Solved

As the title says, switching between certificate-inspection, deep-inspection and custom-deep-inspection does not help load most common & reputable (both international and Vietnamese) websites on either Microsoft Edge or Google Chrome, such as:office.comvietcombank.com.vnbidv.com.vnvnexpress.netSetting the SSL/SSH inspection profile to no-inspection makes it work with one exclamation on the policy rule.Is there any idea about this?

Hello, I would like to ask you because I am in the process of configuring a Fortigate 40F where I have a port which goes to a switch with TAGs (vlan). But I would like to define another port of the Fortigate with the same TAG (vlan) which goes to another managed switch. How can I define a second port with the same vlans? A big thank you to you. Olivier

Hello dear friends from Fortinet,Sorry for my tone but I have no normal words.I spent several nights trying to understand why my Asterisk PBX can't register on SIP provider. So finally I found in captured packets the makings of a failed intellect.1. PBX sends register packet src:int_IP:5060 to dst:SIP_prov_IP:5060  Message HeaderVia: SIP/2.0/UDP ext_IP:5060;branch=z9hG4bK6a3e42f7 2. Fortigate translats by NAT ........ BUT!!!!!!......it changes packet's contentsrc:ext_IP:5060 to dst:SIP_prov_IP:5060 Message HeaderVia: SIP/2.0/UDP ext_IP:5170;branch=z9hG4bK6a3e42f7 3. Evidently SIP provider response to the fake port presented by Fortigatesrc:SIP_prov_IP:5060 to dst:ext_IP:5170Message HeaderVia: SIP/2.0/UDP ext_IP:5170;branch=z9hG4bK6a3e42f7 And NOTHING MORE !!!! Because this port in not listen and even is blocked as it is not permitted by policy and therefore this packet doesn't returned to PBX. And the same thing happens with RTP packets!!! I don't understa

Hello, I´m setting up a internal DNS server on a fortigate 40F. Where do I set the port for the address the DNS is solving ?  

Hi,I have fortigate 1200D (2x HA), it has only one default root vdom. My plan is to activate the multi vdom function, but I have doubts if it can be done without any interruptions or reboots. In cookbok for v6.2 i found information that states:Multi VDOM mode can be enabled in the GUI or CLI. Enabling it does not require a reboot, but does log you out of the device. The current configuration is assigned to the root VDOM.f I recall correctly, that wasnt the case on earlier versions? My question is if i have only one root vdom now, after activation of multi vdom will I loose any kind of configuration? I have read that by activating split task vdom it retains 'some' config but not all, i just want to make 100% that this operation i safe to make.cheers

Hi there, I am in a test enviroment and set up the options and can access a web server target via FortiPAM with activated explicit web proxy mode. So far this is no problem. But when I try to connect the target with the option "Replace Web Credential" the target system give me the message wrong user / password.It seems as is the replacement of the fake login information cannot take place. Where and how can I go into further troubleshooting for ths scenario? Kind regards,Daniel

Hello guys,i'm using Forticlient vpn only - version 7.0.9.0493 and i already have configured five connection profiles, now i need to add a new profile, but once i create it, it is not shown in the profiles list.This issue appears even with a newer version, so i'm wondering if there is a profile limit.I've also noticed that after some time i'm not even able to modify the existing profiles anymore...Another question if is there is a way to not manually reconfigure all the other profiles in case i should install another more recent version. Thank you

Hello, I am very new to FortiGate and I am studying for the Network Security Certification.  I have the following question, which I am not able to confirm my answer on the internet. FortiGate - version 7.4.3 Say I configure a Firewall rule with:Inspection Mode as: Flow-based In the same Rule I add security profile >> Antivirus >> In the antivirus profile, feature set is configured as Proxy based. Does the above means that now the firewall rule will use Proxy-based mode for all the traffic?  Thanks for your assistance. Aaron Olguin    

Hello team, Without FortiAnalyzer, can only specific types of logs be forwarded to a syslog server on the Fortigate firewall? Thanks for the supportBR

