Fortinet Community

I am working as an intern at a startup and the website I am handling https://www.gazfull.com/ is being flagged as malicious by FortiGuard and getting blocked.There is no intentional malicious content on the site. We want to fix the root cause instead of just requesting whitelisting.What are the common reasons FortiGuard flags a website as malicious?Are there specific security loopholes, misconfigurations, headers, SSL issues, third-party scripts, or deployment patterns that typically trigger this?Also, after resolving potential issues, what is the correct process for requesting reclassification/whitelisting with FortiGuard?Any guidance on debugging this systematically would be really helpful.

Hello COMMUNITY,I am facing some problems, I would really appreciate if you can assist me with that. I have installed fortigate on vmware on ubuntu and configured it per this document (https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/545125/ztna-agentless-web-based-application-access).I added the fortigate ip (172.169.173.132) as portal.ztna.com to /etc/hosts to resolve the DNS. The issue is that web portal is not accessible. when I wrote the address to the browser, it shows  with HTTP   This page isn’t workingportal.ztna.com didn’t send any data.ERR_EMPTY_RESPONSE with HTTPSThis site can’t be reachedportal.ztna.com unexpectedly closed the connection.Try:Checking the connection Checking the proxy and the firewallERR_CONNECTION_CLOSED-----------------------------------------------------------THIS IS MY CONFIGURATION FGVMEVYLSWRHYA98 # show firewall vip config firewall vip    edit "ZTNA-web-proxy"        set uuid 65006b6c-42f6-51f1-97c1-5c559a60d09e        set type

I have yet to find a working solution for what seems like a normal networking scenario. Here are the requirements:ports 1-5:  port1: access vlan 5 (untagged vlan 5) should share l3 gateway with any hosts connected to trunks  port2: access vlan 10 (untagged vlan 10) should share l3 gateway with any hosts connected to trunks  port3: access vlan 15 (untagged vlan 15) should share l3 gateway with any hosts connected to trunks  port4: trunk all vlans, native vlan 99. non-aggregate  port5: trunk all vlans, native vlan 99. non-aggregatel3 interfaces of some kind. cannot be under a physical interface because two trunks must carry vlans:  vlan5: 10.0.5.1/24  vlan10: 10.0.10.1/24  vlan15: 10.0.15.1/24  vlan99: 10.0.99.1/24 (native)I’ve read the documentation. I’ve asked open.ai several different times, I’ve had Claude read through multiple FortiOS version documentation. The documentation is not great in this area. So no great that claude cannot figure it out.I can make something like this work w

We are using a FortiGate-200G running FortiOS v7.6.6.We would like to know if there is a way to send alert email notifications when there is a sudden increase in the number of sessions, such as RDP sessions, passing through the FortiGate.If there is a method using FortiAnalyzer, please let us know.Alternatively, a solution using only the FortiGate would also be acceptable.

Go stdlib vulnerability detected in FortiTcs.exe (possible GO‑2026‑4865). Version Forticlient: 7.2.13.1287. Is there a fix that will release soon? Does the version 7.2.14 can fix this vulnerability? 

We have deployed fortianalyzer on VM & currently it is in production.We have given 500GB of disk space first & currently we need to add 500GB size additionally.Can anybody help me on how can we add the diskspace & what all needs to be done before proceeding with the addition. 

Hello everyone,I am planning a firmware upgrade for a FortiSandbox currently running 4.0.9. My target is 4.4.9.Since this is a jump across several versions, I'm looking for a validated Method of Procedure (MOP). Specifically: Upgrade Path: Based on the release notes, is a direct jump supported, or do I need to step through 4.2.x first? Cluster Impact (If applicable): If I'm in a Primary/Worker setup, should I expect significant downtime for the Rating Engine sync between these versions? Are there any known issues in the target versions that needed to consider? If anyone has a step-by-step checklist or "gotchas" for this specific path, I’d appreciate the help!

