Fortinet Community

Hello everybody,we are currently using a Fortigate and ForticlientOnlyVPN with an IPSEC XAUTH configuration.Since we are now moving to Forticlient EMS (up to date server and client) and after testing Forticlient 7.4.0.1658 the following problem occurs:If I manually add the IPSEC connection we are using with the OnlyVPN to the new Client (managed with EMS), succesful connection is possible.If I config the same IPSEC parameters on EMS and distribute it, remote access does not work.The error message on the client states something with Error: Aggressive Mode and the log files hints a certificate error (I replaced some sensitive information):21.08.2024 08:12:21 error ipsecvpn date=2024-08-21 time=08:12:20 logver=1 id=96567 type=securityevent subtype=ipsecvpn eventtype=error level=error uid=664559DDC9CC478DBC0D3A5B686BAA87 devid=FCT8002127206410 hostname=PC pcdomain=domain deviceip=IP devicemac=MAC site=default fctver=7.4.0.1658 fgtserial=N/A emsserial=FCTEMS8824006969 os="Microsoft Win

Hi people,I did some testing because our upload/download speed is nowhere where it should be.We have 1000/1000Mbps contract with our ISP.When I test the speed without Deep Inspection we got 925/925, that is pretty great.When I enable Deep inspection our speed goes to 850/350 which is really bad.Testing is done in this way:Client PC > Access Switch > Core Switch > FortiGate > ISP > InternetAnybody has some ideas ?

Hi people,I did some testing because our upload/download speed is nowhere where it should be.We have 1000/1000Mbps contract with our ISP.When I test the speed without Deep Inspection we got 925/925, that is pretty great.When I enable Deep inspection our speed goes to 850/350 which is really bad.Testing is done in this way:Client PC > Access Switch > Core Switch > FortiGate > ISP > InternetAnybody has some ideas ?

Hello, Can I please have my nickname changed to sifr? Thanks

Hi there, So after upgrade forticlient from version 6.4.8 or 6.4.9 or 6.4.10 to forticlient (any version) of 7.0.XX to 7.2.XX, I starting have issues with FortiAMSI.dll: C:\Program Files\Fortinet\FortiClientx86\FortiAmsi.dll is not designed to run on Windows or it contains an error. Try reinstalling the program using the original installation data or contact the system administrator or software vendor for support. Error status 0xc0000428. Is randomly in some PCs, starting from Windows 10 - vs. 1909 Fortinet support means that Microsoft will have to resolve this. I don't believe that Microsoft does it, "per client" and not on a global level. Does anyone have a similar problem? I ask the question here, that someone may have had a similar problem, and found a solution. We have added ticket at Microsoft, since, in principle, it will be Microsoft's issue/problem. 

We are using FortiEMS in our organization. And recently we have received a vulnerability related to Oracle JAVA on EMS server side. So, please suggest whether JAVA is required on EMS server side. Apache 2.4.x < 2.4.62 multiple vulnerabilities - HighOracle JAVA SE multiple vulnerabilities - High Please refer attached snap. Thanks.

Hello all, i need help making sense of a malware log in FortiAnalyzer.The log only show the Threat as a bunch of numbers and letters and i am having a hard time deciphering its meaning. Can some one help. It seams a "generic" threat ID but i really don't know for sure since the source is a blog in wordpress and it has already been the target of defacing and redirect before. I would appreciate any help.

Hi all! how are you?I upgrade all our Fortigates to 5.6, but now the Analyzer doesnt  process logs.Can anybody help? I have to downgrade the Fortigate Firmwares to get back to work my Analizer?There is any news about new version of FortiAnalizer?I upgrade my FortiManager too, and if I execute a downgrade of Fortigates, my Manager stop work normally...There are some with the same problem?Thanks you all!Best regards. 

Hi, I´m using a Fortimanager (v.6.2.6) to serveral Fortigates (also v.6.2.6). Over time the Fortimanager looses the FGM-Acces to some Fortigate´s and I already debbugging it with this cookbooks: https://kb.fortinet.com/kb/documentLink.do?externalID=FD33882 https://kb.fortinet.com/k....do?externalID=FD48001 https://docs.fortinet.com/document/fortimanager/6.2.0/cli-reference/861511/fgfm-reclaim-dev-tunnel (he dont get the tunnel, but over time he get it without this command) [size="4"]But in the end I dont find the issue. Also i checked the ports for Input/Output errors (zero tx/rx errors, only sw_in_drop_pkts : 4  errors!?)[/size] [size="4"]What can be the issue here?[/size]  

