Support Forum

Using the search bar to search for an IP address at the top of the firewall policy screen in FOS 7.4+ always includes as a result any rule containing the "all" object. How do I turn this behavior off? While it's logical, for me it's uninteresting (unless I would specifically want it that way). This worked just fine in < 7.4, i.e. a search gave all policy rules containing a subnet or group or anything that contains what I am looking for, but not "all".

Hi!As I understand, after failover, system ha's "route-ttl" timer dictates validity period of FIB routes inherited from former Primary. Default is 10s - low value.However, BGP Graceful Restart timer "graceful-update-delay" default is 120s - a much higher value.How does Fortigate enforce these two values or is it up to me to align them? If so, given that "route-ttl" affects all routes, not just BGP routes, how would I align - recommendations?Thanks!

Hello, We're running a pair of FortiGate 121G (v7.2.11 build1740) in active/standby mode, acting as a gateway/DNS and DHCP server for the wireless guest users.The Security Policy along with the DNS Filter policy is very generous with literally nothing blocked. There are absolutely no issues with any laptop (Windows or Mac) and Android phones/tablets, but I have consistent issues coming from iPhones. It takes some time to load any page and sometimes it works fine and sometimes it just times out. Reloading the page seems to help. I initially blamed Private Relay, but turning it off doesn't seem to help, and there is nothing in my policy that could affect it. Everything is under DHCP and it's the same SSID for all devices. Would greatly appreciate any tips since I can't find any errors in the logs, nor traces that some web resources are blocked. Thanks.

Does FortiSwitch support just RMA and hot swap of the FAN and PSU without RMA the whole appliance? For  FS-1024E, FS-T1024E, FS-T1024F-FPOE, FS-1048E, FS-3032E, FS-2048F.  FortiSwitch   

Good evening, We have a issue regarding a IPsec remote access VPN configuration. We now have to covert entirely to IPsec VPN (no ssl-vpn anymore) and we are having issues with configuring user and group based restrictions. We want to create 3 tunnels which will use 3 user groups which have users that have a external Radius server for authentication (everything works fine in that part). We want to create a policy for each group, which will have access to 3 servers, and then add access to other servers for specific users. We are using Fortimanager, and a sample configuration is Incoming interface :  ipsec-VPN-Tunneloutgoing interface : local-area networksource:  172.17.0.0/28 + user1destination: server 1, 2 and 3 Problem is, the Fortigate allows all the users in the  172.17.0.0/28 to access these resources, not only user 1. We also tried enabling the "security mode: captive portal" option on the tunnel interface and allowed only the logistics department

Although I’ve successfully established an IPsec tunnel between our Head Office and Factory using the same DDNS, I’m still unable to access the Factory’s FortiGate 80F through it.I am using internet from Mobily and STC 5G routers, enabled the DMZ in there...Kinldy help ASAP.

Good morning, Since upgrading to 7.4.3 on my 601E firewall cluster, my AP's (only 9 of them) keep dropping offline with no good explanation in the logs that I can tell.  I never had a problem with the previous version I was at which was 7.4.1.  A reboot of the AP (either by resetting the POE on the switch port or by unplugging and plugging back in) will bring the AP back online and connected with clients but then randomly (could be hours or days later) it will drop back off.My Fortigate cluster is stable (no HA changes) and seems to be normal.  The APs are all 221Es running 7.4.2 firmware.  The only log entry I see that seems to be related to when they drop is:Action ap-failReason Control message maximal retransmission limit reachedProfile resv-dflt-FP221E5519035229Physical AP ap-2b-publicMesh Mode mesh root apMessage Failure happened on AP ap-2b-public. I did find a document (https://community.fortinet.com/t5/FortiAP/Troubleshooting-Tip-After-a-failover-F

I am trying to automate the creation/renewal of Let's Encrypt certs through the REST API, but I cannot seem to get POST /system_certificate_local/automated to execute properly. Even following the example formatting, I still can't get it to work. I can upload certs using the API with POST /system_certificate_localut only the automated portion gives me issues.I can create an automated cert in the GUI using both ACME and DNS-01 challenge, so I know it is possible.I am on v7.4 if that adds any context.

