Support Forum

Hi everyone,I noticed FortiDeceptor supports integration with Cuckoo Sandbox, but given that Cuckoo is no longer maintained, I have a few questions:Is anyone actively using Cuckoo (or forks like Cuckoo3) with FortiDeceptor?For those who are, what does your environment look like? What security measures have you implemented to safeguard an unmaintained Cuckoo server?Are there users here leveraging other sandboxing alternatives instead?Has Fortinet issued any official statements about continuing to support Cuckoo integrations or recommendations for alternatives?Looking forward to hearing how others are approaching this. Thanks!

Hello,I am currently dealing with an issue related to the FSSO feature, which helps us manage rules on Fortigate. We are experiencing a situation where a user is not authenticated via FSSO when they switch from a wired connection to Wi-Fi. After this change of adapter, the user receives a new IP address and FSSO does not authorize them immediately. We also have a feature enabled that should detect IP address changes, but either it works with significant delay or not at all.Could someone advise me on how you handle FSSO during a change in the connection method? We would like to continue using rules for selected users. Best regards and thank you,Jan

Hello, We have an issue with configuring and using ZTNA tag for filtering internal traffic.We would like to base our config on following example:https://docs.fortinet.com/document/fortigate/7.0.0/new-features/477578/ztna-ip-mac-filtering-examplebut we would like to use it with many Fabric firewalls not just one (as it is shown in the example). Here is our setup:1) EMS server (7.2.6) assigns ZTNA tag - it works OK2) Forti manager (7.2.8) synchronizes ZTNA config to all our firewalls (7.2.9) - it works OK3) We configure internal traffic rules using ZTNA tag as source criteria. Unfortunately, we discovered that above config works properly only within one firewall. That is because ZTNA tag is mapped ONLY to local IP addresses on the firewall.Thus if we want to use ZTNA tag globally as a source criteria, it doesn't work (because particular firewall maps ZTNA tag to only local IPs and doesn't know anything about remote source IPs for that tag). Question:Is there a way to

My Apple device running iOS 15.6.1 is failing to connect to FortiClient VPN IOS 15.6.1 (FortiClient  7.4.2.0151) – Not work * No popup for enter the username and passwordIOS 18.1 (FortiClient  7.4.2.0151) - OK Does anyone know if there is any compatibility issue between FortiClient 7.4.2.0151 and devices running iOS 15.6.1?

Hi Fortigate experts,we need your kind help. End customer needs a DRP for some of their on-premise business critical applications.We are proposing AWS for the DRP environment .We are proposing Fortigate to protect some internet exposed services and also to enable VPN Clients to connect to the AWS DRP environment.The AWS DRP environment (and therefore the Fortigate) is only needed when DRP is declared by the IT department (1 or 2 times per year for around 24hrs each time). Is it possible to avoid being charged the Fortigate prices when DRP environment is not needed?, for example, "turning off" or "disabling" the Fortigate when it is not needed and "turning it on" only when needed ( or 2 times per year) without losing configurations?Thanks

Hi I am currently using Fortinet V7.4.4 and recently encountered an issue where users connected to the WiFi1 network were unable to browse the web. However, there were no issues with web browsing when connected to the WiFi2 network.After comparing the configurations of both WiFi networks, I noticed that the DNS filter was enabled on WiFi1. Disabling the DNS filter resolved the issue.We haven’t made any configuration changes, so I’m curious—why would the DNS filter block web browsing?

Hi,please refer to the screenshots - why is the FortiGate blocking legit HTTPS and HTTP traffic? The policy and the corresponding SDWAN rule should alllow everything. It just doesn't make any sense and the provided article is not helpful at all.https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Threat-131072-is-seen-in-logs-when-traffic/ta-p/192533   

Hello,I took over the infrastructure with FSSO on DC installed, in services Domain Administrator is set for FSSO Service as run us account.I don't want to use Administrator account, can I change it for normal user or some special user ??If yes, what permission in AD this user should heve ??Thanks,

Hello, I’m experiencing an issue with my firewall. A service used within a website is fetching image files from its own server. Due to a problem with the firewall, I can't see these images. From the firewall logs, I see that there is no response from the other side. However, when I use my mobile internet, I can access both the website and the images fetched by the service. I’ve allowed access to the services the website connects to through Google Chrome in the firewall, but the issue persists.

hi,for now we have services fo0r 5/8we want to upgrade the services to 24/7what we should do?

Hi All, We are having issues in our MPLS - IPsec VPN Tunnel, please see attached network diagram for reference.    Whenever we up the tunnel in ISP1, we have no problem.1. We can access the ATM and Blackbox Switch from the server and vice versa. We also have a test laptop in the client side which I forgot to in include in the diagram.2. We can traceroute the traffic and see that it is passing through the expected path, which shows the IP address from both sides in ISP1.3. Even on Fortigate logs, we can see that traffic is using the right policy and static route. The problem start when we swing to ISP2, for HA testing.1. We can still access the test laptop from the server and vice versa. We use the test laptop first before we proceed with adding the ATM and Blackbox, which is what we did in the ISP1.2. When we traceroute the traffic, we can still see that it is passing through the router in the ISP1 of the client side.3. The client also tried to traceroute

Hello,i have an issue on FortiAuthenticator HA on virtual machine,when trying to create HA Active-Passive between two virtual machine the HA status on the two nodes become primary with one has high priority and the second has low priority but no sync happen between the both devicesi have attached a copy of the config of the ha setting on both devices

We are attempting to Push the Persistent Agent to our Mac's via JAMF School. We are seeing the package and script pushed to the macs but it is not Executing. Has anyone attempted this? Any luck?

