Support Forum

Dear All, This question is little bit strange but I want to know for My KB. If you see the digram there are three interfaces Port1, Port2 and port3 which are in deffirent subnets. I am able to ping from PC1&2 to my gateway 192.168.1.1 which is absolutely is same subnet but not able to ping 1.1.1.2 and 2.2.2.2 from PC1 and PC2. Why ??I have configured same thing on Cisco router with three subnet with same subnet, I was able to ping because these are the subnet which directly connected If see the routing table using #show ip route. I though same thing should be in Fortigate Firewall but it did not work for me. Can anyone tell me why I am not able to ping from PC1&PC2 (192.168.1.0/24)  to 1.1.1.2&2.2.2.2.These subnets are also directly connected to Fortigate Firewall.   Thank you for your reply in advance.  

Currently I have a problem: i installed ipsec vpn successfully. Stand from the vpnclient user position and access to vpn but it shows a web page and asks to enter the user/password again. I want to remove the requirement to enter 1 more user/password, how do I do that. Currently I am using version 5.2

Hello Team,  m facing an issue with my FortiFone-380. When I access the web interface, I only see the Fortinet logo — there's no login prompt or dashboard displayed. 

Hello dear Fortinet Community Since I have an FAP-221C laying arround, is it possible to use it without an Actual FortiGate? I have a FortiGate 40C to configure, but the Firmware is pretty old, since the payed Account has expired and I want to switch over to a OPNsense Appliance. So is it possible, to use (and configure) the FAP-221C independently? To run WiFi Controller sepperately? Firmware FortiGate:FGT40C-4.00-FW-build535-120511 Firmware FortiAP:FP221C-v5.2-build0245 Thanks, any information appreciated.

i setup this hub site with diaup ipsec option with igbp my issue spoke1 to spoke 2 not ping

I set up HA between 2 FortiGate VMs on vSphere. When I do a packet sniff on the heartbeat interface of FW1b I am getting ICMP unreachables for port 730 from FW1a. Both are configured identical. Any idea where to troubleshoot next? FW1a:bb-fortigate-1a # sho system interface port5 config system interface edit "port5" set ip 192.168.255.1 255.255.255.0 set allowaccess ping https ssh snmp http telnet set type physical set snmp-index 5 next end bb-fortigate-1a # sho system ha config system ha set group-id 1 set group-name "site1cluster" set mode a-p set hbdev "port5" 0 set session-pickup enable set ha-mgmt-status enable config ha-mgmt-interfaces edit 1 set interface "port1" set gateway 172.20.137.65 next end set override disable set priority 200 set unicast-hb enable set unicast-hb-peerip 192.168.255.2 end FW1b:bb-fortigate-1b # show system interface p

Hi, I'm new hereI have the SIEM analyst role and I have read-only access to the fortianalyzer.I have to monitor all the events that it detects as incidents.This fortianalyzer manages more than 10 firewalls and I only want to get the events that are most relevant or what fortianalyzer considers as an incident or what most draws attention and contributes to security issues to avoid incidents.According to what I have investigated this is the configuration that I should request to the firewall administrator but I would appreciate if you could share with me your recommendations config system log-forward edit 1 set mode forwarding set fwd-max-delay realtime set server-name "SIEM_Server" set server-addr "192.169.1.1" set fwd-server-type cef set server-port 6515 set fwd-reliable enable set log-filter-status enable config log-filter edit 1 set field "event" set value "sec

Hello Team, I connected an already configured fortigate cluster to a Fortimanager. Now I wanted to try to create a policy from the Fortimanager and push it to the firewall. Can you point me to the correct procedure?To do this I saw that you have to create a policy package but I have the grey button and I can't click it.I am logging into the FortiManager as an admin user (so I am ruling out permissions problems).I point out that on the same adom (root) as Fortimanager there is already another pair of fortigates which already have a policy package assigned. Please feel free to ask for more details.I thank you in advance for the supportBR 

New to Fortinac so very low knowledge of it right now. But we recently upgraded our appliance and went to virtual server from physical. Some names got changed of the actual server and while everything looks good for the most part I see where no client i look up shows it has the persistent agent. I went into the logs and it looks like it is trying to reach out to the old Fortinac server and not the new. It has the most recent agent but not looking for new server, I've changed the DNS records of bradford_tcp and bradford_udp to the new server and still no luck. Is there any other places I need to make changes to point my clients to the new server???

i need to know after ssl vpn not support in future so if we need vpn web mode how we configure this?

Hi youI'm trying to block adult websites using Fortinet's Web Filter. I've already blocked the "Adult/Mature Content" category in the Web Filter profile. Additionally, I've added URL Filter and Content Filter rules using a wildcard for the keyword "vlxx" (e.g., *vlxx*), which is a known adult site.However, the website is still accessible. I checked the logs and saw that the traffic is going through Cloudflare, and it is not being blocked by any of the configured filters.Could someone please help me understand why this is happening and how to effectively block this site?Thanks in advance for your support. 

I have 3 fortigate (firmware is 7.2.11), one is using public IP as IPSec HQ, two are hehind NAT as IPSec dialup client. I am not use default udp 500 port.Both three units are created ipsec tunnel by wizard and share the internet to client, and then change ikev1 to ikev2. All tunnels are up, three unit can access each others. But the two clients can not access internet via HQ WAN.Any body help？ Thank you very much.

