Fortinet Community

Hello team! I hope you are fine!Recently a user reported me a problem, after some troubleshooting, I find something new for me:This is one of these enents, in SSL section: date=2025-06-04 time=09:56:47 eventtime=1749041807646108870 tz="-0300" logid="1702062101" type="utm" subtype="ssl" eventtype="ssl-negotiation" level="warning" vd="root" action="blocked" policyid=25 poluuid="916a1a8a-ab4a-51ef-8238-c0f79567272e" policytype="policy" sessionid=234042452 service="HTTPS" profile="certificate-inspection_Alumnos" srcip=10.1.1.35 srcport=50274 srccountry="Reserved" dstip=104.21.96.1 dstport=443 dstcountry="United States" srcintf="VLAN1" srcintfrole="lan" dstintf="wan2" dstintfrole="wan" srcuuid="bc5355aa-c400-51ed-6f23-4fa5e520c8f9" dstuuid="5a9b4e2a-bf4c-51ed-dc50-e448f485ac50" proto=6 eventsubtype="encrypted-client-hello" hostname="cloudflare-ech.com" msg="SSL connection is blocked." The certificate inspection profile, is the following: config firewall ssl-ssh-profile&n

I create web filtering name Block_Social_Media and apply for all user in Vlan4, but I want to whitelist a few IP address of this Vlan4 to access Social Media. How to config that in FortiGate?

Hi all, A FortiGate firewall Restarted around couple of weeks ago. Is it possible to find why it was restarted? I know it wasn't done manually and there was no power outage.  Thanks.

I am trying a schema as shown in the screenshot.Currently, when the setting is like this, you can access the Internet normally using bridging, but when using the channel, you can obtain an IP but cannot access the Internet. Checking the AP log, you can see DNS-no-resp.There are also policies set. Not sure what went wrong.FG-VM uses the free version.

Hi everyone,Spoiler (Highlight to read)สวัสดีทุกคนฉันกำลังใช้ **FortiGate 200G** รัน **FortiOS [เวอร์ชัน — ใส่เวอร์ชันของคุณที่นี่ egv7.2.8]**เมื่อฉันรันคำสั่งต่อไปนี้จาก CLI:ดำเนินการ traceroute-options source 49.231.244.67 ดำเนินการ traceroute 49.231.244.70 ฉันได้รับข้อความแสดงข้อผิดพลาดนี้:traceroute ถึง 49.231.244.70 (49.231.244.70), สูงสุด 32 ฮ็อป, 3 แพ็คเก็ตโพรบต่อฮ็อป, แพ็คเก็ต 84 ไบต์1 49.231.244.70 <m.lannapoly.ac.th> 0.028 มิลลิวินาทีtraceroute: sendto: การดำเนินการไม่ได้รับอนุญาตtraceroute: เขียน 49.231.244.70 84 ตัวอักษร, ret=-1 มีใครเคยเห็นปัญหานี้มาก่อนหรือไม่?สวัสดีทุกคนฉันกำลังใช้ **FortiGate 200G** รัน **FortiOS [เวอร์ชัน — ใส่เวอร์ชันของคุณที่นี่ egv7.2.8]**เมื่อฉันรันคำสั่งต่อไปนี้จาก CLI:ดำเนินการ traceroute-options source 49.231.244.67 ดำเนินการ traceroute 49.231.244.70 ฉันได้รับข้อความแสดงข้อผิดพลาดนี้:traceroute ถึง 49.231.244.70 (49.231.244.70), สูงสุด 32 ฮ็อป, 3 แพ็คเก็ตโพรบต่อฮ็อป, แพ็คเก็ต 84 ไบต์1 49.231.244.70 <m.lannapoly.ac.th> 0.028 มิลล

Hi there, I'm trying to restore an ecrypted configuration, however, it looks like the Password field is missing in the macOS (14.5) FortiClient VPN (7.4.0.1645)  It would seem that the Windows version of FortiClient (7.4.0.1658) does indeed support this.  Is there a way to work around the issue until it's resolved? Cheers,Attila