 Good Morning,  I have in my office 5 APs FAP231F connected to a Fortinet Switch and then to our Fortinet Firewall FW80. The FW provides DHCP to all our devices and then connect using IPSec Tunnel to our Domain Controller for DNS Services. A couple of months ago we updated configuration in the Firewall and activated antivirus and file filtering, ssl/ssh inspection and web content filtering. These are the only changes done recently and are my starting point for any possible changes in the environment that could be affecting my wireless network. I disabled all the fw security features I enabled a couple of months ago and seems to bring stability to the wireless network, yet in the last week I started experiencing the random issues of APs not broadcasting SSID or if connected to the SSID disconnecting from internet. Please find below our current AP configuration: Any help or guidance in what to do next would be much appreciated.    

We are ussing Fotigate 201F- Captive Portal applied and LAN User authenticate but Wifi Users not authenticate, both Networks are different segment (LAN- 10.161.0.0/16, WIFI- 10.172.0.0/16while applied the Captive portal, LAN Users properly authenticate but WIFI users trying to connect the the authentication but page not open however did not get dhcp IP but when disable the Captive Portal then users connect properly through DHCP IP. Connectivity-- Users---LAN/WIFI >> L3 Switch >> Fortigate >> Internet.

I added SSO login to VPN with these guides:https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Companion-for-troubleshooting-SSL-VPN-with/ta-p/217719 Currently, I can connect to the VPN using SSO via the SSL-VPN realm link, connect and it's working great.When I'm trying to connect via FortiClient I have an issue, if I connected to a session from the SSL-VPN realm portal it opens the browser with the session, if not it will open 'This page isn’t working'.On Google Workspace side and on FortiGate side, everything looks OK in terms of configurations. The fact that I can connect to a session with the SSL-VPN realm portal prove it.I'm trying to troubleshoot this issue with no luck, what am I missing?I'm using FortiGate 60F version 7.2.9  

I'm having a DUP! ping on Fortigate 100E. please guide to find the error and how to fix it. thank you

Baddi_Aw # 2024-08-31 10:17:53 id=65308 trace_id=8 func=print_pkt_detail line=5836 msg="vd-root:0 received a packet(proto=6, 172.27.138.59:39491->20.190.145.140:443) tun_id=0.0.0.0 from PORT-CHANNEL251. flag [S], seq 1152205440, ack 0, win 29200"2024-08-31 10:17:53 id=65308 trace_id=8 func=init_ip_session_common line=6020 msg="allocate a new session-3e06eec6"2024-08-31 10:17:53 id=65308 trace_id=8 func=vf_ip_route_input_common line=2612 msg="find a route: flag=00000000 gw-223.30.9.17 via port3"2024-08-31 10:17:53 id=65308 trace_id=8 func=__iprope_tree_check line=539 msg="gnum-100004, use addr/intf hash, len=55"2024-08-31 10:17:53 id=65308 trace_id=8 func=get_new_addr line=1258 msg="find SNAT: IP-223.30.9.18(from IPPOOL), port-39491"2024-08-31 10:17:53 id=65308 trace_id=8 func=av_receive line=480 msg="send to application layer"2024-08-31 10:17:53 id=65308 trace_id=9 func=print_pkt_detail line=5836 msg="vd-root:0 received a packet(proto=6, 172.27.138.59:39491->20.190.145.140:443) t

Hi all,I need to create a firewall policy for AD communications but RPS service is using a lot of high ports and we need to avoid this, I heard that Juniper can use UUID mapping at app level and I'm wondering if also with Fortinet we can do that, any idea?thanks 

Hello, from day to day I started having problems starting the FortiClient application. Before that it worked for me for about 2 weeks. After startup, FortiClient shuts down after about two seconds. Can't click on anything in the app. No error appears anywhere. They could not advise me even at the IT department in the company. I am said to be the first to come up with such a problem. Reinstalling didn't help.Version: 7.2.4 (other version is not available in our company)Thanks for any help

Hello,I have issue with RIA by Tunnel in case of main WAN link is down or IP SLA is not meet... I have two sites  (MAIN and SMALL) and FGTs 100F in each.  This SMALL Site has three interfaces:WAN1 - Internet accessIPSec Tunnel0 - P2P Link between sites IPSec Tunnel1 - use WAN1 Internet Interface   I have one SDWAN zone with all these interfaces above and two rule: 1. To_MAIN Site (use Tunnel0 -prefered,  and Tunnel1) (for traffic between sites)2.To_Internet (use WAN - prefered, and Tunnel0 when WAN int has issue or is down (IP SLA))   I have FW rule to from SMALL to MAIN site and destination interface is SDWAN zone Issue is when WAN link has issue (or is down) and is removed from RoutingTable (thanks to SLA) -  Internet don't work, I see in debug that trafic is going to tunnel0 but not work, I found also in debug that FGT is still do  NAT using IP of WAN Interface , but why ?? When I disable NAT on FW rulle

