Support Forum

friends a question: I have problems accessing a page, specifically a video that is within the page. Since it is displayed as not available.Reviewing the logs, I do not observe any blockages from the firewall.I performed the following validations: *I generated a new policy, in which no security profile was enabled. Additionally, the no inspection profile was enabled.*For the new policy, all ports were enabled. Furthermore, it is located above everyone. However, when you directly access the internet router, you do have access to the page. Do you know what could be happening?

i have fortigate 40F and i'm trying to access the firewall on web browser but it's not opened ! i connect the firewall through fortigate port 1 to computer by ethernet, the ping was okay but its not opened the log in page ! please help me to log in the firewall. Thank you GG FortiGate #support #all 

HiI have a pair of Fortigate 200F running 7.2.3, when i try to configure log disk setting, the option doesnt seem to be availablePlease refer to the screenshots below

Hello Fortinet Community,I’ve configured two identical IPsec remote access VPNs on my FortiGate—each mapped to a different WAN interface for redundancy purposes. On FortiClient, I’ve added both VPN gateways. The issue I'm facing is that when I disable WAN1, FortiClient does not automatically failover to the second gateway. Instead, I have to manually reconnect by clicking "Connect" to establish a session with the secondary gateway. I'd like to know is it possible  to automate this failover process, so users experience minimal disruption? Is it possible to achieve automatic remote access VPN failover in FortiClient without using EMS?Thank you! 

hi, I am using EMS 7.2.11, with client 7.0.14.software inventory is working fine, but PUA page, under dashboard, is empty.there is only one row with this warning: Software Inventory must be collected for PUAs to be detected, but this is not true.under "software inventory"-> applications I can see all software installed.

hiI have a server configured as a vip in my fortigate to be accesses from internet. I want to block it's admin page. (my.domain.com/admin) . I tried the policy with deep packet and ssl inspection along with creating a webfilter and blocked *\admin* but still admin page reachable from internet. how can i block admin page?

Hi eveyone,I need help or technical help. I have this topology:I have central router Cisco ASR 920, on this router ending L3 routing and interfaces. Router send trafic via BGP to isfw fortigate or segmentation firewall and segmentation send via bgp to perimeter. Comunication to public is okay but internal trafic no, ending on router. Default routes is directed to isfw. I try it PBR from routers but the router has limitations.i dont know how to directed all traffic to isfw. Thank you for supportMathues

Hello, everyone. I have a question. The client ZTNA has 1,500 terminals, and each terminal may have two USB mobile devices. The client's requirement is to release them in a whitelist manner. However, with so many mobile terminals, the workload is a bit large. For the mice of the same brand purchased in the same batch, information such as USB Type, Vendor ID, Product ID, and Firmware Revision is still different.I have several questions:Question 1: Is there any way to avoid manual entry one by one? The workload is too large. Question 2: Can the whitelist be released based on a certain brand? For example, HP and Dell mice, Panasonic USB drives.Question 3: For the control of such a large - number of mobile external USB devices, are there any other good suggestions?References:https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-properly-identify-USB-devices-to-configure/ta-p/339955                          

Hello, We recently started migrating our SSL-VPN to IPSec. Something we just noticed is that the IPSec setup is not fully compatible for iOS version of FortiClientVPN application. FC VPN at its latest version for iOS devices supports IKEv1 only on Main Mode (we went with aggressive mode on our initial config).For remote users authentication we’re using a FortiAuth server that communicates with the firewall using RADIUS and to the AD Servers using LDAP. FortiAuth checks if the user exists on AD and then sends an authentication token to the user for 2FA. We started noticing that the last part with the authentication is problematic for FC v7.4.6 on iOS devices and after investigation with Fortinet they informed us that FC VPN on iOS rejects the authentication packets and drops the tunnel afterwards. For testing purposes, we disabled the 2FA option within the ForitAuth for the spesific user we login and the tunnel was able to connect succesfully without authentication j

Hi, We have two firewalls located in different locations: Firewall A and Firewall B. Both setups include an L3 device positioned between the LAN and the firewall. In Firewall A, the relevant subnet appears as directly connected, whereas in Firewall B, the subnet is marked as statically connected. This indicates that in the Firewall B setup, the switch acts as the gateway, causing the firewall to receive the MAC address of the L3 device instead of the end-user device. However, in the Firewall A network, even with the L3 setup, the firewall acts as the gateway for the subnet, enabling it to detect actual client MAC addresses and enforce MAC-based policies. Consequently, MAC-based policies do not function in the Firewall B setup because the L3 device serves as the gateway. In contrast, these policies work in the Firewall A setup, where the firewall directly receives the MAC addresses of the client devices.  FortiGate 

