Solved

Hello dear Fortinet Community! I am investigating a curious situation in a customers enviroment. There is a continuous problem in 2 different VLANS (the first one is on an AP and the other on a wired VLAN)The problem occurring is that the client PC suddenly drops packets. I cant find anything unusual in the FGT error log history from the client IP both in the wireless VLAN or the wired one.If the user hotspots from his mobile everything works fine.The problem was first noticed in Video calls where the user would suddenly loose connectivity.I tried pinging from the users pc , another pc on the same wired VLAN and from a different pc in the wireless one towards 8.8.8.8.I can see packet losses but not at the same time and not a steady interval. It can happen from an hour to 10 minutes to two and half hours. Again i say it doesnt happens at all the different PCs at the same time.To add the wired VLAN policy has only web flow based module, AV flow based module, DNS module and

Hello everyone, While I was reading about IPS and how it is being used when in flow based for various security features, such as Antivirus, Web Filtering any many more. What I was intrigued about is the behavior when it is in proxy mode and I found a thread about it, but when I click on it all I see is "This Content was Archived". I can read the first two sentences of the thread from the google search, but it ends right when the person is explaining what happens in proxy based.  Here's the link: https://community.fortinet.com/t5/contentarchivals/contentarchivedpage/message-uid/72266  

Hello, everyone!I hope you are all doing great. Our company's Fortigate license has FortiCare Support included. The company through which we bought the license have been giving us poor support. I have been contacting them for weeks, but they have only answered my phone calls and messages a few times. They didn't contact me back except one time or so. What rights do I have against this company? It's a Fortinet partner, and yet we don't get proper support.They were better in the first few months, but they slowly started changing. Best regards, #fortigate #forticare

Hi,I´m tring to integrate my Fortigates with an script.My script can add any already created address in an specific group, but I can´t find a way to remove only one address, all I can use is add just an address or change all adresses all at once. Any help would be appraciented.

Hi, I get errors when I want to add a device to Fortimanager.The devices are on the same network and have icmp access to each other. All outputs are as follows. Why am I getting errors, can you help me?  Manager # Request [dvm/cmd:dvm/cmd/discover/device ...:5825:2]: { "client": "dvm\/cmd:dvm\/cmd\/discover\/device ...:5825", "id": 2, "method": "exec", "params": [{ "data": { "host": "192.168.1.17", "passwd": "******", "usr": "admin"}, "target start": 1, "url": "probe\/device"}], "root": "deployment", "session": -1} Chkperm Response [dvm/cmd:dvm/cmd/discover/device ...:5825:2]: { "id": 2, "result": [{ "status": { "code": 0, "message": "OK"}, "url": "probe\/device"}], "session": -1} start_dmsvc_probe_device,788: dev_oid=0, host=192.168.1.17, flags=0x0 __enter_state,440: dev_oid=0, start check_reachable Start probe_dev.check_reachable ... __on_state,446: dev_oid=0, check_reachable, done, events=16 r=0 __enter_state,440: dev_oid=0, start start_probe_session Request [dmserve

Hello fellows, I have a problem with the DNS resolution of www.epicgames.com in particular. I have not yet noticed any other FQDNs. The following configuration at my home:Fortigate assigns an IP address to all LAN clients and is the local resolver and gateway, this is set via DHCP.My private Fortigate 61F (FortiOS 7.2.8) is (sometimes) not able to resolve this FQDN. Accordingly, the browser reports back that the domain could not be resolved (DNS_PROBE_FINISHED_NXDOMAIN).Same result when I try it with nslookup (** server can't find www.epicgames.com: SERVFAIL)It also does not work on the Fortigate itself (execute ping www.epicgames.com - Unable to resolve hostname.).However, if I use nslookup to query the server 9.9.9.9, for example, it works fine. It also works with the server 96.45.46.46 from Fortinet (both upstream resolvers). There are no security profiles set in the rules. What should I do, how can I find out what the problem is?After restarting the FortiGate, i

Hello, I'm testing a configuration using aggregate dial-up IPsec but I'm having trouble getting it to work. The thing is that in the IPsec Tunnels configuration the aggregate "Test" shows up in green, but when I create the static route in Network -> Static Routes it shows the aggregate "Test" as down in red. Did I miss something in the configuration that most be done to work? If I change the VPNs to IPsec site to site not dialup the aggerate shows up (green) in static routes. Can't use SDWAN because I used up all 512 members already.Fortigates have Firmware 7.0.15  Thanks for any help you can provide!

