Solved

Good morning, Since upgrading to 7.4.3 on my 601E firewall cluster, my AP's (only 9 of them) keep dropping offline with no good explanation in the logs that I can tell.  I never had a problem with the previous version I was at which was 7.4.1.  A reboot of the AP (either by resetting the POE on the switch port or by unplugging and plugging back in) will bring the AP back online and connected with clients but then randomly (could be hours or days later) it will drop back off.My Fortigate cluster is stable (no HA changes) and seems to be normal.  The APs are all 221Es running 7.4.2 firmware.  The only log entry I see that seems to be related to when they drop is:Action ap-failReason Control message maximal retransmission limit reachedProfile resv-dflt-FP221E5519035229Physical AP ap-2b-publicMesh Mode mesh root apMessage Failure happened on AP ap-2b-public. I did find a document (https://community.fortinet.com/t5/FortiAP/Troubleshooting-Tip-After-a-failover-F

Blocking External Access to the Anydesk ApplicationHello, good morning.I'm trying to block external access to the Anydesk application installed on computers on my internal network. I've tried several times to block access by creating firewall rules to block access from WAN to LAN, but to no avail. However, I can normally block access from LAN to WAN using Web Filter, Application Control, or Anydesk's internet service.Could you help me with the best way to implement this external block?My goal is for users on my internal network to be able to use Anydesk for remote access normally, but for external access to Anydesk on my local network to be blocked.Thank you in advance.

We've had sections created on each of our FortiGates (currently running 7.4.6) that we manage via FortiManager. Today upon logging into FMG, two of the FortiGates now have the section before every firewall rule and not the specific sections wherer they've been for the past few years.  I suspect the cause is something within the FortiManager, because we deployed changes to these two firewalls yesterday, and when I look at what's about to be deployed to another firewall, every line of the firewall policy has "set global-label "blah(##)".  Can someone point me in the right direction as to how to disable this behavior? Thank you.

Hello Team,We are currently working on configuring per-user firewall policies for SSL VPN access using both LDAP and Azure IdP (with MFA) to restrict access to specific destinations for individual users.Our FortiGate firewall is successfully integrated with Microsoft Azure IdP for SSL VPN authentication using token-based MFA. Additionally, we have integrated our on-premises Active Directory with the FortiGate firewall for SSL VPN access.However, when creating firewall policies, we are encountering a limitation where policies are applied at the group level, rather than allowing us to define policies for individual users.Can someone advise on the best workaround for this scenario? Specifically:Do we need to create individual user groups in Active Directory and Azure IdP for each user to achieve per-user control?Alternatively, is there a method to configure this directly on the FortiGate firewall?We are also utilizing FortiClient EMS for managing remote access VPN policies. If there's a w

Hello community! Which FortiSIEM version is preferred for critical production environment in terms of stability, bug free and LTS7.3.0, 7.3.1, 7.3.2 or 7.4.0? Thank you very much in advance. Regards,Miguel.

Hello, I’m experiencing an issue where the Web Filter profile on FortiClient EMS does not block access to sites categorized under Gaming, despite being explicitly set to Block. Details: Web Filter profile is correctly applied in EMS.FortiClient shows the Gaming category as blocked.Testing was performed on macOS M3 (Apple Silicon).The Web Filter browser extension is installed on both Firefox and Chrome.However, no block page is displayed and the user is able to browse gaming websites freely.  It appears the Web Filter is not being enforced properly on macOS endpoints.Is there anyone who has encountered this issue or has suggestions on how to resolve it? Thanks in advance.  

Hello colleagues,I have a question related to the FortiGate 7.6.0 and the property security-rating-result-submissionconfig system global set security-rating-result-submission {enable | disable} endThis property was documented and available in the 6.2 version of the product:Security rating | FortiGate / FortiOS 6.2.16 | Fortinet Document LibraryAfter upgrade of the FortiGate to the version 7.6.0 I cannot find this property anymore:config system global | FortiGate / FortiOS 7.6.3 | Fortinet Document LibraryI also found the information that this property was excluded from the CLI in the document:https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/51fcbb4f-33ff-11ef-bfe5-fa163e15d75b/fortios-v7.6.0-release-notes.pdf995885 Removed the set security-rating-result-submission setting under system.globalCan please someone confirm that the propertysecurity-rating-result-submissionis officially excluded and it will not be available in the product anymore(or it was r

Hi All, I am new to FortiGate and i am doing a lab for LDAP I set up the LDAP server on the FG and the connection to the LDAP server is successful however, when I test a user credential on the LDAP it says invalid credential even though i am sure the credentials are correct. not sure where I can go from there?  your help and guidance is much appreciated  

