Solved

I'm using the forticlient with Ubuntu 24.04.1 LTS. After running an apt upgrade the forticlient was also upgraded from version 7.2.5.0854 to 7.2.7.0905. Now I'm no longer able to connect to my VPN.  I get the following error messages in the log file sslvpn.log:  20241217 17:58:10.901 TZ=+0100 [sslvpn:EROR] nmtools:255 Command to set ipv4.ignore-auto-routes returned with status 256. 20241217 17:58:10.901 TZ=+0100 [sslvpn:EROR] nmtools:1060 Failed to modify connection docker0 property ipv4.ignore-auto-routes 20241217 17:58:10.901 TZ=+0100 [sslvpn:EROR] dns:1007 Failed to finish Network Manager configuration 20241217 17:58:10.901 TZ=+0100 [sslvpn:EROR] vpn_connection:2072 Config DNS failed I have already removed some docker interfaces, which occurred before in the log as error messages, but I cannot remove the docker0 interface, only to get the client running.  I have also upgraded to the Version 7.4, but I get the same error messages. I tried

Hello Everyone,I want to configure DKIM on our Fortimail unit to sign outgoing messages, but I have a lot of questions that I need your help with. First of all, our Fortimail unit is 200F unit, working in transparent mode. We have 2 protected domains configured inside this unit. The two domains are MS exchange serversFor my questions:Can I configure the DKIM signing in Transparent mode, or it should be in gateway or server mode for this to work?If it is applicable in transparent mode, and I successfully configured it, will this configuration be affected or stop working if I change the working mode of the fortimail unit to gateway mode?Do I have to make a record for the DKIM inside my exchange servers internal DNS, or it should be published only on the external DNS?Does the protected domains SSL certificates have to be imported inside the Fortimail, or the DKIM has nothing to do with the certificates?Is it better to configure the DKIM inside my exchange servers, or it's better to be con

Hello, we just put in 2 branches a FG 80 cluster with 7.4.5. Both connected to Arruba Switch with ISP A Internet Access and ISP B 5G Failover. Our ISP now comments that the 5G router are in dormant and they dont reveice the VRRP events. Since router and 5G backup are connected to the switch I dont see why we should configure multicast policy. Trying out with multicast policy we risk some strange behavior with the Fortigates? Thanks!

Looked at the admin guide, and the example it shows, is www.google.com (As a subnet object???)Need to add a simple subnet object like "192.168.0.0/16".  Is this possible?I have many address objects of type Subnet, that were created in a FortiGate before FortiManager came along.  When trying to add in FortiManager, It clears the subnet address I try to add within IP/Netmask and then says "Invalid IP address"Does FortiManager have a different concept of a subnet address object than the FortiGate does?I know I can add an IP range (probably), but that means I have to go through and edit "all" of the exiting definitions. In the FortiGate, when adding a subnet object, I can name it something like "sn-bob" and it does (or at least did not previously) require that it resolve to anything. I'm hoping that I am missing something stupid. 

We recently upgraded multiple FortiGates (60F through 2600F) to 7.2.8 the day after the latest release was made available. Last week, one of these (60F) stopped passing traffic. We could ping the management interface and could do a "tnc -p 443 <IP>" where we'd see the 3-way handshake in a packet capture, but the login page would time out. We tried to console in - there was no prompt, but it'd echo back what we typed in. I did try an "exec reload", but nothing happened. But then, we couldn't get authenticated. This firewall required a hard reboot to bring back online. The only significant things in the system logs were these two events: - Critical: Kernel enters memory conserve mode- Critical: Kernel enters extreme low memory mode This was just a few msec after an antivirus update, but I'm not certain if they are related. We had the exact same thing happen today on another FortiGate. We have an upgrade scheduled for the main hospital this Friday, but I'm very hesita

Hi all, I have a problem, Fortinet support have been less than useful. FortiGate  We have a cloudflare Zero trust setup that stops any DNS requests to malicious sites. What I want to do is intercept these requests on the Fortigate before they get to Cloudflare.In the past I have been manually adding eachnew site that cloudflare makes me aware of, this is time consuming. I have been on leave and returned to over 100 URLs to add to the DNS filter on the Fortigate. I was hoping to just import a csv or text file of the URLs into the Fortigate DNS filter list. Apparently this is not possible. I have seen some talk of using a cloudflare API to do this but not sure how. Has anyone found a way to do this. The Stock Frotinet answer of "put in a new feature request" is laughable when solutions are needed quickly and when we all know, that feature will never get added. I don't know why they can't have a plain text input for the list. E.G. on our smoothwall

