Solved

Hello!  So I am completely new to FortiClient, but its management in my organization has been dropped into my lap. There have been complaints from users that the time that they have to log into the VPN is too short. I am just looking to see where exactly that timer can be changed.  Thank you.

I am trying to set up automated backup over FTP on my FortiGate firewalls. I have the FTP server set up and running and have confirmed it is accessible through FileZilla. However when I enter the command through CLI I get an error message that I cannot decipher. Here is my command: execute backup full-config ftp [filename] [ftp-server] [username] [pword] And here is the error message I am receiving: Connect to ftp server 10.10.10.100:21 ...Please wait...Send config file to ftp server via vdom root failed.Command fail. Return code 5 I have searched but I cannot find anything specific to that error message. There are no entries in the log files on my FTP server, so it appears this error is directly related to the FortiGate.

Hi Guys, I have FortiClient/ZTNA working fine but I am having issues connecting to our internal VCenter applience. I was wondering if anyone has this setup and working? When we set it up we get this error when we go to the login page. [400] An error occurred while sending an authentication request to the vCenter Single Sign-On server- An error occurred when processing meta data during vCenter Single Sign-On setup:the service provider validation failed. Verify that the server URL is correct and is in FQDN format, or that the hostname is a trusted service provider alias. Any Ideas, I have tried all the VMware/Broadcom solutions but no luck. Cheers John. 

haven't been able to find anything on knowledge base or while searching in general but maybe not (well) documented. is there a way to check for hits on routing route map / acl / prefix lists counters. like when you create one that allows some and denies other, can you see which of the options is hit how often?

I wanted to use the on_connect script in the FortiClient to connect an smb share after the connection is established as shown here. But the command is executed before the connection is established. After my command failed the connection is shown as established in FortiClient. I tried to execute the command in the background but failed to do so.  <on_connect> <script> <os>mac</os> <script> echo "" & sleep 4; /usr/bin/osascript -e 'mount volume "smb://ssldemo.fortinet.com/installers"' </script> </script> </on_connect>  Environment:MacOS 14.6.1FortiClient 7.4.0.1645SSL-VPN via SAML SSO using the external browser as user-agent

Hi,I have two firewall1.)fortigate 400E firewall (currently live)2. fortigate 300D firewall (older one) Can i use fortigate 300D firewall as a forti analyser to store logs?

i just changed my FortiSwitch to standalone because I replaced an old fortigate firewall to a new one.  I maintained the same configuration no vlan just hardware switch network.  I’m not using Fortilink port so the switch is standalone mode. It’s working but it does not show up on FortiSwitch and even if it does it shows offline.  How can I make it appear and online without using Fortilink? thx

Hi expert, I'm trying to create a policy to quarantine any email that has a email header X-RCIS-Action = Quarantine.Can any one share the configuration on Fortimail? Thank you!

I have new device 401F. By default it is on the v7.4.3. I need to downgrade the device on the version 7.2.8. I tried to downgrade but getting an error "image downgrade failed. Failed to upgrade firmware due to expired firmware updates license." Is to possible to downgrade device without registration/activation of license. Also I verified with cli by using the command diag sys flash list only v7.4.3 is showing there.

Hello, Fortinet's chat support recommended to ask here if anyone would be kindly willing to provide me with (one of) the latest firmware for Fortigate 60D. I need to burn the firmware as my unit is bricked. Thanks a lot Best RegardsJaroslav

Was doing some log parsing and came across some traffic flows that had me scratching my head. I have a policy with DPI enabled, but I do have reputable websites with various categories and address objects exempt. I also have a application control profile applied to said policy where I explicitly block DNS over HTTPS and DNS over TLS.  The traffic in question going through that policy shows traffic to dns.google (8.8.8.8) with application of DNS over HTTPS and DNS over TLS as Allowed (again, app control profile has it set to block). My assumption is, that due to my DPI profile having pretty much all things google exempt, this is causing the traffic to pass Allowed. This seems the most logical reason, but just wanted to bounce this out there and get some thoughts if I'm on the right track or there is some other "rabbit hole" I need to go down.

