Fortinet Community

Using version 7.6.3 on the Fortigate (also tested this on v7.4.7) and a Fortigate-120G. Has anyone tried using the automation tab to create a stitch that when triggered will send a notification to a webhook? And that webhook being a power automate "When a teams webhook request is received"? I have this setup for when a user logs in, and I see the stitch being triggered, but power automate never receives the webhook request. I tested with Postman to make sure that the power automate link was good, and it was because it posted a message in a channel when I sent a test. I also used a website called webhook.site to see what exact information was being sent and the stitch was able to send the webhook request to this site and I was able to see what information was being sent. But again when I send it to power automate, it never even receives the request.

Hello, I would like to know the specifications of Fortigate, when is a reverse lookup done when a name resolution query is made to a particular domain? example:■forward lookupFQDN : aaa.comIP : 54.11.11.11 ■reverse lookupFQDN : bbb.comIP : 54.11.11.11 Is there a possibility that different name resolution will be performed even if the IP address is the same?Also, if there is a way to check reverse lookups with a command, please let me know

I have a FortiGate 70f firewall with two ISP connections configured on WAN1 and WAN2. I have configured static routes for both the WAN interface, also created firewall policies for both the interface. But when my WAN1 is goes down, the failover to WAN2 is not working, I have to disable the down WAN interface static route then it divert traffic to WAN2. I don't have anything running on this firewall as this is new device and want to test it first and then put it on production environment. Here the my setup is little different, I kept normal unmanaged 8 port switch between ISP and Firewall, means ISP first comes in my 8port switch then from switch to Firewall. If I connect ISP directly back to the firewall it works perfectly, it only give me an issue when I have 8port switch between ISP and Firewall. I need expert advice on this issue. Thanks in advance.

Running Fortigate 7.6.2.  I would like to set up Shadow DNS server to improve ZTNA proxy queries for a *.example.net proxy.  All possible matches for *.example.net can be looked up via our AD DNS servers inside our network.  So my question is should I put the DNS service on the WAN interface or should it be on the LAN interface? The ZTNA users are on the WAN side.  The AD DNS servers are on the LAN side.

I am unable to push a certificate to endpoints on EMS. I have uploaded the certificate in EMS, and I can confirm that EMS has picked it up and is reporting the certificate is valid. Under the Systems Settings Profile, I have checked "Install CA Certificate on Client" and checked my certificate. I can confirm that the System Settings Profile is applied to the group my test endpoint is in. I can also confirm the certificate is valid, I was able able to manually install and trust it on my test system.I know this setting works with another certificate, as we are using it to push a different certificate to endpoints. However, this new certificate is not being pushed out. I cannot find anything in the documentation about this -- does anyone know why a certificate would not be sent out to endpoints?

can someone tell me if fortigate 60F has battery in it and also provide material data sheet for Fortigate 60F

Hello,While trying to create a new VDOM, I encountered the following error message. Note that this is the first VDOM I am creating on this FortiGate-VM.Can someone please help?

Hello experts,I have a FortiGate Active-Passive cluster (FG-101F) running version 7.2.10.I configured the mgmt port on the firewall for management purposes. In the HA configuration, I wanted to add the mgmt interface under Management Interface Reservation in order to manage each cluster member separately.However, the mgmt interface does not appear in the list. I also tried to configure it via CLI, but I received an error message indicating that the interface is unavailable.Thank you for your help.

Hello everybody,I'm working on a Fortigate 70G v7.2.11.Long time ago I created an IPSec Tunnel using a wizard tool.On this tunnel, I enabled the split tunneling.I have 2 Windows PCs (PC A - Windows 10 / PC B - Windows 11)On both PCs I have a free FortiClient VPN version (PC A: 7.2 / PC B: 7.2 and then I tried to upgrade to 7.4).What I'm pretty sure of is that each client should receive, connecting with the same settings on the same tunnel, the same configuration.This is the PC B configuration:        This is the IPSec tunnel:  On the working PC A, routes are configured correctly (route print): Network address             Mask          Gateway     Interface  Metrics          0.0.0.0          0.0.0.0    192.168.1.254     192.168.1.66     35         10.0.0.2  255.255.255.255 &n

I have a 60F and a 100F and both of them have stopped generating any kind of system events or logs whatsoever. They have both been working as intended for years up until yesterday when I got on to check some wifi logs and there is just nothing there suddenly. I've tried diagnose log test and still have nothing. Any help would be appreciated. Thanks.

