Fortinet Community

Hi There,I have 40F running 7.2I have Site2Site IPSEC VPN Running.I have added to to Phase 2 the Subnet that is used for the Remote Access SSL-VPN users (172.16.255.0/24).over the split tunnel - I've added the subnets that are in the remote S2S Firewall (because these are the relevant subnets).I've added a rule over the firewall - do I need to set anything else ?here is the configuration I've used:config firewall policyedit 26set name "POD1"set srcintf "ssl.root"set dstintf "S2SVPN"set action acceptset srcaddr "SSL VPN"set dstaddr "POD1"set schedule "always"set service "ALL"set users "pod1"nextend config vpn ssl settingsset servercert "SSL-VPN"set tunnel-ip-pools "SSL VPN"set source-interface "wan"set source-address "all"set source-address6 "all"set default-portal "SSL_VPN"config authentication-ruleedit 1set groups "VPN_USERS"set portal "SSL_VPN"nextendend config vpn ssl web portaledit "SSL_VPN"set tunnel-mode enableset web-mode enableset limit-user-logins enableset save-pass

There is vulnerability find in Fortidevsec tool. We verified with developers, as they are saying there is no possible to inject in logger. Hence they are saying false positive. Is it possible to false positive? what are the things to verify in the code level?

Hello,I have the following question regarding the SSL inspection process performed by Fortigate, specifically the options below:I'm trying to understand the order in which these options are analyzed. I understand that a verification flow must be followed, and my current understanding is as follows: My Logic:It all starts with cert-probe-failure.cert-probe-failure = Couldn't get the certificate, so it stops here and takes a block or allow action. If successful, continue >>cert-validation = Opens the certificate and checks CA, revocation, expiration, and SNI.According to the information obtained from cert-validation, it will perform the actions set below:sni-server-cert-check = enable (I understand this check already occurs in cert-validation)revoked = allow or dropexpired = allow or dropuntrusted = allow or dropI'm a little confused about these checks. I read in the documentation that cert-probe-failure alreadyperforms validations that other options do, such as untrusted cert

Is it possible to get FortiGate to use USB-tethering of an android smartphone instead of a real USB LTE modem  for  the WWAN connection? cdc_ncm driver is loaded, good T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480  MxCh= 0D:  Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1P:  Vendor=18d1 ProdID=4eeb Rev= 5.10S:  Manufacturer=GoogleS:  Product=Pixel 6aS:  SerialNumber=0123456789012C:* #Ifs= 2 Cfg#= 1 Atr=80 MxPwr=500mAA:  FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0d Prot=00I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0d Prot=00 Driver=cdc_ncmE:  Ad=82(I) Atr=03(Int.) MxPS=  16 Ivl=32msI:  If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncmI:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncmE:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0msE:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0msgw # show system lte-modemconfig system lte-modemset status enableendgw #

I am trying to use the ice=1 parameter in identifying the remote gateway. The examples on the support portal all use html formatting (https://remote.company.org?ice=1). When I attempt to use the html formatting as the gateway address, setup reports that this is not an address. If I use the format "remote.company.org" I get the vpn up. If I add the ...?ice=1" setup again rejects the address. I am getting a cert, but want this for now. Thanks!   

Hello, I have set up a firewall policy to test our FSSO functionality. I have noticed that when the FSSO group corresponds to a user DN it works fine, however, if it corresponds to a Global Security group, it does not work. Below is the firewall policy: show firewall policy *** config firewall policy edit *** set name "TestFSSO" set uuid f44e2db6-3fe8-51f0-****-6d00*****3be set srcintf "lan" set dstintf "wan1" set action accept set srcaddr "all" set dstaddr "all" set schedule "always" set service "ALL" set utm-status enable set inspection-mode proxy set profile-protocol-options "custom-default" set ssl-ssh-profile "certificate-inspection" set av-profile "default" set webfilter-profile "Default" set dnsfilter-profile "default" set ips-sensor "Default" set application-list "Default" set logtraffic all set nat en

Today, all of a sudden 100+ clients reported W32/Tedy.7918!tr malware in C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe. The definition was just updated today and it may be a false positive, but I want to verify if the alert is legit. Did anyone have the same issue and what would be best practice to verify this alert?Thanks,Markus

Can anyone help me with the definitions of the services that run on the FortiGates? I think this would be highly helpful to those of us who are watching high memory or cpu utilization on a specific service but cannot correlate it to anything. Specifically I' m trying to figure out what the " scanunitd" service is/does. Here' s a partial list of the services I have seen, some of them are obviously self-explanatory: Self-Explanatory: thttp.........................http daemon ipsengine......................... ips engine hasync......................... ha sync service pop3......................... pop3 service smtp ......................... smtp service cli .........................cli service hatalk ......................... ha talk service httpsd .........................https daemon sshd .........................ssh daemon authd .........................authentication daemon alertmail .........................mail alerts urlfilter .........................

