Solved

I have 2 standalone FGT200E firewalls running 6.1.15, for the last month Qualys has failed the PCI ASV scan with a detected vulnerability QID150004 Predictable Resource Location Via Forced Browsing, its finding an /image/ fileRESULT:url: https://x.x.x.x/images/Payload: https://x.x.x.x/images/comment:Original URL is: https://x.x.x.x/matched: HTTP/1.1 200 OK I have SSL VPN in tunnel only mode, web mode disabled I came across an article https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-prevent-the-SSL-VPN-web-login-portal-from/ta-p/215905 to stop the web login page from appearing, which i applied to no effect. I also changed all the portals to not allow forticlient download in case this was causing the problem. Nothing has changed on Qualys that i know of & as mentioned scans were fine until the start of July.I've searched forums, google etc but not coming across any similar issues. 

Is there a way to configure FortiGate to not reflect the DHCP server IP when the end user (guest) opens command prompt on the client machine and perform an "ipconfig /all"? If there is no direct configuration, any other ways for us to hide the IP of DHCP server? Thank you!

I am having a problem running an automation to backup my computer. I want to send the backup to a sftp server of a remote branch, connected to the fortigate equipment from which I make the backup, and it is as if it did not arrive. If I do a ping it arrives, but I have to specify the source. Does anyone have any idea how I can fix it?The traffic and routes are allowed on both sides. But when I launch the "execute backup" it doesn't arrive. When pinging I have to add the source option to allow the traffic. Packet Trace #7,2024/08/06 15:59:27,"vd-root:0 received a packet(proto=6, 181.14.198.42:6817->10.1.4.121:22) tun_id=0.0.0.0 from local. flag [S], seq 4203643946, ack 0, win 65535"Packet Trace #7,2024/08/06 15:59:27,"Find an existing session, id-060b7b91, original direction"Packet Trace #7,2024/08/06 15:59:27,"enter IPSec interface VPN_IPSec1, tun_id=0.0.0.0"Packet Trace #7,2024/08/06 15:59:27,output to IPSec tunnel VPN_IPSec1 vrf 0Packet Trace #7,2024/08/06 15:59:27,"No matchi

I asked this question: https://community.fortinet.com/t5/Support-Forum/Controlling-ZTNA-access-via-Active-Directory/m-p/330127#M247776 and got the answer I needed but I still have more questions around this. My setup is FortiGates in AWS controlling access to AWS resources.  99% of the resources are SSH to instances in different accounts and connecting to ALBs via HTTPs.  Right now I have VPN groups in ActiveDirectory which translate to VPN groups on the FortiGate.  Each group is assigned a VPN CIDR unique to each group.  On the AWS side I have Security Groups relating to the VPN CIDRs. Now when we move to ZTNA I will still need to give some users SSH access and HTTPs access depending on their groups.  The list of HTTPs addresses are changing all the time so the only way I could create an address book for users would be to use the FortiGate APi.  So for now I am going to skip that problem. Users who need to SSH to instances is a sm

Hello Team, Is it possible to change the echo of VPN Authentication Failed error messages? Via FortiCLient and via Web portal SSL VPNThanks for the supportBR

Hi everyoneI have a problem when pushing configuration from Fortimanager to Fortinet firewallI used Fortimanager version v7.2.5-build1574 with evaluation license and pushed the sd-wan overlay template and it noticed the error but I do not see the error on the installation logI tried to upgrade the firmware on FMG from 7.0.3 to 7.2.5 and the Fortigate from 7.0.5 to 7.2.0 but it did not resolve the problem. I also tried to install each part of the sd-wan overlay template but it had the same problem. Do you have any idea how we can fix it?Please help me! Install log: Starting log (Run on device) Start installing Site-30 $ config vpn ipsec phase1-interface Site-30 (phase1-interface) $ edit "HUB1-VPN1" Site-30 (HUB1-VPN1) $ set interface "WAN1" Site-30 (HUB1-VPN1) $ set ike-version 2 Site-30 (HUB1-VPN1) $ set comments "VPN: HUB1-VPN1 [Created by IPSEC Template]" Site-30 (HUB1-VPN1) $ set peertype any Site-30 (HUB1-VPN1) $ set mode-cfg enable Site-30 (HUB1-VPN1) $ set localid "B

Hello FCT EMS adminsFCT EMS v7.2.4.Is it recommended to install FCT (client) on FCT EMS server so it can manage itself?Does it have any negative impact?The aim is to have AV and vulnerability scan on EMS server as well.

