Support Forum

Hello, I tried to export the system configuration file from my FortiGate with FortiOS v7.2.7 build1577, today the first time in YAML. When exporting using the WebUI I chose: Scope: Global, Backup to: LocalPC, File format: YAML, Password mask: enabled, Encryption: disabled. When I then tried to load the yaml file with the PyYAML python library v6.0… without the expected success:  import yaml with open("[…].conf.yaml", encoding='utf-8') as fd: yconf = yaml.safe_load(fd) File "[…]\Python311\site-packages\yaml\parser.py", line 438, in parse_block_mapping_key raise ParserError("while parsing a block mapping", self.marks[-1], yaml.parser.ParserError: while parsing a block mapping in "[…].conf.yaml", line 2407, column 9 expected <block end>, but found '<scalar>' in "[…].conf.yaml", line 2408, column 50  When examining with a text-editor, I found the following at the guilty part of the YAML-file (starting at line 2405):  firewal

Is it possible to do link monitor for two fortigates in active/passive HA pair in transparent mode? If so how? What are the limitations?

Hello there, Trying to move away from SSL and one of the last issues we're having in the setup is we are not able to ping users on the IPsec VPN via their FQDN. IP works fine but this makes me think the IPsec setup isn't communicating with our DNS server correctly. Any ideas what could be causing this or anything I can check? Our DNS server works just fine with our SSL VPN and is able to resolve FQDN but for some reason our IPsec VPN isn't.  I have both our DNS server IP and domain listed on our IPsec settings. 

My client company has various types of smartphones and OS for testing in app development.The client company said that since yesterday, they can't access the company's internal network with the FortiClient app on their iPhone. It's not that all iPhones are not working, but there are problems with 3 devices. FortiClient app installation, various basic settings, and ID/PW input are all possible, but the UI for OTP authentication is not displayed. They can receive an email containing the OTP value to the email address set as FortiToken. However, the UI for entering the OTP value is not displayed. I accessed FortiGate and checked various debug logs, but there are no problems confirmed in the device, and a timeout occurs because the OTP value is not entered. I opened a ticket and contacted TAC, but there is no problem confirmed in the FortiGate logs, and FortiClient also said there are no known issues. The iPhones that are having problems are as follows. 1. iPhone 16

Hi,We are working on customizing the quarantine report for our users and would like to include additional information. Specifically, we’re trying to add the classification or reason why an email was quarantined.However, we’re unsure which variables are required to include this information in the report.Could you please advise?

FortiNAC self-registration Guest Management with wireless dynamic Vlan management .During the registration process without doing nothing . I got a native vlan ip.In NAC's Network>Inventory>Device>Virtualized Devices>root I haven't add native Vlan id . What is the fault ? 

 Good day,Please note that we have successfully replaced the FortiGate Firewall 60E with a FortiGate Firewall 100F using FortiConverter. While most services are functioning correctly, we are currently experiencing issues with VPN connectivity. We cant connect to VPN seems like the SSL-VPN configurations on E60 was never converted to  FortiGate Firewall 100F.  Thank you @ Anthony_E

HI, Can the Auto-Script backup be configured to use the LAN IP as the source IP? If so, could you provide guidance on how to accomplish this? FortiGate 

One of our customer planning to integrate Forcepoint DLP with our FortiGate firewall using ICAP profile and require information regarding SSL inspection, specifically whether deep SSL inspection is necessary for this integration. As deep inspection enables the firewall to decrypt, inspect, and re-encrypt encrypted traffic by acting as an intermediary, which requires distributing FortiGate’s CA certificate to all endpoints to avoid certificate warnings. Could you please confirm if deep SSL deep inspection is mandatory for Forcepoint DLP integration with FortiGate?   

Hi there, We enhance our SSL/TLS configuration with the config below but this does not affect the ACME interface.How can we (due to an audit) harden the ACME interface?config system globalset admin-https-ssl-banned-cipher RSA DHE SHA1 SHA256 SHA384 ARIAend The ACME interface still supports the following chipers:TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 2048)TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048)TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 2048)TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1)TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1)TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1)TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1)

Hi I have updated my FGT 200F to 7.6.3 version. from now on, full ssl inspection has many problems. it shows certificate error for some websites which was working well before and some times it bypasses all websites automatically. here is the error message for chatgpt :   please help net::ERR_CERT_DATE_INVALID Subject: chatgpt.com Issuer: FG200FT9044229 Expires on: Apr 30, 2025 Current date: Apr 30, 2025 PEM encoded chain: -----BEGIN CERTIFICATE----- MIIEIDCCAwigAwIBAgIUdrj1VYAKb+FPzB4q2HANTQTfVcIwDQYJKoZIhvcNAQEL BQAwgakxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRIwEAYDVQQH DAlTdW5ueXZhbGUxETAPBgNVBAoMCEZvcnRpbmV0MR4wHAYDVQQLDBVDZXJ0aWZp Y2F0ZSBBdXRob3JpdHkxGTAXBgNVBAMMEEZHMjAwRlQ5MjI5MjA1ODExIzAhBgkq hkiG9w0BCQEWFHN1cHBvcnRAZm9ydGluZXQuY29tMB4XDTI1MDQwMzAwMTYwNFoX DTI1MDQzMDA1NDY1MVowFjEUMBIGA1UEAxMLY2hhdGdwdC5jb20wWTATBgcqhkjO PQIBBggqhkjOPQMBBwNCAARSTlz4/3zd7PcHph2Iwh0IgKNBtZHPkGl1IovCE4Qq BDlfa9Kx3S++x0WXdGBCPmx8bh9xp4/SlgeWq8kMUl0So4IBmzCCAZcwDgYDVR0P AQH/BA

Dears, I try to connect to my Fortigate but i cannot. When i check the logs i can see : reverse path check fail, drop. I can join it from another WAN IP btw. In the Administrators, the IP is correctly added. What' s wrong? Thank you in advance, Vincent.