 Our setup is such that we're trying to get our FG1101E to act as both router and firewall with BGP routing. We have our ISP provided single fiber uplink at 10gbps (SFP+) which has a defined Point to Point IP /29 IP address that's used to peer with a BGP neighbour. The BGP side of things appears to work ok, with our prefix for public IPs are being advertised and received to our ISP, and they are sending at default route to us. What we're trying to achieve is to be able to egress to the web using an IP on the advertised prefix, these are public IPs assigned to us as an organisation.  We're able to use them in the context of an outbound rule, for this to work we have to create an IP_Pool overload object and use that in the rule which shows to the world we're coming from an IP we own. If we don't do that, then our IP is shown as the BGP peer IP. We are trying to get to a place where we can use some sort of virtual interface with the IP loaded on fro

Hello everyone,Since we did move to FortiClient EMS end of last year I do want to start diving into ZTNA now: I do have a VLAN that is not connected to my windows domain server (Domain Controller, File-Server, ...). This VLAN is for third party machines and computers (robotics, PLC, IOT devices, ...)Now there is a use case that some of our plc programmers want to work in this specific VLAN for the ease of access to the robotics but also need to access e.g. windows File-Server. What is the easiest way to set it up? Basically I was thinking about creating a policy that only allows FortiClient EMS managed devices. I do see the ZTNA Tags created from EMS in the FortiGate. Should I go for the "IP/MAC Based Access Control" in a "standard" FortiGate policy where I can secelt the ZTNA tags? Or do I need a full ZTNA policy?    ZTNA policies documentation seems to often point into a kind of webserver scenario - that is not really needed here. So do I need a ZTNA ser

My new 60F Wi-Fi will only do 5 or 2.4ghz which I think is normal.I am using 2.4ghz since one device is IoT and likes 2.4ghz only.Many devices are happy but the 16 Pro is not - I tried a few settings and channels (3 choices) and it wont connect.Any ideas please?

My aim is mainly blocking bad sites (malware, C2, phishing) not controlling certain types. Web filter and DNS make sense, though perhaps are a tad similar. ISDB seems to offer some IP blockers. Would ISDB cover my wish by blocking connections pre/post malware to malicous domains (IP behind)? Thank you

Hi, I was wondering if someone can help me on this. I am very new to networking and would like to check if I can do IP address translation on a layer 2 device with address 192.168.199.2 on my VLAN2 going to VLAN 1 with subnet 10.156.116.0/22. My intended translated address is 10.156.119.2 for this layer 2 device and will be using a kepserver ex v6 device from the vlan 1. Hope someone can assist me. Thanks

Hi Everyone,  we like to monitor our local SSL-Certificates from our Fortigate with PRTG to E-Mail us when the day of experation is near. has Anyone found a posibilty to do so ? I looked for a solution the last day an didnt found any.  Greetings!     

Howdy, I just have a question on a firewall policy that I have been playing around with. I have an IPSec tunnel between my agency and our parent agency allowing traffic to 2 subnets on their end (192.168.139.x). On my end, we have a supernet (172.19.41.x) passing clients using their application to their servers over that tunnel and everything is working well. However, the local LAN at my agency (192.168.56.x) is on a subnet that conflicts with one at the parent agency's, so we cannot pass that traffic over the IPSec tunnel. In an attempt to get around that, I created a firewall policy to pass the traffic but with a NAT IP Pool that falls within the allowed supernet, so the conflicting 192.168.56.x subnet is disguised as the allowed 172.19.41.x subnet. This works going out but does not work coming in. I can ping the parent agency's application server, but I can't connect to it from one of the end user computers. I have the two firewall policies for this below (sanitized), can anyon

Hi, In log view or FortiView I'd like to see netbios / host names next to the IP address - or as a column - for each entry. This would save me from doing individual reverse lookups in our internal DNS.  I've looked at the settings and added columns for "host name" but they are not populated.  Am I missing a setting somewhere to achieve this?

Hello and sorry for my english, I want to activate revision on my fortigate 901G. I saw this article : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-the-Revision-option-to-revert-to-a-previous/ta-p/194312 But the commands doesn't works on my fortigate and i find anything in the GUI about this...How to activate revision ? i 'd like to have backup when configuration is change et come back easily in last configuration with revision. thansk a lot

We bought some Firewalls 81F, but unfortunately they all have BLE inbuilt and it is not possible to go through TEMPEST screening. Is it possible to remove inbuilt BLE? Thank you.

