Solved

i am getting the following SSL error message from my fortigate firewall when i access some FTP and HTTPS sites. how can i by-pass this error message ? This Connection is Invalid. SSL certificate expired.A secure connection to ftpsin.emc.com cannot be established.When you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.Site ftpsin.xxxx.comCertificate CN ftpsin.xxxx.comCertificate Authority Entrust Certification Authority - L1KCertificate ValidityNot Before: Nov 6 22:29:54 2020 GMTNot After: Nov 6 22:29:54 2021 GMT

Hello all,I used FortiClient VPN for a while and one day, it suddenly started to pop up the following window:I checked the security & privacy settings as mentined, but couldn't find any request for approval from any app. Full disk access is allowed for "FortiClient" and "fctservctl2" so there should be no issue but still, it insists. I decided to uninstall the client and reinstall it and now there is a new problem. Second before the installation process ends, I'm getting this message:                   I clicked "Allow" and the installation finished.Now, when I open the client and add a new profile, after clicking "Connect", it's getting stuck in the status: "Connecting". The disconnect button doesn't respond, I need to force close the client completely to get out of it.Any idea what it might be? It worked perfectly for a long time and now it stopped.There were no changes in my system tha

I configured allow access from specific subnets under admin user configuration, but it still allows access from anywhere. Is there anything am I missing? 

We have a FortiAnalyzer and want to create a new dataset with bandwidth consumption for the previous month based on vlans port. The bandwidth consumption refers to traffic from/to vlan to/from wan port.E.g. vlanconsumedvlan10123vlan20456...... So query intercepts "internet usage" of vlan# for the previous month.Can someone help us? Thanks in advance.VZ   

HelloVRRP on FortiGate fails over in a minimum of 3s and I couldn't find a way to reduce it more.Tried to use VRRP v3 but I got the same.By the way VRRP v3 timers should be configurable in millisecond but on FortiGate it is still in seconds.Any idea on how to reduce failover time to 1 or 2s?

good afternoon colleagues, a question.In the morning we had some problems with access to some pages that I could access normally.In order to pass the certificate analysis I had to enter the rule and in the SSL INSPETION section change from certificate-inspection to no inspection until the page loads without problems and then return to certificate-inspection.This problem has been occurring with other pages that were previously accessed. the connection is not privateIt is possible that attackers are trying to steal your information from xxxxx.com(for example, passwords, messages or credit cards).NET::ERR_CERT_AUTHORITY_INVALIDIt is worth mentioning that when you enter through another network, for example, a cellular data network or a home network, if you can access the page and the message "it is not secure" does not appear.Do you know why this happens? It is worth mentioning that the certificate of the page expires in 2024 so there should be no problem. 

I have this log in our FortiAuthenticator. What does it mean? Failed to send notification to user[username] due to: [HTTP code 400] Cannot determine platform based on reg_id  

Is there a way to disable all accounts with out a token in bulk? 

Hello, communityI am trying to update the database ISDB through REST API FortiOS from file "ffdb_...". Which db_name should I use? The REST API Reference does not say about it? Also, when I try to update through web from file "ffdb_...": Fortiguard→ Firmware & General Updates I get the error: "Failed to upgrade database"

Hello, I run a single supervisor node in a virtual environment. Is it possible to install Windows Agent and configure it to send data directly to the supervisor, or I always need to set up a collector in order for the Agent to communicate with it? 

have you tried registering AIX server? we're able to configure syslog setting but AIX still not sending logs to Fortisiem.

Hi, I have a FortiGate 50E running v6.2.4build1112 The following issue occurs with different browers (FF, Chrome, Safari) and also on different platforms (Win,OSX,iOS,Android) For the last 24h I have suddently started receiving certifiacte errors on various websites which have worked flawlessly before. I get the typical HTTPS warning in my Browser (e.g. "Your connection is not private" in Chrome) and the exact error message is "NET::ERR_CERT_AUTHORITY_INVALID". Interestingly if I look at the certificate details it shows "Fortinet Untrusted CA" as the issuer. If I access these sites via mobile data these pages work fine and also the issuer is shown as a know institution (in all cases noticed so far it's "Sectigo"). In the SSL Logs I see "blocked" actions for the respective website: Message: Server certificate blocked Reason:    block-cert-invalid Type:    utm Sub Type:    ssl Event Type:    ssl-anomalies These actions are

Hello - We have a FortiGate 30E with 2 VLANs at a new office.  The first VLAN is for devices that just need internet access, the second is for domain connected devices that need to connect to the private LAN at our datacenter.  That connection is done through an IPsec VPN tunnel (FortiGate to FortiGate, other side is a 200E).  The 0.0.0.0/0 routing entry points to the local internet connection so that regular outbound traffic goes over that connection.  However, I'm trying to find a way to route all traffic on the 2nd VLAN over the VPN connection, including internet bound.  In other words, we want internet traffic from that subnet to be routed over our corporate internet connection in the datacenter, not the local office internet connection.  Is there a way to do this?

