Solved

Hi, Because of "Troubleshooting Tip: Web pages not loading or taking too long to load when a web filter is applied"I changed my HTTP, AND HTTPS Policy's to proxy mode. The websites load fine, but if I turned on the Antivirus scannig, it takes an extremly extremly long time to download files (I really didn't have time to wait for the end). I would like to download a 50 MB ZIP file. I can download it without antivirus scanning in about 1 minute (or in flow mode), but if I turn on the antivirus scanning (in proxy mode) I can't download it in an hour. What could be the problem?  (Fortigate 201F; ver.7.4.3) 

On CLI, when a user tries to assigne the option ‘peer id from dialup group’ in the dial-up IPsec tunnel: # config vpn ipsec phase1-interface(phase1-interface) # edit <phase1 name>(phase1 name) # set peertype dialup(phase1 name) #set usrgrp <usergroup name>Error: auth_user not a local usernode_check_object fail! for usrgrp <usergroup name> value parse error before 'test'Command fail. Return code -1 On GUI, an error '-1: Invalid length of value’ will be visible when a user tries to assign a user group to the option ‘'peer id from dialup group’'. Solution: A user group can only be assigned/used in option ‘peer id from dialup group’ if every user in that group is locally created or the user group will have a Group type of ‘Firewall’. My Problem is that the user group RADIUS I use is from the group type Firewall, and it doesn't work. The user group RADIUS has a remote group being a RADIUS-Server. Is there no way to authenticate with the F

helloI have FortiGate 100F before 8 months when I buy this device I get contract registration code from supplier now I need this number can I find this Number from FortiGate GUI or CLI Thanks

Hi, I am trying to create policies based on AD-Users. So  I connected our FGT to our DC and was able to retrieve the users I would like to use in our policies. If I create a policy (LAN->WAN) -> Source: Username of the AD User ->> Destination WAN (all Services) the connection is not working. So I assume there is some component missing. As far as I understood, we will have to install the FSSO Agent on Windows AD and create a connection on our FGT to this SSO Agent, to authenticate our logged in PC-Users to the FGT  (=the FGT can check if the user is logged in correctly to AD). Is this correct, or should the above mentioned, also work without any Clientsoftware in AD-Environment? Thanks a lot!

Hello everyone. In our infrastructure, we have a Fortigate 100f. Situation: we are replacing our main switches. I have attached an image for you to see the changes. Basically, we want to remove core-1 and core-2 switches and will keep core-3 and core-4. Currently, everything has been migrated except for VLAN 1, where the firewall and the network communications of the switches are located. The only change I really see here is in MAC addresses since we are configuring the VRRP group in the new cores. That said, when we move VLAN 1 to cores 3 and 4 to finally shut down cores 1 and 2, everything works perfectly except for the services we have in the DMZ of our Fortigate. The question I have is, what could be changing if currently everything is working including the DMZ, and when we make the switch, everything works except the Fortigate's DMZ. Basically, the behavior of the Fortigate is that it sends the traffic, which it is currently correctly sending to the LAN, to another interface or to

Hello!I've only slightly modified Replacement Message "post_admin-disclaimer-text" but kept out-of-box system variables. However, as per screenshot, variable values aren't being substituted (or are empty valued)... Is this a fault, or am I'm doing it wrong?  FG200F-1 (global) # show system global | grep post-login-banner set post-login-banner enable FG200F-1 (global) # show system replacemsg admin post_admin-disclaimer-text config system replacemsg admin "post_admin-disclaimer-text" set buffer "Unauthorised Access Prohibited. %%LAST_SUCCESSFUL_LOGIN%%; %%LAST_FAILED_LOGIN%%" end     c:\Temp} ssh -l username FG200F-1 username@FG200F-1's password: Unauthorised Access Prohibited. ; (Press 'a' to accept): FG200F-1 # exit Connection to FG200F-1 closed.Also.. How to include line breaks?

