Solved

Hi, I need to install FortiClient to access a clients network. I have downloaded the newest version of the client but every time I try to install it gets to the point of " Starting services" then fails and rolls back the installation. The installer gives no indication of any error. The windows event log contains " Windows Installer installed the product. Product Name: FortiClient. Product Version: 5.0.1.0194. Product Language: 1033. Manufacturer: Fortinet Inc. Installation success or error status: 1603." I have full admin on my machine and I am trying to install into the standard program files folder. Anyone any ideas?

hello, we have a fgt-40f. we also use voip and it looks like that SIP ALG blocks it. on web GUI i couldn't find anywhere to disable it. tried several forum but most of them are for old firmware current firmware is v6.2.5  can anyone send a configuration how to disable it ?

Is anyone using FortiCloud Multi Tenancy service for a Managed Service Provider (MSP) to be able to create and manage multiple SubAccounts? I would like to use a FortiManager for customers FortiGate and FortiAP units but the cost is fairly high. I was told that the FortiCloud – MultiTenancy Account might be useful in lieu of the FortiManager. Are others using this? How effective is it?

Hi!   I configured a automation action on my Fortigate (6.2). The automation was configure to send a e-mail when a interface status change. The notifications is work well, but a questions is that on email not inform whic interface had the status change. Below the mensage that I recived from fortigate.   "FGT[FG200ETK189xxxxx] Automation Stitch:Interface_Status_Change is triggered. %%Interface JGS Status Change%%"   Is possible recive the interface name information?

I have a user where this file has grown to over 200GB. Is there a way to compress or delete the file to free this ungodly amount of used space for a data file?

Can someone tell me what information I can check to see if there is no compatibility problem between an FG 600D that I want to update to version 6.4.3 and my FortiAPs that are in a version v6.0 build0037?

Hi,  I was trying to set an exception to one of the FortiGuard category based filters, some of the options that show up in the cookbook are not on my page. specifically under Status URL filter the URL Filter and Content Filter Options are missing. They show up in this document, https://docs.fortinet.com/document/fortigate/6.2.4/cookbook/725397/web-content-filter, but all I see is "Block invalid URLs" and "Block Malicious URLs discovered by ForiSandbox". Anyone have any idea why?  I'm on FOrtiOS version 6.2.4 Thanks. 

I have a FGT 200D running 6.0 and have used the 'set management-ip' command there to specify a local (non-syncd) IP address so that each unit in the cluster can be directly managed/monitored. Just got a new FGT 600E and am unable to apply the same command. It's not showing up in full output as an option, or using command completion. Checking the CLI reference log it shows as valid command for 6.2. https://docs.fortinet.com/document/fortigate/6.2.6/cli-reference/10620/system-interface Is there a pre-req before I can apply this command 6.2?

I want to create a VLAN.  I do not want to create a VLAN Interface.  I do not want routing/gateway capability.  I do not want the FortiSwitch/FortiGate to take an IP address on this VLAN. Is this possible?  I'm beginning to think that in the FortiWorld it is impossible to create a Layer2-only entity. Thank you, Chris

Hi, Has anyone worked through a similar problem on SD-WAN where the self-originated traffic isn't smart enough to pick the correct interface to get out ( internet ). I know this because running diagnose sniffer packet any "port 8888" 4 0 l we can see the device is trying to use the wrong port / sdwan member to talk to forticloud on port 8888. That's whats tricky with the self originated traffic when it doesn't work. In this case we have wan1, port1 and port2 as member interfaces for sd-wan. port1 and port2 are private circuits and wan1 is the internet gateway. Looking at its very obvious which interface has the internet gateway but the device wants to use every port except the correct one for the self traffic. :( All the user / client traffic is operating as it should.

Dear expertsCould anyone tell me why I can't see any entries in the fgHwSensors table for some devices? I can see it in our 1500d and 300d but not in an 100F.  They're running the same version. 1500D and 300D: 100F: In case the images above are blocked for CORS/throttle reasons, here's a link to all three:[link]https://imgur.com/a/ud7JIDv[/link] Any ideas? Kind regards,Patrik

Hi guys So my FG-60D running 5.2.3 has been at 100% CPU and about 90% memory recently so I thought I would run the diag sys top command as shown below.  From this command I can see that the scanunitd and IPS engine it taking most of my CPU usage. I don't have vulnerability scanner but I have AV enabled on 17 different policies. I think the box is being overworked, but can I restart any processes or do you guys have any other advice? Run Time: 42 days, 19 hours and 54 minutes 62U, 0N, 37S, 1I; 439T, 40F, 189KF scanunitd 7079 R < 68.4 3.7 ipsengine 602 S < 19.2 13.1 httpsd 7717 S 2.3 4.2 httpsd 7718 S 1.9 4.2 httpsd 7737 S 1.7 4.2 I also ran get sys performance - Output below CPU states: 75% user 25% system 0% nice 0% idle CPU0 states: 75% user 25% system 0% nice 0% idle Memory states: 93% used Average network usage: 6282 kbps in 1 minute, 2754 kbps in 10 minutes, 2200 kbps in 30 minutes Average sessions: 1995 sessions in 1 minute, 2178 sessi

HiWe are running version 6.2.3 on a fortigate 301EI want to use a different SSL certificate on an existing SSL inspection policy to only inspect the headers , not full inspection.I have created the csr on the FG,  got it signed by our trusted subca and imported it back into the FG as a local certificate successfully. It is now sitting in the FG cert store under local certificates. When i select security profilesSSH / SSL Inspection and select an existing profile , the settings are Multiple clients connecting to multiple serversSSL Certificate InspectionIn the CA certificate dropdown my new certificate does not appear in the list.  When i try and create a new one then upload it states the certificate already exists which it does. Does anybody have an idea why the new certificate is not showing in the drop down many thanks in advance mac

