Fortinet Community

Can we disable the hit count in the rule?

Hello Everyone, I've been having this issue with staff at my company being kicked off the VPN regularly, to the point they cannot work effectively from home. I myself can work from home on the same VPN without issue and have done hours at a time. When I export the logs from an affected client it shows this: "sslvpn FortiSslvpn: 7664: Did not find interface for local_gwy 6721a8c0". If I quit their Forticlient and re open it using admin credentials, it will work fine for X amount of time, but it will soon hit the same issue. I have updated all their drivers, ensured all windows 11 updates are installed, the client is up to date, the VPN URL and port is correct. Yet it will still randomly disconnect then continue to disconnect through out the day without warning or reason. Has anyone faced a similar issue to this before?I appreciate any input that can be given, thank you very much! :)

FortiClient is disconnecting immediatly after clicking connect, debug shows SSL error: 2024-05-29 11:23:15 [308:PLATTLING:1263]allocSSLConn:310 sconn 0x7f47c7b8b000 (1:PLATTLING)2024-05-29 11:23:15 [308:PLATTLING:1263]SSL state:before SSL initialization (62.159.210.6)2024-05-29 11:23:15 [308:PLATTLING:1263]SSL state:fatal decode error (62.159.210.6)2024-05-29 11:23:15 [308:PLATTLING:1263]SSL state:error:(null)(62.159.210.6)2024-05-29 11:23:15 [308:PLATTLING:1263]SSL_accept failed, 1:unexpected eof while reading2024-05-29 11:23:15 [308:PLATTLING:1263]Destroy sconn 0x7f47c7b8b000, connSize=0. (PLATTLING)2024-05-29 11:23:15 [309:PLATTLING:1274]allocSSLConn:310 sconn 0x7f47c7b21000 (1:PLATTLING)2024-05-29 11:23:15 [309:PLATTLING:1274]SSL state:before SSL initialization (62.159.210.6)2024-05-29 11:23:15 [309:PLATTLING:1274]SSL state:fatal decode error (62.159.210.6)2024-05-29 11:23:15 [309:PLATTLING:1274]SSL state:error:(null)(62.159.210.6)2024-05-29 11:23:15 [309:PLATTLING:1274]SSL_ac

Hi Experts,can you help me,What method can I use for Fortigate devices to apply multiple rules? For instance, I want to block Instagram login and similar activities, while still allowing access to Reels and posts.

Good day all, having a weird issue, was hoping for suggestions as to where to look for the cause. Have a FortiGate-61E v7.2.8,build1639,240313. The WAN interface connected to the ISP switch drops every 10 minutes, almost as though scheduled, on the hour, 10, 20, 30, 40, and 50 minutes after the hour. It drops for about 20-30 seconds, then comes back up. I lose pings to that interface from the outside.  The ISP switch also has a Verizon router (different external IP). This connection does not drop.The Fortigate also has a connection to a Velocloud (which also connects to the ISP switch) for an SD-WAN connection. This connection does not drop.  The "get system interface physical [interface name]" command shows the interface never going down physically (and I never lose the remote webui connection, but that's using the SD-WAN route). We've rebooted the router, tried different DNS servers for the dns probe health check, tried to use pings for the health c

We want to extend our support licences for our fortiweb 400d device with a 24x7 FortiCare plus AV, FortiWeb Security Service and IP Reputation support licence. When we contacted our distributor he told us they could only extend it up to 2026-01-14 which we can see on our asset management site is the hardware lifecycle end of support date. But on the software lifecycle page we can see that the end of support for the software lifecycle is 2027-06-16.  So our question is when our hardware support ends do we also lose software support since we can only buy a 24x7 FortiCare plus AV, FortiWeb Security Service and IP Reputation support up to the hardware end of support date? Or does the software support continue without paying for it? Or is there a separate license that is just for software support?

