Solved

Dear Fortinet Community. We have upgraded our Fortiagte 100F from version 7.4.0 to 7.4.4. After that it seems so that users which we have defined to get mails for 2FA when connecting to SSL VPN will not receive emails with the 2FA code anymore. Other emails for triggers for instance still work. So it does not seem to be a mail account issue. But the emails with the 2FA code will not be sent anymore. I have created a testuser in order to check it. Mails will not received and they are not in SPAM or Quarantine or so. Does anyone of you have ever experieced this? Or probably know a solution for this circumstance? Any answer or hint is much appreciated. With kindest RegardsFortiLover :)

Hi FG-OT adminsIn OT security study guide, page 39, Asset Identity Center,When we organize the devices in their corresponding levels (Perdue Model), does it actually have any added value on how the traffic is filtered or how it is monitored or whatever?

Hello. We are planning to implement #FortiPAM through a Korean vendor and have a few questions regarding its compatibility with custom applications. Our network environment consists of separate IT and OT (Operational Technology) networks, controlled by firewall. While we understand that #FortiPAM can easily register and manage known applications and ports (such as MS SQL with port 1433), we're curious about its capability to handle custom-developed, private applications. Specifically:Is it possible to register and manage custom-developed applications in #FortiPAM, similar to how we would with well-known applications?We have a use case where a user in the IT network has developed an automation program to retrieve and analyze data from the OT network. Can we register this custom automation program in #FortiPAM?If custom application registration is possible, can we also specify and manage the specific ports used by these applications through #FortiPAM?Are there an

I have Fortigates in Azure deployed as per below scenario: Active-passive with external and internal Azure load balancer (LB) Can session synchronization happen between Fortigates? If YES how? If NO Why? 

Hello all,The past night Forticlient 7.0.1 update was pushed via EMS and now inside of Defender we are seeing multiple endpoints reporting that: Defender detected and terminated active 'Trojan:Win32/SuspServiceBin.A!cl' in process 'FortiClientSetup_7.0.1_x64.exe' It is also saying that:FortiClientSetup_7.0.1_x64.exe - 'SuspServiceBin' malware was detected and was active I know I can whitelist what I need to in defender, but I want to know if anyone else has come across this/seen this to get a better understanding as to why this would be. 

Good morning all,I am running into an issue where our Fortigate's firewall policy is blocking employees from logging into ticketmaster.com When they try to login they are met with a screen that says: Your Browsing Activity Has Been Paused We've detected unusual behavior on either your network or your browser.To resolve this:Sign in to your Ticketmaster account if you haven't alreadyChange your Wi-Fi or cellular networkSwitch devices or move to a different location if possible I have attemtped to add a policy rule that will stop all traffic from our lan to the wan with a destination of ticketmaster.com from being scanned by the various services, but it does not seem to fix the issue. Has anyone else ran into this? Or do you have another idea I can try?Thanks so much

Greetings, community. I hope you are doing well. I am trying to reach a Fortigate 80F through the LINKDDNS, but I am unable to access the device. However, when I ping the public IP and the LINKDDNS of the device, I do not experience any packet loss.

Our recent vulnerability scan has pointed out we need to set timeout outs for:- console sessionsSSH HTTPSadmin services Looks like this has to be done through the CLIHave viewed some documents but is there a way to set them all to the same time? Thanks 

Hi, I'm configuring my first FortiNAC.I manually installed the Persistent agent on a test PC (OS Windows 11), according to the instructions found in https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Manually-install-and-configure-Persistent-Agent-on/ta-p/191164It seems that the agent does not communicate with the Fortinac.From the PC, telnet to eth1 fortinac on port 4568 is ok.In the %ProgramData%\Bradford Networks folder I do not find any log files. As suggested I reinstalled the client but without success. Icon of Persistent agent say: Network access normal. PC is viewed as rogue. Could you help me? Thanks in advance.

