Support Forum

hey i never even knew this existed but today my site refused to open and said 'fortinet didn't instal correctly' I didn't have any file related to fortinet. I've now installed it hoping to fix the problem but can anyone help me

Hi, I`m having problems with setting up IKEv2 IPSEC with remote site.What I`ve done:I`ve imported Certificate via GUI and whole Chain by which this certificate is signeg (Internal CA).I`ve setup Custom Site-to-Site tunnel.SA Policies do match.Hovewer I can see in logs message saying:ike 0:NVT_BIA:44590: reassembled fragmented messageike 0:NVT_BIA:44590: initiator received AUTH msgike 0:NVT_BIA:44590: received peer identifier DER_ASN1_DN 'CN = RemoteIP, OU = VPN, O = CompanyName, C = UK'ike 0:NVT_BIA:44590: Validating X.509 certificateike 0:NVT_BIA:44590: peer cert, subject='RemoteIP', issuer='IPSecCA'ike 0:NVT_BIA:44590: peer ID verifiedike 0:NVT_BIA:44590: building fnbam peer candidate listike 0:NVT_BIA:44590: FNBAM_GROUP_ANY candidate ''ike 0:NVT_BIA:44590: certificate validation pendingike 0:NVT_BIA:44590: certificate validation completeike 0:NVT_BIA:44590: certificate validation succeededike 0:NVT_BIA:44590: signature verification failed

Any one knows how to change the loginscreen title or name -> FortiAnalyzer-VM64-KVM to a different name ? I have tried the following config system globalset platform-name <new-name>endIT DIDN'T WORKED

Hey, we have a FG60F with 7.4.4 and 3 Interner Access (all of them >500/500MB). They called me yesterday and at 1700 they had no internet. I was OoO so I asked them to ping the firewall (OK) and check lights (check of FG and Switches) and everything inside seemed normal....but that all 3 accesses fail at the same time, that never ever happened. They rebooted FG and all routers and nothing. At the end after 1 hour I told them to reboot FG, wait 2 mins and only connect WAN1 and sudenly it worked. I am not sure that this process solved the problem but 5mins later I connected via Forticloud and in SD WAN all of them were OK. Today checking th logs at 1700 I only find "Member status changed" and "Member status changed. Member out-of-sla." At 18:27 I find "SDWAN SLA information warning" and Message "Service disabled caused by no outgoing path." I am not worried that this can happen soon, but maybe one of you had the same experience once? Thanks 

Hey, I configured dot1x on FortiNAC with these and trying with Aruba AOS-CX Switch; (Winbind joined and Radius services running)   When I try to connect, I see logs with the correct username but FortiNAC does not send reply packet.  10:38:54.579232 IP (tos 0x0, ttl 62, id 13822, offset 0, flags [DF], proto UDP (17), length 199) 10.8.4.4.35733 > trnacsr01.test.local.radius: RADIUS, length: 171 Access-Request (1), id: 0x30, Authenticator: 4be24ae1715b87beb75e8daa5fd19d8f User-Name Attribute (1), length: 23, Value: TEST\baris.yilmaz Calling-Station-Id Attribute (31), length: 19, Value: E8-80-88-E9-46-69 NAS-Port-Type Attribute (61), length: 6, Value: Ethernet NAS-Port-Id Attribute (87), length: 8, Value: 1/1/23 NAS-Port Attribute (5), length: 6, Value: 23 Service-Type Attribute (6), length: 6, Value: Framed EAP-Message Attribute (79), length: 28, Value: .. Message-A

I am trying to send Traffic Syslog encrypted from Fortigate firewall to Rsyslog on Ubuntu server.I have managed to do this for other Clients, however one of my latest Client gets an error saying"Decode error" in traffic dump and "No supported cipher suites have been found" in Rsyslog logs. The certificate is uploaded to the Fortigate firewall at System > Certificates > CA Certificate (rootCA_ip.pem+key.pem). Tcdump Decode Error from Ubuntu Server:RSYSLOG error logs on Ubuntu Server:rsyslogd: tcpsrv listener (inputname: 'imtcp') failed to process incoming connection with error -2083 gnutls returned error on handshake: No supported cipher suites have been found.tcpsrv listener (inputname: 'imtcp') failed to process incoming connection with error -2083 Generate Certificates:The Ubuntu server is hosted at Google Cloud and it generates root certificates during creation with a Startup Script: # -------- VARIABLES -----------------------------------------------------

I am using FortiEMS 7.2 on prem and whenever i try to create a new installer the download link shows a "installer creation failed" message.Why is this happening and how can i fix it?

