Support Forum

I have a Web Filter security profile already in place. Along with AV, DNS, APP, SSL filters as well. I am trying to add a site to URL filter for it to be blocked. I got this to work at one point by selecting Wildcard, Block, Enable. I had it written as *.website.com and it seemed to work hit or miss (seems like if you cleared your cache and retried it would give you the blocked splash page when trying to access the site). I am trying to block a website now and it will not block no mater what I do. Same for the old site that originally DID get blocked. I have the security profiles all set up as they should be and they haven't been touched. Why is this not working? 60F version 7.2.9  

 Hello. I would like to configure wan1 as the SD-WAN members on the case of new device.But, it is not appeared wan1 on interface for creating new SD-WAN member.It is appeared wan2 and dmz interfaces.How can I create SD-WAN members with wan1? Regards. 

hi, I have two subnets :wifi 10.8.8.0/24internal 172.22.2.0/24 ( NAS,Printer) I have created policies to route from wifi->internal and internal ->wifi, I am able to ping the NAS  and Printer from the wifi network but am unable to access the actual devices. in the policies in the source and destination i used the actual subnets and not the usual "all" for the policies, is this correct? I had also tried with all but didn't seem to work either so the issue must be something else... I am able to access the fortigate admin on the internal from the wifi subnet but that seems to be about all i am able to do.. any idea how to get the visibility of the devices? ciao,Antonio   

Will it possible If 2 Sites network connect with VXLAN and I configure FortiGate HA Cluster through VXLAN. I tried it with Cisco/ARUBA VXLAN (VLAN in VXLAN only for this case) but it seems not completed process.FortiGate

Curious for a bit of input on how to make this work, as this is our first FortiGate deployment. Due to limitations in ability to use redundant static routes on Meraki, we are looking to set the FortiGates up in an Active-Passive cluster so we can create a VIP and have a single IP to create a static route to on the Meraki MX firewalls (our assumption is that the FortiGates have to be in a cluster to create a VIP). See setup A (attached) The problem is that my understanding is that once clustered, the FortiGate configs have to be identical, and that's an issue because the secondary ExpressRoute link from Azure is on a different /30 space and needs a different IP. Also looked into configuring WAN 1 and WAN 2 in SD-WAN group with both FortiGates connected to both ExpressRoute circuits, but similarly this is not feasible because both ExpressRoute links are tagged with same VLAN (1003) so we cannot set the VLAN interface for the same VLAN to be both .1 and .5 for the WAN 1 and WAN

Hello,It is my first post here and I'm not experienced to much with Fortinet.What I would like to do is move the server from Site 1 to Site 2 and keep the ip address for the users from Site 1. Sites are connected via ipsec vpn and I try to avoid changing database connection details on all clients.I mean... If I ping 10.0.0.101 from Site 1 then I get reply from 192.168.1.101.Is it possible to achieve it with virtual server function inside these to networks?   

Hey, Guys,I don’t know if you can help me with this problem, but I have tried many types of configurations network and of interfaces, therefore, the problem still happening.  On Windows I’m abel to Connect and use services of this VPN, but on Ubuntu, after some atualizations of system, when I try to connect the FortiClient shows the “VPN Connect” but the bytes received are iqual 0 and I can’t access the services and VMs. I already try restart network confugurations and reinstall FortiClient, but still not working. Thanks for your attention

Hello all,is there any Documentation or Best-Practice on how to set-up a Wifi SSID with AD-Authentication via Windows NPS Server from scratch? At the moment our company uses MAC Filter based via WPA2-Personal, but i want to change it into Authentication through AD via Radius Server. Best would be WPA3 Enterprise i guess. I set up the NPS Server, applied the Network policy and Connection Request Policies, set up the AD groups, added them into the Network policy, created Radius Client on the Forti (and NPS Server ofc), connection between Forti and Radius is successfull and also my user credentials are working, but when i set up the SSID and add it to my Network Interface, the Client says connection is not possible.I mainly used this technical tip: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-FortiGate-and-Microsoft-NPS-Radius/ta-p/213024and also thishttps://docs.fortinet.com/document/fortiap/7.4.4/fortiwifi-and-fortiap-configuration-guide/961597/configu

Hello, I have strange situation related to my configuration of  SSL VPN and LDAP users on my FG100F unit.Currently all people in my agencies using their LDAP accounts to connect VPN and work remotely. Last week one person reported to me that it is possible to change expired password using Forticlient. It is normal because I have configuration which allows to users to change their Windows (LDAP) password. Unfortunately this user changed password for exactly the same as he had before. In my GPO I have password history for last 10 and compliance policy on high level (at least 10 characters etc.)But for now I see that it is possible to change it though Forticlient  Does anyone know how to force FortiGate to use AD policy during password change ?  BR Konrad

Hello,I recently purchased a few APs and have already set them up and installed them. However, I haven't registered them yet.How can I activate them?Thanks!

