Fortinet Community

How to block 1723 port incoming request ?

Hello there,We are having issues on machines trying to update to the last windows 11 update 24h2.The updates are taking way too long, some of them taking 5 hours to complete. Our machines all have SSDs installed, so, don't think it is an I/O issue.We tested machines without forticlient and they finished updating in about 10 minutes.Our forticlient versions are 7.2.4.0972 and 7.2.5.1053 (tested in both of them and the issue persists).I tried disabling Cloud based protection and refining antivirus exclusions, to no avail. Exclusions are as follows: Paths:%windir%\SoftwareDistribution\Datastore%systemroot%\System32\Spool Files:%windir%\Security\Database\*.log%windir%\Security\Database\*.sdb%windir%\SoftwareDistribution\Datastore\Logs\Edb.chk%windir%\SoftwareDistribution\Datastore\Logs\Tmp.edb%windir%\Security\Database\*.chk%windir%\Security\Database\*.jrs%windir%\Security\Database\*.csv%windir%\Security\Database\*.edb%windir%\Security\Database\*.xml%windir%\SoftwareDis

my issue is the following. The customer is migrating to new DNS servers on DMZ, but they have too many endpoints on the LAN with old DNS servers (x.x.x.x) configured, they want to MAP the ip for the old DNS servers (x.x.x.x) to the new DNS servers (y.y.y.y) This can be acomplished using DNAT with the following configuration VIP:set service "DNS"set extip x.x.x.xset mappedip y.y.y.yset extintf LAN after doing this, the DNS traffic going the old DNS servers is natted correctly, but the server x.x.x.x is still giving another services and after natting DNS traffic, Fortigate treats x.x.x.x as virtual IP and any other traffic going to x.x.x.x is dropped with the error "iprope_in_check() check failed on policy 0, drop" is there a way to do this nat and still have another services on x.x.x.x without considering x.x.x.x as Virtual IP?after doing this, 

Can someone help me with this situation? Any information will be of great help.This was scanned as a risk: PCW/RS_ProgramCompatibilityWizard.ps1

Hi, We are using Netskope and for Chromebooks it uses a Proxy, which appears to be blocked by the Proxy group, which we need to keep enabled. How do we create a custom application signature for Netskope and allow it for Application, DNS & Web Filtering so it functions properly.Blocking applications with custom signatures | FortiGate / FortiOS 7.2.9 | Fortinet Document Library I was looking at above and thinking of doing an Allow, but not sure what the signature portion needs for values. Has anyone does this and have instructions we can follow? Thanks.

Dear All,  I have a fortigate is facing to internet, it has public IP: a.a.a.a , port : wan 1I have IPSEC tunnel to another site using WAN 1 port also, and I have Fortimanager manage Fortigate use WAN 1 also. I want to use Local-in-policy to block unknown Pulbic IP  access to my fortigate via WAN 1 IP Address My question is: If I apply the local -in-policy on WAN 1, my IPSEC tunnel and Fortimanager can connect to my Fortigate ? Thanks !

Hello community,I need yours help, when i make FortiGate-VM64-AWS (interface) #edit port1  set mode dhcpthen i getting this errorThis interface is being used by one or more dhcp servers.attribute set operator error, -236, discard the settingCommand fail. Return code 1

hi,i recently did a HA firmware upgrade following an upgrade path.the selection of HA primary kept changing due to high uptime.my question is, do i need to keep "forcing" back HA to original primary or just proceed to upload the firmware on the current primary (secondary unit).the serial with 795 is the original primary/active and 836 is the secondary/passive. # get system ha statusHA Health Status: OKModel: FortiGate-xxFMode: HA A-PGroup Name: xxFW01_CLUSTERGroup ID: 0Debug: 0Cluster Uptime: 264 days 9:33:6Cluster state change time: 2024-10-03 15:04:23Primary selected using:<2024/10/03 15:04:23> vcluster-1: FGxx836 is selected as the primary because its uptime is larger than peer member FGxx795.<2024/10/03 15:01:40> vcluster-1: FGxx836 is selected as the primary because it's the only member in the cluster.<2024/10/03 15:01:31> vcluster-1: FGxx836 is selected as the primary because UPGRADE_SECONDARY flag is set on peer member FGxx795.<2024/10/03 14:59:19> v

I'm preparing to push FortiClient 7.2.5 to the employees, but FortiClient EMS 7.2.5 doesn't show it as an available package. How do I add it?FortiClient#FortiClient EMS