FortiAutenticador "e-mail smtp: envio para usuário@email.com.br via 192.168.1.1:25 falhou, erro: Nenhum erro de destinatário válido fac.home.www-data.fac.fac.utils.email __init__ 31293 139969435703040 Falha ao enviar e-mail. Nenhum destinatário válido" Att, Cleiton

I would like to delete some unused rules Virtual IP, before I delete this Virtual IP I Ill like to check if there is still traffic in that Virtual IP.  Im using V7.2.7  

Himy device is Fortigate 60F running 7.2.8I have defined a new hardware switch named internal0, added physical ports internal4 and internal5I have added some Vlans on internal0, let's say VLAN17, VLAN18, VLAN19 (192.168.17.0/24, 192.168.18.0/24, 192.168.19.0/24).Internal 5 is uplinked to the trunk port on my Aruba switch (setup as L2 switch) where are also defined same Vlans.Everything is fine, devices connected to Aruba are getting IP addresses from the corresponding Vlan. (DHCP is setup on Fortigate for the Vlans)Now I want to have internet access for the vlans and I am not able to do it.I have setup an allow all rule from internal0 - WAN1 but still the devices are not able to access internet.It may have to do with the fact that the internal0 switch need an IP address on order to do NATI have added an IP address (say 192.168.10.1) to the internal0 switch but still no able to access internet.What am I doing wrong? please helpNote: the reason I have created a new hardware switch and no

Hello community! I have a very complex scenario to implement, but without much information. The intended scenario is: Multiple SSIDs for the Wireless network, however, must use WPA2-Enterprise... however, I do not intend for authentication to be done with user and pass, but rather via the EAP-TLS certificate issued by fortiauthenticator, tied to the local user created. Performing EAP authentication was already successful, however, now I need to isolate the certificates so that only the certificate authorized for a given SSID can access. In testing, any certificate is capable of logging into the SSID. How to isolate?I've already tried to create the local group on Fortigate and indicate the remote group on Fortiauthenticator, but without success.I've already tried applying the radius attributes, indicating the FortiAP SSID for the created user, but it didn't work. summary: I intend for each ssid to only allow one certificate issued by fortiauthenticator&nbsp

Hello team,I have some points regarding persistence agent deployments:1- is a DNS record mandatory or there is a way to configure the agent to reach FNAC via its IP2- I understand that when registering endpoint as a host, the device is tied to a user, whereas as "device" it is not, so why we need "authentication" when choosing "register as device" under "system--persistence agent / credential management? 

Hello,I set up IPSec connections for roaming clients with split-tunneling. Although the connections succeed phase 2 and R_U_THERE packets do cross the tunnel, there is no packet flow between client and the Fortigate. Neither one can ping the other through the tunnel.Another fact which I do not understand. Although split-tunnel and mode config is selected, the Forticlient 7.2.4 alters the default route on the Windows 10 / 11 clients to the tunnel. The dial-in client´s LAN network address is 192.168.0.0/24. The HQ network is 192.168.0.0/16. This will also lead to routing problems. Is it possible to map the HQ IP-Address [192.168.0.0/16] within the tunnel to another network (e.g. 192.0.0.0/16) ?For testing purposes we altered the accessible networks into another network [10.0.0.0/8] which is also connected to the Fortigate. But that did not lead to data flow through the tunnel. gatewayname: 'EMS_Test_0'local-gateway: 123.45.678.123:4500 (static)remote-gateway: 123.46.78.123:6289

Hi guys, What is the right procedure when creating NAT to my web server. should be accessible outside using a public ip of the same subnet as my wan interface. i am using sd-wan interface. thank you in advance.

