Support Forum

Hi all,  does it possible to create on FGR60 and Hardware Switch interface with port(n) and WAN(n) port? I'm asking because I don't have the possibility to verify directly. Best RegardsAlberto 

Hi guys, i am trying to configure our Fortigates to send scheduled backups to Azure blob storage, but with no success.I've set up a blob containers and a webhook on Forti side, but keep recieving this error when triggering the automation:auto_curl_perform()-107: Curl perform error:22 - HTTP response code said error.__action_webhook_status()-150: Failed to perform curl for url:https://....... ( URL to my containers)Here is my webhook action:---------------------------------------------------------------------------------------------------config system automation-actionedit "HTTP-to-azure"set action-type webhookset protocol httpsset method putset uri "<HIDDEN>.blob.core.windows.net/<HIDDEN>"set http-body "%%results%%"set port 443config http-headersedit 4set key "Content-Type"set value "text/plain"nextendset verify-host-cert disablenextend----------------------------------------------------------------------------------------------I am pretty sure that my Azure configuration i

Hello,After making a research regarding of the (im)possibility to make it work, and some tests on FAZ 7.4.x, I wonder if this is feasible or even in the roadmap. Apparently the log parsers can be assigned to a device only if it is recognized as Fortinet, and appears first as unauthorized. However, sending syslog to FAZ from any device seems to store the logs into the Syslog ADOM, but when you try to assign a parser it's not possible because there is no device to select. Also, even if the logs would come from a Fortinet device (e.g. FortiSOAR), the docs say they would be parsed and inserted in a "SIEM db". But how can the latter be used?Any ideas?Thank youCristian

Hey People!  I would like to raise a concern I have a little knowledge in firewall role. Just wanna regarding on the SSL failed Login. our client want to block the IP address of unknown and random credentials found on VPN event logs. We already block those IP using the deny policy (example we already add the 80.94.95.x) but upon checking the VPN event logs the still existing on the logs. Am I doing it wrong? or is not possible to block the IP using local policy is it possible to minimize this load of logs?. our client said they are already disabled the SSL VPN because they are using IPSEC  the first image is the firewall objectthe second is from VPN event logs Thank you (Version 7.2.8)

Hello Community, We recently upgraded an existing Fortigate Rugged 60-F (FGR-60F) cluster from 7.0.x to 7.2.x.  The cluster was in sync and operating fine in 7.0.x but failed to establish the HA cluster after the FortiOS upgrade.  After troubleshooting this with Fortinet we learned that even though there is only one SKU for order placement (FGR-60F), Fortinet itself has various generations of this hardware platform (currently 5).  The first 2 generations came with only one power supply and since the 3rd generation a 2nd power supply was added to the platform.   The problem now is that FortiOS 7.2.x added new command statements (config system vin-alarm) that only work on gen 3-5 which results in a configuration difference between gen 1-2 and 3-5 that prevents clusters from being able to get in sync. How can you tell what generation of hardware you have?  Two ways:Run the CLI command "get system status" and look for the "System-Part-Number".&n

Hi All, I 'm facing an issue, in the Forticloud report, the user who use the most the bandwidth is displayed as N/A.We use FSSO as authentication method. Have anyone an explanation ?Thank you in advance 

Good day Fortipeeps, I just want to ask if there's such command to get fortigate CPU utilization for specific time? For example diag sys top 2024-11-11. or that command does not exist. Thank you! 

Hi,  New to using FortiSwitch and FortiAP so bear with me. I'm trying to configure a SSID to authenticate users based on a provided certificate they have. We already have this all set up and working using our Cisco AP's, but for this site we are trialing a full FortiNet setup. We also dont have FortiAuthenticator. The SSID is configured to use WPA2 Enterprise and points to our RADIUS server.  It looks like the configuration for the certificate authentication is done on the FortiAP Profile. I have enabled 802.1x and selected EAP-TLS as the type. But its asking me for a username and password and wont let me proceed without it? What is this for as I want the clients to authenticate solely with the installed certificate on the machines? Also, if I have .1x enabled on the profile, can I still use another separate SSID with a PSK for authentication as well? Thanks.

