Fortinet Community

Hallo zusammen At home I have a Fortigate 40F for my home office.Unfortunately, my Fortigate 40F doesn't have that much RAM. (just 2GB)That's why Fortigate simply removed the proxy policies from firmware 7.4.4! ! !https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/519079?preview_token=6ac61bfb23d50d4e67fe I had proxy policies - these were simply changed to flow based during the automatic firmware update to 7.4.6!I would now like to completely switch off the automatic firmware update so that the Fortigage remains at 7.4.3 firmware version.I've tried this post several times, but every time my Fortigate updates back to 7.4.6 after about a week! ! !https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-disable-automatic-firmware-upgrades-on/ta-p/326998 Does anyone know what I can do to actually keep my Fortigate on 7.4.3????Thank youGreetingsSwiss daddy

Hello, Recently, in my company we've changed to FortiClient VPN.  All the computers of the company with Windows are working correctly and have a correct connection with the VPN Server, but in a specific department we have a Macbook Pro, and this seems to be not working as it has to. The device has the MacOS Monterey 12.6.3, it is updated at the maximum available, the problem with this device is that the connection is established but after literally 4 minutes, it's automatically closed.  I've researched some information based on the logs of the FortiClient, but nothing has worked for me.  I proceed to show the logs, if someone can help me out with this, I'll appreciate it. The first one is extracted from fortytray.log, and the second is from vpn-provider.log: 20241128 11:33:58 TZ=+0100 [FortiTray:DEBG] VpnManager.swift:699 VPN tunnel provider Main status changed: Connecting20241128 11:33:58 TZ=+0100 [FortiTray:DEBG] VpnManager.swift:988

The ProblemFortiManager allows for the scheduling of the execution of CLI and TCL scripts. When setting up scheduling, the user is able to select FortiGate devices OR device groups that are to be included in the scheduled script execution. But the way that the selection works, the device groups themselves are not actually assigned to the schedule. It appears that the devices that are in the group are assigned instead. This severely degrades the usefulness of selecting device groups, which is that when a group of devices is selected for the schedule, if devices are added or removed from the group, then they would be added/removed from the schedule execution. In this way, it would be easy to set up a schedule for a group and then simply maintain the desired device membership in the device group. Unfortunately, that isn't the behavior of group selection.Behavior exists on FMG v7.4.3-build2487 240514 (GA) and others.SetupFortiManager allows for the creation of CLI and TCL scripts. The

Bonjour à tous.J’aimerai savoir si c’est possible de coupler SNORT en IDS/IPS avec un FortiGate ?

Hey. Im aware that you can find vulnerabilities and version-recommendations as solutions to the specific vulnerability at Fortiguard Labs, but is there any place you guys find the overall recommended Forticlient version?I suppose you can find an overview of a recommendation somewhere, instead of every admin having to do the research every time, just to get the same result as everyone else who did the same

As captioned, could FortiNAC restrict the end users to access some webpages?Since my company would like to restrict the end users to access some public cloud page, such as gxxgle drive.

Hi, When connecting VPN from FortiClient getting the error message “The security certificate for this site has been revoked. This site should not be trusted”.I have verified the server certificate used under SSL-VPN settings and found that certificate is valid.FortiOS version - 7.0.15 

Hello everybody am facing an issue where when trying to create anew SD-WAN member in the interface option when I click it it is not showing my internet VLAN even tho I have set the VLAN role to WAN regards

How to set a policy that deny traffic of udp on 1000A My device firmware version is V3.00,build0483,070703Operation Mode is NATPort1 is connected Intranet, and Port3 is connected Internet. when I create a policy that deny traffice of udp @ Port3 or Port1 on cli,  the destination / source of interface must be assigned.  it doest not input any. only select port 1 to port 10.

Hello, help me please.I have two similar fortigate devices. One of them displays full license information, the other one displays it in a "short" format. Why is this happening?  

Hi everybody  Am facing an issue where we have a new site and that site is getting the internet from our main HQ when i try to connect with forticlient (my user is on the HQ forticlient) in our new site am getting server unreachable we are using SSL-VPN connection in our HQ.for more context we have our public IP that is on the main HQ Fortigate interface and our remote gateway is that public IP the internet in our new site is from our HQ ofc I have an IP sec tunnel with our HQ and it is used for VOIP and AD to make it reachable from new site.regards

Dear Team, I would like to understand the SSL VPN connectivity features of the latest version of Fortigate combined with FortiClient. In scenarios without EMS integration, is security posture checking still supported?As shown in the figure below:Bruce Liu   

Product: FortiGate 60FVersion: v7.4.5When using RDP through the Fortigate web portal, the characters in the browser tab appear garbled, as shown in the attached image. I understand that the issue is likely due to the presence of Japanese characters in the RDP name. Could you suggest any solutions to display the characters correctly without garbling?  

