Solved

My user is unbale to access FTP server from ssl vpn which protocol need to add in firewall policy when I add all services to the firewall policy, the SSL VPN user able to access FTP server but when  i  add FTP services in firewall policies the user unable to access FTP Serveris there any other services need add in firewall policy to access FTP server 

Dear all, I just read this KB https://docs.fortinet.com/document/fortigate/7.6.0/new-features/634909/socks-proxy-supports-utm-scanning-authentication-and-forward-server , and it looks good to my operation.So I tried to set up one Evaluation Fortigate and see if Form-based Auth is also supported. But seems no luck here. The Form-based auth only appeared when I selected HTTP protocol. If I selected Socks. No luck then.  Is there any way to achieve Captive portal + Local User DB + Socks-based proxy Auth on Fortigate?  

Getting logs in system event in FortiGate about "Admin login failed" and showing ip of the (Server connected to the internal network) as the source ip what to do? Is disabling SSH will work for it. or SNMP will work. Please suggest what solution we can do?

I have successfully imported my certificate which is signed by my CA. The problem is I cannot choose it as HTTP server certificate. I see only two options, even though I have many more certificates in System -> Settings -> Certificates. I 've tried also via command line but again I only see these two options.Thanks in advance. Edit: I have also imported both Root CA and Sub CA certificates.

I understand Fortigate must do this by default but I have not found this stated in the documentation. In my case, the Fortigate-100F seems to have no TPM and even if it had the admin manual does not mention that login credentials are encrypted by the TPM. Therefore, is there any official source which confirms login credentials are encrypted in a Fortigate-100F?

Hello.We'd like to configure our FortiAuthenticator as SAML IdP. The first authentication factor is password from AD. We've tested several OTP options: fortitoken, sms, email, etc. and the work fine but we'd like to use another second factor: client certificate. We've used local CA or remote CA, and we've configure "certificate bindings" under user configuration, but when SAML web page is shown, it only asks for username and password, and it doesn't prompt to chose a certificate.Anyone knows if it's possible to configure 2FA with AD password and user certificate?.Thank you!.

hi, can anyone please advise whether fortigate accept gratuitous arp sent from other device (like router, load balancer...)? some network devices will send out gratuitous arp when failover occur. thanks in advance!

hi,i'll be getting a new FG 401 but don't know yet which FortiOS code.i usually get OS 6.4.6 with newer device.my question is, since this is a new/blank FG, can i jump directly to 7.2.9?or do i still follow the "lengthy" upgrade path? 6.4.6 > 6.4.8 > 6.4.10 M > 7.010 M > 7.2.5 F > 7.2.7 M > 7.2.9 Mto my knowledge you follow the upgrade path when the FG is configured/in production so that it will "update" CLI syntax/command with the newer OS. 

Hello, Can I please have my nickname changed to sifr? Thanks

We are using FortiEMS in our organization. And recently we have received a vulnerability related to Oracle JAVA on EMS server side. So, please suggest whether JAVA is required on EMS server side. Apache 2.4.x < 2.4.62 multiple vulnerabilities - HighOracle JAVA SE multiple vulnerabilities - High Please refer attached snap. Thanks.

Hello, from day to day I started having problems starting the FortiClient application. Before that it worked for me for about 2 weeks. After startup, FortiClient shuts down after about two seconds. Can't click on anything in the app. No error appears anywhere. They could not advise me even at the IT department in the company. I am said to be the first to come up with such a problem. Reinstalling didn't help.Version: 7.2.4 (other version is not available in our company)Thanks for any help

Hello!  So I am completely new to FortiClient, but its management in my organization has been dropped into my lap. There have been complaints from users that the time that they have to log into the VPN is too short. I am just looking to see where exactly that timer can be changed.  Thank you.

I am trying to set up automated backup over FTP on my FortiGate firewalls. I have the FTP server set up and running and have confirmed it is accessible through FileZilla. However when I enter the command through CLI I get an error message that I cannot decipher. Here is my command: execute backup full-config ftp [filename] [ftp-server] [username] [pword] And here is the error message I am receiving: Connect to ftp server 10.10.10.100:21 ...Please wait...Send config file to ftp server via vdom root failed.Command fail. Return code 5 I have searched but I cannot find anything specific to that error message. There are no entries in the log files on my FTP server, so it appears this error is directly related to the FortiGate.

Hi Guys, I have FortiClient/ZTNA working fine but I am having issues connecting to our internal VCenter applience. I was wondering if anyone has this setup and working? When we set it up we get this error when we go to the login page. [400] An error occurred while sending an authentication request to the vCenter Single Sign-On server- An error occurred when processing meta data during vCenter Single Sign-On setup:the service provider validation failed. Verify that the server URL is correct and is in FQDN format, or that the hostname is a trusted service provider alias. Any Ideas, I have tried all the VMware/Broadcom solutions but no luck. Cheers John. 

haven't been able to find anything on knowledge base or while searching in general but maybe not (well) documented. is there a way to check for hits on routing route map / acl / prefix lists counters. like when you create one that allows some and denies other, can you see which of the options is hit how often?