I have a FortiGate 61E at a remote site with a VPN tunnel back to my main site. I have had a problem where my Windows clients will detect a new network, and will identify it as "Network 3". That is, when you choose a type of Network in Windows 7, you choose from Home, Public, or Work, and then it gives the network a name. So it's almost as if the Windows machine thinks that the network has changed. This happens rather randomly throughout the day, several times a week, with different computers. Yesterday I was doing some troubleshooting and I discovered that it's selectively unable to reach *certain* networks through the VPN tunnel. If I do a traceroute, it's picking up an address of 192.168.0.1 between the local gateway (the FortiGate) and the remote end of the VPN tunnel. The packets are dropping at 192.168.0.1. I do not use this IP address anywhere in my network! Oddly enough, I can browse to this IP address, and it loads a Ubee Modem DOCSIS page. I called my ISP, Spectrum (formerly

Hello.  Can FortiNAC require that a computer be domain joined before getting an IP address or being allowed network access?  If it isn't, like a contractor or a visitor, I'd like the machine placed in a locked down guest vlan with only Internet access.  Thanks everyone!

Hi, i'm using this commanddiag sniffer packet any "host x.x.x.x" 6 0 ato capture some traffic, then convert the text file using the tool fgt2eth.exe to convert it to pcap.https://kb.fortinet.com/kb/documentLink.do?externalID=FD30877 Then... when I'm going to view it in wireshark, it shows TCP-out-of-order in all the capture.I try a lot of captures with different destination and in different firewalls (models 100d, 300d, 500d) same result. A lot of TCP Out-of-Order I'm doing something wrong? is not possible that in all my tests was errors in comunication.  Same result in all my captures from CLI.

Hello, I have an internal IIS server with one site configured with the following address (for example) : https://toto.test.frThe IP server is for example : 10.0.10.1The public ip address is for example : 1.1.1.1 I created the following virtual IPname : test external ip : 1.1.1.1internal ip : 10.0.10.1Port forwarding TCP : 443 to 443 Then I created my policy enabling all from external to access to test on service HTTPS. It's working but I would like to know how to enable the ping to toto.test.fr because currently it's not working.I tried to add a new virtual ip by selecting port forwarding ICMP and added ICMP+Ping  to my policy but it doesn't work. Regards,

We're using a few FortiGate 50E with FortiOS 5.6.2 and DNS filtering, which works great (properly enforces SafeSearch over SSL/TLS without requiring a local certificate to be installed). However, when Safe search is enforced, YouTube restrictions must be set to "strict" or "moderate". Even moderate YouTube restriction blocks LOTS of videos that aren't in any way problematic for a school. Is there a way to have Safe search enabled for search engines (Google, Bing, etc.) but not restrict YouTube?

Can not access Fortiguard seversHi, guys,   My Forti600E can not access Fortiguard servers ( for device registration, any Fortinet services), network infrastructure is:   The Forti600E has few network links : 1. The device is using Fortinet DNS services : 208.91.112.53 & 208.91.112.52 2. The default route (0.0.0.0/0.0.0.0) can point to internal network. 3. The route table to Fortinet DNS services are implicitly defined, as the following route table:   Forti600E-01 # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP            O - OSPF, IA - OSPF inter area            N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2            E1 - OSPF external type 1, E2 - OSPF external type 2            i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area     &nbsp

Hi, just after some help from anyone who has had some experience with VXLAN.I setup a VXLAN a while ago which worked fine but now has stopped passing traffic?  the ipsec tunnel is up but can only see traffic either side, ie not traversing the L2 VXLAN, it's a fairly simple setup, diag attachedAny help/suggestions appreciated.Dave

Several of our SSL-VPN Portals have been defined in the default realm (/). The title of the login page there is an inviting 'Please Login'.  For legal reasons, we want it to read 'unauthorized access is prohibited'. Is there a way to change this? Kind regards, Herta

Dear forum, I have a FortiGate 300E and a Fortimail 200E, love them both very much - great products! However I have an IPS Sensor issue regarding the signature "SMTP.Login.Brute.Force". On the FortiGate we have the IPv4 policy that controls smtp traffic to our spamfilter:Source: ALLDestination: SMTP VIP (External IP: X.X.X.X to Mapped IP 10.100.10.9, External Port 25 to Map port 25).Service: SMTP, SMTPSAction: AcceptSecurity Profiles: IPS (with IPS Signature SMTP.Login.Brute.Force, Quarantine 15 Minutes). On the FortiMail I see around 6000-7000 SMTP Auth Failed attempts every day, some are legit email addresses, but most are random names, which probably is someone trying to brute force login. Why does the IPS Sensor not stop this? I have tried custom signatures I found on these forums and put those into the IPS Sensor, with no luck : F-SBID( --attack_id 6228; --name POP3.Brute.Force; --protocol tcp; --service POP3; --flow from_server,reversed; --patte

The Fortinet Discussion Forums hold a wealth of information that has been helpful to users of Fortinet products.  We would be interested to know which of the posts, both old and new, you feel should be added into the Fortinet Knowledge Base. Regards,Admin.

Hi, I want to remove an IP Address from a Group and them delete that IP via CLI command, I try with the command exclude member but after exclude the member does not permit to delete the IP via CLI. There is a way to do that via CLI?. Regards,

hi guys according to  FortiOS-administrarion guide ver6.4.2 when using FQDN in firewall policy, the OS will gather and match related IP address to that FQDN and use them as a certain destination/source.photo #1,2here is my scenario : photo 3as i understand, according to my firewall rule ( photo 4) all client request (req1,2,3  ) to destination 5.5.5.5,4.4.4.4,6.6.66 will be blocked, even the request would be http://news.msn.comam i right ?