Hello everyone,I have a problem with the DHCP service no longer working after reconfiguring fortinac using the configuration wizard.I tried to restart it via cli but without success.Can you help me?

Hi, some months ago we changed from 100D to 100F HA (7.4.3). Sofar, no problem at all ;) but it happend like 3 times that our Zabbix reports for some time critical CPU utilisation (I think it marks critical if it is some min >75%). Than I log in to the FG100 and in the dashboard I see like 2-3% of usage in the last 6 hours.  We had the same Zabbix with the old FG100D and never got this message. Anybody any idea? Is this data real or a failure in the syslog? Thanks

I'm looking to see if there is a way on a FortiSwitch (version 7.4.2) to view the current rx and tx optical power level for the SFP module.We are having some unusual issues and am trying to figure out if I have a bad fiber or possible bad optic

HI there,i am here to know that which forigate update is more stable and have less issues regarding preformance.

Hello. I am quite new.I used Forticlient VPN only with a Centos 8 box with no problems.Yesterday I upgrade my box to Centos 9 and reinstall  then Forticlien VPN from the this rpm packagehttps://www.fortinet.com/support/product-downloads/forticlientas I did on my Centos 8.Unfortunately, although I have exact the same  configuration as I had on my Centos8, now I can not connect to VPN.Is there something I should concerned on Centos 9? Thank you in advance.

Hi, I will install fortisiem for the customer, but when I download the package from the firmware download section, it shows 6 hours,my internet speed is 700 mbps tufin installation file 16gb tar in 20 min downloaded fortisiem 6gb

 Gentleman,I need support, show below that port 2601 on server that is map on loopback 10.2.202.10 is getting reset, but going direct to server port is open.  Need some help why going to loopback is resetting. 

Good day Fortinet Family, Is there a way to achieve this? I see steps  Profile -> Sessions -> inbound session -> lists -> Disallow recipients on this list Is this the only section or is there another/best alternative? Your assistance/direction/steps would be greatly appreciated. Regards,NeoRant  

I made some configurations,I created new user groups that I pulled from the ldap serverI created radius client and created policy but I get the error in the following log is it related to eap# Executing group from file /usr/etc/raddb/sites-enabled/default2024-06-04T12:33:46.061923+03:00 FortiAuthenticator radiusd[6259]: (4) eap: Found authclient from preloaded authclients list for 10.140.140.1: Forti_Radius_Besiktas (10.140.140.1)2024-06-04T12:33:46.063080+03:00 FortiAuthenticator radiusd[6259]: (4) eap: WARNING: No authpolicy for authclient 2 with authtype eap-tls2024-06-04T12:33:46.063679+03:00 FortiAuthenticator radiusd[6259]: (4) eap: Found authpolicy 'WiFi_Policies' for client '10.140.140.1'2024-06-04T12:33:46.063710+03:00 FortiAuthenticator radiusd[6259]: (4) # Executing group from file /usr/etc/raddb/sites-enabled/default2024-06-04T12:33:46.063738+03:00 FortiAuthenticator radiusd[6259]: (4) facauth: Updated auth log 'elif.sert' for attempt from 10.140.140.1: 802.1x authenticatio

I'm currently trying to troubleshoot the VPN tunnel why it won't work and what is missing for it to work. Problem is, I can't reach or have any connection to the dialup peer for the VPN. I only have a backup of the config so I can try to imitate the general configuration. The certificates that were used for the VPN have been imported to the local certificates in the Fortigate. The authentication from the peer were so:(Lancom-Router)Local Authentication: Digital-SignatureLocal Identity-Type: ASN. 1-DistinguishedLocal Identitity: /CN=Lancom-RouterRem. Authentication: Digital SignatureRem. Identity-Type: ASN. 1-DistinguishedRem. Identitity: /CN=UF-360Local Certificate: Lancom-Router-Cert(Fortigate)config vpn ipsec phase1-interfaceedit "Lancom-Router-VPN-CERT"set type dynamicset ike-version 2set authmethod signatureset net-device disableset localid "/CN=UF-360"set certificate "UF-360"set peer "Lancom-Router-Peer"nextendconfig user peeredit "Lancom-Router-Peer"set ca "CA_UF-360"set sub