We are a software service company and we use Fortinet for securing our machines. Recently we started working for a client that is also using Fortinet. We are required to install their Forticlient in order to connect to their VPN because of the licensing of the Zero Trust Telemetry. The only reason we need their Forticlient is to use the VPN.If we want to use their Forticlient we need to uninstall ours which might put is in a situation that we compromise with our security. Is there an option to connect to VPN network managed by FortiGate/Fortinet without using Forticlient?

Dear Concern, I need to configure an IPsec VPN between two FortiGate, in which the traffic coming from SITE-B should be NATed only. That means when I configure the IPv4 policy on SITE-B, I should enable NAT in the policy and define an IP Pool so that the traffic from SITE-B is NATed and reaches SITE-A. I need to do this configuration because there is a server located at SITE-A, and I only want to give access to this server to users at SITE-B. The reason for enabling NAT is that SITE-B is using a subnet that is also being used by SITE-C, and I want to avoid any conflicts. Can anyone to helpme for this configuration.

Hello FortiGate Community,I’m currently working on configuring two FortiGate 200E firewalls in HA(High Availability) mode and need some guidance. Specifically, I want to understand how the HA setup behaves in a situation where the WAN interface shows as up, indicating a physical connection, but traffic cannot pass through due to an issue with the ISP. Can anyone provide insight into whether the HA failover will still function properly under these conditions?Thank you for your assistance!

rebooted my switch yesterday due to having to relocate it.  It is connected to another Fortinet POE, FG-80EPOE.  when it boots up it no longer provides power to my fortinet u431F AP's.  It previously worked in the same config just fine.    Now via the cli it shows POE errors on all ports: Fault 4 Error Type 17 (Port is yet undefined). at the interface level it shows similar:Power Fault: Error Type 17 (Port is yet undefined). I have followed all of the poe related post here including the poe debug, error 36,38, 4, and 17.  None of the recommended actions seem to work.  I have upgraded this switch to the latest FortiOS code as well 7.2.2. I have also done the poe reset, switch factory reset, still nothing.  Any suggestions?

Hi there, Guys I am trying to set up a firewall into a VRRP. Currently I have only configured one firewall and given a priority of 255. When I see the status of the firewall it says it is a backup. The priority is 255 so I assume is should be a master. Am i missing anything ? FortiGate-100F # get router info vrrpInterface: x2, primary IP address: 10.108.0.2UseVMAC: 1, SoftSW: 0, EmacVlan: 0 BrPortIdx: 0, PromiscCount: 0HA mode: primary (0:0:1) VRRP primary number: 0VRID: 1 verion: 2vrip: 10.108.0.1, priority: 255 (255,20), state: BACKUPadv_interval: 5, preempt: 1, ignore_dft: 0 start_time: 10primary_adv_interval: 500, accept: 1vrmac: 00:00:5e:00:01:01vrdst: 10.50.50.109vrgrp: 100 edit "x2"set vdom "root"set ip 10.108.0.2 255.255.255.248set allowaccess ping https sshset type physicalset mediatype srset alias "Uplink to Core Switch"set vrrp-virtual-mac enableconfig vrrpedit 1set vrgrp 100set vrip 10.108.0.1set priority 255set adv-interval 5set start-time 10set vrdst 10.50.

Hello, How can I change the color scheme of the interface of my FortiMail Cloud? Under Preferences, I only have the language selection option, nothing else. Thank you for your help!

Hello All, We are working on a FortiGate upgrade for a customer and they have VDOMs configured on their current deployment. They are moving from a 1500D to 601F both running FortiOS 7.2.8. We have FortiConverter and have used the application to map all previous interfaces to new interfaces on the 601F. When attempting to restore the converted configuration onto the default configured 601Fs we receive the following errors in diagnose debug config-error-log read:>>> "config" "vdom" @ 12398:command parse error (error -61)>>> "config" "global" @ 12423:command parse error (error -61)>>> "config" "vdom" @ 23614:command parse error (error -61) These errors correspond to the places in the config where after multi-vdom mode is enabled, config vdom is used to initially create the vdoms, then config global is used to begin the global configurations as follows:config vdom edit rootnextedit vdom1nextedit vdom2nextend config globalconfig system globalet

I made a configuration to receive an e-mail message when my link goes down, but I would like to know which link went down, I'm using event 20099, I tried to configure event 20090 but I don't receive an e-mail.Is there any way to receive the name of the dropped link or interface?

