Support Forum

Hi everyone, I am unsuccessfully trying to implement Web Filter Category quota on my 40F. 2 problems: despite time limit set under a monitored category, (1) client device has access to websites falling within that category beyond such time limit. And (2) in the Fortiguard Quota Monitor dashboard, FortiGate displays “No matching entries found” for this client IP. Current setup:License activated;Explicit Proxy features activated;Fortiguard filtering services on port: 8888; no report received after launching connectivity test;Network > Interface: Explicit Proxy (HTTP 8080, no PAC file) on that Vlan (10 clients, 5 laptops, 5 mobiles);Policy & Objects > Firewall Policy in proxy-based for this Vlan to ISP;Policy & Objects > Proxy Policy proxy-based with Web Filtering profile on that Vlan address range;Security Profiles > Web Filter profile on proxy-mode; andClient proxy manually set up with Vlan IP Interface and Explicit Proxy port.What I can see:Clien

Hi there, I am in charge of introducing FortiPAM in our Windows domain environment to manage log and secure the access to our servers.Testing things out I have created some users, groups, targets and secrets (mostly on the same target). Clearing out some of my tests I ran into a problem: Secret Z with ID=1 gave the answer "Failed to delete some of the secrets or folders" (I can click the delete button). I tried to delete everything that could be related to it. The situation now is following:  In my personal Folder and in the secrets folder I can see the entry for the secret Z. I have owner permissions on it. In Targets there is only the asociated Target also called Z. The delete button for this is grey and can not be clicked (obviousliy because there is an dependent objekt). I thought I could solve my problem with deleting the secret entry in the "secret database" via cli-command but the answer is this:"SRV-FPA # config secret databaseSRV-FPA (database) # get==

Hi. I'm having this strange issue with a customer.I'm new to FortiGate so would appreciate any ideas on how to troubleshoot this.  The customer when connected to the main office remotely (SSL VPN) or from another branch office (S2S VPN) cannot login to their Syspro application.Basically the application just hangs.  When at the office there is no issue as Syspro server resides on the same LAN as the users, so this traffic is not been inspected by the FortiGate. For troubleshooting the SSL VPN rule allows everything and there are no security profiles enabled nor SSL Inspection.There is no latency or Interface errors.  What I do see all the time is that the Syspro server (10.0.0.4) sends a rst before there is an ack from the client to complete the 3-way TCP Handshake as shown below.Then there is some communication, connection is terminated and we see a new connection.  The server is listening on the port (30110) and there is no local firew

Hello, Does anyone have access to a copy of the Meru MC1500 controller firmware?A certain NPO still uses this controller to manage the WIFI network. I assume that the Compact Flash memory has been damaged and the controller does not start. Repairing the controller and getting the system up  is very important.I will be very grateful for any help.ThanksKrystian

New FortiGate admin here. I'm looking to enable web-admin on the WAN ports, but only allow access from specific IP addresses. I've created the address objects, but am not seeing how to configure a firewall policy. There would (obviously) be no outgoing interface.I can see a couple of suggestions coming, so to avoid those...I'd rather not have to use a VPN just for remote admin access.Also, configuring "trusted hosts" for specific users still exposes the admin ports to the entire internet, which is an all-around bad idea.So, a firewall policy should be the way to go...Any help would be appreciated!

Hi, I've got a site that's being blocked by the student policy(yearbookavenue.jostens.com 192.189.112.187). It's a big single page webapp type site that makes a lot of xml http requests. Students can visitthe site just fine, but when students go to save their progress on thesite it makes a POST request to yearbookavenue.jostens.com/savestuff orwhatever and this will work fine on my machine when I'm hitting theStaff policy, but produces an error when on a student account on a chromebook. Looking in the firewall logs I can see that the ip address192.189.112.197 is allowed when the "Application Name" is HTTPS.BROWSER but blocked when it's SSL. I'veallowed the site in web filter but it seems like it's still beingblocked at the application level somehow, like the SPA is producing adifferent application signature. To make things trickier sometimes traffic to that site produces HTTPS.BROWSER when student access it, allowing them to save, but other times it produces SSL traffic and i

