Support Forum

Hello All, The Microsoft Defender Endpoint vulnerability scanner is detecting the following vulnerable files created as part of the Forticlient 7.4 VPN Installer, all with the version number 3.1.5.0:c:\program files\fortinet\forticlient\libcrypto-3-x64.dllc:\program files\fortinet\forticlient\libssl-3-x64.dllc:\program files\fortinet\forticlient\x86\libcrypto-3.dllc:\program files\fortinet\forticlient\x86\libssl-3.dllThe listed CVE's against these files from MDE Show as:CVE-2024-2511CVE-2024-4603CVE-2024-4741CVE-2024-5535CVE-2024-6119Is the Forticlient 7.4 VPN software vulnerable to these CVE's because of the libcrypto/libssl dlls present in it's install directorys?

Hi,On FortiGate 100F I create vlan50, vlan60, vlan70 and make port1, port2 as trunk(vlan50, vlan60, vlan70), how can I make port3 access vlan50?

Hello everyone, I am in the process of building a short report for firewall policy usage and I am having a bit of a time trying to retrieve the firewall policy usage from any "diag" commands. Unfortunately, I don't have API access to the devices that I will need to run this against. Any thoughts appreciated!

Hello, I use the forticlient vpn an android 8.1 for sslvpn. I would like to use client certificates and username/password to authenticate. I need to use the certificate store from my android device to select the client certificate. At the moment only an import of a PKCS12 is possible.Is there any chance to use the certificate store from android? I know other vpn clients like openvpn can use this, but these client can not connect to my fortigate 101E. Thanks Markus

Dear Support Team,I am writing to seek assistance with an issue I encountered on your platform.Under https://fortiphish.com/users all Azure AD Users wer added, I can see them.Under https://fortiphish.com/user_groups I see all Azure AD groups.But when I create a campaign https://fortiphish.com/campaigns/create in step 3 Select a target I only see the Azure AD groups.Why?I look forward to your response.

Hello everybody, some days ago I received this error on my Fortigate F60 (v 7.2.10):msg="User shutdown the device from forticron. The reason is 'System file integrity check failed'"I searched for this error and I found the following guide: https://docs.fortinet.com/document/fortigate/7.2.5/administration-guide/249947From this guide, I didn't understand very well. I'll try to explain:what I understood is that this error appears beacause BIOS security level is 2 (I confirm) and, because the firmware (as well as the AV engine etc.) is signed by the Fortinet CA and a third-part CA, this integrity check fails.Now, I have two question:1) Who is this third-part CA?2) If there is an integrity check error, how is it possible that the solution can simply be setting the security level to 1? How can we simply ignore this error?I think I'm missing the point. Can someone explain to me this concept in a simple way?Thank you so much!

Dear community, we have laptop users whom which are connected with VPN's based on US. but on the same laptops softphones are installed. which are connected with local SDWAN interface, calls works smoothly but if we bring local interface down and we switch to VPN for the backup. calls still established but one way audio occurs while switching. 

Hello everyone, I'm trying to create a small VM lab based on a FMG and a few FGT. I did set up every VM correctly but I'm facing an issue whenever I add a Fortigate to the FortiManager and try to push a new policy package to the FGT. Looks like it's a problem about certificates. Install History:HUB-1 80% 2020-07-02 05:12:34:fgfm install state: prepare to post-checksum HUB-1 90% 2020-07-02 05:12:40:post-checksum state: start verification HUB-1 95% 2020-07-02 05:12:44:verify state: install OK/verify FAIL Install Logs: Starting log (Run on device) Start installing FortiGate-VM $ config vpn certificate ca FortiGate-VM (ca) $ edit "root_CA2" FortiGate-VM (root_CA2) $ set ca "-----BEGIN CERTIFICATE----- FortiGate-VM (root_CA2) $ MIIDADCCAeigAwIBAgIgRTk2MjE0OTk5NDk3QkM3NUREQTQyRURBMTg4NEExQ0Qw  ... FortiGate-VM (root_CA2) $ iXJK2fIdzPWUqEHExeVawvcCZBxzpw7dwB5fdKCyZ6Zj+FVVY+Q+TrPNyIfiirRc FortiGate-VM (root_CA2) $ vi5lVQ== FortiGate-VM (root_CA2) $ -----END CERTIFICA