One of our branch offices is facing a lot of brute force attempts via SSL-VPN.For some reason, all these (failed) attempts are also forwarded to our RADIUS server (only used for wireless / wired network authentication via a NAC solution). Other branch offices with the same setup do not forward these brute force attempts to the RADIUS server(s). We have tried to compare the full configuration with each other, however do not notice any differences. Are we missing something here?  We are on FortiOS 7.2.10 on this specific branch office. 

Internet and ADVPN interfaces are virtual on the firewall. When either the ISP or ADVPN goes down, the Firewall marks interfaces as DOWN on the GUI but in CLI, the interface appears up. Any suggestion on same, we are running FortiGate version 7.2.8

Hi, i'm looking for a way to sync the sso groups from AD.  Now we manually import a group.  But if the name changes for example, we need to import it manually again.  I don't believe there is an option in the Authenticator environment itself to sync this? Running 6.5.5 btw.

Dear Community Team, We are running FortiWeb OS v7.2.7.I tried to create a new user with permission to change only another user's password, but it was unsuccessful as expected. Is it possible to do that? Please kindly share any ideas or solutions.  Regards.

Fortinet changed the way local-in-policies are created when an interface is part of an SD-WAN zone. From 7.4.6 and 7.6.1, the local-in policy is assigned to the SD-WAN zone instead of the interface as explained in the article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Local-in-Policy-is-Missing-after-upgrading-to-v7-4/ta-p/367001 This is great, however I'm dealing with issues now when I change these local-in-policies on the FortiManager. We run FortiManager 7.4.6. FortiManager 7.4.6 appears to not understand this new behaviour. I get a warning that I can't assign a local-in-policy to an SD-WAN zone when I create a local-in-policy in a policy package that's only assigned to firewalls that run FortiOS 7.4.6. That's quite annoying when you manage all your local-in-policies from the FortiManager. Is this intended behaviour in FortiOS 7.4.6 and if so, is there a fix on the way to bring this in line with FortiOS 7.4.6?

Hi,I have a huge connection attempt to my firewall (SSL-VPN). I have reduced the geographic origin of authorized connections, and I would like to exclude certain address from this geographic area. I can't do it.Can you explain to me how to do it? Fortigate FGT60E, last firmwareSSL-VPN Settings:Restrict Access: Limit access to specific hostsHosts: my geographic alow zoneNegate source: disable Thanks for your help 

Hello Everyone, plz could you help me to find out and fix the problem of the windows agent in fortisiem that is showed Critical in Event Status and what does it mean? I've attached a screenshot of the problem 

Hello,We are trying to switch our EMS authentication server from LDAP to LDAPS.  LDAP works fine.We have ports 389 and 636 open on our FortiGate firewall.  After inputting our local CA certificate and clicking Test we get a Network error message at the top.We are using the local CA certificate from our Windows server 2019 domain controller/Certificate authority by exporting it in DER format.  We have also tried that same domain controller server certificate, which is what EMS is syncing with today.Any thoughts about what could be doing wrong?  Could it be the certificate export process or maybe something else?Screenshot below.

Hello everyone, I'm from Mexico.I have a big problem, recently I have problems accessing my fortinet because it sends an error that says "Authentication failure" and does not let me access. I have tried to access via forticloud, console cable and locally and I get the same problem.What I found is that we have suffered from a vulnerability called "FG-IR-23-475": FortiOS - SSLVPN session hijacking using SAML authenticationA session fixation vulnerability [CWE-384] in FortiOS may allow an unauthenticated attacker to hijack user session via a phishing SAML authentication link.So I don't have access in any way. Is there any way to access it?To update the firmware can I do it through the forticloud Premium subscription since I currently do not have it.Note: I currently have the OS version: 7.2.6

Happy new year everyone.I want to authenticate a user through the Forti API, after the user finishes to authenticate against a 3rd party captive portal.I figured the API command would be: https://FORTI-IP/api/v2/monitor/user/firewall/auth?vdom=root{"users": [{"ip": "10.235.1.50","ip_version": "ipv4","method": "firewall","user_type": "firewall","username": "test4"}]}But I'm getting 424 Failed Dependency.Unfortunately I don't know what parameter is missing and I do not have access to the developer portal to read the documentation.FYIDeauthentication works fine like this:https://FORTI-IP/api/v2/monitor/user/firewall/deauth?vdom=root{"users": [{"id": 0,"ip": "10.235.1.50","ip_version": "ip4","method": "firewall","user_type": "firewall"}]} 

