Fortinet Community

Hello, I hope this message finds you well. Below is the detailed information regarding the issue we are experiencing with our Fortigate 6300F with FortiOS 7.2:1. Detailed Problem DescriptionWe are using a Fortigate 6300F configured as an explicit proxy. The Fortigate restricts access to certain categories, such as Instant Messaging (e.g., https://zoom.com). When a user attempts to access these restricted categories, a warning page is displayed. The Fortigate generates a certificate signed by a custom CA certificate that we uploaded (not the default one). However, after the user proceeds past the warning page and is redirected (e.g., to https://zoom.com:8010), the Fortigate uses the default certificate instead of the custom CA certificate. Please note that we have cloned all the default SSL inspection profiles and configured them to use our generated self-signed CA certificate. We are only using the certificate inspection profile, not full inspection. We would l

Hi all,  I hope you can help me, I have a 2-Tier MCLAG setup with 4 x FSW443 and 2 x FG80 appliances. I'm having some unusual network behaviour which let me to investigate and upon running the diagnose switch mclag peer-consistency-check command on my FSW I could see that the link to my FG didn't look right as below:   On all of my other deployments, I have checked and confirmed that these FortiLink interfaces when running the same command are OK, UP, OK and do not display the "NOT-FOUND" like this. The switches are visible, online and accessible from my FG and I have tried deleting the trunk and re-establishing but I cannot get this state to change.  Anyone have any ideas as to what the issue may be? I'm currently running 7.4.4 FG, 7.4.3 FSW and 7.4.3 FortiAP.  Thanks, Dan.  

Hello, I have a FortiSIEM on VM, the license expires in 1 month and we will not be able to contract support again until the first days of next year.The question is what will happen when the license expires, what limitations does it have?Is FortiSIEM still functional?Thanks.

Hello everyone,We are using the vulnerability scanner from FortiClient.The scan takes one hour and 15 minutes on Windows 11.I have already tried different versions of FortiClient (7.2.5 and 7.4), but with the same result.Has anyone else noticed the same behavior, or is there a solution?Thank you very much. 

Hello Team! I am using a FortiGate 40F model FG-40F with a configuration which consist of a VDOM root (management, operation mode NAT) and a VDOM transparent (operation mode transparent).  The VDOM root is only use to give access to internet:  The VDOM transparent is only use to stablish a firewall between a network called LAN and a network called WAN:  My objective is to monitor the Fortinet sending get SNMP from a PC connected to the port 2 (Inside lan 2).I have configured the System > SNMP in this way:  My problem is that the Fortinet receives the SNMP get but not answer me:  I am sending the get SNMP with iReasoning Browser: I amnot using HA or trusted hosts (I have tested to add my pc to trusted hosts but the behaviour does not change), I have checked the threads: SNMP don't response traffic, SNMP response and SNMP no response: timed out but I can not solve the problem. I give you more information that could

Hello all,I have a problem, probably in connection with my Fortigate100F to establish a RadSec TLS 1.3 connection from a UniFi AC Pro AP to an external RadSec Server (RADIUS). The connection is made via a Ubiquiti UniFi AC Pro AP and Ubiquiti UniFi Application 8.5.6 and RadSec is official supported.The connection via RADIUS works, but as soon as I activate TLS for this connection with the required certificates (root, client, private key), no connection is established.In the log files I do not actually see that the connection is blocked. The only thing I see is action=“close” - What does this mean?When I add the external IP in my exclusion list from my SSL Deep Inspection, I can't connect either.Even if I temporarily deactivate IPS, SSL and App Control, I cannot establish a connection.I can establish a telnet connection to the RadSec server from the Fortigate and from the UniFi AC Pro AP. However, this is terminated immediately  date=2024-10-21 time=13:42:13 eve

Hello community, I recently replaced a SonicWall with a FortiGate 100F in my SCADA network. The problem is that I have Site-A connected to Site-B via a VPN, where I have a ThinClient that needs to connect to the ThinManager server in Site-A and pull the configuration. The ThinClient's PC has a static IP, and when it tries to connect to the server, I see that the packets are being dropped. I've tried everything! I even contacted support, but they can't find an explanation... Any suggestions?