Good Morning, Has anyone ran into issues when updating the firmware on MCLAG switches that would cause the switches to disconnect? I'm wondering if the MCLAG group of switches need to be updated to the same firmware at the same time? Topology:FW1 & FW2 (HA Active/Passive)SW1 & SW2 MCLAG Group 1 (SW1 connected to SW3)(SW2 connected to SW4)SW3 & SW4 MCLAG Group 2 (SW3 connected to SW5)(SW4 connected to SW6)SW5 & SW6 MCLAG Group 3 SW1 & SW2 are running FortiSwitchOS 7.4.1SW5 & SW6 have been updated to FortiSwitchOS 7.4.3 After updating SW4 to FortiSwitchOS 7.4.3 last night we lost access to switches 3-6. The log message that stands out is "action="unsup-cfg" status="none" msg="MCLAG: **peer software mismatch local-software(v7.4.1,build0787,230921 (GA)) peer-software(v7.4.3,build0830,240422 (GA))"" Disabling the port on SW1 that connects to SW4 gave us access back to SW3-5 but SW6 is still down. I'm assuming that updating SW3 to 7.

Hi, we are in the middle of changing a FG300 cluster to a new FG200 cluster. In the old config we didnt use SD WAN, we had like one WAN1 for the MPLS connections and WAN2 and WAN3 for Internet Access. WAN1 mainly has all VIPs and VPNs, also it is a shared Internet Access so thats why we got WAN3 for all outgoing traffic. Now we would like SD WAN for Load Balancing or primary failover reasons but I am not sure what would be the correct configuration. If I do the implicit rule with 99%  - 1% or what is the best way? Thanks for your suggestions!

Hi Team, When the user registers his account on the portal, he must select a prefix for the phone number. The question is how to set my country to be my favorite or by default will be chosen. The current default setting is +1 and I don't know how to change it. To clarify the question, how to change it so that the +48 prefix is always shown to each user. I traied change that in html code, but i failed. I searched the forum but didn't find anything. A request for help Fortiauthenticator 6.5.3  

Hello everyone, Our Firewall was configured with several virtual IPs (static NATs) to forward internet traffic do our internal services.Currently we do have three public IP adresses but I want to merge them. So I do want to use virtual IPs with FQDN.I guess I need to enter the External FQDN in the top field, and the internal fqdn in the bottom field (mapped address). We use windows DNS server for internal name resolution (so that our clients can find each other). When we do intern name resolution the public domain name gets overwritten with the internal IP address... (e.g. service.company.at gets an private IP adress in our company lan and no the public one) so traffic does not have to use the internet. So I guess I somehow need to add two different DNS to FortiGate - one for public dns name and one for the private IP adress (=mapped address). Does that even work when both names are identically? 

Hi,I can't get a reverse rule to trigger for VLAN communication. VLAN 30 is able to ping VLAN 100, but 100 can't ping 30. VLAN 30 Laptop[10.0.30.2] can ping 10.0.100.200, and 10.0.100.1, and 10.0.30.1VLAN 100 Laptop[10.0.100.200] can't ping 10.0.30.2, but can ping 10.0.100.1 and 10.0.30.1FG and Laptops are connected to 8 ports switch. FG is trunk port. Laptops are VLAN Access Ports 30 and 100 respectively.0 bytes go across 100 -> 30 rule, unless I do Policy Match, then its the 40bytes FG tests withI am going to re-start the FG after posting this...just in the event something rules wise effect its. I have about 50 rules, and nothing worked as expected, so I cut down to 3 rules and smaller test setup. The other rules not included are 30 -> Wan (working fine) and Implicit Deny. Here are screen shots from the Firewall:Reset counts to ZeroBoth Laptops doing PING to each otherPolicy MatchPolicy Match ResultPolicy After Policy MatchVLAN settings

Hi, When remote user client system trying to access the internal application via Fortisase to SDWAN SPA, it is not showing actual ip of the client system. Instead of it shows the tunnel interface ip of the Fortisase.How can we get the actual client ip details on sdwan spa.Please guide. Regards,Ganesh

Good morning,Every time our user goes to connect to the VPN to access the server, reaching 98% he disconnects or sometimes he connects and falls, only the second time it works. Is there anything I can check to see why this problem occurs?

