Fortinet Community

Hi All,            I just got my new fortigate 100F firewall and would like to use it as part of routing capabilities. I 'm trying a simple network setup such as physical port 1 is 192.168.1.1/24 , port 2 is 192.168.2.1/24 & port 3 is 192.168.3.1/24. I've a PC connected under port 1 branch with IP of 192.168.1.10 and Gtwy is pointing towards 192.168.1.1, the PC was able to ping and reach those firewall port 2 and port 3 IP addresses however they were NOT able to reach those devices under port 2 and port 3 for example such as 192.168.2.10 & 192.168.3.10.- I've allow all policy between src and destination between these ports.- Under network static router. I have added 192.168.1.x/24 route to gateway 192.168.2.1. Any 2 cents and suggestions on the issue will be very much appreciated.    

Hello Fortinet Community! I'm experimenting with a 40F Gate and was wondering if this is even a feasible idea.I'd like to create a Virtual Server with 3 x Public DNS Servers behind it (as an example). Then I'd like to set the System DNS to that of the Virtual Server. Then under my "internal" interface with DHCP enabled, I'd like to set the clients to use the "Same as Interface IP" which points to the gate. Is this a viable approach or am I over complicating it?

I am looking in the Image Folder for the Fortivoice 7.0.4 update and don't see the 100F listed. When I look at the release notes it shows under Supported platforms 100F listed and 100E has reached its end-of-order (EOO) date but only 100E in the Image Folder. Would the issues affect the 7.0.3 on the 100F?

Can someone explain the specific ways/differences in how the two Inspection Modes " Proxy-based" and " Flow-based" work in FortiOS v5.0.4 please? I had guessed that " Proxy-based" meant what we have clasically called " explicit proxy" , where the web browser would have to be configured to proxy to an IP address assigned to the FortiGate itself, and " Flow-based" meant what we have classically called " transparent proxy" . But I just did a test, switching the Web Filter Profile to Proxy based Inspection Mode, and without making any change in my web browser' s configuration, the FortiGuard Categories are properly applied. The FortiOS v5 handbook on page 774 gives a very brief treatment of Flow-based vs. Proxy-based, suggesting that flow-based is packet-by-packet, does no buffering, is faster; whereas proxy-based buffers up data objects which flow through the FortiGate, is slower, but could be more accurate. But I' ve been unable to find anything more detailed, and I' d prefe

Hello Team,  We have an alert generated about an malicious file 642226271.ico located from user machine. The File path says like C:\Program Files\Fortinet\FortiClient\SoftwareInventory\642226271.ico Need to know how this file got into the file path which has malicious reputation. User has not downloaded or tried to modify the file.

Unable to connect to fortiguard servers and unknown wan ipI'm getting these error on cliLimonPay-main # ssl_connect_fds[407]-Poll timeout[207] __ssl_data_ctx_free: Done[1115] ssl_free: Done[199] __ssl_cert_ctx_free: Done[1125] ssl_ctx_free: Doneupd_comm_connect_fds[478]-Failed SSL connectupd_comm_connect_fds[459]-Trying FDS 173.243.138.71:443tcp_connect_fds[235]-Binding to interface 22[116] __ssl_cert_ctx_load: Added cert /etc/cert/factory/root_Fortinet_Factory.cer, root ca Fortinet_CA, idx 0 (default)[116] __ssl_cert_ctx_load: Added cert /etc/cert/factory/root_Fortinet_Factory_Backup.cer, root ca Fortinet_CA_Backup, idx 1[497] ssl_ctx_use_builtin_store: Loaded Fortinet Trusted Certs[517] ssl_ctx_use_builtin_store: Enable CRL checking.[524] ssl_ctx_use_builtin_store: Enable OCSP Stapling.[835] ssl_ctx_create_new: SSL CTX is created[862] ssl_new: SSL object is created[191] ssl_add_ftgd_hostname_check: Add hostname checking 'update.fortiguard.net'...[929] ssl_set_hostname: Set hostname '

I have been slowly rolling out 7.2.9 to our 90G Fortigates, and I have noticed consistently that in our HA pair configurations the update will install on the secondary then fail on the primary and I have to reboot the primary then push the update again and it finally goes through. This has happened on 3 different pairs. Has anyone else seen this issue?

