Support Forum

we have a problem with certificates and fortiweb, we get a certificate chain error shown as Incomplete on SSL scan with https://www.ssllabs.com/ssltest/, but browsers show certificates as valid, and the complete chain is ok, we uploaded the certificate to fortiweb, and to the IIS server, we get this error with sslshopper too.  

How can I use [FortiClient VPN-Only] in an offline environment? I would like to perform IPsec remote access testing in a closed testing environment, but FortiClient VPN-Only is not functioning correctly offline. When I click "Connect," nothing happens, and it returns to the screen before entering the password.No packets are reaching the FortiGate side, and when I perform a packet capture on the client, no packets are being generated.In the testing environment, I am using an L3 switch as a pseudo-internet environment, and there is a Ping response between the client and the FortiGate. The client’s default gateway is the IP address of the FortiGate’s listening port. Even when I connect the client directly to the FortiGate’s listening port without using the pseudo-internet environment, the issue persists. Is it not possible to use FortiClient VPN-Only in a completely offline environment? Environment in use:FortiGate 60F Version 7.4.5 build 2702Windows 11 FortiClient VPN-Only

Hi Fortinet Family, I am currently facing an issue with configuring ISP failover for FortiManager connectivity. The current scenario is as follows: I am onboarding a FortiGate firewall through FortiManager, and FMG access is currently enabled on one of the ISPs. However, I would like to ensure high availability and redundancy for management access. My goal is to configure ISP failover so that if the primary ISP goes down, FortiManager can automatically switch to the secondary (active) ISP to continue managing the FortiGate device without interruption. I would appreciate any guidance or best practices on how to achieve this setup, including any specific configurations required on both the FortiGate and FortiManager sides to ensure seamless failover and reconnection.Looking forward to your support. FortiManager FortiGate 

The IPsec VPN wizard clearly states that FortiClient is supported on Windows, macOS, and Android, but not on Linux. So, how can we connect to a FortiClient VPN from a Linux machine?

Good Morning, There were post about the symbolic link vulnerability on Fortigate recently, the document mentioned  the updated AV / IPS can remove the bad symbolic link.  I want to know if there is AV/ IPS event tell us, the bad symbolic link detected and has been removed ? How to check if bad symbolic link exists in the file system ?  Regards,Jacky 

Good afternoon,We have a problem with Forticlient VPN. The client is configured with ZTNA and EMS. Every time we suspend the notebook and turn it on again, the Forticlient window opens. We have tried reinstalling and installing older versions, but without success. Has anyone experienced something similar and would know what could be the reason?Thank you in advance.

Hello, Email-based two-factor authentication has been successfully enabled for users, including SSL VPN users, who are now receiving OTPs via email without any issues. The OTP emails are currently being sent from the email address "DoNotReply@fortinet-notifications.com." Is it possible to modify the sender's email address to align with our domain (e.g., example@test.com)?

Good day Team, Fortimail v7.4.1 I have a few entries (full email addresses) under IP Policy -> Inbound Session -> Lists -> Sender Blocklist checkingand indeed, it works, no more mails from those senders.  However, I am getting quite a few from same domain, how can someone in Fortimail block only the @domain.com portion of email addresses. Please show me the definite steps to complete this procedure. So far my Fortimail is working well, just a few domains I want to keep under control. Regards,

I am following this doc.https://docs.fortinet.com/document/fortinac-f/7.2.0/kvm-deployment-guide/31945 ./deploy_kvm <domain_name> 1- what is meant by "domain name" in this case?2 - Didn't know what that was so I just used "nac". After running the script, I got the following errors and cannot proceed../deploy_kvm: line 164: virsh: command not found./deploy_kvm: line 165: sudo: command not found Any ideas ?

Hello AllI am looking to have Fortiweb secure all of our on-premise external web applications that require Kerberos authentication.Also, I need to enable MFA for this authentication.According to the Fortiweb documentation, MFA can be enabled with Fortiauthenticator, which only works with Radius authentication, not Kerberos.Has anyone tried something similar? Can a scenario like the one below work?Fortiweb manages Kerberos authentication and keeps the token until it requests MFA via FortiAuthenticator.If the MFA is okay, Fortiweb should send the Kerberos token to the Web application.

I've got a device that has a Microsoft account which seemingly enabled Bitlocker, so Bitlocker is enabled and it is encrypted, however in the appliance it tells me it is unencrypted.  Is this by design or a bug?

Hi, we´ve got some difficulties with our new internet provider. The background: We´re using a Fortigate 60F with Firmware 7.4.7 and our new provider gives us a /28-Subnet, but via PPPoE. I found the following, how to configure it with a Fortigate: (https://qiita.com/haruharuharuby/items/7f737153f8f291e089ca). If I understand correctly, the key is to set pppoe-unnumbered-negotiate disable on the PPPoE-interface and use a second one to configure the whole subnet to. Then bring them to the same subnet by useing the set allow-subnet-overlap enable config switch. Now the lane is connected to the WAN2-interface. My initial idea was:to create an PPPoE-Interface on the WAN2 and let it does the PPPoE-Dialup. configure the public-IPs on the WAN2 (and the corresponding VIPs ect...). After this setup, I want to set the pppoe-unnumbered-negotiate disable on the PPPoE-Interface (from step 1), but I cannot. The Fortigate console does not offer the command :((To be sure,

HelloThe following doc shows that FortiLink is supported is this topology:FortiGate <---> FortiSwitch <---> 3rd party L2 switch <---> FortiSwitchhttps://docs.fortinet.com/document/fortiswitch/7.0.8/devices-managed-by-fortios/801183 My question is more simple: is FortiLink supported in the following case?FortiGate <---> 3rd party L2 switch <---> FortiSwitch

Hello,my company has a web service that sends keepalive messages every 20seconds, the web server is out of our network, it is on Azure Cloud.If i send keepalive from my network the messages I sent don't arrive on the serverIf i send keepalive out of my network (with a notebook connected to my phone), I can see the keepalive messages on the server.To sniff the traffic on the sever I used wireshark.On the firewall I can't see the keppalives going through. Thank you! 