Hello!I hope someone can help with a boot loop issue on a 900D.Please excuse the NOOB description, as I am just coming into this job and have a non functioning device.Putty is being used for CLI serial access to the device.I have had to format the boot device, as I am starting from scratch--which appears to go fine.Then I load from TFTP (tftpd64 program) on MGT port 1 the downloaded OS version 7.0.0 (checksum verified).That goes well, no errors.Next I am prompted to choose the boot program as Default/Backup/ etc.I choose Default (I also have tried backup).The system then goes into the "Programming firewall" - again, no errors.After that the system reboots.Here is the console out put that is concerning, and I am not sure what to make of it.Sorry for the long detail, but perhaps someone can decipher it:FortiGate-900D ( 9:56-10.13.2017)Ver:05000004Serial number:123456789RAM activationCPU(00:000306c3 bfebfbff): MP initializationCPU(02:000306c3 bfebfbff): MP initializationCPU(04:000306c3 bf

Hello,I am running an AD on Windows Server 2019, and I would like Fortisiem to trigger any change or modification made on the DNS server ( adding a new record, deleting a record, etc ... ).Fortisiem now polls event information from different DCs by using OMI. 

Hi Guys, I have not configured any static route but it is showing in the routing table. Kindly suggest on the same. 

Hello Is it possible for a FortiGate to both act as the DHCP server and relay? The reason I would want this is because I have a NAC solution that would use the relay information to profiling the endpoint and the endpoint also needs to get an IP address from the FortiGate DHCP server. I have tested this in a Lab, but I am getting this error:FORTINET-FW (CISCO-CORP-LAN) # set dhcp-relay-service enableFORTINET-FW (CISCO-CORP-LAN) # set dhcp-relay-ip 10.0.1.51FORTINET-FW (CISCO-CORP-LAN) # set dhcp-relay-agent-option enableFORTINET-FW (CISCO-CORP-LAN) # showconfig system interfaceedit "CISCO-CORP-LAN"set vdom "root"set dhcp-relay-service enableset ip 10.100.100.1 255.255.255.0set allowaccess pingset device-identification enableset role lanset snmp-index 7set dhcp-relay-ip "10.0.1.51"set interface "port4"set vlanid 100nextendFORTINET-FW (CISCO-CORP-LAN) # nextdhcp server 2 of type Ethernet already exists on this interface, cannot add relay!object set operator error, -76 disca

i have deployed fortianalyser container with this command Docker run -it --restart always -p <Port Mapping>:443 -p <Port Mapping>:22 -p <Port Mapping>:541 --cap-add=ALL <image ID>:<Tag>and then i go to the browser i put localhost:39443, it says  "This site can’t be reachedThe connection was reset."is the image fortinet/fortianalyser not stable or what !!what is the solution please  !!?

I have a scenario where there are two subnets in AWS, a public subnet and private subnet. Most of the public subnet have web servers running with multiple public IP's to access from the internet. Now I would like to deploy the Fortigate Firewall in the same public subnet & route all those web servers traffic through the Fortigate without changing already mapped public/elastic IP's of those web servers. Can some one please provide some inputs on this ? PS: my private subnet traffic towards internet through Fortigate is working fine & also traffic from internet to private subnet via Fortigate WAN public VIP and port forwarding is working perfectly.  Only concern are the instances hosted in the public subnet where it has multiple public IP's and I can't change the architecture keeping existing setup in view. Appreciate your inputs, thanks FortiGate 

Hi guys,In my domain I have two web Servers appliccation and I need to publish both. They are hosted in differente internal web servers.I only have one public IP to do that and both need to use https port.Ex:webserver1.mydomain.com  / 200.10.10.10:443 > 192.168.1.10:443 webserver2.mydomain.com / 200.10.10.10:443 > 192.168.1.11:443 Is it possible configure Fotigate to do it with virtual IP?Fortigate will be able to match different fqdn and redirect to correct web server ? Regards ,

Hi all, I am configuring a 40F for a small branch site, using a VPN to the main core site.  The VPN is up and running, but I am having problems with access to the core FortiManager and out to FortiGuard. The FW is on a private address behind an ISP router. The problem is that the FW is using the 192.168 IP from the inside of the ISP's router as the source for the FW originating traffic. Is there a way to set the source to a routable address ?  

Hi everyone,   We are moving our School environment over to a Fortigate 100F with 5 year UTM - and after setting up our web filtering profiles, I am looking for a way to setup email notifications when certain categories are blocked.   For example, if a member of X group attempts to go to a website categorised as Adult content. When it is blocked, we would like an email to be sent detailing the user and the website. Is this possible with the current licensing we have in place or do we need to look into alternatives like FortiAnalyzer? Is this even possible with FortiAnalyzer?   Any help is appreciated.    

Hello, I am currently working with a FortiAnalyzer cluster. In the Log View I can see several "IPS detected intrusion" events with an "alert" severity. When double-clicking the events, a detail view is opened. Now the detail view displays that the threat direction is outgoing, although the source interface role is WAN while the destination interface role is LAN. A screenshot of one such event is attached below. Why is the direction "outgoing" instead of incoming and how can I fix this? I would have assumed that the direction is determined based on interface roles. Is this a bug or a configuration error on my side? And should the IPS even report an intrusion since this is coming from the outside (just another vulnerability scanner) and there is no indication of compromise? Thanks in advance.   

I enabled FortiLAN in europe and the "Combined Default" network was automagically created in my FortiLAN. When clicking on the options I can only clone it. If I create a new network, I can delete and rename it. So, what's with this mystical network that I can't find in the docs? Is there a way to get rid of it or rename it to something that can satisfy my OCD?

Hello, We have 2 Virtual Fortigate deployed on ESXi with 2 trial licenses (provided by Fortigate) and I'm trying to configure Active-Standby Failover. Also we have Out of Band Mgmt (added one interface to another VRF and added one default route). When I'm activating HA on firelwalls, Fortigate do reboot and after that I lose access to the web. I have access just via ESXi console.  How I can fix it?