Support Forum

Hi All,     I've noticed a difference between FortiManager and FortiGate that I want to understand, and I'm hoping someone can help.We have a group of FortiGates (v7.4.5 build2702) that were recently added to a FortiManager (v7.4.5 build2553). If I log into one of the FortiGates, I can see that we have an SSL-VPN setup that limits access to specific hosts and then has two groups of hosts - but the negate switch is turned on, which means anyone can try to connect EXCEPT someone in one of those groups:  When I look at the same config in the FortiManager, there is no negate switch, meaning only those groups can try to connect - the opposite of what we want:  My concern is that if I push the config from the FortiManager, it will not push the negate switch, and I'll lose access to the firewall as I'm coming through the SSL-VPN.If you're building a VPN from scratch, how do you configure the negate switch in FortiManager? Thanks

How to do we restrict SSL VPN connections from active directory domain joined machines only? Plan is other devices should not be able to connect SSL VPN.  Thank you!

Hi All,Been searching through docs but haven't found a clear answer...What TCP / UDP ports are required for FortiClient to comm with a cloud hosted EMS? Is it all just over TCP 443?And then - with all the individual services (exe's) installed with FortiClient, which specifically will comm with EMS?If there is a doc published somewhere please share;Thank you!FortiClient FortiCloud Products 

Hi there, I need a little help, everything was working well yesterday, I was able to create and deploy phishing campaigns normally, but today when I tried to deploy new campaigns suddenly all my new fortiphish campaigns are stuck on processing and not sending e-mail anymore. When creating a new camaign, sending the test e-mail works normally, looking my licenses everything is ok, anyone had this issue before? best regards

Hi FGT/FAP adminsI have a SSID in tunnel mode where I enabled "block intra-SSID traffic".Now I need to allow intra-SSID traffic only between some specific clients on some specific ports. Is there a way to do that? I mean just the same way we do with zones (deny intra-zone traffic then enable exceptions with firewall rules).

Hello, i got problem when cant upgrade firmware,there is pop up "No available firmware From Fortiguard", i have try this method https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-No-firmware-available-from-FortiGuard-under/ta-p/198619 this the result  FortiGate 

Hello Fortinet Community,I am currently working with a FortiGate firewall 61F v7.2.6 setup where I have a VLAN switch interface named bgroup0 with a physical connection to internal3. The IP address assigned to bgroup0 is 192.168.1.1/24, and it is connected to an Aruba switch.The goal is to have new devices that connect via LAN cable to the Aruba switch send DHCP requests to the bgroup0 interface. However, for security purposes, I would like these devices to receive IP addresses from a different subnet, such as 192.168.2.0/24. I initially tried using a secondary IP, but due to subnet conflicts, this did not work as intended.I am considering configuring DHCP Relay on the bgroup0 interface to forward these DHCP requests to another DHCP server(internal2 or internal5) that is configured to assign IP addresses in the 192.168.2.0/24 range. However, I am uncertain about the exact configuration steps required to achieve this.Could anyone provide guidance or confirm if this approach is feas

Hello,- We use "Forticlient VPN" software to connect to our organization network from external sources (e.g. computer at home) through our Fortigate firewall.- We use "Forticlient" (Zero Trust Fabric Agent) as the antivirus solution in our organization PCs (they connect to our "FortiClient Endpoint Management Server").What are the steps to run both VPN client and antimalware client on the same computer? We need to connect to our VPN from a laptop which has got "Forticlient" (as antivirus) installed, but it looks like it's not possible to have both that and "Forticlient VPN" installed ad the same time, and the Forticlient doesn't show any VPN-related option, so we are at a dead end. I guess there is some way to enable the VPN features in the Forticlient software, but I have no idea how.Any help would be very appreciated, thanks!

HelloFortiWeb 6.3.9 and FortiAuthenticator 6.4.9.My FWB is configured to authenticate admins (for admin access) via RADIUS authentication with FAC and it works just fine.This issue comes when I want to use HTTP authentication, for users when they want to access some protected Web servers.I configured like explained here:https://docs.fortinet.com/index.php/document/fortiweb/6.3.9/administration-guide/467409Now when a user tries to access a protected server, it shows HTTP authentication window, but when user enters correct username and password, FWB still returns error 401 (unauthorized), even if my FAC logs show the related authentication was successful.For info on FWB's RADIUS config, when I test the authentication with the same credentials it works fine.

