Fortinet Community

As more organizations transition to cloud-native architectures and container-based deployments, maintaining strong security becomes a critical priority. The dynamic and distributed nature of these environments brings unique risks that demand a comprehensive and adaptive security approach. Fortinet delivers a robust portfolio of tools tailored to meet these challenges offering deep visibility, granular control, and end-to-end protection across your cloud ecosystem. In this article, we’ll highlight essential areas of cloud security, such as source code and container vulnerability scanning, security best practices for Oracle Kubernetes Engine (OKE), and advanced FortiCNAPP features for Kubernetes workloads. We’ll also examine the role of FortiGate in monitoring outbound traffic and how FortiWeb Ingress Controller safeguards external-facing services. By implementing these strategies and leveraging Fortinet’s integrated solutions, organizations can significantly improve the security and res

Dear all, I want to know for the sake of knowledge as i have to implement this scenario at my small office. How can I manage two fortisw (LAN and Internet facing Fortisw) from single fortigate firewall.  Can I manage using this diagram.  

hi,i recently migrated from ASA to FGT and received complaints that HTTPS traffic is very "slow".when i moved back to ASA, it works fine.i suspect there's an issue in MTU or TCP MSS or both along the path.1) can someone advise what is the "optimum" value for MTU and TCP MSS?2) is there a way to know/test this from client machine?3) should i set either one or both to 1400 or 1300 to avoid "slowness" issue? config system interfaceedit "wan" set mtu-override enable <<< DO I NEED TO ADD THIS? set mtu <MTU Value> set tcp-mss <MSS Value> next edit "lan" set mtu-override enable <<< DO I NEED TO ADD THIS? set mtu <MTU Value> set tcp-mss <MSS Value>  

Hey guys, I'm trying to get an IPsec VPN working for a client since their new FortiOS firmware dropped SSL-VPN support.Here's the problem: The very first time I built the IPsec VPN, it looked like it connected, but I couldn't actually get to the internet or my DNS server through the FortiGate. Thinking it was a glitch, I ended up deleting it, re-making it, and deleting it a few times. Now I'm getting this persistent error when I try to set it up:"Unable to setup VPN. The rollback process has encountered an error. Orphaned objects may still exist in the configuration database." I've made sure to clean up everything after deleting the VPN each time – references, static routes, firewall policies, address – but this "orphaned objects" error just won't go away. Has anyone seen this before or know how to fix it? Any help would be awesome

Hi All,Good Day.  I have some issues with FSSO where it is not hitting the firewall policy and traffic is getting denied.  My setup:- I have a  DC agent installed on the DC server itself. - A collector server (Separate)- TS Agent installed on Citrix.  Issue:When user logs in to the Citrix, the TS agent is able to get the port and the username/IP and send it to the Fortigate.I can see the user authentication on the Fortigate User Auth page but the rule is not hitting as the user ID is not a match. I have got a TAC case raised but not much help as they could not find the fault.I am seeking assistance from the community to see if there is anytone can help and guide me to the right direction.  I am have configured TS server to connect to the CA via Secure Connection on port 8003.Appreciate any help that you can provide/share.Similar issues to what is described here:https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-TS-Agen

Hello. We are getting ready to migrate to a new Fortigate 101F. Our current device is a Fortigage 101E.  The version of FortiOS installed on the new device is 7.2.8. Should I upgrade to 7.2.11 or go to the latest 7.4 release. We are currently running 6.4.16 on the 101E.

In the Fortigate, WiFi & Switch Controller > FortiSwitch VLANs, I have assigned different colors to each VLAN.For my FortiGate 100F that is still running v7.4.7, those VLAN colors carry over to the WiFi & Switch Controller > FortiSwitch Ports in the Native VLAN and Allowed VLANs columns.But on my FortiGate 100F that is running v7.4.8, the Native VLAN and Allowed VLANs columns show the same port icon color for every VLAN.Anyone aware of a setting I've overlooked that controls whether or not to show the VLAN colors on the FortiSwitch Ports list? Switching to the Faceplates view, the port icons are colored to match the Native VLAN. But I'd really like to get back the color coding for the Ports list view.Thanks!

Good morning, Got a weird problem that shouldn't be a problem regarding Fortivoice and the Fortifones.  We have about 10 employees that have two phone numbers (one for each company they represent) and for some reason they can't be assigned to a phone. Example: Mike has the phone number xxx-xx-xxxx for company A and it's assigned to extension 3000Mike has the phone number yyy-yyy-yyyy for company B and it's assigned to extension 3001Mike has a Fortifone FON-280B on his desk.  It has 4 buttons along the right side.Mike would like the 1st button be for the xxx-xx-xxxx number for company AMike would like the 2nd button be for the yyy-yyy-yyyy number for company B Our 3rd party implementation team has having issues with it and/or the Fortinet support either isn't understanding or it's not possible.  I should note that I don't have admin access to the system but any suggestions offered I'll pass along. I mean, It's not rocket science.  Our old pho

