Fortinet Community

Hi guys, Let me introduce myself first, I am a Freelance IT, I setup computers, cabling and help users with common problems at office or with printers as well I can take care of servers hardware.Actually one of my clients is a branch of the foreign affairs of my country, the security for them is very important as you can imagine. I have a small linux web server installed at home, there I have a web ticketing system which I want to use to keep a fast contact with users and give a fast response and solution when they have problems. From outside the office I can access but not from inside network, it seems there's a problem with the configuration of the SSL, I have few domains in that server, 2 of them with free SSL certificate provided by lets-encrypt and the other one was the cheapest I found just to try but with the same results (ComodoSSL). In any case when I try to acces to such domains there's a message "timeout" or if I try from my smatphone "ERR_CERT_

Hello, this happens now the second time with 2 different FG60 clusters. We have support tickets open but sofar no solution. This time we had 7.4.4 SD Wan configuration and working fine now for at least 3 months. Today we updated to 7.4.5 (we had conserve mode issue) and right away we get problems with the SLA Performance and since it puts down WAN2 interface I only have read only access from the Forticloud. I can access via WAN1 and the MPLS but I am not in the office now. We had standard SLA performance rules:1. Cloudflare ping to 1.1.1.1>WAN1 OK>WAN2 DOWN2. Default DNS ping to FG DNS>WAN1 OK>WAN2 OK3. Google Ping to 8.8.8.8>WAN1 OK>WAN2 DOWN I really dont understand. I see in Fortiview that there are 500 sessions over WAN2 to the internet, it is working but since SLA performance kills the route, I dont have access from outside to the public IP. What is the issue? Anybody else with the same problem? Any suggestions? Thanks!

I have an IPSEC tunnel configuration that refuses to allow GUI re-configuration. Displayed error is -9999:-9999.Objective: I am migrating from one IP/ISP/fiber to another, at the remote location. Local (HQ) connection will remain the same.I wish to run both tunnels until configuration is up and running. Otherwise, termination of existing tunnel disconnects all communication with the remote fortigate 80e.I originally configured the HQ connection to point to the DynDNS address of the remote site, I am unable to reconfigure this connection to a fixed IP.This connection is up and running. Firmware v.7.2.3 on both fortigates. When I change the Remote Gateway from Dynamic to fixed, it accepts the change, it recognizes and validates the IP address (malformed addresses are rejected). and when the 'check mark' is clicked the changes get locked in.But, when I click the OK button to accept the configuration, I am greeted with a red 'tag' in the lower right that displays and unhelpful '-9999:

Good day I am looking at purchasing a Fortimail 200E appliance and I see you you can still get a Forticare license per year. My question is, if I purchase it for a year and in a years time I want to renew, will I be able to or will I have a device that is no longer usable or can I renew it year on year for the next 5 years, one year after another? Sorry if this question has been answered, I can't find any solid answers. Another question, will the Fortinet Fortimail 200E work with a Fortigate Firewall 61F? Thank youEdward

Dear Community members, i require the IPS signatures file to upload into FortiGate. Please share link where to download the updated signatures.

Hi Team, I have configured 2 IPSEC to the same remote destination and it was working fine with version 6.4 however after the upgrade it stopped working. The reason for that is that the Tunnel ID for the second tunnel is assigned with an IP of 10.0.0.1 and not the public IP (which is assigned to the first IPSEC). Apparently, there is a behavior change on version 7.2. (In general, tunnel IDs are assigned the IP address of the remote gateway. If multiple tunnels use the same gateway IP address, then a random IP address from the subnet 10.0.0.0/8 is assigned).  Has anyone encountered a similar issue and what is the recommended fix? Appreciate your help and assistance. 

Hello!I have an environment with VPN connections using Native Android VPN. I've configured the policy and tunnel, and everything is working fine. However, I need to reserve IP addresses for the devices. In the current L2TP configuration, it's only possible to define an IP range, which results in random IP allocation. I would like to know if it’s possible to point to a DHCP relay, use the firewall's own DHCP, or any other method that allows IP reservation for each device. Below is the functional VPN configuration: Firewall OS Version 7.0.14 config vpn ipsec phase1-interfaceedit "VPN_XXXXXXX"set type dynamicset interface "port2"set peertype anyset net-device disableset proposal aes256-md5 3des-sha1 aes192-sha1set comments "VPN: VPN_XXXXXXX (Created by VPN wizard)"set dhgrp 2set wizard-type dialup-androidset psksecret ENCnext config vpn ipsec phase2-interfaceedit "VPN_XXXXXXX"set phase1name "VPN_XXXXXXX"set proposal aes256-md5 3des-sha1 aes192-sha1set pfs disables