Hi Team,   Is there a Windows11 Pre-Configured VMs for Customized Virtual Machine in FortiSandbox ? In the below help.fortinet.com, it only has till Window 10 https://help.fortinet.com/fsandbox/olh/2-5-1/Document/D00_Create%20Custom%20VM%20Image/Appendix%20D%20-%20Custom%20Pre-Configured%20VMs.htm #Fortisandbox

Hi Team, I have Head office and multiple branches around 30, want to configure Ipsec vpn so that all branchces communicate to each with head office. Can anyone suggest perfect method to achieve this task.  Thank you.

Hi All,We have issue to start LVM on Fortimanager OS (see below pictures). Do you know what could be missing? System InformationHost NameFMG-VM64-XEN Serial NumberFMG-VM0000000000Platform TypeFMG-VM64-XENHA StatusStandaloneSystem Time Mon Sep 02 01:57:15 2019 PDT Firmware Versionv6.2.1-build1121 190718 (GA)  For any further information, do not hesitate to contact us.Thanks in advance.Anargyros

Hey, We have 4 locations that we use Aruba APs and works well. Now we have 1 more location and have 4 AP's in the location. AP02 is the VC that assigned by Aruba Central and we cloned the working location's configs in this location. After that, we created VIP .20 and added to the FortiNAC. Credentials are working but in this location we can't see the ports or SSIDs. How can we solve that? Thanks in advance. This is the new location; Working location;

Hi, I was trying to create dedicated HA management port for the firewall cluster but "mgmt" wasn't listed as option under HA config. Could you please advice if i have missed any configuration here.# showconfig system interfaceedit "mgmt"set vdom "root"set ip x.x.x.x x.x.x.xset allowaccess ping https ssh snmp fgfmset type physicalset dedicated-to managementset role lanset snmp-index 2nextendFW01 (mgmt) # endFW01 (global) # config system haFW01 (ha) # set ha-mgmt-status enableFW01 (ha) # config ha-mgmt-interfacesFW01 (ha-mgmt-interfaces) # edit 1new entry '1' added# set interface<string> please input string valueha interfacenpu0_vlink0 interfacenpu0_vlink1 interfaceport1 interfaceport2 interfaceport3 interfaceport4 interfaceport5 interfaceport6 interfaceport7 interfaceport8 interfaceport9 interfaceport10 interfaceport11 interfaceport12 interfacex1 interfacex2 interface# set interface mgmtnode_check_object fail! for interface mgmtAppreciate your response. TIA :) 

We have a Fortigate 201F and its connected to the Internet and licensed for software updates, however, we noted that it is not showing the new firmware version 7.4 as available for download, the firewall is running version 7.2.10 and indicating that as up to date. We have another 201F installed at another location and that one has version 7.4.1 What could be the reason why this firewall is not showing the 7.4 version to be available for download? Regards.

Hi I did setup my ubuntu server to use SSH keys for authentication. I created a VIP to be able to access the server from outside and used proxy based mode. The connection fails when I trying to connect to the server. what would be the solution?

hi,i plan to configure SNAT in a FG with multiple VDOMs.i currently have the "internet VDOM" topology wherein "internet" VDOM act as our internet edge device and all downstream VDOMs will connect/flow through it to go to the public internet.my question, if i create a FW policy WITH SNAT in "VDOM-1", do i also create FW policy WITHOUT NAT in "internet VDOM" for traffic flow continuity?   

Hello,We have deployed a Fortiproxy VM, and we already configured it and now we want to increase de size of de disk, wich is with the default of the OVF file wich is 32GB.Is there a guide to increase de size? I would assume we have to execute some command on the proxy after we increase the size in the ESXi side?Fortiproxy version: 7.4.x Any guidance please...Thank you in advance.Regards.