We are currently using two FortiGate-200G units in an HA configuration with the ha-direct feature enabled.After applying the following NetFlow configuration, we were unable to execute the set netflow-sampler command on the target interface.If there is any way to achieve this, we would greatly appreciate your advice.NetFlow Configurationconfig system netflow    config collectors        edit 1            set collector-ip "x.x.x.x"            set collector-port 9996        next    endendAttempted Command on the Target Interfacefw # config system interface fw (interface) # edit port1fw (port1) # set netflow-sampler bothcommand parse error before 'netflow-sampler'Command fail. Return code -61

Hi all,I built a captive portal at the fortiauthenticator and integrated it with MFA.The saml process works well when tested separately in a browser but when the user connect to the SSID it’s not getting redirected properly, an error pops up says “pretty print”.I have only basics in fortinet, can someone help ?fortiauth in Azure , EntraId in Azure, fortigate onprem.User(SSID)—-(AP)——-Fortigate ——-(IPsec)——Azure(Fortiauth+EntraID) 

​Hello everyone,I am facing an issue with an HA Active-Passive setup using two FortiGate 120G devices (Firmware:7.6.6).The Setup:HA Mode: Active-PassivePriority: FG1 (128) - intended Primary, FG2 (120) - intended Secondary.HA Override: enableMonitored Interfaces: ATC-LACP (802.3ad Aggregate interface connected to a core switch).The Problem: When I reboot the Primary unit (FG1), failover happens correctly, and FG2 takes over. However, when FG1 finishes booting up, it does NOT preempt back to the Primary role. Running get system ha status shows that FG1 is stuck as Secondary with the following warning: WARNING: FG120GTKXXXXXXXX has mondev down;The LACP interface on FG1 stays down. The only way to fix this and trigger preemption is to manually log into FG1 (which is currently the secondary) and flap the interface:Plaintext config system interface    edit "ATC-LACP"        set status down        set status up    nextendImmediately after this manual flap, the LACP comes up, the mondev down

I have a new Fortigate 60F that I am setting up. I upgraded the firmware to 7.2.1 and then used the web GUI to restore factory settings to give me a fresh base to work from. After the factory reset, I can see that the 60F is acting as a DHCP on the network, but I have been unable to ping it or access the web GUI to set it up. I don’t have a console cable and it may be difficult for me to get one as I am in a somewhat remote area. Does anyone have any thoughts on what could be causing this behaviour and/or how it could be resolved? Any assistance greatly appreciated.

Hi,When a non Forticlient MacOS user connects to IKEv2 IPSec they have issues with split tunnel DNS.DNS queries are only using the tunnel when using dig and implicitly querying a specific DNS server.This causes issues with other traffic.dig quanza-eun-ufg71.q @172.28.8.53 ~;; QUESTION SECTION:;quanza-eun-ufg71.q. IN A;; ANSWER SECTION:quanza-eun-ufg71.q. 86401 IN A 172.28.8.139;; SERVER: 172.28.8.53#53(172.28.8.53)With IPSec tunnelping quanza-eun-ufg71.qping: cannot resolve quanza-eun-ufg71.q: Unknown hostdig quanza-eun-ufg71.q;; QUESTION SECTION:;quanza-eun-ufg71.q. IN A;; SERVER: 172.20.10.1#53(172.20.10.1)I have checked the debug of the IPSec tunnel initiation and do not see an obvious difference.Both Forticlient and Non-Forticlient connections acquire the DNS servers in the mode-cfg.This issue does not occur with IKEv1 

Hello Fortinet Community,I have a question regarding FSSO and Active Directory user visibility in FortiGate logs.Currently, the customer has LDAP/FSSO configured, and user identification works correctly for a LAN segment directly connected to the FortiGate. In those logs, we can properly see the authenticated username along with source IP, destination, and bandwidth usage.However, there are additional user segments that are not directly connected to the firewall. These networks are learned through static/dynamic routing from other network devices. For traffic coming from those routed segments, the logs only show source/destination IPs and traffic usage, but no associated username.My main question is:Can FortiGate/FSSO associate users with IP addresses regardless of whether the network is directly connected or learned through routing protocols?From my understanding, FSSO performs User ↔ IP mapping based on authentication events from Active Directory, so theoretically it should not depen

The vpn is working but the users can’t access  the resources because the IP was change All the servers  only approved access from the Wan address of the Forti - it's white list The IP of the server - users have to get access to it  is 20.101.142.72 Anyone who connected to the VPN would receive their address, and because of that, all they had to do was put the VPN's IP in the WHITELIST and that's it. That's exactly how it works at ROCKET too. Can you help me to fix our problem?