We are using Forticlient EMS 7.2.3 and 7.2.3 and split-tunnel for certain traffic (MS Teams for example). To prevent accessing local services (NAS box for example) we enabled exclusive routing on our Fortigate 7.0.0 as per Enabling SSL VPN Full Tunnel - Fortinet Community. However, we can still access local resources/services. 

Using Fortigate 6.412. Can the DNS Server feature support hosting SRV records? I see A and other record types in the UI but no SRV. 

Hi,I have two FG201F FortiGate devices connected via an IPsec tunnel, both running firmware version 7.0.15. The latency between the two FortiGates is approximately 17ms. The VPN's are configured in an SDWAN. Here is the problem:Server-A, located behind FG-A, needs to communicate with Server-B, which is located behind FG-B. FG-B uses an aggregated port combining interfaces X1 and X2, both of which are 10GB interfaces.When Server-A communicates with Server-B through the aggregated interface, the connection speed is only 20-30 Mbps. However, if I move the VLAN of Server-B to a non-aggregated port, such as Port 2 (which is a 1GB interface), the traffic speed increases significantly to 600-800 Mbps.Both interfaces are connected to a Dell N4032F stacked with an N4032. On the switch, the configuration is a simple port channel in active mode.It's noteworthy that if you connect from a server behind Port 2 (FG-B) to the VLAN behind the aggregated interface (also FG-B), you nearly achieve th

Hi,I have a Fortigate Cluster with several VDOMs.rootVDOM1VDOM2I connected the Fortigate cluster to a FortiAnalyzer. I created an ADOM1 in which I placed VDOM1.I want the admin of VDOM1 to be able to see system and traffic logs. I'm not able to do this actually, the "FortiView">Traffic option is grayed out.How can I fix this?Thank you for your help!

I'm looking for some best practices for setting the 'starting default' wired switchport vlans when deploying NAC. What is reccommended for each of these cases ?a) dead end VLAN with zero access ?b) guest network VLAN that denies access to any corporate resources ?c) a isolation vlan with a captive portal ? 1) Switchports configured for 802.1x used by corporate computer access. I have a NAC policy to identify 802.1x/TLS cert auth and change the port to a 'prod' vlan.  2) Switchports dedicated to IOT devices. Device profiling will trigger a access policy to put these devices in the right vlan like camera, door badge systems, printers, etc. 3) Switchports dedicated for byod devices. Access policy will force the users into a registration portal w/ dissolveable agent.  Thanks for any insight.  

Hello team, i have the following problem when try to configuring SNMP on interface LAN (not MGMT dedicated) The monitoring system is reachable via ipsec tunnel. When I try to configure SNMP on the LAN interface, in the local firewall logs I see traffic but no return traffic.The strange thing is that the same policy correctly allows SNMP traffic as well as HTTPS traffic from the ipsec tunnel to the ip address of the interface on which SNMP is enabled. Thanks for the supportBR

Hi, What's the functionnality can do FortiWeb and we Can't do it with FortiADC With AI Security BDL 

Hello everyone,   I am using Fortigate 7.0.12 setting up SSL-VPN with Azure MFA using FortiClient mobile (7.2.0.0101) .   The setup works fine but gives a bad user experience for thousands of users on mobile (iOS and Android)  by throwing an error webpage which is trying to reach 127.0.0.1:8020 (Error: This site can't be reached 127.0.0.1 refused to connect). I do not expect the FortiClient to be running anything on port 8020, or should it?   This error webpage is shown during the SAML authentication flow, and once it is promptly closed the connection is authenticated and browsing is normal. Has anyone found a workaround for this or some pointers to avoid this redirect error webpage?   Some info I found online about this redirect:   #https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/364443/using-a-browser-as-an-external-user-agent-for-saml-authentication-in-an-ssl-vpn-connection   I was hoping I could change t