Fortinet Community

d

Hello everyone, when trying to create a new FortiClient Installer in FortiClient EMS 7.4 it to only get the option to "create installer config file" or to "upload packaged installers". Shouldn't there be an option to select / create new installation files?

Hi All, My boss has asked to me is it possible to accessing proxy server via public IP or FQDN which published to public?The goals is he want to use proxy from internet while out of office.I have suggest to use PAC for another option but he asked for first option possibility. Can you guys help me for the solution like this is possible or do you have alternate solution to achieve the goals?FortiProxy FortiGate 

hi , can anyone please advise what is the default tcp handshake timeout value? I know the default session time out value is 3600 sec. thanks in advance!

I am setting up a Hub and Spoke ADVPN with BGP. The VPN tunnel itself work well. I can ping both way within the tunnel. However, a BGP routing cannot be not established unless I created a neighbor instead of a neighbor group in my Hub BGP settings. The Hub BGP settings even worked with a neighbor alone and without a neighbor group.Hub: FortiGate 60F FW: 7.2.8Spoke: FortiGate 40F FW: 7.2.8 Hub BGP (working):config router bgp    set as 65000    set ibgp-multipath enable    set additional-path enable    config neighbor        edit "10.0.61.4"            set soft-reconfiguration enable            set remote-as 65000            set route-reflector-client enable        next  &n

 In this video, we delve into the intricacies of device profiling rules within FortiNAC, showcasing how to effectively identify, classify, and manage devices on your network. Learn how to: Set up and configure profiling rules.Ensure accurate device classification.Enhance your network security with automated device management. Fortinac Demo IV: Device Profiling rules https://youtu.be/mKXSWd2kxJk

Buenas tardes.En mi ayuntameinto tenemos contratado un servivio Fortigate, y utilizamos forticlient para conectar con la VPN corporativa. El caso es que la ultima version del ejecutable  Forticlient VPN da problemas con algunos sistemas operativos windows, pues se queda intentando conectar y no hace nada, y quisiera poder acceder a otras versiones anteriores para probar aquellas que funcionen mejor con los usuarios que lo neceitan.Donde puedo obetenr esas versiones???

HelloHow can I find the general availability dates of the different FortiWeb HW models?E.g.: FWB 400F and others.

Hello Dears I am trying to add a route map on BGP out filter as below :network 1 : 100.68.0.10/32network 2 : 100.68.0.12/32network 3 : 100.65.0.144/28network 4 : 100.65.0.226/32it's allowing only /32 networks but the /28 network is not announcing to neighbor take in mind all 4 networks are static route redistributedand also I am trying to filter the out network to the neibhour but it is not working using route map and access-list Bests

helloI am trying to connect to the VPN but any user that I enter stays connected, I have already checked the users and they are functional, the network is free, it is not under any corporate domain, what can I do?the version that I installed is the one from the page, I am using Windows.  

We are wondering if there is a way to display the Comments for a rule on the Firewall Policy screen? 

Hello everyone, We installed Forticlient on multiple machines and I have recently been getting BSODs on some of them. They all points to Fortiproxy sending bad arguments/parameters to NETIO.sys. The machine here is using Windows 11 22H2, and the Forticlient version at the time was 7.0.11. Here's the stack from the minidump (happens in process Fortiproxy) : STACK_TEXT: Spoiler (Highlight to read)fffff904`caa2ea40 fffff807`7110992b       : ffff940e`d4ba0014 fffff800`7a70a000 ffff940e`00000002 ffff940e`f4dd0320     : NETIO!StreamProcessCallout+0x273fffff904`caa2eb70 fffff807`711089dd       : 00000000`00000014 ffff940e`f4dd0320 ffff940e`eb816d00 fffff904`caa2f220     : NETIO!ProcessCallout+0xa4bfffff904`caa2ecf0 fffff807`711076ee       : 00000000`00000000 fffff904`caa2ef20 00000000`00000001 00000000`00000000     : NETIO!ArbitrateAndEnforce+0x59dfffff90

Hey All, Is it possible to update the Internet Service Database manually, without TFTP'ing or FTP'ing the file onto the Fortigate?I have the file downloaded locally on my Win11 PC and have local access to the FW etc? Thanks, 

Hello everyone, I'm facing some security alerts in the software (here I would put the site's name) flagged on the website www.virus.total.com and would like to understand better how to distinguish between legitimate 'alerts' and 'false positives'.Could someone explain to me what criteria are used to determine if an alert is genuine or if it might be a false positive?Also, what are the best practices for handling these alerts without compromising the security of my system, and what are the direct channels for contacting for clarification, alert removal, or for engaging services related to this issue?Thank you for your help!

Hello,Can we use  Azure AD as source on firewall rule, and make the log by username also rather than using source IP?