 Hello,I have two FortiGate 60F  7.4.7 devices configured for redundancy in case of failure. The setup includes two physical WAN interfaces: ISP-1 (wan1) and ISP-2 (wan2). There is also a virtual LACP-1 interface that combines internal1 and internal2. Several VLANs are configured on LACP-1.I need to configure an IPSec VPN with Split Tunneling, where all internet traffic should go through the client's local internet, while traffic destined for the VLANs should be routed through the tunnel.The VPN tunnel establishes successfully, and the client can connect. However, the client cannot access any network resources inside the VLANs or ping anything.VPN Tunnel Configuration:VPN Tunnel Configuration: config vpn ipsec phase1-interface edit "Delta_VPN_IPSec" set type dynamic set interface "wan1" set mode aggressive set peertype any set net-device disable set mode-cfg enable set proposal aes128-sha256 aes256-sha256 aes128-sha

We just started using Fortimanager recently.  I've noticed the few virtual servers we have set up do not show the correct settings on Fortimanager. For example, on the actual fortigate, the port is 443 but on Fortimangaer it shows port 80. Is there a way to get these to sync up?

Hey everyone Thanks in advance for any help you can provide. I recently upgraded my company's FortiAnalyzer (FAZ) to 7.6.2, and a custom VPN connection/disconnection report used by my manager has broken. While the report is custom, it was originally based on a Fortinet employee’s article. After logging a support case, I was informed that because this is a custom report, I need to resolve the issue myself. What I’ve Found So FarI found a Reddit post where another user experienced similar issues after the FAZ backend switched from PostgreSQL to ClickHouse.I followed the Fortinet ClickHouse migration documentation and updated my SQL query accordingly.The data appears correctly when previewing the dataset, and it also shows up in chart previews.However, when I generate the report, it comes out blank with the message::police_car_light:"No matching log data for this report"My Current SQL Query SELECT`user` AS "User",(CASEWHEN `action` = 'tunnel-up' THEN 'Co

We are currently running 7.2.x with 160GB disk and have had this disk size for some time without any issues. Is 500GB really required for 7.4.6 or is this just a blanket suggestion? We are utilizing AWS so if it is not required or will cause any issues we aren't going to add any space due to increased cost.

Hello and sorry for my english,I have basic inspection configuration, like this : but i have a lot of SSL anomaly in security events, more than 22,000 and sites are blocked; for example : to website mask.apple-dns.netEvent Type : ssl-anomalyEvent Subtype : certificate-probe-failed what can i do ? thanks a lot

Hello, Does the Free FortiClient supports IPSec or only SSL VPN? Is the Free FortiClient going away? Thank you. 

I have a computer that was sent an invite from the EMS system that was able to go through the set-up process and appears in my system. Today, when the user tried to connect to a VPN they see "Unlicensed VPN access is available until *insert a date here*" (they can still connect to whatever VPN they were attempting). When I access EMS, the device is showing Not Managed by EMS and Not Registered. Please advise on how to handle this. Extra Info:- I have several open spots in my licensing.- According to the Log Viewer, the device was unregistered this morning. 

The VPN connection will be broken if the computer connected by FortiClient with the following settings does not send or receive packets passing through the VPN for 259200 seconds (3 days).---config vpn ssl setting set idle-timeout 0 set auth-timeout 0 <omit>end--- Monitoring in “Dashboard>Users & Devices>Firewall Users>” shows that when there is no communication, the remaining time gradually decreases, and when communication starts, the remaining time resets to 3 days. It seems like a disconnection due to idle-timeout, but the VPN event disconnect reaseon is an auth-timeout. Is it possible to keep the VPN connection for more than 259200 seconds (3 days) even if no packets are sent or received? 

Hi,I am trying to connect to sftp via:execute backup config sftp /mnt/Data1/nas/Fortigate_Backup/%%date%%-backup.conf 10.10.10.10 domain\user <password> encryption-<encryption> On a FGT80 with v.7.2.11The error is:  Connect to sftp server 10.10.10.10 ...Send config file to sftp server via vdom root failed.Command fail. Return code -1. I can successfully login to sftp from other clients. Any thoughts? thanks in advance John

Hi, I´m a little bit confused about the fact, that with FortiOS 7.6, there is now support for UDP, which is then bypassed by an URL on nginx.org. Is the state of the art of a secure application / appliance? Sophos and Cisco already seems to have full support for UDP ZTNA. What are the plans from Fortinet?Solving this issue with kind of BETA implementation on a third party outside proxy, is not a practiable solution.BestRonny

