Support Forum

Hello,  we have two firewalls. We started upgrading the first over automatic upgrade -> 7.0.17 to 7.2.11 to 7.4.8. This was fine. The second had to be updated manually -> 7.0.17 to 7.2.11 ok. Now the upgrade moved to System/Fabric Management. However there I can't choose a file for upgrade anymore. This is availalbe in 7.4.8 again but not in 7.2.11. How can this be solved? Kind regards,David

Hi, We have SDWAN VPN Dialup with fortios 7.4 we used BGP for routing HUB 10.220.1.1/24                                SPOKEN1 10.220.1.2/24                                                                SPOKEN2 10.220.1.3/24 We have ping from spokens to hub  but no ping from hub to spoken. we check this links and we see that same problem,  then we tray the solution but it does no worked. https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Connectivity-issue-between-Dialup-hub/ta-p/328641 https://community.fortinet.com/t5/FortiGate/Technical-Tip-Potential-routing-issue-on-the-Dialup-VPN-hub/ta-p/307683 please help me

I'm running a FortiAuthenticator RADIUS (v_6.6.2) with Trusted CA policy, with the trusted CA being a Windows Server. We have a GPO setup to use either a machine or user cert and confirmed all the settings are consistent with the wireless SSID's auth settings. Clients are taking 60-100secs at times to authenticate.When viewing the PCAP, the communication is seamless between the FG and FAC, but the client takes several Access-Challenges to finally present its certificate https://19216801.onl/ .Has anyone else experienced this?

Hi,I am struggling to make a configuration in my LAB to work, which involves setting up a ZTNA HTTP Proxy which should redirect the traffic based on virtual-host/hostname. I am running FortiOS 7.2.11 , EMS 7.4.3 and FortiClient 7.4.3 in my environment. In EMS I have a ZTNA Destination with the FortiGate Public IP/Proxy ( Proxy Gateway:80 > Destination Host on ports 80,81 and DNS entries locally in hosts for test1.lab.local and test2.lab.local with the PUB IP/Proxy GW and if i switch the entries to the private IP I get: ZTNA Access Denied The page you requested has been blocked by a ZTNA restriction. Details: API Gateway Denied. Tried switching from Service HTTP to TCP Forwarding, no luck The firewall rule is in place and works for HTTPS/SMB , our focus in the matter at hand is for LAB-WIN config firewall policy edit 17 set srcintf "wan1" set dstintf "any" set action accept set srcaddr "all" set dstaddr "LAB-WI

Good day everyone,I added to my repo folder with FortiAnalyzer  Handlers collection ready to use.Your feedback, and ideas for new Handlers are always welcome.Repo: https://github.com/yuriskinfo/Fortinet-tools/tree/main/Fortianalyzer-handlers  Thanks.  

 I am having trouble accessing the website https://concesionarios.gpat.com.ar/webconcesionariosI see that my two Fortinet 80F and 100F devices are automatically blocking me without any blocking filter. I tried creating a web filter and DNS filter to allow me to access the page, but it still won't let me in. That's why I need your help to see what options I can try to allow me to access the page mentioned above.I'm attaching screenshots of the settings I've configured. If you need more information, I can provide it. Thank you very much for your help.  Screenshots:                

Buenas, tengo un problema y es que mi fortigate-30G entra en modo conserva y esto provoca que se bloquee el trafico de red. Hace poco tuve que aumentar un parámetro que es el system session-ttl. Por defecto esta puesto como una hora pero yo lo tuve que subir a 8 horas para que me almacenara mas tiempo las conexiones inactivas. No se si esto ha podido provocar que el forti se sobrecargue y entre en modo conserva en determinados momentos.

hello to you all,I want to get regular backups using SCP But Fortinet doesn't seem to support backing up to SCP=================================FW # execute backup config ?        ftp           Backup config file to ftp server.        management-station          Backup config file to management station.        tftp         Backup config file to TFTP server.        usb         Backup config file to USB disk.        usb-mode             Backup config file for USB mode. FW # execute backup config====================================Firmware version is 5.2 -----------------------------config system global   set   admin-scp enable-------------------------------There is a SCP enable setting, but it seems to be unavailable for backup