I need to delete ima Interface, but I can't figure out how to do it? I want to remove it and put it in SEM_USO 

I would like to know if it’s possible to limit the maximum number of IPsec VPN tunnels per VDOM on a FortiGate 1500D.We’ve tried different approaches using both the GUI and CLI, but we haven’t found any option that enforces such a limit.Thank you in advance for your support.

Hi All, I did some digging and even opened a case with support and I came up empty handed on this topic. We are wondering if the syslog CEF output can be customized? The primary goal is to trim down the size of the logs to just the data we need before ingestion to our SIEM. On PANs we could do this fairly easily, curious if an on box way exists to do with Fortigates. We are running 7.2 code on 200Fs. Thanks

 Hello Fortinet Community,I'm currently working with FortiAnalyzer (version 7.4.x) and have set up an automation playbook that triggers upon specific events, such as multiple failed login attempts. The playbook includes a webhook action intended to send event details, including the ADOM (Administrative Domain) information, to an external system.In my webhook action, I'm attempting to include the ADOM using the ${adom} macro in my automation Playbook.However, the adom field in the payload is coming through as blank. I understand that in notification profiles, the ADOM information is readily available, but it seems that in the context of playbook actions, this macro isn't being populated.I've reviewed the FortiAnalyzer documentation, particularly the section on webhook connectors and supported macros , but it doesn't provide clarity on this specific issue.Has anyone encountered this problem or found a workaround to include the ADOM information in playbook webhook actions? Any g

I need to monitor a logs of 1Device Fortinet 40F But Forti Analyzer cost is so high then what is the secondary option

When I do the Fortigate ssl-vpn test, client failed to get gateway, but traffic flow is normalIs it okay if it's like this?IPv4 Add : 192.168.1.1Subnet : 255.255.255.255Default gateway : 

First of all, I'm not a developer, but I have some knowledge of React and Nest.js. I'm developing a React/Nest.js web application to centralize my client's data. Everything works fine except for one issue: when I try to call the Fortigate API to retrieve license data and uptime from my different clients. When my app makes a request to the Fortigate API, it sends an OPTIONS request first, but Fortigate does not seem to allow, recognize, or handle this request properly. One important thing to note: when I click on the request URL directly in my browser, a new tab opens, displaying the JSON data. So, I assume that clicking the link directly triggers a GET request, which works fine. On the Fortigate i allowed "CORS Allow Origin" with * (I know i will change it after)I would like to know if there is a way to bypass the OPTIONS request and send only a GET request. I dont have the Web Protection menu on my Fortigate V7.4.3, so i can't configure CORS ProtectionConfiguring a

I have 2 Fortigate 201F set up with a tunnel and I'm seeing some strange traffic (mostly missing) from site A to site B.  Site A has 2 active WAN interfaces with the 2nd interface static DF route at a higher priority. My tunnel is assigned to the interface with the lower routing priority.  I'm not able to ping devices on Site B, yet I'm able to access the internal web interface of the Fortigate of Site B.Site B only has one WAN interface and I'm able to ping from devices within Site B to devices on Site A, but I'm not able to connect to NTP, DNS or LDAP from the Fortigate B to Site A.Both tunnels were created as custom pointing to the IP address of the outside interface of the opposite.  I have phase 2 selectors set for each of the VLANs from Site A and all show active.  Both sites are set with incoming/outgoing policies using the named tunnel and allowing ALL traffic and stated VLANs.Both sites have static routes set to use the tunnel interface for traffic.&nb

Is there any way to change the notifications that are displayed when upgrading the Forticlient via the FortiEMS? I would like to add the hint that the new version of the Forticlient will be installed after the reboot - unfortunately I see it again and again that the laptop is not logged in again after the reboot and the users are then left without Forticlient. best regards,martin

Hello everyone,  I am using FortiWeb Site Publish functionnality with a SAML authentification (Google).I need to get some of those SAML attributes to my backend server. Following the documentation https://docs.fortinet.com/document/fortiweb/7.6.3/administration-guide/272565/offloaded-authentication-and-optional-sso-configuration  Here is what I did in my site publish rule : So, my problem is that my attribute is nowhere to be found in any of my headers.   Maybe the $USERNAME var is empty ? Would fortiweb still create the header and give it a blank value ? Thanks in advance to anyone willing to give me a hand :) 

Hello team kindly helpi am configuring site-to-site IPSEC on fortimanager to push on fortigate but the i am confused where to confgure the IPsec?i have tried to my best on all platform1. on VPN Manager2. on IPsec Template3. on the device phase1 and phase 2 but after creating the vpn on all the 3 i can not see the VPN as the interface so that i can use on policy?PLASE HELP