Hi all I have this problem i have 2 vpn tunnels on one Fortigate the external interface is wan1 for both vpn1 --- interface ---wan1vpn2----interface-----wan2 both vpn are working and i can reach a vm on both sides from the lan interface lan ---- vpn1-----ok working.   vm1 pinglan----vpn2--------ok working  vm2 ping now i have on both vpn ends a vm i need to connect vm1 to vm2vm1 ping fortigate lan interfacevm2 ping fortigate lan interface i cannot ping vm1 from vm2 and viceversai have setup routing and firewall policies, maybe i miss something please helpthanks

A few years ago, we transitioned from an on-premises server to using Azure Files Storage for managing our files. To ensure accessibility, we mapped 10–11 Azure folders to drive letters on client workstations via File Explorer. This setup worked seamlessly until yesterday when our ISP replaced our connectivity hardware.Original Configuration:ISP modem (Spectrum) connected directly to a FortiGate device.FortiGate configured with a static IP provided by the ISP for VPN connectivity.New Configuration:ISP replaced the modem with a modem-router combo (to maintain the static IP).Configuration: ISP modem-router → FortiGate device.This resolved our intermittent connectivity issues and improved bandwidth. However, the new setup has caused problems with accessing Azure Files Storage.Issue Details:Symptoms:On my home network (Frontier), I can map Azure file shares on my laptop (Windows 11) as before.On the office network:My Windows 11 laptop cannot access the mapped Azure shares.A different laptop

Hi,I've been reading and tweaking the firewall policy rule to no avail.Made IP lists from official Microsoft web page.Allowed website and application from their official website.Tried with and without SSL InspectionThe policy is put above almost everything else and nothing affect the IP subnet rangeAutopilot won't work (often when choosing Office/365)Nothing is being blocked in FortiAnalyzer except for a few .cabWe're thinking it might be linked to the .cab issue:The DLP is still blocking some .cabauthrootstl.cabdisallowedcertstl.cabpinrulesstl.cabEven if the DLP HTTP-Get is activated or notEven if the file filter for .cab is activated or not.    Threat :Action: blocked    Threat Direction: incoming    Threat Name:data leak by Filter: none    Threat Pattern: disallowedcertstl.cab    Threat Severity: low    Threat Type:Data LeakAny help appreciated.Thank you for your time.

I am currently experiencing this issue-I have connected a phone &behind it a pc to a cisco switch on an ethernet port enforced by fortinac.when i shut & unshut the ethernet port with both the pc & phone connected it stays in a loop.On the switch cli i see fortinac putting the port into admin state down-> applies a dacl -> port moves into correct vlan-> then shuts its down and this happens over & over ,However if i let the phone come up register & thereafter i connect the pc ,its not a problemAnyone experience this?   

Is anyone out there using FortiCloud Overlay as a Service? Why do I feel like I'm the only customer.  We are replacing our old firewalls with Fortinet, and I'm trying to deploy about a dozen firewalls with the Overlay as a Service connecting the offices via SD-WAN. Unfortunately, the IPSec tunnels at two of the locations (my datacenter and HQ) keep going offline and won't come back. It seems like there's something out of whack with whatever configuration is being pushed from the cloud. No one in support seems to understand the overlay cloud service, and the team they escalate to internally never get back to us. We ran a debug and the cloud service IP addresses aren't responding to the VPN requests. I've blown away the entire config and it works fine for a week or so, and then things start to fall apart again. Seems really unstable. 

We are rolling out the FortiClient EMS with an IPsec connection profile to all our users. I have it setup with Azure SAML to perform the authentication, without user intervention. However, sometimes we are noticing that upon reboot the client hangs during the IPsec VPN connection, and as a result it blocks ALL internet access on the device. The FortiClient can't communicate with the EMS Cloud server, and you are unable to open any web pages. The only solution is to reboot or open the EMS client and force a disconnect.  Has anyone experienced this? Some users don't have the issue, while others seem to have it more often. (probably because they shutdown/restart more than others) There's no error, and nothing I can see in the logs that is helpful. Thanks. 

Hello,I have a FortiGate 60F in transparent mode, behind a MikroTik router. I use port3 as external - connected to the mikrotik router and port4 as internal, which is connected to a mikrotik switch.I followed the official documentation to set the FortiGate in transparent mode, and after that, because I have 12 VLANs set on my MikroTik router, I followed this technical note to setup the VLANs and forwarding domains. I configured the forwarding domains, because without that, as soon I plugged the fortigate into the network, it created a loop.Now with this configuration everything seems to be working fine, but when I try to run a ping from the fortigate, or from the MikroTik to the fortigate's management IP, I get DUP! packets:  It is my first time working with a fortinet device, I've read through a lot of the documentation, but I couldn't figure out what the issue is.Thank you in advance for any input.

