Solved

Im currently on FortiOS 7.2.8. Traffics are being dropped by FortiGate when asic-offload is enabled. To work this out, we are currently set the asic-offload to disable but this is not a long term solution. Is this a bug on 7.2.8? https://docs.fortinet.com/document/fortigate/7.2.8/fortios-release-notes/236526/known-issues Does this issue will be resolved in what FortiOS? 7.4.x or 7.2.x ? Appreciate your feedback. TIA :) 

Hello FortiClient admins I have two Ubuntu clients with FortiClient 7.4.0 installed.Both are registered.The first hosts can access apps through ZTNA destination, while the second shows the following error: "No ZTNA client certificate was provided" Following a quick search I found that the first node has a client certificate "/opt/forticlient/ems_cert.crt", while the second doesn't. "Probably" the certificate was removed due to a previous uninstall with purge.Tried to unregister the endpoint an re-register it again but didn't help.Any idea on how I can reinstall the client certificate on the host?

Dear all, i want to set up dhcp server on dedicated vlan for my clients on fortigate.Basically, i want to import list of mac address which will receive an ip from dhcp range (not reserved). On web UI, i did not see any menu which allows me to do that. How can i achieve it ? Best regards.

 Hi Fortinet Community, I would like to explain our scenario and seek your advice on an issue we're encountering.In our environment, we have configured two Domain Controllers (DCs). Each DC has a separate FSSO-DC Agent and a separate FSSO-Collector Agent. In total, we have two collector agents and two DC-agents across our two DCs. We are using the DC Agent Mode, where the DC agent sends logon information (Windows security logon events) to the collector agents. The issue we're facing occurs when a user (e.g., 'abdul.rehman@example.com') logs into a Windows machine. The user is successfully authenticated by FSSO and gains access to resources according to the Firewall Policies. At this point, we can see in the FortiGate FSSO Users Dashboard that the user 'abdul.rehman@example.com' is listed with the assigned IP address (e.g., '192.168.100.100'). The problem arises when the user attempts to access one of our internal systems (a server or another PC) using the RDP protoc

HelloI have installed a Fortigate 60F firewall at a customer. When the customer uses FortiClient VPN they cannot access their Microsoft Dynamics Navision. If they use the Windows native VPN client, everything works as it should.So why not just use this all the time? This is because the firewall does not allow two simultaneous Windows native  VPN clients from the same IP address…I get this error (see the attached file, and bear with the fact that it's in Danish. I'm sure you can translate it).

Hello,Some our user can't connect to the Azure SQL Server with error I try to disable my App Control and the user is able to access to Azure SQL.Here my App Control settingThen i try to disable 'Block applications detected on non-default ports' on the app control, enable this app control on the firewall policy and the user is able to access to Azure SQLSo anyone can help me to make more understand why the 'Block applications detected on non-default ports' should be disabled?

Hi Team, I am building a playbooks that reads the password protected pdf files extract the indicators, create its record and then block the indicators and update its record in indicator if the indicator blocked successfully. In order to update record in reference playbook I need to pass indicator IRI value in the reference playbook but unable to pass the value.Attaching playbook. Assistance is required in passing the IRI value in the reference playbook. Thanks in advance.

I have activated a FortiGate VM-Trail license, followed the deployment process, and am able to access the GUI. The FortiGate can also access the internet. However, under "Firmware and Register," the device is indicated as "Not Registered." But when using the CLI and entering the "get system status" command, I can see that the device license status is valid. Am I missing something? Serial-Number: FGVMEVRFEK_AEUBFLicense Status: ValidVM Resources: 1 CPU/1 allowed, 1930 MB RAM/2048 MB allowedLog hard disk: AvailableHostname: FGVMEVRFEK_AEUBF

Hi— I use FortiClient with cellular data both directly on a Verizon iPhone and through ‘hotspot’ (on the phone) to connect an iPad and Windows laptop. As of about 2 weeks ago, I began receiving an Error: Invalid DNS Server message each time I try to connect any device through the cellular network. Any WiFi network works without issue and connection is no problem, however the cellular network can not connect. I used a colleagues Verizon phone with FortiClient and entered my credentials— no issue. I’ve contacted Verizon who says there’s nothing wrong with my line and to contact Apple or Fortinet for support. Uninstalling and reinstalling the app has not yielded any result. Anyone else experiencing? Any ideas or suggestions on how to resolve? Thanks!!

