Solved

Hi All,Today I have configured successfully email based authentication for Forticlient VPN and when I configure using Local user that time I am getting authentication code. I want, the user type must be Radius user not Local user.User must be authenticate using Radius server.Can anyone guide how can I achieve this things.Please refer the snapshot.    

The latest build of FortiClient EMS ships apache version 2.4.54, which is vulnerable to CVE-2023-25690 and others.Is there a planned fix, or is it possible to upgrade apache independently to the rest of the application?Thanks.

Hi!. Currently we have a FortiSwitch directly connected and managed by a FortiGate. The trunk between the FortiSwitch and the FortiGate is automatically formed by fortilink (default-auto-isl), so the name of this trunk corresponds to the serial-number of the FortiGate. The FortiGate is managed by a FortiManager. In the event of a FortiGate failure, what would be the process to replace it? Is it necessary to apply some configuration in the FortiSwitch so that the trunk updates the name or does this change automatically? Thanks,

I'm a newbie regarding Fortinet products, so forgive me if I ask something silly  :) When I hit an innocuous website likewww.newsweekjapan.jpI get fortinic firewall notification that access was blocked by firewall policy 15.I then check policy ID 15It's named GEOBLOCKIt has for destinations two address groups'GEO IP FILTER'and'BLOCKED-IPs-Group'The first group does contain "Japan" (why it would is a mystery to med at the moment)The 2nd does not contain the ip address (block) of NewsweekjapanSo yeah.. Seems all Japan ip/sites are blocked right?Yet random *.jp sites I tried in chrome come up just fineI found no exceptions that would seem to allow some jp sites through but not othersConfused  

Hello TogetherFor the documantion for the Fortiswitch, Doucusnap is used by the customer.The Fortiswitches are only connected to the Fortigate via Fortilink.I can make the Fortiswitch accessible via SNMP and ping? 

Hi,I have an IPsec connection set up from AWS to Fortigate.In AWS, there's a private subnet containing various services, including EC2 instances.Within my Fortinet, there are two networks - a DMZ network and an internal network, and they can communicate with the EC2 instances without any issues.However, I'm currently facing a challenge: I want to enable internet access for the EC2 instances through the IPsec connection, following this path:EC2 ===> Fortigate 1 ===> InternetTo achieve this, I've configured the AWS route table to have a route with destination 0.0.0.0/0 pointing to the virtual private gateway (VGW) to handle internet-bound traffic.On the Fortigate side, I've implemented two policies. The first policy is to allow traffic from the WAN to AWS IPsec, and the second policy is to allow traffic from AWS IPsec to the WAN.Unfortunately, despite these configurations, the setup isn't functioning as expected. When capturing traffic on the Fortigate, the results show:1 0.000000

We are having issues with the file name(length) in our FTP server is there a way to rename or modify the config file so that we can enable auto-backups. Thank you.   

Hello,  I want to allow push updates for my Fortimail. Problem is i cannot add FortiGuard servers as a Source for incomming direction. Has anyone encountered this? Am i getting it wrong? Thank you. 

Yesterday I've updated my LAB FortiAP (W2, 223E) to Version 7.0.6.First Update to 7.0.5 -> FortiManager shows FP223E-v7.0-build0078 -> expectedSecond Update to 7.0.6 -> FortiManager shows FP223E-v7.0-build0068 -> quiet unexpected? I thought I've made a mistake during updating, downloaded Image "FAP_223E-v700-build0108-FORTINET.out" and tried to update directly by the AP GUI -> same issue? Double Check:I've edited Firmware Image by an Editor and the file header shows "FP223E-7.00-AP-build0108-230329-patch06-protver02". Anybody updated to the new Firmware and can agree with the right Build No. after updating a FAP Wave2?

Hi Fortinet Community,Would like to ask if we can do FortiSIEM installation in Oracle Cloud Infrastructure.I wasn't able to find documentation for this, like AWS (cloud) installation. 

For seven hours in my logs I have entries "Fortigate idsurldb signature is missing or invalid."Does anyone have a similar problem ?The rest of the updates download correctlyFortigate 60F on 7.2 fw

I am trying to create new static routes in my FG100F, but it seems like I cannot select some addresses eg subnets i have already created in my Address list.seems like they are hidden.firmware for the FG100F is 7.2.5 subnets in addresses

Hello,  I just set up my first Foritgate unit, a Fortigate 40F running firmware v6.4.6 build 6083, a few days ago, and was poking around the GUI today to change settings to better suit the best practices shown in the documentation. I changed some settings on a firewall policy I made, and clicked "OK" to save, then I noticed that the policy I had edited was showing a peach highlight around it. I tried searching the forum but could not find anybody who had asked the same question. What does a peach or peach orange highlight mean for a firewall policy in the GUI?  Here is a screenshot showing what I experienced: 

How can I set up a DMZ for the Fortigate VM we are running in Azure?Currently we only have 2 ports (LAN and WAN). 

