Support Forum

Hello,I’m encountering a persistent issue on my FortiWeb device. In the logs, I consistently see entries like: Main Type=HTTP Parsing Error, Sub Type=HTTP Parsing Error Action=alert_Deny To troubleshoot, I have disabled both “Malformed Request” and “Malformed URL” options under HTTP Protocol Constraints. However, these logs are still being generated, and the traffic is denied.I have checked the configuration but couldn’t find any explicit setting to disable or further tune the handling of HTTP Parsing Errors.My questions:Is there a way to disable or adjust the detection for HTTP Parsing Errors?What else could trigger this log even after disabling the relevant protocol constraints?Are there any hidden or advanced settings I should be aware of?Any suggestions or documentation references would be greatly appreciated!Thank you.

Hi. Does anyone know how to block streaming/movies from playing on Telegram without blocking messaging? Best regards! 

Dear All, What can I do with  FortiGate-VM evaluation license, it does not provide basic licensing along with low encryption. No of interfaces & policy -3 Limited route  Do you know what features it provides. It think, do not best time for use Regards,Umesh

Hello class!I have the following request and I am unable to apply, can anyone help me?I need to block YouTube for my entire network, but one specific channel I need to make accessible, it has few videos, but I've tried different ways, and it doesn't work, when it blocks, it doesn't load the videos, it just keeps running, or it only blocks by video categories, I've tried with WebFilter, Video Filter, Deep Inspection, Application Control, and with several community posts, like the one below:https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-restrict-YouTube-channels-using-video/ta-p/191767But without success, My Fortigate is a 100F, version 7.2.7

Hi, Has anyone had any experience using Akamai in front of a Fortigate SSL VPN endpoint? So far we have done the following. - Allowed the Akamai subnets as allowed hosts in the SSL VPN settings on the Firewall - For testing purposes edited the clients local host file to resolve the FQFN to the IP of the Akamai endpoint The Fortigate logs for the users says tunnel-down 'User requested termination of service' when it disconnects. We do note that when the Client connects the remote host IP as an Akamai IP and not the clients public IP which is why I think the client disconnects. Does anyone managed to get this working and if so how? Many Thanks

There is a huawei core switch and fortiswitch 1048 connected to it. Fortigate manages the switches in the network with fortilink protocol in layer 2 mode and directly connected to fortiswitch 1048E. How can I reach the switches under fortilink network from different vlans.

Hi Guys, I wanted some guidance on how can I become a Firewall Engineer. I have 3 years of Exp in IT but I had to left my Job in March 2025. Now I am trying to swicth my skill. I wanted to know that What are the things I need to learn before appplying for a job and how much time it will take to master it. I have started from Basics and so far I have learnt IP Addressing, Subnetting, Routing(Static, Dynamic, OSPF, BGP), Swicthing(ARP, Vlans, Inter VLan routing, HSRP, VRRP), ACLs, NAT(Static, Dynamic, PAT). I have started learning Fortigate from basics and I wanted to know is there anything else I should learn parallely? How much time will it take to land my first job as a firewall engineer. I am also thinking of learning Cloud in future and will dive into Cloud Security.

Hello,  My question is can fortigate autoquarantine AD users based on the number of IPS virus violations they do?  I see that under the article https://docs.fortinet.com/document/fortigate/7.2.4/cli-reference/148620/config-system-automation-action or the video https://www.youtube.com/watch?v=3vLdto9Yx0U  that I can block bad hosts based on Mac address or source IP address but nowadays users use different computers, so my question is can I make an automation that can automatically block the source AD user (after fortigate authenticates the users) if the users does too many attacks in a specified time frame that trigger the IPS or virus detections?

