Fortinet Community

Hii guys  i am using FG100F with OS v7.4.3 yesterday i install FAP-231F AP .My a 

Hi, we are in the middle of changing a FG300 cluster to a new FG200 cluster. In the old config we didnt use SD WAN, we had like one WAN1 for the MPLS connections and WAN2 and WAN3 for Internet Access. WAN1 mainly has all VIPs and VPNs, also it is a shared Internet Access so thats why we got WAN3 for all outgoing traffic. Now we would like SD WAN for Load Balancing or primary failover reasons but I am not sure what would be the correct configuration. If I do the implicit rule with 99%  - 1% or what is the best way? Thanks for your suggestions!

The secenario is that I was using Forticlient VPN (vpn only version) for remote access. On windows, it works fine with the .crt and .pkf local certificate. However, on Ubuntu, I tried same with those cert and receive a fail to create SSL.I did research but there was the FortiManagerr and FortiAnalyzer at https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-verify-the-ciphers-used-in-a-PKCS-12/ta-p/327734 but I'm not sure it works the same.The debug log is as below: 20240823 09:08:53.049 TZ=+0700 [sslvpn:DEBG] vpn_connection:307 SSL error: error:0308010C:digital envelope routines::unsupported20240823 09:08:53.049 TZ=+0700 [sslvpn:EROR] vpn_connection:463 Failed parse PKCS#12 file20240823 09:08:53.049 TZ=+0700 [sslvpn:EROR] vpn_connection:1518 Failed create SSL Anyone that got into such problem and found the way to overcome? Thanks and appreciate any help would come up! 

I would like to disable directed broadcast but have been unable to find how it might be disabled for all interfaces. Is there a command to achieve this?

Hi Team, When the user registers his account on the portal, he must select a prefix for the phone number. The question is how to set my country to be my favorite or by default will be chosen. The current default setting is +1 and I don't know how to change it. To clarify the question, how to change it so that the +48 prefix is always shown to each user. I traied change that in html code, but i failed. I searched the forum but didn't find anything. A request for help Fortiauthenticator 6.5.3  

Hello everyone, Our Firewall was configured with several virtual IPs (static NATs) to forward internet traffic do our internal services.Currently we do have three public IP adresses but I want to merge them. So I do want to use virtual IPs with FQDN.I guess I need to enter the External FQDN in the top field, and the internal fqdn in the bottom field (mapped address). We use windows DNS server for internal name resolution (so that our clients can find each other). When we do intern name resolution the public domain name gets overwritten with the internal IP address... (e.g. service.company.at gets an private IP adress in our company lan and no the public one) so traffic does not have to use the internet. So I guess I somehow need to add two different DNS to FortiGate - one for public dns name and one for the private IP adress (=mapped address). Does that even work when both names are identically? 

FG 400F - FortiOS 7.2.8I'm trying to export  root certificate with password and private key.  I tried exporting using TFTP however, I can't export build in certificate off the Fortigate. "built-in certificate 'fortinet_ca_ssl' is not allowed to export". KBs that I've run through:Export a certificate | FortiGate / FortiOS 7.2.8 | Fortinet Document LibraryProcedure for exporting and re-importing ... - Fortinet CommunityExporting or importing a local server cer... - Fortinet Community - How can I export the cert in p12/pem format so I can extract the private key and password?- How can I decrypt the private key and password? Appreciate your feedbacks. TIA :) 

Hi,I can't get a reverse rule to trigger for VLAN communication. VLAN 30 is able to ping VLAN 100, but 100 can't ping 30. VLAN 30 Laptop[10.0.30.2] can ping 10.0.100.200, and 10.0.100.1, and 10.0.30.1VLAN 100 Laptop[10.0.100.200] can't ping 10.0.30.2, but can ping 10.0.100.1 and 10.0.30.1FG and Laptops are connected to 8 ports switch. FG is trunk port. Laptops are VLAN Access Ports 30 and 100 respectively.0 bytes go across 100 -> 30 rule, unless I do Policy Match, then its the 40bytes FG tests withI am going to re-start the FG after posting this...just in the event something rules wise effect its. I have about 50 rules, and nothing worked as expected, so I cut down to 3 rules and smaller test setup. The other rules not included are 30 -> Wan (working fine) and Implicit Deny. Here are screen shots from the Firewall:Reset counts to ZeroBoth Laptops doing PING to each otherPolicy MatchPolicy Match ResultPolicy After Policy MatchVLAN settings