Hi, We are migrating our SSL VPN to IPSec VPN (IKEv2), so moving the users from Ldap (AD) to Radius (NPS). Users can use SSL and IPSec simultaneously, which is great. But we faced an issue with duplicate push notifications when using FortiToken Mobile in conjunction with Radius authentication. If the same user connects to SSL VPN, he/she only gets one push notification, if the user is Local (without Radius or Ldap) he/she also gets only one push notification. So, the issue is only when using Radius authentication. ftm-push debug shows duplicate FTM messages in case of Radius (identical with the same token and reg_id), in other cases there is only one FTM message. What could be the issue and possible solutions? FortiGate-70F, FortiOS v7.2.11. ===user config=== config user local edit "user" set type radius set two-factor fortitoken set fortitoken "FTKMOB***" set email-to "***" set radius-server "dc1-radius-new"

Hi, we have a small office connected with fiber from Vodafone. Their router has 192.168.1.1 and we have a transfer network to our FG WAN 192.168.1.254. With this kind of router we were not able to connect the fiber directly to the FG so we had to configure it like that. Now we have problems for months now. Every other week for 2-3 days the users loose connection to the internet like 4-5 times a day. Later we check and everything seems normal. Vodafone sent like 4-5 times a technician to test and he connects the laptop to the router and also everything is fine, so we are doing nothing to check the situation. Any siggestions we could do or test? Thanks!

I used foritgate 1101E in china  we all used forticlient the chinese network can't access google play store ,but we have mpls vpn line to outside china through SSL-VPN to access google play store .android phone still can't to access google play store after conecting to ssl vpn ForiTac: the traffic of android.clients.google.com is forwarded from the local network when conecting to a tunnel ssl vpn    

Alright, so we just migrated our datacenter firewall from a Cisco ASA to new FortiGate boxes, and inside this DC is our primary/active FortiManager VM. Well with this migration we pre-created the DNAT policy to map a public address to the inside IP of the FortiMAnager VM but intentionally did not create a security policy expecting all the traffic would be blocked and all the external/remote boxes would disconnect. To our surprise, after the migration was completed we logged into FortiManager and found that all the remote firewalls are still connected and fully communicating. After this discovery we quickly logged into the edge firewall and do not see a single trace of that traffic outside of hit counters on the DNAT rules. It's as if this traffic doesn't exist - the only thing demonstrating it exists are all the connected devices. The firewall is running in policy-based mode, and there is currently a 1:1 DNAT rule, but no security policies for the flow. Has anyone experi

Hello everyone!In our environment, we use wsus as PC patch management.We would like to connect it to fortinac so that we can use it in the remediation vlan. Do you have any ideas?

Hello, dears!I hope this message finds you well. On our Fortigate, we have 2 lines, one for backup. The backup cable (LAN) comes from an antena, and we have used an injector to give it power. The port LED turned amber and doesn't blink. This has happened before, and I kept moving to a new port, which have made me use around 3 ports for the same line. This is so annoying to configure new ports for the same purpose. EDIT: The problem is the connection is shown on the SD-WAN Zone, but with very low speeds of bps, making it not usable at all. Now, it has happened again. I don't know ho to solve this. NOTE:- The line works when I connect it to my PC directly.- We have used SD WAN Rules and Firewall Policies to make different SSIDs use the Main line and Backup line. #Fortigate 

Dear community,I'm trying to integrate an F5 WAF with FortiSandbox using ICAP on port 1344. The goal is to have the F5 WAF send PDF files to FortiSandbox for analysis.I have configured both the F5 WAF and FortiSandbox accordingly, but ICAP connectivity is not working. I also attempted to telnet to the FortiSandbox IP (ICAP server) on port 1344, but the connection was refused (even though ping works fine).My questions are:Are there any methods to test ICAP connectivity and troubleshoot the issue to determine whether the problem is on the F5 or FortiSandbox side?Is a FortiSandbox license required for integration with the F5 WAF?Thank you in advance

