Fortinet Community

Hello, I have set up a firewall policy to test our FSSO functionality. I have noticed that when the FSSO group corresponds to a user DN it works fine, however, if it corresponds to a Global Security group, it does not work. Below is the firewall policy: show firewall policy *** config firewall policy edit *** set name "TestFSSO" set uuid f44e2db6-3fe8-51f0-****-6d00*****3be set srcintf "lan" set dstintf "wan1" set action accept set srcaddr "all" set dstaddr "all" set schedule "always" set service "ALL" set utm-status enable set inspection-mode proxy set profile-protocol-options "custom-default" set ssl-ssh-profile "certificate-inspection" set av-profile "default" set webfilter-profile "Default" set dnsfilter-profile "default" set ips-sensor "Default" set application-list "Default" set logtraffic all set nat en

Today, all of a sudden 100+ clients reported W32/Tedy.7918!tr malware in C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe. The definition was just updated today and it may be a false positive, but I want to verify if the alert is legit. Did anyone have the same issue and what would be best practice to verify this alert?Thanks,Markus

Can anyone help me with the definitions of the services that run on the FortiGates? I think this would be highly helpful to those of us who are watching high memory or cpu utilization on a specific service but cannot correlate it to anything. Specifically I' m trying to figure out what the " scanunitd" service is/does. Here' s a partial list of the services I have seen, some of them are obviously self-explanatory: Self-Explanatory: thttp.........................http daemon ipsengine......................... ips engine hasync......................... ha sync service pop3......................... pop3 service smtp ......................... smtp service cli .........................cli service hatalk ......................... ha talk service httpsd .........................https daemon sshd .........................ssh daemon authd .........................authentication daemon alertmail .........................mail alerts urlfilter .........................

Hi,I was so hyped that arm version of FortiClient was finally released and asked network admin to send me FortiClientVPNSetup_7.4.3.1790_ARM64.exe , but installation always fails :( Installation log where it fails:1: [20:09:47]: FCSetupWx: __cb_find_fortidrv_inf_file searching C:\WINDOWS\inf\oem99.inf 1: [20:09:47]: FCSetupWx: __cb_find_fortidrv_inf_file find result = 0 1: [20:09:47]: FCSetupWx: __is_fortidrv_installed(),found=0, retval=0 1: [20:09:48]: FCSetupWx: HrInstallNetComponent failed (0) (err=800F0235) 1: [20:09:49]: FCSetupWx: HrInstallNetComponent failed (1) (err=800F0235) 1: [20:09:51]: FCSetupWx: HrInstallNetComponent failed (2) (err=800F0235) 1: [20:09:52]: FCSetupWx: pfnSetupUninstallOEMInfW 1: [20:09:52]: FCSetupWx: pfnSetupUninstallOEMInfW res = 0 last error = 87 1: [20:09:52]: FCSetupWx: pfnSetupUninstallOEMInfW 1: [20:09:52]: FCSetupWx: pfnSetupUninstallOEMInfW res = 0 last error = 2 1: [20:09:52]: FCSetupWx: install_driver_inf_newdev szInf=C:\Pro

Hi, As someone who proposes and implements FortiGate solutions for clients,I have received detailed inquiries from them regarding the “File System Check Recommended” message.I understand that this message appears when a proper shutdown cannot be performed. However,I would appreciate any advice on the following points that I was unable to investigate further.If the message is canceled once, will it no longer appear again?Is it possible to reproduce the same message even after canceling it?Is there an alternative method to check for errors in the file system?Thanks, Kenji

Anyone know why a Fortinet firewall set to originate type-2 externals is advertising what looks like type-1 costs (i.e., including internal path costs)? I thought with type-2, only the cost I manually assign to the interface (e.g., set cost 100) should be advertised, regardless of internal link costs. Instead, neighbors are seeing the cost increase as if type-1 logic is being applied. Misconfig? Bug? Misunderstanding on my part?Below is my ospf config for referenceconfig router ospf set abr-type cisco set router-id 192.168.8.181 config area edit 0.0.0.0 set authentication message-digest next edit 0.0.0.16 set authentication message-digest set stub-type no-summary set type stub config range edit 1 set prefix 172.16.0.0 255.255.0.0 next end next end config ospf-interface edit "segfw-user" s

For security resons, we do not allow our users to modify network interface settings on their computers. When they connect to a VPN session using the FortiClient application, the DNS settings get temporarily changed to a static entry.Under some unknow circumstances, sometimes a client will loose or close iis connection and the DNS remains overiden. When this happends, the user is unable to access any network ressources until someone with sufficient security privileges resetsThis situation occurs a few times every week and our users are getting acreasingly irritated.Could anyone please help us resolve this issue?

heads-up, was testing the released FortiClient 7.2.10 with few user and most are facing blue screen issues after i update due to netio.sys. we use Lenovo laptops thus not sure if other brands are affected. machines are windows 11 latest release.