Does anyone have ldaps working with windows server 2019?  I'm running version 6.4.12 and had LDAPS working with windows 2016 without any issues and my server admin upgraded our DC to server 2019 and broke the ldaps connection from the fortigate.  I have unsecured port 389 working but can't get 636 to work.  With the previous configuration we we're using certificates we just had the secure option checked and it was working but now it won't work at all the the option.  I've tried using certificates by downloaded our CA from our certificate store to the gates and selecting the certificates on the configuration and still nothing. 

HelloIs it possible to change the default Fortinet-Factory Cert to my company wildcard cert?Some browsers can not process to portal it said "Your connection is not private" 

Hello everyone,When I upgrade my Ha clusters "fortigate appliance" I have downtime twice for about 40/30 sec.The ha is configured as active-passive.I am using gui to start the upgrade process from fortimanager.Is that normal behaviour? Kind regards,Homan

Hello everyone  I hope you can support me: I added a page in the web filter menu, in the static url filter-enable url filter section, only that people can still see the web page, what should I do so that they do not really have access to that site? The appliance that I have is a Fortigate 60D. Thank you very much for your support

We are using FortiClient ZTNA 7.0.8 with FortiClient EMS. We have experienced sometimes bugs were FortiClient gets unresponsive and only a restart of FortiClient or the notebook works.In the FortiClient EMS System Profile users are allowed to shutdown the client. But when trying to shutdown the client on windows, the users are asked for adminstrator credentials. Is there any possibility to shutdown or restart the FortClient ZTNA without administrative privileges? Kind regards

I have fortiauthenticator 7.2.1.It is setup with with an ldap server and using SAML as an IDP.  When I go to the portal page to test my authentication from the moment I enter my username/password and press enter I only get 5 seconds to respond to my MFA prompt. Is there some way I can adjust this setting?At least with fortigate I set remoteauthtimeout in the system global settings.

Hi allI have three scenarios I need to figure out with prefix lists...and I just need someone to confirm that I am not totally wrong about my approach :) Scenario 1:I receive about 1'000 prefixes (including the default gateway of 0.0.0.0/0) and I want a route-map as preparation if I need to configure something special down the road.In order to accept everything from my neighbor I would have used the following prefix-list:config router prefix-list edit "accepteverything" config rule edit 1 set prefix any unset ge unset le next end next endWould I be wrong with that? Scenario 2:Now that I have those 1'000 prefixes including the default gateway of 0.0.0.0/0 I would like to forward everything BUT the default route to another neighbor.To achieve that I would have used the following prefix-list:config router prefix-list edit "blockrule" config rule edit 1

Recently FortiAnalyzer menu stopped working, I tried to use different browser/computers restart the fortianalyzer.  nothing working, it seems it's a new update or something that broke it.  Cannot also log out because the profile menu is not working. anyone facing the same issue?

We need to migrate our VMs from Hyper-V to VMware.To do this, I have already downloaded the VMware image and created new VMs for it (which now have a trial licence).I can download the configuration as a backup and import it into the new VMs.However, I would have to shut down the existing VMs before importing the backup into the new VMs (because of the IPs).What I haven't quite understood yet is the issue of the licence.How do I transfer the licence from the existing VMs to the new ones?

Hi all I have three scenarios I need to figure out with prefix lists...and I just need someone to confirm that I am not totally wrong about my approach :) Scenario 1:I receive about 1'000 prefixes (including the default gateway of 0.0.0.0/0) and I want a route-map as preparation if I need to configure something special down the road.In order to accept everything from my neighbor I would have used the following prefix-list:config router prefix-list edit "accepteverything" config rule edit 1 set prefix any unset ge unset le next end next endWould I be wrong with that? Scenario 2:Now that I have those 1'000 prefixes including the default gateway of 0.0.0.0/0. I would like to forward everything BUT the default route to another neighbor.To achieve that I would have used the following prefix-list:config router prefix-list edit "blockrule" config rule edit 1

Hello DearsI am trying to imeplemnt that , when user try to reach server the traffic would forward based on url rather than IP address as show in exmple : www.FG1.com ->> 192.168.1.1www.FG2.com ->> 192.168.1.2 both domains FG1 and FG2 would use the same public ip for exmple 1.1.1.1 and tcp port 443any advise about that ?