Fortinet Community

Im currently on FortiOS 7.2.8. Traffics are being dropped by FortiGate when asic-offload is enabled. To work this out, we are currently set the asic-offload to disable but this is not a long term solution. Is this a bug on 7.2.8? https://docs.fortinet.com/document/fortigate/7.2.8/fortios-release-notes/236526/known-issues Does this issue will be resolved in what FortiOS? 7.4.x or 7.2.x ? Appreciate your feedback. TIA :) 

greetings,we'd like to access Internet, say, google.com with ssl vpn establised to Fortigate, but we got the error like below.but the user without ssl vpn connection has no such problem.ssl vpn connection is used for laptops from another country.the connection path is:laptop connected with fortigate via ssl vpn, split-tunneling is disabled.an SD-WAN rule is configured on fortigate for Internet bound traffic. 1. ssl vpn portal:fw-01 $ show vpn ssl web portal "test_townhall"config vpn ssl web portaledit "test_townhall"set tunnel-mode enableset forticlient-download disableset ip-pools "sslvpn_test_townhall"set split-tunneling disablenextend 2. ssl vpn settings:fw-01 $ show vpn ssl settingsconfig vpn ssl settingsset ssl-client-renegotiation enableset servercert "sevpn.companydomain.com"set auth-timeout 36000set login-block-time 120set login-timeout 60set tunnel-ip-pools "SSL-VPN-sitename-10.77.252.0/22" "sslvpn_test_townhall" !!we are using "sslvpn_test_townhall" as the address p

Hi, how do I configure Automation Stitch for the Forti extender if it loses connectivity with FortiGate? What is the correct event in the FortiOS event log?

Hello team!!! We have 2 Fortigates 100F in HA, we have connected the management VLAN (VLAN 30) on "Mgmt" interface on both Fortigates (VLAN 30 is untagged on ports where Mgmt interfaces are connected) and configured HA to use Mgmt interface as "Out of band", with dedicated IP for both Fortigates (A boss wanted to configure this as out of band)Now, we have many other devices on the management VLAN.We cannot access to any device on the management VLAN, from a computer in another VLAN, but we need to this to be possible.  Also, we need to access Fortigates from another VLAN.I think I can add routes in FGTs, because the mgmt network segment is not on the routing table, but this seems dirty to me.  It sounds like "out of band" doesn't make sense in that case.I think I can add VMs in the management VLAN for this purpose, but I am adding steps to access to Fortigates and switches Which is the common scenario for management VLAN?All people who needs to access any device in

Hello FortiClient admins I have two Ubuntu clients with FortiClient 7.4.0 installed.Both are registered.The first hosts can access apps through ZTNA destination, while the second shows the following error: "No ZTNA client certificate was provided" Following a quick search I found that the first node has a client certificate "/opt/forticlient/ems_cert.crt", while the second doesn't. "Probably" the certificate was removed due to a previous uninstall with purge.Tried to unregister the endpoint an re-register it again but didn't help.Any idea on how I can reinstall the client certificate on the host?

Hi to everyone, We are trying to manually restore configuration file from 100E to 100F.  Any idea how to do it?  We can't afford the license to buy forti converter.  Any help is appreciated. Thanks

Hello, Is there a way to disable the Forticlient VPN when the computers are connecting from inside the company network? I've seen some posts mentioning Local-in policies but I've had no success. We have a FortiGate 60F.What I've done is create a policy with source address the internal network and destination the VPN IP, and set it to DENY, but it doesn't seem right. Also is this something only done through CLI, or can it be implemented with Policies through the GUI? 

Dear all, i want to set up dhcp server on dedicated vlan for my clients on fortigate.Basically, i want to import list of mac address which will receive an ip from dhcp range (not reserved). On web UI, i did not see any menu which allows me to do that. How can i achieve it ? Best regards.

 Hi Fortinet Community, I would like to explain our scenario and seek your advice on an issue we're encountering.In our environment, we have configured two Domain Controllers (DCs). Each DC has a separate FSSO-DC Agent and a separate FSSO-Collector Agent. In total, we have two collector agents and two DC-agents across our two DCs. We are using the DC Agent Mode, where the DC agent sends logon information (Windows security logon events) to the collector agents. The issue we're facing occurs when a user (e.g., 'abdul.rehman@example.com') logs into a Windows machine. The user is successfully authenticated by FSSO and gains access to resources according to the Firewall Policies. At this point, we can see in the FortiGate FSSO Users Dashboard that the user 'abdul.rehman@example.com' is listed with the assigned IP address (e.g., '192.168.100.100'). The problem arises when the user attempts to access one of our internal systems (a server or another PC) using the RDP protoc

Hello FortiClient adminsFortiClient 7.4.0.I testes FCT's ZTNA proxy on Windows 10, Mint 21.3 (Ubuntu) and Ubuntu 22.04.On Windows and Mint it works well: FCT proxies the queries (I can see it in tcpdump) and sends them to the remote FortiGate's public IP.However on Ubuntu 22.04 (same package that is installed on Mint) the queries never reaches the remote FortiGate. And I can see in tcpdump that the my queries are not proxied as expected, they are sent to the final destination private IP directly.Any idea?

