Solved

Hi all I am somewhat stumped about this issue and I am not sure where to start looking. Problem:There is an app with automatic checks to the internet which also automatically repeats dns queries to our internal dns servers. Those queries come from five or six source ports from each of the two IP addresses (the app runs on two servers) and there are quite a lot of those requests.This app runs on a virtual machine which is connected to a fortigate 60F with 6.2.9.The query goes to that firewall and then trough a VPN to another fortigate and from there to the DNS. If the internet goes offline for MORE than about five minutes and then comes back again, the automatic queries don't get an answer anymore (as if the DNS server never gets the requests).If the internet goes offline for LESS than five minutes, then there is no issue.(I am not 100% sure about the exact amount of time). Some more info:Unfortunately I have no firewall logs from that time it happensThe customer is

Dear All,  Is there any way to create a script which run when there is a change in the routing table? I would like to make a mechanism that triggered by a bgp routing update. Shortly: when my fortigate get a /32 prefix via bgp (from a certain subnet), then I have to add manually a proxy-arp for that /32.Any advices or key-words are appreciated!Thank you very much

Hi! I've 2 Fortigate 40 with a IPSEC tunnel, working great.Then in each one, I've a SSL vpn for client pc's, they can access local lan in both sites.Problem is I need to allow access to Site 1 using SSL vpn on Site2.Tried to adapt this https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/45836/ssl-vpn-to-ipsec-vpn but cant get it to work.On Site2 I created a policy to allow SSLVPN traffic to access the VPN tunnel:Income - SSLVPNOutgoing - IPSEC TunnelSource - IP range for SSL and the ssl user groupDestination - The remote subnet on Site1Tried with and without NAT, but doesnt work. Don´t I need a policy to allow in Site1 also? Tried that also, but doesnt work. Can anyone help or point another example? Thansk in advanced

Hi everyone, I'm kind of very new to FortiAuthenticator. I am working on setting up one at a customer. I am having issues with the self serve portal (not the legacy one) for the password change. I have setup both LDAPS and the FortiAuthenticator is joined to the domain (although documentation said I need only one of these, issue below was not working with only LDAPS). When trying to change the password for my test user, whatever I put as new password, it doesn't want to take it. I have tried complex, short or long password or even simple ones, I always get the error message below. If anyone have any hint, that would be greatly appreciated.

Every time I try and create a cert using the Let's Encrypt service in the Fortigate it fails. I have followed the KB's I have found and also tried through the CLI. I enabled DDNS, but no matter what I do, it just fails. The Fortigate is a 300E running 7.0.5. Is there anything special that has to done. Here is what I using and doing. I have called Fortinet support, but the person I spoke to ran into the same situation. (Yellow Highlighted area: Yeah, not so much) It used to generate logs, not sure why its not now.   

Dears ,we have two ISP connections wan1 and wan2 which are configured to use SD-WAN on fortigate 100E , we have noticed that there is internet issues over some applications like anydesk connection timeout and slowness once the SD-WAN is on , how can we troubleshoot this further? everything becomes normal again once we turn off the SD-WAN . Regards , 

I am not sure if the SFP ports of the Fortiswitch fs-148e-poe work at 1000 or support 10Gb. The datasheet indicates that the ports are GE but this other document indicates that they support SFP+ FG-TRAN-SFP+SR transceivers, which are 10GB transceivers. Can someone confirm the maximum SFP port speed of the fs-148e-poe please? Thanks a lot!   

Hey there,For those who are running and managing FortiDDoS in your corporate network, what do you think about it? I don't really care if you're running SoHo, DC or carrier-class devices, just looking for feedback about the full product.I have several questions about stability and effectiveness of it, posting it just in case someone can reply his personal experience.How stable is it as a hardware appliance ?How effective is it stopping DDoS attacks ? When successful, what was the vector attack?How often does it trigger false positives ?Cheers!