Hello,I'm about to configure Agentless access to private applications through FortiSASE for contractors, however, I read that it's required to Enable SSO authentication for SWG users, which needs an integration with user database such as Azure AD, without that Agenteless ZTNA cannot be configured (as I understand it right now).I already enabled SWG, created the SWG policies required, and have a local user group created, but this SWG SSO authentication is making things though.Is there any way to bypass this and use only the local database (fortisase database, coupled with MFA, why not). Or it works just like that and there is now way to do it differently ? Thank you in advance

Blocking External Access to the Anydesk ApplicationHello, good morning.I'm trying to block external access to the Anydesk application installed on computers on my internal network. I've tried several times to block access by creating firewall rules to block access from WAN to LAN, but to no avail. However, I can normally block access from LAN to WAN using Web Filter, Application Control, or Anydesk's internet service.Could you help me with the best way to implement this external block?My goal is for users on my internal network to be able to use Anydesk for remote access normally, but for external access to Anydesk on my local network to be blocked.Thank you in advance.

Hello. I am using a handout FortiGate unit, that still have several months left on a support contract.How can I register that unit under my Fortinet account and purchase a new support contract, when the current one expires? Thank you.

We've had sections created on each of our FortiGates (currently running 7.4.6) that we manage via FortiManager. Today upon logging into FMG, two of the FortiGates now have the section before every firewall rule and not the specific sections wherer they've been for the past few years.  I suspect the cause is something within the FortiManager, because we deployed changes to these two firewalls yesterday, and when I look at what's about to be deployed to another firewall, every line of the firewall policy has "set global-label "blah(##)".  Can someone point me in the right direction as to how to disable this behavior? Thank you.

We have fortigate firewalls & EMS server for Forticlient management. We are using several FortiAPs. We want to use certificate-based authentication for wifi users. I know we can achieve it by using EAP-TLS 802.1x and radius server. Is there any way we can use EMS server for certificate-based authentication for wifi users? If so please share document for the same.Thanks in advance.

I am trying to figure out where device info comes from on Forward Traffic logs on Fortigate devices.  The source will show an ip address and the device will have a different ip address.  This causes some confusion when trying to investigate log data.  Thanks in advance.

I have a FortiGate 1000D, v7.0.13, with some VPN connections. Some VPNs have multiple "Phase 2", and the IPsec tunnel only goes down when all of them are down. I'm monitoring the device with Zabbix, which reads the 1.3.6.1.4.1.12356.101.12.2.2.1.3 SNMP table to monitor FortiGate's VPNs. However, I noticed that this table only shows the status of the "Phase 2" selectors and not the tunnel status. When a "Phase 2" status goes down, Zabbix generates an event, but I don't usually need to monitor these alerts.So, I'm looking for an SNMP OID that shows only the actual tunnel status, not its "phase 2 selector". Here's a picture of the IPSec Monitor Dashboard to better illustrate my question. I've marked the actual status I'm looking for in the MIB. Any thoughts on this matter?

Hello, the installation of FortClient on an ARM 24H2 (Win11 Pro) does not work and there is a RollBack. - Tried FortiClientVPNSetup_7.4.3.1790_ARM64 Any ideas? 

We have an FG-200F with only FortiCare. The WAF profile has been activated, and I would like to know if the signatures for this profile are updated with only FortiCare Premium Support?. THANKS

Hello, Fortimanager version : 7.4.7Fortigate version : 7.4.8Adom : 7.4 Our fortimanager try to push object who aren't use in Policy package or SDWAN rules For example :config vdomedit SDWANconfig firewall addressedit "ACE-1"12fc575c-6239-51f0-6d5e-bf3aff5d5940set subnet 10.10.10.10 255.255.255.255next I checked the CLI configurations on FortiManager, and this object does not exist in the database of Fortigate. Other problem, when i modify a groupe like GRP-FORTIGATE, the adress object is not add in the group when i push. But in GUI of fortimanager, group and entry are good Best regards, Killian

Hi, I'm trying to move from SSL-VPN to IPSec, and no matter what I do, my forticlient is getting timeout on connect when I'm trying to use SAML.My SAML port is 1443SAML is working perfectly fine with SSL-VPN.I'm on version v7.6.3.I made to read and follow all the guidelines I could have found on the forums and in forti website.If I try to connect with out SAML, it works fine.I'm pretty lost at the moment because FortiClient doesn't seem to generate any logs for this connection attempt as well.

