Fortinet Community

Our recent vulnerability scan has pointed out we need to set timeout outs for:- console sessionsSSH HTTPSadmin services Looks like this has to be done through the CLIHave viewed some documents but is there a way to set them all to the same time? Thanks 

hi everyonei am newly trying fortigate firewall.. and lets say i am having a custom payment gateway to make invoice to customers (xyz.com) after i reach the site i cant log in and the screen showing white only nothing else and the browser keeps loading can you please explain why is that and how to overcome this My devive is : 40fFramework : v6.x Thank you

Hello..this issue gets sometimes, like peak time. currently, all current sessions are dropped and all firewall internal routing not working, all traffic is dropped. but I can log in to the firewall and do anything in the firewall and CPU and memory are normale..no any other unusual events on the log.  FortiGate 

Hi All, Application Control Requirement -> Block Windows Update After blocking windows update (block Microsoft.Windows.Update) I can notice that users are unable to update apps from Microsoft Store. According to firewall logs Microsoft.Store is allowed.  But, according to https://www.fortiguard.com/appcontrol/40503 Microsoft.Windows.Update is a dependency of Microsoft.Store  Could anyone suggest how to block Microsoft.Windows.Update and allow Microsoft.Store?

Hi, I'm configuring my first FortiNAC.I manually installed the Persistent agent on a test PC (OS Windows 11), according to the instructions found in https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Manually-install-and-configure-Persistent-Agent-on/ta-p/191164It seems that the agent does not communicate with the Fortinac.From the PC, telnet to eth1 fortinac on port 4568 is ok.In the %ProgramData%\Bradford Networks folder I do not find any log files. As suggested I reinstalled the client but without success. Icon of Persistent agent say: Network access normal. PC is viewed as rogue. Could you help me? Thanks in advance.

Hello ,  I have DC agent installed on the Domain Controller, and FAC debug indicate that it's getting the user and workstation details, but that it cannot resolve the DNS name for the workstation domain error below from FAC FSSO debug ( FAC is acting as collector agent ) any ideas or tips on where to look?the workstation domain name is like mydomain.subdomain.local, so I have added subsomain.local to the DNS suffix in the DC agent config page, but still with no luck. appreciate anyone's help. Thanks01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded workstation: WKS0101/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded domain: MYDOMAIN01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded user: userx01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: has 0 ipv6 address01/21/2022 15:32:04 [F4555555] DC/TS Agent [WARN]: cannot get DNS name of domain MYDOMAIN from Domain Manager01/21/2022 15:32:04 [F4555555] DC/TS Agent [WARN]: Failed to decode DCTS

3499197-6422    

Hello,in our company we have Fortigate 80F (v7.0.13 build0566 (Mature)). I'm new in company and totally newbie in Fortigate (used mikrotik and cisco in previous work).We found problem that websites which use Cloudflare DNS not working. Tried this: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Block-QUIC-Protocol/ta-p/197661 websites still don't work. Chrome shows me: ERR_QUIC_PROTOCOL_ERRORIf I disable QUIC in Chrome too, it shows me: ERR_NETWORK_ACCESS_DENIEDEdge: ERR_QUIC_PROTOCOL_ERROR Will be very thankful for your help.

Hello,We have FG60E model with version 7.0.7 (build 0367) running.We have configure Remote SSL VPN and when we try to connect, we get the error as follows,"Unable to establish the VPN connection. The VPN server may be unreachable. (-14)"We checked the option under fullacces, the "Host Check" option not enabled. (SSL VPN Portals -> Tunnel Mode -> Host Check).We tried with Forticlient version 7.4.0.1658 and 6.4.9.1797 and getting same error.How to check if there are any logs in the firewall for this kind of error?Can someone guide on how to resolve this issue?Thanks

Hi friends, I have a question. I plan to take the FCSS in Zero Truss Access exam. Could you tell me if it is just one exam? Or if I need to take more exams to obtain the certification?

 Hello everyone, I’m experiencing an issue with very high CPU usage on my FortiGate VM02. The CPU is mostly consumed by software interrupts (softIRQ), and it seems related to the use of software switches. Here’s a summary of the performance status:  # get sys performance status CPU states: 1% user 9% system 0% nice 24% idle 0% iowait 5% irq 61% softirq CPU0 states: 1% user 9% system 0% nice 22% idle 0% iowait 4% irq 64% softirq CPU1 states: 2% user 10% system 0% nice 23% idle 0% iowait 6% irq 59% softirq Memory: 8155856k total, 1970056k used (24.2%), 5548792k free (68.0%), 637008k freeable (7.8%) Average network usage: 1205906 / 1225484 kbps in 1 minute, 1299972 / 1323049 kbps in 10 minutes, 1260383 / 1282380 kbps in 30 minutes Maximal network usage: 1385365 / 1411865 kbps in 1 minute, 1584081 / 1608140 kbps in 10 minutes, 1725782 / 1755302 kbps in 30 minutes Average sessions: 50420 sessions in 1 minute, 50219 sessions in 10 minutes, 50779 sessions in 30 minutes Max

Hi everyone. I am facing an issue with FGT 60E which I did not face earlier. After upgrading firmware to 7.4.2 I am not able to upgrade to 7.4.3 through Firmware & Registration -> File upload.I am aware my license for license upgrade (automatic) has expired, but I would assume this should not affect manual firmware upgrades ?  Thank you,Azur

I am preparing new Forticlient EMS server. Is there a way to export all the configuration from current EMS server.ThanksArif

I'm trying to set ssh host key using my own generated key following the instructions at https://docs.fortinet.com/index.php/document/fortigate/7.6.0/cli-reference/207795941/config-system-ssh-config. The document doesn't specify what is the format for ssh-hsk parameter. I'm using ssh-keygen to generate the private key. Then remove the BEGIN/END and concatenate the lines together. However, this gives me an error "The password does not match hostkey!" when I run end command to commit the settings. Does anyone have an example how to do this correctly? Thank you.