Hi Team, Our client is requesting us to use Lets Encrypt certificate for SSL VPN certificate protection. We are hosting this customer on the 1200D datacentre firewall as a VDOM. Please advise if we can use this feature? I am getting the below message and the "Lets Encrypt" button is greyed out. Use Let's Encrypt and the ACME protocol to automate certificate creation and maintenance. You will need to enable DDNS or purchase a domain. Kind Regards,Shiv AdhikaryNetwork Engineer

Dear All, I have strange trouble, I have 2 Fortigate running HA (A-P), and have 2 internet connected (internet leased line). Line 01 is working well, but line 2 , its flap down around 30 seconds, interval ~ 30 minutes. During this happened, I can not ping from outside to this public IP address, and also can not ping to internet use this Source IP. Between FWs and ISP, I have switches to share internet line. I checked packet drop on the switch, and did not see drop packet stats.(FW FGT  <--> SW L2 <--> ISP)Are there any you guys see same problem ? Thank you !

we are currently testing proofpoint email security software.how do i whitelist proofpoint under application control ?currently this policy do not have any application control or web filter applied. 

 Hi everyone,I've recently upgraded FortiManager from 7.4.5 to 7.4.6 and noticed a change in behavior regarding policy block names. Previously, FortiManager would prepend the name of a policy block to the name of a policy when deploying the rules to the FortiGate. However, this no longer seems to be the case in version 7.4.6.Immediately after the update I noticed that when deploying policies to the FortiGate it would fail because of duplicate policy names.For instance I have a rule defined on a Policy Package for FortiGate1 which is named "DNS" and I have a policy block called "global" appended to that policy package which also has a rule defined named "DNS". If you check the names of the rules on the FortiGate directly they had the names "DNS" and "global-DNS" before the update.After the update both rules would now be called "DNS" which leads to this duplicate issue and therefore the policy install fails from FortiManager. Current workaround is to just make su

Cross posting with https://forum.opnsense.org/index.php?topic=44897.0 due to the reason I still found no answer or clueI have a S2S IPSec tunnel between an Opnsense (24.7.11) and a Fortigate 60F (current FortiOS) device. Establishing a connection is working, but after some time (Phase 2 rekeying?) the tunnel sometimes breaks and comes back way later without any action on both sides. I captured a log trace (no debug) on the OpnSense side, see below. Both configs are correct in my point of view.Any ideas, is a debug log necessary and if yes, there are a lot of logging options with IPSec, which one?I'm no VPN or network expert, so please excuse if this is an easy mistake on my side.   2024-12-28T22:13:46 3 Informational charon 82877 14[IKE] <a075e27f-ad8d-4e7a-bd35-2f5c5ea0cee5|3> CHILD_SA closed 2024-12-28T22:13:46 3 Informational charon 82877 14[IKE] <a075e27f-ad8d-4e7a-bd35-2f5c5ea0cee5|3> received DELETE for ESP CHILD_SA with SPI e8e6a428 2024-12

We've been managing our FGTs with FMG for a while, and we've been trying to figure out how to restrict access to the FMG. We are using SAML SSO, so trusted hosts option isn't available - at least, it doesn't appear that logins for SSO can be restricted to trusted hosts. I also don't see an option for implementing local-in-policy. Even though all our FGTs are controlled by these controls, our FMG isn't - anyone in our organization can attempt to login, though we do have logins restricted to a particular group. Especially in light of the critical FMG vulnerability last year, this seems like a serious oversight if it can't be done - hence, I believe it can, but we just can't find the right area to configure. How are you folks approaching limiting access to which hosts can log into the FMG?

My VPN connection lasts a couple of minutes and then drops, I have to change ISP to stay connected.The strange thing about the case is the one I have the error with, it connects and for a few seconds you see the upload and download rate, then it stays still and after a while the connection with the VPN drops, what could be happening?greetings!

Hello and thank you in advance for any help.   We have 2 service providers with 2 different ip address blocks.    These service providers are load balanced.   How can I use the NAT dynamic IP pool with these 2 different outbound IP blocks. #fortigate v.7.4.6 outbound policy

I am hoping someone could offer some advice. I'm newer to the Fortinet ecosystem. I'm setting up a new network. So far, my wired traffic is working great. My WIFI is the problem. As of this writing, I have two SSIDs being transmitted. I can connect to both without issue. I have tried it on Windows, Mac, and iOS devices. If I connect to either SSID, I receive the error of no internet. I can ping 8.8.8.8 and 1.1.1.1 successfully, but if I visit Youtube.com, for example, the website gives an error to check my connection.  If I connect to NordVPN on my iOS or Windows device, I can access the internet normally without any issues. Since I'm new, I'm not sure what to share with you about my config, but I believe it's basically open and allowing all traffic. Does anyone have any ideas on where to start with this issue? For reference, My ISP is connected to a Fortigate 60F, FortiLink to a 124F-FPOE, to FortiAP 231Gs Thank You  

Dear All,Hope I will get reply soon.IPsec tunnel is showing inactive why and what can be issue behind it, could you please provide any solution on it. Thank you for your support in advanced.