I need to use Azure Front Door as a WAF up front to on-premis Fortigateand with the FrontDoor_Header_Check - used to Application Control function block whole traffic except FrontDoor ID and i'm not sure how to create/which parameters to used to custom app signature for this traffici have only X-Azure-FDID number, i can't find anythink corrent in to Azure documentation https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-apply-and-validate-a-custom-applica... is not really legibledoes someone have any experience with this and can give me any direction?

Hi Forum,I have recently tried to upload a number of large zip files (500MB - 2GB) onto FortiSandbox for analysis.I have checked the settings, even 2GB should still be allowed.However, I am stuck on 100% on the uploading process until timeout (increased to 60mins) kicks in.I have also tried to change the prescan-config time but it does not allow somehow,https://docs.fortinet.com/document/fortisandbox/latest/cli-reference/707722/prescan-config I then split the files into multiple smaller files with 7zip.But somehow only zip.001 has promising file count (e.g., 1001) and the rest (zip.002, zip.003, etc) only have 1 file count. Here are my questions,How to change the prescan-config if it is why my uploading process got stuck?How does the scanning mechanism work? Would the analysis still be accurate for multiple split zipped files?If multiple file anaylsis is feasible, how do I consolidate the multiple reports into one?Thank you!

Hello, Our user need access to 3rd party application via VPN, they use Sophos VPN for VPN client.This traffic is blocked by fortinet because of the application control, then i make 'application and filter overrides' for OpenVPN and the user is able to connect to the VPN now.With this condition the user can access to any OpenVPN address. Now can we restrict to only allowing use OpenVPN if the destination set to 'vpn.mycomain.com' and block the rest?   

We are thinking about making the jump to it and getting off the 7.0.x branch (mainly for missing features).The upgrade path tool seems to indicate it would be a two step process- we'd have to go to 7.2.10 and then 7.4.5Any big surprises / issues we should be wary of, either during the upgrade process or with daily use of 7.4.5?

Hi , I am preparing for the NSE 6 Security specialist exam. Is this mandatory to write the 4 specialist exams to clear the NSE 6 certification?  Certificate Name: NSE 6 - Security Specialist Requirements: Complete 4 Fortinet Specialist tracks Exam: Specialist Exams[style="background-color: #ffff00;"] (or coursework where no exam exists)[/style] Recommended coursework: Fortinet Specialist courses In this what it is mean by (or coursework where no exam exists) . Instead of writing the exam can we complete the NSE 6 certification while going those self placed courses? [ul][style="background-color: #ffff00;"]FortiWeb Self-Paced Course[/style] + FortiWeb Facilitated LabFortiWeb Instructor-led Course + Lab  .FortiMail Instructor-Led Course  .FortiWireless Course .[style="background-color: #ffff00;"]FortiAuthenticator Self-paced course[/style] + FortiAuthenticator Instructor-led LabFortiAuthenticator Instructor-led course and lab.FortiDDo

Hello everybody, I have a Fortigate F60 device (v 7.2.10).this Fortigate is implementing a conditional DNS for the Wi-Fi interface.For some internal domain, I registered some DNS records:192.168.1.1 is the router address.Normally, everithing works, fine. If I try to ping one of the registered names (for example vpn.xxx.com):   10.1.0.1 replies to the echo request. 10.1.0.1 is the Fortigate address.These are my network settings:  So far, so good. Now I try to connect via Cisco Secure Client to a VPN.Regarding network settings, nothing has changed. My address is the same, Router address is the same, DNS address is the same. The interface is the same, so, if I ping the same address as before, I expect 10.1.0.1 to answer (as before), but now: 79.9.x.x is replying. Who is 79.9.x.x? Is the Fortigate WAN interface:And the domain vpn.xxxx.com, if I put it into the browser, is not reacheable anymore, because I think DNS is not functioning correctly. What am I missing?Thank you fo

I'm using a Fortigate 4200 running firmware 7.4. Most of our rules use FQDNs like www.microsoft.com but this seems very permissive. Ideally we'd like to examine the actual URLs being used and restrict i.e. allow things like http://www.microsoft.com/crl or https://www.microsoft.com/crl.  We have many applications/systems that don't support explicit proxying so explicit proxy is not an option.  So in the absence of using an explicit proxy is this possible? 

