected that the user is connecting to a VPN... how do I block that? In Wazuh, I seeVPN/TOR processes:    27    284010best regards

Hi everyone,Great to be part of this community. I'm looking for technical guidance on a FortiMail mailbox licensing and RAV (Recipient Address Verification) issue.ScenarioWe have a FortiMail deployment licensed for 1200 mailboxes, but the system reports that the mailbox count has been exceeded.Observed behavior:Groups, distribution lists, and aliases are being counted as individual mailboxesRelay-only addresses (non-existent local mailboxes) are also counted due to RCPT TO verification is not rejecting invalid recipients, even though Recipient Address Verification is configured for SMTP Server VerificationNo Access Profiles are applied on policiesI found this community post discussing 'Recipient Address Verification' and 'Automatic Removal of Invalid Quarantine Accounts' for exceeding mailbox count: Link Environment DetailsDownstream mail systems: O365 and Zoho, ( Cloud Tenants ) Inbound mail flow:Internet → FortiMail → O365 → ZohoO365 is configured as an Internal RelayI

 Hello,I have configured two firewall policies on Fortigate running on 7.2.10,build1706Policy 1: Blocks all malicious traffic using the Fortigate Internet Service Database.Policy 2: Allows traffic required to access specific destination public IPs.The issue I’m facing is that:All traffic matching the destination public IP is hitting Policy 2 directly.Traffic only hits Policy 1 if there is no NAT IP match.It seems that the destination public IP traffic bypasses the malicious traffic block in Policy 1 and goes straight to Policy 2.Questions:• Is this expected Fortigate behavior due to policy order or NAT configuration?• How can I ensure that malicious traffic is always blocked by Policy 1 before being allowed by Policy 2?• Do I need to adjust policy sequence, NAT rules, or apply security profiles differently?Any guidance or best practices would be appreciated.Thanks in advance!Below are the details vip.srv.LbrUat 198.184.54.58 --> 172.16.28.58vip.srv.LbrVpn 198.184.54.5

I have been successfully using the Forticlient VPN for some time now. Today I upgraded to the latest version and since then I have been receiving the following error. I have uninstalled, reinstalled, added the latest MS C++ redistributables and am still getting this error. Any suggestions? 

Hello team!!! I have the following issue:We have many Fortigates in many different places, some Fortigates have a L2TP/IPsec VPN, which I can connect ussing the Windows native client, and anothers Fortigates have an IPsec VPN, which I can connect through FortiClient VPN.I have FortiClient VPN 7.4.1.1736 in my Windows.When I restart my computer, I can connect to any VPN, but after connect and disconnect to any IPsec VPN with FortiClient, I cannot connect to any L2TP/IPsec VPN, until I restart the computer again.Do you know how can I solve the issue or any workaround? Thanks in advance.Regards,Damián

Hello, I deployed Forticlients to hosts via Forticlient EMS Cloud. EMS is connected to domain and user are being verified against EntraID so when I deploy msi file from Intune and run the install script the EMS and VPN connects automatically. Issue comes after I log off from windows user to different account (for example maintanance or admin account for the host/station). The EMS disconnects and doesn't automatically connect again and I need to insert the invitation code to connect it again. Also noting that the issue is not persistent and when troubleshooting sometimes the telemetry connection stayed after switching user to Local Admin and sometimes it just disconnects. We are running Forticlient EMS cloud and deployed Forticlient is 7.4.3 I stumbled upon some older forum and reddit posts kinda describing the same issue but there wasn't any specific fix or explanation. Thank you for any help    

Hi All I just came across a strange issue regarding the Forticlient running on a Windows 10 machine. First some quick background info: Our client as a 200D cluster and several 3rd parties VPN in to their network to administer various systems. The problem with this is troubleshooting is a bit of an issue as we (In this case) need to try and get on to one of these 3rd part machines. Anyway, this particular 3rd party user fires up the Forticlient app (Or webmode VPN) and initiates an SSL VPN connection. The VPN connections no problem, I can see the user connected under VPN->Monitor->SSL VPN. The problem is that no connections to our clients internal network are possible. A simple ping for example just times out. This is where things get a bit more strange... If I try the same (Or any other) vpn account from my own machine, everything works 100%. What's more is if a do a diag debug flow trace, I can see the traffic being allowed be the relevant poli