Hello all.Our VPN is getting hammered with spoofed IP addresses and a brute force attack using some of our old (and a few current) company user names.  This is causing account lockouts for several users.  Our third party guys have put in some IP address blocks, but it's partially effective due to the spoofed IPs/user account combinations, which cause valid users to be blocked intermittently. We have geo blocking turned on and limited to countries we need to be able to access, but some of the spoofed IPs are within those parameters. There hopefully is a solution here at Fortinet somewhere, but throwing this out there in case one of you guys have seen this type of attack and found a good solution to shut it down.  We can't keep adding IP address blocks forever. Thanks!

Hello,Yesterday i facing issue where from client not able access to Azure MSSQL, then i found some information from Azure team that deploying MSSQL on azure have 2 kind of connections policy such is :Proxy : With this policy the client only need connect to one single port for MSSQL TCP/1433Redirect : With this policy, the connection need other port range from 110000 - 11999 beside TCP/1433The issue yesterday is on our Fortinet application control the MSSQL is already allowed but the client still not able to connect because the MSSQL using redirect mode which is need open port range from 11000-11999.On the log i also can see there is MSSQL is blocked and also I can see the port used is 11050.Here i want to know how application can knowing this port 11050 is belong to MSSQL? 

Hey everyone.I had a quick question about the following:SetupManagement - FMG 200GHUB - FG 201F HA pairSpokes - FG 40F HA pairsSDWAN overlay config is set to use ADVPN and spoke to spoke connectivity has been confirmed.Our customer is asking for reports related to performance SLAs between spokes.  I understand that performance SLAs generally point to the hub as configured by the FMG SDWAN overlay template.  I've read up on how the spokes build the shortcuts between themselves, but I haven't been able to find anything related to building a performance SLA between spokes.Is SDWAN with ADVPN able to do this or is this something that's easier seen in a custom report?  I've tried a few shots in the dark with configuring performance SLAs between spokes, but I've had no success so far.  I feel like having a standing SLA between spokes might mess with things and create a huge processing overhead for every device involved.I appreciate any insight or help and thanks in advanc

Hello, There is any solution to send a email with TCL Script or CLI ? I need to send information after script Schedule execution. Sorry for my English, I'm French. Thanks,Jimmy

Hello,Good morning! I am using FortiClient to connect to my clients. I am using version 7.4.0.1658:Serial:FCT8003717107945UID2:91110A75512C464DA96D06F1F00C54AD However, every time I connect, my CPU exceeds 90% and even after closing the connection and turning off FortiClient, the consumption remains above 90%. So to solve this, I need to restart the machine every time this happens. I am using Windows 11. Is there some kind of incompatibility? Is there a fix for this? Could you help me? The image below shows the processing after connecting to the VPN using Forticlient. And in the image below is the processing before connecting to the VPN using Forticlient:  Thank you!

Hi, I'm trying to configure an old FA100C with my FG30E. In the FG30E GUI I get the following error when adding the FA100C under the log settings: Error occurred: SSL error.  I don't know if the FA100C uses ssl or if it can be used with a newer FG30E?Regards, 

Hello everybody, I have a lab where we have some clients which i need them to reach a router thro the firewall so the main idea is to not use routing protocol or any default route i need to make the PC ( clients ) ping the router interface without routing what is the alternative of routing is there any solution ? many thanks in advance 

Hello team,   On Firewall FGT, When a user with administrative privileges is added\modified\removed on a Fortigate firewall is there a specific event that we find in the logs? Or is it something that needs to be manually enabled?   Thanks in advance BR

 Hi everybody.Is there a way to apply a policy traffic shape for a firewall polilcy?I tried with this article https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-apply-traffic-shaping-in-a-firewall-policy/ta-p/191943 but it didn't help :') Let me explain: I have a lot firewall policy where I have my users in level permisions with theier policy. But I want to limit the traffic in social media and streaming for those users that have permisions to Youtube and Facebook. Is there a way?

