Support Forum

Hi EveryOne,I need little help on following.I have two location Location A in NY, USA and Location B in Pakistan. Both location have Fortinet firewall with dedicated Ip Addres. Actually I want to use USA Location Internet Like when I will go my web browser and search what is my IP that is always show internet location Of NY, USA Office. In simple words I want to use NY, USA office resources. what configuration I require to connect two diffrent places.Please Help on this.Regards,Umar Ashraf

Hello, I understand that even if a a Telco Internet circuit supports a standard MTU of 1500 and fragmentation is either not supported or reliable, that this is irrelevant to the fragmentation that may take place on traffic passing via a Fortigate IPSEC tunnel across that Internet circuit i.e. the two concepts are separate.So, you could have a telco Internet circuit with 1500 MTU and no fragmentation support, but fragmentation can still work WITHIN the Fortigate established IPSEC tunnel.Am I correct in this thinking ?Thank you kindly. 

Hello all! This is my first time working with Fortinet hardware, specifically a FortiGate firewall and I’ve hit a big roadblock. I’m on a massive time crunch and management is coming down on me hard to resolve it, so I’m hoping someone here might know the answer.The long and short of it is, I have a webpage that operates in a closed network (no external network access, physically). This webpage displays a video feed that is put out from a camera via multicast and in that closed network, everything works great. Management says they want to now do a test to see how this website could be accessed on the internal company network. They’ve provided me a FortiGate 90G and said ‘make it work’. I’ve managed to get the webpage itself through the firewall using NAT and it is accessible on the corporate network.. but the video component isn’t coming through. The video player says it could not open the webRTC stream. So far, I have:- Enabled advanced routing and multicast policy in the feature visi

I need to create some kind of notifications that an email with specific words in subject or in body was sent to any email address. I managed to achieve it with Archive account. I've created an Archive account which is forwarding email to another email address and I've created a policy that is archiving emails based on Subject and Body pattern. It works fine if the word in subject or body is equal to the word I've entered in pattern on policy. For example I've created Policy with Policy Type Subject and in Pattern I've enter word: bomb The policy works fine for example for a subject like this: I've sent a bomb to you. Email is properly forwarded to email address I've entered in Archive account. However the policy is not working for subject like this: I've sent few bombs to you. I've tried entering *bomb* in pattern but it's not working. Is it possible to use WILDCARDS in this policy patterns or REGEXP expresions? Or is there any other way to

Hello FORTINET team,We Are One Digit Solutions, A digital marketing and Web development agency, Located In Karachi Pakistan.Report generated according to : https://www.virustotal.com/gui/url-analysis/u-0b3ffe8e0bf972bad2d54098ae2901fc274c3e00a6d4aecd9616f67bf6843029-1657189856I add Report generated by Google's transparency reporthttps://transparencyreport.google.com/safe-browsing/search?url=onedigitsolutions.comOur website is blacklisted for some reason and we think it may be a false positive. We request the removal of our domain from its blacklist because it is a false positive of phishing.Our website has SSL security for the safety of our visitors.Regards

Hello, I have a FortiGate 100F, and my license will expire on February 3, 2025. Is it possible to add a trial license for temporary use? #fortinet #license #fortigate #100f #trial.

Does anyone know if Fortinet is coming with a new G models for Datacenter solutions? 

I'm setting up a new FM v7.6.1 trial on Hyper-V and have noticed, frustratingly, that every bit of configuration info I add into FM gets wiped out after every reboot, except the FortiCloud licensing. Three times I have added a 60F, rebuilt the SSIDs/groups/profiles, performed the best practice security hardening, before I figured out what was happening here. I've shut it down both from the Hyper-V GUI and exec shutdown, and when it comes back, the 60F/SSIDs/profiles are all gone. Update: Because I didn't know there were installation instructions, I had downloaded the VM image and secured it before creating additional virtual storage disks.  Added the additional storage, and now all the info is retained after a reboot.

The primary firewall was restarted, causing the secondary unit to become the primary. However, it is not syncing with the primary, and both HA cables are active.