Can a fortigate act as the hub for multiple hub and spoke instances? Such as a Hub A for 5 spokes....and a hub B for 5 other spokes. Dont want the A and B spokes to see each other. I didnt want to run through a second hub wizard if I was going to break something. It appeared to setup a different routed network but the AS number was going to be the same. I guess the single fortigate cant run multiple instances of BGP?Would there be a way to do this and separate out the routing?

Hi, When remote user client system trying to access the internal application via Fortisase to SDWAN SPA, it is not showing actual ip of the client system. Instead of it shows the tunnel interface ip of the Fortisase.How can we get the actual client ip details on sdwan spa.Please guide. Regards,Ganesh

An endpoint previously had a vulnerability for an application flagged by FortiClient vulnerability scan.The application has since been uninstalled and the vulnerability is not being detected. However the application is still showing in the Software Inventory. It has been a number of weeks and I can confirm multiple vulnerability scans have since been ran as expected. This issue is occurring with multiple applications but for this application in particular I can see that a vulnerability is no longer detected. I cannot find any executables for the applications on the endpoint. Along side uninstall is there anything else to do to ensure an application is removed from the Software Inventory? If this is an issue is there a location I could provide the application name for further review? I'm curious if this is linked to Issue 73790 for 7.2.4 but just wanted to ensure I've covered all checks from my side. Thanks

DearsAppreciate your support to advise with expected action here for below scenario: I purchased standalone fortigate 100F without forticare or any license 1 year ago and still not registered till now and now I want to order UTP bundle license for itDuring activation of this new UTP license, would be effected by AutoStart policy and maybe license will be backdated? And if so , all UTP bundle will be effected or only forticare/warranty RMA part? 

Good morning,Every time our user goes to connect to the VPN to access the server, reaching 98% he disconnects or sometimes he connects and falls, only the second time it works. Is there anything I can check to see why this problem occurs?

Hello,we have SSL VPN enabled for our employees, based on policy destination.with that we're routing only certain services via VPN to for example whitelist our public IP for services and make a service reachable for employees.the rule contains an address group which contains several FQDNs.The problem we see here randomly is that the firewall resolves 2 IPs for an FQDN, which is fine and intended, but the routing table on client side only contains 1 sometimes."suddenly" (without reconnecting or similar) the 2nd IP also appears in the routing table, but why? So randomly its working or not working to get routed via VPN.As it is not working properly to route all needed traffic via our SSL VPN we added a 2nd rules directly below the main one.that new rule should route all “amazon aws” traffic via VPN - this was implemented for testing and troubleshooting.This rule does not get hit very often, assuming the routing table does not get populated with all routes, as routing all amazon-AWS traffi

I want to implement something like this, with the same public ip and diferent dns names to redirect to diferent ftp servers behind the fortiweb. Like http content routing but for ftp?any idea

HiHave followed this link to setup a S2S between a 60F (local location) and a Draytek Vigor (remote location)https://www.draytek.com/support/knowledge-base/5203 I have got the tunnel up successfully and can access resources to/from both locations. I want to make this 1 way now so only the local location can access resources at the remote location Is it isas  simple as only creating the local to remote Policy and not bothering with a remote to local policy? I have disabled the Remote to Local policy on the 60F after following that guide and that seems to have achieved what i want and stops communication from Remote to local whilst still allowing Local to Remote connectivity,  just checking this is all i need to do? Many Thanks Many Thanks

Good morning,We're receiving sporadic reports of users unable to launch FortiClient and being presented with the following error message. The guidance provided to the users was the following: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-fix-the-A-JavaScript-Error-Occurred-in-the/ta-p/230823  Verification the users have uninstalled Microsoft Visual C++, FortiClient, and reinstalled both is shown below.  However the user reports the Javascript issue is still ongoing. Can Fortinet support provide next steps for the users to try, please? Users are not FortiClient EMS users. FortiClient version 7.4 is being used. Initial error was with FortiClient version 7.0.2.

