Support Forum

Hi,Looking for clarity in DNAT vip in fortigate. I have vip vip_123.1.1.10 [ external ip 123.1.1.10 & mapped ip 10.1.1.100]. And below is my rule,Src 174.1.1.1Dst 123.1.1.10Port httpsNote, I haven't used vip, but used an actual ip. And I belive it will not work, but can any one explain how fortigate process this traffic. Did fortigate still do vip lookup as I used external ip in my policy?Thanks in advance

Do you have to use the Fortinet DNS servers in order for all the filtering subscription services to work properly?

Hello,I'm pretty new to FAZ but we were sold on it based on it's ability to trigger actions based on log events.  Now that we have it, I'm not sure it can do what I had planned though. Problem:  We're trying to phase-out SSL-VPN but can't right now.  We see constant attempts from certain subnets trying random user-names to log in that we'd like to block, but we don't want to block legitimate users that may have mistyped they're username.  The FAC log we see for this is "AUTH_FAIL_NOUSER" in the Log Description field. Solution:  I'd like to detect instances of "AUTH_FAIL_NOUSER" and note the <User IP>.  If the User IP makes more than 5 attempts in 5hrs.  Add that IP to a threat feed (maybe on FMG), or at least send an alert. Currently I'm doing this manually by checking the logs whenever I have time, and adding it to a threat feed we host on an internal github server. I was trying to search for a solution like this but haven't

i have one Fortigate 100F having issues connecting to FortiCloud.there management connection is show inactive.how do i enable the management connection to active again ?

Can we specify a custom port in a FortiWeb health check? I'm using version 7.4.8 and would like to use a port that isn’t part of the default options (TCP, TCP Half-Open, HTTP, ICMP, TCP SSL). For example, can I configure a health check to use port 4433?

Hello ,I’m planning to change My current setup from SSL-VPN to IPsec remote access, but I have a few questions first.How can we handle geolocation restrictions, MAC-address allow/deny, and host checks when using IPsec? For example, will geolocation and MAC binding be enforced only through the firewall policy, or is there a different approach for IPsec remote connections?Thank you.

Hi all,We're looking at Fortinet firewalls and I had a query with the sales person around user/host identification for company devices especially for Entra Joined Devices.We use a different remote access solution so Fortisase isn't an option currently.They mentioned the free FSSO agent but from checking, this would only really work for legacy Active Directory joined machines?Other options (we'd prefer cloud hosting) would be Fortiauth cloud and giving every device a paid Forticlient version?

Hi all,Need help with FortiGate 7.4 SSL inspection setup:Setup:Internal API: 10.10.10.99:8000 (HTTPS)External access: 3.3.3.33:8000 → DNAT to internalCorporate CA certificates imported to FortiGateSSL/SSH profile: "Protecting SSL Server" modeWAF profile: Monitor modePolicy: Proxy inspection mode with SSL + WAF profiles Issue: Traffic passes through but SSL inspection doesn't work - no SSL logs, WAF not inspecting content. Has anyone configured "Protecting SSL Server" for inbound API traffic? What's the correct architecture?Thanks!

EnvironmentWe have two separate FortiGate-VM HA clusters:Cluster-A (VM-A-HA): 2 nodes (active–passive)Cluster-B (VM-B-HA): 2 nodes (active–passive)Both clusters run FortiGate-VM BYOL licenses (one license per VM node).Background / What HappenedThe licenses on both nodes of Cluster-B expired.To maintain service availability, we performed a temporary workaround:Powered off both nodes of Cluster-A.Downloaded the valid license files for both nodes of Cluster-A from the FortiCare portal.Uploaded these two licenses respectively to the two nodes of Cluster-B.Cluster-B resumed normal operation with those temporarily reassigned licenses.Cluster-A has remained powered off since the license transfer.Current SituationWe have now purchased new licenses (one per node) for Cluster-B.Our intention is to:Apply the new licenses to both nodes of Cluster-BRestore the original Cluster-A licenses back to the two nodes in Cluster-ABring both clusters back into healthy HA state with proper licensing.Before do

Please advise — my penetration testing team is recommending that I enable admin-restrict-local on the FortiGate firewall. However, if I do that, local admin logins will be completely blocked whenever remote authentication servers are reachable. My concern is about integrating the FortiGate device with FortiManager (FMG), which sometimes requires local credentials. If FMG tries to connect to the device using local admin credentials over the network (via SSH or HTTPS), those logins could be denied because of this restriction. Since FortiManager (FMG) and other management tools rely on local admin credentials or API access over the network, enabling admin-restrict-local—especially in restrictive modes like non-console-only or all—could disrupt those connections. So, would it be correct to assume that enabling this setting in a production environment is not advisable?