Hi,we are planning to buy some 70G - now I have learned that they only support version 7.0.Is there any ETA for version 7.2/7.4?Thanks. Jirka

 Two Cisco firewall in active passive mode. Suppose I put two Fortigate firewall ha pair one on each side inline behind the Cisco firewall for monitoring. How do I detect the Cisco firewall switched it's active one and therefore will switch to the correct active side on the Fortigate?Can link monitor accomplish this? If so how?Will changing Fortigate HA to active active help with this or cause more problem?Will breaking the Fortigate HA pair so both units are standalone work?

Hi all, Have a Fortigate 81F running 7.0.17. I note that some CVE's such as FG-IR-23-293 and FG-IR-24-250 are listed as being vulnerable on all 7.0 versions. Is it likely that the 7.0 firmware will never get these fixed and we should move to 7.2? thanksJC

Hi all,I’m running Windows 11 24H2 (Build 26100.4061) and recently ran into an issue:I need to connect to two different Fortigate units at the same time for work purposes. Up until now, my workaround was to use both the FortiClient from the Microsoft Store and the standalone FortiClient VPN application. This allowed me to have two VPN connections active simultaneously—each to a different Fortigate.However, after updating to the latest Windows 11 release, this setup no longer works.As far as I know, this was the only way to achieve dual connections on one Windows device.Is anyone else facing the same problem?Are there any alternative methods or solutions to establish two concurrent VPN SSL connections to separate Fortigates from a single Windows 11 system? Or is there an official workaround from Fortinet?This setup is critical for my workflow, as I have to manage resources on both networks at the same time.Any advice or insights would be greatly appreciated!Thanks!Andreas

We've recently upgraded firmware on our 901G to v7.2.11 (from v7.2.8) and since then we're experiencing random internet slowdowns across our sites. Memory and CPU usage are running at normal levels and it appears there is plenty of available bandwidth on our primary Internet Circuit. We use proxy based inspection, with SSL certificate inspection selected. I have found today that if I change certificate inspection to no inspection on the policy that we have had no internet slow downs since. Has something changed between 7.2.8 (where performance was fine) and 7.2.11 where we are seeing these issues? It is worth noting that due to a GUI bug I wasn't aware of the FortiGate ignored the recommended upgrade path and went straight to 7.2.11. I have seen this article How to fix 'SSL connection is blocked... - Fortinet Community however we are not using flow based. I am also seeing floods of "Server certificate is re-signed as untrusted, certificate-sta

Hello,I'm new to FortiGates, moving off of SonicWALL. I'm trying to set myself up for success, and not setting myself up for failure.I have a FortiGate 600F, and 2 web servers that are hosted internally. These web servers are accessed by many users daily, across many different countries, so I'm concerned about security.Since we operate two web servers and our websites are customized for a wide range of clients, we manage numerous unique URLs. To streamline this, we use a wildcard domain certificate.. Right now, I have a basic policy. Incoming WAN interfaces to VIP, with HTTP/HTTPs services, and NAT enabled, no security profiles. I think its wise to setup at a basic, IPS and WAF security profiles. As default, SSL inspection "no-inspection" is selected, and gives the standard message " The no-inspection profile doesn't perform SSL inspection, so it shouldn't be selected with other UTM profiles or features that require SSL inspection."What is the correct approach to configu

Hello experts,I have configured interfaces x1 and x2 on the FortiGate as an aggregate interface, and on the other side, a Port-Channel on a Cisco Nexus switch.I am experiencing ping loss from the FortiGate to a specific IP address.Could you please help me troubleshoot this?Below is the configuration.Switch  Firewall:

I have a question regarding blocking the Cloud flare warp app on our application control in the firewall settings.I have blocked all proxys and VPN's in the generic filters and the app is inside those blocks. However the app still seems to run and bypass all filtering on the firewall. When I run a scan I can see that the app is working and bypasses the application control settings.Anyone know what this problem?Is it a tunnelling problem or a port?I can see it uses the MASQUE protocol.

