Support Forum

Hello, I am running into issues after updating to 7.4.2 to address FG-IR-23-278. Specifically IPSEC tunnel. The SSL works as expected, but not IPSEC. We use DUO for MFA, but it does not even getting to the point just stays at connecting... and then fails. Any thoughts?  Thank you in advance!Best, Brandon 

I'm currently facing some challenges while trying to configure my FortiGate for a Site-to-Site VPN connection. Despite following the provided documentation, I seem to be encountering message scheduler https://www.gbgenie.com/gb-whatsapp/ Status time limit settings, Contact Toast difficulties in establishing a secure connection. Has anyone else encountered a similar issue or successfully set up a Site-to-Site VPN with FortiGate? Any guidance or insights you can offer would be greatly appreciated.

I have a new implementation of FortiSASE and trying to integrate with EntraID for SSO. We have followed all the steps as documented here including API permissions : https://docs.fortinet.com/document/fortisase/latest/agent-based-vpn-autoconnect-using-entra-id-sso/547823/configuring-entra-id-options-for-agent-based-vpn-autoconnect SSO still doesn't work and every time, I lock the policy Source to EntraID group (My account is a member of this group), and i try to connect to agent based VPN, it gives me the following error. AADSTS50105: Your administrator has configured the application FortiSASE ('677888668-56ff-4675-7561-ddee90078') to block users unless they are specifically granted ('assigned') access to the application. The signed in user 'abcd@ybg.com' is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator. Please contact your administrator to assign access to this application. Does anyone knows

So I have a few laptops in our organization that this has happened to now, I originally thought it was the most windows update that did it as both users advised that issue started occurring after a windows update.  But after experimenting with one of the laptops I have wiped it multiple times now (as issue kept reappearing) my tests I started installing things one by one and rebooting.  I started with our 7.2.5 installer and had no issue, but when I updated to 7.2.7 is when issue resurfaced. I then created a 7.2.7 installer wiped the laptop and first thing I did after joining our domain was install forticlient 7.2.7 and it issue immediately happened.  When the issue occurs the login screen flashes every few seconds and resets to the initial screen, it is painstaking to just reboot it into maintenance mode to use the recovery drive.  It has happened on 2 different model of laptops (Surface Laptop 6 and Asus Expert Book) I have a bunch of laptops that are just fi

I am trying to setup my iPad and Phone on Fortisase and then connect to the VPN.  Registering them on Fortisase has worked and I added the SSL cert.  But when I try to connect to the VPN, type in the user and pass (which are correct because that is how I connect on my laptop) it fails. It says Internal Error. I am using the app 7.4.3.0.161 thats available in the App Store.  All help appreciated. 

Network Interface Loopback Test............................... FAIL XI have already made cables for the 50E and 30E passes normally but the 40F does not, can anyone help me?

I have an internal application to which i want to limit the sessions from a particular source IP.. i.e. an IP should not be able to stablish more than 10 sessions to that application..i understand i can create a threshold for this in IPv4 DOS Policy but the source IP is part of a header.. is it possible to limit sessions based on the source IP contained in the header ? 

Hi together, I have the following problem. I have a FortiGate 40F and a LAN configured (192.168.1.0/24) and I have connected the WAN port to another network (10.148.238.0/25).I have created 2 firewall rules, only for testing. Later I will only open needed ports. NameSourceDestinationScheduleServiceActionNATLAN -> WANallallalwaysALLACCEPTEnabledWAN -> LANallallalwaysALLACCEPTEnabledI can reach a computer from the LAN via RDP in the WAN but not vice versa. With port forwarding I only have the option of specifying the IP of the FortiGate WAN port. How do I manage to specify a LAN address? Have I overlooked something?Thank you very much for your tips and help. Regards,Christian

Hi, my lan hardware switch interface has 3 ports lan1,lan2,lan3.-> lan these 3 ports are part of the main "internal lan" how do i take lan1 out of the lan hardware switch and create a second hardware switch lets say lan_2 containing only the port lan1? in this fashion i would then add lan_2 to a new internal interface lets say internal_2 ? how can all of this be done? it seems impossible to find where to topke out lan1 from the hardware switch. any help would be appreciated. ciao,Antonio 

Hi Am facing a strange issue where when I uploaded the backupconfig of the firewall we lost https or http access to the firewall I will explain everything below (I did a session with forti support but the result was you shouldn't take back up config from 7.6.0 version to 7.2.10 version tbh I wouldn't say this is true at some point but I will try my lost hope here) So we have a fortigate firewall that is on 7.6.0 we wanna role back because this version is seriously bad I toke the passive firewall factory reset it also rolled back to 7.2.10 then toke the back up config from 7.6.0 and uploaded it in the 7.2.10 suddenly no https \ http access I will write everything down that I tried : 1-interface up allow access ping https http ssh(i can ssh into the firewall)2-change the https port to default 3-no local in policy is configured4-trust host is configured I added the whole subnet of my vlan (me and the firewall are on the same vlan)5-diagnose sniffer to see what is being

how to fix thisi use SSO for au then via Microsoft Entra ID to allow access networkbut when disconnect or skip day need to login againcan we keep session I mean no need to login againhttps://docs.fortinet.com/document/fortigate/7.6.1/administration-guide/33053/outbound-firewall-authentication-with-microsoft-entra-id-as-a-saml-idp

