Solved

Hello Community, Why I don't have ddns settings in fortigate interface, although I can configure ddns via CLI. Is it because of a license issue? 

We are having a bizarre problem since updating to 6.2.1 (we updated due to a memory leak issue in 6.2.0). Certain sites are giving us a ERR_SSL_PROTOCOL_ERROR only in Google Chrome. I have tried all the usual troubleshooting for this error, but the only thing that fixes it is restarting the fortigate. Two sites (facebook.com and login.renweb.com) both use TLS 1.3, but we can get to facebook without a problem and we cannot get to the other site. After rebooting the device, it works for several days and then starts behaving poorly again. Other browsers work fine, including Internet Explorer, Edge (not Chromium based) and Firefox. I have attempted to disable SSL certificate inspection, but that does not seem to affect the problem one way or another. I also tried putting the fortigate back on its factory certificate. My next step will be to revert to 6.0 branch, where I did not experience this issue, but I figured I would post first to see if anyone had similar exp

Hello everybody,I'm the Fortigate 60F (v7.2.10) admin, and I log into it at: https://vpn.xxx.com:40443/ or https://10.1.0.1:40443/ I defined a local-in policy to momentaneously deny the access to this page to all the users. All the policy above this one are disabled: edit 5set uuid d5c73f7a-eae5-51ef-8ecd-4cb99f22bef3set intf "any"set srcaddr "all"set dstaddr "login"set service "HTTPS-40443"set schedule "always"next The dstaddr is:   while the service is:  I should access the login page from everywhere. Why? What I am doing wrong? vpn.xxx.com is a DNS entry:    

How my product is locked why I can't registered Please help urgently   

Hello everybody, I'm working on a Fortigate 60F (v7.2.10) and I manage my Fortigate at the address: https://vpn.xxx.com:40443orhttps://79.x.x.x:40443  (for externals)https://10.1.0.1:40443  (for internals) because 79.x.x.x is the wan1 interface, I defined two local-in-policy:  login_group is an address group:     HTTPS-40443 is:    The policy n.1 works fine, if I try to access (10.1.0.1:40443 or vpn.xxx.com:40443) I correctly see the login page.From the same network (10.1.10.0/24), another device, can't (correctly).If I use an external device (for example my phone), connected to a different external network, it can access vpn.xxx.com:40443 and also 79.x.x.x:40443. The policy n.2 doesn't generate any log. What am I missing?    

Hi there, I'm encountering problems with the newest FortiClient VPN application. The primary problem is that after hitting the connect button, it displays "Disconnect," yet when I verify the IP, I'm aware that it's not connected.

Hi All, I've just configured link-monitor to allow failover to WAN2 when internet access through WAN1 is unavailable.I've applied this config without any errors, but it doesn't appear to display all the settings.config system link-monitor (link-monitor) # edit "WAN_Failover" (link-monitor) # set srcintf wan1 (link-monitor) # set server "8.8.8.8" "4.2.2.1" (link-monitor) # set protocol ping (link-monitor) # set gateway-ip xxx.xxx.xx9.17 (link-monitor) # set interval 500 (link-monitor) # set failtime 5 (link-monitor) # set recoverytime 5 (link-monitor) # set update-static-route enable (link-monitor) # set status enable The resulting config is displayed below.FW1 # show system link-monitor config system link-monitor edit "WAN1_Failover" set srcintf "wan1" set server "8.8.8.8" "4.2.2.1" set gateway-ip xxx.xxx.xx9.17 next endAs you can see, the following parameters are missing.(link-monitor) # set protocol ping (link-monitor) # set interval 500

Hi All,I'm trying to configure a WAN2 failover but I'm getting stuck on NAT.I have a primary leased line internet circuit on WAN1.I have a secondary FTTC internet circuit on WAN2Both WAN interfaces are in a WAN-ZONE.All firewall policies currently have a specific outbound NAT address with a dynamic ip pool address.This outbound NAT address is different to the public IP assigned to the firewall.The IP Pool addresses are Overload addresses.I have several IP Pool addresses with incremented public ip addresses assigned.Some firewall policies will have different outbound NAT IP Pool address.It is a single public IP from the range allocated to the internet circuit on WAN1. I plan to configure link-monitor to detect when there is problem with WAN1, override the current static routes and send all outbound traffic via WAN2. The problem. When testing, If a client hits a policy like this below, it cannot get to the internet.This is due to the option, "Use Dynamic IP Pool"