 Hi,Guys, I am facing a problem that is difficult to identify the reason;SW CORE VLAN 248 is delivering dhcp;VLAN 248 passing in the trunk to SW2;TRUNK from SW2 passing VLAN 248; VLAN 248 created on the fortiswitch, but when I put the vlan on an access interface I get these alerts in the log and obviously it doesn't deliver dhcp.what tests can I do to try and identify the problem?

Hi,I'm trying to use SSL VPN web mode on a FortiGate 60F running v7.4.8 build2795 (Mature). This has worked before and has stopped working without changing the config. Is anyone else experiencing simular issues?Thanks -- Screen when browsing to WebVPN --First screen after browsing to webvpn-- Screen after pressing OK --login screen after pressing 'ok' on first screen-- Browser network log --browser network logFortigate diagnose log:2025-06-02 11:56:23 [403:root:b]req: / 2025-06-02 11:56:23 [403:root:b]mza: 0x358f360 /rmt_index.html 2025-06-02 11:56:23 [403:root:b]fsv_check_path_passed:997 No access: check path failed /migadmin/rmt_index.html, /data/migadmin, /migadmin 2025-06-02 11:56:23 [403:root:b]sslvpn_zip_handler:136 sslvpn check path failed. 2025-06-02 11:56:23 [403:root:b]req: /sslvpn/css/ssl_style.css 2025-06-02 11:56:23 [403:root:b]mza: 0x358f3a8 /sslvpn/css/ssl_style.css 2025-06-02 11:56:23 [403:root:b]fsv_check_path_passed:997 No access: check path faile

Dear Community Members,I hope you are all doing well.I am trying to configure an event handler for CPU and memory usage that generates an alert when usage exceeds a defined threshold in FortiAnalyzer version 7.6.2 for connected FortiGate devices. However, I want to avoid alerts for brief spikes or hiccups. Specifically, I want the alert to trigger only if the CPU or memory usage remains above the threshold for 5 minutes or long.Unfortunately, I’m having trouble implementing this logic and would appreciate expert guidance on how to achieve this setup. Please See attached screenshot. Thank you in advance for your support.

Hello,I install Forticlient 7.4.3 on Ubuntu, but I do not get any response from Fortitoken. Nor in forticlient gui, nor in console fortivpn connect. I install all dependensies from https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-install-latest-FortiClient-software-on-the/ta-p/378757. confighandler.log:20250430 14:34:21.482 TZ=+0200 [confighandler:EROR] about:105 Failed to get icdb metadata: i/o error: No such file or directory (os error 2)20250430 14:34:22.883 TZ=+0200 [confighandler:EROR] vuln:58 Failed to read vuln scan result: i/o error: No such file or directory (os error 2)20250430 14:34:22.887 TZ=+0200 [confighandler:EROR] antivirus:49 Failed to get total quarantine entry count: i/o error: No such file or directory (os error 2)20250430 14:34:22.917 TZ=+0200 [confighandler:EROR] vuln:58 Failed to read vuln scan result: i/o error: No such file or directory (os error 2)20250430 14:34:22.932 TZ=+0200 [confighandler:EROR] vuln:58 Failed to read vuln scan result

Dear　Team I upgraded Fortigate v6.0.X to v7.0.11 according to the upgrade path.After update We cannot call park with sip server. We are using only FW policy for IP telphone . we do not use Voip profile . I think that fortigate was changed default value v6 to v7. but I cannot find the information.Could you have any infomation. 

Hi Team,We are implementing Explicit proxy at the customer end with Fortinet Firewall-601F. The scenario is we have two VDOM's i.e. Proxy and Perimeter. The user traffic will pass from Proxy towards Perimeter to reach the internet.For user authentication, we are using FSSO. The challenge we are facing is that in FSSO only groups are calling rather than specific user. Our goal is to apply separate policies on the user. In FSSO, we have fetched the AD user locally via LDAP rather than collector agent. The problem is that we have got four active directory and in FSSO only one of them is allowed to add. A user can land on any of the Active Directory for the authentication whereas if any user landed on the active directory that is not part of the FSSO will not be able to authenticate. So kindly help and advise, how can we resolve and overcome the said issue. Moreover, please also let us know in Explicity proxy what is the recommendation either FSSO is more valuable or Kerberos.