Hello ,  I have DC agent installed on the Domain Controller, and FAC debug indicate that it's getting the user and workstation details, but that it cannot resolve the DNS name for the workstation domain error below from FAC FSSO debug ( FAC is acting as collector agent ) any ideas or tips on where to look?the workstation domain name is like mydomain.subdomain.local, so I have added subsomain.local to the DNS suffix in the DC agent config page, but still with no luck. appreciate anyone's help. Thanks01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded workstation: WKS0101/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded domain: MYDOMAIN01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded user: userx01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: has 0 ipv6 address01/21/2022 15:32:04 [F4555555] DC/TS Agent [WARN]: cannot get DNS name of domain MYDOMAIN from Domain Manager01/21/2022 15:32:04 [F4555555] DC/TS Agent [WARN]: Failed to decode DCTS

Hi All,My case is that our branch company will be closed. Valuable assets may be transported to ourheadquarter in another country. Is there any limitation if we move our  firewall to another country? If we are going to buy new license, who should we buy from? The original seller or the seller in another country? Looking forward to your answer. Thanks.

Hello community,I need yours help, when i make FortiGate-VM64-AWS (interface) #edit port1  set mode dhcpthen i getting this errorThis interface is being used by one or more dhcp servers.attribute set operator error, -236, discard the settingCommand fail. Return code 1

hi,i recently did a HA firmware upgrade following an upgrade path.the selection of HA primary kept changing due to high uptime.my question is, do i need to keep "forcing" back HA to original primary or just proceed to upload the firmware on the current primary (secondary unit).the serial with 795 is the original primary/active and 836 is the secondary/passive. # get system ha statusHA Health Status: OKModel: FortiGate-xxFMode: HA A-PGroup Name: xxFW01_CLUSTERGroup ID: 0Debug: 0Cluster Uptime: 264 days 9:33:6Cluster state change time: 2024-10-03 15:04:23Primary selected using:<2024/10/03 15:04:23> vcluster-1: FGxx836 is selected as the primary because its uptime is larger than peer member FGxx795.<2024/10/03 15:01:40> vcluster-1: FGxx836 is selected as the primary because it's the only member in the cluster.<2024/10/03 15:01:31> vcluster-1: FGxx836 is selected as the primary because UPGRADE_SECONDARY flag is set on peer member FGxx795.<2024/10/03 14:59:19> v

Hi, I have to import rules to a production SIEM.  Many of these rules contains a eventType IN (Group@PH_SYS_EVENT_Group). We have noticed those conditons are broken when imported in the new SIEM and we have to remap them manually to the event type group. My question:  Is there a quicker way to make those statements working? Thanks,

Hi everyone,I`m new to forum :)My question is:Is there a way to drop (not block) external traffic into my WAN without logging it?By country or by IP range or single IP?The goal is to block certain IPs so they can't even port scan my firewall.I can`t find too much apart from Deny ipv4 policy which still logs everything.I have Fortigate 60F.Thanks

Hello Community,we do have a problem with EMS. It suddenly stopped letting users log in to EMS and getting a valid license for FortiClient. Dashboard show 0 from 100 used. Licenses are still valid till 2026. We already created a ticket, but the answer by now was upgrading EMS from 7.2.0  to 7.2.5. and try to resync the FortiCloud or uploading the .lic file manually.The last two things did not help. We already did this before opening a ticket.Does anybody knows this issue and were to look for any informations? Setting the Log Level to debug doesn´t show me anything interesting.EMS services and SQL is running.I would like to troubleshoot the issue not only upgrading, because I can´t find anything in Release Notes about that issue and I´m afraid of breaking even more.Users, partially, have just white screens, if they open the Forticlient console. So, there is no change to retype a password if needed.Forticlient version is also 7.2.0 (Windows 10/11) Thanks,Thomas

Hi All !On my FG201F device dashboard, I see the status of "System DNS Servers" has unstable latency (sometimes very high). It seems to be affecting our network performance.Note: This device is running firmware "v7.4.5 build2702 (Mature)" with 4 Internet lines (divided into 3 SD-WAN groups), the system is also divided into VLANs.Could you please assist us in diagnosing this issue? Any guidance on potential configurations or troubleshooting steps would be greatly appreciated.Thank you for support.