Hi all ¡¡ I have fortigate and fortianalyzer. I need to control traffic sent by servers in one Fortigate interface. For that, I have a shared shaper. I would like to receive an email when the shaper is working (droping packets) cause the server exceeds limits. When shaper drop bytes, I can see in Firewall logs "shaperdropsentbyte=X" where X is a number. If it's non-zero, that means shaper is dropping packets (example "shaperdropsentbyte=40"). On the other hand I have a Fortianalyzer receiving logs. In fortianalyzer I've a SMTP relay server configured and if I test it, I receive mail correctly.  I have created a "data selector" and I have attached it to a simple handler. The data selector is simple, I use "Log file by text" with shaperdropsentbyte!=0 (with =0 doesn't works either). The handler, configured with the data selector and the mail notification has never events matched, and, obviously I don't receive mail alert. Please, could you help me? Why handler is

Hi all,Is there any way to obtain the real IP address of a client that accesses EC2 instances through an Amazon Internet Gateway that is routed through a FortiGate VM? I know that Amazon performs NAT on their end to map public/Elastic IP addresses to the Private IP but this is causing issues with testing the feasibility of using FortiGate VM as a replacement to Amazon Security Groups.For testing, I have a simple WAN (public subnet) and a LAN (private subnet) attach to the FortiGate VM with the appropriate route tables. When I simulate an external user connecting to a web server in our private subnet via a reverse proxy, the logs show the connection as coming from the LAN interface of the FortiGateVM. If I disable NAT on the incoming firewall rule allowing HTTP\HTTPS access through the VIP but then I am unable to connect. It seems that Amazon forces a double NAT scenario making it difficulty to obtain the true IP address.Ideally I would like to have the following workflow where the true

Hi, All. I have a some network on my office. This network is use a fortigate, i try to build some network monitoring with Elastiflow. Activate a netflow on my fortigate success, but i have some issue. Why on my network monitoring netflow is not show me a TCP Flags, such as SYN, RST, ACK, and other. The software elastiflow is good working, because i try to my other device such as MikroTik is they can show me TCP Flag types.In my case, i need to show the connection with TCP Flag, because with them i can analysis some traffic port scanning or bruteforce with filter the TCP Flag (syn). Any one can help me what the problems ? FortiGate 

Hi,We've identified "gui websocket" issue on forti-vm 7.2.5 version. The temporary solution by killing "gui websocket" process doesn't support well as it is reoccurring very frequently during operational tasks.Do we have any bug id or latest release to resolve this issue.As i don't have active license to raise this concern on support portal, so thankful if anyone ack here. Issue : Device Manager doesn't load devices after initiating Install Wizard every time.

 Hi everyone,I'm facing an issue with FortiGate Application Control. I have a profile configured to block all applications, including Telnet and Unknown traffic. The problem occurs when I test Telnet using the command:  telnet pop.gmx.net 110Instead of being blocked, this connection goes through, and in the logs, it gets categorized as "Unknown" rather than Telnet. Even though I’ve set Application Control to block Unknown traffic, it still allows the connection.Configuration:Application Control: Blocking all traffic, including Telnet and "Unknown".Application Default: Enabled.Logging: Shows the traffic as "Unknown" instead of Telnet.The Issue:Telnet over port 110 (normally used for POP3) is not getting blocked or recognized as Telnet—it’s instead showing up as "Unknown" but still not being blocked.Questions:Why is Telnet over port 110 being classified as "Unknown" instead of Telnet?Is there any way to force FortiGate to correctly recognize and block Telnet traffic on non

Hi everyone,I`m new to forum :)My question is:Is there a way to drop (not block) external traffic into my WAN without logging it?By country or by IP range or single IP?The goal is to block certain IPs so they can't even port scan my firewall.I can`t find too much apart from Deny ipv4 policy which still logs everything.I have Fortigate 60F.Thanks

Hello, I have a major problem. I have many offices in UAE on FGT60B Firmware: 3.00-b0737(MR7 Patch3). When I try to logon to a major international bank website and go into their online banking page, IE gives me a page not found error. I can reach their main page but as soon as I click Log On the I get " Page not Found" error. I tried from home and I can access the page without any problems or time out. Also I can also access the page from office, if protection profile is switched off. I do not think its IE problems as the same users who have difficulty accesssing online banking from office can do the same from home using the same laptop. Please HELP!!!!!!!!!!!! Regards J

Hi all, I'm completely new to the Fortigate world so hopefully someone can help me. At the company I work we are setting wan connections at remote site, we already have a couple of fortigates managed via Fortimanager and the end result we want to accomplish is to setup fortiextenders at remote sites and extend our lan, and provide WiFi also to our workforce via the extender.  The main objective is to use a common FTTC, FTTP or ADSL line to connect to the extender wan port and manage the extender via Fortimanager and extend our lan and vlans to the remote site, we do not intend to use LTE at least at this point in time as we already have internet service at the remote locations. Is this possible to implement ?

