Support Forum

hi, i am new to this i want to monitoring forti manager in zabbix using API or HTTP agent i dont know how to do it properly. so can anyone tell me how to do it. Thanks a lot 

Dynamic IP addresses change regularly, making it difficult to identify the host associated with an IP address detected at any given time during incident investigations. Is there anyone who can give me a solution?, In my opinion, I think we can create a correlation rule that associates DHCP log events with assigned IP addresses to help maintain a correspondence between dynamic IP addresses and hosts, or use Lookup Tables to keep track of the history of assignments. Thanks,  

I am having an issue with the Fortigate Web Filter Override. The option Allow users to override blocked categories is enabled and the override link on the Access Blocked Page appears, but the page times out. Policy and Web Filter Profiles are set to Proxy mode.

Post delete 

Hello all - new to Fortigate Central Nat and just wanted to run something by the community here.Looking to exempt NAT for a specific source and destination - while maintaining NAT\PAT to internet bound destinations for the same source. My questions are, can a "No NAT" rule be created\utilized in Central NAT, and how are the rules parsed\ matched ? Assume top-down correct? Here's an example of what I'm after - 3 interfaces on the firewall. I just want to NOT nat the Forti voice ip when the destination is the CCUM server ip. Can I create a rule with those sources and destinations and just turn NAT off -then create a rule below for everything else internet bound?  Thanks in advance all inside – outside – any – any – NAT\PAT  - to internet hosted –outside – Fortivoice IP – CCUM IPs– no NAT hosted – outside – any – any – NAT\PAT - to internet 

Good morning everyone.I need to configure an SMTP external to my administration on my FortiAuthenticator (v.6.6.2) to forward FortiTokens.I would like to use the Fortinet service "notification.fortinet.com" as SMTP, but I can't configure it to work.Can someone help me?Thanks.

There doesn't seem to be any way to report bugs like this so I'll post it here: Installing the free FortiClient VPN under Windows 11 fails with the nonsensical error message "FortiClient VPN requires Windows 10 or higher".  This is due to a bug in the installer, it tries to call NetWkstaGetInfo() alongside the more obvious GetVersionEx() and if it fails it bails out with that error message.What's happening is that GetVersionEx() returns version 602 = Windows 8 while NetWkstaGetInfo() returns version 1000 = Windows 10/11.  Since the NetWkstaGetInfo() call has failed and so the version is never updated to 1000, the installer continues while thinking Windows 11 is Windows 8 and bails with the nonsensical error message.

Hello everyone, I would like to know whether it is possible to generate and create a certificate on FortiMail for internal use for administrators only (ex : internal.example.net). If so, could anyone provide guidance on the process? Thanks in advanceBest regards,

Hi Team, I have created a bookmark for web URL in webmode clientless vpn but sometimes login button does not work & sometimes it works. Attached are the screenshot from inspect(console) output from browser. Kindly suggest here. 

When I try to login in Fortigate 60D from wan interface IP (10.*.*.241) from another network. It logged in for few seconds(i.e. 3 second, 5 seconds) and automatically logout. when I saw in forticloud> Fortiview> Admin Session it shows a reason is Violation.as also i attached screen short.Please suggest a solution. I'm new in fortigate.But in same place when i tried to login from network behind the firewall. It's work fine.  

Hi, I'm new with Fortigate and we have deployed an AWS EC2 Fortigate NGFW v7.0.0 build0066 in one of AWS regions.We want to allow internet access to users thru their Active Directory accounts/groups.And, we're testing LDAP as a possible solution. The firewall is configured in split-VDOM (Root and FG-Traffic)Creation of the LDAP in the console was successful. Testing of user and credentials are okay.And, directory tree was displayed when browsed. But when we closed and save the LDAP creation window and access it again the LDAP failed with an error of lda_-3 or Invalid LDAP server. Same thing happens if we repeat the same to create a new LDAP server in the console. In our troubleshooting, we found out that the console or GUI uses the Management interface to communicate with the AD server. While in CLI, the interface used was the interface we set in "set source-IP xxx.xxx.xxx.xxx. Testing in CLI seems consistently successful. Seems the set source-IP is not being u

Hi Community,We have been using FortiClient VPN 7.4.0.1658 (No Licenses). Recently this version was tagged for vulnerabilities. We looked into testing the new version 7.4.2.1737. This version seems to only work for a month without license.  The old version had no issues working with full version being purchased.Will this version not work after a month? Is there no more free Forticlient VPN Version? 

Good morning,I have a problem after fortigate deployment in a bank. Money gram application can't work in branches connected to the HQ with VPN tunnel. But the application work in the HQ, two branches connected with BLR via switches. Find attached the network diagram and notice that nat is configured in the router LAN.[image][/image]

Hi, I want to block custom files (bin, ova, ovf) on FortiProxy. I couldn't find these files in the file filter field. How can I block them? Has anyone done this? I would appreciate your support. Best Regards,İsmail Ürek

Dear Experts, When IPsec VPN at IPsec aggregation with SD-WAN is down, Trap fgTrapVpnTunDown(1.3.6.1.4.1.12356.101.2.0.302) is not sent,although "VPN tunnel down" is enabled at SNMP events.For information linkDown(2) of MIB 1.3.6.1.6.3.1.1.5 is sent. Can someone tell me how & what I should change so that fgTrapVpnTunDown is sent? Thanks in advance. 

