Support Forum

hi,i recently encountered a network issue and found out the subnet mask was wrong (/32) and it should be a /28 instead.i suspect i've overlooked the subnet mask 255.255.255.255 it auto created.is there a way to disable the CIDR subnet mask auto fill in FMG? i fear i might make the same mistake again in the future. 

Although my SSO credentials work fine to connect to Forticlient (7.2.5.1053) from my Win11 24H2 laptop, when I try using the same credentials on a Windows 365 24H2 (with Forticlient 7.2.5.1053) machine, it gets to about 48% and then gives me a Permission Denied error.I'm not being prompted for MFA on the Windows 365 PC so am I missing something there?Can anyone shed any light on why this may be?Many Thanks,Steve

Hello All,while pinging 8.8.8.8 from lan source in sdwan its not pinging, but no issue in traffic of internet and intranet what could be the reason logsfrom Lan source its not pingingexecute ping-options source 110.18.8.254  # execute ping 8.8.8.8PING 8.8.8.8 (8.8.8.8): 56 data bytes --- 8.8.8.8 ping statistics ---5 packets transmitted, 0 packets received, 100% packet loss without souce its pinginging execute ping 8.8.8.8PING 8.8.8.8 (8.8.8.8): 56 data bytes64 bytes from 8.8.8.8: icmp_seq=0 ttl=118 time=26.5 ms64 bytes from 8.8.8.8: icmp_seq=1 ttl=118 time=27.0 ms64 bytes from 8.8.8.8: icmp_seq=2 ttl=118 time=26.2 ms64 bytes from 8.8.8.8: icmp_seq=3 ttl=118 time=29.3 ms64 bytes from 8.8.8.8: icmp_seq=4 ttl=118 time=38.9 ms --- 8.8.8.8 ping statistics ---5 packets transmitted, 5 packets received, 0% packet lossround-trip min/avg/max = 26.2/29.5/38.9 ms

Have a user every week, that submits a ticket for being unable to connect to VPN. I connect with them and the configured connection appears to still be there, but if you "Edit This Connection" there is nothing there, only the name. It removes the Remote Gateway, Description and custom port. If I try to add it back, it fails to do so. I have to complete delete that connection and readd. It seems like every week when they work from home this happens.  What I have done:Looked through logs, updated software, uninstalled/installed, restarted, tried not saving username/pw, disabling the auto connect and always up.  It's still happening. Any tips on how to get this resolved so I don't do the same ticket every week, would be greatly appreciated. Thank you!

I have a very interesting problem that I have not been able to figure out yet. I've searched the internet and haven't found anything with this exact problem. I have a FortiWiFi 40F-3G4G that I upgraded all the way to 7.6.1 build3457 before I did any configuration on the device. I finally got the Sandbox working with FortiCloud, but I noticed that when I try to configure the antivirus policy, there are no entries listed in the GUI for Inspected Protocols. Since they aren't listed, it will not let me proceed to turn on or off any settings or even give it a name. Has anyone else seen this before?

I have been working through the process of connecting our Azure AD domain to our Forticlient EMS Cloud and Fortigate to allow for using windows creds to authenticate to VPN as well as enable autoconnect when off fabric.I followed the steps in the fortinet documentation and am able to attempt to sign into the VPN at my windows login screen but the connection times out. Using a Debug to see if there is traffic reaching the fortigate I see that my authentication request is hitting the fortigate but not being forwarded on to Entra. I have a ticket submitted with forticare but wanted to see if anyone else experienced the same thing

Hi! All KBs and documentation (except very early v5.0 Handbook) documents "vlanforward" field as being functional ONLY in VDOM configured in Transparent Opmode. However, this field is allowed to be set (using CLI/GUI/FortiManager) on a vlan-type subinterface whose VDOM is configured in NAT/Routed mode. Normally, if a field is not appropriate in a particular context, FortiOS syntax disallows it to be set. So, is ability to set "vlanforward" field in subinterface with "vdom" field set to VDOM configured in NAT/Routed mode - a bug? Thanks!

greetings friend,I created an IPsec tunnel named OL_INET_AZ, and it was added to an SD-WAN zone. but there is NO SD-WAN rule using this IPsec tunnel as the outgoing interface. there are 3 static routes:S 10.74.0.0/15 [10/0] via 1.2.3.4, port17, [1/0]                        [10/0] via OL_INET_SKO tunnel a.b.c.d, [20/0]S 10.75.0.0/23 [10/0] via OL_INET_AZ tunnel v.w.x.y, [1/0]Now my LAN network want to talk to 10.75.1.68 via OL_INET_AZ.  From the routing table 10.75.0.0/23 via OL_INET_AZ is the best route as it is most specific. When I ping 10.75.1.68 from the fortigate itself, the traffic is going through OL_INET_AZ, but if I ping from a LAN host behind the Fortigate (and behind the core switch) , it will hit the SD-WAN rule with destination 10.74.0.0/15, and going through port17.From SD-WAN routing logic, it said SD-WAN rules are matched only if the best route to the destination points to SD-WAN, will this