Hi, I am currently looking for Security Pop IP address of Toronto - Canada. I cannot find the IP address, here is in the link.https://portal.prod.fortisase.com/api/v1/public/egress/ips I hope someone can help me to provide the IP address of the said Security Pop, thank you in advance.

current F 90D version is 6.0.9 build0335, this FW works as UTM, wan primary ip is private and secondary ip is the public routed throughout the private ip to reach internet, all filters to current public ip (set as secondary) are enabled to allow only from our network and if no allow rule is enabled by default all sessions to Fortigate Iitself should be dropped ( but some how icmp is still available from everywhere) . Following is debug output:2024-05-10 15:19:10 id=20085 trace_id=58 func=print_pkt_detail line=5455 msg="vd-root received a packet(proto=1, xxxPublicIcmpSourceIp:6164->xxxPublicWanIpxxx:2048) from wanvlanxxx. type=8, code=0, id=6164, seq=1."2024-05-10 15:19:10 id=20085 trace_id=58 func=init_ip_session_common line=5619 msg="allocate a new session-00767dad"2024-05-10 15:19:10 id=20085 trace_id=58 func=iprope_dnat_check line=4921 msg="in-[wanvlanxxx], out-[]"2024-05-10 15:19:10 id=20085 trace_id=58 func=iprope_dnat_tree_check line=812 msg="len=0"2024-05-10 15:19:10 id=

we are currently on FortiOS 7.2.7.is there any benefit to upgrading to 7.4.xx ?is there any vulnerability that is patched in 7.4.xx that is now in 7.2.7 ?

Hello Everyone,hope all is well! I am here as i am a little confused with the different types of the FSM database,i totally understand that there are different types of database such as:1- Event Database :- Store Security Events which comes from the data sources.2- CMDB3- SVN4- Profile I hope I can have more clarification about the three DBs (CMDB-SVN-Profile).#FortiSIEM

Assume I have 50 network device license and 1000 Extra EPS after forwarding 50 network device logs.Can this 1000 Extra EPS be utilised to install NXLog agent in windows PC and collect logs? I

We Use a software called Nagios for reporting and we have a custom made script that would search the following xml:https://support.fortinet.com/rss/firmware.xml It would look for anything with "FortiOS" and pull out the versions.the script would then loop through and check the version of the forti and compare it to the resultsif it was the same version, it would tell me its up to date, it it was lower than whats in the xml it would report an update, anyhting else would throw an error. Since going to 7.4.3 on our Fortis, This is no longer working as it is not equal to the latest version or below the latest version it throws the error.It is now throwing the error because according to the xml, there are only the following FortiOS: 7.0.157.2.86.0.18 Seeing as 7.4.3 is higher than any of these it  throws the error. Is this Feed going to be updated? was this updated recently to remove a version?is there somewhere else better to pull the latest versions out?&nbsp

HelloI use FortiGate 40F when I use default web filter and default DNS filter  after that when I open edge and make search nothing like no internet and more website not opening but if I disable web filter every thing fine why ? in web filter I allow all category allow but still same problem 

Hi, please does anyone knows if it is possible and how to create local (flash) Config Snapshots (like Cisco Archive - local config based on "wr" command or etc) in order to have safe points to be used when config push errors/mistakes? we have severals remote Sites connected over VPN where we need a fast recovery. I am looking something else additional to  "cfg save manual" that could work fine in some cases but I am looking for 3-5 safe points on the local flash. FortiGate  Tks 

Hello everyone, I want to be able to redirect traffic from external users to FortiMail for access to their mail server. External users are those within the domain declared on FortiMail.The server is published and external users must go through FortiMail to authenticate with the internal mail server on ports 587 and 993 before sending and retrieving emails.How can I ensure this configuration? Thank you in advance. 

HiI have a problem with vpn client and fortigate.The tunnel is up ping device is ok but when i ping fqdn host no response. Split tunnel is enabled. do you have an idea.Fortigate and VPN version 7.4.3 Thanks for your help

Hi FortiGate adminsIn my case I need a redundant dial-up VPN from branch office FG to HQ FG, where HQ FG has 2 WAN in a SD-WAN zone.A "classic" setup didn't work, I see the tunnels flapping from the first to the second and vice versa.When configuring one tunnel (A or B) it works well, but enabling the two seems problematic.Didn't troubleshoot deeper so far, so I don't know the root cause yet.Any advice would be appreciated?

