Solved

Hello, I understand that even if a a Telco Internet circuit supports a standard MTU of 1500 and fragmentation is either not supported or reliable, that this is irrelevant to the fragmentation that may take place on traffic passing via a Fortigate IPSEC tunnel across that Internet circuit i.e. the two concepts are separate.So, you could have a telco Internet circuit with 1500 MTU and no fragmentation support, but fragmentation can still work WITHIN the Fortigate established IPSEC tunnel.Am I correct in this thinking ?Thank you kindly. 

I need to create some kind of notifications that an email with specific words in subject or in body was sent to any email address. I managed to achieve it with Archive account. I've created an Archive account which is forwarding email to another email address and I've created a policy that is archiving emails based on Subject and Body pattern. It works fine if the word in subject or body is equal to the word I've entered in pattern on policy. For example I've created Policy with Policy Type Subject and in Pattern I've enter word: bomb The policy works fine for example for a subject like this: I've sent a bomb to you. Email is properly forwarded to email address I've entered in Archive account. However the policy is not working for subject like this: I've sent few bombs to you. I've tried entering *bomb* in pattern but it's not working. Is it possible to use WILDCARDS in this policy patterns or REGEXP expresions? Or is there any other way to

Hello, I have a FortiGate 100F, and my license will expire on February 3, 2025. Is it possible to add a trial license for temporary use? #fortinet #license #fortigate #100f #trial.

The USB modem, which successfully establishes communication on FortiGate 50E and 60E, is not recognized on FortiGate 60F.    FortiGate 50E / OS 6.2.15 .... OK    FortiGate 60E / OS 7.2.5 .... OK    FortiGate 60F / OS 7.2.5 .... NG!On 60F, "Modem failed to open" is repeatedly logged in the system log.Although 60E and 60F have the same OS, only 60F does not recognize the modem. I am confused! #Restored to factory settings and applied only the following configurat#This modem mode switching is not necessary.config system 3g-modem customedit 1    set vendor "SORACOM"    set model "SC-QGLC4-C1"    set vendor-id 2c7c    set product-id 0125    nextendconfig system modem    set status enable    set auto-dial enable    set wireless-port 3    set phone1 "*99#"    set username1 "sora"    set passwd1 ENC xxxxx    set extra-init1 "AT+CGDCONT=1,\"I

Hi, So our fortigate cluster restarted last night. We got the following messages over SNMP :FortiGate: Device has been replaced (new serial number received)FortiGate: System name has changed (new name: xxx-fw1-n1.xxx.net)FortiGate: xxx-fw1 has been restarted (uptime < 10m) This also meant one of our VPN tunnels went down and which generated an alarm. What might have happened here?

Hi, I am trying to configure LDAP for user authentication against AD. This works fine for users that are directly member of the group that is mentioned in the User Group configuration. The design, however, is that a user is member of a Role and the Role is member of the group. When I have this configured in AD it does not work anymore. When I make the user a direct member of the group again it works. How to get this working? Regards, Wim

Hello, I'm configuring ldap server on a fortigate v 7.6.x.The ldap server is behind IPSec VPN. The clients on the LAN already contact the server in question as they have made domain joins and use that ip as the DNS of their network card.When I go to configure the ldap bind to ‘ip_LDAPServer’ on port 389 this fails. Do you have any suggestions? Thanks fort the supportBR

Hello everyone, While upgrading FortiClients on Debian-based machines, I encountered a problem that I would like to share with you here to find possible solutions or workarounds.In the official Fortinet documentation for FortiClient version 7.4 for Linux-based systems (https://docs.fortinet.com/document/forticlient/7.4.2/linux-release-notes/213138/install-forticlient-linux-from-repo-fortinet-com), the following command is given to add the GPG key for installation on Debian-based systems:wget -O - https://repo.fortinet.com/repo/forticlient/7.4/debian/DEB-GPG-KEY | gpg --dearmor | sudo tee /usr/share/keyrings/repo.fortinet.com.gpgWhen execute the following error is shown:Connection established to repo.fortinet.com (repo.fortinet.com)|208.91.114.61|:443 ... connected.HTTP request sent, waiting for response ... 404 Not Found On Fortinet's official download page for version 7.4 (https://www.fortinet.com/support/product-downloads/linux ), Debian-based distributions are not sho

Greetings, we're currently trying to build our new IPsec VPN Config coming from SSL-VPN.While reading the XML Reference Guide for configuring IPsec i stumbled upon an Inconsistency on "implied_SPDO" The "<implied_SPDO>" and the "<implied_SPDO_timeout>" literally contradict each other.For example on: https://docs.fortinet.com/document/forticlient/7.4.2/xml-reference-guide/96295 (however its the same on all Versions that i looked at) implied_SPDO states that Internettraffic is allowed when its set to 1.implied_SPDO_timeout however states  that "FortiClient blocks all outbound non-IKE packets when <implied_SPDO> is set to 1" and "Thus, setting <implied_SPDO> to 1 may have the side effect of blocking access to the captive portal, which in turn blocks access to the IPsec VPN server" Which makes no sense, according to various KB Articles here this looks like that non-IKE packets are allowed whe

Hi, in case any banking customer located in particular country and while initializing Fortisase portal we select same country pop only. Can we select additional pop location later on as per the requirement ?Also what to do if there is no logging pop location within the country. As customer belongs to banking sector will not allow to select logging to another country's pop.Pleas guide.. 

Hello, I have some old Fortigate equipment that need the latest version of the firmware, and I just noticed that Fortinet does not provide it until I have a support contract. Is this true? and I need to purchase the contract to download it for my old equipment?