I have a Surface Pro Windows 11 running Snapdragon X 12-core @3.40 GHz, 32GB Ram, 64-bit OS.  It has Qualcomm FastConnect T800 Mobile Network Adapter.  I cannot get the FortiClient VPN software to install.  It gets all the way through and then rollbacks every time.  I'm running as an administrator and I have admin rights on the computer.  Any idea what the issue is?  I've never had this problem before. It says FortiClient VPN Setup Wizard ended prematurely. Thank you!Stacy

hi,i'm trying to build a new FW policy and wondered if i just build a single custom service object with all the required ports added, i.e. TCP 80, TCP 443, TCP 8080 or create a service group and add the individual service objects.1. would there be a difference if i used a single service object vs a service group in the FW policy?2. what's the recommended or considered "best practice" in FGT FW policy?3. what are the pros and cons between the two approach? 

Hi,I am facing the problem of occurring at similar time intervals (about every 15minutes) saturation of the ssl vpn link to the remote Fortigate device.The saturated outbound direction traffic reaching 70mbit/sec: When I go to Fortiview Destinations with destination network of the remote Fortigate I see that the traffic to this destination is partial about KB/s:  How can I diagnose this, because when these spikes occur it severely drops the performance of this link, ping responses increase from 10ms to about 300ms and users on the remote side of Fortigate can not work normally?FortiOS is 7.2.11  Greetings

Hi Everyone, I have an issue that we can't find any solution to it. We have FortiGate 100F, FortiOS v7.0.3 build0237 (GA).I have 3-4 users that experiencing issues of duplicate routes in the routing table: 192.168.80.0/23  - Internal Network172.16.80.0/24 - SSL VPN IP pool192.168.136.197/32 - local gateway address. this effect on the access to internal resources, all the internal destined traffic is go through the  192.168.136.197 and not through 172.16.80.99.after deleting manually the route it is working fine,This is not happening to all users just for 3-4 right now (maybe the number will increase).  Fortinet support claims that we don't have a license to Forticlient so they can't check at the user's end. They were connected to our Fortigate and saw that everything is set up as needed.  Any suggestions? Thank you :) 

I've followed some of the most posted protocols for preventing brute force on my vpn interface, biggest was to only allow US based traffic to the interface, but what I've found in the last coupld of years, is that all the open VPN environments in the US are used by threat actors constantly.  I'm up to about 3000 failed login attempts in 6 hours time.  This is just US based IP's and when I look them up, the bulk of them are associated to open VPN providers IN the US. I was doing some searching to see if there are geo lists of these open vpn providers that I could import.  I've been manually digging up the blocks and doing ASN/Whois lookups to piece it together.  I get it down to about 200 / 6 hours, but then in a couple of weeks, shoots back up to the 1K's of hits.  Anyone have suggestions?  Again, this is US only attacks at this point.

Hello all.   Any and all help is greatly appreciated.  We have two FAC400Es, both running 6.6.2.  We recently changed the IP address of one of them and lost HTTPS access.  The FAC is reachable from anywhere on the network, does not appear to be a routing issue.  About 10 mins or so after the new IP was configured I cleared the cache on my browser and actually had HTTPS access.  I tried to access the FAC roughly 24 hours later and it hasn't worked since. Other T-Shooting Steps/Points -tried multiple browsers including Chrome, Firefox and Edge-we do not have any security devices between the two points, HTTPS access worked prior to the IP address change on the FAC-power cycled the FAC multiple Times-confirmed we do not have access to the FAC from multiple source IP spaces ===========================================================================Config is below: > show configconfig router staticedit 3set device port1set dst 0.0.0.0

I am working a project which will see the customer inherit an existing FortiGate deployment. These firewalls reside in branch locations and are centrally managed using FortiManager in the data centres. They are also logging to FortiAnalyzer in the same location.  My question is if the FortiGates are removed from FortiManager, will this impact the baseline configuration? My hope is that when removed from FortiManager, these devices can be locally managed with the configuration in tact. 