Our School Resource Officer needs access to a site to order security items for our school. This is blocked because it is a site that sells tactical equipment as well as guns. He is literally the only one that needs to get on this site but Fortinet refuses to respond with any help in this. Is there anyway to bypass a blocked site for a single user?

 Hi,I downloaded vpn forticlient 7.4.0.1658 with Windows 10 pro 22H2. I configured properly following my organization steps, configure authenticator..., but I'm the only one having issues connecting to vpn. I'm using user and pwnd correctly, in other case vpn fails at beginning, but after setting up correct credentials, a new page is created with vpn connecting info message (does not finish to connect) and then in error log I discovered this error:[7020:7024] [FortiVPN 1401 error] !!! fortivpn::StateMachine::HandlePreflight_GetCredentials failed to obtain tunnel credentials Someone have information about which means this error?.Thanks a lot

Hi all ¡¡I want to configure 2 stand alone fortiswitches, forming an MCLAG with ICL. Afther that, I want to define 3 VLANS, each one with a layer 3 address. For example: 192.168.1.1/24 Vlan 1192.168.2.1/24 Vlan 2192.168.3.1/24 Vlan 3 The fortiswitch will be configured with default route 0.0.0.0 0.0.0.0 192.168.1.2 (firewall) connected to VLAN 1. Finally, I want these 3 Vlans can route traffic (using the static route configured) but , I don't want these 3 Vlans can route traffic between them witouth previously leave Fortiswitch. For example, we have a server1 connected to VLAN 1, with IP 192.168.1.200/24 and default gateway 192.168.1.1 that wants to connect with server2 192.168.3.200/24 connected to Vlan 3 with default gateway 192.168.3.1. The flow traffic that I'm looking for Layer 3 is:  SERVER1 --> FORTISWITCH --> ROUTER -->FORTISWITCH-->SERVER2 I have read about offload IP options, but Im not sure wether enable or disable it, the layer

hello Experts', We currently using forti-os 7.2.7 firmware version, ssl vpn client certificate authentication not happening Before we used 7.0.14 version ssl vpn client certificate auth worked as expected, after upgraded to 7.2.7 its not working  Any one faced this kind of issue.? share your thoughts on this issue 

 Hello Fortinet Community, My customer is transitioning from a Palo Alto firewall to a new FortiGate 401F, which is configured in policy mode. The existing Palo Alto firewall uses rules based on App-IDs, and the following App-IDs are in use:(adobe-creative-cloud-base; adobe-update; hp-update; ms-update; ms-update-optimization-p2p; windows-push-notifications; xbox-live)I've configured the FortiGate firewall with equivalent application filters to match these App-IDs from Palo Alto. My question is: will the application filtering rules on the FortiGate function properly without enabling deep inspection (Note:- existing Palo alto firewall is not using decryption (similar to Fortinet deep inspection )).? Thanks! 

Hi All !On my FG201F device dashboard, I see the status of "System DNS Servers" has unstable latency (sometimes very high). It seems to be affecting our network performance.Note: This device is running firmware "v7.4.5 build2702 (Mature)" with 4 Internet lines (divided into 3 SD-WAN groups), the system is also divided into VLANs.Could you please assist us in diagnosing this issue? Any guidance on potential configurations or troubleshooting steps would be greatly appreciated.Thank you for support.

I was working on a Dial Up VPN setup between 2 Fortigate firewalls, I wanted to test the automatic addition of routes from the phase 2 selectors, however, I haven't been able to make it work properly.On The Server FG besides defaults I set mode-cfg enable.On the Client FG besides defaults, I eet mode-cfg enable mode-cfg-allow-client-selector enable.VPN is up, the server FG automatically created a route as per its selector, however, client FF hasn't added any route.Could anyone clarify this for me? Thank you!