 Hello, We use the FortiGate device in our customer. We are using version 7.0.17. We cannot access https://sci-hub.se/. We also cannot access if we do not perform a full-ssl inspection. We do not apply any inspection in the rule written at the top of the policies. However, we cannot access the relevant site. Can you offer me solutions in this situation? Best Regards, 

Scenario:wan ip: 1.1.1.1 (assuming 1.1.1.1 is public IP)i have 1.1.1.2 as another public ip (same subnet of wan) that is whitelisted on the remote gateway of my client ipsec vpn.how can i use 1.1.1.2 as outgoing ip address going to ipsec tunnel instead of wan ip 1.1.1.1 since on ipsec vpn config you can only select wan interface so far i have tried both no good:- set 1.1.1.2 as secondary ip of wan interface - create ip pool of 1.1.1.2 and use it on policy ipsec > lan, lan > ipsec

Hi, Our FG200 firewall cluster auto updated last night, and now we have several win11 failing with the following error : Credential or ssl vpn configuration is wrong (-7200) Checking "Use external browser as user-agent for saml user authentication" solved the problem. Any ideas why this might have happened and if there's an easy fix? We don't know how many clients are affected yet and it would be much better if we can change something on the firewall side to resolve the problem, instead of having to change settings on all win11 clients.

As the title says, I would like to ask a question.Can fortigate vm free trial manage and authorize fortiAP & fortiswitch?Does fortigate vm free trial provide this function? If it does, the performance will be relatively poor, and the number of managed APs may not be large? 

I have two FortiGates configured in HA (FW1 and FW2). After upgrading the firmware to v7.6.2 build 3462 (Feature) and rebooting, I am unable to access the UI via HTTPS on (FW2), although I can access (FW1) after rebooting again.

The firewall is running version 7.2.10.I have a set of rules which has web filters, IPS and DNS filters enabled. The web filter is set to warning for unrated websites. I have set several static URL filters to exempt certain URLs from web filtering, but it is apparently still being blocked by web filtering. How do I ensure the static URL filters work for exempting URLs from web filtering?

When you create or edit an ADOM this setting give you a choice of Select all or Unselect all. What does this setting do? All the documentation I've been able to find just says to choose one, never says what one does compared to the other. My ultimate goal is to have Fortimanage organized so clients with a single FG are all in in ADOM, and any client with multiple FGs have there own ADOM, and in both cases I don't want Fortimanage to push out anything based on any group/ADOM, no policies, nothing. Just a way to manage the FGs independently.  Thanks

Hi FGT adminsThere are some config elements we usually check in order to see if our FGT config is compromised, like check if any suspicious admin account, suspicious VPN account, suspicious suspicious rule, ... etc.But is there any complete official procedure or to check it?

Hi, We have a Fortigate which act as router/firewall to protect/split our different networks. It is also used as the Internet Gateway.Our VPN clients are connected through Cisco AnyConnect Platform, getting RFC1918 IP. These IP are NATed (other RFC1918) in output from VPN plateform for mandatory reasons. NATed address are known from Fortigate and VPN client can reach servers hosted by Fortigate by this way. However, VPN clients have to go to Internet too. So their NATed address is reNATed with a public address to go on Internet. VPN client (10.0.0.1) => NATed on 192.168.1.1 by VPN plateform => Fortigate => NAted on public address by Fortigate  It works for almost cases except for video/audio on particular visio services... VPN client must have a 10.0.0.X address and MUST be NATed to go to Fortigate Networks. What other solution could be used ? Is this "double NAT" correct ? Maybe some parameters to set for keep audio/video (UDP ?) working ? R

helloI have FortiGate40F and already I have DDNS from x.dyndns.orghow I can configure this DDNS from FortiGate (from GUI  only server from fortiddns.com )for example when I write x.dyndns.org with specific port from browser forwarding to server inside my Network Best Regards 

I have the below config, and seem to have an issue where the fortigate isn't sharing the direct connected routes, between BGP peers.FortigateInterfacesaggregateinterf: IP 172.19.0.6 255.255.255.248. No Vlan.MGMT: IP 192.168.183.58 255.255.255.192, VLAN 200, Parent: aggregateinterfCCTV: IP 192.168.183.190 255.255.255.192, VLAN 250, Parent: aggregateinterf.SwitchVRF WANVRF LANVRF MGMTVRF CCTVSVI: WAN, IP 172.19.0.2/29, VRF WAN, VLAN 101.SVI: CCTV, IP 192.168.183.130/26, VRF CCTV, VLAN 250SVI MGMT, IP 192.168.183.2/26, VRF MGMT, VLAN 200SVI: LAN1, IP 192.168.168.1/24, VRF LAN, VLAN 300SVI: LAN2, IP 192.168.169.1/24, VRF LAN, VLAN 301 On the switch, I leak the routes between LAN and WAN.I have BGP peering from the switch as below.VRF WAN to aggregateinterf, 172.19.0.6/29VRF MGMT to MGMT vlan, 192.168.183.58/26 Now BGP is established and I can see the fortigate as the default route.The issue I am having is, the fortigate is not advertising each interfaces connected route to the ot

Hi. Can I check if FortiProxy license expire, will the current configured web filter and antivirus profile still function as normal? Will firmware upgrade still be successful? What about explicit proxy settings configured, will it still work?

Dear support, TrendMicro Worry-Free Business Security Services (WFBS-SVC) provides the different URLs that can be used as reference for troubleshooting purposes (e.g. allow listing from firewall or proxy server): https://success.trendmicro.com/en-US/solution/KA-0006176In FortiGate we created a rule, allowing as destination a new address: trendmicro.com (fqdn) but we noticed that it is resolving only to 1 IP. TrendMicro use more than 1 IP.  Also we tried using the FortiGate Internet services but without any luck. Can you support me ? Thank You 

Need to create IPVPN tunnel from a branch to multiple other branches...All these branches have Fortigate FWs and already have IPVPN tunconfigure as spoke to another Hub.

I did an upgrade on my firewall and now I cannot login.  Also did a reset and cannot connect to the default  IP.  Anyone experienced this ?