Fortinet Community

Hello, I need to restore the Forticlient configuration in a new brand PC. I can restore all the value but the username for all connection is empty! Why? How can I do a full restore? Without user name do not make sense. 

Hi AllI am looking to migrate an interface on some Fortigate 100D devices from a 1Gig LAN with vlans to a 10G X1 interface.When I click migrate to interface and click "select and existing interface", the target appears to be blank, why is this?

Our health check has come back that our login pages are viewable over the internet.I have disabled HTTPS/HTTP over the WAN but page still shows.Any quick fix please?Thanks

Hi,I've looked on Broadcomm's (nee, VMware) support site, but I was hoping someone here has already delt with this and might share the port list to successfully connect 1 vCenter server to 1 host and 2 VMs over a site to sire IPSec tunnel. I'm looking to limit access of the whole remote network to the vSphere infrastructure.TIA 

We have some hyper-v VMs that we upgraded from 7.2.3 to 7.2.5 forticlient. SSL VPN no longer works after upgrading.We can repeat the problem by downgrading to 7.2.3 and then successfully connecting then upgrading to 7.2.5 and breaking it again.we need to run 7.2.5 to fix a wild card FQDN issue with ztna destinations that we were experiencing on 7.2.3.

Hi everyone. I have installed EMS on the same server that a File Server. (Windows enviroment)One day, the app was working fine but on the next day just didn't and shows this error when i try to execute.The Apache service isn't working and i cant run it.Event Viewer show the next errors: The Apache service named reported the following error:AH00015: Unable to open logs . The Apache service named reported the following error:(OS 10013)Intento de acceso a un socket no permitido por sus permisos de acceso. : AH00072: make_sock: could not bind to address 0.0.0.0:443 Have PID 4 that SYSTEM is running on that port, when i'm trying to change the port from httpd.conf nothing happens Failed to load URL https://localhost/ with error ERR_CONNECTION_RESET (-101). 

Hello ,  i have  old device 800c with  Firmware Version v4.0,build0656,130211 (MR3 Patch 12)I want to ask1.  how to set Gateway Failure (Recovery) Actions for Link Health Monitor  ( 2 isp , wan 1  & wan 2 )2.  is it possible upgrade firmware  to  v5 or v6 ?  please suggest   regard  

Hi Forticollegues,I'm implementing a Fortinac solution to manage dynamic vlans via unique WiFi SSID.The wifi networks and all wired networks are managed by Fortigate.In Fnac inventory I see all Fortigates ports mapped and FNAC learn all client mac address from wired and wireless ports.There is some methods to instruct the Fnac to learn mac address only by wireless networks? I don't need to manage all wired networks and I see a lot of rogue devices from Fortigate wired ports.Thank youVincenzo

HiLooking for some advice, if anyone can help. We have a few remote sites each with a Fortigate HA cluster with ADVPN connetivity between the sites. We have a Fortimanager at our primary site which as also managing some of the remote sites but not all of them. We also have a FSSO server at the primary site and 2 of the remote sites. So, I went through the process of adding the Fortigate at one of these remote sites to FortiManager. for the most part it went ok but we have had issues with the FSSO agents.The import process imported ther SSO agent settings from the remote site. What we discovered was that this had a couple of duplicate entries, that were also on the primary FSSO agent. I am referring the configuration in FortiManager at Object Configurations > Fabric Connectors > Endpoint/Identity.What we found is that the 2 FSSO agents cannot have the same groups or users in them. If you add a duplicate entry it disappears from the other agent. Also, when pushing policy, the insta

Hi,we are sw company, and have own security product (authentication server). It can work like radius + otp (and many others methods) so I try to integrate OTP to ftgt. It works (with free ssl vpn client). But after I try use 2FA online method, with push notification. And here I have problem. Forticlient send AD user name and correct password, mobile app recieve notification, but FortClient instantly shows OTP dialog. With no reason, I not send more validation req. -- UPDATE ---This is because I have second functional radius server with MS365 MFA on it. And fortigate from unknown reason switch to this, second server, almost instantly after password send. When I change IP of second radius to nonsense, everything works.Fortios have only 2 parameters I know, timeout in radius definition, and global, remoteauthtimeout. Both set to 120s and not helping.This seems now like some error in fortigate logic, so I create ticket on it, sorry for this post, I believe in time of writing that this can

How can I redirect Port 443 only to a different IP with the FortiGate? Domain Controllers are in separate subnet, and all requests except port 443 should go to the real IP. Port 443 should be redirected to an external webserver. (for context: AD set up with split DNS, domain.com internal AD, and the same domain.com externally and we can't change or AD name, using www is not an option)