Quick background on the environment.Root vdom contains all the physical connections to the VMWare stack and the internet. VDOM A - All internet bound traffic (inbound or outbound) runs through an intervdom link.  Everything works as expected.I understand how one would pass traffic through for either all ports or a single port from an external IP, through a VIP on Root, to the intervdom link IP of VDOM-A and then another VIP on VDOM-A to 'inside' VDOM-A.What happens when you need to have multiple external IPs all routing to something within VDOM-A?  With the intervdom link, VDOM-A essentially only has 1 'external' IP.  For example, you've got external IP: 40.40.40.40 that goes to WebserverA in VDOM-A and you've got 40.40.40.41 that goes to WebserverB in VDOM-A.  Do I create separate intervdom links for each external IP?Do I take the VIP from external to Root and do something like take 40.40.40.40 port 80 outside, translate it to 172.17.172.1 (intervdom

I have a fortigate 90G and I have to console into it to reset the admin password as we forgot itI browsed online and it says to download fortiexplorer as we have usb console cable but couldnt find fortiexplorerCould you please guide me how to get to the consoleThanks in advance

Recently had EMS updated 7.2.5 1061 and no longer see see the quarantine action, was this moved or a known issue? In the past we navigated via. select endpoint -- action -- Quarantine. 

Hello team!! I need to do the following but I dont know how.We have the only 2 WAN connections in the same SD-WANEverything is working fine, but now we need to specific IP range to use WAN2, and when WAN2 is down, this specific IP range should not use WAN1 connection (Should not navigate).Is this possible to accomplish this with SD-WAN rules? Thanks in advance.Regards,Damián 

I have a VIP setup with a static route, so it can be advertised into bgp.  The link-monitor checks the server the VIP is mapped to.  When I shutdown the server, the link-monitor shows the status is dead, but the static route is not withdrawn from the routing table.  Is blackhole as a next hop not supported for link-monitor? FortiOS 7.0.15  config firewall vipedit "VIP"set uuid 6b05a182-a52a-51ef-84f5-d38866bd0382set extip 77.77.77.77set mappedip "172.16.78.10"set extintf "WAN"set portforward enableset extport 80set mappedport 80nextend FortiGate-VM64-KVM # show router staticconfig router staticedit 1set dst 77.77.77.77 255.255.255.255set blackhole enablenextend config router bgpset as 65017config neighboredit "10.17.255.1"set remote-as 65000nextendconfig networkedit 3set prefix 77.77.77.77 255.255.255.255nextend  FortiGate-VM64-KVM # get router info routing-table staticRouting table for VRF=0S 77.77.77.77/32 [10/0] is a summary, Null, [

Hi All, I'm getting a lot of help desk tickets with stuff like "It looks like mathsbot.com closed the connection" (one of many sites!)  I use deep packet inspection. I've tried pretty much every option on the profile to change that, but the only thing that seems to work is adding the site (or the relevant category) to the SSL exceptions.  I'm getting enough of these tickets for it not to be sustainable. Any ideas anyone? (I do need DPI, educational institutions)CheersJon#fortigate

How are we updating firmware on the free (three device) faz / fmg vm64 licenses these days? I am unable to get firmware for faz from support portal because I don't have a support contract for it, and from the web gui it only has older versions in the drop down list.

  facing below error while activating licence Fail to download license, please give it try later. [Error_code: -3040]  

I've created a bunch of address objects for all the host IPs in a given environment but in the forward traffic logs I still see IPs and some DNS entries if RDNS for those IPs has been setup (externally). I was wondering if theres a way to link these address objects in some way so its easier to read through forward traffic logs, and fortiview for identifying systems in various tables?Also wanted to ask, is there any advantage to linking an address object to an interface? I tried to do it after the fact, but wouldn't let me as it said the object was already in use. I find it pretty frustrating that certain config changes cant be made without undoing everything related first. I dont care if it's impacting, just let me do the thing and warn me that certain policies will need to be repaired/updated.

WAN1 port has got 5 different IPs from the same block. I noticed SSL-VPN is active all of those IPs, but I wish for it to only reply to the main address.Are you forced to write a specific firewall policy, or is there a way to only bind SSL-VPN service to a single, specific IP address?

Hi, In the case that a website suggest a list of domains and/or IP addresses, I would like to know how to make a CLI script to either create a new group or add members to a new group. I know the indentation is important. Example: https://learn.microsoft.com/en-us/mem/intune/fundamentals/intune-endpoints?tabs=north-america I was adding things manually but now there's so much that I'm looking into upload CLI scripts. Thank you for your time.

Hi, We have our customer encounter issues with their end users getting VPN locked out and upon checking, the Forticlient still has their OLD passwords.We already disabled the option "Allow client to save password" under VPN Manager > SSL VPN > Portal Profiles > Tunnel Mode Client OptionsSo far, we got multiple different issues on the Forticlient 2 known issue are below.Scenario 1. User able to login and Logout on the VPN. Username and Password are removed upon Logout but still seeing the check box to save password.Scenarion 2. Check box is gone. User is able to login and logout but upon logout, the username goes blank but the password remains.The issue is happening on users whose passwords have been reset by our customer since they are using AD to manage end user accounts. The old password has been saved on the forticlient and we want the option to save the password disappear to avoid the users using their old passoword to avoid being locked outOur forticlient version is