Hi, My Webmail server is hosted remotely and is NATed through a public IP. While the login page is accessible, I am unable to log in. The network is configured with a dual-WAN setup using SD-WAN interfaces. I have observed that when one of the ISPs is disabled, I can successfully access the mail account. An SD-WAN rule has been created, but webmail access is only possible when a specific ISP is used or the other is disabled. Could you suggest a resolution that allows webmail access without relying on an SD-WAN rule or policy route? #Fortigate

Hi all,  I hope you can help me.  I'm having an issue with our FortiManager and a conflict which is preventing us from getting the firewall to a synchronised state. Below is the ssl-ssh-profile and the configuration which it is trying to push, the problem is that this command doesn't exist on the FG CLI.  Does anyone now how I can remove this CLI configuration? I have tried un-selecting but it automatically add tls-1.1 back into the settings, it's very annoying and although it doesn't stop us from pushing our dynamic policy and other configuration it will never been show synchronized due to this conflict.  Many thanks, Dan. 

Hello all, with json options, a Google Chrome-based web browser can be easily configured globally on a Linux system. This allows you to enforce settings in all areas for all users of a Linux desktop/terminal server. This has the advantage that you don't have to worry about the user settings of each individual and that company-wide policies can be easily applied. In addition, you can have each extension installed automatically. Since Google and now unfortunately also Firefox are becoming more and more intrusivewhen it comes to advertising and skimming personal data, I thought I would disable some unnecessary (→ unwanted) features and increase privacy. It also annoyed me that sometimes new features were tried out and switches in Chrome/Chromium were activated without asking. Click here for the project: https://github.com/boospy/Privacy-Browser-Project

Hi everyone,I have a FortiNAC VPN management model with FortiGate (IPsec VPN).I referred to the documents below but still do not understand some things:https://docs.fortinet.com/document/fortinac-f/7.6.0/fortigate-vpn-integration/693309/what-it-doeshttps://docs.fortinet.com/document/fortinac-f/7.6.0/fortigate-vpn-integration/693309/configuring-fortigatePlease see the attached links for IP information, model, etc.My questions:Can FortiNAC's Isolation Interface (10.1.3.71/24) be used for both SSL VPN and IPsec VPN?Where does the Isolation IP range 10.5.254.11 - 10.5.254.99 come from? Where is the gateway of that range?When is the IP range 10.5.254.11 - 10.5.254.99 used?

In all the examples I have seen on how to create a tcp-forwarding proxy policy for ZTNA I always see the following config parts:config firewall access-proxyconfig firewall proxy-policy Some times they do include:config firewall policy In my testing I have noticed that a firewall policy config is not required.  I am sure there is a good reason for having a firewall policy regardless.  Can some one tell me what benefits you can get from including the firewall policy?

Morning everyone, I'm experiencing a delay with outgoing emails and would like to know if there are any additional troubleshooting steps I might have missed. Thanks in advancedKind regards,

HiI'm trying to setup IKEv2 tunnels for my remote access users. on IKEv1 i could assign tunnels to a user groups but when i change it to IKEv2, I can't find anywhere to assign the tunnel to a group. I'm using LDAP for user Authentication. how am i supposed to handle this?Regards

Hello Guys,I have two questions about the Ike V2 IPSEC DIalup Connection. I want to configure in my enviroment (two fortigate 100F HA) like 150 dialup external connection. I have setup an IPSEC Tunnel (IkeV2) and set policy correctly. I created the users locally (without any Proxy or RADIUS) and inserted in a group. The VPN works fine but i have two questions:- Is binding set in the IPSEC configuration the authusrgrp? because i haven't set and i won't set because if i set, every time thast the people connect appear when the people search a local ip for example, the Fortigate Auth page, and for us isn't necessary. So if i unset that is an error? -  Ikev2 works fine with the local user (i enabled the EAP)? because i haven't any other type of authentication Thank you so much

I'm using SD WAN and I have 1 wan port which has a public ip (which I use for my mail server) and the other wan port has a private ip (behind cgnat).My inbound mail is port forwarded from the public ip to the mail server. However, I noticed an issue when the mail server sends email out, it tries to send it over the second port (behind cgnat) and this causes the email to fail to send. Is there any way to set up a sd wan rule to force all outbound smtp mail exiting the mail server to go over wan1 (public ip)?Any help would be appreciated.

Hello, We have a interesting Setup. We have the normal starlink setup + we have a managed router which our provider is using to provide us with a static IP address. They have a ipsec tunnel to our Fortigate and then we have a ipsec site to site vpn back to them. The tunnel itself comes up fine but then nothing can resolve cant go to yahoo.com cnn.com but it has internet access you can ping 8.8.8.8 and access most internal sites.  Has anyone seen this issue before and have any recommendations? 

i'm trying to migrate from SSL vpn to IPsec remote access tunnel. Im using IKEv1 but the linux forticlient doesn't support IPsec. so I tried alternatives like Strongswan and Libreswan and i was able to connect to the tunnel. the users should have two step verification (i'm using email code) on but the problem is when the two step verification gets on i'm not able to connect to the tunnel anymore and it won't prompt for code. Is there anything i can do or any alternatives i could use to be able to connect when 2FA is on.

Hi,Is it possible to use both SamAccountName and DnsHostname authenticated against same LDAP server. I cannot get it worked. If I changed the username attribute to dnshostname as below it authenticates with dnshostname but not with samaccountname, how can I get both working so I can authenticate using both computer name and username ?  Thanks Thilina 

I upgraded from 7.0.15 to 7.4.7 due to a request from Fortinet support to fix an IPSec issue I had.After the upgrade, all was working fine. Then, a couple of days ago, the letsencrypt certificates I use with Virtual Servers were renewed. Successfully.However, since the renewal, the certificates are not applied anymore to the incoming connections. Instead the self-signed certs of the application are shown to the client. After some research, I believe that this is because proxy based fw rules are not supported anymore on a 40F with 2GB RAM. Question: Can I still use the letsencrypt certificates with VIP connections? If yes, what do I need to change on the settings for those connections (FW rule, VIP serttings, etc.)? ThanksDan