Fortinet Community

Hi - Does FortiClient VPN software (paid or free version) has a kill switch feature... meaning if VPN drops the PC should get disconnected from internet until VPN connection is up again.

Good morning!Can I make a usage report for my fortigate interfaces? To receive in my e-mail? If I can also configure something to receive an alert if my link exceeds the contracted limit.

Hi everyone,my colleague and I are working on a migration project involving several FortiGate 50E units that need to be replaced with new 50G models across three different sites. We've already downloaded the configurations from all the existing devices.What’s the best approach to transfer the configurations to the new FortiGates?Has anyone used FortiConverter for this specific model change (50E → 50G)?Any tips, recommendations, or best practices would be greatly appreciated.Thanks in advance!

As organizations increasingly adopt cloud-native applications and containerized environments, ensuring robust security becomes paramount. The dynamic nature of these environments introduces unique challenges that require comprehensive security strategies. Fortinet offers a suite of solutions designed to address these challenges, providing visibility, control, and protection across your cloud infrastructure. In this article, we will explore key aspects of cloud security, including code and container scanning, best practices for Azure Kubernetes Service (AKS), and advanced capabilities of FortiCNAPP for Kubernetes. We will also delve into the importance of monitoring egress traffic with FortiGate and securing ingress traffic with FortiWeb. By following these guidelines and leveraging Fortinet's solutions, organizations can enhance the security and efficiency of their cloud-native applications.   AKS Benchmark Best Practices   Azure Kubernetes Service (AKS) provides a managed Ku

We have recently started using FortiPAM 1.5 and are experiencing some challenges.We have a SCADA system for video, which is based on MediaMTX with three video servers.The issue is that when I create a "web account" target with the associated secret, I am able to log in to the SCADA website itself.However, the video is opened directly from my PC to the video servers. This traffic needs to go through the proxy, just like the SCADA website.I have tested various things, including adding the IP addresses of the video servers to the Domain list IP mask list on the target.This has not helped. FortiPAM does have access to all the video servers over the local network. What needs to be done to make this work? 

Hi, I have a question about configuring the connections between FortiSwitches.I currently have a FortiSwitch 148F that connects to a 124F.These two switches are connected with a single LAN cable (cable A) between the Fortilink ports and a single LAN cable (cable B) between two standard ports.Isn't it possible to also convey normal traffic via the Fortilink connection?The other question concerns the possibility of increasing the connection cables between the FortiSwitches to two.What is the most suitable solution to maintain the Fortilink connection and do LAN aggregation?Thanks.

Hello, Our Fortimail rejects emails which are too big Is it possible to get a daily report with the rejected mails (from, to, subject, date) ? Thanks for your help.

I have 205 switches (version 7.4.3 )registered on a FortiGate VM08 (version 7.4.5 ), which is itself registered on a FortiManager (version 7.4.7). However, only 69 switches are properly synchronized and managed through both the FortiGate and the FortiManager. The others are not receiving the configuration via the FortiGate. Could the issue be that the FortiGate VM08 can only actively manage a limited number of switches (for example, 69 or 96 maximum) through FortiLink?I'm looking for confirmation from TAC or documentation reference if possible.Thank you!

Hello,I have a problem with the explicit web proxy function.We run a Fortigate 200F with 7.4.7. Before that we had a 240D.I have a program that runs on a Server using proxy. Never had any Problems with the 240D.Now we switched and I am getting this Error: HTTP.status:::Error:The connection to the Site 'https://ratsinfo....' could not be established.Errorcode '80072F78':The Proxy- or Webserver has send a 'TimeOut'.HTTP-Header:(HTTP-Objekt nicht verfügbar)SendTime(s): 15Retry not possibleintern errormessage: 7ERROR Microsoft.HTTPCANCELED Here the Original text in german: HTTP.status:::Fehlerhinweis:Die Verbindung zur Seite 'https://ratsinfo-kleinblittersdorf.de/gi/netdata1.php?q=1&version=542&v=10:15:28' konnte nicht hergestellt werden.Auswertung Fehlercode '80072F78':Der Proxy- oder Webserver hat eine Meldung 'TimeOut' gesendet.Mögliche Ursache(n):Die Verbindung zum Internet kann nicht aufgebaut werden.Prüfen Sie die Einstellung zur Internetverbindung.Prüfen Sie,