Hi all,I have read some post to try to configure my fortigate 600E like a reverse proxy. The posts are closed, and that is the reason why I opening this.. I would like to emulate a reverse proxy to connect to internal servers (not DMZ servers) using my external firewall. I would like to know if the final connection to the real servers, is established by Fortigate or from the internet client. I'm not sure about this. I've posted that:https://community.fortinet.com/t5/Support-Forum/Fortigate-SSL-Offloading-with-SNI/m-p/348745#M253392 Do you know if the TCP connection is stablished  from Fortigate? I'm not sure if in both cases it works like a real reverse proxy. I don't want direct TCP connections to the real servers from internet clientsThanks ¡¡¡ 

Dear Team, My firmware version is 7.4.4. We are routing our webservers behind through cloudflare proxy. Here what are we getting in logs are the cloudflare proxy Ip address ranges. Pls guide me how to configure the fortigate to get the Original ip of the source traffic or how to Include the original visitor IP in fortigate logs.  I have already done as per the process defined - https://docs.fortinet.com/document/fortiproxy/7.4.4/administration-guide/764110/logging-client-ip-for-forward-traffic-and-https-transaction FGT (global) # sh full-configuration config web-proxy global set ssl-cert "Fortinet_Factory" set ssl-ca-cert "Fortinet_CA_SSL" set fast-policy-match enable set ldap-user-cache disable set proxy-fqdn "default.fqdn" set max-request-length 8 set max-message-length 32 set strict-web-check disable set forward-proxy-auth disable set forward-server-affinity-timeout 30 set max-waf-body-cache-length 32 set webproxy-profile "default" set learn-client-ip enable set alway

I'm working on migrating my home OpenSUSE machine I'm using for freeradius server to authenticate admin and VPN users on my FG40F(7.2.8) from Leap 15.3 to 15.5(on a new machine). Obviously 15.5's repo has a newer version of freeradius-server image.Then when I simply copied "clients.conf" and "users" file to the new machine and pointed the RADIUS config at the 40F to the new machine, the RADIUS auth request was simply dropped without showing much reason in debug output other than "missing mandatory attribute".After some research and investigation, I figured out I had to set "require_message_authenticator = no" in the client config for the 40F at the server, which was not required with the older version of freeradius, in order to let the server accept those requests from the 40F.So I found a way around but now wondering why 40F wouldn't send the Message-Authenticator attribute with the request.Even with 7.4.4, the admin guide says it doesn't send the attribute.https://docs.fortinet.com/d

Hello,We migrate our firewall to Fortinet and after that some of SAP user have network problem like attached picture. The SAP server located in Azure Virtual Machine and traffic from onprem connected to Azure via VPN site to Site.Anyone know here how to improve or fixing this issue? Trying to increase session-ttl for port 3200 with not helping.

Hi, when I try to open the next columns it doesn't show me any information and I can't apply any filter or anything, at first it only happened in Google Chrome, but now it also happens with Edge and Firefox.

BackgroundWhen a FortiGate downloads package updates directly from Fortinet FortiGuard (FDN), the package files are downloaded and then expanded into the FortiOS without any user control over which subcomponents (within each package) are installed. Thus, the process is "all or nothing". The user (or the configured schedule) triggers the update and the FortiGate obtains the package, then expands and installs all of the package contents. This means that the user has no control over which subcomponents are installed. However, when using the FortiGuard service within FortiManager, the administrator has the ability to control which version of specific packages can be downloaded by FortiGate. In the FortiManager scenario, FortiManager downloads packages from the Fortinet FortiGuard (FDN) service, and then the downloaded packages are expanded into FortiManager. Administrators are presented with a full list of all of the subcomponents that have been downloaded. Most importantly (to t

Fortinet Radius authentication using Azure AD

Hello.I'm managing a Fortigate 40F v 7.0.11 and I'm getting in System Events logs many line reporting that my lan interface is going down and up with log id = 0100020099.When Fortigate logs those lines I can see my ping tests to 8.8.8.8 failing and usually I get customers complaining about a no stable internet.The main problem is that it's not constant. I'm getting this behavior a lot of time during a day.I'm using SD-WAN in lan3 and "a" ports (I just disabled tha Wan port because I have an disabled link in this port) but even when I had Wan port available I was getting the same error but less often.I really don't know what is causing this behavior.. could it be cable or a faulty port in my switch?I'm almost loosing my customer because of this weird behavior.Appreciate any help.Thanks

