Fortinet Community

Hello,on Fortigate 100F how I can monitor the PSU state without execute a commenad in a shell? When a PSU is disconnected the system LED should be amber?I tried to disconnect one of the PSU and I not have any alarms from the hardware led and also in the GUI. Thank you.

I have configured a default route via a SDWAN zone for Internet breakout traffic, this consists of two internet connections. The default route via this SDWAN zone is not being populated in the routing table, both interfaces are up and working. For testing I set a default route out WAN1 and then WAN2 separately, they were both able to reach the internet and the default route was stored in the routing table. Any possible ideas why the route is not being installed and working with the SDWAN zone?     

Hi there, it's a little bit off-topic (non-technical) but belongs to Fortinet. I see many user having their actual Fortinet level as color banner under their Reddit user name shown here (NSEx, FCA etc.) ... I cannot find this option to enter this information. Where to do so?

I can't seems to get this working, I want if somebody connect to User SSLV VPN via FortiClient then they can connect to any local device at least by ping, but specifically for this I want them to connect to Synology NAS IP which is 192.168.110.81 I have added this policy```===config firewall policyedit 7set name "SSLVPN_FortiClient_Outgoing"set uuid fb89aba2-f0f5-51ee-81b1-c690350fbb9dset srcintf "ssl.root"set dstintf "internal"set srcaddr "SSLVPN_TUNNEL_ADDR1"set dstaddr "MGMT_Device" "MGMT_DEVICE" "SYNOLOGI"set action acceptset schedule "always"set service "ALL"set utm-status enableset ssl-ssh-profile "certificate-inspection"set av-profile "Server-AV"set webfilter-profile "default"set dnsfilter-profile "default"set ips-sensor "Server-IPS"set application-list "default"set logtraffic allset groups "SSLVPN_USER"set nat enablenextend===``` but  still seems can't get it workIf I change [set srcintf "ssl.root" ] into other local VLAN like 192.168.60.xxx then it work perfectl

Since SSLVPN will be going away on small units, I have been switching users to IPSEC VPN as we roll out new firewalls. However, I have been having a lot of trouble with the VPN-only Forticlient. The big issue is that, for 30-40% of new Forticlient installs, the client does not seem to respond to the firewall's replies in Phase 1. Firewall log shows P1 successful, then timed out 30 seconds later. If I run wireshark on the client, I see the firewall's traffic arrive at the PC, but then the Forticlient seems to just re-send the first packet again. Seems like only an uninstall-reboot-reinstall has a chance to fix this, winsock reset doesn't seem to do anything.The other thing is that when the client fails to connect, the window never updates, it just sits there on "disconnecting." Closing the window and re-opening it from the taskbar gets it back to normal, but I don't remember SSLVPN's ever acting like that. Today I tried using the Windows native client instead, but it seems lik

I use the Dynamic Device & OS Identification for addresses and it works great, BUT it only works for IPv4 as far as I can see. You can define an address by MAC address in both IPv4 and IPv6 but you can't create a Dynamic address in IPv6 based on Device or OS.  Why is this missing?  Its a very helpful feature in IPv4.  Is there a workaround? I'm on 7.4.8 

I got error Login: Please enter your username and password when I try to connect to VPN, with protocol SSLVPN.Problem is just on my iPhone 7 with iOS 15 (not possible to upgrade to higher OS). On another iPhone with latest iOS all works well.  Not working on both FortiClienbtVPN and FortiClient apps. Version of app: 7.4.7.0183

Hello, So i have a problem and cant solve without some help. We have two Fortigates, Main office (Site A) and the new one (Site B). I connected them by IPsec tunnel, with ph2 address 0.0.0.0/0 to both sides. Tunnel is up and working fine, but now i want to route two local subnets  of SiteB to go to internet over SiteA. and other subnets go to internet from local WAN. Topology: 10.20.1.0/24 -> SiteB FTG ->IPsec Tunnel->SiteA FTG->Internet10.20.2.0/24 -> SiteB FTG ->IPsec Tunnel->SiteA FTG->Internet10.99.99.0/24 -> SiteB FTG ->Internet I am trying to use policy routes but its not working or i am doing something wrong. Any help would be nice. 