I have the following topology:A fortigate40F & a Fortiswitch; I have a fiber connection coming into the switch, because I do not have sfp on the firewall.What I want to accomplish is that my firewall communicates to my core network(VLAN102), while I have a port on the switch that is in VLAN103 so that the client that will reside on port 5 of the switch is able to communicate to a server that resides behind the gateway of my firewall ( VLAN102).I want to protect the traffice with vDoms, one for the VLAN102 (root) and one for the VLAN103 (internal).I have tried the following:- create 2 vDoms- create 2 VLANs and assign each to one of the vDOMS- create vDOM links- create static routes between the vDOMS ( using the vDOM links)- assign the VLAN on the port of the switch where the client is connected.- I am unable to view the ports/switch from the second vDOM, only on the root vDOM- the client is unable to even ping the IP that is one the same vDOM & VLAN.any clue where the flauw

Hi All,My case is that our branch company will be closed. Valuable assets may be transported to ourheadquarter in another country. Is there any limitation if we move our  firewall to another country? If we are going to buy new license, who should we buy from? The original seller or the seller in another country? Looking forward to your answer. Thanks.

How to block 1723 port incoming request ?

Hello there,We are having issues on machines trying to update to the last windows 11 update 24h2.The updates are taking way too long, some of them taking 5 hours to complete. Our machines all have SSDs installed, so, don't think it is an I/O issue.We tested machines without forticlient and they finished updating in about 10 minutes.Our forticlient versions are 7.2.4.0972 and 7.2.5.1053 (tested in both of them and the issue persists).I tried disabling Cloud based protection and refining antivirus exclusions, to no avail. Exclusions are as follows: Paths:%windir%\SoftwareDistribution\Datastore%systemroot%\System32\Spool Files:%windir%\Security\Database\*.log%windir%\Security\Database\*.sdb%windir%\SoftwareDistribution\Datastore\Logs\Edb.chk%windir%\SoftwareDistribution\Datastore\Logs\Tmp.edb%windir%\Security\Database\*.chk%windir%\Security\Database\*.jrs%windir%\Security\Database\*.csv%windir%\Security\Database\*.edb%windir%\Security\Database\*.xml%windir%\SoftwareDis

my issue is the following. The customer is migrating to new DNS servers on DMZ, but they have too many endpoints on the LAN with old DNS servers (x.x.x.x) configured, they want to MAP the ip for the old DNS servers (x.x.x.x) to the new DNS servers (y.y.y.y) This can be acomplished using DNAT with the following configuration VIP:set service "DNS"set extip x.x.x.xset mappedip y.y.y.yset extintf LAN after doing this, the DNS traffic going the old DNS servers is natted correctly, but the server x.x.x.x is still giving another services and after natting DNS traffic, Fortigate treats x.x.x.x as virtual IP and any other traffic going to x.x.x.x is dropped with the error "iprope_in_check() check failed on policy 0, drop" is there a way to do this nat and still have another services on x.x.x.x without considering x.x.x.x as Virtual IP?after doing this, 

Can someone help me with this situation? Any information will be of great help.This was scanned as a risk: PCW/RS_ProgramCompatibilityWizard.ps1

Hi, We are using Netskope and for Chromebooks it uses a Proxy, which appears to be blocked by the Proxy group, which we need to keep enabled. How do we create a custom application signature for Netskope and allow it for Application, DNS & Web Filtering so it functions properly.Blocking applications with custom signatures | FortiGate / FortiOS 7.2.9 | Fortinet Document Library I was looking at above and thinking of doing an Allow, but not sure what the signature portion needs for values. Has anyone does this and have instructions we can follow? Thanks.

Dear All,  I have a fortigate is facing to internet, it has public IP: a.a.a.a , port : wan 1I have IPSEC tunnel to another site using WAN 1 port also, and I have Fortimanager manage Fortigate use WAN 1 also. I want to use Local-in-policy to block unknown Pulbic IP  access to my fortigate via WAN 1 IP Address My question is: If I apply the local -in-policy on WAN 1, my IPSEC tunnel and Fortimanager can connect to my Fortigate ? Thanks !

Hello community,I need yours help, when i make FortiGate-VM64-AWS (interface) #edit port1  set mode dhcpthen i getting this errorThis interface is being used by one or more dhcp servers.attribute set operator error, -236, discard the settingCommand fail. Return code 1

hi,i recently did a HA firmware upgrade following an upgrade path.the selection of HA primary kept changing due to high uptime.my question is, do i need to keep "forcing" back HA to original primary or just proceed to upload the firmware on the current primary (secondary unit).the serial with 795 is the original primary/active and 836 is the secondary/passive. # get system ha statusHA Health Status: OKModel: FortiGate-xxFMode: HA A-PGroup Name: xxFW01_CLUSTERGroup ID: 0Debug: 0Cluster Uptime: 264 days 9:33:6Cluster state change time: 2024-10-03 15:04:23Primary selected using:<2024/10/03 15:04:23> vcluster-1: FGxx836 is selected as the primary because its uptime is larger than peer member FGxx795.<2024/10/03 15:01:40> vcluster-1: FGxx836 is selected as the primary because it's the only member in the cluster.<2024/10/03 15:01:31> vcluster-1: FGxx836 is selected as the primary because UPGRADE_SECONDARY flag is set on peer member FGxx795.<2024/10/03 14:59:19> v