Hello team how to make the two interface to be best path i want each interface to carry different traffic but it canot work beacause the other interface is not best path

I wanted to download the latest firmware for my old Fortigate 50B. Running version is 3.00,build0480,070330. Where can i find it?

Hi, conserve mode is something we didn't have for a long time with all the FGs we are managing right now but now it happened the 3rd time with a FG80F cluster. All 3 times the FGs were restarted right away so we didnt have time to react and check. Normally we dont have memory issues or CPU issues in no moment when we are connected, for example right now 64% memory and 0% CPU. We changed some configurations, disabled Features which are not necessary, deactivated IPS (something we dont like), logging in the policies, etc. but it still happened. Any ideas or suggestions? Thanks!

I have a Fortigate 40f (enterprise) and a Fortiswitch 108F  Fortilink is up, see below Dunno what i am doing wrong i have no internet acces on the switch, i have now set everything back to factory.   

Hi, we have this one site which is giving us memory problems after updating to 7.4.X. First we created Stitches for IPS and WAD and we thought with that we have it under control and we can wait until 7.4.X to come out. But these last days, also with the Stitches we have always over 72% memory usage. Checking memory we get:FG_XXXX # diagnose sys top-memnode (17550): 67393kBreportd (168): 41030kBipsengine (5424): 25112kBlocallogd (175): 22091kBipsengine (5427): 21890kBTop-5 memory used: 177516kB Checking the freeable memory we get only 7%FG_XXX # get system performance statusCPU states: 5% user 1% system 0% nice 93% idle 0% iowait 0% irq 1% softirqCPU0 states: 3% user 1% system 0% nice 95% idle 0% iowait 0% irq 1% softirqCPU1 states: 5% user 0% system 0% nice 93% idle 0% iowait 0% irq 2% softirqCPU2 states: 4% user 2% system 0% nice 94% idle 0% iowait 0% irq 0% softirqCPU3 states: 5% user 0% system 0% nice 94% idle 0% iowait 0% irq 1% softirqMemory: 1910984k total, 13

Hi, we have one office with FG80E on FortiOS 7.4.4 where we have quite some memory issues (varios Stints to manage). Now we are thinking about updating to 7.4.6 (some WAD issues have been resolved) but I was checking if there could be issues with our FortiAPs. We have some 231F models with 7.4.2 which should not have any problems but my concern is about some 221E models with also 7.4.2. Anyone with experience with older FAP models and 7.4.6? Thanks!

I've been trying figure how to find the mac address and arp tables for one of our fortigate firewalls, but all the documentation seem to be for firewalls not connected to Fortimanager. As you may know, the cli becomes very limited one the a firewall when you connect to Fortimanager, and the CLI on it only seem to give the arp for the manager itself which is not very useful. We're running the Fortimanager VM64 KVM 7.2.8 if that helps. The firewall in question is 200f. Any help would be appreciated.

Hello all I'm a new fortigate user and have a Fortigate 40F at home. How is it possible to create a Fortigate firewall policy that expires after a certain period of time?I don't mean a policy with "Policy expiration - Expiration date"! I mean a policy where I can set that it can only be active for 1 hour during 24 hours and then resets itself the next day and again for 1 hour may be active.Reason of the question:I'm looking for a way to limit internet access for my teenagers to a certain time per day, so that they only have internet access for a total of, for example, 1 hour each day.  (not always same time every day - so a timer)If I could then activate this policy rule with an admin account, that would be great.Thank you for your help.GreetingBenjamin 

Hallo zusammen At home I have a Fortigate 40F for my home office.Unfortunately, my Fortigate 40F doesn't have that much RAM. (just 2GB)That's why Fortigate simply removed the proxy policies from firmware 7.4.4! ! !https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/519079?preview_token=6ac61bfb23d50d4e67fe I had proxy policies - these were simply changed to flow based during the automatic firmware update to 7.4.6!I would now like to completely switch off the automatic firmware update so that the Fortigage remains at 7.4.3 firmware version.I've tried this post several times, but every time my Fortigate updates back to 7.4.6 after about a week! ! !https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-disable-automatic-firmware-upgrades-on/ta-p/326998 Does anyone know what I can do to actually keep my Fortigate on 7.4.3????Thank youGreetingsSwiss daddy