Support Forum

Good evening, I hope you can help me get out of this predicament, I have been trying to register my Issabel Pbx exchange to a trunk of the Dominican Claro telephone company for a few days. The Pbx is behind the Fortinet 60f.At the moment I have a Huawei router which has the VPN configured to connect to the Sip server of Claro, on the other hand I also have Internet service from the same telephone company on the network through another Huawei router, I have two Fortinet interfaces, each one connected to the Huawei routers, I have also configured the routes to the Internet and to the trunk and their respective policies, I have also configured the VIP ports with their respective policies as well, the The issue is that I have access to the internet from the Pbx and I can also pin both the trunk gateway and the IP address of the SIP server, of course, calls between local extensions work well and also with external extensions connected via the Internet, But when the PBX tries to register, it

Hi,I have been assgined to deploy a Frotigate VM, i have created the VM successfully but im having a confusion on how to create interfaces for fortigate, and how to connect it to the Virtualised Environment. The Topology looks like this, its very straight froward setup.a WAN Link going to terminate on the Physical Server, which in trun will be fortigate WAN interface, my question is how to create the Interfaces for the LAN, which will be connected to the webservers. (pls find the diagram attached.)

I have two FGR-60Fs powered at 137VDC but they are off now. I have measured the input and there is voltage, and they have been working correctly for several days. According to the datasheet they can be powered between 12 and 125 VDC, but it does not specify the tolerance. Can anyone tell me what it is?

I have zerotier installed and running on server behind fortigate 40E firmware 7.4.5 but it is not reachable from zerotier cloud and from inside it can not ping other pc's on zerotier cloud.When connect server to internet direct zerotier is working perfect. So how to know the policy responsible about blocking zerotier traffic ??Or where to find or identify this blocking in logs ?? 

I've been trying figure how to find the mac address and arp tables for one of our fortigate firewalls, but all the documentation seem to be for firewalls not connected to Fortimanager. As you may know, the cli becomes very limited one the a firewall when you connect to Fortimanager, and the CLI on it only seem to give the arp for the manager itself which is not very useful. We're running the Fortimanager VM64 KVM 7.2.8 if that helps. The firewall in question is 200f. Any help would be appreciated.

Hello all I'm a new fortigate user and have a Fortigate 40F at home. How is it possible to create a Fortigate firewall policy that expires after a certain period of time?I don't mean a policy with "Policy expiration - Expiration date"! I mean a policy where I can set that it can only be active for 1 hour during 24 hours and then resets itself the next day and again for 1 hour may be active.Reason of the question:I'm looking for a way to limit internet access for my teenagers to a certain time per day, so that they only have internet access for a total of, for example, 1 hour each day.  (not always same time every day - so a timer)If I could then activate this policy rule with an admin account, that would be great.Thank you for your help.GreetingBenjamin 

hello,I have a question about config left by our previous admin in our compny. We have two VLANs (100 - Users and 200 - Servers)As DNS server for users in vlan100 we have set IP of our AD Server in vlan 200, and AD Server use google DNS to resolve extrnal names. On firewall we have two rule to the Interent, one for vlan100 and second for vlan200.Both these rules have SSL Inspespection + DNS Filter profile. Rule for vlan100 is in FLOW-MODE, rule for vlan200 is in PROXY-MODE Questions,1. is it ok that both VLANs has DNS Filter ?? especialy is it ok that AD Server is filtered by DNS Filter when he ask google DNS Servers ?2. Is it ok that server vlan 200 has rule as PROXY-mode  Thanks   

Hallo zusammen At home I have a Fortigate 40F for my home office.Unfortunately, my Fortigate 40F doesn't have that much RAM. (just 2GB)That's why Fortigate simply removed the proxy policies from firmware 7.4.4! ! !https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/519079?preview_token=6ac61bfb23d50d4e67fe I had proxy policies - these were simply changed to flow based during the automatic firmware update to 7.4.6!I would now like to completely switch off the automatic firmware update so that the Fortigage remains at 7.4.3 firmware version.I've tried this post several times, but every time my Fortigate updates back to 7.4.6 after about a week! ! !https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-disable-automatic-firmware-upgrades-on/ta-p/326998 Does anyone know what I can do to actually keep my Fortigate on 7.4.3????Thank youGreetingsSwiss daddy

Hello, Recently, in my company we've changed to FortiClient VPN.  All the computers of the company with Windows are working correctly and have a correct connection with the VPN Server, but in a specific department we have a Macbook Pro, and this seems to be not working as it has to. The device has the MacOS Monterey 12.6.3, it is updated at the maximum available, the problem with this device is that the connection is established but after literally 4 minutes, it's automatically closed.  I've researched some information based on the logs of the FortiClient, but nothing has worked for me.  I proceed to show the logs, if someone can help me out with this, I'll appreciate it. The first one is extracted from fortytray.log, and the second is from vpn-provider.log: 20241128 11:33:58 TZ=+0100 [FortiTray:DEBG] VpnManager.swift:699 VPN tunnel provider Main status changed: Connecting20241128 11:33:58 TZ=+0100 [FortiTray:DEBG] VpnManager.swift:988

The ProblemFortiManager allows for the scheduling of the execution of CLI and TCL scripts. When setting up scheduling, the user is able to select FortiGate devices OR device groups that are to be included in the scheduled script execution. But the way that the selection works, the device groups themselves are not actually assigned to the schedule. It appears that the devices that are in the group are assigned instead. This severely degrades the usefulness of selecting device groups, which is that when a group of devices is selected for the schedule, if devices are added or removed from the group, then they would be added/removed from the schedule execution. In this way, it would be easy to set up a schedule for a group and then simply maintain the desired device membership in the device group. Unfortunately, that isn't the behavior of group selection.Behavior exists on FMG v7.4.3-build2487 240514 (GA) and others.SetupFortiManager allows for the creation of CLI and TCL scripts. The

Bonjour à tous.J’aimerai savoir si c’est possible de coupler SNORT en IDS/IPS avec un FortiGate ?