Dear Forti Support,it has happened today again (twice in last two weeks), that our box stopped working without any obvious reason. Our box:FG-40Ffirmware v7.2.8 build1639In the log there are lines (in this order):stitch:Security Rating Notification is triggered.The system has activated session fail modeKernel enters memory conserve modeKernel enters extreme low memory mode.Both RAM and CPU got to >90%, network stopped working and we had to power it off & on again. Regards

Hi, I am running a captive portal for a hotel, using a Fortigate100D as a hub FortiAP 221B, and works very well, but I have a problem, the tiket generated, allowing the connection of multiple machines at the same time, and need is to allow the connection to one machine, with one tiket generated. I appreciate your attention, and I hope you can help me

HelloI have installed a Fortigate 60F firewall at a customer. When the customer uses FortiClient VPN they cannot access their Microsoft Dynamics Navision. If they use the Windows native VPN client, everything works as it should.So why not just use this all the time? This is because the firewall does not allow two simultaneous Windows native  VPN clients from the same IP address…I get this error (see the attached file, and bear with the fact that it's in Danish. I'm sure you can translate it).

Hi all, Setting up a pair of Fortiswitch 108F connected to Cisco Switch. Due to most of the switches are Cisco, so will need to deploy in rpvst. Configured the Fortiswitch interface that connected to Cisco Switch as "set rpvst-port enable" to match with Cisco rpvst.When the Cisco VLAN priority is higher priority (numerically lower), Fortiswitch will get an error "STP priorities inconsistent" and the port will enter discarding state.If Fortiswitch configuring same or higher priority, everything was working fine, both sides interfaces are Forwarding and learning the correct root bridge.Anyone face this issue before? Can advise for this?Many thanks in advance.

Hello, I Have added a computer group to be synced to the EMS server. However, no computers were found in that group on the EMS server. I observed that it syncs only with users, not computers.The only way that computers sync is by syncing the OU. But I need to test something on a pilot group.How can I resolve that? FortiClient Thanks,Alaa Elrayes

Hi, We are currently running FortiOS version 7.2.7 which is the recommended release for the FortiGate virtual appliance. However, we are running into multiple Conserve Mode issues, meaning that we see that the WAD process slowly starts creeping up to eventually reach converse mode. With an automation stitch we can kill the WAD process on time but this does cause a small interruption for our customers. Looking into the version 7.2.9 release notes I see that it seems that this is fully solved in that version hence that I would like to upgrade to this version. However, I see the recommended release is still version 7.2.7. Is there any sight on when the recommended release document will be updated to this version?After quite a few issues we've had with other versions we don't want to run any version that isn't the recommended version. Thanks in advance for any response :)

I want to block access external (Difference Location) users connect to the internal users via anydesk (Application) but I need to use anydesk among internal users in same location. How can I do this from fortigate firewall?

Hello,Some our user can't connect to the Azure SQL Server with error I try to disable my App Control and the user is able to access to Azure SQL.Here my App Control settingThen i try to disable 'Block applications detected on non-default ports' on the app control, enable this app control on the firewall policy and the user is able to access to Azure SQLSo anyone can help me to make more understand why the 'Block applications detected on non-default ports' should be disabled?

Hi— I use FortiClient with cellular data both directly on a Verizon iPhone and through ‘hotspot’ (on the phone) to connect an iPad and Windows laptop. As of about 2 weeks ago, I began receiving an Error: Invalid DNS Server message each time I try to connect any device through the cellular network. Any WiFi network works without issue and connection is no problem, however the cellular network can not connect. I used a colleagues Verizon phone with FortiClient and entered my credentials— no issue. I’ve contacted Verizon who says there’s nothing wrong with my line and to contact Apple or Fortinet for support. Uninstalling and reinstalling the app has not yielded any result. Anyone else experiencing? Any ideas or suggestions on how to resolve? Thanks!!

Hello I went through the documents here https://api2.panopta.com/v2/api-docs  I couldn't find any endpoint that could send/trigger a notification (alert timeline) Is it possible to do such a thing using API? In our use case, we want to run a test somewhere outside fortimonitor and if it fails, trigger an alert in fortimonitor Thanks

Hi everybody,Its possible to make that Fortimonitor execute a command on a Fortigate when detect a SD-WAN incident?Thank you for the time

Hello, the ssl vpn client, when DTLS is enabled, the VPN connection is lost when copying a SAMBA file from the client to the VPN.with DTLS off, the problem does not occur, but I need it to improve performance. I was able to reproduce the problem on two devices. Both devices have firmware 6.2.10.The problem already existed with 6.2.9 firmware. Devices: FGT 50E and 301E  Thanks! --FBK

Hello if we purchase a 5 pack of FortiToken Mobile license does this add-on to the 2 license you get by default? ( So we would have 7 total license?)  SKU = Mfg # FTM-ELIC-5FortiToken Mobile - license - 5 usersPlease confirm. 

In our internal LAN we have the DNS server set to be the same as the Interface IP of that subnet. This DNS server is set in recursive mode and exists only to translate some domain names to IP address for internal uses. I would like to have this same functionality over the SSL VPN for some of our remote users but am unsure how to go about setting it up. 

Hello, I've got a problem with my DKIM on associated domains. When people receive mail from us, for parent domain no problem, i've :dkim=pass (signature was verified) but for associated domains dkim can't be verify, i've :dkim=fail (signature did not verify) i've the same key on all my parent and associated domain, In Domain "DKIM signing for outgoing email" is enable, an in session "Enable DKIM signing for outgoing messages" is also enable. Could you tell me what is wrong in my settings ?  Thanks