HiI added a personal VPN connection to my FortiClient EMS. It connects to the VPN and everything looks ok. But when i do a route print it hasnt addad any interface, gateway or routes for the VPN. The corprate VPN works fine though.What can the problem be?If I do the exact same with another computer the personal VPN works fine, so it seems that it has something to do with my computer.Both computers have fresh updated Windows 11 on the same network. I have tried different versions of the FortiClient, both non-EMS clients and versions from 7.0.1 to the newest. Turned of the firewall. Nothing helps.It looks like the FortiClient isnt allowed to add the routes for my personal VPN, but only on this one PC?Any help or suggestions are appreciated. /Anders

May I create two different ssl-vpn portals with two different ports? For examples 10443 and 11443.

Hello, Fortigate 600 v7.2.9.Ports 1 and 2 on the Fortigate are not yet in use. I activate both.I plug PC1 into port 1 and PC2 and port 2.Should the two PCs be able to talk to each other now (of course I gave them both an IP address from the same network)? So are they in the same Layer 2 network?Or do you have to tell the Fortigate that ports 1 and 2 should be in the same vLAN, so to speak.I'm not actually talking about ports, but rather aggregates, but the logic should be the same. ThanksAlbMin

Hi all,it's possible to create an email warning message (on the fortigate or fortianalyzer) when the interface limit has been exceeded over 2 minute? Thank's in advanceMaurizio

Dear community,  anybody using Fortigate API to retrieve log traffic with this endpoint : /api/v2/log/disk/traffic/forward/system?filter=srcip==10.227.108.88&rows=10 I can get logs for a specific source or destination IP, but do you know anyway to get logs for a network ( example : 10.0.0.0/8) ? Running version :"version":"v7.2.10","build":1706 Thanks in advance for your help ;)  Looking the FortiDev documentation, only available filters are the following, but they didn't make the trick to filter on network after several test : filterarray[string] (query)Filtering multiple key/value pairsOperator | Description== | Case insensitive match with pattern.!= | Does not match with pattern (case insensitive).=@ | Pattern found in object value (case insensitive).!@ | Pattern not found in object value (case insensitive).<= | Value must be less than or equal to pattern.< | Value must be less than pattern..>= | Value must be greater th

Team, I have all the required licensing for FortiSASE (advanced, SPA etc) and have a requirement to provide access to private resources (RDP) for contractors (non-managed devices). Before I go down this route, is this a supported configuration using agentless ZTNA? Or am I better placed to leverage a different solution?TIA.Justin. 

Hello, I am looking for older version of FortiClient VPN version 7.0.8.0427. Can someone please help me with the information about where I can get the software.Thanks,VRG

I tested SSL-VPN and IPsec Remote Access with Fortigate VM Evaluation.But,it didn't work both.Is that Evaluation limitation?I found Restrictions,as "Support low encryption operation only",that means I can't use  SSL-VPN and IPsec Remote Access?

LS,I'm trying to install a new GUEST SSID using the fortimanager, 7.2.8.------- Start to retry -------- FW003 $ config wireless-controller vap FW003 (vap) $ edit "WK-GUEST" FW003 (WK-GUEST) $ config mac-filter-list FW003 (mac-filter-list) $ edit 1 FW003 (1) $ next FW003 (mac-filter-list) $ end FW003 (WK-GUEST) $ next FW003 (vap) $ end ---> generating verification report ( wireless-controller vap mac-filter-list ) add entry 1 <--- done generating verification report install failedAny thoughts?

Hi @Anonymous,Can someone help me figure out how to get the currently logged-in user details through a playbook in FortiSOAR?Thanks.

We would like to delete the default admin accounts on FortiManager, FortiAuthenticator, FortiAnalyzer and FortiClientEMS and replace them with another generic account for security reasons. Is it safe for all these systems to delete the default user admin? For FortiManager and FortiAuthenticator I can see inside the logs that there are some actions performed by the admin user internally from the system. So I would like to ensure that deleting the account won't break something. Kind reagards

I have a internal (default) network 10.25.0.0/24 on port 1 and 2. I created a new network 10.20.10.0/24 on port 3.  Clients connected to the internal network can ping the Fortigate gateway 10.25.0.1.  Clients connected to the network on Port 3 cannot ping the Fortigate gateway 10.25.10.1.  The clients can all access the internet no issues.  In Administrative Access area of the interface configuration for Port 3, I have HTTPS, SSH, PING and Security Fabric Connection checked. Why can't my connected DHCP clients ping the gateway 10.25.10.1?  I can ping this address from CLI from within the firewall no issue (execute ping 10.25.10.1).  What am I missing? Also how do I setup a one way route so that a connection to 10.25.10.X can be initiated from the 10.25.0.X network, but not vise versa? Any help would be appreciated. Thanks!

DNS-DatabaseType: PrimaryView: ShadowDNS records within my private network.A erp 192.168.1.200A erp 192.168.1.201cmd: nslookup erp.exsampledomain.com192.168.1.201192.168.1.200always final a-erp-record like above.DNS round-robin is not working.How to set ?Regards

Hi everyone,I am facing a strange issue here: One of our laptops has bad network quality on MSTeams as soon as FortiClient is connected to EMS.The issue seems to appear only on WLAN, when Ethernet is connected via dockingstation (usb-c) everything works fine. But as soon as the user moves to another location and uses WiFi MSTeams has lot of dropouts when on a call. I tried disabling all security profiles but the issue still appears.Only thing that help is disconnecting the client from EMS in the zero trust telemetry section from FortiClient.I also tried the versions 7.0.x and 7.2.x. Any ideas?The affected device is a Dell Precision 7680 with an Intel(R) Wi-Fi 6E AX211 card... I have found some older issues (2 years old) with FortiClient and Intel wifi cards but nothing related to MSTeams...