Solved

I have this setup, where EMS is not published and the off-net profile is restricting malicious and security risk contents. Will the Forticlient be able to do restrictions with the configured EMS Profile if the EMS is not reachable. This also refers when the VPN is not connected. FortiClient  #ForticlientEMS

Hi,I have configured two ipsec tunnels between Fortigate_A and Fortigate_B with static routing and then added to sd-wan zone on both sides. I created ipv4 allow rules to allow lan to lan traffic, and this is not working, I mean tunnels are up established but cannot ping from lan to lan. So I addressed Ipsec interfaces, now the strange I can ping from Fortigate_B to Fortigate_A ipsec address but not in opposite. Ping are allowed on ipsec interfaces. How to troubleshoot this?

HiI have FortiEMS 6.4.8 and have problem with Thunderbird.this is exaple logW32/PossibleThreat, Last detected at: 2022-11-24 15:45:12, C:\Users\Dyzurny\AppData\Roaming\Thunderbird\Profiles\9ms2l7at.default-release\ImapMail\powiat.tczew.pl\INBOXand it's repeat many times. in TB i have cheked "allow antivirus clients to quarantine individual incoming messages" but no changes there are too many messages in the inbox to check one by one. the problem occurs with several users any ideas?

I installed that latest FortiClient on my debian 11 host. When I attempt to open the GUI, it get this error: $ forticlient gui The futex facility returned an unexpected error code. Aborted I configured my VPN server connection and verified that I can ping that server. When I attempt to connect, it starts attempting a connection but then fails with: $ forticlient vpn connect owems [owems] Connect VPN: owems Status: Connecting... Status: Disconnected Notification: Error: Can not connect to VPN server. DONE. I can connect to this server from my work setup where I am also running debian 11. However, when I connect there,  I get a popup indication that there is not a valid SSL cert for the connection and I have to click OK to ignore that warning and then the connection completes successfully. At home, on my debian 11 workstation, I never see that SSL cert warning when the connection starts. At work I am running:  $ lsb_release -a No LSB modules

My network (currently 1x GW, 2x dist switches, and multitude of access switches) is set up for mclag. Our ultimate goal is to have a full HA system. Our 2nd gateway hasn't been added till I resolve the layer 2 issues. Both dist switches connect to the gateway over a combined 8x ports, 4 per dist switch. The dist switches are connected to each other via 2x physical links (mclag-icl). All access switches were initially connected to one dist switch. As a second link is activated on the second dist switch, the entire network resets and all switches lose conn. It takes almost 45mins for the network to normalize. Traffic flows over both links when things work but we haven't tested removing one link for fear of generating another 45min long "hold your breath that things normalize" event. Any help on what we're doing wrong would be appreciated. Here's a config from one dist switch:edit "DIST-ICL"set port-selection-criteria src-dst-ipset description ''set mode staticset bundle di

Hello Team,Can we configure netflow in transparent vdom of a fortigate firewall running fortios v6.0.10 with no gateway IP configured.

Hello,I need to acheive the below scenario using Fortiauthenticator. SSID with self registeration captive portal, user register their devices.After device registeration, users should not login using their credentials, they should be automatically authorized by their MAC (previously registered) To achevice them, I have configured the following: 1- SSID with MAC filtering and automatice vlan asignment.2- radius policy on FAC for mac authorization.3- authorized macs should be granted access to the network (succeeded)4- unauthorized MACs : send access accept with the known three attributes to assign the host to a specific vlan (tunnel-type=vlan, tunnel-medium-type=ieee 802, tunnel-private-group-id=vlan-id (171)). This configured in the authentication policy which give the option to set "radius authentication response" to access accept for unauthorized MACs and to configure the attributes to be sent. 5- On Fortigate I have configured subinterface of the ssid (vlan-171),

Hello, I have an FG in 7.0.8, where its DNS server settings show DNS service on FortiLink interface and a DNS zone for identrust.com. Do you know if these are default settings in 7.0.8? I remember older releases where the DNS server settings were empty. Does anybody know anything about that? Is this documented somewhere. Thanks