I have a fortiweb on AWS on version FortiWeb-AWS 7.20,build0311(GA),221216...  i am looking to upgrade it to 7.4.5 but i am not sure which file to download for upgrade from support portal... can some one please guide ?

Hi, I'm trying to figure out a good way on how to log and store the logvolume from a specific adom in my FAZ overtime. I've looked into tapping into the API and/or Ansible but I haven't found anything that shows me this particular data. The data I want to store is the one obtained from the command:diagnose fortilogd logvol-adom <adom>Does anyone have any good tips for me on how to get this data stored in a good way?  BR,Per Rosenlind

Hello,I installed fortivm on an esx in the datacenter.Maybe it may sound a little strange, but the following configuration is requested.Datacenter gave me an external ip for example; 10.20.30.40/29 subnet.As a gateway, I was informed that it was 10.20.30.43.Step - 1 ) I will define the ip addresses 10.20.30.41 and 42 as wan ports on the port2 interface in the firewall. Servers in the local network will be able to access the internet via this wan port. Port1 is set as internal (Lan) and port2 as wan port and I can access the internet by giving static route (gw 10.20.30.43) and writing lan to wan rule.There is no problem in this part.Stage - 2 ) 1 db and 1 web service (iis) server 2019 machines that I have installed (iis) server 2019 machines without giving ip address from local network, giving 10.30.40.44 and 10.30.40.45 addresses statically from direct wan ip block and I am expected to pass the traffic on these machines through the firewall. If I write 10.30.40.43 as gw to the machines

Hi!there are three to-the-Fortigate policies - Local-in, Auto-provisioned and Admin-in Policies.However, I'm unable to find documentation listing the order of execution/priority in which these are processed to determine which will occludes (ie. prevents access allowed by) others - is this documented? Otherwise, if it's dead-simple, provide answer?R's, Feren(Edit: removed "vs")

Hello.We have 200 FortiTokens registered with FortiAuthenticator (FAC).There is a single synchronization rule, to synchronize users from LDAP server (ActiveDirectory). The rule automatically assigns a free FortiToken to new user, when he is found in AD and pulled to RemoteUsers list in FAC. The problem is, there are about 120 tokens already assigned and all remaining tokens are in pending status, even though no user has been assigned to them yet. If I login to FAC, I can manually refresh the status of tokens, and it always free up some (not all!) unused tokens. What is the reason behind it? Why are tokens being pushed to the pending status without any assignment?

Hi Trying to connect up a Forti AP with a Dell switch but struggling I have put the port in trunk mode created a VLAN that matches the AP interface on the Fortigateassigned the native VLAN to that port But still my AP isn't picked up by the Fortigate. What have I missed? Thanks

Hello everyone,currently we are hanging in the SAML Entra SSO Setup. I checked the recommends Articles here in the Support Forum and watched serveral Videos.Firmware: v7.4.5 build2702Model: FortiGate 101F After the SAML login via the FortiClient and Enter the M365 Credentials, follwing Error Appear: Configuration on the Fortigate:User & Authentication > Single-Sign-onService Provider ConfigurationAddress: "forti-fqdn:6443" Entity ID: "http://forti-fqdn:6443/remote/saml/metadata/" Assertion consumer service URL: "https://forti-fqdn:6443/remote/saml/login" Single logout service URL: "https://forti-fqdn:6443/remote/saml/logout" Identity Provider ConfigurationEntity ID: "https://sts.windows.net/xxxx/" Assertion consumer service URL: "https://login.microsoftonline.com/xxxx/saml2" Single logout service URL: "https://login.microsoftonline.com/xxxx/saml2"  Certifcate Import from Entra  Additional SAML AttributesA

Hi,Is it possible to have the Fortigate perform a ICMP-ECHO to a IP Address before it sends a DHCP Offer to a client device. Have had an issue with duplicate IP Addresses on overlapping scopes / ranges that have static IP Addresses configured. This could be resolved with the DHCP server testing to see if the IP address is already in use in advance rather than relying on the client device to perform this function, I.E sending out an arp before accepting the DHCP Offer.  Any help would be much appreciated, thankyou. 