Hi All, I have two custom IPSec tunnels setup on FortiGate from same local WAN interface connecting to remote site on different WAN interfaces. The first tunnel is up and running without issues, but the second tunnel shows inactive and show now activity under the events log. The tunnel interface behaves as if disabled but it's not. Any ideas where to start looking? Checked the setting again and again. FortiGate firmware v7.0.15 build7480Some details below: get vpn ipsec tunnel summar'HUB-V1' 197.245.xx.xx:0 selectors(total,up): 1/1 rx(pkt,err): 12247/0 tx(pkt,err): 16156/2'HUB-V2' 169.255.xx.xx:0  selectors(total,up): 1/0 rx(pkt,err): 0/0 tx(pkt,err): 0/1  FW # get vpn ipsec tunnel detailsgatewayname: 'HUB-V2'local-gateway: 217.91.xx.xx:0 (static)remote-gateway: 169.255.xx.xx:0 (static)dpd-link: offmode: ike-v1interface: 'ppp2' (25) vrf:0rx packets: 0 bytes: 0 errors: 0tx packets: 0 bytes: 0 errors: 1dpd: on-demand/unnegotiatedselectorsname: 'HUB

Hello Fortinet Team,Our legitimate website, https://dalnicniznamka.cz/, is repeatedly flagged as phishing by Fortinet, despite multiple reviews and confirmations that no such content exists. Only Fortinet showing Phishing and every other tools/engines showing clean.We kindly request a manual review and a clear explanation of why this detection keeps reappearing. This is a false positive and is negatively affecting our users and reputation.Please help us resolve this issue permanently.Thank you. Proof Attached  

Hi all, I have setup a new Fortigate 1101E cluster with FortiOS 6.2.10. Now I'm trying to configure radius authentication for administrators but when I try to set as source-ip the IP of the MGMT interface I get this error: x.x.x.x is not valid source ip.node_check_object fail! for source-ip x.x.x.x value parse error before '10.119.254.120'Command fail. Return code -8 What am I doing wrong? Thanks,M. 

I recently completed fcf and fca certificates and im looking into to doing one of the following fcp certifcates but it looks somewhat overwhelming, looking to find any practice or lessons that involve nse 4 os training but cant find it on the fortinettraining portal. Is there any advice I can get for preparing for it when i schedule an exam or any tips to further progress in the program. For reference im in college just finding something else to learn while im on break or when not alot of work related to college.

Hi, can anyon clarify what is happening with Fortigate 90G and new firmware versions 7.4.6 or 7.6.1?I have the Fortigate 90G + 7.4.5 + SSLPVN service in production without problems, but:on the one hand i read this:https://docs.fortinet.com/document/fortigate/7.4.6/fortios-release-notes/84653/ssl-vpn-not-supported...and on the other hand i read this:https://docs.fortinet.com/document/fortigate/7.4.6/administration-guide/140089/ssl-vpn-to-dial-up-vp...Fortigate 90G has 8GB of RAM... what happend with SSLVPN if I will upgrade from 7.4.5 to 7.4.6?Thanks!

Hello, I often have problems connecting to WiFi networks. The error I get is:"Unable to join the network "SSID NAME"This network operates on Wi-Fi channels that are also used by several nearby networks.Restarting the wireless router may allow it to automatically select the best channel and thus resolve the issue.When it comes to configuring the Access Points themselves, networks 2.4 and 5 are enabled, channels on 2.4 are 1,6,11. No interference. What could be the reason for such a message? The device on which the problem was noticed is an iPhone 16 Pro.Hardware:- AP - FAP-231G- UTM - FG40F- Switch - FortiSwitchUpdate: I have native NAC applied in my network. 

Hello,Discovered that starting from FortiClient 7.2.5, the 1st 'Client Hello' packet added TLS1.1 as supported version and caused problem in establishing VPN connection with proxy (seems the proxy disallowed the TLS 1.1 support).This can be overcome by creating registry keys HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 DisableByDefault = 1Enabled = 0 However, this has no effect in Windows 10 as the format of the1st 'Client Hello' is different from that of Windows 11 which does not carry the 'supported_versions' information.  Is there any method to make this works in Windows 10 environment? Thanks.