I have followed the guide to setup a site to site VPN with overlapping subnets but I need to get the Branch sites internet traffic to route back over the VPN between FortiGate's but then go out of another router on that network. Can anyone help me get this working as I cannot get the branch office Internet to work.  This is the guide I followed https://docs.fortinet.com/document/fortigate/7.6.1/administration-guide/426761/site-to-site-vpn-with-overlapping-subnets This is the configuration I have Site 1 - HQWAN Router - 192.168.0.1LAN  -192.168.0.0/24WAN router has static route to point traffic for 10.2.2.0/24 to 192.168.0.11 Fortigate 80F - Connected via  WAN 1 - to LAN above IP'd 192.168.0.11WAN2 IP'd- 192.168.1.129/25 and connected to layer 2 link to Branch siteSNAT setup to convert 192.168.0.0/24 to 10.1.1.0/24 Site 2 - BranchFortigate 30GLAN - 192.168.0.0/24SNAT Virtual Subnet - 10.2.2.0/24WAN IP'd- 192.168.1.131/25 and connected to laye

I work at a University (just started a few months ago). Apparently, they have been having an ongoing issue with PS5s. Users say that they will connect for up to an hour and then disconnect and generally just have very unstable connections. I have tried different shaping policies with seemingly little success (I say seemingly as one person may have no issues for a few days randomly and then randomly have issues again for a few days; making it very difficult to troubleshoot). I have found a setting 'Preserve Source Port' which I could apply to the students subnet.  I created a test network and I have managed to get a few PS5s onto it and I have applied the 'Preserve Source Port' setting to. I am getting positive responses from the users. I would like to test with more PS5s prior to rolling out to the main student network but getting into contact with students is difficult. TLDR; I'm wondering if anyone has experience with the 'Preserve Source Port Option' and if it could p

Hi everyone,I’d like to set up automated regular backups for my FortiGate 300D devices in my company’s network. What solutions or tools do you use in your infrastructure to handle this? Any suggestions for reliable, efficient, and easy-to-implement and free or unexpensive:) methods would be greatly appreciated!Thanks in advance!

Hi, since this morning, navigation is very slow if the forticlient Webfilter is enabled. (v 7.4.3.1761).strangely, it impacts only the users if the WebFilter profile is disabled on the EMS profile.as a workaround, the Webfilter is now enabled also if the computers are on-fabric.Anybody else have this behavior ?

Hi, I'm trying to use custom WAF signatures to implement exceptions as described on the page: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-a-custom-FortiGate-WAF-Web/ta-p/355036Unfortunately, this method doesn't work for me, yes, the custom rule does work, the logs show that the URL was detected and allowed, but right after this entry the next entry shows that the same URL was blocked by the WAF rule.The config looks pretty simple:config waf profileedit "xxxx"config custom-signatureedit "allow_search"set status enableset log enableset pattern "search.php"set target req-urinext...I want to exclude the "search.php" page from WAF protection (always allowed)The page is blocked despite the existence of this exception. log:First, there is an entry about the page being blocked:2025/01/31 10:26:26, blocked, SQL Injection (Extended), 40000137, waf-signatureand then:2025/01/31 10:26:26, passthrough, , , waf-custom-signatureIn both cases, the same URL containing "search

If we have 2 different internet connection on the fortigate, how we can failover the remote access VPN to 2nd internet line if the 1st internet down without switch the profile?Currently now in the remote access VPN i have 2 different profile connected to the each fortinet public ip

I have a webserver using SSL sitting behind a Fortigate.  I have a port forward rule and IPS policy enabled to allow outside traffic in to the server.  However, the policy doesn't have full deep ssl inspection.  Without this does the IPS policy provide any protection to the SSL server?

Dears, TrendMicro Worry-Free Business Security Services (WFBS-SVC) provides different URLs used as reference for allowing listing from firewall or proxy server. We created a rule in FortiGate using FQDN trendmicro.com but it is not working and it is resolving in only 1 IP. TrendMicro has more than 1. How we can resolve this ? Thank You   

Hello, Securtiy Events Summary logs do not appear on FortiGate. FortiGate version 7.2.9. Does anyone have a solution for this?

I use Cloud EDR so we have the latest version. Windows version is 11. The agent version installed on Windows is 5.2.2. After the last mandatory windows upgrade I get an OS not supporting error, so it is degraded. I can't see a more updated package, is there any way to fix this?

I have just installed Windows 11 on my desktop PC and installed FortiClient v7.0.9. I have steup my FortiClient app the same way as it was on Windows 10 but it is not working. I just get a failed to connect check your internet and VPN pre-shared key message. It works fine on my Windows 11 Laptop though? Anyone else had this and can offer any advise?

I want to make a secure email connection with starttls for M365. I then created an M365 certificate with openssl. I followed this guide https://docs.fortinet.com/document/forticlient/7.4.1/ems-administration-guide/385506/configuring-smtp-server-settings. But I couldn't upload the certificate to Ems. Ems asks for a certificate password or private key, unfortunately I don't have one. How can I do this?

Hello, I deployed fortideceptor version 5.3.0. But I don't have access from anotether networks to fortideceptor even though create firewall rule. This issue isnt related vm nic card, vm use vmxnet. Also I configured vmware port group proparties like promiscuous mode, mac address changes and forged transmits. If I try to send ping from fortideceptor mgmt ip to a deployment network monitor ip  it fails. But if I open nat in policy, it will be success. Where could I have gone wrong? 

Management access | FortiGate / FortiOS 7.0.0 | Fortinet Document Library"Management access to the FortiGate will be limited to a single physical interface."Foritgate 80E, has 2 WAN ports, but it is really not possible to access management GUI both public IP address on WAN1 and WAN2. So far, I can access management GUI on WAN1 public IP address only.