Fortinet Community

Hi Guys, On two out of the four laptops I am installing FortiClient on to when we wenter the invitation code and click on connect it opens loads of browser tabs saying it is authenticated but the client never shows as connected. On te other two it works fine. FortiClient version 7.2.4.0972FortiEMS Cloud version 7.2.4 build 0983Any ideas what may be causing this? Thanks John

I thought this would be easy, but I am not finding a specific option for doing so. We recently had a system update form a vendor, and they are suggesting we block http port 5985 and https port 5986 at the firewall. I am logged into the Fortigate right now and thought I would just find where ports are already blocked and add these two to the list, but I don't see anything like that.My thought is that everything is implicitly denied unless allowed, so this might already be blocked by default, but I want to confirm that to the vendor to complete the security on this setup.Is there something I am missing while going through the menus? We're on version 7.0.7 - I am comfortable with the menus and interface and making changes, I'm just not sure where to go, and searching online for this option isn't yeilding any good results.

I wanted to use the on_connect script in the FortiClient to connect an smb share after the connection is established as shown here. But the command is executed before the connection is established. After my command failed the connection is shown as established in FortiClient. I tried to execute the command in the background but failed to do so.  <on_connect> <script> <os>mac</os> <script> echo "" & sleep 4; /usr/bin/osascript -e 'mount volume "smb://ssldemo.fortinet.com/installers"' </script> </script> </on_connect>  Environment:MacOS 14.6.1FortiClient 7.4.0.1645SSL-VPN via SAML SSO using the external browser as user-agent

Hi,I have two firewall1.)fortigate 400E firewall (currently live)2. fortigate 300D firewall (older one) Can i use fortigate 300D firewall as a forti analyser to store logs?

Hi all, I am looking for some guidance with setting up an automation with Fortigate. My goal is to create a stitch trigger that, when OSPF neighbor goes down, the action would be to disable the VPN Hub tunnel using a script that points to that tunnel. Then, when OSPF neighbor goes up, the action would be to enable the VPN Hub tunnel using a script again. Unfortunately, I have not yet been able to trigger count this as I tried shutting the interface down and up. Would anyone have an example of using OSPF to have neighbor status changed and which filter you used to do this? I think I have the action correct but not the trigger.

First, I thank the community members for their quick responses. After checking the cluster, I noticed an issue with the site-to-site VPN tunnels, which are going up and down after upgrading from version 6.4.15 to 7.2.8. Does anyone have insights or tips on how to fix this

Currently I manual Block the IP address has given by our SOC at Firewall Level.Can fortigate do auto blocking IP based Threat Intelligence? IF Yes, what the products need to be intergrade with our fortigate?The Objective is to reduce ticket from SOC and manual block IP address. Thanks

i just changed my FortiSwitch to standalone because I replaced an old fortigate firewall to a new one.  I maintained the same configuration no vlan just hardware switch network.  I’m not using Fortilink port so the switch is standalone mode. It’s working but it does not show up on FortiSwitch and even if it does it shows offline.  How can I make it appear and online without using Fortilink? thx

I have read multiple posts online and have tried several things but I cant get Fortigate to contact Fortiguard Servers.The Netwrok/DNS page shows server either unreachable or high latency. On the System/Fortiguard page, when I open Filtering it cant contact the servers.Any thoughts?

Hi expert, I'm trying to create a policy to quarantine any email that has a email header X-RCIS-Action = Quarantine.Can any one share the configuration on Fortimail? Thank you!

I have new device 401F. By default it is on the v7.4.3. I need to downgrade the device on the version 7.2.8. I tried to downgrade but getting an error "image downgrade failed. Failed to upgrade firmware due to expired firmware updates license." Is to possible to downgrade device without registration/activation of license. Also I verified with cli by using the command diag sys flash list only v7.4.3 is showing there.

Hello, Fortinet's chat support recommended to ask here if anyone would be kindly willing to provide me with (one of) the latest firmware for Fortigate 60D. I need to burn the firmware as my unit is bricked. Thanks a lot Best RegardsJaroslav

Was doing some log parsing and came across some traffic flows that had me scratching my head. I have a policy with DPI enabled, but I do have reputable websites with various categories and address objects exempt. I also have a application control profile applied to said policy where I explicitly block DNS over HTTPS and DNS over TLS.  The traffic in question going through that policy shows traffic to dns.google (8.8.8.8) with application of DNS over HTTPS and DNS over TLS as Allowed (again, app control profile has it set to block). My assumption is, that due to my DPI profile having pretty much all things google exempt, this is causing the traffic to pass Allowed. This seems the most logical reason, but just wanted to bounce this out there and get some thoughts if I'm on the right track or there is some other "rabbit hole" I need to go down.