 Greetings everyone, I am opening this case because I have set up a virtual lab with a FortiManager that manages three FortiGates, ALL with TRIAL licenses. The entire lab is virtual, using the following versions:FMG_VM64_KVM-v7.6.1.M-build3344-FORTINET.out.kvmFGT_VM64_KVM-v7.6.2.F-build3462-FORTINET.out.kvmThe FortiGates are registered using the following command in FortiManager: config sys global     set fgfm-peercert-withoutsn enableend  The IssueAfter registering the devices, the problem arises when pushing configurations or policies to the FortiGate, as it always results in an error. As shown in the images below: Install OK / Verify FAILWhen expanding the error message from the FortiManager UI:  Checking the Install Log reveals that the issue occurs because FortiManager attempts to modify (delete) the WebFilter profile "monitor-all", as shown in the following image:  CLI Test on FortiGateThe issue is that FortiGa

Hello i feel so confuse about FortiADC Full NAT vs Direct routing vs DNAT when i do Virtual server configurations i worked alot  with F5 but i realy like FortiADC but i wish if i have simple explainationcould you please tell meif i want to activate SNAT in F5 = Full NAT with source NAT pool right?but my important question i want to disable SNAT in FortiADC = Do i need to use DNAT or direct routing  Regards Adam

Hi all,Users connecting via VPN must be validated via SSO (the IdP is Azure). The problem arises if the user chooses to authenticate via LDAP; the queries reach the server, allowing an attacker to cause a DoS.Force this option in fclient is not an option cause anyone from outside our organization could do it.Has anyone encountered this problem?Thnks in advance!  

Hi,  We are a school using FortiGate on v7.4.7.  We have recently updated our Office package from 2016 to O365, which needs the users to have a licence to be able to access the Office apps. With exam season coming up, we need to set up a web filter to allow users to authenticate against O365, but not access anything else on the web. Has anyone successfully done this? Our web groups are based on a security group from on-prem AD.  We do block Edge, Chrome and IE via GPO, but the exam board are quite strict about restrictions schools have.  Thanks, Cameron

Hi, I can only access Remote Access from the master account, none of my IAM users can access despite having SysAdmin permission profile.It shows as blank.Tried clearing the browser cache and try accessing Remote Access again.Attempted access from a different browser or an incognito/private window.Issue persists across multiple IAM users. Your help/advise is highly appreciated. TIA :)

Hello everyone! I'm having some problems to redistribute bgp routes learned from another part of the network. The routes learned Hub to hub works fine on the hubs, however in the spokes, the routes learned from the other part are pointing to WAN interfaces, not the overlays.  I've created the topology inside GNS3 to test pre-production:I'm using the same AS with iBGP and next-hop-self-rr on the hub to hub overlay neighbor configuration.   Hub routing table: Spoke routing table: Any ideas?

I am having an issue with FortiGate Cloud Tunnel Status inactive. I tried upgrading to FortiGate Cloud Premium but it stuck on this page for over 10 minutes and asked me to try again later. I have checked my product and it is not in the decommissioned group

hi Gents, just a quick question- can you configure a priority for routes learned from BGP like you do for static routes?bgp config - i have changed the admin distance to match that on static routesgbp route map - I have set the metric same as the one on static routeswhat i want to achieve is have  a static default route and a default route learnt from BGP peers in the routing-table, I have seen the route in the database

Hello team!! We have 2 Fortigates 100F in HA, working fine In these Fortigates, we have 2 IPsec site to site VPNs working fine We need to create VPNs for FortiClient, to some users to have connectivity to office from diferent external sites. I will try to explain what happen from the beginning * I had created a VPN for some external users when Fortigates were in 7.4.4 * This VPN worked fine * Fortigate was updated from 7.4.4 to 7.6.2 * Then we did not need anymore this VPN, and insted we needed to create a VPN for all internal users * Instead of rename VPN, I decided to delete the VPN and create a new VPN * The first time I had created the VPN in 7.6.2, I think I didnt get any error, but VPN did not work * I tried to troubleshoot but did not make it work * I deleted the new VPN again * I tried to create this again, then in the last step, I got "Failed to save changes"  But we have received this error:date=2025-03-31 time=11:09:13 devid="FG100FTK22025224" devname="fw-ha01b" ev