Hi!Is it possible to store the keys for intercepting TLS sessions in the Web Filter with an HSM device? I looked at the manuals and only found references to the FortiADC. If it is possible would you mind answering these questions?[ul]Is the key transaction made once per TLS session, or at machine startup?Would you recommend against having a HSM centrally and connecting to it over the internet?[/ul]Is there any other ways to protect the keys in remote locations? Any reply is most appreciated! Kind regards,Patrik

Hello, does anyone use an HSM (Hardware Security Module) to store the private key of a Fortigate used for Deep Packet Inspection ?I would like to know if this is a feasible option ? Thank you.

I have Fortigate 600F (FW 7.2.10) which acts as wireless controller for FortiAP 231g.I have configured configuration profile which changes Management VLAN ID for APs following this article. https://docs.fortinet.com/document/fortiap/7.4.5/fortiwifi-and-fortiap-configuration-guide/809346/operations-profiles-entry I have applied configuration profile to FortiAP profile. However settings defined in configuration profile are not applying. I'm not sure why. Here is the setting from the configuration profile:

VM is not licensed or license is invalid for current VM configuration. Upload a new license or reconfigure the VM. 

Hi Team: After several days, my users can't login via VPN as I see the box has gone into conservation mode.Thus, I reset the WAD Process manually as I don't want to go to 7.61 as its manual.So I'm using a script but this is not a good permanent solution. So I do this: diagnose test application wad 99 config system auto-script    edit restart_wad        set interval 43200        set repeat 100        set start auto        set script 'diagnose test application wad 99'    nextend Repeats every 24 HoursRepeats 100 times 

Is it possible to create ZTNA rules to grant access to microsoft controlled shared and personal drives ? I'm not a windows guy, but I believe that this requires some UDP ports...something not supported in ZTNA. If somehow this is possible, I assume that you wouldn't need a rule for every user. Any configuration guides ? Tom

Hello ForiWorld,i want to configure OSPF in Fortigate to connecte with CISCO 2911 (OSPF is configured in CiSCO 2911)How can i do it???

What am I missing here ?  My traffic is hitting my WAN address, but is not hitting the LAN.  First of all, this is on an old 90D that I am playing with, so it's on it's highest release of 6.0.18I am trying to hit a server inside my network from the outside.  My ISP router is outside the Firewall, and has all ports Port Forwarded.  I can see the traffic hit my FirewallSpirit-FW # diag sniffer pack any "port 22" 4 0 ainterfaces=[any]filters=[port 22]2024-10-20 20:10:27.049346 wan1 in 93.107.205.221.41489 -> 192.168.1.17.22: syn 3251867515 2024-10-20 20:10:28.057670 wan1 in 93.107.205.221.41489 -> 192.168.1.17.22: syn 3251867515 But it won't hit my inside LAN.  I have a fully open Any Src / Any Dst / All services rule in placeI have a Virtual IP for 192.168.1.17 --> 10.10.5.100 (TCP: 22 --> 22)Doing a Packet Capture too confirms the traffic to the WAN, but never his the LAN InterfaceI'm sure that this is something stupidly simple that I am overlooking

Hello, how to not tag "newsletter" a mail containing a MS Word attachment from "sender@our_domain" to a mailing-list@our_domain, but keeping security controls to avoid a spoofing email ? Thank's.Regards.Fred.

incoming-slow queue backed up and all mail was showing "Deferred: 451 4.3.5 Requested action aborted: local error processing"rebooted of fortimail resolvedI need to see if I can prevent this from happening in the future