I generated a CSR on one of my Fortigate firewalls that contained over 10 SAN's entries, the certificate was signed by my internal company CA, I then imported the PEM into the Fortigate firewall successfully to use for HTTPS access, then by mistake I deleted the Certificate off the firewall instead of downloading the cert! My signed PEM file doesn't have a private key, I have a PCKS#7 cert, der and cer from my PKI team. But I do not have the private key anymore is my guess after deleting my imported signed Cert on the Fortigate. On another SAN Firewall where I need to install I import any of these signed cert formats, error is "duplicate mismatch" I gather because the signed cert doesn't have the private key and I should be downloading the imported cert from the Fortigate that imported the signed cert where the CSR was generated to the other Firewalls! Any there any way I can install these signed certs on my SANs Firewalls or do I need to generate another CSR again?&nbsp

Hey everyone! Last month the built-in wifi certificate expired on my 100E. I'm running the latest possible FortiOS release but without a license. (FortiSwitches and FortiAPs are in place as well)I'm using the certificate for the builtin WPA3-Enterprise authentication against user groups. Some devices didn't care that it ran out, others had a warning and few right out refused to connect to wifi https://mobdro.bio/ .Is there a way to get a renewed certificate without a license?Currently I switched it to a public Let's Encrypt cert, hoping to not get the "untrusted" warning on devices but they still appear and I thing some android devices have issues with the (automatic) renewal of certs, which I'm super duper NOT a fan of, since those devices are business critical.Any ideas? I'm all ears!

Hi all, I was recently hired at a school district and the infrastructure is and the infrastructure is all 10 years old. The course. The core switch is an old 2nd hand 2nd hand H p's switch that had been in service that had been in service for 5 years and we got that 8 years and we got that 8 years ago. All of it all of the access switches are the 1st generation unified switches with no redundancy anywhere there. Here are my concerns and/or wants. I'm looking for a solution that has everything I need under one pane of glass. That leaves me with unifi, meraki and Fortinet.. I love unified problems I love unified products and have used them for a while now but I know they're fine but I know their firewall is not up to par. We have a split system Mac Mac air books and Google Chromebooks Around 800 devices total Does Fortinet Have the ability to monitor switches if they go down the monitor switches if they go down? I plan on having a device in my office ATV with a dashboard up so I can

I like to generate a weekly report that includes any active FortiGate-Policy filtered by some keywords in their name.I'm able to query them from $log-traffic, but obviously this gets only the policies with traffic.Is there a table that includes the configured policies regardless of them having traffic or not?

Hello, I run an Installation from an FMG but it failed. However this created a task in the Task Manager which I cannot delete and consequently I cannot do the installation again. It seems that the pending task is blocking any new installation attempts, however I cannot delete the task that failed. Has anybody experienced a similar issue. Is there a way to force delete this task, because it prohibits any further installation to the FG? Thanks

We have been using link-monitor to monitor ping to GW, but after setting up link-monitor, HA switchover due to link monitor failure occurred frequently during periods of high traffic spikes.When we checked the ping statistics of link-monitor, we found a temporary maximum latency of 475 ms, which is a very bad value. No switching occurred at that time.The reason for the frequent occurrences is that the line became unstable due to user traffic.Is it safe to assume that the ICMP packets in the link monitor are likely to have been affected by the unstable state of the line due to user traffic?If so, can this be resolved by changing the timer value of the link monitor?The current settings are interval 5000, failtime 3, and other default values.

I know this is officially unsupported, but still I am curious if someone somehow has a clever solution :) The problem description: On our central datacenter firewall (Fortigate) we have multiple tunnels towards customers who have overlapping destination subnets so policy-based tunneling is a must. A new customer has two tunnels which need to be in a failover setup. Therefore I have two identical policies, both pointing to a different IPSEC tunnel. All traffic for this customer now matches always on the first policy, resulting in the backup-tunnel-policy below it to be never hit. I already thought of an automation-stitch with a script to disable a policy on an event (monitoring the primary WAN IP of the customer) but I think that is too much hassle or might have unexpected results. In the past, when using Cisco ASA, policy-based tunnels could be easely configured as a backup (just add a second peer IP address on the crypto-map). Fortigate lacks this mechanism. O

