Support Forum

How does fortisase spa works and how can we setup

I've come across a strange something I've never seen before in web categorisation. There is a link that Is currently getting blocked on of my FG's. Looking at the logs on the FAZ it was Categorised as Advertising but when looking on FortiGuard's web filter lookup It has the category of business. Creating a simple exemption would get me access to the link but was just wondering why there would be this difference. FG is running on 7.0 could it just be the OS version the FG is on? 

Hello, I'm working on a pre-configured Fortigate firewall and seeing too many logs under VPN Events, most of them SSL VPN alerts. I realized these logs are coming from other countries than the intended country. After looking for some solutions to minimize the logs, I came across this "limit access to specific hosts" option. I tried to add my country as the hosts, however, after applying the policy, it doesn't let anyone connect to the VPN. What I'm seeing under VPN logs when a user tries to connect is "Action: tunnel-up - Reason: login successfully", and a few minutes after I'm getting this "Action: tunnel-down - Reason: User requested termination of service". Additionally, on the client side, it app doesn't even ask for a token verification and just drops the connection.I hope someone can let me know the reason for this issue and what I should do next. Secondly, I tried to revert SSL VPN to the way it was and apply the restriction under firewall policies. This time, I was ab

Is it possible to sync the fortigate webfilter with the EMS

Hello,I had the one more unpleasant surprise after upgrading the FortiAnalyzer to 7.4.5: several datasets that worked perfectly in 7.0.x stopped working with strange syntax errors, not being valid anymore. Also other datasets which were ok before, now need SQL code adjustments because hcahe requirements are very strict. Also, apparently only temporary tables are permitted, which is a change that is impossible to understand for me, and I had quite a lot of datasets that prepared tables on disk which were used by subsequent reports refering such persistent tables. No more permitted, but why? This is an example of dataset which is no loger valid. The goal is to drill down into the DNS queries, listing the domains and query counts per each hour interval. DROP table if exists time_intervals;CREATE TEMP TABLE time_intervals ASSELECT generate_series(extract(epoch FROM (now() - interval '7 days'))::bigint,extract(epoch FROM now())::bigint,3600) AS interval_start;select cnt,from_itime

Looking at implementing the process below and we are having a hard time finding specific instructions. 1) Guest user attempts connection to SSID2) User is prompted for email address3) User enters email address4) Email address is sent to system 5) System sends a code to users email6) User is prompted for code7) User enters code to access wifi Any ideas?

Hello, i have an error with connecting to IPSEC vpn IKEV2 using Azure AD email whats happening is after i get the pop up to enter the credenials after i enter and get the 2FA popup it says VPN connection is down and when i check the logs i get this error: i tried turning off the firewall on the device im trying to connect from, i restarted the services, removed and redownloaded the vpn and still nothing is changing 

Hey, we have VXLAN between DC and DR sites. We can access through the same subnet, so we can ping or access to the GUI. On the different subnets we can't access to the DR site FW with the HTTPs,PING or something but we can access to the DC site FW GUI or can ping it.For example; We have 10.10.10.0/24 and 10.10.20.0/24 subnets. .1 is the VRIPs, .2 is the DC site FW, .3 is the DR site FW IPs. I can't access 10.10.20.3 from the 10.10.10.0/24 subnet but can access to the 10.10.20.2. When I try to ping and sniff from DR site FW it only gets icmp-requests but doesn't send reply packets. MTU sizes the same on both site. How could we solve that?

Hi everyone,I want to evaluate an internet availability connection from ISP for a period of time, but I have already checked in my FortiGate, I don't see where I can check the uptime of an uplink, it means since the system is up, how many hours the internet has been available, taking into account the time of interruptions and times out.I have only seen where I can see the system uptime, which shows the time my device has been up since it was turned on.