This recently has happened to us with our own Website and all our FGT. When one tries to access our website all one gets in Chrome is a QUIC Protocoll error.Looking at Chrome's netlog on a client affected I saw that it tried to use Cloudflare's ECH Protocoll to do encrypted client handshake to their proxy. This failed because UTM blocks  cloudflare-ech.com.If I add that FQDN to a policy that doesn't have filters and comes in front of the other internet policies our website works fine.Cloudflare community also has a thread on this: https://community.cloudflare.com/t/err-ech-not-negotiated-problem/710760 I cannot say wether Cloudflare did something bad by enabling a feature they still declare experimental as default or not. (This is said in the linked thread). However since non-filtering cloudlare-ech.com is not a solution (but a fix) I have openend a ticket with tac (which escalated to a senior with the first answer) aswell as with cloudflare support.curren

Hello Community. Please give some tip on how to create lists like (words, emails, names, etc) for later use. case scenario: using the filter "Mail Sender" --> IN --> (select from cmdb the list emails)   Regards.

Hi,I am currently experiencing issues with FortiClient version 7.0.0 and FortiClient version 6.4.9 installed on a Windows 7 machine. A group of users is configured to not have internet when connection to vpn. On one of them, when I connect to the VPN, it allows both VPN and Internet connections simultaneously, which should not be happening. This user is on the same group with others. I’ve tested the same user on another PC, and it behaves correctly, not allowing the Internet connection while connected to the VPN, so I am confident this is not a firewall issue.

Can I check is there any connection speed difference between the free VPN only client vs the full client?I have a few users which used to use some older i5 laptops with 16gb ram running the full version FortiClientSetup_6.0.9.0277_x64 because the old full version is free.Now have done a hardware refresh for these few users with newer i5 laptops with 16gb ram running the free VPN client FortiClientVPNSetup_7.4.0.1658_x64.These users are complaining that the new laptops are slower when opening up files from mapped network drives. Says that the older laptops are faster when performing the same task?Is there any speed difference between the free and full vpn clients?Thanks

Hi, before getting crazy with all this (I am nearby) ...  Maybe, someone has an idea.We have a Fortinet EMS with ZTNA support enabled;We registered an Android Device and a Windows 11 Client for testing purposes. a) Android Phone (Android 14) does not seem to receive a cert, it is always shown as revoked. CA was already manually installed on the Phone, no change. b) Software Inventory works now. On the Cloud, we are on Forticlient EMS 7.2.4 and requested an upgrade to 7.2.5, and on the clients, we use the latest available packages for the FortiClient. Any help would be nice. Ronny

Is there a way to block sources by their ISP name? We have an issue with skimmer bots attempting authenticate against our VPN server, constantly locking out accounts that we use. Even though these accounts don't have VPN access, the FortiGate still passes through the login attempt to the DC.  We already have connections geo-blocked, but the geo-block feature is useless now that foreign bots just use a VPN service to tunnel into the U.S. before attacking our firewall.  Grabbing the IP addresses from the logs and running a geo-lookup on them, I found that all of them are coming from different VPN providers. Blocking these by the ISP name or even whitelisting certain ISPs should fix this issue if it's possible on FortiGates.I'm using a FortiGate 100E.  Thanks for any help with this. 

After we upgraded Win10/11 clients to the Forticlient 7.4 version, we experienced the forever connecting issues like others. Additionally, we found that after supplying the fortitoken on the first connection, the subsequent attempt did not prompt for a token/code. This was repeatable behavior on the 7.4 client and occurred after an immediate reconnect and rebooting before reconnecting. We worked with support to troubleshoot and found that backing down to Forticlient 7.0.13 resolved the connectivity and token issues. We do not pay for client support so our tech was unable to reach out to the client team on this MFA/token issue.  Has anyone else experienced this behavior in Forticlient 7.4? Reinstalling the redistributable did not help with these issues either.