A IPSEC tunnel is already working from the main office to the Web App (3rd Party). What we need is traffic destined for the third party to pass through the main office from the remote office, which already is using an IPSEC tunnel for traffic to the main office. The company has only paid for 1 VPN tunnel, so I can't go directly from the remote office. I would appreciate any help. If more information/images are required, please let me know. Both the remote and main office firewalls are using Firmware v7.2.5 build1517 (Feature) 

Hi,In one of our Interface (Explorer Data), the DNS Server was set as "Same as Interface IP".1. What DNS will the end device will be getting? We would like to know what DNS it was using if the end device uses FQDN, how it resolves its FQDN to IP Address. DNS Servers - SpecifyPrimary DNS server - 1.1.1.1Secondary DNS - 8.8.8.8 2. For the "dynamically obtained DNS server", what is its purpose? Is it the "same as interface IP", and would this be used to rely on the DNS server or FortiGuard?" Appreciate your comments and Thank you in advance.

hey, we are facing the access block issue on our website. it says you're not allowed to visit this. can anybody help me to fix this?

I have a customer in Canada reporting that he can’t access to our website and he got this alert from Fortiguard.It says "FortiGuard Intrusion Prevention - Access Blocked""You have tried to access a web page that is in violation of your Internet usage policy. Category : Phishing"Our website is https://www.wavepia.com . Apparently your system is defining us as a threat or something which is not. Please advise what we should do to regain our customer’s access to our website without your system blocking.

I am experiencing some strange issue when accessing sage on a server in the USA, that's only accessible via the GlobalProtect VPN platform. when on LAN using the cable, i can access sage but when on Wi-Fi via FortiAPs (221E) I cannot access sage. the policies for the cable and Wi-Fi are identical. I ones tested this on different network that has more or less the same setup as mine, with 221E fortiaps and 100F Fortigate fw and it works fine with no issues.

This is driving me mad.I have set up an IPSec VPN and want to limit it to a certain set of destinations.As I have two WAN links up, I'm connected on one and playing with the VPN settings of the other.I thought I understood how this works, but I'm now utterly baffled.I'm connecting with the FortiClient. I have my static routes pushed through OK so I can route to the destination network I want.Now when it comes to policies, I have set up a policy which has from the remote tunnel to the destination but this doesn't work.If I change the policy so the source interface is "any", it works.If I then change the policy so the source interface is the Remote Access WAN interface that's set up, it doesn't work, traffic gets dropped and is picked up by the default deny policy at the bottom.When I have the policy configured so that the source interface is "any" and it works, if I look at the policy logs, I can see the source interface is my RA WAN.So why doesn't it work when I set it to that interfac

I have two phones that are not registering with Fortivoice that are behind a site-to-site IPSEC VPN. The reason in Wireshark is. I can ping both sides with no problem and the DHCP option 66 is configured.  There not much information about this in Google or any other documentation available. I hope anyone can help Spoiler (Highlight to read)NOTIFY sip:MACd476a0f758ce@xx.xx.xx.xx(Phone IP) SIP/2.0Via: SIP/2.0/UDP xx.xx.xx.xx:5656(FortiVoice IP);branch=z9hG4bKbK4f1731334589;rportRoute: <sip:MACd476a0f758ce@10.100.101.201>Max-Forwards: 20Contact: <sip:xx.xx.xx.xx;transport=UDP;handler=dum>To: <sip:MACd476a0f758ce@xx.xx.xx.xx>;tag=e9b466de-2d30-48e6-80c1-d33fc386c2adFrom: sip:MACd476a0f758ce@224.0.1.75:5060;tag=888888286Call-ID: 9c0ee096-b8a6-472a-ade1-66fa8cfb4affCSeq: 286 NOTIFYContent-Type: application/urlSubscription-State: terminated;reason=timeoutUser-Agent: FortiVoiceEvent: ua-profileContent-Length: 37NOTIFY sip:MACd476a0f758ce@xx.xx.xx.xx(Phone IP) S

Hello,  we have a working tunnel (up) from one location to the other. From the remote location, the ping arrives our firewall, but it does not reply to them (they get timeout).Our ping seems to go through our firewall, but does not arrive the remote location (we also get timeout).Both traffic is visible in the logs.Policys from remote subnet to local subnet are there and vise versa. At least on our location, I'm waiting for response from the remote location. Also we have a (in my opinion) working static route for the remote subnet, pointing to the vpn-connection.   Same interface / ip is also used for a second ipsec tunnel and this one is working fine (I get icmp: echo reply)Any ideas or troubleshooting hints?thanks