Hi team, So i found a Fortimail 7.2 Lab/install Guide that basically instructs new users how to setup standard features for all modes, gtw, trans, serv. I am using the nstructions for the gtw mode - antispam, antivirus, policies, encryption etc, pretty standard, well developed lab guide.But still...... i think more can be explored and the admin guide just give definitions, not much real world setup to follow. Does anyone or rather, can anyone send a more robust template/settings for all features on fortimail to inspect smtp traffic, specifically the tabs - (policy, security, encryption, dlp), something robust. For e.g. banned words are VAST, other fortimail features are so daunting and almost endless. What, where or which is best? Asking for someone's .cfg with some nice gateway setup and just removing their internal IP details would not be cool lol, though a bit flexible and efficient.  Can anyone assist?

Hi i have kind of an unusual situation where i need to replace private asn to public asn but keep the asn prepend. I have 3 FortiGate firewalls, FG11. FG2, and FG3.I have a BGP between FG1 and FG2, and between FG1 and FG3.fg1 asn is set to 1111 (Public ASN example)fg2 asn is set to  64512 (Private ASN)fg3 asn is set to 3333 (Public ASN example)I have set as prepend on FG2 so now the advertisements include ASN 64512 64512 64512 64512.I would like to manipulate the bgp settings so when FG1 re-advertise to FG3 a network learned from FG2 it would replace the asn so FG3 will see asn 1111 multiple times. how can i do it?What i did so far is creating aspath-list:config router aspath-listedit "as-fg2"config ruleedit 1set action permitset regexp "64512"And then i have created a route map:config router route-mapedit "ASPATH-REPLACE"config ruleedit 1set match-as-path "as-fg2"set set-aspath-action replaceset set-aspath "1111"I have assigned the route map to BGP peering towards FG3 (

Hello everyone, I have a licensing problem on FortiMail. FortiMail is displaying the following error "Invalid Duplicated Error". I need to re-upload it multiple times for the license to be valid. But the problem persists.During the installation, I downloaded the license onto a first VM. Then, I deleted it.I reinstalled another VM and uploaded the same license, but I'm encountering this problem.I don't know if the problem could be due to this action. How could I resolve the problem? 

Hello Fortinet Community, We are in the process of configuring FortiWeb 7.4.3 as a reverse proxy for our on-premises web servers. Our FortiWeb deployment is VM-based. Alongside hosting a web service, these servers are also involved in IP-Sec tunnels established on our core firewall (FortiGate) with various financial institutions.Our objective is to bypass traffic destined for these IP-Sec tunnels through FortiWeb, excluding HTTPS/HTTP traffic directed towards the web servers (HTTP/HTTPS Traffic should be inspected in FortiWeb)We seek clarification on the following points:IP-Sec Tunnel Bypass: How can we ensure that traffic intended for the IP-Sec tunnels bypasses FortiWeb? Are there specific configurations or policies within FortiWeb that we should implement to achieve this seamlessly?Impact on Financial Institutes' Settings: Will configuring our servers behind the WAF (Web Application Firewall) necessitate any changes at the end of the financial institutes regarding their IP-Sec

Hi,I have this problem of sync in Fortigate.Anyone that can help me? Thanks

Hello Fortinet family, Can someone provide some insight and/or solution? I just put my fortimail in the dmz, my mail server is behind the fortigate fwl, enabled smtp traffic on fortigate, mails are processed/flowing via the fortimail perfectly(a lot of false positives though, some inspection settings might need to be tweaked down). I have to ethernet ports enabled on my fortimail hyperv vm:eth0 -> internaleth1 -> dmz I can login to Fortimail web UI  via port1-internal lan(172.16.10.5) . However, i am unable to login to the web ui via port2-dmz(172.16.40.10). What do i need to do to log in the fortimail web ui via the dmz port/IP? ANY help would be great, thanks. 

Hi, I have recently tried to restrict our SSL VPN to one specific country. I have created the Geography Object for the country, added it under SSL-VPN Settings, limit access to specific hosts.Under the SSL-VPN tunnel interface policy the source for IPs was all, so I have changed it to the object I created for the country as I understand the Country has to be set in both places.The problem I am having is that users can connect, but once connected they cannot access anything. If I take the Country out of the SSL-VPN tunnel interface policy and change back to all it works fine.As far as I can see I have implemted as recommended so unsure of where to go next. I have tried one two different VPN devices both with public IPs in the country I created.

Hi there,My query is regarding Forti web,i have servers connected to the back of Forti web in reverse proxy mode but my backend server needs to connect to its update portal outside but can not connect.is there any outgoing policy or any way to allow my specific server for allowing internet for updates.Thanks