Hi, I'm getting an SSL certificate warning when using FortiClient VPN on 1 of my Linux machines but not on 2 other Linux machines. Why does this only happen on 1 machine and not on the others? I've tested this on 3 machines, and only 1 of them has this problem (openSUSE). Context: - There are no certificate warnings at all if we visit the SSL endpoint in the browser, or when we run 'sslscan' or 'testssl.sh' on the SSL endpoint: vpn.ourdomain.tld:10443All good here. - All 3 machines are running the same FortiClient version: 7.2.2 (build 7.2.2.0753) - libssl versions on the 3 machines:Debian: 3.0.11Fedora: 3.0.8openSUSE: 3.1.4 - All 3 machines are using the same DNS server, same DHCP, same internet connection. - The cryptographic policies are set to DEFAULT. - To make FortiClient usable at all on openSUSE, I temporarily(!) disabled AppArmor. That allows me to establish a successful VPN connection, although I see the certificate warning shown in the

Client laptop has a cert issued by Microsoft AD (via Intune) the Trusted CA has been imported to the FAC 6.6.0 as per this video:EAP-TLS Authentication with FortiAuthenticator | Identity and Access ManagementThe fortigate is set to use the FAC / WPA2 Enterprise as per the instructions, everything is configured as per the fortinet website, but nothing gets sent to the FAC (other traffic using SSL VPN is fine, so its not a connection issue) Running debugs and logs on both the FAC and the Gate, the EAP-TLS request is not even reaching the FAC,  Fortigate logs show:2024-11-06 15:09:28 05768.944 70:32:17:11:01:7a <eh> IEEE 802.1X (EAPOL 14B) ==> 70:32:17:11:01:7a ws (0-10.16.152.100:5246) rId 0 wId 1 38:c0:ea:a0:d0:81 2024-11-06 15:09:28 05768.974 70:32:17:11:01:7a <eh> IEEE 802.1X (EAPOL 5B) <== 70:32:17:11:01:7a ws (0-10.16.152.100:5246) rId 0 wId 1 38:c0:ea:a0:d0:81 2024-11-06 15:09:28 05768.974 70:32:17:11:01:7a <eh> recv IEEE 802.1X ver=1 type=1 (

I'm facing issue while using 2fa fac agent for wins loginthe fac agent login portal itself is not getting trigger and getting bypass with admin login

How to add existing Azure Virtual networks to the firewall? I about ten vnets and i want to add into the firewall, but I am not seeing how to do this.   

Hi,We have noticed that our domain, highstreetpharma.org, is blacklisted by fortinet as reported on securityscan.getastra.com. After conducting a thorough review of our files and database, we did not find any malicious content on our website.

Hi,on CLI console I want check interfaces configuration without success.admin@fortinac:~> show system interface-bash: show: command not foundadmin@fortinac:~> execute show system interface-bash: execute: command not foundI try also with root user without success.With command get the result is the same.Fortinac appliance is a virtual machine.Could you help me?  Thanks  

We have Fortinet firewall 200FCan we increase socket connection timeout for specific clients OR for specific firewall rule ?

Hello everyone,I recently discovered that the FortiAuthenticator supports a proxy authentication mode for remote RADIUS servers:FortiAuthenticator DocumentationHowever, the FortiGate does not seem to offer a similar option:FortiGate 7.4.5 Documentation (our current version)FortiGate 7.6.1 Documentation (latest version)If you want to set up remote Dial-Up IPsec VPN tunnels using EAP-TLS authentication via Microsoft NPS (RADIUS), it seems you would need to purchase a FortiAuthenticator solely to forward the requests to the remote RADIUS server.Will FortiGate ever introduce a proxy mode for authentication via remote RADIUS servers?