Hello, Kindly, we want to download the Fortinet VMs for the following products : Fortigate, Fortiswitch, FortiSIEM... to build a test labCould anyone guide us how to download it and how to get demo licenses, BR

I have a FortiGate 90G firewall and two FortiSwitch T1024E switches. I want to create a hybrid configuration where the FortiSwitch T1024E switches handle all internal VLAN routing. I want to avoid all traffic flowing through the FortiGate, as this would create a critical performance bottleneck in my system.  The main questions are: 1) can the pair of FortiSwitch T1024E's handle all internal Layer 3 routing between VLAN's? 2) do I need special licensing features for Layer 3 functionality? 3) if I attach FortiAP access points to my system (at the Layer 2 Edge switching level), how are these managed? Via the FortiiGate firewall? Or via the L3 switching stack?  Please suggest any critical configuration settings to enable inter-VLAN routing by the T1024E's while maintaining as much management integration as possible across Fortinet devices.

 I'm trying to run a PoC using fortigate VMs and a fortimanager hosted in Azure. The fortigates are running and licensed but I cannot get them connected to the fortimanager no matter what I do.The log in the fortimanager simply says deny request from the fortigate, I can't figure out why.I'm not new to fortigate but I am new to fortimanager. Anyone have any ideas?

Hi everyone I have a core switch connected to different access switches. when any user connected on any access switch through LAN then how should i know the user is connected to which access switch from that user's MAC address.

Hi, Has anyone configured FortiMail to block only password protected archives? I.e if it's not possible to open it to block it, otherwise send it through. Kind regards, -1984-

Hi all,I’m facing a frustrating issue with my FortiGate firewall. Remote users are getting disconnected from the VPN randomly throughout the day. There’s no pattern to when it happens sometimes within 10 minutes, sometimes after an hour and the users have to reconnect manually each time. We’re using SSL VPN, and everything looks fine in the logs. Bandwidth is stable, and there are no clear errors reported when the connection drops. The same users are reporting it across different ISPs and devices, so I don’t think it’s just on their end. I’ve checked timeout settings and session TTLs, and nothing seems off. At this point, I’m just looking for any angle — even reviewing small details like session behavior, logging anomalies, or traffic patterns. Sometimes, looking at the issue through a fresh lens (like categorizing by nouns that start with A — activity, authentication, allocation) helps uncover something you’ve overlooked. Thanks in advance for any help.

We have no software available in the drop down and we have issue uninstalling a Forti client vpn on windows 11 machine. 

Hi all Have been experiencing a strange issue on 600F firewalls in HA running version 7.2.11 it just stop responsive and like frozen but all interfaces will be up but not pingable internet links down all interfaces not pingable unresponsive.. and the only way to fix the issue it to reboot the Primary FW, Its doesn't failover guess coz HA heartbeat and monitored interfaces will be still showing up... This has happened 3 times for the past 3 months like every after  25-35 days. Any suggestions or anyone experienced same issue ?

Hello everyone, I'd like to better understand the "set update-static-route" command and the effects of "enable" and "disable" settings.I read several articles but I want to make sure what I'm doing because I'm setting up a firewall remotely on a remote site where it's difficult to dispatch so I'd like to avoid making stupid mistakes. We have two WAN links, ext1 is fiber and ext2 is cellular, so ext1 needs to be primary and ext2 secondary. We are not looking at improving performance, we just want extra reliability so everything fails over automatically to ext2 if ext1 fails, and also it fails back automatically to ext1 when it comes back. There's a passage in this article that annoys me : Link-Monitor Explained - Fortinet Community **set update-static-route Enable/disable updating the static route, default: enable”[** It is advised to keep disabled as it may cause the production environment down , Make sure it's working before enabling it] I think I need to

Hello,I recently upgraded the FAC to version 6.6.4 using TFTP. After booting, the admin password was supposed to be blank, but I received a message saying the password was incorrect. To resolve this issue, I accessed the device with the master account and performed a factory reset, which successfully fixed the problem. Due to time constraints, I wasn’t able to test with a lower version, but I’m curious if anyone else has experienced the same issue.Has anyone else encountered a similar problem? If so, how did you resolve it?