Hello Community,We are planning to add a second uplink on our FortiGate firewall. Currently, VLAN 92 and VLAN 93 are configured as sub-interfaces under Port13.Now we have a requirement to:Add Port14 together with Port13.Create a Redundant Interface (Port13 + Port14),Move all existing VLAN sub-interfaces from Port13 to this new redundant interface.My questions are:After creating the Redundant Interface, do we need to reconfigure all existing firewall policies, routes, and objects that are currently using Port13?Is there a way to migrate VLANs from Port13 to the new redundant interface without deleting/recreating all VLAN sub-interfaces manually?Does this change affect existing VPNs, static/dynamic routing, or HA configurations?Are there any best practices or recommended steps to perform this migration in production to avoid downtime?Can anyone share official Fortinet documentation or KB articles regarding redundant interface + VLAN sub-interface configuration?In GUI/CLI, which option/me

I see a big discrepency between 7.2/7.4 and 7.6 for maximum values.On a 1500D, 1100E, 2200E, and 3301E the maximum number of server-load-balance is 2048 when running 7.2 and 7.4For 7.6 these values drop to 64. Why is there such a big discrepency?  firewall.vip type=server-load-balance (virtual server)

i have an issue on fortipam windows application filter profile, i have created the target and secret and apply a windows application filter profile to block or prevent user opening CMD or PowerShell but it dos not work as expected and always give me log tell me skipped for privileged account

I am trying to use a FortiAP 221E without a FortiGate, but thus far have been unable to get it work. This FortiAP was previously used with a FortiGate and I can reconnect if needed to put in Standalone mode. I attempted to Factory Reset the AP using the reset button, but even after Factory Reset it doesn't broadcast an SSID and attempting to connect to via web GUI does not work. I am posting here to see if I am missing a step in putting into Standalone mode or if that is not even and option on this model.

Hi Team, Is it possible to configure an IPSec VPN tunnel in which its traffic will be terminated on a VLAN interface (In physical LAG interface) for DMZ?  Seemed like I cannot find a related KB link for this. I hope you can help me. Thanks!

Hi All, I'm installing 250+ FortiAP's on a new site, and to test rolling-wtp-upgrade, I disabled "FortiAP auto firmware provisioning" so I could test 'rolling-upgrade'. FG: 7.4.3 1: Rolling Upgrade never gets past first 5 AP'sSelecting many AP's (10-25 tested here), after enabling rolling-wtp-upgrade and starting a FW upgrade from the FortiGate, it always start FW upgrade on first semi-randomly-selected AP's, but after those 5 move to 'Reboting...' it never moves on. I have let it run more that 30 minutes multible times.Anyone have this working? 2: Disabling Rolling Upgrade still uses RU..? ;)Now, after I went to CLI and disabled rolling-wtp-upgrade, I did 2 more upgrades on 25 AP's, but FG is still only updating the first 5 AP's in the list..  Is this feature (hidden in CLI) just not mature, or broken, in 7.4.3?? After this, I've set up a Firmware Template in FortiManager and updated all the AP's from there. That seems to have worked,

Hello Fortinet support, According to VirusTotal (https://www.virustotal.com/gui/domain/indogal.co.id), Fortinet is falsely accusing indogal.co.id to be a Phishing site. We are certified Beef importer from Indonesia. Our vendor reported that their antivirus program is blocking our email. Kindly remove the false positive detection from your site. Thanks. 

Hello, I am using the FAC v6.6.5 and I would like to edit some settings of the OIDC configuration. In my Relaying Party, I would like to add some claims but not on the "openid" scope but on a custom scope "abc". Is it possible because I cannot edit the field ? I follow this information in the guideline :"Select the claim scope. In FortiAuthenticator xxx, only the OpenID Connect (openid) claim type is supported"Has this changed ? Thanks 

