Solved

Hello everybody,I've FortiClient EMS in my network. The filtering is working correctly, but I can't understand how to view generated logs. Is it mandatory to send logs to FortiAnalyzer or to an external server?Where can I view generated logs on FortiClient EMS?Thank you 

We would like to know more information about the Crowdstrike issue. Just wanted a confirmation that this issue could happens to Fortinet Products too such as Forticlient or any?  Does CrowdStrike has any impact on Fortinet products?  TIA :) 

Hello everybody,on my PC I've FortiClient, and in my network I have a Fortigate. Essentialy, regarding web filtering, FortiClient and Fortigate have the same settings and the same exceptions.When I visit a "tobacco" site, this site is correctly blocked. Reading the logs, how can I understand if the site was blocked by FortiGate or by FortiClient? date=2024-07-23 time=14:26:54 id=7394806744431460361 itime="2024-07-23 14:26:54" euid=1026 epid=1030 dsteuid=3 dstepid=101 logflag=3 logver=702081639 type="traffic" subtype="forward" level="notice" action="close" utmaction="block" policyid=6 sessionid=6330623 srcip=10.1.10.31 dstip=104.26.14.200 transip=192.168.1.4 srcport=55936 dstport=443 transport=55936 trandisp="snat" duration=140 proto=6 sentbyte=220 rcvdbyte=4659 sentdelta=104 rcvddelta=260 sentpkt=4 rcvdpkt=13 logid=0000000013 unauthuser="xyz" srcname="MacBook_Pro" service="HTTPS" app="SSL" appcat="Network.Service" fctuid="92CB99E956C6570AB48FD3B7E84960C7" srcintfrole="lan" dstintf

I'm having issues with FortiClient (7.0.3.0193) on Windows 10 Enterprise (19044.1645) inside a virtual machine (VM-ware)Installation of the Forticlient worked without issues.Configuration of VPN is OK (identical config works on host).Connection gets established according to Forticlient.Once connected, every communication through the VPN (ping,...) crashes Windows with a blue screen.Stop code: KMODE EXCEPTION NOT HANDLEDWhat failed: ndis.sysOn the host computer everything works without blue screen... Any idea how to solve this?

Hello everyone,We have recently started using a FortiManager VM (v7.4.3-build2487 240514 (GA)). We use it to manage a Fortigate 400F and of course also create our policies with it. Now to my problem: I have not been able to change the view mode for a few days and am now stuck in ‘By Sequence’ mode, the button for this has disappeared. According to a Fortinet article, the reason for this is that there are two interfaces in From or To - but I have checked each of the rules and there is only 1 interface in From and To in each rule. Do you have any idea how I could correct this? Kind regards Marc

I have two machines that when the firewall is enabled with Domain it disconnects Fortinet Single Sing On Agent Configuration, if I disable the Domain Network firewall it works perfectly. This machine has the same rules as all the other machines. Has anyone experienced this? 

greetings,Previously we used ping to a single www server from public Internet as the SLA detect method, and some day ISP stops the ICMP to that www server, so SD-WAN rule brought down the member interface.Now we'd like to use DNS as the active probe method since there are robust public DNS service provider for public Internet.So, my question is, what is the SLA Target if using DNS? from the screenshot below, it looks the same as measurement to Ping. Isn't it supposed to measure the response time for a DNS query? Should SLA Target be enabled?Thanks for your any advice！

Hi, I'm running FortiClient EMS v7.2.4 and I've deployed FortiClient v7.2.4 to a device, let's call it DeviceA. In EMS I have our Microsoft Entra ID added under Endpoints -> Manage Domains. Within this configuration I am sync'ing in selective groups, for ease, let's call them Device Group and User Group. DeviceA is a member of Device Group and UserA is a member of User Group. I then have various policies (VPN, FW etc) assigned to User Group, with no policies assign to Device Group. This is working nicely in that UserA is getting the correct policies when logging into DeviceA. Also, in EMS under Endpoints I can see DeviceA in Domains -> Entra ID -> Device Group, which again is to be expected. Now to my issue... I have created an installer (for v7.0.13 as a test) and a deployment within Deployment & Installers -> Manage Deployment and assigned this to my Device Group. The assignment appears as domain.onmicrosoft.com/Device Group, so it a

Hello all,I'm having problem with AnyDesk and activated SSL Deep inspection.As soon as this is activated, the AnyDesk client can no longer connect to the AnyDesk server.I've already tried to exclude *.anydesk.com but no luck.I have already created a outgoing policy specialy for service "AnyDesk-AnyDesk" and set it to the top. But even this does not work.

Hello team what is the course for the BGP not form neighbor between HQ and branch

I have two FortiGate 200D in HA mode currently and need to transfer one of them to the DR location. DR Site IP range and HO IP ranges are the same. Core Switch with different VLAN is having a gateway set to firewall LAN IP. Is it Possible to have an HA configured using Datalink connectivity between 2 different geographic locations?Do any other Changes are required on the Core switch?