As FortiSASE currently lacks an official public API, I thought I'd share a little bash-script I just wrote that uses cURL to login to FortiSASE via SAML/SSO and can then access the backend REST(ish)-API used by the FortiSASE portal natively. I needed this to automate the process of adding ZTNA destinations as part of our customers build pipeline.Please ignore the ugly grep/sed's and just see this as proof-of-concept code for inspiration. Also be aware that as the API is currently not documented or intended to be used by end customers, I assume Fortinet will not give you any support if you experience problems with the API, so please use this code on your own risk.     #!/bin/bash ################################################################################# # CURL snippet to use SAML IAM Login to FortiSASE to consume it's REST API. ################################################################################# curl_opts="-s --cookie-jar saseCooki

Ever since the firewall was set up, the DNS to contact the domain hmf.local is not working. Does the firewall inspect internal DNS queries? The local DC is the DNS server and FG is the DHCP server. The DC can be pinged from workstations. The FG is connected to the DC via LDAP. For e.g., This stops VPN users from changing their passwords remotely.This stops Windows machines joining domain.

Hi Guys, Normally when i use FortiClient VPN in my corporate network it works without any problems but as soon as i want use it with my home network to get access to the university network it shows "SSL VPN permission denied" without even asking FortiToken. I did all necessary sittings as my university explained in the video but still did not work. could some one please help me solve this problem!   I use Windows 10 thanksFortiClient FortiToken FortiAuthenticator 

Maybe not a FortiToken bug, but very annoying. When sizes of display/characters are larger than normal, there is no way to click 'allow' or 'deny' in the FortiToken app when accessing. GrtzS

Hello,  I need to configure Direct Connect on AWS using a Fortigate 90G.Does anyone have a step-by-step guide or any configuration documentation for this task? Thank you. 

Hello,I've been trying to report on how much time my users spend in the 'Streaming Media and Download' category on FortiAnalyzer for a while. I noticed that the reports I created weren't working correctly, so I started to dig deeper into the issue.According to my findings, the main source of the problem is that the 'ebtime' parameter is missing in the raw logs for some categories.The 'Streaming Media and Download' category is one of them. Since the 'ebtime' parameter is not present in the log, 'FAZ' cannot calculate the 'Estimated Browsing Time' value for these categories. How can I solve this issue? How can I ensure that the 'ebtime' parameter is included in these categories?The traffic logs of the 'Streaming Media and Download' category that do not contain the 'ebtime' parameter; date="2024-08-29" time="14:40:17" id=7408525277996777492 bid=39320003 dvid=1064 itime=1724931709 euid=1110 epid=3405 dsteuid=3 dstepid=101 logflag=1 logver=702071577 type="traffic" subtype="forward

hi , i am facing problem in 121g firewall , when we update firmware to 7.2.9 than HA is not synchronized but in 7.1.5 it's work , kindly help

Good Morning, Has anyone ran into issues when updating the firmware on MCLAG switches that would cause the switches to disconnect? I'm wondering if the MCLAG group of switches need to be updated to the same firmware at the same time? Topology:FW1 & FW2 (HA Active/Passive)SW1 & SW2 MCLAG Group 1 (SW1 connected to SW3)(SW2 connected to SW4)SW3 & SW4 MCLAG Group 2 (SW3 connected to SW5)(SW4 connected to SW6)SW5 & SW6 MCLAG Group 3 SW1 & SW2 are running FortiSwitchOS 7.4.1SW5 & SW6 have been updated to FortiSwitchOS 7.4.3 After updating SW4 to FortiSwitchOS 7.4.3 last night we lost access to switches 3-6. The log message that stands out is "action="unsup-cfg" status="none" msg="MCLAG: **peer software mismatch local-software(v7.4.1,build0787,230921 (GA)) peer-software(v7.4.3,build0830,240422 (GA))"" Disabling the port on SW1 that connects to SW4 gave us access back to SW3-5 but SW6 is still down. I'm assuming that updating SW3 to 7.

Hello,Currently we use FortiClient for SSL-VPN connection to our corporate network.We have licenses to use ZTNA also.Plan is to implement ZTNA.Is FortiClient needed or it can be without it?

Hello guys i need your helpHow can I configure the Traffic Shaper so that the set value applies equally to all users? For example, if I set the value to 20, it should be the same for all 30 participants, without needing to divide this value among the 30 users. Thank you

Hello All, Purchased an Fortigate 201 F, where i need to use 2x 10 GE SFP+ fortilink Slots as normal L3 port and further add it into portchannel. Is it possible.

Hii guys  i am using FG100F with OS v7.4.3 yesterday i install FAP-231F AP .My a