Hello,We use SSL VPN to allow user's specific access by AD-linked group. We have the case where a user belongs to 2 different AD groups which each correspond to a portal profile. A specific policy is created to manage access for each portal. What is the criterion that applies to define which policy will be used? in my case, the policy that should be used is before the other policy but it doesn't work. It is the 2nd which is applied. Fortigate version 7.2.7

Hi,It is possible to aggregate wan1 & wan2 (or SFP1 & SFP2) ports on fortigate 90G please ??I created two aggregate : - The first,  with port 1 & port2 --> ok- The second , ports wan1 or wan2 are not in interfaces list ...Thanks.  

Hi, I will be transferring my unit from one FortiCloud account to another.Will the existing licenses and existing configuration be retained once the device is transferred? Thank you! 

I have fortigate connected to 4 fortiswiches, and 10 forti AP'sHow can i get notifications if one of my AP's or switches are down as proactive searches on the fortigate notification email alert but could not find anything about the the switches, and AP's Note:i don't have fortianalyzer 

Dear community, I having troubles deploying a FortiADC in vmware environment. Some interfaces are not working at the start, and sometimes stop working sometime later.  If I check the interface status in CLI with command "diagnose hardware get deviceinfo nic-detail" it appears as connected:  Settings for port1: Supported ports: [ TP ] Supported link modes: 1000baseT/Full 10000baseT/Full Supported pause frame use: No Supports auto-negotiation: No Supported FEC modes: Not reported Advertised link modes: Not reported Advertised pause frame use: No Advertised auto-negotiation: No Advertised FEC modes: Not reported Speed: 10000Mb/s Duplex: Full Port: Twisted Pair PHYAD: 0 Transceiver: internal Auto-negotiation: off MDI-X: Unknown Supports Wake-on: uag Wake-on: d Link detected: yes  I can ping my own interface also, but not the gateway. The interfaces works again if I disable and enable from network configuration in vmware. Maybe someone had the sa

Hi ! After trying to find a solution by myself, and googling as much as I could, I can't really find help on how to proceed with our infrastructure. We have a FortiGate 601E serving as our main DNS, and we recently added 2 Windows Active Directory, that we would like to use also as a secondary DNS. So what we did in our FortiGate is to create a new zone for our domain, non Autoritative, with both DCs as the DNS Forwarders. Also adding A entries with the server names and IPs.Up to that, it worked fine for most Windows machine, with the Fortigate as the main (even only) DNS, they can join the domain and communicate without issues. Now we are trying to create a service on a Linux server, with an LDAP link to our DCs. And we have two points that we can't make work : - If a Linux server has only our Fortigate as DNS, it won't be able to resolve any of our DC domain DNS names. We can tinker it out and make it work by manually forcing a DC DNS inside the configuration

Hello everyone, I am deploying FortiMail-VM01, i registered the VM and license (ATP) in Fortinet's support portal and downloaded the file  I deployed the image on the hypervisor Hyper-V. On the CLI the Fortimail displayed the serial number as the name of the VM My problem, when i try to upload the license file on the GUI it says "Invalid license" and on the general information of the Fortimail the serial number displays "FEVM00UNLICENSED" Does anyone ever had this issue ? if so i'll be taking any advice to resolve this problem Kind regards,

Hello, I need an urgent supportI am doing ztna configuration and fortiems on prem,For off-net and on-net users, I created a record as fortiems.xxx.com for users in both local dns and global dns,I created fortiems.xxx.com for off-net users, the dns record is in the same subnet as the wan ip but it is not a direct wan ip, I need to announce this ip behind the wan interface to get telemetry data, but I do not know how to do this, I entered the wan interface as the second ip, but it did not seem like a correct configuration, I cannot see it in the arp table.Can you help me for this 

Hi, I installed a second VLAN, but no computers from the new VLAN can reach the internet or ping the interface of the Fortinet-Firewall.The new VLAN is in the same IP-Range, so it should be possible to ping it without routing. Is there anything, preventing the Fortinet to accept calls from the VLAN?