Hello, I have 2 branches that have 3 links each (this due to the instability of the ISPs). In both branches I have the same 3 ISPs. 2 of these ISPs do not offer a public IP, but rather an IP from their LAN (CGNAT), I want to connect these branches via VPN through these ISPs, I talked to the carriers and there is no way they forward a port to my branches. I read in a similar question that this can be solved using a hub-to-spoke VPN, placing the hub in some cloud or site with a fixed IP and making my 2 branches spokes. is there a tutorial on how to do this? the services i want to comunicate are: voice, BD´s, and web internal servers

We have a FortiEMS 7.4 and we want to expose RPC ports through the ZTNA.For what I have read so far there is only possibility to define single port per ZTNA destination rule.The problem is that by specification RPC uses:-  TCP 135- Dynamic TCP range 49152-65535. How to make the dynamic range accessible through the ZTNA?On the FortiGate site it is OK, but on the client site when we try to create destination rule like:Server: 49152-65535The server is no longer resolved through ZTNA and no connection can be processed by it.

Hi everyone, I want to set a different time server than the one provided from Fortinet. I have run diagnose sys ntp status, and have found the synchronisation status set to "no". I have read this is a common issue and want to set a different time server for my Fortigate but I still get the synchronisation status error. The NTP server I want to use uses a hostname and has no static IP address. I have tried to use the guide posted in another thread but it has not worked for me so far (https://community.fortinet.com/t5/FortiGate/Technical-Tip-An-alternate-way-to-sync-the-NTP-server-to-avoid/ta-p/280309). Does anyone know how may I fix this issue? P. S. Why is synchronisation with Fortinet NTP server set to "no" despite time being accurate in the GUI? 

Hi due to CVE-2022-0778, I need to keep track on latest firmware release by try subscribe firmware release but it seem not working http://pub.kb.fortinet.com/rss/firmware.xmlhttps://pub.kb.fortinet.com/rss/firmware.xml anyone success subsribe 

Hello FortiGate/FortiProxy admins FortiOS 7.6.0 is now released, with many new interesting features.https://docs.fortinet.com/document/fortigate/7.6.0/fortios-release-notes/743723/new-features-or-enhancements I'm listing here some of them:974984FortiOS now preserves authentication sessions even after a Firewall reboot. This feature enhances the user experience by eliminating the need for re-authentication after a Firewall reboot. 877680Enhancement to IPsec GUI. The process of creating and editing IPsec tunnels is now more logical. The wizard supports setting the IKE version for both Hub and Spoke and Site-to-Site configurations, along with other transport-related fields for Site-to-Site tunnels. Additionally, security posture tags can be added to FortiClient Remote Access tunnels. These updates aim to make the process more intuitive and efficient. 1035775Improvements to device upgrade. This enhancement streamlines the upgrade process for all supported devices, inclu

Hello, we have two Fortigate devices in different cities. There is a connection between the two. We have a local website in city ‘X’. In city ‘Y’ there is a group that has an internet ban. How can I make the local website in city ‘X’ authorised for this group. I hope I was able to explain.

Hello,By default when I assign a FortiToken mobile license to a user they receive an activation email. The user only has 1 hour to activate the license before the license has to be reassigned. 1 hour isn't long enough... Is there a way to increase the account expiration time so the user has longer to activate it?

Hello Team, I'm configuring a profile with application-based split tunnel using this reference https://docs.fortinet.com/document/forticlient/7.2.0/ems-administration-guide/234887/configuring-a-profile-with-application-based-split-tunnel First, I applied the exclusion on MS Teams from cloud apps. I observed that MS Teams "web version" was excluded however the desktop version is not. So, I'm trying to exclude the desktop version using the path method. The desktop version is the new teams which has a path like "C:\Program Files\WindowsApps\MSTeams_24165.1414.2987.41_x64__8wekyb3d8bbwe". The problem is this path differ from version to version so it may differ from machine to another. I searched for a methods like the wildcard "C:\Program Files\WindowsApps\MSTeams_*" but this method seems to be not supported by Fortinet. How can I exclude this variable path ? Thanks,Alaa ElrayesFortiClient  

I don't want to keep spamming this forum, but at the moment I can't find the documentation to help me, is there a sensible course I could do to learn how to see what our Fortis are doing? Regardless.  I'm using the Built-in Threat Report to see if anything had happened and, clearly, yes it has.  However, it's not clear what it has happened to.  Specifically Intrusion 2, udp_flood, how do I match it up to the Victim IP and the Intrusion Source IP?   Is this the right report to be using, and how can I tune it to get better or more meaningful results?  I feel I'm asking silly questions that I could easily RTFM the answer. Cheers, Simon.

Hi all, new Fortigate user here.  Looking at our Fortianalyzer we have the error You have exceeded your daily logs GB/day licensing limit within the last 7 days. I've been through this forum and done some Google-Fu, so far so normal.  However, and I only saw this just now, the dates are totally wrong. This is where Google-Fu fails me and I call upon the experts to assist.  Any ideas? Cheers, Simon.