Support Forum

 I would like to share only the most relevant security logs from FortiGate to a syslog collector, and I aim to minimize the volume of data being sent.For example I am interested in User Activity Events, but I would like to filter them further, for example, to include only admin login events.Is there any official Fortinet documentation that lists the subcategories or log IDs included in “User Activity Events”, describing their purpose and content?And more importantly:Is it possible to apply filters directly on FortiGate (e.g., using CLI) to export only specific subcategories within a log group?Any example or reference would be greatly appreciated.

Dear all,Could you please let me know which category the following logs:- Anomaly - APP-CTRL- DLP- DNS- EmailFilter- FILE-FILTER- FORTI-SWITCH- GTP- ICAP- IPS- SSH- SSL- Virus- VoIP- WAF- Webfilter  in FortiGate belong to, based on the categories shown in the image from fortigate GUI? I found this categories in the table from "Log Reference" section in fortigate guide. I can't understand for example the "anomaly" logs which category do they belog according to the fortigate list in gui (shown in immage).Thank you in advance for your support.Best regards,

I have a dialup IPsec VPN account on Fortigate firewall. When I use my laptop to connect to VPN using the firewall credentials, I can successfully connect and then RDP to the remote servers.When I use the same connection and credentials from my Windows Cloud PC 365, although the VPN gets connected successfully but I am not able to access any of the remote servers via RDP.There is no change in the VPN connection. It works absolutely fine from laptop but does not work from Cloud PC.Cloud PC does not allow ping, telnet or tracert as per Microsoft policies.When I do "route print" I can see exactly same results on my laptop and on my cloud PC for destination network and IP assigned to me via VPN. (with of course a different IP from VPN range) My fortigate FortiOS is 7.6.3 which does not allow SSL VPN. I have another Fortigate with FortiOS 7.4.8 with SSL VPN configured.I am able to connect SSL VPN and RDP to remote servers successfully.   Is there any workaround/fix

Hello everyone, Before implementing the following configuration in production I'm testing it out in GNS3 and I'm facing issues with Inter-VLAN routing. I have configured FortiGate to act as router-on-a-stick. I have created VLAN 100 and VLAN 200 on the switch and allowed it over the trunk interface that is connected to the FortiGate. Configured the ports connecting the end devices as access ports.Created same VLANs on the FortiGate and attached it to the interfaces that is connected to the switch.Created the required Firewall polices, VLAN 100 -> VLAN 200 and VLAN 200 -> VLAN 100.From device in VLAN 100, I'm able to ping the VLAN 100 SVI IP address and the SVI IP address on VLAN 200. But unable to reach the other device in VLAN 200 and vice-versa.Packet sniffer on FortiGate shows that It is receiving the packet on VLAN 100 interface but it is not sending it out of VLAN 200 interface. Please, find the attached images for the reference. I believe I'm not missing anyt

I have to block filesharing and storage. It works with dropbox.But wetransfer.com is still shown, even when lookup rating tells me it is "filesharing and storage".But sometimes it blocks the short-url we.tl. Any suggestions?Thanks.

 Dear Community, due to the fact that Fortinet decided to remove the Classic SSL-VPN with 7.6. the first people try to migrate from SSL-VPN to Dial-Up IPsec with mode-config.To test it for a customer i built following lab:I was able to get it all running on IKEv2, but somehow eventhough i enabled Split-Tunneling for both ipv4 and ipv6 i receive a default route for both v4 and v6.Does anyone know the issue and know how to solve it?ThanksMario :)

Hello and sorry for my english, I want to configure SNMP on fortigate FG500E firmware v7.2.11 (no VDOM). I did on other fortigate it was easy to configure but for this model, nothing works. I create community and allow IP of my Zabbix server (i allow V2 snmp)After that i allow SNMP on interface fortigateI can ping fortigate on interface, but there is no response from fortigate. The interface is not Magement interface, it is that the problem ? not sure i don't find the solution

Hi there,  We are running PCI Compliance scans on our network, each time we do we have an issue with both port 1000 and 1003 tcp over ssl.  I have tried changing the SSL certificates we've used, and can't see any references to ports 1000 or 1003 in our config.  We are running a Foritgate 400e on Firmware 7.3.