Hello,I am setting up the ZTP function on the fortimanager.After adding the firewall on fortimanager via the "add device" functionThe firewall registers on the fortimanager (via the DHCP option)The registration is done well, but during the 1st installation wizard the fortimanager generates a purge action which generates an install failedDo you know why the fortimanager does this and do you know how to prevent this purge? Should I disable a function?Below are the installation logs Starting log (Run on device)Start installingFGT80E $ config endpoint-control fctemsFGT80E (fctems) $ purge5 can not be deleted because it is a static entry.4 can not be deleted because it is a static entry.3 can not be deleted because it is a static entry.2 can not be deleted because it is a static entry.1 can not be deleted because it is a static entry.FGT80E (fctems) $ endFGT80E $ config user fortitokenFGT80E (fortitoken) $ purgeFGT80E (fortitoken) $ end---> generating verification report<--- done

Hi we have Fortigate 61E (OS version 7.0.7 build0367 feature ) in our organization. At a time we can only allow or deny a port in the firewall policies for a server but can not specify both at a time (Example - allow 80 and deny 1433/1434). FortiGate 

Hello, We purchased about 1000 FortiTokens (Software) and want to assign them to our users. Instead of doing this manually I was hoping there was a way to assign these tokens to all our users at once. The Fortigate is running firmware 7.2.0 and we use LDAP to sync our users.Thank you in advance!

HelloI would like to access a web server in our DMZ from our public IP.Access via https (port 443) works find but the access via http (port 80) does not work.Here are some screenshots of my configuration:    If I change the external service port from 80 to for example 81, then I can reach the web server viahttp://....:81. Is another service running on port 80? I disabled "Administrative Access" over HTTP for wan 1 under interfaces. From my internal network I can reach the web server via port 443 and 80.How could I find out what might cause the problem?Thanks in advance.

Hi, I have a new FortiGate 80F located in a data center since August 2021 and it was working perfect, until October when I started getting notification that the internet was dropping out overnight. At first I thought it was the provider doing maintenance work over-night since the drop outs only happened between 1am to 3am and it was only happening once or twice a month. By December it started happening every second day or so. That's when I noticed that the router was rebooting automatically.Logged a call with Fortinet support, they checked logs, hardware stats, etc, all was showing to be working fine. They asked me to do a hardware diagnostic check and a format to the same firmware 7.0.3. After all those steps the unit kept on rebooting, so they replaced it with another unit.After replacing the unit it only took 2 days and the replacement unit started rebooting again.Escalated the issue again and now they're asking me to do other test. Downgraded to Firmware 7.0.2 and it continues

Hi! I recently discovered this Internet Service while going through the Source. Would like to know what is the purpose of this? Is it related to Spam databases and should we block it? Really appreciate the communities' assistance on this.  

Hi all,I created a SSL vpn with full access.I am able to connect to the VPN portal via web browser.When trying to access an internal https service, I receive this message:"SSL VPN Proxy ErrorThe proxy server could not handle the request GET /proxy/597d4bc4/http/x.x.x.x/.Reason: Access Denied "the x.x.x.x IP is the address of the internel service and is added to the vpn security policy as the destination address. I dont see any hits on the VPN access police!!!On the VPN event tab I have "SSL web application blocked" as a message for that destination host. Could you please help troubleshooting this issue?

Hello,I can't uninstall FortiClient Zero Trust Fabric Agent. When launching the forticlient setup to uninstall, I have only the repair option that is activated. ( if i launch this one i have a fatal error). Below the "Remove" grey button, it is indicated:   "Forticlient cannot be removed while registered to EMS".I can't use it anymore because I think that since v7 the VPN tab is not available. My client with whom i use a vpn connection asked me to install an old version of forticlient. Could you please help ?

Hello,I'm trying to improve my setup. I have a new Fortigate units with 2 ISP: 1 primary and 1 backup under FortiOS 7.2.3. So I followed this https://docs.fortinet.com/document/fortigate/7.2.2/administration-guide/431448/sd-wan-overview in order to add my wan1 and wan2 into virtual-wan-link. I configured a cost 0 on WAN1 and a cost 10 on WAN. I added the default static route through virtual-wan-link. However, I cannot manage the distance and priority of this route and I'm not sure my VPNs (IPSEC + SSL) will continue to work. When I created a VPN (without SDWAN), I used to create a static route to the VPN interface with a lower distance than my default route. But now, I can only create a static route with the same priority. Will it work ? I read this https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-IPsec-VPN-with-SD-WAN/ta-p/209840 but not sure if it's mandatory ? Unfortunately I cannot test right now. I need to create and prepare my