Hi all,One of our customer is currently managing Fortigate device using FortiManager. The Firewall has VDOM activated. On the firewall, I created one admin user (with prof_admin admin profile, so RW access) to allow management of one VDOM only (root). When the admin user connects to the Fortigate, it receives a prompt that 'This FortiGate is currently managed by a FortiManager device' but the Login Read-Write button is missing. So the admin user has only read access even if the prof_admin (RW access) is assign to him...What can I do to solve this problem ??Regards,HA

Hi There,I have 40F running 7.2I have Site2Site IPSEC VPN Running.I have added to to Phase 2 the Subnet that is used for the Remote Access SSL-VPN users (172.16.255.0/24).over the split tunnel - I've added the subnets that are in the remote S2S Firewall (because these are the relevant subnets).I've added a rule over the firewall - do I need to set anything else ?here is the configuration I've used:config firewall policyedit 26set name "POD1"set srcintf "ssl.root"set dstintf "S2SVPN"set action acceptset srcaddr "SSL VPN"set dstaddr "POD1"set schedule "always"set service "ALL"set users "pod1"nextend config vpn ssl settingsset servercert "SSL-VPN"set tunnel-ip-pools "SSL VPN"set source-interface "wan"set source-address "all"set source-address6 "all"set default-portal "SSL_VPN"config authentication-ruleedit 1set groups "VPN_USERS"set portal "SSL_VPN"nextendend config vpn ssl web portaledit "SSL_VPN"set tunnel-mode enableset web-mode enableset limit-user-logins enableset save-pass

There is vulnerability find in Fortidevsec tool. We verified with developers, as they are saying there is no possible to inject in logger. Hence they are saying false positive. Is it possible to false positive? what are the things to verify in the code level?

Hello,I have the following question regarding the SSL inspection process performed by Fortigate, specifically the options below:I'm trying to understand the order in which these options are analyzed. I understand that a verification flow must be followed, and my current understanding is as follows: My Logic:It all starts with cert-probe-failure.cert-probe-failure = Couldn't get the certificate, so it stops here and takes a block or allow action. If successful, continue >>cert-validation = Opens the certificate and checks CA, revocation, expiration, and SNI.According to the information obtained from cert-validation, it will perform the actions set below:sni-server-cert-check = enable (I understand this check already occurs in cert-validation)revoked = allow or dropexpired = allow or dropuntrusted = allow or dropI'm a little confused about these checks. I read in the documentation that cert-probe-failure alreadyperforms validations that other options do, such as untrusted cert

Is it possible to get FortiGate to use USB-tethering of an android smartphone instead of a real USB LTE modem  for  the WWAN connection? cdc_ncm driver is loaded, good T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480  MxCh= 0D:  Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1P:  Vendor=18d1 ProdID=4eeb Rev= 5.10S:  Manufacturer=GoogleS:  Product=Pixel 6aS:  SerialNumber=0123456789012C:* #Ifs= 2 Cfg#= 1 Atr=80 MxPwr=500mAA:  FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0d Prot=00I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0d Prot=00 Driver=cdc_ncmE:  Ad=82(I) Atr=03(Int.) MxPS=  16 Ivl=32msI:  If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncmI:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncmE:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0msE:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0msgw # show system lte-modemconfig system lte-modemset status enableendgw #

I am trying to use the ice=1 parameter in identifying the remote gateway. The examples on the support portal all use html formatting (https://remote.company.org?ice=1). When I attempt to use the html formatting as the gateway address, setup reports that this is not an address. If I use the format "remote.company.org" I get the vpn up. If I add the ...?ice=1" setup again rejects the address. I am getting a cert, but want this for now. Thanks!   

Hello, I have set up a firewall policy to test our FSSO functionality. I have noticed that when the FSSO group corresponds to a user DN it works fine, however, if it corresponds to a Global Security group, it does not work. Below is the firewall policy: show firewall policy *** config firewall policy edit *** set name "TestFSSO" set uuid f44e2db6-3fe8-51f0-****-6d00*****3be set srcintf "lan" set dstintf "wan1" set action accept set srcaddr "all" set dstaddr "all" set schedule "always" set service "ALL" set utm-status enable set inspection-mode proxy set profile-protocol-options "custom-default" set ssl-ssh-profile "certificate-inspection" set av-profile "default" set webfilter-profile "Default" set dnsfilter-profile "default" set ips-sensor "Default" set application-list "Default" set logtraffic all set nat en

Today, all of a sudden 100+ clients reported W32/Tedy.7918!tr malware in C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe. The definition was just updated today and it may be a false positive, but I want to verify if the alert is legit. Did anyone have the same issue and what would be best practice to verify this alert?Thanks,Markus

Can anyone help me with the definitions of the services that run on the FortiGates? I think this would be highly helpful to those of us who are watching high memory or cpu utilization on a specific service but cannot correlate it to anything. Specifically I' m trying to figure out what the " scanunitd" service is/does. Here' s a partial list of the services I have seen, some of them are obviously self-explanatory: Self-Explanatory: thttp.........................http daemon ipsengine......................... ips engine hasync......................... ha sync service pop3......................... pop3 service smtp ......................... smtp service cli .........................cli service hatalk ......................... ha talk service httpsd .........................https daemon sshd .........................ssh daemon authd .........................authentication daemon alertmail .........................mail alerts urlfilter .........................