In our internal LAN we have the DNS server set to be the same as the Interface IP of that subnet. This DNS server is set in recursive mode and exists only to translate some domain names to IP address for internal uses. I would like to have this same functionality over the SSL VPN for some of our remote users but am unsure how to go about setting it up. 

 We use sslvpn web portal to reach http/https server. We are not able to proceed after browser hits the url https://hostname-fortigate/proxy/xxxxxxx/https/login.microsoftonline.com/common/GetCredentialType?mkt=en-USI did debug for sslvpn and following is the error:[313:root:5dd]SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384[313:root:5dd]do_http_validate:442 method (POST) on uri (/proxy/xxxxxx/https/login.microsoftonline.com/common/GetCredentialType) not allowed.[313:root:5dd]sslConnGotoNextState:309 error (last state: 1, closeOp: 0)[313:root:5dd]Destroy sconn 0x7f0f70cae000, connSize=0. (root)[313:root:5dd]SSL state:warning close notify ()

We were having trouble accessing a specific website and the issue ended up being our Geo Blocker policy was preventing access to the website. We have temporarily resolved the issue by disabling the Geo Blocker policy but would like to reenable this policy while still allowing access to the website we were previously experiencing issues with. I called the company that owns the website/server, and they gave me the public ip address for their webserver I created both a subnet allow policy and an ip range allow policy to hopefully allow access to this server while the Geo blocker policy is on. Neither allow policies seemed to work and when I looked up the company's server ip address it is located in a country that is not blocked by out firewall. I am assuming they either gave me the wrong ip address, somehow the webserver is associated with a country that is blocked by our policy, or I configured the allow policies wrong. Would anyone be able to assist in listing out the steps required to

I’ve been working on integrating LDAP with FortiClient EMS server v7.4.0 build1793 running on Ubuntu 22.04 but am getting "Auth Method Not Supported" when trying to add LDAP authentication server.In the EMS web console, when I go to Administration > Authentication Servers, I select "ADDS" from the dropdown, enter localhost and the admin creds, but when I hit "Test", I get an "Auth Method Not Supported" error.slapd is running and listening:# netstat -aptn |grep LIST |grep 389tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 326786/slapdtcp6 0 0 :::389 :::* LISTEN 326786/slapdAnd doing a tcpdump, I can see the traffic (although not the username and passwd being passed):17:30:52.956097 lo In IP (tos 0x0, ttl 64, id 42008, offset 0, flags [DF], proto TCP (6), length 115)127.0.0.1.41008 > 127.0.0.1.389: Flags [P.], cksum 0xfe67 (incorrect -> 0x25f2), seq 1:64, ack 1, win 512, options [nop,nop,TS val 3342323866 ecr 3342323866], length 63E..s..@.@..j.........0.......d[......g......7...7..0=...`8.

Hello,My board is wanting to buy Firewall via Amazon site , will I have any issue with configuration or support problem ? today I pay for this personal service of putting ready license , do I need to do some kind of registration at fortigate ? As I'm just starting to work with firewalls, I'm afraid I won't be able to configure the equipment.https://www.amazon.com/FORTINET-FortiGate-FortiCare-FortiGuard-Protection/dp/B08126TLGJ/ref=sr_1_1?crid=1GCVFTC60DS9R&dib=eyJ2IjoiMSJ9.NkFXLMZMwVINF-vHID1IVIvS4VAG98wBT9ISu4tag6lKAwEZ9MRlWo5Mo9HI7LzbTOIWZgcw7FcyE1rDCxU00Ae0SCs6bFn9FVDey5XWBgKF7ci2gBL8btbuX1qfhXssSYw8NrMGxrAetBCWMuaHKA.GZY71woOBcUqaQ2hzu19lFsB98ekh-cIm84kPKhRhFc&dib_tag=se&keywords=fortinet%2Bfirewall%2B60f&qid=1724073149&sprefix=firewall%2BForti%2Caps%2C200&sr=8-1&th=1Translated with DeepL.com (free version)