Hey. Im aware that you can find vulnerabilities and version-recommendations as solutions to the specific vulnerability at Fortiguard Labs, but is there any place you guys find the overall recommended Forticlient version?I suppose you can find an overview of a recommendation somewhere, instead of every admin having to do the research every time, just to get the same result as everyone else who did the same

As captioned, could FortiNAC restrict the end users to access some webpages?Since my company would like to restrict the end users to access some public cloud page, such as gxxgle drive.

Hi, When connecting VPN from FortiClient getting the error message “The security certificate for this site has been revoked. This site should not be trusted”.I have verified the server certificate used under SSL-VPN settings and found that certificate is valid.FortiOS version - 7.0.15 

Hello everybody am facing an issue where when trying to create anew SD-WAN member in the interface option when I click it it is not showing my internet VLAN even tho I have set the VLAN role to WAN regards

How to set a policy that deny traffic of udp on 1000A My device firmware version is V3.00,build0483,070703Operation Mode is NATPort1 is connected Intranet, and Port3 is connected Internet. when I create a policy that deny traffice of udp @ Port3 or Port1 on cli,  the destination / source of interface must be assigned.  it doest not input any. only select port 1 to port 10.

Hello, help me please.I have two similar fortigate devices. One of them displays full license information, the other one displays it in a "short" format. Why is this happening?  

Hi everybody  Am facing an issue where we have a new site and that site is getting the internet from our main HQ when i try to connect with forticlient (my user is on the HQ forticlient) in our new site am getting server unreachable we are using SSL-VPN connection in our HQ.for more context we have our public IP that is on the main HQ Fortigate interface and our remote gateway is that public IP the internet in our new site is from our HQ ofc I have an IP sec tunnel with our HQ and it is used for VOIP and AD to make it reachable from new site.regards

Dear Team, I would like to understand the SSL VPN connectivity features of the latest version of Fortigate combined with FortiClient. In scenarios without EMS integration, is security posture checking still supported?As shown in the figure below:Bruce Liu   

Product: FortiGate 60FVersion: v7.4.5When using RDP through the Fortigate web portal, the characters in the browser tab appear garbled, as shown in the attached image. I understand that the issue is likely due to the presence of Japanese characters in the RDP name. Could you suggest any solutions to display the characters correctly without garbling?  

Hi Team, Our client is requesting us to use Lets Encrypt certificate for SSL VPN certificate protection. We are hosting this customer on the 1200D datacentre firewall as a VDOM. Please advise if we can use this feature? I am getting the below message and the "Lets Encrypt" button is greyed out. Use Let's Encrypt and the ACME protocol to automate certificate creation and maintenance. You will need to enable DDNS or purchase a domain. Kind Regards,Shiv AdhikaryNetwork Engineer

Dear All, I have strange trouble, I have 2 Fortigate running HA (A-P), and have 2 internet connected (internet leased line). Line 01 is working well, but line 2 , its flap down around 30 seconds, interval ~ 30 minutes. During this happened, I can not ping from outside to this public IP address, and also can not ping to internet use this Source IP. Between FWs and ISP, I have switches to share internet line. I checked packet drop on the switch, and did not see drop packet stats.(FW FGT  <--> SW L2 <--> ISP)Are there any you guys see same problem ? Thank you !

we are currently testing proofpoint email security software.how do i whitelist proofpoint under application control ?currently this policy do not have any application control or web filter applied. 

 Hi everyone,I've recently upgraded FortiManager from 7.4.5 to 7.4.6 and noticed a change in behavior regarding policy block names. Previously, FortiManager would prepend the name of a policy block to the name of a policy when deploying the rules to the FortiGate. However, this no longer seems to be the case in version 7.4.6.Immediately after the update I noticed that when deploying policies to the FortiGate it would fail because of duplicate policy names.For instance I have a rule defined on a Policy Package for FortiGate1 which is named "DNS" and I have a policy block called "global" appended to that policy package which also has a rule defined named "DNS". If you check the names of the rules on the FortiGate directly they had the names "DNS" and "global-DNS" before the update.After the update both rules would now be called "DNS" which leads to this duplicate issue and therefore the policy install fails from FortiManager. Current workaround is to just make su

Cross posting with https://forum.opnsense.org/index.php?topic=44897.0 due to the reason I still found no answer or clueI have a S2S IPSec tunnel between an Opnsense (24.7.11) and a Fortigate 60F (current FortiOS) device. Establishing a connection is working, but after some time (Phase 2 rekeying?) the tunnel sometimes breaks and comes back way later without any action on both sides. I captured a log trace (no debug) on the OpnSense side, see below. Both configs are correct in my point of view.Any ideas, is a debug log necessary and if yes, there are a lot of logging options with IPSec, which one?I'm no VPN or network expert, so please excuse if this is an easy mistake on my side.   2024-12-28T22:13:46 3 Informational charon 82877 14[IKE] <a075e27f-ad8d-4e7a-bd35-2f5c5ea0cee5|3> CHILD_SA closed 2024-12-28T22:13:46 3 Informational charon 82877 14[IKE] <a075e27f-ad8d-4e7a-bd35-2f5c5ea0cee5|3> received DELETE for ESP CHILD_SA with SPI e8e6a428 2024-12