Hello Expert, I configured a Stitch to backup our Fortigates firewall to an solarwinds tftp server. But I notice once the backups are completed for a week it is not running automatically for the next week. I did some troubleshooting and found that last trigger date and next scheduled trigger is same.Unsure if this is preventing the backup from running at the next appointed time.I humbly request some help . Please results before for guidance .  Guy-Head-Office-1 # diagnose test application autod 3alert mail log count: 0 stitch: Weekly_backups_to_TFTP (scheduled)local hit: 0 relayed to: 564 relayed from: 564last trigger: last relay:Sun Feb 9 14:08:41 2025next scheduled trigger:Sun Feb 9 14:30:00 2025actions:Upload Backup config to Tftp Server:done: 564 relayed to: 564 relayed from: 564last trigger: last relay:Sun Feb 9 14:08:41 2025 Thank youRegards  

In a FGCP cluster trying to get session sync traffic over the dedicated interface with the set session-sync-dev command. But the corresponding diagnose output seems to indicate it doesn't work. fgt1 (root) # diagnose sys ha session-sync-devHA sessync ports: 1dmz probe: HA probe, Standalone connected, peer_mac = 00:00:00:00:00:00HB pkts: rx=0, tx=508298SES pkts: rx=0, tx=0 Seems to indicate HB packets are send, but none received. Also the status remains probe for HA.The cluster is connect with a direct cable, no switch in between or such.Tried with other interfaces also, wan1, internal4, ... Anyone has this working and different command (diagnose sys ha session-sync-dev) output? What are your counters and status?

Hello everybody,I've a simple IPsec tunnel on my Fortigate 60F (v7.2.10):  Is it possible to reserve a particular address to a specific client based on the MAC address. Let's suppose I want to reserve 10.212.134.221 for the client whose MAC address is xyz. Is it possible? My attempt was:I connect from the xyz PC, then I go to Settings -> DHCP Monitor -> Select the client ad reserve the address. Unfortunately, during the IPsec connection, the client is not shown inside the monitor.Is there any way to do what I want?Thank you!

 I have two Sites (Site A) using Fortiddns, and Site B using Daillup . There is VPN tunnel between them and it's working fine. I want to make DNAT for my server and it's behind Site B. I don't have public IP Addresd .it's not working in this scenario? 

Hi All,I'm looking for advise on configuring a backup internet connection using vDSL.I have a Draytek 167 which I plan to set to bridge mode and perform the PPPoE authentication on the FortiGate.I have a single /32 public ip address. Any thoughts on this?The ISP is Andrews and Arnold.

Currently I have a typical Active Directory on-prem setup. 1- Persistent Agent gleans the username from the PC. 2- NAC is linked to AD and pulls the group info for the user.3- NAC sends the group tags to the Fortigate for use in FW policy to limit access for certain groups If we move to EntraID (which does not have directory services), how can we keep this design ?Is there any kind of workaround ? Don   

I got FortiCare today so downloaded some firmware off the site following upgrade path then the UI offered to do upgrades in the console rather than manual. Now it is at v7.0.17 and the upgrade path tool goes up until only 7.0.16 so I don't know how to move up to 7.6. "Firmware Management  Current FortiGate versionv7.0.17 build0682 (Mature)Select FirmwareLatestAll UpgradesAll DowngradesFile UploadThe firmware is up to date." This is from console. Thank you.

Hi there, I'm surveying related FG-121G solutions. Since FortiOS 7.0 satisfies Common Criteria for Information Technology Security Evaluation, Version 3.1 Rev. 5, June 2024.However, I checked related information (https://www.fortinet.com/corporate/about-us/product-certifications/common-criteria) that did not include FG-121G.Could the FG-121G be certified and listed in Security Target this year?

Hello everybody, I'm using a macOS with 7.2.5 of Forticlient.I had a deployment error with my device. Looking at the logs, i found this error: Downloading data from xxx:10443/Installers/default/FortiClient for Invitation/FortiClient_7.2.8.dmgURL using bad/illegal format or missing URL Obviously the error was caused by the spaces between the words:  FortiClient for Invitation On the EMS, I updated the URL, removing the spaces. At this, point, I want that my client, for the next update, automatically downloads the file from the new url. How can i say to my client:retrieve the new url and download the installer from thereIs there some command to push this new url to my client?Thank you! 