Hi, I see that from doc 7.47: (https://docs.fortinet.com/document/fortimanager/7.4.7/administration-guide/186508) If you set trusted hosts and want to use the Console Access feature of the GUI, you must also set 127.0.0.1/255.255.255.255 as a trusted host. but I cant add 127.0.0.1 from GUI error "invalid ip address ... must be class A,B,C, etc"and I still can connect from console access ! the doc is wrong or not up to date or its me ! Thank you for your answer

Need to check impact in case we didn't upgrade from version 7.4.5 to 7.4.8.

I switched to Let's Encrypt on my Ubuntu 24.04.2 web server for multiple web sites.   It is a pain to move the certificates from this server to my Fortinet 61F ever 60 days1.) install the certificates on the 61F2.) Create a deep SSL/SSH inspection certificate for policies3.) Add them to multiple policiesI want to run this every night. Fortinet worked on getting Let's Encrypt working on the 61F.   They never got it working to create a certificate with all the names. I could do wildcard for the two domains.  This would be easier to copy it from the 61F to the directory on the web server.   

hi there,I need help please.I need to add many url list to be allowed. so I plan to use urfliter inside webfilter profie (existing webfilter profile). rather than to add one by one, it takes time. is there a way to copy - paste to CLI to add urlfilter for existing webfilter profile that already have some urlfilter as well?if yes, please help.I use FG60F with forti OS 7.2.4 by the way I've try use web rating by create new rating category and put all url insde that category.use webfilter profile activate fortiguard based category, block all categories except the new one. and inside that webfilter profile also has urlfilter active.but somehow all url inside urlfiter keep blocked because some of them refer to existing fortiguard web rating category. I expected all url listed in urlfilter will override setting on fortiguard webbased category.thank you  

Hi, I hope you are doing well, can someone provide me the link to report my PowerShell module PowerTree as false positive. It is already clean, and I wanted it to be removed from the blacklist.Github Repo: https://github.com/spaansba/PowerTree

Hi everyone, A website is accessible but it does not show Graphs/Its a physical FortiGate Firewall IOS FortiGate 40F, IOS v7.2.11 build1740  so, it opens the website ,but when it's time to open the reporting which have some graphs to display, it DOES NOT DISPLAY THE GRAPHS.any ideas, I went to the logs and all is pass...nothing 

Hi Everyone! Would like to ask if anyone had experience connecting a breakout cable LC to Fortigate 200FThe breakout Cable in question is the HPE/Aruba K2Q46A MPO to 4 LC.This will be connected on an Aruba Switch using JH233A MPO Qsfp+ so the LC side will be on the Fortinet using a fortinet 10GBase-SR  Sfp+ transciever FTLX8574D3BCLFTN.Would this work having the Aruba switch do the splitting to 4x 10G per breakout cable? Your thoughts on this is much appreciated. Thanks 

Hi,A customer of mine previously had a Fortigate device, for which the subscription expired in 2023. At the time, he had created a Fortinet/FortiCloud account for it. Now, he has purchased another Fortigate with subscription and would like to assign it to the same Fortinet account again. He still has the login credentials. However, when he tries to log in, he receives the following message: "This user is disabled."How can the account be re-enabled? Best regards,Karsten

 Is it possible to create a custom app package that contains the .MSI and a manifest file (.MST) with both the invite and telemetry codes? I have found a couple posts with command line arguments but they don't seem to work when running them on the my test device - it's still asking for both. Commands I've found on other posts: C:\Program Files\Fortinet\FortiClient> FortiESNAC.exe -c REG_REG_TO_CLOUD -r <invite code> FortiESNAC.exe -r ems-ip/FQDN -k telemetry-key <telemetry key> Essentially, I'm attempting to do an org roll out via Microsoft Intune and using the documentation produced, I've only found solutions for mobile devices and need to roll out to PC's. I've created a custom MST under the Property table I've injected values "ems_key" for telemetry code and "invitation_code" for the invitation code. It seemed to have not worked. Do they require to be in a different table, or is this not possible? install command: msiexec /i "FortiClient.

Hi FGT adminsWe have FGT 40F with FOS 7.4.7. It has s2s IPsec tunnel with HQ FGT.We noticed from time to time (approximately 10 times per hour) the there is no traffic going through the tunnel anymore for about a minute or two, then it back again to normal operation, while we see the tunnel is always up (both phase 1 & 2).When we replace the 40F with a 100F we notice all works fine with no interruption.The problem started about 2 weeks ago, even though there were no changes to the firewall (no firmware upgrade, no configuration changes).Any helpful info would be appreciated.