Fortinet Community

incoming-slow queue backed up and all mail was showing "Deferred: 451 4.3.5 Requested action aborted: local error processing"rebooted of fortimail resolvedI need to see if I can prevent this from happening in the future

Hi I haven't used this feature before and need to set it up, have a question if someone can help? lets say you create a web filter that has some categories set to allow and others set to authenticate.....when the user browses from 1 site in the first authenticate category, then moves to a site in a different authenticate category, do they need to enter their details again or is it just the initial authentication?  thanks 

Hi Guys,I am testing a setup with 2 x 80F in two branches ( A and B) connected back to Hub (C) via an Ipsec tunnel.The local LANs behind the branches can ping the hub local lan through the tunnel . Also I configured a second phase2 selectors to allow another local lan ( /29 each) in the branches to get to the internet through the hub. I have added default route via the ipsec interface in each branch and and a firewall policy allowing the second local lan (/29)  and in the hub the required firewall policy.For branch B which has the second /29 , the ping towards internet via the hub is working but not in the branch A.I can see under routing monitor that a static router /29 - branch B is showing but not for /29 - branch A.I am wondering if I am missing anything. I went to compare the config of A and B and couldnt  find  any difference/issue  except the IP scheme is different. 

I have a Fortigate with a LAN interface with a static IP address (no DHCP enabled) which provides internet services to my internal network. The LAN interface is set up as a "DNS Service on Interface"  which forwards any host DNS queries to the system DNS. Therefore my host has been configured with the LAN interface IP address as the preferred DNS server address. However, in the Fortigate DNS page I cannot specify that I want to use system DNS and I am given just two options: Use FortiGuard Servers or Specify (which requires me to write down static IP addresses). I am using Fortiguard servers (i.e. primary and secondary DNS servers) but my WAN interface (which has both DHCP and Override internal DNS enabled) uses my ISP DNS server (i.e. Acquired DNS). I want my LAN interface to use my ISP DNS server and acquire its address automatically as my WAN interface already does, but I am not sure what DNS server is being used to resolve my host DNS queries as the Fortigate ha

I’m currently working with a FortiGate 200F that has two interfaces configured with public IPs, each connected to a different ISP. One of the interfaces (ISP-1) has an SSL FortiClient VPN activated for remote work users, and this interface is also set as the default route for the FortiGate.Now, I would like to activate SSL FortiClient VPN on the second interface (ISP-2) while keeping the default route to ISP-1.Could anyone provide guidance on how to configure the FortiGate to allow SSL VPN access through ISP-2 without changing the default route?What would be the best practices for setting this up?Thank you for your assistance!

Hello, I recently was testing the upgrade of TLS1.2 to TLS1.3 VPN SSL settings on a 40F.  I enabled TLS 1.3 support using the following CLI commands: config vpn ssl settingset ssl-max-proto-ver tls1-3set ssl-min-proto-ver tls1-3end Now, I am unable to VPN using the FortiClient  v7.0.9.0493.  It should be noted that I am using Azure MFA for 2-factor authentication. I am guessing it is a incompatibility between the VPN client and the new TLS version. TLS 1.3??  Are there any prerequisites, i.e. certificates, etc. that should be done before enforcing TLS1.3?  Any thoughts and suggestions are welcomed.

Hello Fortinet Community,I'm seeking advice on the best practice for setting up two FortiGate 121G units in an active-passive HA pair configuration, alongside two FortiSwitch models FS148F and FS124F (does not support MCLAG). I'm currently evaluating two potential topologies and would appreciate your insights on both, particularly around VLAN configurations and any relevant design considerations.Here are the two topology options I'm considering:Daisy-Chained Topology:In this scenario, the two FortiGate units in HA mode will be connected to a daisy chain of FortiSwitches (FS148F and FS124F). The switches would be stacked for redundancy.Mesh Topology:Each FortiGate in the HA pair would be connected directly to both FortiSwitches. This creates a more distributed setup with each switch directly connected to each firewall for greater redundancy.Questions:How would VLAN management differ between the daisy-chained and mesh topologies?What would be the most efficient way to handle VLANs with t

Good day, I am setting up Outbound firewall authentication with Microsoft Entra ID as a SAML IdP and have a question about the required Firewall Policies and can't find the answer anywhere, I am following this guide https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/33053 I the Firewall policy it says to use "All", "Azure-FW-Auth" for the source which means it will apply to all users, is there a way of targeting only certain devices or IP's? I have tried replaying the "All" with Address Lists with a device's IP and or MAC but when I do this the Firewall Policy stops working and I am not sure why as it should. How would I set up to target only certain devices so I can roll out in stages rather then all in one go? Thanks

Hello, For some time now it has been impossible to connect to the Ubisoft Connect application (which tries to connect online each time via this site: dmx.upc.ubisoft.com.   I can see this site in the "violations". So I saved it as an "exception" in different forms, to be able to authorize safe access.   But that doesn't change anything.   On the browser, by entering the URL "dmx.upc.ubisoft.com", the site is marked in the "Unknown" category by Forticlient.   The only solution to open Ubisoft Connect is to deactivate Forticlient. Which I don't want to do of course. Thank you.