HiHave followed this link to setup a S2S between a 60F (local location) and a Draytek Vigor (remote location)https://www.draytek.com/support/knowledge-base/5203 I have got the tunnel up successfully and can access resources to/from both locations. I want to make this 1 way now so only the local location can access resources at the remote location Is it isas  simple as only creating the local to remote Policy and not bothering with a remote to local policy? I have disabled the Remote to Local policy on the 60F after following that guide and that seems to have achieved what i want and stops communication from Remote to local whilst still allowing Local to Remote connectivity,  just checking this is all i need to do? Many Thanks Many Thanks

Good morning,We're receiving sporadic reports of users unable to launch FortiClient and being presented with the following error message. The guidance provided to the users was the following: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-fix-the-A-JavaScript-Error-Occurred-in-the/ta-p/230823  Verification the users have uninstalled Microsoft Visual C++, FortiClient, and reinstalled both is shown below.  However the user reports the Javascript issue is still ongoing. Can Fortinet support provide next steps for the users to try, please? Users are not FortiClient EMS users. FortiClient version 7.4 is being used. Initial error was with FortiClient version 7.0.2.

hi hello allI need to replace a FGT200B v5.2.13,build762 (GA) with a FGT 400D v6.4.9 build1966 (GA) but I can't find the option to add "device"User and Device -> Device -> Device Definitionspresent on the FGT200Bis it a device or firmware version problem for the FTG400D?any suggestions about new hardware and firmware.thanks a lotMassimo

Hi All,  Customer is running non forti APs with a Wireless Controller located over an IPSec VPN from my Fortigate to their ASA.   AP's are losing their connection to the controller, and the customer is confident the Fortigate isn't sending on CAPWAP traffic.    I thought this might be an MTU issue, with ASA side set to 1500, Fortigate was set to 1420 so I've increased it to 1500 but issue is still ongoing,  Any ideas, or debugs I can run to help determine the cause?   Thanks, 

When ADOMs are activated, When ADOMs are activated, Hello, I'm a beginner and I've activated ADOM in my lab.I have 2 ADOMs:  - ADOM Si1 - ADOM Si2 And a third ADOM that was created automatically. THE ROOT ADOMThere is no policy package in this ADOM.What is it for? Thanks for your help.

I’m working on a project where a client is installing a new camera system. The vendor will provide their own router and PoE switch. We need to connect this router to the client’s existing firewall (91G), and the client has available public IP addresses. Can I configure the 91G firewall to pass-through mode, allowing the vendor’s router to use a public IP directly? Or is there a better approach to integrate the vendor’s router with the client’s firewall? BTW, the camera vendor will handle all system management independently and requires full access to their equipment, which will be completely separate from the client’s network. Thanks!

Hi all, i am trying to get a certificate for a cmp client from the FAC (6.6.0).In beforehand igenerated a .pem keypair on the cmp client. (openssl genrsa -out key.pem 2048)generated CA cert for FACgenerated server cert for cmp server on the FACThis the command:openssl cmp -cmd ir -server http://192.168.1.99/app/cert/cmp2/ -subject /C=Country/ST=State/L=City/O=Company/CN=PFC200/emailAddress=placeholder@company.com -newkey key.pem -certout cert.pem  The problem is, that the cmp client throws the following error:CMP info: sending IRCMP info: received ERRORCMP error: missing protectionI could not find any hints as to how i can resolve the error/what the reason is. Unfortunately i cannot see any log entries in the logs of the FAC to further investigate. A capture from the answer of the cmp server on the FAC in wireshark shows the following:It was not possible to enter the screenshot, but it also said "missing protection" and failinfo was "BadRequest" with the error code being 4865