Dear Fortinet Community :) Today I have a quite simple question. I have received a new FortiGate (Fortigate 401F) and a new FortiAnalyzer (FortiAnalyzer 300G). Both are up to date with version 7.4.8. I have connected both devices to each other and authorized the FortiGate on the FortiAnalyzer. Was a simple task and worked easy peasy. Then I have created my interfaces for testing purposes. A WAN interface and a test client interface (LAN). Created my route so that I can browse as client through the web. I have defined the policy in a way that everything should be logged. Now my question: Question: When I want to have a look at the log on the Fortigate I can switch to show the logs from the analyzer. But they are always empty. No results. I can see the logs when switching back to show the logs from the firewall itself. How is this possible? Why do I not see logs when switching to show logs from the analyzer? One thing is different to the production environment. In my produ

Hi everyone,I'm experiencing a recurring issue with FortiClient VPN (version 7.4.3.1790) on Windows 11 Professional.The VPN connects successfully, but approximately 25 seconds after the connection is established, it drops automatically without any user action.Looking at the logs, I see messages like:WSAEnumNetworkEvents FD_CLOSE (10053)Failed to connect to SslvpnDaemonThings I’ve already tried (unsuccessfully):Full uninstall and clean reinstall of FortiClient (including registry cleanup)Disabling IPv6Trying different internet networksUpdating Windows to the latest versionChecking firewall and antivirus settingsIs anyone else facing the same issue or has found a workaround or permanent fix? Any help is greatly appreciated!Thanks in advance!

Requirement :Dc Fortinet Firewall :70FDC Firewall ka WAN IP: 103.62.237.154Public IP Pool (NAT ke liye): 103.62.237.153/30Branch Fortinet Firewall: 2 Wan 1 PPPoe WAN1 and 2nd DHCP Wan2Need Tunnel Between DC aur Branch Branch : Fortinet Firewall 40FBoth Tunnel will UP but Traffice will go depend Primary and secondaryBranch office ke ek system ka IP: 103.62.237.158"What is my IP" site par 103.62.237.158  show   Scenario Overview:You have a Fortinet Firewall deployed at both your Data Center (DC) and Branch Office, and a Site-to-Site VPN tunnel is already established between them. You want internet traffic from a specific system in the branch office to go out via the DC firewall, using a specific public IP (103.62.237.158). That is, when that system browses the internet and checks “What is my IP?”, it should show 103.62.237.158.Network Information:1. DC Fortinet Firewall:WAN IP: 103.62.237.154Public IP Pool for NAT: 103.62.237.153/30 → usable IPs:103.62.237.153 (n

Hi All, We are experiencing strange behavior in our Fortigate 4401F A-P HA environment. During reboot of the standby device, some sessions, which are carried on the active device, are dropped/stucked. Does anyone encountered such behavior? Thank you!   

Hi all,We have just got our iPads to connect using the FortiClient app with IPSEC and SSO and this works fine so the user can log in using their Azure details and then the login window shows that they have successfully logged in and this window then disappears and the VPN then connects however we've noticed that the Windows FortiClient app doesn't have the SSO option with IPsec (correct me if I'm wrong on that but it only seems to be for SSL) so we're trialling the ZTNA with a view to getting EMS (we don't have EMS installed yet though) and found this DOES have the SSO option with IPsec so I've configured it the same as the iPads and it shows we're successfully logged into the SSO but then whereas on the iPads the window disappears, this doesn't happen...the window just stays there and if we close it then the VPN goes from disconnect to connect as though it's just disconnected but if I check the VPN status without closing the window then it's not connected anyway ?I've tried both the i