Solved

I have a created a Firewall Policy to block some URLs, and selected "certificate-Inspection" for SSL. When a client PC tries to access the blocked URLs, I want them to view our custom 'access denied' page but instead Edge/Chrome gives this error page instead. How do i fix this? A step by step instruction would be great.   

I'm running FortiClient to connect from home to my organization's VPN.  Everything works fine when my laptop is connected via wifi.  However, if I plug the ethernet cable (from the very same home network) into the laptop and connect FortiClient, I cannot connect to any of my organization's servers, even though the VPN connection succeeds and is reporting an active connection. Any ideas?

Could someone clarify what the licensing options are for a FortiAP-U Series that is managed by a FortiGate?Can I use it without any supplemental license like any other FortiAP (except a Forticare license for hardware support if I need it) or I MUST buy a supplemental license also if don't need the supplemental Universal Threat Protection it could offer? Thank you very much for your help.

Good morning,I'm having trouble connecting to the Fortinet Single sign on agent on Domain Controller. The firewall fails to connect correctly with the SSOA on the domain controller. On DC the firewall (windows) it's off, port 8000/8002 are ok.Collector Agent status on DC is RUNNING,but when I click on the "show log on user" the system respond: "Time out when getting logon user list" Password require from Fortigate it's ok.Ldap server on port 389 it's ok. When click on "Show Monitored DCs" ---> Time out when getting DC agent status. The log application error: ldaplib::ldap_connect failed to connect to DC:3268 with error code 0x51. can anyone help me ? Tnx       

Hello team!!! Just a basic questionWe have a third party certificate issued from a trusteed certificate authority, for our web server.Is it possible to use the same certificate for doing deep inspection in outgoing fortigate policies?  Is there any requirement for this certificate to work?What are the steps to import this certificate into a Fortigate in 7.2.1 ? Thanks in advance.Regards,Damián 

Hello everyone,I apologize because I am using the translator to request help. I clarify that I do not have knowledge in fortinet not am I an administrator of one of these devices, I am an administrator of a SIEM and I am currently receiving the UTM type logs through Syslog and I see that within this log the origin country and destination country fields do not arrive . I would like to know if there is any way for this field to be included to send the request to the administrator of said firewall I exactly need to know which IPs are from Russia since I need to get a report of the incoming and outgoing connections from this country to the firewall tnx

Hello I have created 2 new policies for GEOblocking but there is no sequence group created for that. I know it is not needed, but I do like to keep the book keeping sound. How can I create a new one? I only see the ability to rename or delete.I would like to create one titled "GEOblocking & deny" Thank you  

Hello, I can't seem to find any questions quite like mine, and I apologize if I have missed them. Fortigate 300D - 6.0.4 We are setting up a SSL VPN with Split Tunneling. I can route our internal networks and some public IP Addresses through the tunnel. That much is easy. What I am trying to find out is if I can switch this around? So I would specify 0.0.0.0/0 to go through the tunnel, but then specify IPs, or FQDNs out through the endpoints local ISP. Specifically Microsoft Office 365 traffic. The reason I am thinking this way is because we currently have no control of internet access at the endpoint, like WebFilter/AppControl using FortiClient. Something I hope to get soon, but having to wait. I don't like the idea of internet access outside of the corp net that I cannot control. And this is why we don't use Split-Tunneling. Feel free to change my mind here, I might be barking up the wrong tree. If I had EMS I wouldn't be doing this. Many thanks!

Recently we added a new fortinet device to our fortinet support account, but why does it shows only the trial license of 90 days ?Warranty Support Start Event - Initial Registration of SN at support.fortinet.comIs there any thing else we need to do to fully register the new hardware. 

Hi,Is it possible to install (any existing feature or service or script) to use the device itself as a tiny simple MTA to send its necessary emails without connecting to another MTA like exchange server or so? This is possible on many devices and software. Regards, 

I have setup two sites with a Fortgate 100F device (7.0.5) at each site. I have set-up and have operational a vxlan connection between the two sites over an IPSEC tunnel. At site A there is a monitoring VM with a fixed IP address (192.168.200.2/24 GW 192.168.200.1) and at site B a test VM with a fixed IP address 192.168.200.3/24 GW 192.168.200.1) The issue I have is the test VM is unable to ping the GW IP address 192.168.200.1 or anything beyond the GW) The testing at the moment is: The Monitoring VM (192.168.200.2) is able to ping the test VM (192.168.200.3)The Monitoring VM (192.168.200.2) is able to ping the GW (192.168.200.1)The Monitoring VM (192.168.200.2) is able to ping 8.8.8.8Can RDP from Monitoring VM (192.168.200.2) to Test VM (192.168.200.3)The Test VM (192.168.200.3) is able to ping the Monitoring VM (192.168.200.2)The Test VM (192.168.200.3) is able to ping other devices at Site A in the 192.168.200.x/24 rangeThe Test VM (192.168.200.3) is unable

Hi, I've been using FortiClient VPN on Ubuntu 20.04 and have no problems. Last week I have installed Ubuntu 22.04 from scratch and have several issues connecting to company VPN.  Today I've manage to connect to company VPN but no `bytes received` has to come.Logs shows, that some routes are failed to add:e.g. [sslvpn:DEBG] route:475 Failed add route: addr XX.X.X.X netmask 255.255.0.0 gw XX.X.XXX.X dev vpnthis command fails several times. Could someone help me with this? Also sometimes connecion is not established and have this error in logs: [sslvpn:DEBG] main:1457 exception: Backup routing table failed Regards.