Hi,I was so hyped that arm version of FortiClient was finally released and asked network admin to send me FortiClientVPNSetup_7.4.3.1790_ARM64.exe , but installation always fails :( Installation log where it fails:1: [20:09:47]: FCSetupWx: __cb_find_fortidrv_inf_file searching C:\WINDOWS\inf\oem99.inf 1: [20:09:47]: FCSetupWx: __cb_find_fortidrv_inf_file find result = 0 1: [20:09:47]: FCSetupWx: __is_fortidrv_installed(),found=0, retval=0 1: [20:09:48]: FCSetupWx: HrInstallNetComponent failed (0) (err=800F0235) 1: [20:09:49]: FCSetupWx: HrInstallNetComponent failed (1) (err=800F0235) 1: [20:09:51]: FCSetupWx: HrInstallNetComponent failed (2) (err=800F0235) 1: [20:09:52]: FCSetupWx: pfnSetupUninstallOEMInfW 1: [20:09:52]: FCSetupWx: pfnSetupUninstallOEMInfW res = 0 last error = 87 1: [20:09:52]: FCSetupWx: pfnSetupUninstallOEMInfW 1: [20:09:52]: FCSetupWx: pfnSetupUninstallOEMInfW res = 0 last error = 2 1: [20:09:52]: FCSetupWx: install_driver_inf_newdev szInf=C:\Pro

Hi, As someone who proposes and implements FortiGate solutions for clients,I have received detailed inquiries from them regarding the “File System Check Recommended” message.I understand that this message appears when a proper shutdown cannot be performed. However,I would appreciate any advice on the following points that I was unable to investigate further.If the message is canceled once, will it no longer appear again?Is it possible to reproduce the same message even after canceling it?Is there an alternative method to check for errors in the file system?Thanks, Kenji

Anyone know why a Fortinet firewall set to originate type-2 externals is advertising what looks like type-1 costs (i.e., including internal path costs)? I thought with type-2, only the cost I manually assign to the interface (e.g., set cost 100) should be advertised, regardless of internal link costs. Instead, neighbors are seeing the cost increase as if type-1 logic is being applied. Misconfig? Bug? Misunderstanding on my part?Below is my ospf config for referenceconfig router ospf set abr-type cisco set router-id 192.168.8.181 config area edit 0.0.0.0 set authentication message-digest next edit 0.0.0.16 set authentication message-digest set stub-type no-summary set type stub config range edit 1 set prefix 172.16.0.0 255.255.0.0 next end next end config ospf-interface edit "segfw-user" s

For security resons, we do not allow our users to modify network interface settings on their computers. When they connect to a VPN session using the FortiClient application, the DNS settings get temporarily changed to a static entry.Under some unknow circumstances, sometimes a client will loose or close iis connection and the DNS remains overiden. When this happends, the user is unable to access any network ressources until someone with sufficient security privileges resetsThis situation occurs a few times every week and our users are getting acreasingly irritated.Could anyone please help us resolve this issue?

heads-up, was testing the released FortiClient 7.2.10 with few user and most are facing blue screen issues after i update due to netio.sys. we use Lenovo laptops thus not sure if other brands are affected. machines are windows 11 latest release.

Hello, Kindly, we want to download the Fortinet VMs for the following products : Fortigate, Fortiswitch, FortiSIEM... to build a test labCould anyone guide us how to download it and how to get demo licenses, BR

I have a FortiGate 90G firewall and two FortiSwitch T1024E switches. I want to create a hybrid configuration where the FortiSwitch T1024E switches handle all internal VLAN routing. I want to avoid all traffic flowing through the FortiGate, as this would create a critical performance bottleneck in my system.  The main questions are: 1) can the pair of FortiSwitch T1024E's handle all internal Layer 3 routing between VLAN's? 2) do I need special licensing features for Layer 3 functionality? 3) if I attach FortiAP access points to my system (at the Layer 2 Edge switching level), how are these managed? Via the FortiiGate firewall? Or via the L3 switching stack?  Please suggest any critical configuration settings to enable inter-VLAN routing by the T1024E's while maintaining as much management integration as possible across Fortinet devices.