Dear Concern,  I need to access a website that is currently being blocked by my FortiGate-201 running FortiOS v7.6.2.F. I have attached a screenshot for your reference.  The website is authentic, and I would like to specifically allow or exempt it so that it can be accessed from our office network. According to the attached capture currently, it is being categorized as a "Malicious Website," which is why the FortiGate firewall is blocking it. I have already added the website to the Security Profiles > Web Filter > URL Filter and set it to Allow by using type simple or wildcard, as shown in the attached capture. However, the website is still being blocked. Kindly guide me on how to properly exempt or allow this website so that it can be accessed from our network.  Your urgent and appreciable technical support is required to allowing this specific website in my FortiGate firewall.

Hi Fortinet Community,I'm setting up a network with three FortiGates and need help configuring IPsec VPNs and inter-site communication. Here's the setup::small_blue_diamond: Topology Overview:HQ FortiGate: NAT mode, connected to ISP via L3 linkBranch1 FortiGate: Transparent modeFactory FortiGate: Transparent modeAll sites are connected over Layer 2 linksDHCP for both branches comes from HQ:small_blue_diamond: Network Details:Site Device Role Subnet Assigned HQNAT mode FortiGate10.10.10.0/24 (LAN)Branch1Transparent FortiGate192.168.100.0/24 (via DHCP)FactoryTransparent FortiGate192.168.101.0/24 (via DHCP)HQ Server1: 192.168.100.1 (needs to be accessed by Branch1 PCs)HQ Server2: 192.168.101.1 (needs to be accessed by Factory PCs)All branch PCs should also have access to HQ LAN (10.10.10.0/24):question_mark: What I Need Help With:How to configure IPsec VPN tunnels:Between HQ and Branch1Between HQ and FactoryNote: Branch1 and Factory are using transparent mode FortiGatesHow to allow the fo

hi,i'm planning to build a new FGT VDOM with a single WAN then with multiple "inside" VLAN interfaces, i.e. corporate and guest VLAN.the customer will use all the RFC 1918 address space, so i'll prepare static route and SNAT for the 10.xx, 172.xx and 192.xx subnet.my question is, is the VDOM setup "feasible"? i have same RFC 1918 static routes to both "inside" for corp and guest sub-interface/VLAN which have different exit interface and gateway and RFC 1918 for SNAT/PAT to the single WAN public interface/IP?  config router static!! Corp VLANedit 1 set status enable set gateway 172.16.45.20 set dst 10.0.0.0 255.0.0.0 set device "po1.10"nextedit 2 set status enable set gateway 172.16.45.20 set dst 172.16.0.0 255.240.0.0 set device "po1.10"nextedit 3 set status enable set gateway 172.16.45.20 set dst 192.168.0.0 255.255.0.0 set device "po1.10"next!! Guest VLANedit 4 set status enable set gateway 172.16.17.25&n

Hi , I'm Currently facing an issue with My Fortinac-VM i already Download the new version 9.4.7 but when i press install it's sending me to the page to start the download when i press it nothing happen any suggestion  

Hello,I have to go through the "Automatic Patch Upgrades" wizard each time I connect to my FortiGate. I am using version 7.4.6 of FortiOS.Does anyone know the solution to this problem?

Hello,I would like to inquire about the automatic update management for FortiManager that is integrated with FortiGate and the Security Fabric.Could you please provide information on how automatic updates are handled in this setup?As far as I know, when a FortiGate is connected to a FortiManager, the FortiGate shows that automatic updates are enabled, and because it is managed by the FortiManager, the option to disable automatic updates is not available on the FortiGate.So, does this mean that automatic updates are not actually performed on FortiGates that are managed by FortiManager?I would like to perform updates manually when I want, and I do not want automatic updates to be applied.Is there anything that needs to be configured separately on the FortiManager side? Thaks all.

I have duplicated dashboard like below pic for some my fortigate, anyone know why?

 I often have customers who lose their wireless connection.if I look in the Fortianalyzer I have this log .Someone has an idea why?How to stabilize customer connections? --------------------------------------------------------------------------------------------------------------------------------------------Actionclient-disconnected-by-wtp EncryptionN/A Levelnotice ReasonUnspecified reason Securit Actionclient-disconnected-by-wtp EncryptionN/A Levelnotice Reason Reserved  0 Securit ---------------------------------------------------------------------------------------------------------------------------------------------- Thank you for your help !