For the FortiIsolator is there an official document (matrix compatibility type) as is done for FMG and FAZ ?Also among the Fortinet Fabric I mentioned below, can you confirm that the ISOLATOR interacts only with these products:Fortigate - YESFortiAnalyzer - YESFortiManager - NOFortiSandbox - YESFortiDeceptor - NOBest Regards

Hi all, Am hoping you can help with an issue I can't seem to get my head around! We have a site that has two WAN lines - one is a Starlink (DHCP) and the other a leased line (PPoE). We have the Starlink line going into one 40F, and the leased going into the other, with a patch running between the two on LAN3. I've set HA up for the the leased line 40F to be the primary, which is absolutely fine. However, when I sync the firewalls the PPoE WAN settings from the primary overwrite those on the secondary, meaning that when the primary 'fails' the secondary does not provide internet access.  Is there something really obvious I'm missing here, or will this setup not work? Simon

Hi FortiGate Community,I'm considering replacing the current Windows AoVPN RRaS I have with a solution based on FortiGate. I aim to set up both a device tunnel (which connects before user login) and a user tunnel (which connects after user login).So far, I've successfully configured the device and user tunnels separately. However, face issues when trying to run both tunnels at the same time.Has anyone here successfully switched from Windows AoVPN RRaS to a Fortigate setup with both these tunnels? If so, I would really appreciate any advice, tips, or configuration steps you could share.And any best practices that are important for this setup?Thank you.

Fortigate v7.4.5 build2702 (Mature) I am trying to block large subnets that are trying to access the management interface of our firewall. Almost just like this page here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-FortiGate-Firewall-Policy-to-block/ta-p/197727I've created an address subnet object then created the following firewall policy:Name: Deny X.0.0.0Incoming Interface: AnyOutgoing Interface: AnySource: X.0.0.0-NetDestination: AllSchedule: alwaysService: AllAction: DenyLog ViolationEnable Policy Despite this I continue to see connection attempts being made. All of them either end in client-rst or server-rst. What am I missing? Or is there something else i need to do?

Hello Forti community,I am trying to monitor the temperature of our Forti Switches through snmp. I get difficulty with some models.  I am using the ENTITY-SENSOR-MIB (1.3.6.1.2.1.99)I check the temperature with oid .1.3.6.1.2.1.99.1.1.1.4 JohnnyIn the model 448E-P, I get values 43 and 40.The sensor precision is set at 1 in the oid .1.3.6.1.2.1.99.1.1.1.3Meaning that it should be 4.3 and 4.0 degrees Celcius. In the model 148F-F, I get values 37 and 50The sensor precision is set at 0 in the oid .1.3.6.1.2.1.99.1.1.1.3Meaning that it should be 37 and 50 degrees Celcius. I am a bit confuse on how to check the temperature of the fortiswitches through snmp. Anyone has a successful setup working? Is the temperature indeed in celcius?Is the sensor precision used for calculating the switch temperature? Thank you for your help

Hello all, We have a few customers who use a FortiGate and are experimenting with deploying ChromeOS. Through ChromeOS you're able to push the FortiClient VPN Android version to the device. We would like to offer the right configuration for our customers without offering a tutorial/guide on how to create the correct configuration themselves. We noticed the FortiClient VPN Android version supports JSON files which can be used to add the settings automaticaly. Unfortunately we're unable to find the correct JSON script to do so. Where can we find the JSON file or how can we generate one? I would guess there is a template available somewhere! Thank you in advance!

Hello Guys, I upgraded EMS version 7.2.4 to 7.2.5, the installation finished correctly, when I go to run the console it does not work and gives the following error:Failed to load URL https://localhost/with error ERR_CONNECTION_REFUSED (-102)apache service does not start

Is it possible with FortiGate security profiles to log what SSH Version is used and which algorithms are negotiated on a ssh connection? For Https connections it's possible to see the TLS version with normal certificate inspection and additionally the exchanged algorithms and parameters when using Deep Inspection. But for SSH I did not figure out how to get the exchanged algorithms and SSH version.I tried SSL/SSH inspection with DeepSSH inspection and a SSH-Filter profile with all possible logging enabled. For my test policy all traffic is logged. I also applied an application control profile with SSH monitored. All I see in my logfiles is that there is a connection - and with SSH Filter enabled e.g. which commands where issued. 