Is there a way to automatically map AD Groups to Workgroups for use in Policies ?I saw this article that seems to support it in 6.2. Seems the functionality is missing in 7.4.1  https://docs.fortinet.com/document/forticlient/6.2.0/new-features/280319/automatic-group-assignment#:~:text=group%20assignment%20rule:-,You%20can%20use%20AD%20groups%20to%20categorize%20users%20into%20different,local%20domain.  

Hello, I'm blocking app control Proxy category but I need to whitelist access to proxy-safebrowsing.googleapis.com. It falls under Proxy.HTTP application and gets blocked. I would like to do it via custom signature. But I can't seem to match the traffic using my custom signature.  I've read the signature creating guide and followed it but no luck. It still recognized as Proxy.HTTP.   config application custom edit "Google.Safebrowsing.Proxy" set signature "F-SBID( --attack_id 9876; --name \"Google.Safebrowsing.Proxy\"; --service HTTP; --protocol tcp; --  app_cat 6; --pattern \"safebrowsing.googleapis.com\"; --weight 40;)" set category 6nextend config application list edit "AppControl" set extended-log enable set other-application-log enable set unknown-application-log enable set deep-app-inspection disable unset options config entries edit 4     set application 9876  &nbsp

On the fortigate 100D, I configured an IPsec Site to Client VPN. How do I make the remote device connected to the VPN continue to access the internet? In this scenario it is Windows 11.

FortiMail 3000FFirmware version: 7.4.2 Two problems occurred when registering approximately 5,000 new aliases via CLI to FortiMail, which already has 100 aliases registered.1. When mail is received by newly registered aliases and existing aliases, mail is not delivered to members (user unknown is displayed even though the user is already registered).2. Adding/deleting a member in the GUI is not reflected in the alias where the above problem occurs (the member is deleted in the GUI, but the member still receives mail via the alias).The first problem stopped after I forced failover from primary to secondary in HA configuration,However, problem 2 continues to occur.Are these known issues?Is there a limit to the number of aliases that can be registered or the maximum number of members that can be registered in one alias? Is there any way to recover problem 2 ?

Hello Fortinet Community,I activated device control in #EDR to control the use of mass storage devices. The last days I created several exceptions for usb sticks with in the gui. Now we plan a bigger roll out of usb sticks. I want to prepare the exception in advance before handing out the sticksI used the API several times to handle collectors and their groups. This was no problem. The description of the API has a function call "create-or-edit-exception". The Exception data is mentioned as JSON in the body. There is no example for it in the dosumentation. I retrieved an exeption with "list-exceptions". I passed this JSON output to the create-or-edit function an get an error.So I´ve got the following questions:Can I create an exception for an usb mass storage device which has never generated an event?When there first has to be an event, can I used the event to create or add the device to an exception?Is there an example existing?My goal is to generate a script on an Linux machine in ord

Hi, we recently changed from 300D cluster to 200F cluster. Now we see no logs, no information at all in FortiCloud. In the GUI Dashboard I see Status activated, connected to my account, storage used 0KB and no files uploaded.  In System Feature Visibility I dont see anything deactivated which could have impact, Fortigate Cloud Sandbox is activated. In Security Fabric > Fabric Connectors and Logging Settings I see Fortigate Cloud activated and connected to send logs every 5 minutes to Fortigate Cloud. In Log Settings > Local Logs memory is activated since we also want to have the information there. We dont really see something missing? Thanks!

This problem began after I upgraded Fortigate from 6.4.15 to 7.0.17 without any configuration changes. Before this, the issue was not observed. It's not a problem if it asks for a username and password; the issue is that it started asking for a token, which was initially required only for VPN users.FortiGate is requiring a token for internet access, even for users who should only need a token only for VPN. The firewall integrates with MS AD with LDAP and FSSO.VPN users authenticate with tokens via FortiAuthentication, also integrated with MS AD and LDAP. FortiGate requires a token for internet access only if users are in local, not when are in remote access.All firewall rules for Internet access are configured to validate FSSO users, with LDAP validation as a fallback in the same rules. See the attached screenshot. 

Hi Guys, We are unable to reset uptime by using dia sys ha reset-uptime. But didn't work