Fortinet Community

I have an issue when accessing url by ip address using https. Why does the firewall block web access and how do I solve it? all i can see in the log is: 

Directly on the fortigate firewall I would just right click a rule and select 'clear counters' but I can't figure out how to do it in fortimanager.  This is the only document I could find on it and it doesn't mention clearing the hit counter.  https://docs.fortinet.com/document/fortimanager/7.6.2/administration-guide/397218/policy-hit-count  Sort of a huge fail for FortiManger because I clear the hit counters on certain rules all the time.

WHY!!!! 

Hi Team, I am using FortiGate with Version 7.4.9. I have ISP connected to WAN interface and my clients on LAN interface. Currently I have configured Prefix Delegation for IPv6 to get the LAN addresses from ISP and it is working as supposed to be, with SLAAC addressing towards the client for the PD prefix.Now along with this, I want to configure a ULA as a secondary address in my LAN interface. How can i achieve this. I could not find any option in CLI. Please provide any insight on this or let me know if Am missing anything. Warm RegardsMidlaj

My office has an HA pair of 600E’s with a WAN link of 1.5Gbps and failover link of 1Gbps. We have 10Gb connections from the gates to the core switches.We have about 1,000-1,200 devices (including user personal devices) onsite and have 10-20 users connected via IPsec dialup and one S2S to AWS. IPsec tunnels using AES256 (CBC) currently and would like to switch to GCM once we get a unit that supports offloading it https://speedtest.vet/ .We use an average of 39% memory and the CPU rarely goes above 10%.I am trying to right-size our environment. I am looking at 400F’s and 200G’s to replace the 6 year old 600E’s.I’m hoping to get input on either the 400F or 200G (unless there are other models others would recommend). Hoping to get us cheaper units that aren’t overkill without reducing performance.Thanks

We have been getting a ton of phishing emails lately. They pass through the fortimail without issue, and they contain links (either direct in body or in pdf) to sites that try to harvest email and password. The websites they are linking to are usually hijacked and therefore usually categoriezed by fortigate as safe (business etc). Is there a way to prevent users from being able to submit their email in forms? I have tried messing around with dlp without success.

Hello, I have encountered strange issue on our FortiClient configuration. We have deployed FortiClient via EMS Cloud to 500+ stations and for some time everything runned smoothly but suddenly lot of stations started to disconnect with this error even tho the configuration on both sides remained unchanged. The VPN connection is re-established randomly. For the specific error - VpnParameterConfigError i did not find any community posts, I reviewed configuration on both sides as the error is pretty explanatory but did not find any misconfigurations. As this is currently production environment, i cannot really troubleshoot this issue and make lot of changes on the current VPN configuration at the moment and need to wait for a weekend. If anyone encountered this beforehand please shine some light on this issue. Thank you Below I attach screenshot from the FortiClient (its in Slovak as the customer has it set this way) Rougly translates to: Last r

Hi, We have a FortiExtender 511G that we want to connect to a private 5G solution. To connect to this private 5G service it is mandatory to set the modem to 5G only mode. I have not found this option in the GUI or CLI. I only found a post on this forum how to do this for the FortiExtender 511F ( https://community.fortinet.com/t5/FortiExtender/Technical-Tip-Switching-Carrier-Service-Mode-to-FortiExtender/ta-p/336389 ). However the used AT-commands are not recognized by the modem of the 511G.  The FortiExtender is in LAN extension mode and runs firmware v7.6.4 and the modem runs FEM_20_EM9291-24-01-01-NAM. So is it possible to set the 511G's modem to 5G only? And how do I do this?Thanks in advance.

Hi I want to allow access only to the following URL using a Static URL Filter, and block any subdomains. www.microsoft.com/security/encyclopedia/adlpackages.aspx  here is my setting, but it doesn't workstill can accesswww.microsoft.com www.microsoft.com/security      

Hi Team We have a FGT 1100E That had an issue of a process draining the RAM, it went into Conserve mode after trying to process an extremely large volume of traffic which effectively exhausted resources.Is there separation on the Control and Data plane on this platform(FGT 1100E) for the memory usage as I understand things: Session setup and teardown(State) is managed from the control plane that this process is a part of hence would be contributing to the problem where we see these large influx of traffic requiring session setup, but other products are not affected as packet forwarding is processed within the Data plane .  