Hi All, General question about memory optimization and firmware. I have a 60E that does a lot of work and runs quite high in memory, and has recently started hitting mem conserve mode. I'm aware there are a few ways to bring the memory down, and I am exploring those, but what about firmware? Are there any memory efficiency gains from potentially updating firmware from 7.0.11 to another version? If so, would Fortinet be able to advise which version to try upgrading to? Cheers 

Hi, We have a simple architecture :- a wan int for incoming request to our servers with static nat- several int for internal servers and users ressources- a single default route for outgoing and reverse traffic- several static routes for different ressources and sites All goes well. We recently had to manage a new public range, with new internal servers. For different internal reasons, the two public wan have to be separated and using the same vdom. We dedicated a wan int to the new range. Default route is still on the old one.When we try to reach the new public int from outside, the famous "msg="reverse path check fail, drop"" raised. Doc : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Detailed-Guide-on-dual-WAN-setup-for-targeted/ta-p/276308 was very good information, but does it apply only for egress traffic, or is it for ingress traffic too ? In other words, we want to expose services on internet on two separates wan int on the same vdom. B

I've been having issues getting my AP to work while building my network. I have a Fortigate 40F connected to a Fortiswitch 108F connected to a a FortiAP 221E. The Fortigate is running 6.4.15 and the AP is running 6.0. The AP shows up in the Wifi/Switch controller > Managed FortiAPs and shows that it is online. Its broadcasting the SSID I setup, but when I connect to it, it shows connected with no wifi. It also has a VLAN with a manual IP config.I'm confused and need help, would anyone know why this would be doing this?Also does anyone know how to delete VLANS, its not giving me the option to delete them. I want to try and put them on the fortigate instead of the switch

I am accessing the site when I go to generate a file to download it does not download, would there be any way I can check and the domain is blocked, I did the release of the site, it was already F12 in Sources and nothing.

Hello,I’m experiencing an issue with my FortiAP after performing a reset, changing the password, and configuring a static IP address. When I connect or add the FortiAP to the FortiGate and try to log in to the FortiAP, the password I set no longer works.Additionally, I am unable to access the FortiAP via SSH because the password is being rejected.Could you please help me resolve this issue?Thank you in advance for your assistance.

Hello everyone, I’m back with another issue related to FortiNAC... In the client's network infrastructure where FortiNAC is deployed, there is an Explicit Proxy configured on the FortiGate.If I disable the proxy on the test machine, the FortiNAC Captive Portal appears as expected. However, when the proxy is enabled, the traffic bypasses FortiNAC entirely, and I can browse the internet without being redirected to the Captive Portal. I’ve tried creating Proxy Policies to deny traffic from the isolation VLAN subnet, but this still bypasses the FortiNAC registration portal, and I receive an error indicating that internet access is blocked. Is it possible to forward traffic from the FortiGate proxy to FortiNAC? I couldn't find any reference to "proxy" in the allowaccess settings for FortiNAC's port2 interface.Thank you very much for your help!

132>1 2024-09-30T19:28:50.597024Z adadsads61.irasp.etta asd.asdt.gads.asda.com NILVALUE NILVALUE - {"adf":true,"significant":0,"udf":false,"virtualservice":"virtualservice-333afa37-f201-4d1c-bc3f-3fe7a5e337fa","report_timestamp":"2024-09-30T19:28:50.597024Z","service_engine":"z9900001awaf401-se-jmonv","vcpu_id":0,"log_id":123935,"client_ip":"199.19.253.11","client_src_port":25458,"client_dest_port":443,"client_rtt":8,"ssl_version":"TLSv1.3","ssl_cipher":"TLS_AES_256_GCM_SHA384","sni_hostname":"asd.asdt.gads.asda.com","request_state":"AVI_HTTP_REQUEST_STATE_SSL_HANDSHAKING","significant_log":["ADF_CLIENT_CONNECTION_CLOSED_BEFORE_REQUEST"],"vs_ip":"1.1.111.10","ocsp_status_resp_sent":true,"max_ingress_latency_fe":0,"avg_ingress_latency_fe":0,"conn_est_time_fe":8,"source_ip":"199.19.253.11","vs_name":"asd.asdt.gads.asda.com"}

Hi all. Ive been setting up brand new Fortigate 100F.There is only one cable between them: HA port 1 to HA port 1. However it keep saying out of sync because of the table  ips.sensor.I have seen this before on 70F aswell. Im running v7.2.8 build1639 (Mature) I have tried to recalculate #diagnose sys ha checksum recalculate but no result.