Hi Team, I have output as DestIP = ['1.1.1.','1.1.1.2'] and I want to update this in a text file of server which i have integrated using SSH connector, while trying to update it is getting updated as it is ['1.1.1.','1.1.1.2'] but I want to update these mutiple IPs in text file of server in a vertical format without any brackets and commas. For example, refer below: Is there any utility to change the format like this ?  1.1.1.11.1.1.2 Regards,Shashank

Hi all,I've a FG-1800F that I've upgraded to 7.0.16.SSLVPN tunnel mode works well, but SSLVPN  web mode have a problem when i try to connect using http/https or other protocols.It shows the message "SSL VPN Proxy Error. Reason: Access Denied".I state that firewall policies are correctly configured so much so that I can navigate via tunnel without problems.By debbuging I see the ouptut below:[5530:root:56b2]deconstruct_session_id:709 decode session id ok, user=[testuser], group=[VPN],authserver=[LDAP],portal=[fullaccess],host[x.x.x.x],realm=[],csrf_token=[BF28A52BF8CD26D67351B134F895BF9],idx=4,auth=16,sid=3e129ec9,login=1732875556,access=1732875556,saml_logout_url=no,pip=no,grp_info=[FP00ys],rmt_grp_info=[pSVTnq][5530:root:56b2]dns_query():296 tried IPv4 0 www.google.com[5530:root:56b2]dns_on_read():178 got result[5530:root:56b2]sslvpn_policy_match:2641 checking web session[5530:root:56b2]remote_ip=[x.x.x.x], user=[testuser], iif=34, auth=16, dsthost=[www.google.com], portal=[full-

Hi, I have 3 internet links:Broadband 250/250 Mbps PPPoECorporate 1000/500 Mbps Static IPMPLS 10/10 Mbps Static IPThe issue you're facing is that you cannot access the AGO website or the site is very slow, but you can access Google, YouTube, and social media normally.How can you fix this issue? And how should you configure the SD-WAN link?FG100F Firmware : v6.2.3 build6188

Some of our Fortigates are located behind other firewalls and the only way for those Fortigates to reach the Internet is via a web proxy. We were able to configure Fortiguard to use the web proxy to reach FDN to pull AV,IPS etc auto updates. Is there a way to configure threat feeds to use a web proxy too? If the answer is yes, how is this configured?

All of a sudden I can't login to my 40F device in our Forticloud instance...the appliance is up and I can connect to it via VPN, but for some reason when I try to connect to remote management via Forticloud I just get a blank screen. No config changes were made....anyone else seeing this?

When i go to the download page, and trying to download the windows version of VPN only, but can not access to the page. At the end this message showed out : Fatal error: Uncaught PDOException: SQLSTATE[08004] [1040] Too many connections in /var/www/html/src/Core/Database/DBAL/Database.php:22 Stack trace: #0 /var/www/html/src/Core/Database/DBAL/Database.php(22): PDO->__construct('mysql:host=mysq...', 'v-kubernetes-my...', 'HZKn0qIwHWdALJ8...') #1 /var/www/html/src/Core/Database/DBAL/Database.php(41): Core\Database\DBAL\Database->connect() #2 /var/www/html/src/bootstrap.php(11): Core\Database\DBAL\Database::Get() #3 /var/www/html/public/index.php(7): require_once('/var/www/html/s...') #4 {main} thrown in /var/www/html/src/Core/Database/DBAL/Database.php on line 22 

Hello,I am trying to set up automatic failover wan using link-monitor and not SDWAN.  Before I even get as far setting up the link-monitor I am running into an issue.  My primary is wan2 and backup is wan1.  I have tried setting the static route for the backup to a higher priority and/or distance value.  When they are both connected it uses wan2 (what I want) then if I unplug wan2 it switches to wan1 (also good), but when plug wan2 back in it still uses wan1.  Shouldn't it switch right back to wan2?  I think I must be using the distance and or priority incorrectly.wan1 and wan2 are in a zone and my internet access policy uses the zone.   

hi,is the FG dashboard > network > ipsec view for "incoming" and "outgoing" data an "incremental" value over time, i.e. from the time ipsec VPN tunnel was built up to current date?how to view "real time" ipsec VPN traffic in GUI?