Hi Experts, I'm trying to setup a Virtual FortiManager on my EVE-NG platform. I have performed the following configurations on it through the CLI:config system interface     edit "port2"         set ip 192.168.1.200 255.255.255.0         set allowaccess ping https ssh http     next end My workstation IP is 192.168.1.14 and I'm am able to ping it successfully.C:\Users\Arpit>ping 192.168.1.200 Pinging 192.168.1.200 with 32 bytes of data: Reply from 192.168.1.200: bytes=32 time=119ms TTL=64 Reply from 192.168.1.200: bytes=32 time=211ms TTL=64 Reply from 192.168.1.200: bytes=32 time=307ms TTL=64 Reply from 192.168.1.200: bytes=32 time=389ms TTL=64 Ping statistics for 192.168.1.200:     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 119ms, Maximum = 389ms, Average = 256ms However, whenev

Hello,IS any solutions or workaround to allow guests to type in and send login and password immediately - not waiting for approval? It's quite problematic to explain to guests that they should wait until request will be approved, especially they can see form to put these credentials..Perfect scenario would be when guests can type in credentials, sent them immediately and wait for approval.Thanks for any help

Hi Guys,I’ve been using a FortiGate 60E in my homelab for about a year now, and it’s been working great. However, I’m considering upgrading to something more powerful with additional ports. I recently came across a good deal on a FortiGate 100E for around $100 USD.Before making the purchase, I’d like to hear from others: is it worth upgrading to the 100E, even though support is scheduled to end in 2026?I don’t have the budget to buy one of the newest models that’s I am looking at older models.

HiCan i use the same ip range for multiple tunnels in ipsec remote access vpn. thing is i make three tunnels for the same group of people but with different internet links. Can i assign a same ip ranges for all three tunnels for clients to get when they connect to tunnel or is it gonna lead to ip conflicts and i have to assign three different ip ranges for each tunnel?

there is problem when i config IPSEC in my forticlient mobile in android an ios and i use IKE1 but there is problem when connected (Could not establish session on the IPsec daemon) and the other problem in ios when i config IKE1 there is not open phase1 or 2,how i can solve it :)  step by step in fortigate and forticlient plz

We have switched from Sophos UTM to Fortigate and we used to have DNAT rules to redirect all internal traffic to any destination with specific service to secific internal IP.  scr.ip ANY > dst.ip ANY > dst.port tcp-udp/123 > dst.ip 10.20.30.40 > dst.port tcp-udp/123src.ip ANY > dst.ip ANY > dst.port udp/53 > dst.ip 10.20.30.50 > dst.port tcp-udp/123I only can find DNAT via Virtual IP - but there is no option to create rules like above.Can anyone help me out or open my eyes to find the way to go. Thx and greetingsChristian 

How to Create Subnet at FortiAnalyzer when want to generate reports.For example, User Top 500 Websites by Bandwidth->Settings->Subnet 2: All Subnet & Specific Subnet.  Select subnet.. -->Include Subnets -> Click Select I want to choose 10.168.230.0/24 But no button to add subnet. Please Help me   

What the heck am I doing wrong here? FortiWifi # config system netflowFortiWifi (netflow) # set collector-ip 192.168.3.197command parse error before 'collector-ip'Command fail. Return code -61FortiWifi (netflow) #

Hey,I am obligated to use Forticlient VPN for my workplace. Unfortunately, whenever I try to open the Forticlient GUI, I get a completely blank screen. The navigation menu on the top loads fine, I can press file which gives me an option to quit the application (and nothing else), and I can press Help which gives me two links to documentation that don't help me in this situation. The program itself doesn't load however.Does anyone have an idea how to solve this issue? I just tried to install the rpm-package from the VPN-only client. I guess it may be specifically designed for CentOS only? If so, is there any way to get it working on Fedora? My terminal output doesn't give me a lot:[sjoerd@lennart ~]$ forticlientFontconfig warning: "/usr/share/fontconfig/conf.avail/05-reset-dirs-sample.conf", line 6: unknown element "reset-dirs"Platform detected: fedora[ '/usr/lib/opt/forticlient/gui/FortiClient-linux-x64/FortiClient' ]did-finish-loadwindow-all-closedI'm running Fedora Silverblue wi

Background:Fortigate version: 7.4.7FortiClient version: 7.2.4/7.4.1/7.4.2Android version: Android9, Harmony4.2, Xiaomi Hyperos1.0.4.0     1. I selected split tunnel mode, but the logs show that internet traffic is still being matched through the tunnel    2. I noticed that the default route is being pushed to the VPN interface, just like on wlan0, this may be causing internet traffic to go through the tunnel.    3. I tested connecting to another FortiGate running version 7.4.8, and it pushed specific routes to the VPN interface.    4. It might be a bug related to the version7.4.7, but I couldn't find any explanation or fix for it in the 7.4.8 Release Notes.