Is it possible to have more than one switch in the 'config target-port' section of the configuration or are you limited to one switch....? Also, I'm assuming you can only have one RSPAN or ERSPAN block of config... Sorry.... still new to Fortinet CLI after working in the other networking worlds equipment whom I would rather not even mention...         

we tried to install FortiClient EMS 7.2.4 on our Windows Server 2019 Standard. Actually we have installed FortiClient EMS Version 7.0.13. We have previously performed a Inplace Upgrade from Windows Server 2016 to Windows Server 2019.When we try to update as an Administrator, it goes back at some point and says "fatal error".We use Microsoft SQL Server 2017, the ODBC Driver 17 for SQL Server. and Microsoft Visual C++ 2015-2019. Microsoft Docs says that the ODBC Driver 17 for SQL is compatible with Windows Server 2019.Our FortiEMS-Server is not a member of a domain and does not have restricted access to the internet, which should block the installation.

When downgrading FortiGate from FortiOS version 7.4.x and above, down to version 7.2 or 7.0, an error may occur where the "Users & Devices" dashboard section shows the name "Assets & Identities", which is the section name on version 7.4.x   This can cause a malfunction where no information is shown. To correct this, download a backup config file and replace this portion: set name "Assets & Identities"set vdom "root"config widgetedit 1set type device-inventoryset width 2set height 1nextedit 2set type identitiesset x-pos 1set width 2set height 1nextedit 3set type firewall-userset x-pos 2set width 2set height 1nextedit 4set type quarantineset x-pos 3set width 2set height 1nextedit 5set type nac-vlansset x-pos 4set width 2set height 1nextendnext   By this: set name "Users & Devices"set vdom "root"config widgetedit 1set type device-inventoryset width 2set height 1set table-visualization "charts"set device-list-view-type "hardware_vendor"nextedit 2set type fort

deleted

Fortigate 7.2.9Forticlient 7.2.4.0972Forticlient EMS 7.2.4.983 I've gotten this to work using just the internal IP address over ZTNA for connecting to an RDP server.  I followed the steps to configure ZTNA for use with FQDN (ZTNA TCP forwarding access proxy with FQDN example | FortiGate / FortiOS 7.2.0 | Fortinet Document Library) When I do a name resolution for my RDP server, it resolves to the VIP 10.235.0.3, as expected. Yet when I try to connect, it fails. Is there a better document for using FQDN with ZTNA since the document is for 7.2.0 and my fortigate is 7.2.9? 

Hi.The staff member of a client of ours who has a 60E Fortigate with the latest 6.2 firmware, is trying to connect from his new home, which uses a Starlink connection. If we use the Starlink connection, we cannot connect at all to the Fortigate, but if we tether to a Mobile 4G connection or similar, it works fine, as does the same credentials from a Fibre connection.TIA for any insight into what might be happening.

I have a guest WIFI that uses the FAC Captive portal and its all set up as per the guides, Guest gets the captive portal popup, I can see he registers, gets put into the "GUEST" group on the FAC, and the Fortigate uses that group "remote server group" to authenticate, I authorise the user, but he cannot connect, The FAC logs show the error "Authentication failed: NAS cannot find user realm" the Realm is set to local! where the guest group is, so I'm a little confused on the error, any thoughts please?

Hi!I wish to implement OSCP Stapling for some (not all) firewall policies referencing a "firewall ssl-ssh-profile" with "inspect-all" set to "deep-inspection". KB 198293 comments on "vpn certificate setting", "vpn certificate ocsp-server" and notes "client traffic which requires OCSP validation is expected to have SSL deep inspection enabled on the firewall policy.", however, it does not document how to enable OSCP Stapling on granular basis (in other words, not universally). In "config firewall ssl-ssh-profile" I can see "revoked-server-cert" field, but this implies being subsequent to the result from OSCP responder - it does not enable/disable support for OSCP Stapling (requiring on-demand sending 'OCSP request' certificate's CA). So, how can OSCP Stapling feature be explicitly enabled for some firewall policies but not others? Thank you. 