Good evening  I want to monitor a lan to a zabbix server with ip address 192.168.1.87 connected in bridge adapter but a tracer to a zabbix server and i see the ip 10.50.3.21 FortiGate-HomeLab # show system interface port1config system interfaceedit "port1"set vdom "root"set ip 192.168.55.10 255.255.255.0set allowaccess ping https ssh snmp http fabricset type physicalset lldp-reception enableset role wanset snmp-index 1nextendFortiGate-HomeLab #FortiGate-HomeLab # show system interface vlan20config system interfaceedit "vlan20"set vdom "root"set ip 10.10.20.3 255.255.255.0set allowaccess ping https ssh snmp fabricset device-identification enableset role lanset snmp-index 29set secondary-IP enableset interface "port2"set vlanid 20nextendFortiGate-HomeLab #FortiGate-HomeLab # show firewall policyconfig firewall policyedit 1set name "vlan20-port1"set uuid a58b44a4-3d9d-51f0-e235-a09bba7147a0set srcintf "vlan20"set dstintf "port1"set action acceptset srcaddr "vlan20"set dstad

I am using Fortigate Firewalls between Windows clients and domain controllers. In this case by allowing DCE-RPC, does the firewall allow the required return sessions without allowing dynamic port range? What are the requirements like firmware, IPS etc?

In our environment, we use FortiClient VPN version 7.0.14.0585. We started researching into the possible benefits of Intune, so I configured enrollment, compliance polices, and a simple BitLocker requirement. Those are the only changes to our Entra/Intune environment that I made. Soon, I had rolled Intune out onto a few computers in our division. One of our employees notified us of issues connecting to the VPN, and we suspected Intune to be at fault. Sure enough, when Intune was removed the issue went away. Screenshot is attached. When clicking yes, you are brought a blank page with a 300 second time out.

Hello all,I have a client where WIFI is prompting as though captive portal is enabled while set to WPA2-Personal.We've updated both firewall and APs to the most recent version 7.2, to no avail.Next attempts will be a downgrade to observe if the issue persists on 7.0I will be happy to add details or information as needed. Hoping someone can help.**EDIT**This issue started last Friday 11/4 (no changes or updates that we are aware of)Current config:config wireless-controller vapedit "guest-test"set ssid "testSSID"set passphrase ENC set intra-vap-privacy enableset schedule "always"nextend

Hello. We are getting ready to migrate to a new Fortigate 101F. Our current device is a Fortigage 101E.  The version of FortiOS installed on the new device is 7.2.8. Should I upgrade to 7.2.11 or go to the latest 7.4 release. We are currently running 6.4.16 on the 101E.

Hi There,I have 40F running 7.2I have Site2Site IPSEC VPN Running.I have added to to Phase 2 the Subnet that is used for the Remote Access SSL-VPN users (172.16.255.0/24).over the split tunnel - I've added the subnets that are in the remote S2S Firewall (because these are the relevant subnets).I've added a rule over the firewall - do I need to set anything else ?here is the configuration I've used:config firewall policyedit 26set name "POD1"set srcintf "ssl.root"set dstintf "S2SVPN"set action acceptset srcaddr "SSL VPN"set dstaddr "POD1"set schedule "always"set service "ALL"set users "pod1"nextend config vpn ssl settingsset servercert "SSL-VPN"set tunnel-ip-pools "SSL VPN"set source-interface "wan"set source-address "all"set source-address6 "all"set default-portal "SSL_VPN"config authentication-ruleedit 1set groups "VPN_USERS"set portal "SSL_VPN"nextendend config vpn ssl web portaledit "SSL_VPN"set tunnel-mode enableset web-mode enableset limit-user-logins enableset save-pass

Hello, I have set up a firewall policy to test our FSSO functionality. I have noticed that when the FSSO group corresponds to a user DN it works fine, however, if it corresponds to a Global Security group, it does not work. Below is the firewall policy: show firewall policy *** config firewall policy edit *** set name "TestFSSO" set uuid f44e2db6-3fe8-51f0-****-6d00*****3be set srcintf "lan" set dstintf "wan1" set action accept set srcaddr "all" set dstaddr "all" set schedule "always" set service "ALL" set utm-status enable set inspection-mode proxy set profile-protocol-options "custom-default" set ssl-ssh-profile "certificate-inspection" set av-profile "default" set webfilter-profile "Default" set dnsfilter-profile "default" set ips-sensor "Default" set application-list "Default" set logtraffic all set nat en