Hi All, I'm having trouble with SD Wan Rules, I have a scenario that when ISP1 goes down I want it not to failover to ISP2.I already tried to create SD WAN rule, the Interface selection strategy is in MANUAL, and only 1 outgoing interface is selected, but when I simulate ISP1 to go down, it still goes to ISP2. Also have dedicated health check for the said SD WAN rule with Update static route disabled. note: Fortigate 101F v.7.4.7 Any help will be much appreciated. Thanks

Hi I am trying to activate the permanent evaluation license without any luck!Here what i am getting on CLI:FortiFirewall-VM64-KVM # execute vm-license This VM is using the evaluation license. This license does not expire. Limitations of the Evaluation VM license include: 1.Support for low encryption operation only 2.Maximum of 1 CPU and 2GiB of memory 3.Maximum of three interfaces, firewall policies, and routes each 4.No FortiCare Support This operation will reboot the system ! Do you want to continue? (y/n)y Failed to download VM license.execute vm-license-options account-id mymail@mail.comexecute vm-license-options account-password mypasswordThe username and password are 100% correct DNS is working and i can ping forticloud! GUI looks like this:  What do I miss here? 

Hi,  can anybody tell me if FortiOS and other products from Fortinet are affected by the new RegreSSHion Exploit, CVE-2024-6387? Regards, Brisacto

Hello, i have a Fortigate 30E in our enviroment, but i lost the login credentials. now i bought a second one of the Fortigate 30E. so i want to make a firmware update, but it seems to be its impossible to get firware without registrating the device in the portal of Fortinet. First question, if i register the device to get an update, can i unregister it, for selling it after using ist for my work?  so if the firmware was updated, ill want to send it to the location for using it for the guest w-lan connection.  the problem device with the lost login credentials would be send back to me, so i can make to reset the device an make a firmware update too, on it.  if the problem fortigate 30E was reconfigured, ill want to chage it to the first fortigate 30E again, and want to delete the backup fortigate 30E. #second question, how can i make a reset on the problem fortigate 30E how can i do that, is it possible to reset the configured fortigate

Hi all I'm aware of the following resource for finding out what software versions are still supported and when hardware goes end of life:   https://support.fortinet.com/Information/ProductLifeCycle.aspxDo Fortinet provide an API to be able to programmatically access this information?  For example, Cisco provide a number of APIs to query things like recommended software versions, end of life for hardware, etc.: https://developer.cisco.com/site/support-apis/   I'm looking at automation to pull this information into our monitoring and CMDB systems, so ideally want to avoid having to manually review the info on the Product Lifecycle pages on a regular basis. Dave

Backstory:We're a small MSP that has a client with existing Fortinet equipment, which means they use FortiClient VPN, we also use Pulseway to do 3rd party patching with a delay to make software update a few weeks after new patches.This Monday, April 14th, we got reports of pre-boot BSOD, specifically PAGE_FAULT_IN_NONPAGED_AREA and some driver related ones but in all cases the "what failed" was fortitransctrl_74.sys in c:\windows\system32\driversThe most annoying part is you couldn't boot in safe mode, no matter what you tried it would always BSOD before the advanced start menu would appear.To fix the issue we used Windows ToGo usb and renamed the misbehaving driver, computer would boot back up no problem.The other weirdest part is it only happened to computers with intel 10th gen (10500T/10210U/10505), the OS breakdown was 5 Windows 11 and 2 Windows 10 but all windows 11 were not fresh installs but upgraded from Windows 10. This is with a client that has ~100 computers operating on av

Hello all,I have site 2 site tunnel between paloalto and fortigate firewall.On paloalto firewall i have enabled tunnel monitoring with fortigate but i can see on paloalto tunnel monitoring shows down.i can see packet send on paloalto keep on increasing but packet received is 0.no issue with monitoring range proxy ID but issue with all other proxy ID in same tunnel.Anyone know how it works and what i may be missing.

Hello , Our client is requesting a firewall cluster consisting of two physical appliances (we don't know whether this is active/active or active/passive).He has requested a requirement : "Threat prevention throughput of the firewall cluster: minimum 18 Gbps." Does this throughput need to be guaranteed for each firewall, given that the traffic will ultimately be handled by a single firewall? Or does this mean that each must ensure a minimum of 9 Gbps?