Hi, I’m having a lot of trouble getting ourFortiGate firewalls (100Fs /  v7.2.10 build1706) to connect to our Microsoft NAS RADIUS server (Windows Server 2022). In NAS there is a tick box that says “Access-Request messages must contain the Message-Authenticator attribute”, my research shows that given version of the Forti software we are running, this should be ticked, however with this ticked Forti reports “Unable to reach RADIUS server” and Windows Event Viewer shows: “An Access-Request message was received from RADIUS client 10.10.100.1 without a Message-Authenticator attribute when a Message-Authenticator attribute is required. Verify the configuration of the RADIUS client in the Network Policy Server snap-in (the "Client must always send the Message-Authenticator attribute in the request" checkbox) and the configuration of the network access server.” If I untick it then Forti reports invalid secret (even though it’s been triple checked, reset, and che

I want to configure the proxy of my fortigate and I need to install the “Fortinet_tsagent” to recognize all the users in the Terminal Servers, but in a Windows Server 2003 I get this error when I want to run it:“Service Fortinet SSO Terminal server agent (Fortinet_tsagent) failed to start. Verify that you have sufficient privileges to start system service.” The user I am using has administrator privileges to everything. That is not the problem.Can you help me? 

Following from a previous post, which was kindly resolved (External CA for Captive Portal). I am doing further testing and have come across a minor query: How to configure FortiGate Captive Portal... - Fortinet Community This article mentions using DNS, so that it can resolve the FAC address, now, I dont use internal DNS I use google DNS on my Fortigate to resolved external and get out to fortiguard etc, Am I right in assuming, in order to allow the Guest Portal to see Fortiauth, Ill need to set up a local DNS Zone with the internal DNS as forwarders and apply it on the Guest SSID interface? is this the correct way to do it?  

The USB modem, which successfully establishes communication on FortiGate 50E and 60E, is not recognized on FortiGate 60F.    FortiGate 50E / OS 6.2.15 .... OK    FortiGate 60E / OS 7.2.5 .... OK    FortiGate 60F / OS 7.2.5 .... NG!On 60F, "Modem failed to open" is repeatedly logged in the system log.Although 60E and 60F have the same OS, only 60F does not recognize the modem. I am confused! #Restored to factory settings and applied only the following configurat#This modem mode switching is not necessary.config system 3g-modem customedit 1    set vendor "SORACOM"    set model "SC-QGLC4-C1"    set vendor-id 2c7c    set product-id 0125    nextendconfig system modem    set status enable    set auto-dial enable    set wireless-port 3    set phone1 "*99#"    set username1 "sora"    set passwd1 ENC xxxxx    set extra-init1 "AT+CGDCONT=1,\"I

Hi, So our fortigate cluster restarted last night. We got the following messages over SNMP :FortiGate: Device has been replaced (new serial number received)FortiGate: System name has changed (new name: xxx-fw1-n1.xxx.net)FortiGate: xxx-fw1 has been restarted (uptime < 10m) This also meant one of our VPN tunnels went down and which generated an alarm. What might have happened here?

Hi All, Does anybody know what does srcserver / dstserver means on logs???? I see that it can be 0 or 1. Mostly I get 0. Documentation is not very clear "Source Server (srcserver) Server of the source. srcserver=0" What does it mean that the server of the source equals 0????

Hello everybody,I am trying to exploit the *.rpm version of fortinet client VPN on OpenSuse Leap 15.2 to connect to a VPN with SSO authentication. While all the SS= steps are completed successfully the client remains forever in the "connecting" status with no error or useful information available in the logs. Is there anyone who has been able to exploit the client on OpenSuse Leap? any suggestion on how to overcome this issue? Thank youDario

