Fortinet Community

In my FortiAnalyzer, scheduled reports are no longer being generated. However, if I manually click "Generate" on a specific report, it works fine. Additionally, there is plenty of space left in the /tmp folder, so I'm unable to identify the source of the problem.

I have 2 standalone FGT200E firewalls running 6.1.15, for the last month Qualys has failed the PCI ASV scan with a detected vulnerability QID150004 Predictable Resource Location Via Forced Browsing, its finding an /image/ fileRESULT:url: https://x.x.x.x/images/Payload: https://x.x.x.x/images/comment:Original URL is: https://x.x.x.x/matched: HTTP/1.1 200 OK I have SSL VPN in tunnel only mode, web mode disabled I came across an article https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-prevent-the-SSL-VPN-web-login-portal-from/ta-p/215905 to stop the web login page from appearing, which i applied to no effect. I also changed all the portals to not allow forticlient download in case this was causing the problem. Nothing has changed on Qualys that i know of & as mentioned scans were fine until the start of July.I've searched forums, google etc but not coming across any similar issues. 

Hi, We have configure new OU in Fortisase. After logged in into that OU we are unable to see the default certificate in certificate section.The same is showing properly in existing OU.Please find attached snap and guide... Regards,Ganesh

I am using fortinet firewall on AWS & also I have configured SSL vpn. I am facing an issue with the MAC user they are not able to use interenet after VPN. safari is working but google chrome is not working.  I have check in the wireshark as well traffic is not hitting from google chrome after VPN connectes but same worting in safari.I have unisatll forticlient & reinstall as well but nothing helps. Please help 

Spoiler (Highlight to read)  Is there a way to configure a VPN connection time limit for each user or a group of users?For example: user 1 is connected to VPN for 1 houruser 2 is connected to VPN for 2 hoursAfter 1 hour, user 1 disconnects and re-authenticates. After 2 hours, user 2 disconnects and re-authenticates.

Hello. In "Advanced Settings" -> "Syslog Servers" you can set an ip address so send SSO Agent logs via syslog to a syslog server.  Is there any option so select the message severity to send via syslog? At the moment the agent sending all debug and informational level logs to syslog server.   

Is there a way to configure FortiGate to not reflect the DHCP server IP when the end user (guest) opens command prompt on the client machine and perform an "ipconfig /all"? If there is no direct configuration, any other ways for us to hide the IP of DHCP server? Thank you!

Greetings. For certain reason, I couldn't connect to the VPN using Fedora 40 on my system, due to a research to find out what happened, for some reason, specific dependencies were not resolved when reinstalled forticlient with the latest version (7.4.0.1636) and testing on a VM, I found that some dependencies were not installed on my system and the rpm package didn't expected to resolve, so I took the list of dependencies using dnf repoquery that matches with forticlient, using dnf install $(cat <listDependencies.txt>), and got my issue solved. If someone else is dealing with that, here's the list of dependencies that I installed:Spoiler (Highlight to read)alsa-lib-0:1.2.12-1.fc40.x86_64at-spi2-atk-0:2.52.0-1.fc40.x86_64at-spi2-core-0:2.52.0-1.fc40.x86_64atk-0:2.52.0-1.fc40.x86_64bash-0:5.2.26-3.fc40.x86_64bzip2-libs-0:1.0.8-18.fc40.x86_64cairo-0:1.18.0-3.fc40.x86_64cups-libs-1:2.4.10-3.fc40.x86_64dbus-libs-1:1.14.10-3.fc40.x86_64dnf-utils-0:4.8.0-1.fc40.noarchexpat-0:2

we'll be replacing our old Aruba APs w/ FortiAPs, each site has a fortigate connected to fortiswitch, but beyond the Fortiswitch are cisco switches. quick question; can I connect a fortiAP to a poe Cisco switch? maybe same vlan config would work (ideally)? I know when FortiAP is connected directly to Fortiswitch everything works great.

Hello Team, This is the scenario:FGT firewall offering SSL VPN serviceIs there any way to do these things?1. Autoban IP same user wrong password 5 attempts over 10 minutes2. Autoban IP different user wrong password 10 attempt over 30 minutes Thanks for the supportBR

Hello, we need to secure an IIS which servs several subdomains and different applications on one server with FortiWeb.How can it be accomplished to have different protection rules for several URL paths on the same backend server? best regardsMartin

I am having a problem running an automation to backup my computer. I want to send the backup to a sftp server of a remote branch, connected to the fortigate equipment from which I make the backup, and it is as if it did not arrive. If I do a ping it arrives, but I have to specify the source. Does anyone have any idea how I can fix it?The traffic and routes are allowed on both sides. But when I launch the "execute backup" it doesn't arrive. When pinging I have to add the source option to allow the traffic. Packet Trace #7,2024/08/06 15:59:27,"vd-root:0 received a packet(proto=6, 181.14.198.42:6817->10.1.4.121:22) tun_id=0.0.0.0 from local. flag [S], seq 4203643946, ack 0, win 65535"Packet Trace #7,2024/08/06 15:59:27,"Find an existing session, id-060b7b91, original direction"Packet Trace #7,2024/08/06 15:59:27,"enter IPSec interface VPN_IPSec1, tun_id=0.0.0.0"Packet Trace #7,2024/08/06 15:59:27,output to IPSec tunnel VPN_IPSec1 vrf 0Packet Trace #7,2024/08/06 15:59:27,"No matchi

compañeros buenos días, soy nuevo en el Foro. Les comento que estamos integrando la VPN SSL con 2FA por medio de FSSO contra el directorio activo de AZURE, de momento todo conecta de manera correcta pero el cliente final me hace una consulta  quiere saber si hay alguna forma de bloquear el forticlient para que el usuario final no puede editar la configuración la VPN debido que si desmarcan la opción Habilite el inicio de sesión único (SSO) para el túnel VPN puede saltarse la doble autenticación, se que  quizás es mas de sistema operativo pero quisiera saber si alguno ha tenido la oportunidad de aplicar esto o alguna potra alternativa para que los usuarios no se salte el 2FA contra azure. quedo atento a sus comentarios