I have a problem. How can I configure an IPsec remote access VPN on FortiManager 7.4.5 and assign it to our Fortigate? I found many documents and videos about hub-to-hub and hub-and-spoke solutions, but unfortunately, I couldn’t find any solution explaining how to set up IPsec remote access VPN. Can anyone help me with that?

Hello,I am posting this message as I am having a blue screen issue when attempting to upgrade our FortiClient VPN agent (version 7.4.3.1790) on some computers only.Here are the steps performed in my script that was working perfectly on test computers before deploying it on all our clients : The following processes are killed before uninstalling any previous version of the FortiClient VPN agent :FortiClient.exe, FortiClientConsole.exe, FortiClientSecurity.exe, FortiElevate.exe, FortiSSLVPNdaemon.exe, FortiSSLVPNsys.exe, FortiScand.exe, FortiSettings.exe, FortiTray.exe, FortiVPN.exeExisting versions of FortiClient VPN are being uninstalledThe installation script resumes its actions at next rebootThe issue seems to occur on some computers during the uninstall process and cause a BSOD with the "BAD POOL CALLER" error.Thanks to some utilities like WinDebug, logs show that the FortiClient agent is in cause, but with no further explanations.Has anyone already experienced the same issue ?

Hello, dears!I hope this post finds you well. We currently have Fortigate firewall, FortiAP (231F, 231G, and a few outdoor ones), and Hikvision cameras in our network. We also have switches from different brands, including Planet, Hikvision, ONV, Dahua, etc. (4-port, 8-port, 16-port, 24-port). We need industrial switches at some areas, but most are non-industrial.We have planned to start using a new brand for better management, visibility, remote control, great visual tools, etc. However, we need a brand that could cover our needs. Our company is medium size, with around 50 access points and 250 cameras installed so far with the high expectation of expansion. That's why, we will also implement HikCentral system for our CCTV room. We have received some recommendations, but each sources seems to praise what they sell.This is the list of recommended brands:- Ubiquiti (Unifi)- Cisco (too EXPENSIVE)- Planet- Ruijie (easy and modern management system with lifetime cloud manage

Hi,Is there a feature/option for Fortinet 40F to integrate with Microsoft/Office 365 AD Directly natively for Admin authentication and also for SSL VPN authentication ?Any guidance would be great :)

I just ran into this: I have a FQDN that used to be rated as "newly observed domain". I create a rating override to a custom cathegory and added that cathegory to the list of reputable sites in the DPI profile.  The Site then worked (before that it got blocked by either IPS or APC and those have no whitelist).Now it seems that Fortinet have removed the rating as it is now shown as "unrated". The cathegory unrated in webfilter profile is set to "warning". The Site still has the rating override from above.In the support docs fortinet writes that if you exempt a site from DPI then no further UTM is processed on it after certificate inspection. In opposition to this I do get a webfilter blocking page stating the site is rated "unrated".As far as I understood the webfilter should not even apply when a site is exempted in DPI.What is wrong here?  We're on 7.2.11 on the Fortigates btw.

version 7.2.11from same source IP first rule SNAT to inet, second rule DNAT into IPsec VPN; the issue is, FG takes always the DNAT pool address as source; even in the SNAT (outgoing interface) rule the FG takes the assigned pool addres as source, but sends the traffic to the destination in inet; result I get an outgoing hit to my SNAT rule, but the traffic doesn't come back; in sequence the SNAT rule comes before the DNAT rule destinations are not overlapping; the SNAT target in the internet are three host addresses; so very small;  is there something I've to consider specifically? After my opinion the FG shall process the rules after sequence and SA/DA match before processing NAT rules; Is there a good hint to get this solved? thx br Hanno