Fortinet Community

The security team picked up the below scan on the external firewall which the IP is the SSL vpn used by us.The ASV scans shows the web directory is accessible via this URL https://x.x.x.x/images/. when I tried to access it from a public network, it redirects me to SSL VPN web portal login page. https://x.x.x.x/remote/login?lang=en Previously article that I looked atSSL-VPN Connection Attempts - Fortinet Community We want this vulnerabilities to be removed regardless of locations, is there any way we can to disable this file directory/subfolder without impacting the SSL VPN? Appreciate your feedback. TIA :)  

rebooted my switch yesterday due to having to relocate it.  It is connected to another Fortinet POE, FG-80EPOE.  when it boots up it no longer provides power to my fortinet u431F AP's.  It previously worked in the same config just fine.    Now via the cli it shows POE errors on all ports: Fault 4 Error Type 17 (Port is yet undefined). at the interface level it shows similar:Power Fault: Error Type 17 (Port is yet undefined). I have followed all of the poe related post here including the poe debug, error 36,38, 4, and 17.  None of the recommended actions seem to work.  I have upgraded this switch to the latest FortiOS code as well 7.2.2. I have also done the poe reset, switch factory reset, still nothing.  Any suggestions?

Hello community, does anyone know if there's a way to differentiate devices connected to WiFi so that computers connect to one SSID and devices like phones and tablets connect to another in order to allocate more specific bandwidth?

Hi, community I wonder if it is possible to instruct NGFW to use a specific port in SD-WAN when a user wants to reach out specific website. I created a rule on SD-WAN Rules where all users that want to reach a specific website redirect that request to the specific port where one of the ISPs is connected. But, it doesn't work. The website request always has been redirected to our main ISP port is connected to. Thanks

Dear Team,I am not able to Ping my fortigate global IP from LAN and also not able to use IpSec VPN. Is there any solutions for this?

Hello FAC adminsAccording to your experience and/or knowledge,Among the two below FSSO methods, which one is the more efficient (and recommended) to configure on FortiAuthenticator?Is it AD polling mode or DC agent mode?I'm also asking this because I had not so good result with AD poling mode on FortiGate and I'd never use it in prod, so I wonder if it is better on FortiAuthenticator.

Hello Guys,We are adding firewalls to be managed by the FMG.we added all the branches firewalls to the FMG in the HQ, but weirdly the Branches firewall in the HQ which is the assembly point for our branches firewalls has a problem when we trying to add it to the FMG, although as I mentioned that all the firewalls that pass through it were added to the FMG.I Captured the traffic between them and found that the Firewall it self kill the session "sending Fin to the FMG"Find the two attached photos which shows the capture.172.130.201.2 is the FGT  10.130.139.100 is the FMGI tried to add source IP on the FortiGate config destined to FMG.the policies should allow all the ports between them.Any idea about that?

FOS 7.4.3I have a client trying to use passive mode for FTP. This mode uses many ports, not just port 20/21.Is there a Service on the Fortinet that allows FTP ALG? Currently we have this open to any ports TIA :) 

Located this, in the docs regardng FortiProxy."Application control uses IPS protocol decoders that can analyze network traffic to detect application traffic even if the traffic uses nonstandard ports or protocols."I am assuming that when I have an IPS sensor configured that specifies, for example, the SSH protocol, it does not care what port the traffic is using. But inspects the traffic to identify the SSH protocol.Is there somewhere in the docs this is noted, for more than FortiProxy?

Hi there, Guys I am trying to set up a firewall into a VRRP. Currently I have only configured one firewall and given a priority of 255. When I see the status of the firewall it says it is a backup. The priority is 255 so I assume is should be a master. Am i missing anything ? FortiGate-100F # get router info vrrpInterface: x2, primary IP address: 10.108.0.2UseVMAC: 1, SoftSW: 0, EmacVlan: 0 BrPortIdx: 0, PromiscCount: 0HA mode: primary (0:0:1) VRRP primary number: 0VRID: 1 verion: 2vrip: 10.108.0.1, priority: 255 (255,20), state: BACKUPadv_interval: 5, preempt: 1, ignore_dft: 0 start_time: 10primary_adv_interval: 500, accept: 1vrmac: 00:00:5e:00:01:01vrdst: 10.50.50.109vrgrp: 100 edit "x2"set vdom "root"set ip 10.108.0.2 255.255.255.248set allowaccess ping https sshset type physicalset mediatype srset alias "Uplink to Core Switch"set vrrp-virtual-mac enableconfig vrrpedit 1set vrgrp 100set vrip 10.108.0.1set priority 255set adv-interval 5set start-time 10set vrdst 10.50.

Hello, How can I change the color scheme of the interface of my FortiMail Cloud? Under Preferences, I only have the language selection option, nothing else. Thank you for your help!