On a setup that I have is configured to an SSL tunnel vpn for some of the company internal apps. The website and apps can be accessed via various devices once forticlient configured. Lately on iOS the vpn configured and connection is established but the apps are not accessible via any browser safari or chrome. But on android the same configuration but apps accessible. Can help with any insights to make it workon ios.

I want to capture the packets of network interface on Fortigate firewall. Still, I found the function packet capture missed(see photo below). How do I solve the problem? 

Hi there, how can I do the following to increase the security in using a PAM solution?Given is a web launcher target that is only accessable via FPA - so far, this is good. But I want to assure that the login at the target is only made possible via FPA proxy connection with specific credentials.Actually I can use the FPA web filler via browser addon on the target in the login mask - but (now that the connection to the target is possible due to the proxied way started from FortiPAM) I couls also enter any other credentials (as the first login attempt as well as after logging off after using the FPA credential way) ...So I think there is a gap because herewith it is not possible to assure that no other credentials will be tried out or any full superadmin / root access can be made via this connection.I searched for any options and tested with template modifications (web filler attributes) but did not get any successfull behaviour for this. Hoping that this is even possible in FortiPA

Hello everyone, hello experts.I'm currently having an issue with activating an EZVIZ camera. The activation fails and the logs show a 'no session matched' error. I've tried several different methods, but none of them worked.Is there any way to resolve this issue completely, and which configuration steps should I pay attention to? Does using SD-WAN affect this, and what can I do to allow it?Thanks you so much!id=65308 trace_id=430 func=fw_forward_dirty_handler line=401 msg="no session matched"   

I've been reading fortigate secure sd-wan admin guide and other contents on overlays and they all or mostly recommend to use BGP as the routing protocol between sites. I only have 3 sites (hub and spokes) in same country communicating via an ipsec tunnel and I feel like BGP is for big companies with multiple sites accross the globe and does not apply to my case. I was inclined to use OSPF, and the tunnels will be in area O. What do you think? 

I have taken the certification exam and failed as the questions and answers i had were wrong some of them, does anyone know where i can check the answers or where is a reliable place to buy the answers?

Is it possible to block the Instagram app without having to block the entire QUIC protocol? I also can't enable "deep-inspection" because it will cause certificate errors for users (FortiOS 7.4.8).

Hello,I need to migrate the configuration of a Palo Alto firewall to a FortiNet firewall.Could you tell me if there is a tool available to perform this migration and if it is free?Thank you.

OS: LinuxKernel: 6.9.3FortiClient VPN Version: 7.4.0.1636I have been connecting to this network for months, this morning when trying to connect I had this on my console output Create VPN network interface failedNow the usual way of connection just does not work. Here are my log outputs:sslvpn.log 20240614 14:13:09.997 TZ=+0100 [sslvpn:INFO] main:1817 Init 20240614 14:13:09.000 TZ=+0100 [sslvpn:INFO] main:622 Load profile: eicon 20240614 14:13:09.002 TZ=+0100 [sslvpn:DEBG] main:631 Inherit local DNS: No 20240614 14:13:09.002 TZ=+0100 [sslvpn:DEBG] main:644 DNS service resetting interval: 0 20240614 14:13:09.002 TZ=+0100 [sslvpn:INFO] main:329 Get DBUS session bus address 20240614 14:13:10.004 TZ=+0100 [sslvpn:DEBG] main:333 Failed to find DBUS session bus address in dbus-daemon, try to find in dbus-broker 20240614 14:13:10.005 TZ=+0100 [sslvpn:DEBG] main:393 get passwd: true, get cert passwd: false, get user input: false 20240614 14:13:10.018 TZ=+0100 [sslvpn:INFO] main:329 Ge