 Hi,I am using a FortiNAC-CA 7.2.4 (FortiNAC-OS) with a basic FortiNAC license. Network Infos:The FortiNAC is connected via cable to a switch and terminates on a FortiGate through port6 (0.0.0.0/0) with a VLAN stub and VLAN Isolation. I have configured port1 for MGMT (Layer 3) and port2 in L3 Isolation mode, with an IP on the VLAN stub and a Range Scope for the VLAN Isolation. The FortiGate acts as a DHCP relay towards the IPs of the FortiNAC (both port1 and port2). FortiNAC infos:I created two groups (MAB_VLAN2 and MAB_VLAN3) and two roles (ROLE_VLAN2 and ROLE_VLAN3). I then set up user configurations with the following logic:If the user does not belong to the groups VLAN2, VLAN3, or Registered_Host → Logical Network IsolationIf the user belongs to group VLAN2 and has ROLE_VLAN2 → Logical Network VLAN2If the user belongs to group VLAN3 and has ROLE_VLAN3 → Logical Network VLAN3I am using a test switch and a test PC, and from manual testing, it seems everything

Hi I'm trying to migrate from EMS 7.2.5 to 7.4. I have gone through all the steps in the Admin guide and have now hit a brick wall.  I am getting an error "Authentication (publickey) failed" and "encountered RSA key, expected OPENSSH key" and the migration is failing. I found this article at  https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-Getting-an-error-when-performing-EMS/ta-p/328415 which did help with another error I had. However, the article just says to the generate the public key, which I have done and re-done several times with no effect.  Has anyone had this issue? Can anyone help please? ThanksRoy

Hi,Good day everyone.I would like to seek your assistance as networking is the least of my professional skills :(Currently, I need to transition the current Internet Line from existing different ISP to another one for one of our remote office but at the same time, let the other old Internet Connectivity up for the time-being.The old Internet Line (A) is connected to WAN1 of the firewall, and has existing site to site VPN.The new Internet Line (B) is connected to WAN2 of the firewall. The Internet Line (B) connection has it's own router and the PublicIP is NAT'ed to 192.168.1.2 - connected to WAN2 which now has 192.168.1.3 IP.My question is, what is the best approach for this? I would like to set-up WAN2 (Line B) as the main line and also set-up site-to-site VPN but at the same time, retain the existing line A as the backup temporarily in case for 2 months before totally discontinuing it if all works well. ...How can I do this? Thank you!!! FortiGate 

Hello Community,our FortiGate blocks access to Dropbox by the Category "File Sharing and Storage", this is ok.However, I need access to Dropbox from my PC. So I created a Firewall-Rule to allow Dropbox-Web from my PC.But this rule didn´t work.When I try to access Dropbox, I still get the message that the access is blocked by Category.Can anyone help me?Kind regards,Christian 

I have log lines that I want to parse to JSON using Regex. I can now parse 99% of all logs, but the regex failes on a few log lines! I need help to complete the regex.RegEx so far: <(?P<priority>\d+)>(?P<timestamp>[A-Za-z]{3} \d{2} \d{2}:\d{2}:\d{2}) (?P<hostname>[^\s]+) date=(?P<date>\d{4}-\d{2}-\d{2}) time=(?P<time>\d{2}:\d{2}:\d{2}) devname=\"(?P<devname>[^\"]+)\" devid=\"(?P<devid>[^\"]+)\" eventtime=(?P<eventtime>\d+) tz=\"(?P<tz>[^\"]+)\" logid=\"(?P<logid>\d+)\" type=\"(?P<type>[^\"]+)\" subtype=\"(?P<subtype>[^\"]+)\" level=\"(?P<level>[^\"]+)\" vd=\"(?P<vd>[^\"]+)\" srcip=(?P<srcip>[^\s]+)(?: srcport=(?P<srcport>\d+))?(?: srcintf=\"(?P<srcintf>[^\"]+)\")?(?: srcintfrole=\"(?P<srcintfrole>[^\"]+)\")?(?: dstip=(?P<dstip>[^\s]+)(?: dstport=(?P<dstport>\d+))?)?(?: dstintf=\"(?P<dstintf>[^\"]+)\")?(?: dstintfrole=\"(?P<dstintfrole>[^\"]+)\")

How to convert the FortiGate firewall logs in csv format, please provide the solution.

Hi,we play around with ZTNA and I am not sure, if I am to silly ;) or I have a single point of missing knowledge or misconfiguration. Our Setup:2 x FGT (HA) -> Fortiswitch (VLAN) <-- fiber, with transfernetwork --> FortiSwitch (VLAN) -> 2 x FGT (HA) Some hints:- we use a Fortiswitch on each site, we have a highspeed fiber ($$$) and this is just in place once, so for HA purposes on the FGT, we use this Fortiswitch,- the VLAN is configured with same ID on both sites and dataflow works - we need at both site a full FGT cluster, to setup local ip settings, manage the local switches and can run both sites without interruptions if one site fails (we have a fallback route on site A to reach site B)- first idea was, to manage *ALL* switches and networks from site (B), this would work, but then, we can not manage the setup on site (A) if there will be any problem with site (B). And now, the fun begins...We setup a simple EMS Cloud to fulfill ZTNA. a) Normall