I wanted to use the on_connect script in the FortiClient to connect an smb share after the connection is established as shown here. But the command is executed before the connection is established. After my command failed the connection is shown as established in FortiClient. I tried to execute the command in the background but failed to do so.  <on_connect> <script> <os>mac</os> <script> echo "" & sleep 4; /usr/bin/osascript -e 'mount volume "smb://ssldemo.fortinet.com/installers"' </script> </script> </on_connect>  Environment:MacOS 14.6.1FortiClient 7.4.0.1645SSL-VPN via SAML SSO using the external browser as user-agent

Hi,I have two firewall1.)fortigate 400E firewall (currently live)2. fortigate 300D firewall (older one) Can i use fortigate 300D firewall as a forti analyser to store logs?

i just changed my FortiSwitch to standalone because I replaced an old fortigate firewall to a new one.  I maintained the same configuration no vlan just hardware switch network.  I’m not using Fortilink port so the switch is standalone mode. It’s working but it does not show up on FortiSwitch and even if it does it shows offline.  How can I make it appear and online without using Fortilink? thx

Hi expert, I'm trying to create a policy to quarantine any email that has a email header X-RCIS-Action = Quarantine.Can any one share the configuration on Fortimail? Thank you!

I have new device 401F. By default it is on the v7.4.3. I need to downgrade the device on the version 7.2.8. I tried to downgrade but getting an error "image downgrade failed. Failed to upgrade firmware due to expired firmware updates license." Is to possible to downgrade device without registration/activation of license. Also I verified with cli by using the command diag sys flash list only v7.4.3 is showing there.

Hello, Fortinet's chat support recommended to ask here if anyone would be kindly willing to provide me with (one of) the latest firmware for Fortigate 60D. I need to burn the firmware as my unit is bricked. Thanks a lot Best RegardsJaroslav

Was doing some log parsing and came across some traffic flows that had me scratching my head. I have a policy with DPI enabled, but I do have reputable websites with various categories and address objects exempt. I also have a application control profile applied to said policy where I explicitly block DNS over HTTPS and DNS over TLS.  The traffic in question going through that policy shows traffic to dns.google (8.8.8.8) with application of DNS over HTTPS and DNS over TLS as Allowed (again, app control profile has it set to block). My assumption is, that due to my DPI profile having pretty much all things google exempt, this is causing the traffic to pass Allowed. This seems the most logical reason, but just wanted to bounce this out there and get some thoughts if I'm on the right track or there is some other "rabbit hole" I need to go down.

Good Morning, Has anyone ran into issues when updating the firmware on MCLAG switches that would cause the switches to disconnect? I'm wondering if the MCLAG group of switches need to be updated to the same firmware at the same time? Topology:FW1 & FW2 (HA Active/Passive)SW1 & SW2 MCLAG Group 1 (SW1 connected to SW3)(SW2 connected to SW4)SW3 & SW4 MCLAG Group 2 (SW3 connected to SW5)(SW4 connected to SW6)SW5 & SW6 MCLAG Group 3 SW1 & SW2 are running FortiSwitchOS 7.4.1SW5 & SW6 have been updated to FortiSwitchOS 7.4.3 After updating SW4 to FortiSwitchOS 7.4.3 last night we lost access to switches 3-6. The log message that stands out is "action="unsup-cfg" status="none" msg="MCLAG: **peer software mismatch local-software(v7.4.1,build0787,230921 (GA)) peer-software(v7.4.3,build0830,240422 (GA))"" Disabling the port on SW1 that connects to SW4 gave us access back to SW3-5 but SW6 is still down. I'm assuming that updating SW3 to 7.

Hi, we are in the middle of changing a FG300 cluster to a new FG200 cluster. In the old config we didnt use SD WAN, we had like one WAN1 for the MPLS connections and WAN2 and WAN3 for Internet Access. WAN1 mainly has all VIPs and VPNs, also it is a shared Internet Access so thats why we got WAN3 for all outgoing traffic. Now we would like SD WAN for Load Balancing or primary failover reasons but I am not sure what would be the correct configuration. If I do the implicit rule with 99%  - 1% or what is the best way? Thanks for your suggestions!

Hi Team, When the user registers his account on the portal, he must select a prefix for the phone number. The question is how to set my country to be my favorite or by default will be chosen. The current default setting is +1 and I don't know how to change it. To clarify the question, how to change it so that the +48 prefix is always shown to each user. I traied change that in html code, but i failed. I searched the forum but didn't find anything. A request for help Fortiauthenticator 6.5.3