Good morning, We have a FortiGate 50G installed at home. The device has been set by the company who sold it to us. The FortiGate is used over 2 routers from 2 different providers. We have asked the company to close all the ports as the use of internet here is domestic. When using nmap in order to check possible open ports, the results are:113/tcp  closed ident2000/tcp open   cisco-sccp5060/tcp open   sip I have used the WAN IP of the Forti as target. Maybe I am doing it wrongly... Here there is the Firewall Policy: The company told us that the ports are closed but here at home we are a little bit worried. Please, could you confirm that the policies are correct in order to close all the ports? If positive, how is it possible that nmap shows open ports (I have done the process 4 or 5 times)?  We are not professional here and our goal is to be completely protected only. Thank you very much. 

Hi everyone,I am troubleshooting a persistent IPsec VPN issue on a specific Windows 11 workstation and looking for pointers on local OS interferences.Environment:Gateway: FortiGate 70G (Firmware v7.4.9).Protocol: IPsec Dial-up (IKEv1, Aggressive Mode).Failing Client: Windows 11 (FortiClient latest).The Issue: Phase 1 negotiation times out with "No response from the peer". The issue is strictly isolated to this specific PC.Troubleshooting & Isolation: I have confirmed the FortiGate configuration and Phase 1/2 proposals are correct by successfully connecting with other devices:Success: Another Windows 11 PC running FortiClient v6.0.0 connects immediately.Success: A MacOS device running FortiClient v7.4 connects immediately.Steps Taken:Verified local Firewall/AV allows the connection (tested with them disabled).Verified no ISP blocking (same behavior on different networks).Since it works on other clients, I have ruled out the FortiGate configuration.Has anyone encountered specific Win

Hi, We are only enabling IPS on some firewall policies and I want to verify if SSL inspection is required for IPS to analyze encrypted traffic? Or is IPS capable of performing deep packet inspection without SSL inspection? I am a bit confused, because the below Fortinet link, mentions: "FortiGate IPS is even capable of performing deep packet inspection to scan encrypted payloads in order to detect and prevent threats from attackers."Also, that same link mentions: "Secure sockets layer (SSL) content scanning and inspection allows you to apply antivirus scanning, web filtering, and email filtering to encrypted traffic. You can apply SSL inspection profiles to firewall policies." - No mention for IPS.Reference Link: https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/565562/intrusion-prevention Whereas the best practice section for IPS in the NSE4 version 7.2 Security Guide (Page 410) mentions: "Certain vulnerabilities apply only to encrypted connections. In some o

Hello team,Anyone has an idea when implementing an IPSEC tunnel using ikev2 and eap for user authentication against radius or ldap. Does Fortigate terminate the eap messages, extracts the username and password the performs an access request to the radius server or bind to the leap?Or the eap messages are forwarded to the remote authentication server inside the radius (like 802.1x) or ldap messages m 

On Fortigate 90G faceplate shared ports wan1, wan2, sfp1, sfp2) shows grayed out.There physical connectivities on sfp1, sfp2 and it working fine. We are able to do the configuration  for those interfaces but the only concern is it shows grayed out on gui faceplate.Please guide..

I have a server running multiple services behind a modem that uses port forwarding to redirect ports on the public ip to an internal ip. So for example homeserver.ddns.net:8123 forwards through to 192.168.1.1:80. This works fine for all computers except the ones behind a fortigate device running FortiOS v7.0.12 (GA). The only relevant firewall rule on the fortigate is one say all traffic from the internal device to the external device should be allowed and NATed. The machines on the internal network can connect to any other ip or port on the internet just not the ones behind my modem, they just timeout. Although I do notice there's an option to preserve the source port that is currently disabled. Would that help or is there anywhere else that this type of traffic is being blocked?