Dear Everyone, I passed the "FCP - FortiGate 7.4 Administrator" exam on 14th August 2024. Today when I logged on to "Fortinet Training institute Portal" (https://training.fortinet.com/local/cert/my/) I don't see any certification badge on my Profile, Online scorecard says that you will get "Your Fortinet NSE Training Institute account will be updated within 5 business days and A digital exam badge will be issued for passing this exam"  It has been 7 days since I have passed the exam but still I don't see the any badge at above mentioned portal. Can someone please help me regarding this. Regards,Suhas Khade    

Hello world, Can you tell where can i download FSSO agent. I can' t find it in https://support.fortinet.com/Download/FirmwareImages.aspx. Thank you for your help Georges

Client have loaded a faulty configuration and have lost access (cannot login). We want to factory this unit.FGT 800D does not have a RESET button, only a NMI button. The below link does not work because we do not have any consolse access.https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-reset-a-FortiGate-with-the-default-factory/ta-p/196896Is there a way to factory reset the FGT 800D model as per below link?https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-To-Reset-To-Factory-Default-Configuration/ta-p/198660Appreciate Y'all. TIA :) 

I am looking for information about:https://www.cve.org/CVERecord?id=CVE-2024-28910https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28910 We have FortiClient 7.0.11.0569which runs under a Windows 2019 Datacenter server version 10.0.17763 number 17763 The version of MSOLEDBSQL 18.6.5.0, Microsoft OLEDB product, has been vulnerable since April. We need to upgrade to version 19.3.3.0. How can we get our EMS server back into compliance with the vulnerability rules? 

Hello ZTNA adminsI can access all my back-end server through ZTNA destination except the FGT WebUI.I guess there is a special config (if any) so it allows access to itself through ZTNA, right?Any idea?

New install of FortiEMS, I have turned on settings for Software Inventory in the relevant policies, but the inventory collect process never actually starts on my clients, no software is detected. How do I start to troubleshoot this? 

Hello, we are just starting to implement SD-WAN and I have a question on how to setup IPsec tunnels because I am sure I am overlooking something or making things more complicated than they are. If both sites have a Primary WAN and a Secondary WAN, do I have to create 4 tunnels and 8 policies to make all the possible combinations to keep the traffic flowing at all times without manual intervention or is there a better way to accomplish that? IPsec tunnel sourceIPsec tunnel destinationPrimary WANSecondary WANFortigate 1Fortigate 2WAN1 WAN2 Fortigate 1Fortigate 2WAN1BACKUP WANFortigate 1Fortigate 2BACKUP WANWAN2Fortigate 1Fortigate 2BACKUP WANBACKUP WANFortigate 2Fortigate 1WAN2WAN1Fortigate 2Fortigate 1BACKUP WANWAN1Fortigate 2Fortigate 1WAN2BACKUP WANFortigate 2Fortigate 1BACKUP WANBACKUP WAN

Greetings all,I'm having an issue which I get the sense will be a simple fix but I'm at a bit of a loss. I'm trying to add a certificate to iOS to use for connecting to a fortigate vpn. I have no trouble getting the certificate onto the iphone and forticlient detecting it, but its asking for a passphrase. I generated a certificate key pair via Easy-RSA and was able to upload them to the Fortigate without issue. The private key has a password so I was able to enter that into Fortigate without issue. But on the iphone, my understanding is its just the one file, and it needs to be the certificate, which does not have a password. But the app will not let it be used without a password, and leaving it blank returns incorrect passphrase.  What am I doing wrong? I'd appreciate any help. Thanks!

Hello,i set up a vlan with public ip adress. I want to set up dhcp server with clients wich receive adress on pool 10.1.0.0/24 with  private ip address (different than public ip address). I set a secondary ip address on Web UI with private ip adress.When i try to set it, Fortigate denies and displays dhcp pool adresses must belong to same subnet than public ip adress. I conclude than it doesn't consider secondary adress for dhcp allocation adresses. Am i right ? How can i achieve my configuration ?Clients are on same vlan than fortigate dhcp server. The interface is type Vlan with public ip adress. Best regards.

hello,My forticlient VPN suddently can't connect and i can see on the local traffic log the traffic is denied.Anyone know why?