Fortinet Community

I notice that fortigate doesn't send certificate chain for vpnssl portal neither for authentication portal.I have try to reimport pfx certificate being safe that contain full chain.I have checked also other fortigate and none of them send the chain causing error on certificate validationChecked on FortiOS 6.2 and 7.2

I currently have 2 FortiSwitches I'm running in stand-alone mode. The switches are connected from port 24 to port 24. I ran the following commands:Config switch interfaceedit port 4FFTFXXXXXset native-vlan 10set allowed-vlans 1-4094set auto-discovery-fortilink disablenextendHowever, when I go and show that interface it still has the native vlan of 4094 listed. Any other port I can change with no issues. I've researched and can't find a reason it's not allowing me to change the interfaces that are connecting the 2 switches.Any ideas or suggestions will be greatly appreciated.

Hi folks,I wonder if I interpret the following right. The "Domain" polyfill.io is listed at Fortiguardservices as "bad" since 26th of June 2024.   See: Threat Signal Report | FortiGuard Labs We recognized in our FGT, that we have logs about botnet-cc-connections exactly to this domain (polyfill.io). Our investigations show that our DC is trying to lookup the domain. When it tries it, the FGT redirects the request, which is good. My assumption now is, that our clients (or some of them) are trying to lookup polyfill.io, ask our Domaincontroller/DNS and the DC/DNS is forwarding the request to the provider-dns. Then the FGT blocks it. As polyfill.io was not "bad" before 26th of june and a lot of websites use the services of polyfill.io i further assume, that our clients are simply surfing to websites, which use this "tool" (polyfill) and then we got the botnetwarning. We have not found any indication of a infection at our internal computers till now.

I'm having issues with FortiClient (7.0.3.0193) on Windows 10 Enterprise (19044.1645) inside a virtual machine (VM-ware)Installation of the Forticlient worked without issues.Configuration of VPN is OK (identical config works on host).Connection gets established according to Forticlient.Once connected, every communication through the VPN (ping,...) crashes Windows with a blue screen.Stop code: KMODE EXCEPTION NOT HANDLEDWhat failed: ndis.sysOn the host computer everything works without blue screen... Any idea how to solve this?

Hello everyone,We have recently started using a FortiManager VM (v7.4.3-build2487 240514 (GA)). We use it to manage a Fortigate 400F and of course also create our policies with it. Now to my problem: I have not been able to change the view mode for a few days and am now stuck in ‘By Sequence’ mode, the button for this has disappeared. According to a Fortinet article, the reason for this is that there are two interfaces in From or To - but I have checked each of the rules and there is only 1 interface in From and To in each rule. Do you have any idea how I could correct this? Kind regards Marc

Is anyone here having a successful configuration of playbook based on the components I have? In my lab I have FAZ VM with Security Automation, FG and FortiEMS. if any could share their working config it is highly appreciated.  

Howdy, We have a FW policy where web-based email is being blocked. I wanted to allow just Gmail through so I created fw addresses used by gmail, added them to a FW Address Group. I then created a fw policy from internal to wan1 with the destination address the group I created. I placed this policy above our fw policy that blocks web-based email through categories, however Gmail is still being blocked. The block page says: URL: mail.google.com/mail CAtegory: Web-Based email Any ideas? FG50B v3 MR7 P9 Thanks!

I want this particular ip range to be added into static route via vpn tunnel. How do I do this? 

I am trying to configure an Captive Portal employee SSID on a Fortigate 60F that would allow users to sign-in with their Google Workspace email address to sign them in. Is it possible? Any help would be appreciated. We don't have FortiAuthenticator so option will not work for us. FortiGate FortiManager 

Hi thereMacOS Sonoma 14.5FortiClient 7.4.0.1645 I am using prediminantly mobile IPsec VPN connections, and I noticed that when the underlying network changes, the network connections are not working properly anymore. Especially when on the move (using mobile 5G connections from my phone), or changing WiFi connections, it breaks routing or connectivity. A simple disconnect and reconnect of the respective IPsec and WiFi connection doesn't help, and I need to reboot the Macbook to get a proper connection back, and access all sites or devices, irrespective of whether these are behind the VPN connection or not. Anyone has had a similar experience? Cheers,Jaap

Merhaba, birkaç günlüğüne uzaktaydım ve eve geldiğimde LG olan akıllı televizyonumun 360 gözlü bebek kamerası olarak yeniden adlandırıldığını ve dizüstü bilgisayarımın adının bitcoin minör falan olduğunu gördüm. Ev Wi-Fi'ma bağlı bazı cihazlarımın takma adları nasıl değişti? Bilgisayar korsanlığı konusunda endişelenmem gerekiyor mu?Hello, I am connecting to a customer's server with FortiClient VPN Only(Free). However, the connection drops every 8 hours. Auto connect and always up buttons are also disabled. How can I solve this? Is there a method without the FortiClient app? With a different VPN client or RRAS?