Does anyone know how I can use ansible to update Forticlient EMS Cloud?  I specifically want to update the ZTNA Application Catalogs and Endpoint profiles ZTNA Destinations.

Hello! Our fortianalyzer stopped displaying logs 2 days ago. I am using fortigate with version 7.0.13 build0566 and fortianalyzer with version 7.6.3.From the fortigate graphical interface I can successfully run a connection test with fortianalyzer. However, through the CLI command "execute log fortianalyzer test-connectivity" I see the output "Log: Tx & Rx (log not received)": execute log fortianalyzer test-connectivity FortiAnalyzer Host Name: FAZ-MINUANO FortiAnalyzer Adom Name: FortiGate Device ID: FGT40FTK21099EV4 Registration: registered Connection: allow Adom Disk Space (Used/Allocated): 0B/Unlimited Analytics Usage (Used/Allocated): 0B/Unlimited Analytics Usage (Data Policy Days Actual/Configured): 0/0 Days Archive Usage (Used/Allocated): 0B/Unlimited Archive Usage (Data Policy Days Actual/Configured): 0/0 Days Log: Tx & Rx (log not received) IPS Packet Log: Tx & Rx Content Archive: Tx & Rx Quarantine: Tx & Rx Certificate of Fortianalyzer valid and ser

Hi, Would like to know if I can backup a FortiGate device through FortiManager?

Hi, Struggling to find the answer in the documentation or google/forums search and wondered if anyone know the answer. I have a icon on an address object that I haven't seen before and wondered what does it mean?  

Hello everyone, we use a FortiMail VM02 with version 7.2.5. I would like to set up a "Content Profil" for attachments that only allows selected (explicitly defined) "File Types" and "File Extensions" to pass through.All other "File Types" and "File Extensions" should be removed from emails. (and insert some disclaimer, send notification, ...) I've set up "File Filters" for the allowed "File Types" and "File Extensions".In addition, I set up a "File Filter" "all_other_attachments" with “File Type” and “File Extension” “*.*”. But no matter how I combine these "File Filters" in a "Content Profile" ("Attachment Scan Rule" operator "Is" or "Is Not" and regardless of the order) all attachments are always removed from emails.The log always says "File name: testpicture.PNG, detected by Content Filter, attachment scan rule: all_other_attachments". Can anyone give me a tip on how I can implement this allowlist?How do you manage email attachment restrictions? Best re

Hi all,We have created file filter in FortiGate firewall but I want to prevent dounload .exe file

I have a Forti AP setup with native mgmt VLAN and 3 allowed SSID VLANs in a fortiswitch I have setup bridge to SSID with my Guest WIFI network When I plug an ethernet cable into my Forti AP I receive the IP of the mgmt VLAN not the Guest SSID Why?How can I fix this please? Thanks

Hello,I'm in the process of configuring FortiNAC as a RADIUS server to authenticate WiFi users using certificates deployed through Microsoft Intune. My setup includes FortiGate and FortiAP devices. I aim to establish three distinct SSIDs:SSID 1: For company-managed laptop.SSID 2: For company-managed tablet.SSID 3 (Guest): For visitors requiring temporary network access.Requirements:SSIDs 1 & 2: Devices receive certificates from the same internal Certificate Authority (CA) via Intune. I need to ensure that:Laptops can only authenticate to SSID 1.Tablets can only authenticate to SSID 2.Devices cannot cross-authenticate between SSIDs.SSID 3 (Guest):Unregistered users connecting to this open SSID should be redirected to FortiNAC's captive portal.Users should be able to self-register through the portal.Upon successful registration, users should automatically gain access to the guest network.Questions:Is it feasible to configure FortiNAC to enforce SSID-specific access based on certifica

HelloI have my AD controler on the SAMBA 4. I have question: My FSSO can get Logon sessions data from my AD controler? Maybe FSSO work only with Windows AD controler and it's a waste of my strength in the fight against FG acticity with Samba AD?BR

hi there, I need to add override url so won't be blocked.what I understand, there are two way:1. create custom web category2. add url on web filter profile am I correct?there are hundreds url address that I need to add. what is the best practice to add locally, without add manually one by one?thanks

All our FortiGates (running 7.2.8) are managed by a virtual FMG (running 7.2.5), and backups have run consistently since they were setup. We recently implemented FAZ, and as soon as we setup a root for the security fabric, every backup has been failing except for the one that is the root. The backup for the root FortiGate is now creating 5 files every night (file sizes are different) and we get 5 alerts; also, all files are in the same folder. Files are encrypted, so I don't know if they are all from the same firewall, but I may disable encryption for a night to see what I can find inside the files. Incidentally, we have 13 FortiGates and should have 13 backup files. Can someone point me in a direction to look at to figure why the backups are no longer running? Thank you.

Hello,we have different sites connected between us via three vpn ipsec with different isp using sd-wan and static routing.We want to move from static routing to bgp and started some test on one vpn using the normal neighbor configuration and all is working, the peering is ok and i see the routing table.Using three vpn ipsec ffor each site connected ivolve a lot of neighbor to configure.I want to use neighbor-group and neighbor-range, but the documentation about this is lack of details.Can I use the neighbor-group on each side?And also the neighbor-range implementation is not clear, what infomation I must insert when I declare a network range?I implemented a test configuration, but the peering process is not started.Below the schema  For test purpose I using only vpn over isp3.In network range I declared the ip configurated in system interface for interface peer.On phase1-interface I disabled net-device.I set also the policies to allow ping and tcp 179 between loopback interfaces.B

In 1801f (version 7.4.7 )Email is configure, how we test it