Hi,  Is it possible to retrieve the ML-KEM keys from an external HSM using KMIP? I've been reading this article, Post-Quantum Cryptography for IPsec key exchange NEW | FortiGate / FortiOS 7.6.1 | Fortinet Document... We currently have the ability to retrieve the IPSEC SA key from an external HSM using KMIP, IPsec SA key retrieval from a KMS server using KMIP | FortiGate / FortiOS 7.4.0 | Fortinet Document .... However it would be great to be able to retrieve the ML-KEM keys as well. Is this supported? If so is there a configuration guide or some guidance you could offer?

Configure Fortinet ZTNA Application Gateway with SAML and MFA using FortiAuthenticator  In this hands-on tutorial, you'll learn how to configure Fortinet’s ZTNA Application Gateway with SAML-based authentication and Multi-Factor Authentication (MFA) using FortiAuthenticator. :rocket: What you'll learn: Step-by-step setup of ZTNA Application Gateway on FortiGate Integration of FortiAuthenticator as a SAML Identity Provider Enabling MFA for secure remote access Creating secure access policies for remote users Testing and troubleshooting authentication flowshttps://youtu.be/zngSdBCOPyY 

Hi there,We use the Fortinet-all_rules rule for our AWS WAF (via AWS Marketplace) and have used it for a long time.Today, we experienced an unfortunate outage due to the SQL-Injection-02 rule falsely identifying legitimate traffic to a critical endpoint in our system.This outage was not related to any activity on our part, and AWS eventually confirmed for us that other AWS customers also experienced problems due to this false positive.Is it the case that Fortinet pushed a problematic update to this ruleset today?  The outage began for us at 2:51pm ET. Does that line up with a deploy to that ruleset?Thanks,Terren

Hi,I have a remote site A (SonicWall NSA) connected to site B (FortiGate) with IPSec tunnel. Site A is sending load balancing probes (over the tunnel) to site B, but it's targeting the WAN interface IP of site A. Traffic arrives on my tunnel interface at site B. Note that site A's probes are implicit and cannot be edited to target one of my local IPs on the local site. On the receiving site the FortiGate drops the traffic due to strict RPF, message as in logs below contains "reverse path check fail, drop". I tried setting up a DNAT with Virtual IP and got pass the initial above error, but still could not get the firewall policy to trigger correctly. When I enable below CLI bash stops working for some reason, so I suspect something is not right. Any idea if this is the right approach and what I should look at? Thnks. Policies are:vipconfig firewall vipedit "vpn-ahg-hub-probe-vip"set uuid 3e958d92-4f6b-51f0-67e8-xxxset extip 217.91.x.xset mappedip "192.168.10.1"  --> local L

Hi,Is there a known issue when using an "Active directory Connector" to query a Windows Server 2025 LDAP ?We have several fortigates (7.4.8) which have 2 connectors: one to query a windows server 2022 and another one to query a windows server 2025.The connector works well with Windows Server 2022 but not with Windows Server 2025...Has anyone managed to get an Active Directory connector to work with a Windows server 2025?  

I have installed windows agent 5.2 but whenver i need access NAS it is accessable but when folder i need to access like \10.10.10.100\folder its fortiauth windows open up but local user isn't working there i tried alot options like . And "no domain" optionHow to do that , i also unchecked option "permit built in password providers"Before un checking it it usually gives option for choose other option but not now it is good for RDP.mFA but for access something ok network creates issue

Hello All, Recently i faced an issue with policy package sync whenever I created a user or any device settings and installed it. after the installation, policy package shows out-of-sync and if I want to re-install it. it shows me to delete the device settings which I created recently.Appreciate your help for this.