Hi,I was so hyped that arm version of FortiClient was finally released and asked network admin to send me FortiClientVPNSetup_7.4.3.1790_ARM64.exe , but installation always fails :( Installation log where it fails:1: [20:09:47]: FCSetupWx: __cb_find_fortidrv_inf_file searching C:\WINDOWS\inf\oem99.inf 1: [20:09:47]: FCSetupWx: __cb_find_fortidrv_inf_file find result = 0 1: [20:09:47]: FCSetupWx: __is_fortidrv_installed(),found=0, retval=0 1: [20:09:48]: FCSetupWx: HrInstallNetComponent failed (0) (err=800F0235) 1: [20:09:49]: FCSetupWx: HrInstallNetComponent failed (1) (err=800F0235) 1: [20:09:51]: FCSetupWx: HrInstallNetComponent failed (2) (err=800F0235) 1: [20:09:52]: FCSetupWx: pfnSetupUninstallOEMInfW 1: [20:09:52]: FCSetupWx: pfnSetupUninstallOEMInfW res = 0 last error = 87 1: [20:09:52]: FCSetupWx: pfnSetupUninstallOEMInfW 1: [20:09:52]: FCSetupWx: pfnSetupUninstallOEMInfW res = 0 last error = 2 1: [20:09:52]: FCSetupWx: install_driver_inf_newdev szInf=C:\Pro

Hi, As someone who proposes and implements FortiGate solutions for clients,I have received detailed inquiries from them regarding the “File System Check Recommended” message.I understand that this message appears when a proper shutdown cannot be performed. However,I would appreciate any advice on the following points that I was unable to investigate further.If the message is canceled once, will it no longer appear again?Is it possible to reproduce the same message even after canceling it?Is there an alternative method to check for errors in the file system?Thanks, Kenji

Anyone know why a Fortinet firewall set to originate type-2 externals is advertising what looks like type-1 costs (i.e., including internal path costs)? I thought with type-2, only the cost I manually assign to the interface (e.g., set cost 100) should be advertised, regardless of internal link costs. Instead, neighbors are seeing the cost increase as if type-1 logic is being applied. Misconfig? Bug? Misunderstanding on my part?Below is my ospf config for referenceconfig router ospf set abr-type cisco set router-id 192.168.8.181 config area edit 0.0.0.0 set authentication message-digest next edit 0.0.0.16 set authentication message-digest set stub-type no-summary set type stub config range edit 1 set prefix 172.16.0.0 255.255.0.0 next end next end config ospf-interface edit "segfw-user" s

For security resons, we do not allow our users to modify network interface settings on their computers. When they connect to a VPN session using the FortiClient application, the DNS settings get temporarily changed to a static entry.Under some unknow circumstances, sometimes a client will loose or close iis connection and the DNS remains overiden. When this happends, the user is unable to access any network ressources until someone with sufficient security privileges resetsThis situation occurs a few times every week and our users are getting acreasingly irritated.Could anyone please help us resolve this issue?

heads-up, was testing the released FortiClient 7.2.10 with few user and most are facing blue screen issues after i update due to netio.sys. we use Lenovo laptops thus not sure if other brands are affected. machines are windows 11 latest release.

Hello, Kindly, we want to download the Fortinet VMs for the following products : Fortigate, Fortiswitch, FortiSIEM... to build a test labCould anyone guide us how to download it and how to get demo licenses, BR

I have a FortiGate 90G firewall and two FortiSwitch T1024E switches. I want to create a hybrid configuration where the FortiSwitch T1024E switches handle all internal VLAN routing. I want to avoid all traffic flowing through the FortiGate, as this would create a critical performance bottleneck in my system.  The main questions are: 1) can the pair of FortiSwitch T1024E's handle all internal Layer 3 routing between VLAN's? 2) do I need special licensing features for Layer 3 functionality? 3) if I attach FortiAP access points to my system (at the Layer 2 Edge switching level), how are these managed? Via the FortiiGate firewall? Or via the L3 switching stack?  Please suggest any critical configuration settings to enable inter-VLAN routing by the T1024E's while maintaining as much management integration as possible across Fortinet devices.

 I'm trying to run a PoC using fortigate VMs and a fortimanager hosted in Azure. The fortigates are running and licensed but I cannot get them connected to the fortimanager no matter what I do.The log in the fortimanager simply says deny request from the fortigate, I can't figure out why.I'm not new to fortigate but I am new to fortimanager. Anyone have any ideas?