Hi, I've a very huge problem about admin rights. I've a new costumer with a Fortigate firewall and i've reset the fortigate admin password(because they didn't had);.. but i still haven't the full super_admin permission. In fact the account can't see Administrators profile and i figured out that the admin account is an prof_admin.Is it possible to change an admin account from prof_admin to super admin? In the past i've done with a backup config but i had the backup file. Now i've no config backups files and no way to backup or restore fortigate config with the prof_admin account. I'm also wondering if there is another hidden account as super_admin? I'm very stuck in this bad situation and i can't do a factory reset.

Hi,Two things on my mind 1- Is that possible to set a device to get definitions update from the others? I have a few live fortiguard connected devices but some others who should not have direct Internet connection but can contact the firstly mentioned devices, So I'd like them to get definitions update automatically / scheduled from the live devices. And I need to have this with no extra cost of fortimanager or other devices / software. 2- Is there a simple way such as an script or a feature (again with no extra cost of fortimanager or so) to have a report from definitions update or other info like systems firmware / uptime and so ? Maybe via emailing them, having them in a SNMP software or using an API or a web page? Regards, 

Firmware: v6.4.9 build1966 (GA)Firewall: Fortigate-40FI need to connect two ISPs in firewall. I want to use these two ISPs separately. Means ISP1 will only work with 8/10 computers (according to my choice) and ISP2 with 10computers or more  both ISPs have their own switch (unmanaged) that is, sw1 and sw2. Whichever ISP I want to use I have to connect with that switch. Its not possible for me to give mix ISPs to PCs or servers (sometime ISP 1 and sometime ISP2)I have configured like this:Internet1 (WAN) to lan1Internet2 (lan3) to lan2Both internet interfaces are in DHCP mode and both LAN interfaces are in manual mode with "DHCP server" ON for assigning address range. I have created two static routes for two internets. Two separate policies (internet1 to lan1 and internet2 to lan2).The problem I am facing is only one internet is working at a time. What I have noticed is two static routes (Internet1 & internet2) is creating issue. If disable one static route, internet which stati

Can i export reports from old Analyzer 200D to my new Analyzer 300G so that i dont have to re-create all the reports 

Hi Team, We have a fortigate 3200D - v6.0.10 manage via Fortimanager v6.2.8. We have noticed the config status as "conflict" in Fortimanager and a popup of "device config out of sync".Could someone advise what can be done to resolve this issue?I have attached a screenshot for ref. 

Hello - assuming that many companies use Cisco Umbrella DNS, does anyone know if FNT plans to add these to their ISDB list? Thank you...

Is there a place where I can see solutions to commonly hit problems in FortiSOAR?

Upgraded FAZ from 6.4.7 to 7.0.4. The device is receiving logs from several FortiGates without issue, but now I noticed the out of box and previous filters (srcip, dstip, host name, etc..) under ‘Log View -> FortiGate -> Traffic’ is gone. Am I missing a setting to re-enable those or were they removed for version 7? Thanks!

Hi team, Please I can't find the manage image under replcament message in fortiGate 5.6.14 for e specific VDOM.Please any help or should be just under the global VDOM or need any feature to be activated. Thanks in advance.

Hi guys, I have a config file backed up from my forticlient VPN software (including many connections). Is there any way to restore this config file to machines on my Domain controller so I don't need to go to each machine and restore manually each one?  Thank you!

Hi All, We came to notice that after we updated the FortiManager from 7.0.6 to 7.2.0 the time field is showing an incorrect date. Instead of seeing the Time/Date stamp we now see it counting up in hours. (See screenshot) Is this already a known bug at Forti?  

hi all, Im new to the fortigate products and have not been able to find the answer online. Im wondering if DNAT/VIP is supported on the 40F firewall? I'd imagine so but I cannot find a confirmation online and the Feature/Platform matrix doesnt mention anything. Do it mean this feature is unquestionably supported on all firewall platforms? cheers.

Hi, Guys, I am using Fortigate 400E HA with FortiOS V7.0.3 and some SDWAN configurations; but found the local NTP servers do not work for LANs, as the following: Forti400e_01 # config system dnsForti400e_01 (dns) # showconfig system dnsset primary 208.91.112.53set secondary 208.91.112.52endForti400e_01 (dns) # end Forti400e_01 # diag sys ntp statusHA primary: yes, HA primary ip: 1.0.0.0, management_vfid: 0 ha_direct=0, ha_mgmt_vfid=-1synchronized: yes, ntpsync: enabled, server-mode: enabledipv4 server(ntp1.fortiguard.com) 208.91.112.61 -- reachable(0xc1) S:2 T:97server-version=4, stratum=2reference time is e6a5da97.d048a955 -- UTC Tue Aug 16 08:57:59 2022clock offset is -0.000284 sec, root delay is 0.127930 secroot dispersion is 0.011673 sec, peer dispersion is 524290 msecipv4 server(ntp2.fortiguard.com) 208.91.112.62 -- reachable(0x80) S:2 T:106server-version=4, stratum=2reference time is e6a5da97.d048a955 -- UTC Tue Aug 16 08:57:59 2022clock offset is 0.004056 sec, roo