Hello, Being new to the Fortinet ecosystem, I am not yet familiar with all the details of the FortiManager solution. However, I have installed the FortiManager VM with a trial license to perform tests in preparation for future use with a full license.I have two FortiGate 30G devices running the latest available firmware version for these models: 7.2.8.They are properly "synchronized" with my FortiManager, but when I make a Policy modification and push the changes using "Re-install Policy," an error occurs.In the "Preview" before the push, I can clearly see the test modification I made and only that modification. However, later in the "View Installation Log" file, new commands are added, which causes the error. The Policy does get successfully pushed, but this creates a configuration "conflict" with each push due to the additional commands/checks. Starting log (Run on device) Start installing FortiGate-… $ config firewall policy FortiGate-… (policy) $ edit 20 FortiGat

Hi, I am trying to configure LDAP for user authentication against AD. This works fine for users that are directly member of the group that is mentioned in the User Group configuration. The design, however, is that a user is member of a Role and the Role is member of the group. When I have this configured in AD it does not work anymore. When I make the user a direct member of the group again it works. How to get this working? Regards, Wim

Hello, Customer has FortiGate + fortiap deployments at all of their locations (around 22 and growing). We used to use windows NPS for 802.1x, recently we switched to Fortinac (Fortinac-f 7.2.8). Everything works as expected. But the problem is in the FortiGate GUI, wifi-controller -> wifi clients section we used to view user information as Domain/username (COPMPANY/USER1) After the transition, half of the users started appear as Domain/computername FQDN (COMPANY/PCHOSTNAME.COMPANY.LOCAL) Both type clients work fine, but this makes IT support a bit tricky since they are mostly using usernames to check on users. Is there a reason for this to happen? If it was for all users, than I would say ok there is ma parameter to deal with. But having some users with usernames and some users with hostnames is a bit confusing. Regards, 

Hi, guys, I am using Fortigate 400E, 600E with FortiOS v6.4.2 and V6.4.4. For some reasons, my company perfers GRE tunnel. It is found that the poor performance SLA of the GRE tunnel between two fortigates  ( often some percentage of packet loss often found, while the internet lines are running well - no packet loss ), any advice, thx a lot ? Any article/doc to fine tune the GRE tunnel parameters/attributes ?    

Hello, i read and applied the documentation but the issue is that i cant obtain the permanent VM trial license from FortiCare. I cant conatin the "account-id xxxx@fortinet.com" "ccount-password xxxxxxx" Trying from the cli: "execute vm-license-options account-id xxxx@fortinet.com execute vm-license-options account-password xxxxxxxexecute vm-license."   

Hello, I'm configuring ldap server on a fortigate v 7.6.x.The ldap server is behind IPSec VPN. The clients on the LAN already contact the server in question as they have made domain joins and use that ip as the DNS of their network card.When I go to configure the ldap bind to ‘ip_LDAPServer’ on port 389 this fails. Do you have any suggestions? Thanks fort the supportBR

Hi, Is it possible to create a usage quota (either time og amount of data) for a policy.If you, please advice me how to do this in the gui.I am using a Fortigate 81E-POE with firmware 7.2.2 Thanks. /Kim

FG-Version: 7.2.10 Hi Community, I’m looking for help on how to disable logging for specific policy rules in Fortigate devices that are part of a security fabric. I’ve tried changing the rules, but it hasn't worked. Has anyone figured this out? Any advice would be really appreciated! Thanks!

Hello everyone, While upgrading FortiClients on Debian-based machines, I encountered a problem that I would like to share with you here to find possible solutions or workarounds.In the official Fortinet documentation for FortiClient version 7.4 for Linux-based systems (https://docs.fortinet.com/document/forticlient/7.4.2/linux-release-notes/213138/install-forticlient-linux-from-repo-fortinet-com), the following command is given to add the GPG key for installation on Debian-based systems:wget -O - https://repo.fortinet.com/repo/forticlient/7.4/debian/DEB-GPG-KEY | gpg --dearmor | sudo tee /usr/share/keyrings/repo.fortinet.com.gpgWhen execute the following error is shown:Connection established to repo.fortinet.com (repo.fortinet.com)|208.91.114.61|:443 ... connected.HTTP request sent, waiting for response ... 404 Not Found On Fortinet's official download page for version 7.4 (https://www.fortinet.com/support/product-downloads/linux ), Debian-based distributions are not sho