I have a new FortiGate 40F that I'm learning and see that there is Wifi configuration available in the GUI and I'm wondering if this device can act as an access point? Thanks jackster

Hi I have a requirement to block a range of file types, however quite a few of them aren't in the supported file type list in the file filter or for use with DLP filters. For example, I need to block inf, jse, lnk, vbe, vbs extensions, but they are not in the supported list.  Is there any way I can block these file types? Thanks J

This client has FG-224B, and it's at V4.0 MR2, and they have WAN2 for the new ISP which provides 15MB speed (up/down). but at speedtest.net the download speed is good, giving 15MB, but the upload is very bad below 1MB. I have checked the firewall interface, there is no UTM enabled. How can I check the bandwidth settings for this network port? What CLI command shows me the WAN2 setting?How can I connect to the other ports on the firewall and check the upload speed? The network ports used are Port23 and WAN2 only, So how can I connect my laptop and check the speed from other network ports? Also, How can I do speedtest from the firewall itself? So I can eliminate the point of failure, I mean if the firewall is configured well, but we have a limit on the switches/VLANs, etc. 

Hi guys,I just bought a new FortiGate 40F which is up and running but I'm trying to configure SNMP polling so that I can perform the "snmpwalk" command from my MAC. I created the SNMP Agent as v1/v2c and set the community as public for now.I allowed my /24 network to be "Accept queries only", everything is enabled. When I try to poll from my MAC computer on the /24 using this command:     snmpwalk -v 2c -c public 192.168.1.99 I get "no response from 192.168.1.99". I started a packet capture and see the SNMP packet come into the FortiGate but no packets return so it's obvious that I have something misconfigured.  The configuration for the GUI seems very straightforward and everything looks correct, I'm wondering if I have to download FortiGate MIBS and install them before I can execute and snmpwalk from a remote computer? Thanks  

HelloWhen I execute  the command for a multicast address for instance : "get router info multicast PIM dense-mode table 239.2.10.10"  the Upstream IF is not what I attend and the the upstream state is pruned.My  logical configuration (see the picture) is composed by 4 nodes  (firewall 600D) PIM enabled using  between them GRE tunnels  in a HUB and SPOKE architecture. Each Spoke send multicast packet to both HUBs by GRE.The Upstream IF sometime are not the GRE tunnels that the spokes use to send multicast .Any  configuration to force  the spokes to use only a specific GRE between spoke to hubs? RPF seems ignore static routing and policies.Policies and static routing have been configured but RPF neighbor is sometime wrong.  What do I need to use? Policy routing?      

Hello Forti guys, I have a physical Fortimail 400E server mode and we would like to migrate to the new Fortimail 1000D server mode. 1) Is 400E Compatible with 1000D to backup and restore configuration?2) How to backup and restore mailboxes of all users from 400E to 1000D?3) The migration can be one shoot or will be divided into phases of testing? The migration project is stopped due to backup and restore mailboxes from the old appliance to the new one.  Thank you. 

Hello team!!! Is there a way to enable 2 factor authentication for admins with other than local Users?As suggested by Fortinet, I created an AD group, added the AD Group to the local group, and added the local group as admin in System->AdministratorsWith local users I have the "Two factor authentication" option in the gui, but this option is not available with this group, also tried to configure two factor autentication from the cli but "set two-factor" is not possible with this group. Any suggestion?Regards,Damián

 Hello,I have a FortiGate 60E appliance on which I am trying to enable SAML sign-on for the SSL-VPN portal. I have followed the steps in Fortinet's guide, as well as verifying everything using Microsoft's guide. SAML SSO does technically work, but it authenticates everyone as the "azure" user. Here are my configs:FortiGate Side:FW (saml) # show full config user saml edit "azure" set cert "{CERT}" set entity-id "https://{FQDN}:8443/remote/saml/metadata"; set single-sign-on-url "https://{FQDN}:8443/remote/saml/login"; set single-logout-url "https://{FQDN}:8443/remote/saml/logout"; set idp-entity-id "https://sts.windows.net/{GUID}"; set idp-single-sign-on-url "https://login.microsoftonline.com/{GUID}/saml2"; set idp-single-logout-url "https://login.microsoftonline.com/{GUID}/saml2"; set idp-cert "REMOTE_Cert_1" set user-name "username" set group-name "group" next end edit "AAD-