I followed the tech tip from: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Setting-up-a-VIP-load-balance-with-HTTP-host-check/ta-p/198274Now I have the question about the following situation:I have one wan ip adress and the situation that i want different IPS/WAF profiles to the different http-hosts.Is it possible and how? I tried creating a new virtual server with the same pub ip and other real hosts with different http headers but it didnt work. If i had fw rule 1 "wan-2-owncloud" where i had applied VServer-Owncloud with real ip 192.168.1.1 and port 443 and a 2nd fw rule "wan-2-wordpress" with realip 192.168.1.2 and port 443 then either owncloud was unreachable or wordpress was unreachable. What do I do if i want to apply IPS+WAF+FullDPI to wordpress and to owncloud just IPS+FullDPI?

Hi Everyone, I have installed EMS agent in Macbook but its not syncing up with EMS server so I'm trying to uninstall it but it is not happening so please suggest some steps to sync agent with EMS server & how to uninstall it from MacOS. Regards,Hariharan 

Hello, I have connected a Fortigate 70F and Fortiswitch 180F together through fortlink and the switch is authorised+online. When I navigate to Fortiswitch ports there is no way for me to edit the ports, why could this be?

Hi, We got a problem with one of the suppliers having a Fortinet FW regularly blocking our traffic because it is tagged as using QQ application, with specific blocking rule being the QQ_Sign.In We have no QQ IM appliaction on our end, we send only SMPP traffic towards the supplier and nothing else. We can't find the exact reason why the rule is triggered, can someone please share some more information on what is that specific rule looking for when filtering the traffic? Is it possible that the rule is triggered for specific SMS messages originating from Tencent?

Hi,today I have been upgrade my fortigate 601E to FortiOS version 6.4.5. I want to run command #exe ping-options source but after I check on CLI fortigate I can't perform that command. Could you give me information regarding this case ? Thanks.  

Hello all, I am running Forticlient 7.2.2.0753 on RHEL 8. I have successfully installed it using the RPM but when I try to create a new profile, I get the error below. I have installed it as root (which is required) and am running this command as a different user as root is not allowed. This seems to be a permission error but there is no information to see where it is trying to write to, and my user has full access to its home directory. Does anyone know what might be wrong? $ /opt/forticlient/fortivpn edit "CLI VPN"Failed to set up FortiClient directories. 

Hi everyone,  Apart from firmware updates, are licenses and subscriptions required only for signature updates or to be able to use the features themselves (e.g. Antivirus, DNS, SSL inspection) in a Fortigate?

I have two machines that when the firewall is enabled with Domain it disconnects Fortinet Single Sing On Agent Configuration, if I disable the Domain Network firewall it works perfectly. This machine has the same rules as all the other machines. Has anyone experienced this? 

Hi, i'm configuring a new interface on a Fortigate cluster running 6.4.11 using Fortimanager.Part of the process is i need to map to a normalized interface.  I can create a new normalized interface, but the mapped device does not show me the needed mapped interface name (it does show me a bunch of other ones).  It's unclear to me where this needs to be created.  When hovering over the entries it looks like this is a vlan object.  The object needs to be created somewhere else but the question is where?  Or is a policy and device settings push needed before?  Thx!

Hello, I have been looking for information on the subscription prices for the Fortigate remote access feature, but I couldn't find much detail. Could you please provide me with the pricing for the licenses? Specifically, I need the remote access feature to manage my distant firewalls. Which subscription would you recommend me? Thank you in advance.

greetings,Previously we used ping to a single www server from public Internet as the SLA detect method, and some day ISP stops the ICMP to that www server, so SD-WAN rule brought down the member interface.Now we'd like to use DNS as the active probe method since there are robust public DNS service provider for public Internet.So, my question is, what is the SLA Target if using DNS? from the screenshot below, it looks the same as measurement to Ping. Isn't it supposed to measure the response time for a DNS query? Should SLA Target be enabled?Thanks for your any advice！

Hi folks, I'm confused about maximum values supported for Phase2 tunnels by fortigate 300E. (VPN concentrator, mostly dial-up IPsec VPNs) Datasheet said: Client-to-Gateway IPsec VPN Tunnels:50,000, but even TAC don't explain if is related to phase1 or phase2. In my understanding is about total.There are any another way to find out this information?

Hi, One of our laptop keeps connecting on 2.4ghz.We have set 5ghz as preferred band but still it is connecting to that band only.Laptop model - Thinpad E14Wfi adapter - Realtek 8822CELast driver update - 01-Apr-2024.AP - 431F v7.4.3 Regards,Ganesh

Dears, I have two sites1- Main site: 2 HA FG firewall.2- DR site: 2 HA FG firewall. How can I apply a cluster between two different sites to sync configuration?