My policies are based on AD groups. I assume this screen is trying to authenticate me before I open a browser window but I can't make it load properly. I have the necessary certificates installed, if I try to browse a webpage I already get a username and password prompt and can authenticate and browse without problem. But this screen keeps popping up until I open a browser and authenticate. I have set the auth portal to my fw address, installed wildcard certificate that my fw uses and also the Fortigate's certificate for SSL check and I am not getting any SSL errors at all. What am I missing?  This is probably a silly rookie question, I am sorry. Any help is appreciated!

Hello everyone! I'm trying to trace packets from one client. I've done it in the past successfully using the following command:diagnose debug flow filter addr x.x.x.xdiagnose debug flow trace start xdiagnose debug enable However, it seems like I am unable to trace packets from a host located on a wifi vlan, from an SSID in tunnel mode. We have a fortigate 101F. Any idea how I can make it work? Is there another CLI command I can use to track packets from such host? I read something about hardware-accelerated packets not being captured by this command, but I don't really know how to see whether these are considered hardware accelerated packets or not. Wishing you a good day!

I am planning to enforce Antivirus filtering to Internet bound traffic on Fortigate running 7.2.4. I wonder how I can make exceptions for any potential false positives without turning off the filtering altogether?

In my FortiClient EMS Cloud all users are AD SAML Users.  All of our AD users should be assigned a VPN Policy.  However, some users were put in the Default Policy Group.  I have since gone through and added the missing AD groups yet the users still show up under the Default Policy.  What do I need to do to get the users to change Policy?  I picked on one user and had him Disconnect from EMS and then re-connect but that did not help.

How to change the date/time format in FortiMail? The current format does not match our national environment and is too long. I would like to use a custom date format in Custom Email Template when using variables.

Dear Concern, In the FortiClient application, I have defined 2 remote gateways, but the connection is not being established with the first one, only with the second one. This happens only when I manually replace the first remote gateway with the second one in FortiClient. It used to work with both, but now it suddenly stopped working with the first one for an unknown reason. When I try to connect to the first one, it stays at 0% and doesn't give any error. As soon as I set the second remote gateway as the first one, it connects immediately. Both WAN IPs are responding to ping. In the FortiGate Firewall VPN settings, both WAN interfaces are selected in the listen interface. So, how should I troubleshoot to find out what the issue is and how can I resolve it? Can anyone help me to resolve the issue

Hello Guys, Please somebody help us. We have changed the mgmt ip address on the Firewall Fortigate 400 and now its not reachable via https no more with new and old mgmt ip. And its not possible to restart it. Maybe somebody knows what to do. How to set up the mgmt access nowThank you in advance

greetings all, I'd like to know what does "IP connection error" exactly mean in FortiAnalyzer? we are a production factory and when there is some delay from the production line, I can see the log IP connection error displayed in fortianalyzer, and matches the production delay time. So it is quite critical that we know what does this exactly mean, so we have a direction to do troubleshooting.is this log entry a single packet? or it consists of a complete 3-way handshake of a TCP connection or even more? What could cause the kind of log occur?If the log detail is needed, please see the screenshot as below:

I asked this question: https://community.fortinet.com/t5/Support-Forum/Controlling-ZTNA-access-via-Active-Directory/m-p/330127#M247776 and got the answer I needed but I still have more questions around this. My setup is FortiGates in AWS controlling access to AWS resources.  99% of the resources are SSH to instances in different accounts and connecting to ALBs via HTTPs.  Right now I have VPN groups in ActiveDirectory which translate to VPN groups on the FortiGate.  Each group is assigned a VPN CIDR unique to each group.  On the AWS side I have Security Groups relating to the VPN CIDRs. Now when we move to ZTNA I will still need to give some users SSH access and HTTPs access depending on their groups.  The list of HTTPs addresses are changing all the time so the only way I could create an address book for users would be to use the FortiGate APi.  So for now I am going to skip that problem. Users who need to SSH to instances is a sm

Hi guys, I would like to know if it is possible to delete a fortimanager user via API, and if so, what is the body and parameters to be sent?

Hello Team, Is it possible to change the echo of VPN Authentication Failed error messages? Via FortiCLient and via Web portal SSL VPNThanks for the supportBR

Hi everyoneI have a problem when pushing configuration from Fortimanager to Fortinet firewallI used Fortimanager version v7.2.5-build1574 with evaluation license and pushed the sd-wan overlay template and it noticed the error but I do not see the error on the installation logI tried to upgrade the firmware on FMG from 7.0.3 to 7.2.5 and the Fortigate from 7.0.5 to 7.2.0 but it did not resolve the problem. I also tried to install each part of the sd-wan overlay template but it had the same problem. Do you have any idea how we can fix it?Please help me! Install log: Starting log (Run on device) Start installing Site-30 $ config vpn ipsec phase1-interface Site-30 (phase1-interface) $ edit "HUB1-VPN1" Site-30 (HUB1-VPN1) $ set interface "WAN1" Site-30 (HUB1-VPN1) $ set ike-version 2 Site-30 (HUB1-VPN1) $ set comments "VPN: HUB1-VPN1 [Created by IPSEC Template]" Site-30 (HUB1-VPN1) $ set peertype any Site-30 (HUB1-VPN1) $ set mode-cfg enable Site-30 (HUB1-VPN1) $ set localid "B