I am trying to migrate from FortiGate 400E version 6.4.6 to FortiGate 600F version 7.2.6, but when migrating the Access Points, I see that it appears as a 'VAP switch'. Does this option change when it updates?

Hello everyone, We are using a Fortigate 120g. However, we can't open any website. Ping and DNS works on the client and on the fortigate and the packets are forwarded on the fortigate without dropping any packets. When we connect directly to the Fortigate 120g, we can access the Internet and open web pages without any delay. When we disconnect the Fortigate 120g and connect our old firewall, everything works fine right away. What we tried:Configuring port speed 1000Full on our Cisco CL9200 switch and on the Fortigate 120g.Do you have any idea how we can fix the problem? Thank you in advance! Best regards

Good Afternoon, Some clients showed up problems to connect to the vpn(SSL-VPN), the computer is windows 10 pro 22h2 build 19045. and always stay connecting and don't show the connectiong percent before connection estabelish. I test in android and its work with client credential. i already Repair the application and also uninstalled it, and re-installed. but no success, not even with my Credentials. Any suggestion?

I just installed FortiClient EMS 7.4.0 on Ubuntu 22.0.4 according to the installation doc. All the running services check out like they're supposed to. The doc says to double-click the FortiClient Endpoint Management Server icon to fire up the gui so I can configure https access, but there is no icon to click, nor does the system have anything for forticlient in the applications menu. Anyone have a workaround for this or tell me the bin the icon is supposed to point to?

Using FAC for Radius/EAP-TLS, backend is Active Directory. My LDAP remote user synch rule seems to be working, except for the fact that my a user's certificate binding is not coming through. The user does have a cert issued. Any ideas - misconfiguration on FAC or my domain controller ?

I'm trying to test authentication by using Machine certs instead of User certs. When I configure the windows supplicant to use "User or Computer" OR "User" I can authenticate. If I force the setting to "Computer" it fails. Both the computer and user certs are valid and signed by same CA. I must be missing something in the Radius server config. Any ideas ?

Now that I have all my users using SSL VPN similar to how our old Cisco AnyConnect was working I would like to start learning and then implementing ZTNA to better control the users. My EMS Cloud, FortiClients and FortiGate all use ADFS for SAML.  Is there anyway to setup ZTNA such that the groups the user is in controls their access to devices?  For example.  If I have a user in Dev group I want that user to be able to SSH to a CIDR address list.  I also want them to be able to connect to HTTPS to another CIDR address list.  Then I have a group like AppSupport that should only HTTPs to 2 different CIDR address groups.  Then I might have a third user which has both AD groups (Dev and AppSupport) so they should be able to access the combined CIDRs. Is this at all possible???What 

A while back I found a really good Technical Tip article on setting up Fortimanager for SSO with ADFS SAML with the FortiManger in SP mode.  I am totally unable to find it anymore.  Does anyone know of any good Tech Tip articles for this or other docs besides the standard Fortinet junk manual?

Hi,I am currently testing SSL VPN multi-factor authentication. Since we already have PKI and smart cards running in the Microsoft AD environment, I followed the steps in the guide:https://docs.fortinet.com/document/fortigate/7.0.1/administration-guide/266506/ssl-vpn-with-certificate-authenticationEverything executed smoothly, but I noticed a peculiar authentication mechanism. Fortigate's certificate multi-factor authentication matches if the account subject string on Fortigate matches part of the information in the certificate subject. I believe this is not a secure and rigorous matching method. The PKI user's subject should fully match the certificate subject. It can be observed that test3-jason was initially matched by jason's subject, leading to subsequent authentication failure.How can I avoid the following situation?Additionally, can Fortigate's certificate authentication authenticate the subject alternative name in the certificate?FortiGate  The following is the ve

Hi FortiClient EMS adminsFCT EMS 7.0.13.When deploying client from EMS I get error 150 on the EMS logs.Windows events on client show 30000 ms timeout waiting for FortiClient Install Service.I checked all below prerequisites are ok.https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-FortiClient-Deployment-Error-150-for/ta-p/260271Any idea?