Everything was working fine until suddenly this message appeared and now I can't connect anymore. It just stopped working. I'm using version 7.2.9.1033 on macOS Tahoe. Any help would be greatly appreciated, Doug. 

Hi all, FAZ 7.6.4 I need some help trying to write a very specific query and I'm struggling.  It needs to be able to Union All so that I can read from the VPN logs and the Traffic logs to be able to then collate the information and produce a table. Here's what I need to be able to do. I need to be able to detect a users source country when coming in on the SSL VPNI then need to be able to see if a user connected to an ip address say 192.168.1.1I then need to be able to list it by user rather than srcipFilter out everything elseCan this even be done? SELECTuser,srcip,srccountryFROM$log-eventWHERE$filterAND subtype = 'vpn'AND srccountry != 'United Kingdom'AND srccountry != 'Reserved'GROUP BYuser, srcip, srccountryUNION ALLSELECTuser,dstip AS srcip,srccountryFROM$log-trafficWHERE$filterAND dstip = '192.168.1.1'GROUP BYuser, dstip, srccountryORDER BYsrcip

Hi, FortiGate - 7.4.9Fortimanager Cloud - v7.4.8 I am configuring a FortiGate to use SD-WAN for connectivity to FortiManager Cloud and FortiGuard (plus more services once I have a confirmed config), and am hoping to get some feedback on the best way to configure this. I have set the configured central-management to use sdwan (following this page) config system central-management set interface-select-method sdwan All seems ok, however the Fortigate doesn't want to connect using the best connection. The firewall is connected to an FTTC and a 4G router. The FTTC connection has lower latency and jitter, but the firewall always seems to want to connect to FortiManager Cloud using the 4G. Note the 4G interface is DHCP and the FTTC is using a fixed IP.The default route on the Fortigate is pointing to the sdwan-zone as the interface.Other SDWAN rules seem to work fine. Whether I just leave the SDWAN rules blank and use the default 'sd-wan' rule or use a

Hello All, I'm looking fo a way to export the Object configuration from a #Fortimanager, if someone have any idea Thank you

Dear All, I need support for you all whether issue it at Firewall or with Synology NAS device.  Synology NAS device is installed our LAN for that I have created DNAT with Synology IP so that external user (over the internet) can download the file. but users are getting very slow speed while downloading the file. I have also created at firewall with no security profile with no IPS, anti, application control, file filter at Firewall level only simple policy with port. Tested with One user which is using local LAN and his bandwidth is also fine and getting up 100 mbps speed. Can anyone tell me where Issue can be . why users are getting very low speed.  thank you for your support.    

Hi all, this is my first post overhere and I'm kinda new to all of this.I'm in studying for FCSS EFW AD 7.4 exam and I have a queistion related to debug output - is there anyware a guide that tells what exactly all of the outputs tell?I really want to get pro with few of them and whole fortigate processes behinde the curtain. I'm interested in the deeper knowledge just to troobleshoot better.

Hello guys, i stumbled into the FortiGate logs from external client which needed some analysis - ive checked the logs and there was value applist="block-high-risk" associated with public "grey area" application, but the action was action="accept" which might indicate that even the connection was flagged the connection was allowed anyway?