I am using FortiClient VPN Version 7.4 on Windows 11 24H2. When I connect to the VPN using FortiClient VPN, an IP address is not assigned, and I am unable to access the internet after connecting to the VPN. If I uninstall and then reinstall FortiClient VPN, it connects without any issues the first time, but from the second attempt onward, an IP address is not assigned, and I cannot connect to the internet. This issue occurs on two identical PCs. Of course, when using the VPN, the Wi-Fi is set to DHCP. If anyone knows the cause of this issue or has experienced the same problem, I would appreciate your help.

Hello guys, in our Fortigate we have list of few hundreds dynamically assigned IPs in Quarantine.And I found this topic, where is some Quarantined MAC addresses are automaticaly filled into Address Group list named Quarantine Devices. https://docs.fortinet.com/document/fortigate/6.4.0/administration-guide/900942/quarantine So I am courious is there some way to do similiar thing with our list of IP addresses? We want to create deny rule in firewall with this address group.     

Hello, Can you recommend some basic/advance tests to apply on the Firewall after configuring it, to ensure that everything is working properly. Thank you,

HI, i am trying to configure authentication with LDAP in my fortiweb just for admin user I configured:  https://docs.fortinet.com/document/fortiweb/7.4.5/administration-guide/410257/grouping-remote-authentication-queries-and-certificates-for-administrators#Configuring_tacacs https://docs.fortinet.com/document/fortiweb/7.4.5/administration-guide/286471/administratorsFortiWeb #ldap if i do a test user in the remote server configuration i get succeful, but if i want to loggin with the ldap user i am not able.   

Hello everyone!I am experiencing some weird behaviour with login on Fortigate device with os 7.4.4 and 7.4.5.I can successfully login on the device with whatever username (but no one local username, try for example username: qwerfdsa) as long as the password is correct (the password of a local user or from a tacacs+ server).I discovered this by mistakeThere is anyone who also discovered this problem?And also, there is a way to solve this problem?

Hello,In the NSE guides Fortinet says that at a minimun you need 2 FortiGates and a Fortianalyzer.We are deploying 1 Fortigate,1 Fortiproxy and 1 Fortianalyzer.Being that fortiproxy is VERY similar to Fortigate in many aspects, Can I set up the Security Fabric with these 3 devices? Maybe selecting the Fortigate as the root device,and the proxy as a downstream device?All verisions: 7.4 Thank you in advance.Regards. 

Hello everyone,I am pretty new to Fortinet community and I need some help regarding the activation of MFA SMS functionality on Fortigate 60F 7.2.9. :)If I understood correctly, we have 2 options: getting a FortiGuard Messaging license or getting a 3rd party provider SMS gateway. Either way, the documentation says I need to configure SMTP server.Is it necessary to go through SMTP server, that is to go through email2sms or can I just go directly and define my custom sms-server (provider's domain) and sms-phone to which I want the OTP to be sent and if it is necessary why is that if it's not too much of a trouble explaining?

HI All, Have a setup where I have a pair of Fortigate FW cluster (A-P)  connected into ACI Fabric under a VRF1. Have BGP configured to learn routes dynamically . There is a new requirement to create a new VRF2 on the Fabric and move this BGP connection onto that .While configuring this on the firewall we plan to create a new interface in the same zone and plan to move traffic from Link 1 to Link 2. Now it is understood that when we do this we will end up breaking existing connections which are in the session table ( with successful 3 way handshakes) . Trying to find a solution where by we can move the traffic from the primary link to secondary link without impacting existing connections. Any ideas ?

Hello,we are using FortiAnalyzer together with the Outbreak Detection module. To make our work as easy as possible, we want to work with playbook We know how to create a playbook for a handler and also for a report. The problem with the Outbreak Detection module, however, is the large number of handlers, each of which has its own report. We want to save ourselves the work and do not want to create a separate playbook for each handler. So the question here is whether and how a playbook can be configured for all handlers? FYI: We already know this community contribution, but it is no help to us.https://community.fortinet.com/t5/Support-Forum/Custom-Playbook-to-notify-for-any-Outbreak-Alert-FAZ/td-p/289890 Thank you