I have configured call restriction profiles for certain extensions, and it works correctly. However, I need to change the default audio file that indicates "no permissions and please contact the administrator" to another language (Spanish). I've already preloaded an audio file in Spanish, but I can't find the option to associate it with the call restriction. Has anyone experienced the same situation? FortiVoice 

Hello, I am having an issue when generating a custom report on FortiAnalyzer.I have created a custom dataset, added it to a chart and when I run it from here with real data, the table is showing successfully with data.The issue is when I need to add this chart into a report and run it, I always get in the pdf report No matching log data for this report but when I run it directly from the chart tab it is working.Below is the dataset created, appreciate your help why in the report it is not workingSELECTsrcip,dstip,action,policyid,user,$calendar_time(itime) AS "time_stamp"FROM $logWHERE $filterAND type = 'traffic'AND subtype = 'forward'AND policyid = 120AND `group` = 'users'ORDER BY eventtime DESC 

Hi everyone, bit of a niche problem, I have many students working from home with laptops provided by us, they are hard configured to browse by the proxy we have set and they're locked down to keep it that way,  they can browse some times but not all. So we have an implicit proxy exposed on the FG's wan interface.The proxy is configured to default deny.There are proxy policies in place permitting access to Azure for the auth process to succeed which it doesA default policy is inplace that has the SAML_Group object associated against it to permit the learners access to the web, src=all + SAML_Group, dst=all, security= student-web-filter, Full SSL inspection.Clients win11, have the CA cert installed from the gate to their trusted ca stores. A session token is provided to the user post auth with 5 minute timeout.The user on their laptop can browse the web to certain sites, but then it suddenly blocks them going from say google to whatsmyip.In the logs I can see the successfu

Hello Team,I am trying to rewrite  https://exapmle.in.com to https://exapmle2.out.net (URL are fake).I have tried HTTP header rewriting ( without success) and body rewriting 9 the URL was redirecting to the new URL, which is not our case).We need to keep the traffic to Fortiweb and not redirect the traffic to the end URL.Bello the config config waf url-rewrite url-rewrite-ruleedit "ASK-AI-REWRITING"set host-status enableset host exapmle.in.comconfig header-insertendconfig response-header-insertendconfig header-removalendconfig response-header-removalendset request-remove-duplicate-headers disableconfig match-conditionedit 1set reg-exp exapmle2.out.netset HTTP-protocol httpsnextendnextendconfig waf url-rewrite url-rewrite-ruleedit "ASK-AI-REWRITING-2"set action http-response-header-rewriteset location_replace $0exapmle.in.com$1set location-status enableconfig header-insertendconfig response-header-insertendconfig header-removalendconfig response-header-removalendset respo

Hello,I’m encountering a persistent issue on my FortiWeb device. In the logs, I consistently see entries like: Main Type=HTTP Parsing Error, Sub Type=HTTP Parsing Error Action=alert_Deny To troubleshoot, I have disabled both “Malformed Request” and “Malformed URL” options under HTTP Protocol Constraints. However, these logs are still being generated, and the traffic is denied.I have checked the configuration but couldn’t find any explicit setting to disable or further tune the handling of HTTP Parsing Errors.My questions:Is there a way to disable or adjust the detection for HTTP Parsing Errors?What else could trigger this log even after disabling the relevant protocol constraints?Are there any hidden or advanced settings I should be aware of?Any suggestions or documentation references would be greatly appreciated!Thank you.

Hi. Does anyone know how to block streaming/movies from playing on Telegram without blocking messaging? Best regards! 