Hello, Would appreciate any insightful details on why the installs might be failing SELinux is enabled, these  followingpackages are also installed:policycoreutils-pythonlibselinux-utilssetools-console I don't have the logs yet but any insights as to why the agents are failing install. Also what is the absolute highest version to safely install on RHEL 9.4? ARe Fortinet haveing issue with this latest version? Agent Versions Attempted(Supervisor version 7.1.3):Version 7.1.3: FSM Linux Agent not updated with the latest certificate.Version 7.1.7: installed require Packages to enable SELinux still issue not resolved research done by vendor engineerand suggested attempt v7.2.4Version 7.2.4: Vendor engineering team updated parts of the script related to SELinux  hence attempted this version  Can anyone please verify if they have a functioning Lunx agent on RHEL 9.4 SELinux? We are stuck.Are we missing packages? what about these ? libcapauditrsyslo

I have topology like below pic, where i have 2 location and both location connected using advpn.Also both location have vpn site to site to azureFrom site-1 perspective the BGP status is connected to azure and site-2but from route table why traffic from site-1 to azure is learned by site-2 (10.201.0.0/16) as best path?since site-1 have direct connection to the azure why second path is not become best path?

Hello members.I recently upgraded firewalls from 7.2.10 to 7.6. I have 2 firewalls connected in fabric, the root fortigate at the headquarter connects directly to dns server and it is reacheable but it cannot reach the fortinet dns 96.45.45.45 or google public DNS 8.8.8.8. The down stream fortigate accesses the internal DNS through a tunnel.Clients can reach the internal DNS however when you ping directly from the fortigate the ping fails. I have noticed on the DNS settings with default settings the fortinet dns 96.45.45.45 shows reacheable while the internal DNS shows unreacheable but if I change the source IP address of local out traffic, the internal DNS shows reacheable while the fortinet DNS 96.45.45.45 and google public DNS 8.8.8.8 shows are unreacheable

Hi there,Our domain is still listed as Phishing here:https://www.virustotal.com/gui/url/904b0c0e0ed1239034a4e61588cf860f0841f967172392636be4c6d661d86916 The domain is: https://amazonswag.com/ This is affecting some of our customers raising support tickets using this url: https://www.amazonswag.com/support/Please can I ask that the malicious flag is removed from our site ASAP so our users are not affected?Cheers,Billy

One of the iPad has automatically updated the FortiClientVPN app to v7.4.2 from v7.2.5.While on v7.2.5 no issues encountered. However, once updated, no prompt for username and password. We have already reformat and uninstall multiple time, still the same output. v7.4.3 just released, already tried. No luck. The iPad Air 2 iOS version is 15.8.3 Appreciate any feedback on this. Cheers!

Hello All,kindly i need to know the supported Forti analyzer version that compatible with Forti Sandbox Version 5.0.1 as I cannot integrate Forti Sandbox with version 5.0.1 with Forti Analyzer version 7.2.8BR

Works with IPv4 & IPv6 local-in policies.Can auto-run when imported as Userscript.Purely reads and shows the config, not touching it.If you use it, please write a comment or click the Kudo button. Show custom local-in policies in FortiGate's WebUI with just a click! Login to your FortiGate's WebUI and open to the local-in policyEnable in System > Feature Visibility if requiredCreate a new bookmark in your web browser and copy the JavaScript code below into the URL field.Click the bookmark and enjoy viewing your custom local-in policies!Result:Copy & paste into a bookmark:javascript:(async function(){const ip4=await fetch('/api/v2/cmdb/firewall/local-in-policy');const a4=await ip4.json();const ip6=await fetch('/api/v2/cmdb/firewall/local-in-policy6');const a6=await ip6.json();const m=document.querySelector('.mutable-menu');const p=document.createElement('div');p.setAttribute("id","clip");s=t="<table style='width:100%;padding:0;border-spacing:0;border-collaps

when i am uploading the firmware image then its not working because that file is corrupted and asking to upload only virtual machine images in .ova file Please provide me virtual machine image of Forti Authenticator for Google Cloud Platform

Hello I had a problem with Web filter Service where all users could not browse because the fortinet block page was displayed. With the message 'Web filter Service error N/A' I checked the security profile that have the browsing policies and this has enabled the option “Allow websites when a rating error occurs” which in several forums indicate that it is a workaround for scenarios like this at the level of traffic captures the action was Passthrough. Can anyone help me understand what could have happened or what revisions I can make to understand. Thank you very much

Does the Enhanced Support Premium license for the FortiGate-100F include the provision of a replacement device if a malfunction requires repair at an external service center or replacement with a new unit while waiting for the repair or the new device?