Hello, I have a forti60f, fortios 7.0.16 build 0667, since I updated the firmware every time it wants to update the fortiguard bases it crash,Sometimes in the logs I saw this messages-Kernel enters memory conserve mode.-The system has activated session fail mode. Without network, without internet and we have to restart it.How can I update the bases without the forti crash? 

Can someone share FAC Upgrade (Path) details

I need to setup a VIP on my Fortinet 101F firewall (FortiOS 7.0.16) that provides SAML authentication in my Azure environment (Azure should play the role of Identity Provider), is it possible to create such an inbound policy using the firewall I have?

I've had this same problem since I've had FortiClient installations managed by EMS (6.0.4.0158) and I don't know if I'm doing something wrong, or this is just expected behavior.  Over the holiday break I assigned a deployment package to the profiles for most computers with the thought they would be upgraded by the time we got back.  That didn't happen, out of about 75 desktops, which are usually left powered on, only 12 upgraded and most of those are ones I upgraded before the break while testing to upgrade.  In EMS most of the PCs state "Endpoint Notified", but if you go to the actual computer there is no message to begin the installation - and as far as I know the deployment settings shouldn't require manual user input so I don't understand why they aren't getting upgraded. I've always had problems with getting EMS to successfully upgrade FortiClient.  It doesn't help that there are no real helpful log messages to help determine why a client didn't get the up

I'm facing issue while accessing the sec boxI tried taking the direct mgmt connection but im not able to ping nor access the sec fgt though the primary box works fine

Hello,I have several RADIUS confs serving several WiFi networks auth.I'd like to have a status return of these radius server using SNMP, but I don't find anything about this in the MIB files.Do you knwo how I can do this ?The goal is to monitor RADIUS availability in Zabbix solution. ThanksNico

Hello, We are on EMS 7.4Forticlient on 7.4.1. We have some machines that occasionally cant connect to SSL vpn. When they hit connect in the Remote access, nothing happens. Our connection is set to use external browser for saml auth and normally it opens edge and authenticates and vpn connects, but when they are having issue browser doesn't open and nothing happens. I have tried setting up a new profile and unticked the use of external browser for auth, still it doesn't bring up the native FortiClient login window for auth, it just sits there, restart doesn't fix, have already tried reinstalling and it keeps reoccurring. The only thing i can find in the fortivpn.log is this error, I can't find anything on web relating to this, does anyone have any idea about this ?[8308:8312] [FortiVPN 1171 warning] fortivpn::StateMachine::HandlePreflight_EnvironmentCompliance environment does not permit VPN connections: Power is suspending.  

is there any limit on the IP address that I can used for ipsec site-to-site tunnels from fortinet firewall to 3rd party firewall like in AWS cloud.currently we have site-to-site ipsec using 172.xx.xx.xx/16 as our MPLS network are all in the range 172.16.0.0 to 172.32.0.0/16.Can we do IP subnet out of this range?

Hi We've been having spotty internet connectivity since adding a 4G interface ( a Teltonika device in pass-through mode) to the SD-WAN on our 200E running 7.2.10. The three fibre interfaces in the SD-WAN are only running 20-30 % utilization generally, and the 4G is weighted as a last resort. The only traffic I see on the 4G is the SD-WAN SLA targets. The 4G does work well enough when I add a SD-WAN rule to force a device to use it. I came across this post saying to not use any-any in SD-WAN rules, and not to use the SD-WAN interface as a default route in heterogenous environments. We did have an any-any rule, that was an easy fix, but regarding the routing, would a zone consisting of 3 fibre connections with different ISPs and a single 4G connection be considered heterogenous? Should I instead be adding a default route for each SD-WAN zone member interface? I can't add multiple interfaces to a single default rule as per the above post.   

I'm doing an exchange program and I use Forticlient VPN to connect to the network of the institution where I study in my home country. It works normally on my laptop with a Windows OS, but when I use it on the computer in the lab, which is Linux, it doesn't work. I don't think the problem is the network or that I'm in a different country because I use the same network with my laptop. We formatted the lab's computer so that I could use it and installed the Kubuntu 22.04 LTS distribution. I installed Forticlient VPN, and when i tried to connect to the network it wouldn't leave the “connecting” status. I searched on the internet and saw that other people also had problems with this Linux distribution to connect to Forticlient VPN and that possibly the problem was the Kubuntu uses KDE. We formatted the computer again, this time using Linux Mint 21.3 (Virginia) and with that I was able to connect to the network but I can't browse the internet. The measurements are 0.4 Kb sent and