Hi, I'm not sure it is even possible. I have 40F running version 7.2.11 I understand that I can configure 40F to do SSL Inspection and Web Filtering - to block adult websites (not sure how - a guide would be great).   I've been asked to block the following situation -  when a person enters Google and over google search for "porn" or "xxx" etc - the following should occur -  1.at best option - the whole search will be blocked. 2.in case option 1 is impssible - would it be possible to block the images that you can see when going to "Images" and "videos" tab under the google search ?   the situation is that the images tab for example shows previews of porn websites without entering them.

In fortigate v7.6 the SSL VPN is retired so i create IPSec VPN for remote access.Tested using my android phone using native android vpn client and the vpn connection is working fine.But if i use forticlient vpn both on my android or my windows then the VPN is connected but can't access to anywhere.In forticlient VPN client i see i got the ip address from the fortigate 10.18.200.100 but the gateway is 10.18.200.101From where the forticlient get the gayteway 10.18.200.101?Here my IPsec vpn setting at fortigate.

I have two firewall devices integrated. Device A and Device B using fortigate firewall connector, i want to check the configuaration ids of both configuarations done using fortigate connector.

Hi I want to remove only the Malware component, and leave VPN Application firewall  etc on. I cant see an option to only remove those components. want to leave everything else just want to use another product for AV .appreciate any help

When FortiClient performs SAML login for SSL VPN authentication, a connection with a successful authentication page will appear. May I ask whether the content of this page can be modified and customized?

Dear all, I want to configure a IPsec connection with authencation via user certificate. The user certificate is missing from the first startup view.In the VPN profile settings I can choose between machine certificate and the user certificates.When I switch to the startup view, then I cannot choose the user certificate anymore. Within the SSL-VPN connection I can choose the user certificate always. Could you please assist? Does anybode facing the same issue? Currently I am running the version 7.4.3.1790

Hello,I am posting this message as I was wondering if it would be possible to perform a full silent uninstallation of the FortiClient application using the specific "fcremove.exe" utility.If so, does anyone know what the silent parameters would be in order to perform this action in combination with the "fcremove.exe" utility ?Thanks in advance.Fred

Hello Experts, We have aaa.bbb.209.136/28 global IP address range by provider. The connection is PPPoE.As wan1 IP address, aaa.bbb.209.142 is set at unnumbered IP. At DMZ, aaa.bbb.209.137/28 is set.Everything works at Fortigate 60E. Recently, we bought Fortigate 90G to replace it with.However, the same IP addresses cannot be configured at Fortigate 90G.When we try to set aaa.bbb.209.137/28 for DMZ, an error message such as"overlapped network with wan1" is shown. How can we solve this situation?For information, aaa.bbb.209.142 can be configured at 90G. Thanks in advance and best regards, 

Hi,I’m experiencing an intermittent internet drop issue with my FortiGate 40F.Here’s the situation:- The ISP says they are not receiving any packets from my firewall when the issue occurs.- The WAN port shows link/ACT lights ON and stable.- When I connect my laptop directly to the upstream MikroTik RB3011UiAS-RM switch, I get internet without drops, so the ISP link and MikroTik appear to be fine.- The FortiGate is connected to the MikroTik RB3011UiAS-RM, which does NAT/routing.- This happens about once a day or every other day. It usually starts working again within 5–10 minutes, but today it did not recover on its own  I had to restart the firewall for it to work again.I appreciate any guidance you can provide.Thank you.   