Hi community  I’m configuring Fortinet 60F with 2 switches (48 ports each). The idea is to create a failed over if switch A fails Switch B takes over.  Can someone please offer guidance on how to configure it?  This is for office network configuration.  thank you 

Greetings. What's the recommended configuration for blocking access to all websites except for those explicitly allowed under v7.0.14? Would the recommendation be the same for v7.4.7? Thank you -Steve

Migrating a customer over to a FortiGate from a watchguard and they currently have fortiswitches managed via FortiEdge cloud. I want to migrate the management of these switches to the FortiGate via Fortilink - what are key things to consider for this process? Is this still considered a controller migration and will default the switches configs? Are the backups taken from the FortiEdge portal a compatible format to import into the switches after they are managed via the Fortigate, or to paste in the CLI? Thanks

Running Fortigate v7.4.5 and I'm trying to use a datadog collector to forward my logs up to datadog but the datadog isn't able to recognize individual lines/json object as disticnt logs. I was looking at some of the raw output and I noticed that there are some characters between the 2 json objects. Does anyone know what these are? ","mpsk":"N/A","msg":"Client d2:b6:1c:6c:c2:45 authenticated.","new_line":"/n"}1557 <45>{"date":"2025-02-26","time":"09:41:55","devname":"PGH-What is the "1557<45>" it' not part of the json object and I'm wondering if it is causing this.

About a year ago, we encountered VPN access that appeared to be using information from the account list we managed.There are three types of targeted VPN users based on logs and token reception status via email.・Email authentication applicable account・Non-multifactor authentication account・Deleted account　　For accounts eligible for email authentication, token notification emails were received, but the logs for those users could not be confirmed.For deleted users, SSL-login-fail logs were recorded.For users with non-multifactor authentication, only tunnel-down logs due to timeout were recorded.When checking the normal logs, tunnel-up and tunnel-down are set as a set, but for non-multifactor authentication users, only tunnel-down due to timeout was recorded in the log.We inquired about this situation to the maintenance vendor, but they answered that due to the specifications, only tunnel-down is not recorded in the log.However, the actual declared contents are recorded in the logs, and I

Hi All, I have a ADVPN setup with certificate authentication. In firewall, we imported one local CA & root CA_1. IF any policy related changes pushed via Fortimanager to Fortigate, additionally VPN CA certificate also pushed to firewall along the policy change... so inthe firewall, we have 2 root CA's - root ca_1 & root CA_2. When the tunnel starts renegotiation, it takes the root CA_2 for cert authentication which caused "VPN certificate check failed " error and tunnel goes down. solution: i manually deleted the root ca_@ in the firewall and tunnel came up - it works.. Query: i need to know what is this behavior and how to stop pushing vpn ca certificate to be pushed to firewall in fortimanager. or any other solution for this..  

hello, I'm trying to set up SAML VPN authentication with Azure using a Realm.I'm having trouble figuring put which is metadata link in Fortigate.Doc claims that should be like:/remote/saml/metadata or /remote/saml/metadata?Realm=REALM Both link returns:403 Forbidden Graziano

Hi All, I'm wondering if Anyone has used FortiAuthenticator to perform BYOD ?I'm testing FAC 5.1.2 in a lab envirement to authenticate WiFi users using EAP-TLS, the FAC has a CA certificate configured (signed by a Win2016 root CA). And I'm stuck at getting devices self-enrolled to obtain a certificate that they can use for EAP-TLS.I've enabled Device Self-enrollment using the CA Certificate Template (SCEP request is configured using Wildcard).At the moment, I'm unable to enroll a client device on the url : https://FAC-IP/cert/scep . I'm getting the following error on the Browser : "operation" parameter is required I've also tried http (enabled http on the Interface) instead of https and keep getting the same error. Has anyone faced the same problem before ?Has anyone succefully got device self-enrollment working on FAC using SCEP ?Do FAC provide an onboarding portal similar to other products such as Aruba Clearpass ? Your help will be very much appreciated.&nbs

Is it possible to make the Fortigate route traffic in this way:External dns pointing to fortigate public ip > fortigate external interface > route the traffic based on dns to a internal IP ONLY if it matches the requested dns?example using other dns names:google.com > 8.8.8.8 (fortigate external ip) > 192.168.1.200 (internal system) Essentially asking if the fortigate can serve the same purpose as a reverse proxy which checks source packets trying to match dns and redirect to a local server. I hope i explained in a understandable way and thanks in advance.

Hi all, We are seeing some strange peaks in our WAN bandwidth. Every 20 minutes, we get a peak of around 1.5Gbps which lasts for about 1 minute. We can not figure out what is doing this. We did a packet capture when the peak is going, but when looking in wireguard -> statistics -> conversations, we can only see 5 things that are around 15Mbps. To IP addresses that are not being used in any VIP. How can we further troubleshoot this? Edit: We've also checked all firewall rules comming into the fortigate, but none of them are producing this many Gbps..