Hi, guys, Another "session clashed" found in Fortigate 400E with FortiOS v6.4.2 My NAT configuration is VIP + NAT enabled: ( 111.111.11.5 :18889 --> 10.16.6.35:18889), 100.100.11.54 is the internet user: The Fortigate eventlog is below:1: date=2022-06-12 time=22:01:54 logid="0100020085" type="event" subtype="system" level="information" vd="root" eventtime=1655085714423584374 tz="-0400" logdesc="session clash" status="clash" proto=6 msg="session clash" new_status="state=00010200 tuple-num=4 policyid=69 dir=0 act=2 hook=0 100.100.11.54:58902->111.111.11.5:18889(10.16.6.35:18889) dir=0 act=1 hook=4 100.100.11.54:58902->10.16.6.35:18889(10.16.6.254:31307) dir=1 act=2 hook=0 10.16.6.35:18889->10.16.6.254:31307(100.100.11.54:58902) dir=1 act=1 hook=4 10.16.6.35:18889->100.100.11.54:58902(111.111.11.5:18889)" old_status="state=00010200 tuple-num=4 policyid=69 dir=0 act=2 hook=0 100.100.11.54:58902->210.57.60.2:18889(10.16.6.35:18889) dir=0 act=1 hook=4 100.100

Hi,is there any one who can give me some information about /bin/foritviewd process on fortiweb devices?when I run get sys top command i see /bin/fortiviewd process consuming about 30 percent cpu.is there any risk if i kill this process?Regards.

We found "session clash" in the Fortigate model 600E with FortiOS v7.0.3, the eventlog as below: 1. Fortigate eventlog (internet IP: 100.19.44.39;  Fortigate VIP (46.96.186.1 ->10.113.1.115, currently is VIP static NAT :( 1: date=2022-06-10 time=09:48:54 eventtime=1654825734757941183 tz="+0800" logid="0100020085" type="event" subtype="system" level="information" vd="root" logdesc="Session clashed" status="clash" proto=1 msg="session clash" new_status="state=00010200 tuple-num=2 policyid=258 dir=0 act=2 hook=0 100.19.44.39:28674->46.96.186.1:8(10.113.1.115:8) dir=1 act=1 hook=4 10.113.1.115:8->100.19.44.39:0(46.96.186.1:28674)" old_status="state=00010200 tuple-num=2 policyid=258 dir=0 act=2 hook=0 100.19.44.39:28618->46.96.186.1:8(10.113.1.115:8) dir=1 act=1 hook=4 10.113.1.115:8->100.19.44.39:0(46.96.186.1:28618)"2: date=2022-06-10 time=09:47:51 eventtime=1654825671783553340 tz="+0800" logid="0100020085" type="event" subtype="system" level="information" vd

Hi team, I'm trying to connect to My ssl vpn configured in FGT from external NW but I'm facing issue while connectingIt is getting stuck in 10%Please suggest

Hi everyone, I would like to remove root vdom and remain another created vdom. I did remove all the reference on root vdom but it still unable to be removed. Is it possible to remove root vdom? Thank you.

HI all,as per diagram,the three sites are configured with BGP and all is working properly.All the networks are received trough BGP from both FGTs and from Cisco R1.Now the problem is when i configure Vlan in FGT.As per diagram,vlans configured trough cisco router as L3 device are working properly,buuut the Vlan I configured on SITE-C FGT (Vlan 50)the network is published trough BGP to all the sites,but the PC4 is only able to ping his GW but any site.I don't understand if is a bug or something not configured properly.Wireshark only give "no response found" for ping request.Either PC4 can't be pinged from any other site.Basically,all network is working proiperly,only vlans configured in FGT are not working.Thanks in advance!