Hey.I have a couple of 231F’sI use 5Ghz on my client network nearly everywhere but obviously any mesh would need to be ideally over 5Ghz and I’ve not heard great things (for obvious reasons) about broadcasting the mesh and client ssids on the same band..So - as per the title :beaming_face_with_smiling_eyes: any hacks to change radio 3 from dedicated monitor to a broadcasting AP which then could be used for mesh backhaul?=)

Hello All, We are working on a FortiGate upgrade for a customer and they have VDOMs configured on their current deployment. They are moving from a 1500D to 601F both running FortiOS 7.2.8. We have FortiConverter and have used the application to map all previous interfaces to new interfaces on the 601F. When attempting to restore the converted configuration onto the default configured 601Fs we receive the following errors in diagnose debug config-error-log read:>>> "config" "vdom" @ 12398:command parse error (error -61)>>> "config" "global" @ 12423:command parse error (error -61)>>> "config" "vdom" @ 23614:command parse error (error -61) These errors correspond to the places in the config where after multi-vdom mode is enabled, config vdom is used to initially create the vdoms, then config global is used to begin the global configurations as follows:config vdom edit rootnextedit vdom1nextedit vdom2nextend config globalconfig system globalet

Hello, does anyone have a guide to setup IPSEC tunnels to Azure while using SD-WAN?I had my tunnel to Azure working fine. Added a 2nd backup internet line and switched over to SD-WAN and now I can't get it to connect properly. I can get traffic from Azure to my site but not from my site to Azure.

Good day, I am trying to create a firewall policy on my FortiGate 7.* from the SSL-VPN interface to the LAN interface to block certain counties, I have set an Address group with the GEO locations but the source keeps saying "One User or Group is required", I have an Active Directory group set up to only allow users in this group to use the VPN can I add this? or will adding this group means these users and the GEO locations will be blocked?  

I made a configuration to receive an e-mail message when my link goes down, but I would like to know which link went down, I'm using event 20099, I tried to configure event 20090 but I don't receive an e-mail.Is there any way to receive the name of the dropped link or interface?

I am trying to migrate from FortiGate 400E version 6.4.6 to FortiGate 600F version 7.2.6, but when migrating the Access Points, I see that it appears as a 'VAP switch'. Does this option change when it updates?

On a brand new deployment, I would like to start deploying web filtering. When applying the custom filter to the outbound policy, this requires SSL Inspection. Whether "Certificate-Inspection" or "deep-inspection" require browsers to have at certificate installedAs a test, I have manually installed on my browser the default "Fortinet_CA_SSL"Is the installation of the Certificate really necessary?Would it be a best practice to push this certificate to everyone or shall I create a new one? We do not have a CA server

Hi  I have this scenario ,whereby some user`s are prompted to "sign-in to network "a number of times immediately they connect to the LAN. while others are not affected ,it works automatically without any user interaction.All The PC`s are windows 11 Laptop with the patch version 22H3.  I have checked all the pc`s have the same certificates and also have the option of "verify server identity under Protected EAP Properties".Any ideas on how i can solve this?

Just playing around with a FAP 231F.Latest firmware 7.2 connected to a FGT running 7.2.8Currently have Orbi 6 mesh as a WiFi network - running in bridge. FGT is default gateway to the network.When on WiFi through the Orbi, comfortably get 520Mbps download with 100 up. Matches what I’m paying from my ISP.. ish.Anyway. Taking the Orbi out and replacing with the FAP - wow.It will not breach 190Mb down at all. Running in bridge - again just directly replacing the port that the Orbi plumbs into.Any tips? I cannot believe it’s that bad. My client has signal strength of -40dbm. I’m pretty much next to it.Download tests are fully comparative. Same download server tested against. Same port, same cabling, same device tested from, same distance away for each test.Put simply, everything is equal.Happy to share my wtp profile if needed but it’s fairly left to defaults. Experimented turning radios on and off, keeping radio 3 with WIDS ap scan..Power and radio are not auto - set to 100%.Cannot work t

Version: 7.4.0.0.427 Need help finding where to disable when a user is disabled in AD the host(s) that is registered to said user has all of its adapters disabled. I'm not seeing Mappings to cause this action, hoping I can be pointed in the right direction. Thank you  

hello is there any way I can retrieve back user profile of super admin I accidentally change it to prof_admin thanks 

Dear Community, I am facing issue that when I create a policy from LAN to WAN and my all traffic is passing without issue, but when I want to block certain countries and IP from all the port like DMZ, LAN (inside to WAN) it's not blocking at all in the Any to WAN policy, I am confused about any to wan and Lan to wan that which policy gets  priority. FortiGate #policy #600e

We're going to be replacing our soon to be EOL 1048D pair, will config info be compatible with 1048E? I'm wondering if that's going to be a reasonable way (I still have more to research) to start looking at migrating to the new hardware. I'm not a network engineer so go easy on me please!

Hello everyone, We are using a Fortigate 120g. However, we can't open any website. Ping and DNS works on the client and on the fortigate and the packets are forwarded on the fortigate without dropping any packets. When we connect directly to the Fortigate 120g, we can access the Internet and open web pages without any delay. When we disconnect the Fortigate 120g and connect our old firewall, everything works fine right away. What we tried:Configuring port speed 1000Full on our Cisco CL9200 switch and on the Fortigate 120g.Do you have any idea how we can fix the problem? Thank you in advance! Best regards