Hi All, is it possible to create a read only account that can run below command  config global config system console set out standard end show null 

Hi Everyone, I'm having 10 years of experience with Palo Alto's. We make heavy use of their URL filtering and Application Detection.In our environment it's not possible to decrypt any traffic, yet the Palo could block all URL's (based on SNI, certificate names etc) but here with the Fortigate Eval License it even refuses to block any webpage using the URL filtering - I've tried "youtube.com", whatsapp.com, facebook.com and none of these work and I'm refusing to believe that this isn't possible with a Forti without decryption. What I've done:1. Security Profiles -> Web Filter -> Create New -> Checked URL Filter (Static URL Filter) and I've choosen Wildcard, Block, Enable for *facebook.com* / *whatsapp.com* and "*youtube.com*"2. I've made sure the Filter is set in "Flow Mode" and hit OK.3. Created a "Firewall Policy" under "Policy & Objects" that includes this Filter:Accept, All, All, All, Flow-Based, Web-Filter checked and choosen, SSL-Inspection left on "no-inspe

hey, I'm having issue with a specific user trying to connect. when trying to connect to the software, doesn't matter what address is being placed, after entering password and pressing enter, the password gets longer and the application is stuck on connecting. i tried a few things, of course uninstalling and reinstalling, including restarts, i tried connecting via diffrent wifi network, and i tried even Full uninstall, registry and program data, does anyone know what else i can do to fix that problem? Thanks a lot. 

Hello Forum,MacOS version 15 SequoiaFCT version 7.2.6 GAIn our organization we are deploying a MDM profile for FortiClient. I am wondering if the Full Disk Access is properly granted for the application. I cannot see the fctservctl2 and FortiClient in the GUI Full Disk Access System Settings. Also from the command " /usr/bin/sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access' | awk -F'|' ' { print $2 } ' | grep -Ev "com.apple|System" | sed 's/\/Library\/Application Support\///g' " I still cannot retrieve the information that the application has full disk access. In conclusion I am not sure if the Full Disk access is properly granted. If I check the "Device Management" settings and click on the "Configuration Profile for FortiClient" there I can see""" Access All Application Data """ : "com[.]fortinet.forticlient.macos.antivirus- Allowed" "com[.]fortinet.FortiClient - Allowed" "/Library/Application Support/Fortinet/FortiClient/bin/fctservctl2 - Allowed

hi,i'm trying to create a FW policy (top most rule) to exempt/bypass selected public IP host/subnet for FW policy inspection. this for troubleshooting/logging purpose and to quickly react if a client escalated a complex issue.can someone confirm if below logic is correct? do i use the same source address ("extempted-subnet" address group) for both inbound and outbound rule? Rule #NameSource InterfaceDestination InterfaceSource AddressDestination AddressServiceAction Exemption Traffic - Inbound/Outbound      1Allow Exempted Subnet Inboundinternet (egress interface)anyTo add customer public IP subnet in "extempted-subnet" Address GroupallN/AAccept2Allow Exempted Subnet Outboundanyinternet (egress interface)To add customer Public IP subnet in "extempted-subnet" Address GroupallN/AAccept

Please help me configure a policy for one connection. FG-60E (firmware v.7.2.10) works in transparent mode between optical modem (also in transparent mode) and main router for LAN. External IP address is on router, not on modem. When Inspection Mode works in Proxy-based (Firewall Policy), one of the devices in LAN cannot communicate with its server where it sends measurement data (blitzortung.org). Policy in Flow-base mode does not block the connection. It blocks only in Proxy-base. Is it possible to set Flow-based policy for selected remote server? Or add some exclusion in current policy? I know the addresses of servers to which data is sent.

Hello.I am currently using an ARM-powered computer (Snapdragon X Plus) and I couldn't install Forticlient 7.4 normally. Then I installed Forticlient from the Windows Store and added a new VPN connection in the VPN tab under Settings. But I can't access any pages while connected to the VPN, I can't connect to SSH. The connection is successful but I can't do anything. Do I need another setting? 

Hello, I have download the Vm image for  vmWare ESXi 7.6.1 and I have set ip static for the first port but when i am trying to access via browser it's appear there is a problem in license (vm is not licensed or licensed invalid for current vm configuration upload a new license or reconfigure the vm) and i have tired to download the license via cli but there is problem (failed to download vm license) although I am sure that insert the right username and password