Support Forum

I am using a wireless LAN by connecting FortiAP421 and FortiAP431 to Fortigate60E. Occasionally, there are instances where client devices get disconnected. The logs output during those times are as follows:- Wireless client left WTP- Action client-leave-wtp - Reason Unspecified reason.  Does anyone know the cause of this log? If I were to investigate, how should I proceed?

Hey Guys We are facing Hight SSL Negotiation time, when WEB filter profile has enable on the rule at Security Profile.When we disable de WEB Filter profile on the rule, the SSL Time improve considerable .To test i'm using this curl command, for google website. But this issue occur with any destination addresscurl —resolve www.google.com.br:443:142.250.219.131 -w "DNS_resolution: %{time_namelookup}| TCP_negotiation_time: %{time_connect}| SSL_negotiation_time: %{time_appconnect}| TTFB: %{time_starttransfer}| Total time: %{time_total} \n" -o /dev/null -vsL https://www.google.com.brWhen WEB Filter profille is enable the SSL_negotiation_time is more 3 secondsWhen WEB Filter profile is disabled  the SSL_negotiation_time is not more tham milliseconds When I check on System ==> Fortiguard  My Web Filter Status is average 123 ms. Someone experienced this same issue ?

I have a Fortigate 60F with 2 networks.  10.25.0.0/24 is the default internal network and I have 10.25.10.0/24 configured on Port 3.  There is not policy routing between these networks yet. I accidently set the Trusted IP restrictions on the Admin account to 10.25.10.0/24 so now I cannot log into the GUI at all, from either network. How do I reset this? Help!

Hello All,I have this issue. FortiGate 40F (v6.4.15 build2095)Fortinet tunnel is showing inactive stateReproduction : I use the GUI not the CLI.1. I created a vpn user2. I assigned this user to a vpn group3. I used th VPN wizard to create an Dialup FortiClient (Windows, Mac OS, Android) :-> https://docs.fortinet.com/document/fortigate/6.4.15/administration-guide/785501/forticlient-as-dialup-client4. In Firewall & Objects-> Addresses :-> Created automatically -> vpn1_range = 192.168.1.1-192.168.1.254-> Created automatically -> vpn1_split = members = lan-> Firewall Policy :-> Created automatically -> vpn_vpn1_remote_0-> The VPN was created, but shows INACTIVE.I really don't understand. Can some help, please ?Kind Regards,Jo

This regards the " Spam URL" Classification under " Fortiguard Web Filtering" . I was wondering if anyone else felt the Spam URL classification has been applied to liberally to too many websites. For example budget.com, the rental car company, fell into this one. While having this on sounded like a good idea at first, I quickly had to turn it off due to frequent blocking of sites my personnel need. I' ll send the occasional correction in to Fortinet, but I' m not going to turn it into a full time job.

Hi - weird one that has never happened before...https://imgur.com/gjjth76Everything is fine license-wise except for this "Industrial Attack Definitions" expiring. This occurs on both of our Fortigate 101F's.The contract was renewed and applied over a month ago, so it's not an update issue it seems. The Industrial DB's definitions have also been updating just fine.We purchased:1 FC-10-F101F-809-02-12 1 Year coverage for FortiGate 101F include:Hardware Advanced HWFirmware & General UpdatesEnhanced Support PremiumTelephone Support PremiumAdvanced Malware ProtectionFortiGuard IPS ServiceFortiGuard URL, DNS & Video Filtering ServiceAntiSpamFortiConverter Service 8x5FortiGuard Attack Surface Security ServiceFortiGuard AI-based Sandbox ServiceDLPWhats the deal? Am I going to lose IDS? Do we need to remove anything from our policies to prevent blocked traffic?These are several years old now and this has never happened before. It's just odd it's happening to both devices because it seem

Could someone clarify what the licensing options are for a FortiAP that is managed by a FortiGate? I'm aware there is an Advanced Management license when using Cloud-managed FortiAP but I want to confirm whether that is required for all FortiAP's or not. If you could point me to a document that explains this in detail, I would appreciate it. I've been searching documentation for a while & haven't found anything clear.

There is a nice articlehttps://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-Disable-Specific-IP-Addresses-or-IP-Address/ta-p/271410but this does not really help, if you want to disable an entry in the Malicious-Server table.Because this has more than 500.000 entries and if the ip-address is in the middle you can scroll down a few weeks.Not possible to search for the ip-address and disable it.

Downloaded Forigate 7.2.2 for my virtual lab and for life of me could not get the evaluation version register. First it was giving me DNS resolve error. I resolved that error now I am, getting " Curl Forticare failed,7 time out." on Gui I am getting error " error communicating with forticare ". I am using WMware workstation 16 Pro.

It's basicly what the title says. We use forticlient to connect to the company's VPN. I was told that the request reaches successfully the server but when it tries to create the ssl tunnel it fails. I already tried to reinstall, changing the wifi connection used.Here I have extracted some info from the sslvpn.log file that I think relates to the problem.Could you help me please?    20241112 09:58:28.682 TZ=-0300 [sslvpn:DEBG] vpn_connection:2451 EMS info added : serial number FCTEMS8823008006, tenant id 00000000000000000000000000000000 20241112 09:58:28.682 TZ=-0300 [sslvpn:DEBG] main:1609 Create socket connection 20241112 09:58:28.695 TZ=-0300 [sslvpn:DEBG] main:1687 Message to UI: A FortiToken code is required for SSL-VPN login authentication. 20241112 09:58:28.695 TZ=-0300 [sslvpn:DEBG] main:1705 153 bytes sent. 20241112 09:58:36.260 TZ=-0300 [sslvpn:DEBG] vpn_connection:659 http connection closed. 20241112 09:58:36.260 TZ=-0300 [sslvpn:DEBG] vpn_connection:521 R

Hello communityI have a question, if anyone can help me.I would like to work for Fortinet in Switzerland, in or around Geneva. Would anyone have a contact to advise me at Fortinet to apply or call me?thank you in advance for your reply.