Dear All, What can I do with  FortiGate-VM evaluation license, it does not provide basic licensing along with low encryption. No of interfaces & policy -3 Limited route  Do you know what features it provides. It think, do not best time for use Regards,Umesh

Hello class!I have the following request and I am unable to apply, can anyone help me?I need to block YouTube for my entire network, but one specific channel I need to make accessible, it has few videos, but I've tried different ways, and it doesn't work, when it blocks, it doesn't load the videos, it just keeps running, or it only blocks by video categories, I've tried with WebFilter, Video Filter, Deep Inspection, Application Control, and with several community posts, like the one below:https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-restrict-YouTube-channels-using-video/ta-p/191767But without success, My Fortigate is a 100F, version 7.2.7

Hi, Has anyone had any experience using Akamai in front of a Fortigate SSL VPN endpoint? So far we have done the following. - Allowed the Akamai subnets as allowed hosts in the SSL VPN settings on the Firewall - For testing purposes edited the clients local host file to resolve the FQFN to the IP of the Akamai endpoint The Fortigate logs for the users says tunnel-down 'User requested termination of service' when it disconnects. We do note that when the Client connects the remote host IP as an Akamai IP and not the clients public IP which is why I think the client disconnects. Does anyone managed to get this working and if so how? Many Thanks

There is a huawei core switch and fortiswitch 1048 connected to it. Fortigate manages the switches in the network with fortilink protocol in layer 2 mode and directly connected to fortiswitch 1048E. How can I reach the switches under fortilink network from different vlans.

Hi Guys, I wanted some guidance on how can I become a Firewall Engineer. I have 3 years of Exp in IT but I had to left my Job in March 2025. Now I am trying to swicth my skill. I wanted to know that What are the things I need to learn before appplying for a job and how much time it will take to master it. I have started from Basics and so far I have learnt IP Addressing, Subnetting, Routing(Static, Dynamic, OSPF, BGP), Swicthing(ARP, Vlans, Inter VLan routing, HSRP, VRRP), ACLs, NAT(Static, Dynamic, PAT). I have started learning Fortigate from basics and I wanted to know is there anything else I should learn parallely? How much time will it take to land my first job as a firewall engineer. I am also thinking of learning Cloud in future and will dive into Cloud Security.

Hello,  My question is can fortigate autoquarantine AD users based on the number of IPS virus violations they do?  I see that under the article https://docs.fortinet.com/document/fortigate/7.2.4/cli-reference/148620/config-system-automation-action or the video https://www.youtube.com/watch?v=3vLdto9Yx0U  that I can block bad hosts based on Mac address or source IP address but nowadays users use different computers, so my question is can I make an automation that can automatically block the source AD user (after fortigate authenticates the users) if the users does too many attacks in a specified time frame that trigger the IPS or virus detections?

Hi Experts, I'm trying to setup a Virtual FortiManager on my EVE-NG platform. I have performed the following configurations on it through the CLI:config system interface     edit "port2"         set ip 192.168.1.200 255.255.255.0         set allowaccess ping https ssh http     next end My workstation IP is 192.168.1.14 and I'm am able to ping it successfully.C:\Users\Arpit>ping 192.168.1.200 Pinging 192.168.1.200 with 32 bytes of data: Reply from 192.168.1.200: bytes=32 time=119ms TTL=64 Reply from 192.168.1.200: bytes=32 time=211ms TTL=64 Reply from 192.168.1.200: bytes=32 time=307ms TTL=64 Reply from 192.168.1.200: bytes=32 time=389ms TTL=64 Ping statistics for 192.168.1.200:     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 119ms, Maximum = 389ms, Average = 256ms However, whenev

Hello,IS any solutions or workaround to allow guests to type in and send login and password immediately - not waiting for approval? It's quite problematic to explain to guests that they should wait until request will be approved, especially they can see form to put these credentials..Perfect scenario would be when guests can type in credentials, sent them immediately and wait for approval.Thanks for any help

Hi Guys,I’ve been using a FortiGate 60E in my homelab for about a year now, and it’s been working great. However, I’m considering upgrading to something more powerful with additional ports. I recently came across a good deal on a FortiGate 100E for around $100 USD.Before making the purchase, I’d like to hear from others: is it worth upgrading to the 100E, even though support is scheduled to end in 2026?I don’t have the budget to buy one of the newest models that’s I am looking at older models.

HiCan i use the same ip range for multiple tunnels in ipsec remote access vpn. thing is i make three tunnels for the same group of people but with different internet links. Can i assign a same ip ranges for all three tunnels for clients to get when they connect to tunnel or is it gonna lead to ip conflicts and i have to assign three different ip ranges for each tunnel?