We have multiple users reporting extreme slowness when opening files from a file server. This seems to have started when we upgraded FortiEDR to 5.2.8.41 last Wednesday. We were also upgraded to 7.2 backend this Sunday.  I ran some tests on my machine to rule out the network. With FortiEDR enabled on both my machine and the file server a 13 MB .pdf takes 10 seconds to open. When disabling FortiEDR on my (client) machine the time to open is only a second. We see similar behavior on other machines/file servers.  Anyone having similar issues?

Hi all, I'm configuring my 70G on 7.2.12. I'm trying to setup a Virtual Server with load balancing and offloading a certificate via Lets Encrypt.  via "diagnose sniffer packet any "host [client ip redacted]" I can see the traffic arriving on the wan1 interface. But without any response. I setup debug flow like so: diagnose debug console timestamp enablediagnose debug flow show iprope enablediagnose debug flow show function-name enablediagnose debug flow trace start 100diagnose debug flow filter addr [client ip redacted] But requests to the virtual server don't generate any debug flow output. the Virtual Server:FortiGate-70G # diagnose firewall vip realserver listalloc=2------------------------------vf=0 name=[the website name].com/1 class=4 type=1 [endpoint IP redacted]:(443-443), protocol=6total=1 alive=1 power=1 ptr=332816741ip=192.168.9.11-192.168.9.11/2283 adm_status=0 holddown_interval=300 max_connections=0 weight=1 option=01alive=1 total=1 enable=00000001

Hello, I am planning on using the fortiap 433g for a warehouse. I want to use 3rd party antennas,Ventev M6060060D4D3620FP and Ventev M6060060MO1D43620 Does anyone have experience with these antennas? Are they compatible with the 433G? Thanks,

Hi,I need help troubleshooting a FortiClient VPN issue on my Windows 11 laptop.Problem SummaryWhen I click Connect in FortiClient VPN (v7.4.3.1790), the Connect button immediately changes to Disconnect, but the VPN never actually connects.No “Connecting…” animation, no delay, no status messages.Even if I enter a wrong password, the behavior is the same — Connect → Disconnect button appears immediately, but no error is shown.The same VPN credentials work on my colleague’s laptop, so the issue is specific to my system.

I'd like to use FAC's TACACS+ service. Users will be pulled in from EntraID via SAML. Of course Entra has MFA via MA Authenticator.What happens in this scenario ? FAC couldn't broker Entra's MFA right ? Would I need Fortitokens in this case to do MFA ? Don

I have advpn shortcut from spoke1 to spoke2 and 3 link connections.If i traceroute from spoke1 to spoke 2 i got below path FW01 (Internet) # execute traceroute-options source 10.10.112.2FW01 (Internet) # execute traceroute 10.101.62.1traceroute to 10.101.62.1 (10.101.62.1), 32 hops max, 3 probe packets per hop, 84 byte packets1 10.10.112.1 4.026 ms 4.149 ms 6.013 ms (hub ip)2 10.10.112.3 9.931 ms 10.167 ms 9.969 ms (spoke tunnel ip)3 10.101.62.1 10.194 ms 11.533 ms 10.212 ms (endpoint) FW01 (Internet) # execute traceroute-options source 10.10.111.2FW01 (Internet) # execute traceroute 10.101.62.1traceroute to 10.101.62.1 (10.101.62.1), 32 hops max, 3 probe packets per hop, 84 byte packets1 10.10.111.1 2.554 ms 3.221 ms 3.834 ms (hub ip)2 10.10.111.3 12.219 ms 16.811 ms 13.925 ms (spoke tunnel ip)3 10.101.62.1 18.478 ms 17.462 ms 16.482 ms  (endpoint) FW01 (Internet) # execute traceroute-options source 10.103.113.2FW01 (Internet) # execute traceroute 10.101.