Keeping Split Tunneling routing address blank in SSL-VPN portal. be able to use FQDN addressesso my collaborator's internet goes out through fortigate, or through the internet from his own home? Leaving Split Tunning blank, when checking the IP that the Client is going out to the internet, it is the Company's IP. Is internet traffic going all the way through Fortigate? https://community.fortinet.com/t5/FortiGate/Technical-Tip-Access-to-Specific-FQDN-using-Split-Tunnel-SSL-VPN/ta-p/190062?externalID=FD46248

EnvironmentFortiGate 6.4.4FortiClient EMS 7.0.4 (Cloud)FortiClient 7.0.5 So I am just starting to look at the Web Filtering module and have some questions: Q.Is there any dependency on FortiGate Firewall or can this be ran independently given a lot of my users are WFH? Q.Once configured, I see there were prompts to install the Web Filter extension for Chrome and Edge on the detected browsers.The Chrome extension was found and installed OK but when I tried the one for Edge (Chromium version) it took me to a blank Add-ons page which displayed nothing.Is this a known bug?Tried installed the native Chrome extension for Edge but I was still getting prompts. Q.Is there any work required on the ForitiGuard setup? I presume that this is part of the licence set you get with Cloud EMS. 

Hi, I have a question about FAC as below.1. I want to set Captive Portal on FAC as HTTP. but I found only HTTPS service on network setting. Can I set Captive Portal as HTTP?2. Can FAC Provide a logout page after done login page? My Network DiagramComputer (wired) > Fortigate(Point External Portal to FAC)> FAC that provide Captive Portal. Thank you.

How do i find out what is inside the custom1 list under Local Categories in Web Filter ?What URL are inside this custom1  

Hello, forum. I need help ASAP. So I decided I wanted two-factor authentication on my Fortigate-30E. I was supposed to receive an authentication code or something like that to my email but I never received it. I'm now unable to get into my fortigate (GUI and CLI) because it is requesting a Fortitoken. I went to the Fortitoken page and now have a free license but I would think the previously stated activation comes first. I don't have a license for Support and I'm not apart of any organization. I'm just a aspiring network engineer that wanted something to practice on at home. Can someone help? 

Hello,Do you have information about release date FortiOS 7.0.6? Our security team requests a fix for CVE-2022-0778. The solution is to upgrade to 7.2 or 7.0.6 https://www.fortiguard.com/psirt/FG-IR-22-059I don't want to install 7.2 in a production environment.Thank you

Everything had been working just fine. Then last night I got this error code (-20199). I thought the VPN was down. Called work this morning everything is working fine on their end. I checked with their IT department and he doesn't know/hasn't hear of this problem. 

 Hi  team：The client is headquartered in China, 70 percent of its employees are located in China, and 30 percent are located overseas.Our plan is on-premise forticlient ems,Due to the Internet in China, we hope to deploy a set of EMS overseas to deal with the problem of network connectivity, so do you have any suggestions to solve this problem?

Hi,I am new to fortinet, I need to setup a network consists of two FortiGate1101E with forti Authenticator, Forti Manager and Forti Analyzer  in the HQ and about 100x FG-40F in branches. In each branch, I have one FortiAP and One FortiSwitch.The branches with will connect via IPsec tunnels to the HQ.My questionCan I create one single wireless network all the beaches, the core firewall or do I have to create a WLAN in each remote branch separately?Is there a design document to help with my scenario? Thanks2.12.0.02.12.0.02.12.0.0

Hi,Old Checkpoint R77.30 user, I'm using now one cluster of FG100E with v5.6.7 build1653. I'm having difficulties with Anydesk: all my workstations can't connect to Anydesk's services (error ssl_14090086).Application Control is on with "Monitor all applications" default profile and no trace of Anydesk in Application Control LogBut in Web Filtering logs, it's full of  hostname "AnyNet Relay" or URL "AnyNet Relay/" sometimes with non resolved IP or the classic boot-*.net.anydesk.com or relay-*.net.anydesk.com with Unrated Categorie.I've added Static URL Filter but no success. I can't add wildcard * expression in Web rating Overrides.I've also made a rule for testing with any any all "Anydesk-Web" but this Internet Service have only 28 entries and i can't edit thoses.The only thing that works: remove the Web filtering, and i don't want that.If someone could give me some hints. Thanks.

Hi, I have gotten a very special request that I can't figure out if is possible by some kind of magic.What is wanted is that all traffic except MS Teams traffic is routed through the Fortigate and Teams traffic is directly accessed.It's a Fortigate 200E with firmware 6.4.6 and the free vpn client going over ssl-vpn. Is there any way to achieve this?FortiGate#Client