The FortSwitch Ports view on the Fortigate shows just regular access ports where the Fortilink is. Running 7.2.12 and 7.6.4 on the switch.Talked to support and they had a look at the interfaces from the CLI and everything was as it should. This all changed after moving some VLANS around and might have caused a loop which got shut down by STP. IDK if it was related, but it happened right after.Has anyone else seen this happen? Apparently just a bug in the GUI?

Currently, we are using SSL inspection with the "certificate-inspection" profile and have Web Filter enabled.However, since the FortiGate certificate has not been manually imported into the client PCs, users see a certificate error screen when traffic is blocked.We would like to redirect users to a specific page instead of displaying the certificate error page, without importing the FortiGate certificate on the client PCs.If there is a way to achieve this, could you please advise?

Hi,I would like to ask if we can deploy SDWAN with one Internet line and MPLS?My topology:HUB and Spokes have one internet line and one MPLS. The MPLS connect directly between Hub and Spokes. The internet using for VPN between them.I dont want to config VPN via MPLS.Is it possible to deploy sdwan for both VPN and MPLS for steering or control traffic to Dc behind the HUB via both MPLS and VPN?Thank you

I have an explicit proxy test configuration with NTLM authentication;I have the groups configured in the proxy policy, but while I can authenticate on the computer, I can’t browse the web. In the debug log, it shows the error highlighted in the screenshot it’s unable to read the groups but I’ve already verified that communication between my user and the group configured in the proxy policy is working;I’m stuck; I don’t know how to fix this.FortiOS 7.4.11

I have installed FortiClient EMS version 7.4.4 (trial). I deployed this instance as a VM. I am trying to perform an automatic upgrade from the GUI to version 7.4.6. Unfortunately, it keeps showing an update error. In the logs, I see errors and warnings:Err:5 https://dl.winehq.org/wine-builds/ubuntu jammy InReleaseThe following signatures couldn't be verified because the public key is not available: NO_PUBKEY 76F1A20FF987672FWARNING: apt does not have a stable CLI interface. Use with caution in scripts.E: Conflicting values set for option Signed-By regarding source https://apt.postgresql.org/pub/repos/apt/ noble-pgdg: /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc != /usr/share/postgresql-common/pgdg/apt.postgresql.org.gpgE: The list of sources could not be read.Warning: The unit file, source configuration file or drop-ins of redis.service changed on disk. Run 'systemctl daemon-reload' to reload units.___________Please help me resolve this issue.

Hello everyone,I know that Fortinet previously removed the possibility to transfer FortiToken licenses from one FortiGate to another FortiGate.I would like to know if it is still possible to transfer FortiTokens from a FortiGate to FortiAuthenticator now. Has anyone done this recently ?Thanks in advance.BR,

Hi !  Hello everyone: Has anyone found such a situation? Is when the interface of FortiLink is generated, it can not do any firewall policy to other interface.cause FortiLink interface don't show in the firewall policy GUIDoes it mean that Fortigate does not allow any intranet data to communicate with the Fortilink interface, or is it just a bug? P.S. I have tried OS 5.4 , 5.6 , 6.0

hello allapologize in advance for my englishi'm trying to set up ltp2 vpn in my fortigate 60e 6.2, i followed this simple guide and windows connect successfully, i am assigned correct ip range and dns and i can access my internal stuff, but there's not connection to internet, even tho split tunnel is enabledi checked the policies and everything appear to be in order and i can see the user connected in fortigate ipsec monitorif i uncheck “Use default gateway on the remote network” on windows connection setting, navigation works normally but then i can't access internal stuff (what is the vpn even doing at this point?)everything works fine with regular ssl vpn connection with forticlientappreciate any help, thanks

Hi I try to configure firewall policy service select FTP_GET or FTP_PUTbut it doesn’t work

Can we set lease time for SSL VPN IP range? I don’t want same user use different IP if the user disconnect for short period.

I upgraded my FAC from 6.6.4 > 8.0.3 and something has broken EAP-TLS,Users have a cert on their devices, and a profile pushed out to the laptops, that says , connect automatically using the device cert to the SSID,  before it connects seamlessly, but now they get a prompt that says “continue connecting?” if you expect to find THIS-SSID in this location, go ahead and connect”  then asks you to show certificate details.  This didnt happen before the upgrade, I think so far its WINDOWS 10 users only, cannot see anything in the release notes either? help appreciated.