Hi Team, I have a question about using DNAT and SNAT simultaneously. For example, my global IP is 100.100.100.100/32. I want to enable RDP (port 3389) access to a local host with the IP address 192.168.10.10/32 from the Internet.When a user connects to 100.100.100.100:42424, it should be forwarded to 192.168.10.10:3389 and also be SNATed to 192.168.20.10/32. Is the configuration below workable?------------------config firewall vip edit "vip_192.168.10.10_Office-RDP"  set service "TCP_42424"  set extip 100.100.100.100  set mappedip "192.168.10.10"  set extintf "WAN_v2000"  set portforward enable  set mappedport 3389 nextend config firewall ippool edit "192.168.20.10/32_LAN-Office"  set startip 192.168.20.10  set endip 192.168.20.10 nextend config firewall policy edit 10  set name "Internet->Office-RDP_allow"  set srcintf "WAN_v2000"  set dstintf "LAN_v2002"  set action accept

hi I need to implement HIGH Qos for Microsoft services. I understand I need to use shaper.i need help how to configure it.1.should i give maximum band for shard or per ip?2.the Microsoft services need to be as source or destination?3.do i need reverse shaper? thank you for  helping

Good morning experts. Maybe you want to help me with a problem that is killing me..?I’m trying to configure a solution for a remote office using CISCO switches and a Fortigate 60E. Difficult to explain but that is almost fixed, no problem with that.The problem is a behavior about how Fortigate manage VLANs in its Internal ports hard-switch:When all infrastructure is connected, the testing host is able to ping all VLANs. But when a physical trunk link is down between two of the Cisco Switches, the testing host loses connection to its default gateway (which is the Fortigate...!) I mean that the testing host can ping 5/6 time more from the moment the link goes down and after that it loses connection and pings are not more answered until the link is reestablished. I drew my infrastructure so that it is understood, I hope you can help me. Technical data:* Interfaces used: ports 1 to 5 of the Internal hardware-switch* Five VLANs configured on it: IDs 15, 30, 35, 50, and 101.* VLAN

Hi everyone, I want to allocate X, Y, etc. amounts of memory to storing certain log categories. Is it possible to do this in a Fortigate 100F?

I would like to have the fortigate update its webportal URLS dynamically using some kind of script or tool or pull method.  As an example the Fortigate periodically pulls in a file from some linux server internally to create the webportal URL list that is then presented to the usergroup assigned to that portal. Any one know how to do something like that?

greetings, I'd like to know what is the meaning of the time duration next to the DNS server in Fortigate.When it is showing thousands ms, we can still ping it without issue.

 I need to install a few FortiSwitches (FS) as replacement for very old cisco switches in a quite remote site.I already got the switches here in my office and wanted to prepare them before I go onsite. How should or could I prepare the FortiSwitches here in my lab to reduce onsite time? The FS will be connected via FortiLink (FL)to a local Fortigate 40F with FortiOS 7.0.1440F(FL)---FS124---FS148---FS148                    |                FS148 Uplinks are FO 10GB, no reduncancy, so I need to connect the switches mostlty in serial order. See in the schema above. I should be able to connect the FS with FortiLink in parallel to the Cisco setup.The old Cisco setup is pretty straightforward. Just two VLAN's.   Actual Cisco Switch (CS) setup looks like this here:40F(LAN1)---CS24---CS48---CS48---CS48                   

hi, can someone please advise how to check the fortigate log to confirm the traffics are blocked by the ssl security profile? The policy looks allow. Thanks in advance. 

Hello all,  I found TWO VM images available from Fortinet as said Fortigate and FortiFirewall. What is the difference between them?  Thanks 

We have LDAP configured and working for VPN authentication, but need to of course have secure auth, so need to change to LDAPS. LDAP is working with a regular bind account. When I change to LDAPS, both the connectivity and the user credentials test pass successfully. However, nobody can log into the VPN; Permission denied. (-455). The documentation is pretty vague. To keep things simple for testing I haven't toggled the 'Certificate' option and assume that is not a requirement. I haven't been able to locate any logging to get more information, either. I'm puzzled as to why the LDAPS tests show success, but logins fail. I appreciate any insight.

I am attempting to open our Fortigate firewall for one specific IP to troubleshoot some issues with an external vendor. How would I go about this? Fortigate 100F v7.2.7 build1577 Any help would be greatly appreciated! 

I have 60F V.7.2.8 and I'm configuring automation to receive e-mail when the user connects to the SSL VPN and when they leave, but I'm not receiving the e-mails.

Hello, We are using FortiMail and we want to forward a copy of every incoming email to another server. Is this possible and how can we do it? I have made a diagram to explain it, can you help?

How many sections does a vdom support?