 Hi all, In the process of setting up FAC Cloud with radsec and a fortigate firewall - we are seeing the traffic coming to the FAC from a different IP to what is our FWs public IP address - when setting our radius client, this took me a little while to find.  Can anyone advise what should be set under the client IP for radius, or how the traffic is handled please? 

hi all !i've a question :i've 2 FGT 200F cluster on different location connectet by several link that share the my own BGP pubblic IP access in VRRP.so every cluster have different phisical IP on WAN interface and a COMON VRRP Address that i use to terminate IPSEC VPN declaring the Local Gateway ip address.In case of Failiure of the Primary location the Ipsec VPN tunnel will be closed on the same VRRP address on other location.Is it possible to use same configuration for SSLVPN?In gui i have not found the possibility to specify the IP where the sslvpn listen to,but only The INTERFACE where the services in Listen on - there are some other workarround?I'm in 7.0.12 Nat modeThanks Alberto

Hello, may i am doing something wrong or this is complete wrong here since i cannot find any post about my question.I am maintaining several fortigate firewalls without having devices which are placed behind the firewalls. When i get troubleshooting tickets it would be fine for me to have a possibility to check if a port on a remote device is open/accessable or it is not because for example it is blocked by a local firewall on the device.I know the "exec telnet" command, but for me it is only a workaround since depending on the daemon listing on the remote port telnet keeps connections established without the possibility to cancel them (for ex. with CTRL-c), port 445 SMB is such a candidate.I am a little bit supriesed that no one seams to have the use case for a port scanner / port test tool on Fortigates. Is there a command line tool on Fortigates to test remote ports and i have no idea of them or how do you deal with such situations? Creating temporary rules is also no option since t

Hello everyone, after updating the license for fortimanager in my testing environment, I found that fortigate couldn't connect to fortimanager. Despite entering the following command, I still couldn't connect. I hope to get your help. Thank you!fortimanager version: 7.2.8Fortigate version: 7.0.15config system central-managementset type fortimanagerset serial-number " FMG-VMTM25015787"set fmg "113.31.127.109"endexecute central-mgmt register-device FMG-VMTM25015787 123The following is the firewall debug informationfortigate_test_1 # diagnose debug application fgfmd<Integer> Debug level.fortigate_test_1 # diagnose debug application fgfmd -1Debug messages will be on for 30 minutes.fortigate_test_1 # diagnose debug enablefortigate_test_1 # FGFMs: set device as in_progressFGFMs: client:send:get authserialno=FGT40FTK2109BQ01mgmtid=1581151727platform=FortiGate-40Ffos_ver=700minor=0patch=15build=632branch=632maxvdom=10fg_ip=192.168.1.4hostname=fortigate_test_1harddisk=nobiover=05000021mgm

Hello Experts, Confirmation for "Adaptive Forward Error Correction (FEC)".https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/169010/adaptive-forward-error-correction?utm_source=chatgpt.com Is Adaptive FEC only applied to the existing "virtual-wan-link" SD-WAN zone?I tried it for my created/custom zone which belongs to IPsec tunnel members,however, it does not seem to work.FEC counter is not increased at "diag vpn tunnel fec VPN-NAME". If any, I would like to know the official KB ID and/or the reference.Any comments are appreciated. Best regards,  

Hello, Is there way to import profiles (like Web Filter etc.) to Forticlient EMS Cloud from FortiManager while not having the FMG configured with HTTPS access and public IP ?The Manager and EMS are linked via Fabric connections as they are under same Forti account but our Fortimanager appliance is not publicly accessible so I am wondering if you can somehow sync these profiles and other stuff to EMS. Only guide i found for this scenario is for on prem EMS appliance where in Web Filter you can Import from Fortigate/Fortimanager but you have to put the IP:port and FMG credentials. In my case this is not possible as the FMG is hidden and I dont want to do any port forwarding and etc. These appliances are already linked via Fabric Connection i dont understand why they cant sync profiles this way also.  Thank you

Hello. I have a question to FortiClient EMS and registration of endpoints/clients to FortiEMS-Server which is public reachable through port 8013.  I have configured that clients need an invitation code and afterwards need to autenticate with ldap username and password. Is there any possible to get a two factor authentication via OTP like FortiToken Mobile? Is this possible with SAML Auth and Microsoft 2FA?  Or is the Invitation Code the second factor?  Thank you. 

Hi, is anyone else having a problem doing deep inspection using Google Chrome? Google Chrome version:  119.0.6045.160 (Versão oficial) 64 bits Fortigate 200F, 7.4.1.config sys globalset admin-https-ssl-versions tlsv1-2 tlsv1-3google same policy/ssl profile from prints below. same policy ID from above - EGDE    same policy ID from abobe - firefox   SSL Profile:   Do you guys have some advices?TY