Dear EveryoneI recently bought and old fortigate 61E on ebay, i capture the serial number and the image of the product and sent to customer service to ask for device transfer, but they said that they do not support product that not bought from authorized seller, I also contact the email of the pre owner and he said that i already remove the device from his account and i have to factory reset the fortigate and register it to another account. But this does not seem to helpAnyone here who has experience with this, will i be able to register the device after the old owner removes it from his account?What is the best way to deal with this trouble?Thanks

Hi,After upgrading to FortiOS 7.2.8 we are having some issues with the WAF filter on some of our services. It seems that the filter in this version is setup harder or that the exceptions we built in the past based on event ID's are being ignored.I noticed that when an event has been blocked no Event ID is showing up. On previous versions I could use the event ID to create an exception but now I can't. Any ideas?Thank you in advance.

Hi, we Have a F600E, which is the single main router, firewall and DHCP server to a single LAN. What we want is when a group of VPN clients connect with FortiClient VPN to this device and network, they should only be able to communicate with one machine in that LAN, which is a file server. We don't want VPN connected clients to have access to any other local machines in that network. How can we achieve this ? Thanks

I have a FortiGate configured with two tunnels on two Ethernet ports with the intention to do load balancing or traffic steering on them. They go through a router to converge onto one port/IP at another FortiGate (a.k.a. server). The server is configured with one dynamic tunnel, and I left the dst-subnet in phase2 empty.I can connect to the server fine, and the server "spawns" logical tunnel interfaces _0 and _1 for each dial-up. However when I ping from client to server or initiate any TCP connections, the responses all come back on _1 even if the origin is from tunnel _0. When I look at the FortiView Sessions list in GUI it just shows the session from the parent tunnel name. The Debug Flow shows the origin point of the session was from the right tunnel but it chooses to output on the other tunnel. It is as if it is using the routing table to pick the interface, not the origin tunnel, and I don't know what makes it pick _1 all the time either.Is this a misconfiguration on my part or F

I was sent this article. It is amazing to me the amount of time that was invested in hiding the script and the related activity. Are there any tips or tricks to stopping melicious code like this? https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/ 

Hi,I've configured ipv6 for the first time on my Fortigate 50E with 6.2.16 firmware.My ISP doesn't give me the option to delegate /56 or /60 subnet but only eight /64 subnets for internal use. So I've connected the wan1 port to the ISP bridge and using link local IPV6 address of the Fortigate WAN1 port I've I've delegated one of the /64 prefix to the Fortigate.Then I've configured the WAN1 port via CLI in dhcp as follows: config system interface edit "wan1" config ipv6 set ip6-mode dhcp set ip6-allowaccess ping set dhcp6-prefix-delegation enable end next end Next I've configured my lan interface: config system interface edit "lan" config ipv6 set ip6-mode static set ip6-address xxxx:xxx:xxxx:f2f1::1/64 //the subnet is the same of the one delegated by the ISP set ip6-allowaccess ping https ssh set ip6-send-adv enable set ip6-other-flag enable config ip6-delegated-prefix-list edit 1 set upstrea

I have a company that has about 200 VPN users and we are wanting to push the IPSec configuration to them. I can deploy the Forticlient using Windows Group Policy but I also was to push the IPSEC configuration. Can that be done using Group Policy or is there another way to push it so I do not have to touch 200 machines. FortiClient 

Hi, we have a customer who has >20 FG30E and FG50E units to connect ther small branch offices. They are in the middle of a ERP change, so the trade up for new FG models was planed for the end 2024. Yesterday they told us that in 2 offices (1 x FG30 and 1 x FG50) their internet is really slow. We connected from outside and for us everything seemed normal. We sent a technician and he found out that connecting directly to a LAN port he got like 25-50% ping loss to the FG unit.  We had once a similiar case and we needed an RMA. It seems clear that this is a hardware failure but for us doing an RMA is also bad timing and bad process for the customer. Anybody else got the same issue and found a work around or is the RMA the only solution? Thanks!

I am trying to get an api call to FMG to get statistics for FortiAP from the FMG or FAZ. The document online states the use of IP addresses but we cant use that for our case. Is there anymore info on api calls for FortiAPs from FMG or FAZ