Hi, Currently using FortiGate VM in FortiOS version 7.0.15. Based on the details below, it looks to be not supported. Is there another firmware which we can upgrade to, to enable the long vdom name? Followed this link to enable long vdom name: Long VDOM names - Fortinet Community, but unable to find the said config parameter - 'set long-vdom-name' It was indicated as well in the CLI reference that the parameter set long-vdom-name may not exist in some models: https://docs.fortinet.com/document/fortigate/7.0.15/cli-reference/339914554/config-system-global Thank you!

Hello, I have two different laptops running Debian 12, and in one of them  FortiClient stopped working (it was working before, and it is not clear what changed). When I start the GUI, I get the dreaded "blank" window (with just a menu with the options to quit and help).If I try to do anything with the CLI, I get errors to the tune that "No configuration data was returned".Investigating a bit, it seems that the "confighandler" process runs a local HTTP server, and the tools connect to it to get configuration data. However, in the computer with FortiClient issues, this server seems to not respond and close connections without delivering any data. I have tried purging and installing all 7.2.x versions available in the Fortinet repositories (both Debian and Ubuntu), and even the latest 7.4 from the Debian repo. All of them fail in the same way (7.2.0 is different in the sense that it keeps retrying, while all others seem to give up at the first failure to connect to the

Hello,I've been trying to decrease the downtime of new ADVPN setup, as for the traffic flowing from our Spoke -> Hub -> DC internal segmented firewall (ISFW). Our ADVPN Hub and spokes run iBGP.On the Hub, there is a BGP-group configured with settings for all SpokesBetween our DC ISFW and ADVPN Hub, eBGP is running.I've managed to decrease the packet-loss to ~10 sec when the ADVPN Hub cluster (two FortiGate 200Fs) are doing the failover.I have Graceful restart enabled global between DC ISFW and ADVPN Hub + between ADVPN Hub and SpokesI have set the following for Hub/spoke BGP speakersAdvertisement interval = 1 secKeepalive = 3 secHoletime = 9 seccapability-graceful-restart enabledstale-route enableretain-stale-time 120 sec On the Hub, I have also set globally:graceful-end-on-timer enablegraceful-update-delay = 10 secTowards the DC ISFW, the advertisement interval = 1 sec When I monitor the RIB of our DC ISFW, the prefix from my ADVPN spoke advertised via ADVPN Hub i

In the previous versions the box use to not auto open the Forti Client, box on the screen at login.  There appears to be no way to stop this from happening, it suddenly appeared with one of the updates earlier this year from Forticlient.  Before you would login and the Forticlient box would not pop up and ask for a login to VPN even-though you can minimize it, this is a waste of time.

Hello everyone! I would like to know if there is a way to exclude specific VLANs from passing inside a fortiswitch ISL trunk or to pass only management traffic between a specific ISL link. By default fortilink passes all VLANs between Fortiswitches connected to each other. Yet, I have a requirement to not allow specific VLANs to pass through a ISL formed between 2 FortiSwitches, therefore forcing data traffic to go through a 3rd party switch connected to both of these Fortiswitches. KB: https://community.fortinet.com/t5/FortiSwitch/Technical-Tip-Seperate-Inter-Switch-Link-ISL-between-Managed/ta-p/224568states about separating the traffic, but my requirement does not need the second link to pass data. Is there a simpler way to achieve this? Did not want to go into modifying MSTP instances and all of that. Thanks in advance for any suggestions and tips! Regards FortiSwitch 

Hi FortiManager use v7.4.3please refer to the picture. the process stuck in 36%  it seens like FMG not push the firmware to FGT.if I wating one hours, the Progress Report show "upgrade image timeout" I checked my other firewall, tcp 541 is allowed, but I don't see the FMG push firmware to FGT's log. Thanks.  

HiI am seeing this error on a number of our MacOS clients but I have no idea how to debug where this comes from.Is there a way to see more infrormation on this? The clients all connect to an EMS solution - but this just shows a count, a threat ID of 0 and the same message. Thanks in advance

We have a few customers who use the DUO Radius proxy to provide 2fa for the VPN. After an automatic update to 7.2.10 the user receives the DUO prompt, but authentication never completes. There is a known bug int the release notes about radius not working in the UI, and the workaround is to use the CLI to test authentication, but not that it would break any actual functionality.For now we have rolled back to 7.2.9 but just wanted to give a heads up.