HelloI have the following issue.I need to do a routing by http content with fortiweb, as an examplewww.informacion.go.rx/vista/1_inicioI have already made the policy in which when it finds www.informacion.go.rx it redirects to the server 10.22.130.5 through port 80.The problem I have is that it is not finding the URL /vista on the web server since vista is located in the following route10.22.130.5/www/vista.In nginx as a proxy server I can add a specific routein the proxy "proxy_pass" from where to start looking for the URL, but in fortiweb I have not been able to find it.I hope you can help me to see if there is a way to do the same in Fortiweb

Need evidence where FortiGate IPS detecting the Covert Malware communication detection.FortiGate

Hi,I have a FortiGate 61E configured for SD-WAN, with WAN1 as an Internet broadband connection and WAN2 as an MPLS link. The company uses an internal web application, and I've configured the MPLS link for accessing the internal web. However, when the MPLS link goes down, I'm unable to use the broadband link to access the internal web via VPN to HQ. What should I do to resolve this issue?

I cant install my FortiSIEM Linux Agent on my Ubuntu 21 with the last install script from Fortinet Support.  The Error message：No matching OSINSTALLATION FAILED Try to install with Linux Agent scriptView my os-release information file or link  The Content of the last version FortiSIEM Linux Agent Script  If my Costumer ask me just use Ubuntu 21 to install Linux Agent, how to solve this Issue?    

Hello, The Web Application Firewall on FortiGates is blocking access to two URLs due to the following event IDs: 1. URL: [https://web.domain.com/page.php] Event ID: 60140003 Event Type: waf-signature Sub Type: waf Type: utm FortiGate # diagnose waf dump | grep -f 60140003 60140003 - This signature prevents attackers from performing RFI attacks to include a malicious code from a remote resource. <---  2. URL: [https://web.domain.com/file.php]Event ID: 40000141 Event Type: waf-signature Sub Type: waf Type: utm FortiGate # diagnose waf dump | grep -f 40000141 40000141 - This signature prevents attackers from injecting SQL Databases using "\*". <---  Could you please guide me on how to add exceptions in WAF profile for these two URLs in FortiManager, so that access will be granted? Thank you!

 Hello,I am currently using FortiAuthenticator version 6.4.9. Additionally, my firewall is running FortiOS version 7.2.9, and based on the documentation I reviewed, these versions are compatible with each other. However, I am facing the following issue:I have completed the integration between FortiAuthenticator and the firewall, and all necessary configurations have been made. On the first attempt, the user I want to apply MFA to receives the email without any problems. But on subsequent attempts, the user can log in directly without being prompted for a token, and then the email is sent. The logs in FortiAuthenticator show an OK log indicating that the email was sent, but the user is logged in without seeing the token entry screen.Could this be a bug related to the version, or is it possible that I have missed something in the configuration? If this is a bug, it is not mentioned in the "Known Issues" section of the release notes.Best regards

The handsets (FON450i) reportedly support RTTTL ringtones. I created a text file, entered the tune, and saved the file. When I try to upload I get an invalid format. What extension should the file have? Since there is a 5 (custom) ringtone limit, how do I check or erase an existing tone? Are there changes outside of the standard specification we need to conform to (such as case-sensitive input)?

Hello I'm having problems with local traffic generated by Fortigate and SDWAN rules. When one of the links that make up our SDWAN goes offline, I receive the following error message: "unable to connect to fortisandbox. Either the appliance is not reachable or this fortigate is not authorized" Then users start receiving SSL certificate error messages when they try to access a web page, or a message like this: "Web Page BlockedAn error occurred while trying to rate the website using the webfiltering service. Web Filter Service Error no correct FortiGuard information" I tried the following commands (available at: link  ) but the problem persists: config log fortiguard setting set interface-select-method sdwan end config system fortiguard set interface-select-method sdwan end I have a 60F with version 7.0.13 build 0566 (Mature)

I'm using Forticlient EMS 7.2.4 and Fortigate 42000F 7.0.12 (on-prem). Currently all our policy rules are the traditional system to system or area to area type i.e. IP/CIDR/HOSTNAME to IP/CIDR/HOSTNAMEI'm looking for a modern approach where I can govern network level access from system to system based on the user initiating the traffic. For example, if I have a support person working on shared laptop I would like to them to be able to get to back-end SystemA but not neccessarily another user that might user the same laptop from time to time.I assume this is a ZTNA type solution but wondering if my existing stack/kit would already have this capabilty? 

I can't access internet from my pc that is in the same subnet as the LAN port,  Firewall policies are created (LAN-WAN) dst lan port address / src all, and (WAN-LAN).