Dear All, I have noticed during the Microsoft team call audio gets stuck for few seconds then again gets normal. checked at Firewall No packet loss even latency was normal during that time but what I have noticed too DDOS policy was blocking some UDP packets for inbound connection not outbound connection. Just let me know what has to be done from my side If more than 20 users are connected at the same time for Microsoft team call. how much threshold should I set  and what ports has to be allowed in DDOS policy . Also please share best solution, I had gone through below URL as well.https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-The-most-common-issues-with-FortiGate-and/ta-p/190635 Regards,Umesh   

Users are experiencing intermittent video freezing and robotic audio during VC sessions (Zoom/Teams/Webex). Despite having 3x 100 Mbps Dedicated Internet Leased Lines (ILL) and SD-WAN rules in place, the traffic does not seem to be optimally prioritized and is getting errors as "your video is paused due to network problem" Environment Details: FortiGate Model: FGT-400E Firmware Version: 7.4.9 Link Setup: 3x 100 Mbps ILL via SD-WAN. Current Config: Performance SLA is configured for Jitter/Loss.SD-WAN Rule "Lowest Cost SLA with load balancing" is set for VC applications. Traffic Shapers (High Priority) are applied to VC traffic 

Hello TeamIn our environment, we can see only root and other VDOMs. The Global VDOM/config is not visible, and all global user objects (LDAP/RADIUS/local users & groups) are missing, while VDOM configurations remain intact.Due to the loss of all super_admin users, we also cannot access the firewall using PAM.Has anyone encountered a case where the global configuration/VDOM is lost or not loaded, but other VDOMs are unaffected?FortiGate #for

Anybody else having issues with getting the 'free' ipsec client to work?I've been messing around with this for a couple of weeks and so far, with 5 different machines and 4 different clients - only 1 machine will connect.I've already engaged support but since this is the 'free' client - they have exhausted all that they can help with.I don't need all the 'add-on' stuff with the vpn, just need it to connect - stay stable and provide some basic routing (thru it).What happens is that i install, configure, connect - and it hangs.  nothing until the connection drops off a few minutes later. packet captures seem to indicate that 'all' the tcp packets aren't getting sent/received and therefor phase 1 never completed. 

I am getting vulnerability warnings from NIST, which indicate I need to be using version 7.4.4.x of FortiClient, but your website does not provide beyond version 7.4.3.1761 for the VPN only version. Please provide an update for the VPN only version. https://nvd.nist.gov/vuln/detail/CVE-2025-31365

Hi,Has anyone encountered when executing a command below to get this output?Model FSW 124F-FPOE most of them and managed via FortiLink. diagnose switch physical-ports summaryPortname Status Tpid Vlan Duplex Speed Flags Discard__________ ______ ____ ____ ______ _____ ____________ _________prt_switch_phyport_summary: unable to get port1(#1) statusprt_switch_phyport_summary: unable to get port2(#2) statusprt_switch_phyport_summary: unable to get port3(#3) statusprt_switch_phyport_summary: unable to get port4(#4) statusprt_switch_phyport_summary: unable to get port5(#5) statusprt_switch_phyport_summary: unable to get port6(#6) statusprt_switch_phyport_summary: unable to get port7(#7) statusprt_switch_phyport_summary: unable to get port8(#8) statusprt_switch_phyport_summary: unable to get port9(#9) statusprt_switch_phyport_summary: unable to get port10(#10) statusprt_switch_phyport_summary: unable to get port11(#11) statusprt_switch_phyport_summary: unable to get port12(#12) statusprt_

How to Configure Fortigate IPSEC VPN + Google Workspace SAML?

I have a fortiap 231g, which I purchased new and it is still on the 3 months Fremium license that comes with the device. now I want to extend the license to keep receiving firmware updates. I don't need other support options in Premium and Elite licenses. With this can I buy a Forticare Essential license or I have to buy Premium/Elite for the first year and then extend by Essential license later? I receive conflicting info from different sources, including my official Fortinet rep who says I must buy Fortinet Premium for the first year, then extend with Essential from the second year. Any idea what the truth is?

In FortiEDR, there are always quite number of disconnected (Expired) collectors, as there is no policy can help to do auto housekeeping, anyone can share wha