I was looking for a way to add the policy name to the blocked page. Currently the blocked page shows the policy UUID which isn't helpful since it can't be referenced in the GUI. Does anyone know what variable the policy name would be? the policy uuid variable %%POLICY_UUID%%. I tried %%POLICY%%, %%POLICY_NAME%%, and %%POLICYNAME%% but none worked.

hi hello allI need to replace a FGT200B v5.2.13,build762 (GA) with a FGT 400D v6.4.9 build1966 (GA) but I can't find the option to add "device"User and Device -> Device -> Device Definitionspresent on the FGT200Bis it a device or firmware version problem for the FTG400D?any suggestions about new hardware and firmware.thanks a lotMassimo

Hi All, I know how I can negate a session filter from CLI, but haven't found a way to do it in the gui. I don't like much the search box in gui isn't very intuitive/easy to use, but at least it does offer a nicer view of sessions ;) So anyone know how we could negate a session filter in GUI, as an example, I would like to list all session that aren't port 53 or all session aren't using the "HighPrio" Traffic Shaper.. Thanx for you help!

Hi all, I provide users with Fortinet Wifi and ISE captive portal. After users fill in the required information on the captive portal, ISE drops an e-mail them their credential. For checking their mailbox, the user needs limited access. In order to get this access, they need to exit the captive portal, by clicking 'Cancel' and 'Use Without Internet' at the top right. Then, they will be able to go to their e-mails and get user information with the limited access they receive. When they open a page and redirect to the captive portal, they will be able to log in with their information. I don't want users to have to click 'Cancel' and 'Use Without Internet' to get restricted access. My request is that when the user clicks on the ssid, IOS and Android should not direct them directly to the captive portal. If they open a tab, let them be redirected. However, they will have received the network IP and I will be able to give them restricted access. They will open a web page, and

Bom dia, Estou com duas redes separadas, faixa 192.168.1.0/24 e 10.1.0.0/24 ambas separadas fisicamente. faixa 192... navega normalmente, mas na faixa 10.1... entrega IP, DNS. mas não navega, toda rota está configurada para navegar normalmente. Alguém já pegou essa falha?.

Hello, I have restored an archive on cluster of 2 gates from the master gate, but now it's unable to connect (GUI, CLI, console ..) with anyone local account on them ..... This cluster is in production and all the traffic is ok  ;  On Fortimanager, members are ok and synchronized , the state (active-passive) is ok ; I can push new configuration from FM to Gates etc...   All to be seems ok but impossible to connect on gates ! I have tried to push a retrieve since FM but same result. Any idea please ??For information, the maintaner function is disabled.  Thanks

Hello everyone, I'm kind of curius at this point if there is any solution to this problem: I have a Fortigate 60f (v7.0.10) setup to handle my ipsec VPN connections. There are site to site and end to site tunnels configured and working. The Fortigate is directly connected to the internet with a public IPv Adress.One of the end to site VPN's is using the old Shrew Soft VPN Client and I want to switch to FortiClient. After a few frustrating failed tries to set up the tunnel I realized all the internet connections I tried used DS-Lite. When I connected my notebook with the FortiClient (v7.0.7.0345) installed over the SIM card it immediatly worked. I saw for SSL VPN there is an extra configuration implemented to accept sessions over DS-Lite https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/766455/dual-stack-ipv4-and-ipv6-support-for-ssl-vpn .Is there anything similar for ipsec VPN's or am I missing something? The config which worked with FortiClien

Hi All,  Customer is running non forti APs with a Wireless Controller located over an IPSec VPN from my Fortigate to their ASA.   AP's are losing their connection to the controller, and the customer is confident the Fortigate isn't sending on CAPWAP traffic.    I thought this might be an MTU issue, with ASA side set to 1500, Fortigate was set to 1420 so I've increased it to 1500 but issue is still ongoing,  Any ideas, or debugs I can run to help determine the cause?   Thanks,