 Hello, I'm trying to setup an ldaps srv on my fortigate 50E (6.2.17) and it works with the ip without cert and i can save but i would like it to work with a cert when i try with the fqdn, i can't save and shows invalid hostname (i can ping the fqdn from the fw) even if the connectivity test works and i can browse the distinguised name  then when i try to enable the secure connection and add the CA cert (with the fqdn as the cn), the connectivity test still works, i can still browse the distinguished name but when i try to validate, it disable the secure connexion with the cert and i get an invalid hostname error even if i can ping this hostname and browse the dn and everything... Does someone knows why it could do that ?  Best RegardsJohn      

FortiGate 60F, v7.4.8, with IPsec Remote Access VPN using Forticlient, everything has been working well. I now need to set up a second tunnel that will assign a single IP address to a remote access client.  The remote access client can access all LAN resources, but need servers on the LAN to pass traffic to the Remote Access clients too. I've tried setting up a static route to the tunnel interface, and created a policy to allow LAN > Tunnel. I see traffic coming in from the LAN, and out through the tunnel interface, but nothing arrives (no response back from ping).  Hopefully I'm missing something easy here! 

Hello, we write the year 2021 and ipv6 has grown to an over 30 years old protocol. But it still seems to lack basic support. We switched from OPNsense to FortiGate and our network is dual-stacked. With OPNsense it was no problem to declare FQDN address objects that resolved to all A and AAAA records. And really nobody wants to create ipv6 objects manually. So we use mainly FQDN to access ipv6 resources. In FortiGate FQDN objects just resolve to A records and no chance to get my ipv6 addresses added. Any hints, tricks how to keep our system dual-stacked without abandoning our ipv6 design or manually add each ip resource twice? The lack of ipv6 support makes many cool features useless e.g. FSSO agent. I bet users in ipv6 networks won't be resolved dynamically to address objects and get no access - except they disable ipv6 on their pcs. How do you work with dual-stacked servers without adding everything twice and manually adding 128-bit long addresses which are more li

I noticed that the firewall logs did not show the up-to-date hostname of the user's device. However, by running the command:execute dhcp lease listI was able to retrieve the current DHCP leases, which included the correct hostname information for the device. This confirms that the DHCP lease information is current, even though the firewall logs do not reflect the updated hostname. Additionally, the hostname shown in the DHCP lease list differs from the one recorded in the firewall logs.How can I update the device's hostname in the firewall logs without causing any disruptions? I'm using a FortiGate 81F running firmware version v6.4.16.

Can we send the log to syslog only for specific category? Example send log to syslog for '**bleep**' categories.

HiI'm asking because I have a question when I do okta certification at Fortigate. Diagram is ScenarioWhen users on INT side access SRV, they must obtain okta certification to access it. Policy1.INT > SRVS : SSO, User IPD : Server IP 2.INT >  EXTS : User IPD : ALL This way, I can access the server after being authenticated. However, ALL is not available in Destination.So I made okta FQDN and trial.* as destinations, but the authentication screen doesn't show up. Do you know how to set the destination for Okta authentication? Also, I would like to know what traffic flow okta authentication is done when users access the server. Thank you.       

I know Fortinet has their own EDR, but we are a CS shop and like it. I have heard there is some integrations with CS and curious how good it is and if there will be a tighter integration down the road?Using the CS client but having it talking and working with the FG firewall would be a nice solution IMO. A partnership would be good.

I have a Fortinet device that has been decommissioned by my company. I use it at home for lab work and study, but the licenses have expired, even for firmware updates. Is it possible that there is no home lab evaluation license for those who use it outside of a professional enterprise environment? I would be willing to pay for it, but only at a reasonable cost.Thanks

We are new to the FortiVoice community and so far everything seems to be working fine except our CallerID. We have looked at the Caller ID modification hierarchy, and to my understanding, the Caller ID that is specified in a user's extension page should be the highest priority. For us, however, this doesn't work. Despite having something entered in that field, it continues to show the Caller ID being sent by the Survivability Gateway. As far as I can tell, nothing changes what called ID is being sent. It is always what is listed on each site's Survivability Gateway. I even attempted to set a DID Outbound Number Map (which according to the hierarchy, should be high priority than the Survivability Gateway) and it still overrode that with the information on the Survivability Gateway.  Any help on what may be causing this would be very helpful..