Went searching as much as possible and couldn't find a solution so I made one myself. Thought I'd share to save someone else the legwork if they wanted to also do it. We want to block all incoming connections from any country outside the U.S. So Fortinet documentation says you have to create a firewall address object for each country you want to block. I use dual WAN's on each firewall so it was quite a bit of blah work. Here are the address objects if anyone else wants to use them. Just throw them all into a group and block away if needed. config firewall addressedit "Afghanistan - WAN1" set type geography set associated-interface "wan1" set country "AF" next edit "Aland Islands - WAN1" set type geography set associated-interface "wan1" set country "AX" next edit "Albania - WAN1" set type geography set associated-interface "wan1" set country "AL" next edit "Algeria - WAN1" set type geography set associated-interface "wan1" set country "DZ" next edit "American Samoa - WAN1"

Hey everyone, a user in my company has a problem with windows 11 and FortiClient.When he connects his FortiClient sucsessfully, he doesnt get any data traffic, probably because of a wrong IP configuration. We already tried to reinstall version 7.2.8 and also uninstalled it and installed 7.2.6 -> same error even after upgrading 7.2.6 -> 7.2.8On the attached screenshot you can see that FortiClient shows a different IP adress then the adapter in cmd with ipconfig, to me that looks like the error.The exact same constilation between Windows 11 and FortiClient 7.2.8 worked for the user the last 5 months until today. When you google something the following message appears: He is currently the only user with this issue, other users can work perfectly fine.I hope you guys can give me a solution. Best reguards,Alex

Hello everyone, I have a working configuration for remote accesssing via VPN and SAML (Microsoft Entra).  I am trying to restrict the access to the VPN on only specific devices. It does work when FortiClient uses external saml via edge browser. But when someone has set a different browser (e.g. firefox) as default and FortiClient uses Firefox to provide the SAML login, there are some background informations missing which are needed in entra. These information seems to be only available when using edge as browser (shown by my testing).  Is there any way to set edge as browser for using saml and not the machines default browser?

We're testing a scan-device (Zebra, Android) for our company.  We use FortiClient VPN Android, the free version so far.The software works as expected and we can sucessfully connect and user our application.  But after a while, the connection gets lost, and we would have to re-connect many times a day.  Is there any way to stop FortiClient from disconnecting, so it always keeps the connection in the background? For me the reasons for disconnection might be for example:- device goes to sleeping-mode and Forticlient VPN because of that disconnetcs in the background. - VPN ist unused for a while, since there ist no data-flow and Forticlient VPN because of that disconnetcs in the background.  Your help is much appreciated!      

I have successfully received VM order response from Fortinet Academy already. Now I am planning to install all VMs (e.g. FortiGate, FortiManager, FortiAnalyzer and FortiAuthenticator VMs) on a VMware workstation on my Window-based laptop. I would like to know the hardware specification of my laptop for installing all VMs so that I can let a student to locally do all labs required in all courses in the academy. For example, is the laptop specification as shown below good enough?CPU: Intel Core i7 (10th Gen or newer) or AMD Ryzen 7 (4000 series or newer), 6-core/12-thread or better.RAM: 32 GB.Storage: 1 TB NVMe SSD.OS: Windows 11 Pro.

Current running on VM and no hardware disk present but I wish to use current DIsk System as log diagnose hardware deviceinfo diskDisk SYSTEM(boot) 40.0GiB type: IDE [Virtio Disk] dev: /dev/vdapartition 231.0MiB, 93.0MiB free mounted: Y label: dev: /dev/vda1(boot) start: 2048partition 1.7GiB, 1.4GiB free mounted: Y label: dev: /dev/vda2(boot) start: 526336can I partition to use as log and how ?

Hello, Is anyone aware if that legacy "scp -O" is going to be fixed soon by migrating to newer protocol or by a specific configuration? https://community.fortinet.com/t5/FortiGate/Technical-Tip-Backup-via-SCP-getting-error-subsystem-request/ta-p/253357