Hi, It is trying to do certified EAP-TLS for remote users on ldap.I created a Fortiauthenticator local ca as CA.While there is no problem with local users, it gives an error with remote ldap users.On the Create New User Certificate screen, I used the remote user name as Name (CN).I imported the CA and user certificate to the PC, but it did not work.The same process works with local users.What could be the reason?    2024-09-02T12:08:04.633327+03:00 fac radiusd[16808]: (144) authorize {2024-09-02T12:08:04.633338+03:00 fac radiusd[16808]: (144) [preprocess] = ok2024-09-02T12:08:04.633345+03:00 fac radiusd[16808]: (144) [chap] = noop2024-09-02T12:08:04.633350+03:00 fac radiusd[16808]: (144) [mschap] = noop2024-09-02T12:08:04.633356+03:00 fac radiusd[16808]: (144) [digest] = noop2024-09-02T12:08:04.633363+03:00 fac radiusd[16808]: (144) eap: Peer sent EAP Response (code 2) ID 204 length 172024-09-02T12:08:04.633368+03:00 fac radiusd[16808]: (144) eap: No EAP Start,

Hi Team, I have configured a FortiSwitch 108F-FPOE // version S108FF-v7.2.4-build5148,230530 (GA) // via fortilink and everything works ok, but when I reboot the Fortiswitch, I start getting messages saying "FortiLink: ISL timing-out for trunk". Info  Before restarting the Fortiswitch After restarting the FortiswitchFortiswitch Trunk configuration config switch trunkedit "_FLinkDhcpDisc_"set auto-isl 1set static-isl enableset members "port10"nextend What can this be due to? Thanks & Best Regards,Juanmi 

Dear team, I noticed that Cisco Switch are not accept Radius CoA/Disconnect Message from FortiNAC-F 7.4. I'm not sure if we need to have any customer RADIUS Attribute to pass to the Cisco Switch. I would like to share debug of pcap and Switch here.Anyone who has experience this issue, Please kindly share Note: RFC5176 Mode: system defined and Switch is configured CoA Port 3799 Thank You

Hey Guys,  Hoping someone can shed some light on this problem I'm having, Google hasn't been much help unfortunately.  I've set up an SSL-tunnel VPN for users to connect to our network remotely. Everything seems OK for most users, except for 2 of them. Two users receive [style="background-color: #ffff00;"]"Permission Denied -455"[/style] error message when attempting to connect to the VPN with FortiClient. Users credentials are getting checked against an LDAP connection which I know works because other users are having no issues and I've tried their accounts locally inside the network with my FortiClient. Users are also able to login normally when using domain workstations. Is this more likely a problem with FortiClient or perhaps their home network? I'm currently working on troubleshooting with the users about their home networks, block ports, router configuration, etc... FortiGate 800CFirmware 5.2.4 build 688 Thanks for any insight guys. Cheers

  Most of the Source in Log & Report -> Secuirty Events -> Application Control not showing user name in source  UserName(Ip Address) eg E10293(10.20.10.55) few of them appearing IP Only 10.20.10.66  Please guide how to fix this we need to see UserName(Ip Address) in Source column for all devices

I have azure networking backend hosting azure subnet with my DC and computers subnet x.x.x.x/16 and then I have another subnet in azure hosting my fortigate VM y.y.y.y/22. On my fortigate VM I have the local LAN z.z.z.z/26. I have configured the fortigate with FortiClient and would like the DC and computers in Azure to only be reachable through connecting to the FortiClient.  

Hello;As mentioned at multiple posts here, the fnsysctl command may provide some helpful possibilities, including access to ifconfig, ls or other very useful commands. I tried to use it, unfortunately, not possible. Had installed education Lab with a bit older Fortigate FortiOS version, user as initial, admin, with super_admin profile (accprofile command in that version for change). Also, had installed (not fully yet) the Trial version of the Fortimanager with newer FortiOS, there's admin with super_user profile (and command for changing that is different, includes profileid instead of accprofile). Command fnsysctl does not work on both (even it should work at the admin user with super_admin profile). Two questions:- How and where to elevate privileges for admin super_user to admin super_admin at Fortimanager FortiOS (and to get the fnsysctl command work)?- Why the fnsysctl does not work even on the Fortigate FortiOS wher the admin has super_admin profile?