I have an issue that I would like some advice for. I have 2 sites with Fortigate 40F's and both sites are on a Comcast 1.25 Gpbs x 300 Mpbs circuit.I have built an IPSec between sites and initially it seemed that the speeds were around 40 Mb (measured using iPerf) but they consistently keep dropping to unworkable speeds of less than 1 Mb. Comcast uses some product called "Security Edge" but I have turned it off on both sites. I am trying to work with Comcast to troubleshoot this issue but as expected, the service desk does not really seem to understand what a site to site is.. and speedtests on the network and connected devices and raw speed tests show proper speeds so Comcast blames the issue on the Fortigates and a misconfig on our end. The tunnels are super simple, Ike 2, aes and sha 256 and diffie 14. No inspection or any other things that could slow the tunnel down. Does anyone have an idea as to what could be causing this or what we can do to solve this issue? I don't e

I would really like to get a remote access VPN to my Fortigate network which is connected via Starlink, has anyone been able to make this work? I have a Fortigate 60F running version 7.2.11 Supposedly Starlink CG-NAT network supports SSL VPN (I have read it does not support IPSEC VPN) but I have no luck. I have not found an option for "NAT Traversal" in the Fortigate SSL VPN config anywhere. I have done a packet sniffing session on the WAN interface of the Fortigate and it shows no traffic coming from my public IP while trying to ping or connect via SSL VPN. I have confirmed with support that my SSL VPN config is correct and I am successfully using identical config at sites with Comcast internet connection.

Hello, can you please help me to configure an interface based routing? I understand this to mean the following:  The entire traffic that is to be sent to a specific IP address is sent to a specific interface without any information from a gateway.  Example: 192.168.99.25/32 should be sent completely and without specifying a gateway to the interface port3.  Unfortunately, I have not been able to find this in the routing configuration so far, or I have always had to specify a gateway. Even if no gateway was specified, 0.0.0.0 was entered and thus routed to the default gateway.  I'm using version 7.6.3 Yours sincerely, Markus

We recently moved a FortiGate cluster (60F running on 7.4.4b2662) to a new location and are now unable to re-add it to FortiManager (VM running y7.4.3b2487) using the new WAN interface IP receiving the generic "Probe failed" error. Nothing was changed at the time in the configuration of the FortiGate cluster other than the WAN interface IP and the default static route. FGM-Access is enabled on the interface. We have an active IPsec VPN tunnel between the site containing the FortiManager installation and the new location of the FortiGate cluster. The cluster was previously connected to FortiManager with no trouble at all and we are able to connect them now using the LAN interface IP over the VPN tunnel but using the WAN interface as was previously the case is the preferred method. We have confirmed that the credentials being used are correct. Nothing in the firewall policy directly references the old WAN IP that I can find. As mentioned, we can add the cluster using the internal IP

Hello, I lost the software installer for my Fortivoice 100, I can't find where to download. please let me know if there is some link to download the software. Thanks!

Hi there,I've been using FortiClient 7.2.8 so far and just rolled out version 7.2.10 as an update via FortiClient EMS on two test PCs.The clients are running Windows 11 24H2.On both machines, I’m seeing the same issue: after updating from 7.2.8 to 7.2.10, the reboot doesn’t happen. The "Restart now" window pops up, but clicking it doesn’t do anything.After manually restarting, the installation seems to be fine.I already noticed this with 7.2.8 but didn’t think much of it – now the same thing is happening again.Could this be a bug in these versions?Anyone got an idea how to fix this?Back in 7.2.7, everything worked fine...The main issue is that after the update, the user has to restart the PC manually – which probably won’t happen during the day. So the machines remain unprotected in the meantime!

I'd like to ask a question Estimated bandwidth , what's the difference between kbps Upstream and kbps Downstream ? Upstream would be input and Downstream would be output ? in it I put example 80.0Mbps Upstream and limit of my link send message ? would that be it ? 

Dear Colleagues,Our Infrastructure currently utilizes fortigate 60F for network security. We keep receiving waves of phising email directed at individual staff and our general group emailing list. I have had to try antispam feauture of the fortigate 60F firewall to salvage the situation since the email service provider have not been responsive. Unfortunately with all efforts made we still keep getting these spam emails. Its show either i am not doing something right with configurations or its cannot be done unless from ISP side since email server hosted in their datacenter. Kindly advice. Warmest Regards.Ibrahim.