Hi All, I'm trying to find out how to configure our FG100D (6.2.14-FW-build1364-230411) to send to our Syslog Server (ELK) just every 5 mins. There is no option in the WebUI or even in the CLI to configure this. Is there any way to do this? All I can see is in the FortiAnalyzer option. Thank you. Oliver

I installed FortiClient VPN version 7.4.0.1636 on Ubuntu 22.04.4 LTS with the GNOME 42.9 desktop environment using the Wayland windowing system. After creating a new VPN connection and attempting to log in via SAML, the application became unresponsive. Upon exiting and reopening the app, I noticed that the VPN connection configuration I had previously set up was not saved, it had disappeared. sudo dpkg -i forticlient_vpn_7.4.0.1636_amd64.deb 

When adding an authentication server in EMS I only ever get 1 domain even when the tenant has multiple domains registered and synced. These aren't subdomains but two different unique domains.example1.comexample2.comThe only information I provide is the tenant ID, client ID, and secret. And then I only get 1 domain available for doing user to OU matching to assign policies.How do I get all of the available domains that are synced in azure so I can can assign policies? Currently I have to create workgroups and assign the users to that either manually or with group assignment rules. 

Dear Concern, I am visiting a website, but the page is not opening. In the forward logs, I see 'TCP reset from client' under 'action', and sometimes it shows 'accept'. The webpage says 'refused to connect'. How can resolve. I have FortiGate 201F firewall and firmware version is 7.0.10 If I check from another network, the webpage opens properly. can anyone help me to resolve the issue

When using VPN, the user does not receive the local IP assigned by FGT (not the wrong IP). Sometimes it happens like this.

Hi everyone, I have a Linux virtual webserver in ESXI that I would like to be accessible over the internet. Currently it's accessible locally but I have tried all the settings on Fortigate to make it accessible over the internet to no avail. I am plugging the 2nd Physical NIC directly to either internal 4 port and bridging the virtual webserver connection in ESXI to that 2nd NIC but not getting any good luck. I also did create VIPs in Fortinet to the Internal 4. I would really appreciate any help I could get.

Hi All, Is there a way to check or determine in the Fortigate firewall if the difference in bandwidth of MPLS site (our site has 20Mbps and our client has 2Mbps only) will result in slow in traffic?We and our client have both 2 ISPs for redundancy, but the client's other ISP is much slower, so they prefer to connect using the other. When our main ISP was down, we swung to the other resulting in much slower traffic. But our client checked their current bandwidth and said that they were only using 60% of the traffic and insisted to check where the bottleneck was. I'm trying to figure out how to check and present to the client that the issue is their bandwidth unfortunately, when I check the bandwidth monitor in Dashboard, I can only see the grouped MPLS tunnels of ISP1 (interface 1) and ISP (interface 2) with Hardware Switch as type. There is no option to check the separate interface. Even the VPN Event logs don't help that much. Is there a way to check this? Thank you in

I have two firewalls.At one end a firewall with a dedicated link and at the other a Sophos firewall with dynamic IP.I will have to increase the Dialup Type configuration.Does anyone have any documentation that covers this type of configuration.The biggest problem is at the Sophos end, I've already tried several ways.But without success, I've seen several ways on the web but without success.If anyone can give me some direction, I'd be grateful.

Hello, I am facing an issue on DM after Guest self registration on a port used with dot1x the vlan never get changed. The capture of Disconnect-Request :The Disconnect-NAK :  After shut no shut the port, the correct vlan get applied, do i need to apply cli configuration with port bounce as a workaround ? any other options ?@ebilcari Thank youRegards! 

Hi all,in FortiSIEM 7.0.2,I want to deleteone or more CMDB devices using REST APIs.I'm trying with the /phoenix/rest/device/list/delete API.The command is: curl --location 'https://Server-IP/phoenix/rest/device/list/delete' \ --header 'Content-Type: application/json' \ --header 'Authorization: Basic xxxxxxxxx' \ --data '["111111"]' where 111111 is the deviceId. The result contains:HTTP Status 415 - Unsupported Media Type

Hi, Would like to check if there are latest information already about the release of newer firmware version for FG-90G?Due to vulnerabilities, I am keen on knowing when the expected dates are. Thanks!