Today, all of a sudden 100+ clients reported W32/Tedy.7918!tr malware in C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe. The definition was just updated today and it may be a false positive, but I want to verify if the alert is legit. Did anyone have the same issue and what would be best practice to verify this alert?Thanks,Markus

Hi, As someone who proposes and implements FortiGate solutions for clients,I have received detailed inquiries from them regarding the “File System Check Recommended” message.I understand that this message appears when a proper shutdown cannot be performed. However,I would appreciate any advice on the following points that I was unable to investigate further.If the message is canceled once, will it no longer appear again?Is it possible to reproduce the same message even after canceling it?Is there an alternative method to check for errors in the file system?Thanks, Kenji

Anyone know why a Fortinet firewall set to originate type-2 externals is advertising what looks like type-1 costs (i.e., including internal path costs)? I thought with type-2, only the cost I manually assign to the interface (e.g., set cost 100) should be advertised, regardless of internal link costs. Instead, neighbors are seeing the cost increase as if type-1 logic is being applied. Misconfig? Bug? Misunderstanding on my part?Below is my ospf config for referenceconfig router ospf set abr-type cisco set router-id 192.168.8.181 config area edit 0.0.0.0 set authentication message-digest next edit 0.0.0.16 set authentication message-digest set stub-type no-summary set type stub config range edit 1 set prefix 172.16.0.0 255.255.0.0 next end next end config ospf-interface edit "segfw-user" s

Hello, Kindly, we want to download the Fortinet VMs for the following products : Fortigate, Fortiswitch, FortiSIEM... to build a test labCould anyone guide us how to download it and how to get demo licenses, BR

Hi, Has anyone configured FortiMail to block only password protected archives? I.e if it's not possible to open it to block it, otherwise send it through. Kind regards, -1984-

Hello everyone, I'd like to better understand the "set update-static-route" command and the effects of "enable" and "disable" settings.I read several articles but I want to make sure what I'm doing because I'm setting up a firewall remotely on a remote site where it's difficult to dispatch so I'd like to avoid making stupid mistakes. We have two WAN links, ext1 is fiber and ext2 is cellular, so ext1 needs to be primary and ext2 secondary. We are not looking at improving performance, we just want extra reliability so everything fails over automatically to ext2 if ext1 fails, and also it fails back automatically to ext1 when it comes back. There's a passage in this article that annoys me : Link-Monitor Explained - Fortinet Community **set update-static-route Enable/disable updating the static route, default: enable”[** It is advised to keep disabled as it may cause the production environment down , Make sure it's working before enabling it] I think I need to

Hey everyone, a user in my company has a problem with windows 11 and FortiClient.When he connects his FortiClient sucsessfully, he doesnt get any data traffic, probably because of a wrong IP configuration. We already tried to reinstall version 7.2.8 and also uninstalled it and installed 7.2.6 -> same error even after upgrading 7.2.6 -> 7.2.8On the attached screenshot you can see that FortiClient shows a different IP adress then the adapter in cmd with ipconfig, to me that looks like the error.The exact same constilation between Windows 11 and FortiClient 7.2.8 worked for the user the last 5 months until today. When you google something the following message appears: He is currently the only user with this issue, other users can work perfectly fine.I hope you guys can give me a solution. Best reguards,Alex

Hello everyone, I have a working configuration for remote accesssing via VPN and SAML (Microsoft Entra).  I am trying to restrict the access to the VPN on only specific devices. It does work when FortiClient uses external saml via edge browser. But when someone has set a different browser (e.g. firefox) as default and FortiClient uses Firefox to provide the SAML login, there are some background informations missing which are needed in entra. These information seems to be only available when using edge as browser (shown by my testing).  Is there any way to set edge as browser for using saml and not the machines default browser?

Current running on VM and no hardware disk present but I wish to use current DIsk System as log diagnose hardware deviceinfo diskDisk SYSTEM(boot) 40.0GiB type: IDE [Virtio Disk] dev: /dev/vdapartition 231.0MiB, 93.0MiB free mounted: Y label: dev: /dev/vda1(boot) start: 2048partition 1.7GiB, 1.4GiB free mounted: Y label: dev: /dev/vda2(boot) start: 526336can I partition to use as log and how ?

Hi Team, SAML authentication is not working. We have integrated Azure IdP with on-prem Active Directory and called the Azure IdP on the Fortigate Firewall. We are using SSL VPN and when we dial up the remote connection, its getting stuck at 40%.  Can someone help out on this.Thanks