Solved

Hi Team,I have encountering an issue with devices while updating their records.This issue occurs after installing FortiClient ZTNA.I monitored the traffic by Wireshark and I observed that the connection refused as shown:Our DNZ zone security configuration is to allow secure connection onlyBut after changing it to unsecure, machines can update their records.This issue without connecting to VPN just the FortiClient installed and connected to EMS server.FortiClient Appreciate your support.Thanks,Alaa Elrayes

I am trying to figure out the best way to setup ZTNA for our environment.  We create a lot of server that server up our SaaS application via https.  Each server has its own unique URL.  If I had to create a ZTNA server for each one I would have a new full time job.  Even setting up a single ZTNA Server and then managing webservers as they are added/removed from our environment would be a full time job.  All of our webservers do live on a handful of subnets that never change. What would be the best way to setup ZTNA for this?

I am trying to configure trusthost for the user ADMIN on my fortigate with the following:config system adminedit adminset trustedhost1 172.25.176.23 255.255.255.255set trustedhost2 172.25.177.0 255.255.255.0end My other users use ADFS SSO login with 2FA so I am ok with them accessing the FortiGate from the internet.  I just want to block the default admin account (and any other non 2FA backed account) from logging in via the internet.  I do want to allow the admin user to be able to login from our internal AD domain servers. When I set this up though I found that ALL users were blocked from accessing the FortiGate unless they came from our AD servers.  Support is trying to tell me that setting up the trusthost effects ALL users and not individual users.  I find this very hard to believe that Fortinet would prevent people from controlling where a user logs in from on an account by account basis.  Linux has been doing this for MANY MANY years.  And

Hi all,I've got an incident based on traffic from an internal IP to Malware IP 192.143.59.12. FortiGuard is not showing anything regarding 192.143.59.12. Neither the Malware IP list under FortiSIEM -> Resources.I know that Malware IP's are based on services such as Emerging Threat.Why is FortiSIEM classifying  IP 192.143.59.12 as a malware? Thank you,Norberth  

I am trying to configure the fortiportal with a secondary IP address and every time I do so, I get the error"Disabling interface eth1"after I enter the end commandhere is what I input:fortiportal # conf system interface(interface)# edit port2(port2)# set ip (ip address and subnet)The system already has a primary address and port1 configured with an ip which we use to access through ssh to configure the secondary ip.What we are trying to do is have a primary IP for one team to use for configuration and a secondary for another to access Fortiportal.Did anyone have any luck in configuring two IP addresses for Fortiportal?

Hello,For our customer who has a full forti-stack: Fortigate firewall, FortiSwitch and the FortiAPs, the WIFI guest users are not getting the IP addresses and the error DHCP-no-responseWarningDHCP server not responding for client (Client device Mac-address)The link to the Fortigate documentation which shows the Log ID:https://docs.fortinet.com/document/fortigate/7.2.7/fortios-log-message-reference/436581:) I have a question is there a separate document that advises the steps to troubleshoot this issue related to the log messages on the firewall not only for this issue but also for the other issues?2:) Lastly the issue started after the firmware upgrade from version 7.0.12 to 7.2.7 last week?3:) What are the steps to troubleshoot the issue?Many thanksFaisal

Dear Colleagues,we are facing issues with tcp forwarding on some MacOS mashines. On some Macs its working quite fine but some are not able to connect to ZTNA Destinations, while the normal ZTNA Web-Proxie stuff is working.The FortiClient logs are showing the following on these devices:2024-02-26T15:08:55.162 TZ=+0100 info ztna mergeCfg:{"enabled":0,"rules":[{"name":"replaced","mode":"transparent","enabled":0,"destination":"replaced","gateway":"replaced","encryption":0,"local_port":"7788","type":"private"}],"portals":null,"gateways":[{"redirect":"0","addr":"replaced","alias":"replaced","rules":[{"name":"replaced","mode":"transparent","enabled":1,"destination":"replaced","gateway":"","encryption":0,"local_port":"7788","type":"private"}]}],"notify_on_error":1,"portals_enabled":1,"gateways_enabled":1}2024-02-26T15:08:55.162 TZ=+0100 info ztna ztna disable I replaced the private data with "replaced".Every time you try to access a host, specified in the ZTNA Destinations, you will get t

Hi,I have a problem with a FAZ trial license. Some time ago I've been playing with a FAZ VM on Proxmox - restoring from backups and resizing data disk (of course within trial limits). After that I was getting errors about duplicated license.I've decided to decommission the old license, delete the VM and start fresh. Sadly, with the new license and new VM I was still getting the duplicate license error.With the support help, I was able to remove all old and decommissioned FAZ licenses from my account and once again deployed the new VM. Nothing has changed. I've even tried to create another Fortinet account, but no matter what I do, there is still an error.Does anyone have any idea what to do to deal with this?

When we configure this SSL VPN MAC address filtering, what system limit would dictate the max number of MAC addresses we can configure on an FGT (no vdom/muti-vdom)?https://community.fortinet.com/t5/FortiGate/Technical-Tip-MAC-address-check-on-SSL-VPN-connections/ta-p/194337The max value table doesn't seem to have the exact matching object.https://docs.fortinet.com/max-value-tableToshi

Hi, Our company has 6 x /24 IP blocks, and we want to create static ARP records for each IP address, consisting of different MAC addresses. We only want the specified MAC addresses to access the internet. We are using a Fortigate 3700D device. We don't want anyone else to use that ip other than the mac we paired with. Is it possible with without problem ?  My question this process can be offloaded by the NP6 processor and if there would be any issues with a 10Gbps active capacity. Thanks.