 I'm trying to run a PoC using fortigate VMs and a fortimanager hosted in Azure. The fortigates are running and licensed but I cannot get them connected to the fortimanager no matter what I do.The log in the fortimanager simply says deny request from the fortigate, I can't figure out why.I'm not new to fortigate but I am new to fortimanager. Anyone have any ideas?

Hi everyone I have a core switch connected to different access switches. when any user connected on any access switch through LAN then how should i know the user is connected to which access switch from that user's MAC address.

Hi, Has anyone configured FortiMail to block only password protected archives? I.e if it's not possible to open it to block it, otherwise send it through. Kind regards, -1984-

Hi all,I’m facing a frustrating issue with my FortiGate firewall. Remote users are getting disconnected from the VPN randomly throughout the day. There’s no pattern to when it happens sometimes within 10 minutes, sometimes after an hour and the users have to reconnect manually each time. We’re using SSL VPN, and everything looks fine in the logs. Bandwidth is stable, and there are no clear errors reported when the connection drops. The same users are reporting it across different ISPs and devices, so I don’t think it’s just on their end. I’ve checked timeout settings and session TTLs, and nothing seems off. At this point, I’m just looking for any angle — even reviewing small details like session behavior, logging anomalies, or traffic patterns. Sometimes, looking at the issue through a fresh lens (like categorizing by nouns that start with A — activity, authentication, allocation) helps uncover something you’ve overlooked. Thanks in advance for any help.

We have no software available in the drop down and we have issue uninstalling a Forti client vpn on windows 11 machine. 

Hi all Have been experiencing a strange issue on 600F firewalls in HA running version 7.2.11 it just stop responsive and like frozen but all interfaces will be up but not pingable internet links down all interfaces not pingable unresponsive.. and the only way to fix the issue it to reboot the Primary FW, Its doesn't failover guess coz HA heartbeat and monitored interfaces will be still showing up... This has happened 3 times for the past 3 months like every after  25-35 days. Any suggestions or anyone experienced same issue ?

Hello everyone, I'd like to better understand the "set update-static-route" command and the effects of "enable" and "disable" settings.I read several articles but I want to make sure what I'm doing because I'm setting up a firewall remotely on a remote site where it's difficult to dispatch so I'd like to avoid making stupid mistakes. We have two WAN links, ext1 is fiber and ext2 is cellular, so ext1 needs to be primary and ext2 secondary. We are not looking at improving performance, we just want extra reliability so everything fails over automatically to ext2 if ext1 fails, and also it fails back automatically to ext1 when it comes back. There's a passage in this article that annoys me : Link-Monitor Explained - Fortinet Community **set update-static-route Enable/disable updating the static route, default: enable”[** It is advised to keep disabled as it may cause the production environment down , Make sure it's working before enabling it] I think I need to

Hello,I recently upgraded the FAC to version 6.6.4 using TFTP. After booting, the admin password was supposed to be blank, but I received a message saying the password was incorrect. To resolve this issue, I accessed the device with the master account and performed a factory reset, which successfully fixed the problem. Due to time constraints, I wasn’t able to test with a lower version, but I’m curious if anyone else has experienced the same issue.Has anyone else encountered a similar problem? If so, how did you resolve it?

Went searching as much as possible and couldn't find a solution so I made one myself. Thought I'd share to save someone else the legwork if they wanted to also do it. We want to block all incoming connections from any country outside the U.S. So Fortinet documentation says you have to create a firewall address object for each country you want to block. I use dual WAN's on each firewall so it was quite a bit of blah work. Here are the address objects if anyone else wants to use them. Just throw them all into a group and block away if needed. config firewall addressedit "Afghanistan - WAN1" set type geography set associated-interface "wan1" set country "AF" next edit "Aland Islands - WAN1" set type geography set associated-interface "wan1" set country "AX" next edit "Albania - WAN1" set type geography set associated-interface "wan1" set country "AL" next edit "Algeria - WAN1" set type geography set associated-interface "wan1" set country "DZ" next edit "American Samoa - WAN1"

Hey everyone, a user in my company has a problem with windows 11 and FortiClient.When he connects his FortiClient sucsessfully, he doesnt get any data traffic, probably because of a wrong IP configuration. We already tried to reinstall version 7.2.8 and also uninstalled it and installed 7.2.6 -> same error even after upgrading 7.2.6 -> 7.2.8On the attached screenshot you can see that FortiClient shows a different IP adress then the adapter in cmd with ipconfig, to me that looks like the error.The exact same constilation between Windows 11 and FortiClient 7.2.8 worked for the user the last 5 months until today. When you google something the following message appears: He is currently the only user with this issue, other users can work perfectly fine.I hope you guys can give me a solution. Best reguards,Alex