I have a fortigate in the cloud that when the flow from a linux server passes through it, the source machine in question is on the Oracle Cloud internal network and the destination private load balancer is on another Oracle Cloud network, but I want to force them to communicate only by passing through the firewall. I can close telnet, which shows that the route is correct. I can connect to the destination, but when I try to execute the connection via the linux command line using SSL, it does not negotiate, giving an SSL Handshake error. The problem only occurs when passing through fortigate.If I go through the VPN in others to the same Load Balancer it works normally, only when the connection is coming from an internal network to another internal network that the error occurs. The tests performed were done both with NAT active and without NAT active, but in both tests the error persisted.

Hello,I'm trying to create a notification when my internet link is down to send a message by e-mail, but I'm getting 3 e-mails with DOWN and UP status, would you have a tutorial I can see where I'm going wrong? Another thing, would it be possible to send this by telegram or WhatsApp? I can't do it through teams because Microsoft is giving me an error in the apps. I'll send a printout of my settings 

hi,i plan to configure a couple of VDOMs in a FGT, one VDOM is our "main" internet VDOM connected to ISP (and downstream customer VDOMs).i plan to deploy another customer VDOM with eBGP integration.is this VDOM design/setup feasible? are there any "gotcha" that i should know?

Hello all, I am currently preparing QoS for a Dante audio network for some FortiSwitches managed by Fortigate / FortiLink. Dante needs at least priority for PTP (CS7, high) and Audio (EF, medium), and optional for other reserved traffic (CS1, low) according to following documentation:www.getdante.com/support/faq/how-does-dante-use-dscp-diffserv-priority-values-when-configuring-qos/ As far as I understood the Fortiswitch QoS concept, it should be sufficient to map the different DSCP values to different queue-numbers according to their priority (higher priority, higher queue) and to use the default "strict" scheduling, so that higher queues (e.g. the queue for PTP) are always serviced first. DSCP Mapping:CS1 to cos-queue 1 (reserved)EF to cos-queue 5 (audio)CS7 to cos-queue 6 (PTP) QoS Policystrict scheduling for all above named queues Port configurationMap the QoS policy to all uplink-portsTrust DSCP map on all Dante endpoint access ports Would you recommen

Hai we got FortiGate F201E with 7.0.17 matured versionUnable to find any upgrade path on gui and support tool to 7.2 or above any version if we manually choose any version and update ,will there be a chance loose configuration . any end of support announcement for 201EFirewall in critical production 

The last time I deleted an old DDNS entry on a Fortigate that had been thrown away, I simply contacted TAC, and they deleted the record. Now TAC says that there has to be a valid subscription in order to have a DDNS entry deleted. The Fortigate in question was End of Life years ago, so renewing the subscription is impossible. How can this be solved, and can it be solved without contacting TAC and creating a support ticket?

Hi FGT/FPX adminsRegarding the latest security incident, IR number FG-IR-24-535 // CVE ID CVE-2024-55591, that affected some FortiOS versions.https://www.fortiguard.com/psirt/FG-IR-24-535Additionally to the remediation actions described on the PSIRT page, you may check if your IP address is affected (published by some third parties) and take the appropriate action if so.

Hi Team, The site to site has already Up.From HQ to Branch Okay, everything can Ping and access.From Branch to HQ unable to ping and access.Route and policy has done on HQ FortiGate 80F.HQ - FortiGate 80FBO - Sophos UTM 9HQ subnet - 192.168.110.0BO subnet - 192.168.1.0, 192.168.3.0 Is it possible I need to add extra Route and Policy on the Branch Sophos UTM?  

Hi all,I have installed an additional ISP on my Fortinet firewall, the policy has been applied successfully. I have also 2 catalyst manageable switch. the main directly connected to the switch and the second by hyperlink to the mail.all users from the first switch work well, they get internet, etc... but all users from the second switch do not get internet connection

hi,i'm going to configure a new FGT.is it preferred to put/configure ALL VIP/DNAT rules on top then put ALL FW policy/SNAT afterwards?can someone advise what's the best practice in FGT?

I can no longer connect to the console of my FortiGate 60F.Does anyone know how to solve this?I am trying to access the console with teraterm. When I start up fortigate, I can access the console, but after a while, pressing Enter does not respond.I believe there is no physical problem because I can connect to the console of devices other than fortigate using the same cable and PC.The firmware I am using is FGT60F-7.4.5-FW-build2702-240916.

Hi Team,I'm trying to Create an IPSEC Site to Site to a Sophos UTM.Below was my configuration in FortiGate: Just wanna to confirm that my configure correct or not as default. FortiGate  

Hi Everyone,I have a FortiGate 40F firewall and a 48-port Unifi switch. I am using different vlans to manage Wi-FI for our customers, Wi-Fi for our staff, Local LAN, CCTV and IP Phone on the same switch. I am facing voice breaking issue on my IP Phones. I want to implement VOICE QOS so that my IP Telephones gets high priority and get clear voice without any break. Can anybody guide me on this how can I create VOICE QOS. I have created a QOS with minimum bandwidth of 20MB and maximum of 100Mbps but that is not helping.

Hello everyone,I installed the latest version 7.4.2.1737 of FortiClient VPN, but when I try to connect, the program gets stuck at 10%. It seems like the application adds extra characters to the password field when I click on "Connect" (the field shows more * than it initially did).All updates have been applied. I even installed this https://aka.ms/vs/17/release/vc_redist.x64.exe as recommended on a forum.Regards. Edit: it's working after fresh uninstall.