Hello, 2 wees ago we replaced a FG100D cluster for FG100F. We copied all VoiP rules for the external Voip provider. Now we get some feedback from the local users that "sometimes" it takes lie 1-2 seconds before they can take the call and they did not have this issues lie 2 wees before. the policies are the same, we deleted the session session helper so I think we should have the same situation. Any ideas? Thanks

Could someone kindly assist me with the FortiSOAR uninstallation/reinstall procedure via the command line interface? (Tried and Tested)

Trying to get a trunk built between a Cisco Catalyst switch and a Forigate 100F using two 10G links in an LCAP link-aggregation configuration.  The LACP link comes up but the VLAN communication does not work.  I swear I've used this same configuration in the past and it worked, but it isn't working now. Here is the configuration on the Fortigate:config system interface    edit "x1"        set vdom "root"        set type physical        set trunk enable        set snmp-index 7    next    edit "x2"        set vdom "root"        set type physical        set trunk enable        set snmp-index 8     next     edit "po1"        set vdom "root"        set allowaccess ping https ssh snmp http fgfm radius-acct fabric ftm&nbsp

Hi guys, I wanna upgrade my SOAR to the latest version but i get a response disc error. How can i fix this?  Error: There is insufficient disk space to complete this operation.Make sure you have enough space on the following locationsand then retry the operation.Details: Available Free Space on /: 1.33GBRequired Free Space on /: 2 GBRerun the script post addressing above error(s).Exiting.

I have a strange issue with FortiManager, I have two sites that have radius configured for VPN authentication. Each site has a local server and a remote server as a backup that connects over IPSEC. I set a source IP in FortiManager and push the system config. Both sites then can contact the servers using the test connectivity, but as soon as the system config is pushed, the policy package goes out of sync. When I go to push the policy package, it unsets the source-ip and the test connectivty fails. I have tried it directly on the firewall and retrieve the config, but ultimately get the same issue where FortiManager wants to unset the source-ip. Anybody ever run into this or have any suggestions?

Hello!after installing FAZ-VM-KVM 7.2.4 (with Trial License, if it matters), I was not getting "Top Sources" and "Top Destinations" for Last 4 hours, 1 hour, 30 minutes or 5 minutes. To fix, I rebuild'ed the database (using "execute sql-local rebuild-db") and now, I'm seeing "Server error: ERROR: relation "app_mdata" does not exist LINE 1: ... ON t1.dvid=t2.dvid) t WHERE (1=1))) t1 left join app_mdata ... ^" in graph and table.Suggestions on how to fix, most appreciated.R's, FerenX  

Hello everyone, Our #Fortigate v7.0.14 detected a Heartbleed attack, but it did not block it, so it reached an inner service (luckly not vulnerable)  To my understanding, the default action should be blocking such malicious connections. Why did it detect but not block? How should I configure Fortigate to block it? Thanks for your help,

Hi there , we are using Fortinet 60F and it was working all good and I can login via Https , but suddenly its stop working , i cannot access it , I have tried rebooting but no luck , the only way i can access is TELNET and I am not good on CLI , i have check some basic commands , i have tried already killing the Https daemon , and check the ports (http , https) for connectivity but I am still not getting any luck , I have also checked the storage which is all good, I am not sure what the Issue is , could this be a trusted IP issue ? i don't know as i was using the same IP address to access the console before. Any help will be much appreciated :) , Thanks in Advance

Hey all, my on Prem Data Gateway connects to Office 365 via 443(no inspection), but after few minutes it looses connection. The issue is definitely the forti. With a direct uplink the connection is persistent. How can i debug? What kind of trace can i perform to find the issue? Any direct ideas? Thanks and best regards

Hello, do you know why the path for the update from version 6.4.13 to 7.0.14 is not shown?I have a 300E device and I need to update to version 7.0.14 but when I enter the following link to see the update path https://docs.fortinet.com/upgrade-tool/fortigate I cannot find the version  

HelloI have FortiAP 220B/221B at v5.2.7 build0265, which I know is very old.I need some info but I can't find documentation on it.What is the last firmware version that was released for this AP?How can I find the upgrade path for this AP from v5.2.7 to its latest firmware version?

Hello fellows! In a FGT-61F I created a local DNS service for domain "local.tld" with some A records in it.All clients using the fgt as their primary DNS server and can resolve all hosts in "local.tld" with their FQDN.Fine. Now I want to use this working FQDN resolution for some firewall policies, so I added some addresses.When I try to use the same FQDN for an address object, fgt says "Unresolved FQDN: host.local.tld". What am I doing wrong? Any suggestions? Working on FGT-61F with FortiOS 7.2.6. Any help welcome. Thank you in advance! Regards, Michael.

Hello, Is it possible to block the change of the expiry time of a guest account? For example, I set 4 hours and the administrator who creates the account cannot change this or no longer than 4 hours. How can this be done? Zaq

I am trying to see the commands in CLI to display the network interfaces configured for the fortiportal but the show commands donot work.I am using the Fortiportal 7.2.2.Is there a specific command to see the configuration?

I have two LAN networks: the first one is 192.168.1.0/24, and the second one is 10.0.0.0/24. Each LAN is directly connected to a FortiGate firewall. I have set up a site-to-site VPN using two FortiGate virtual machines running version 7.2.0. The VPN configuration was done using the wizard.However, when I try to ping a host in the other subnet (for example, from 192.168.1.1 to 10.0.0.2), I don't receive any response. The ping requests seem to be unsuccessful.I researched this issue and discovered that it might be related to the black hole route created by the VPN wizard template. If anyone has experienced this problem before, I would appreciate any suggestions or solutions for resolving it. If anyone has knowledge of how to fix this, please provide guidance.