Support Forum

solved

Hello everybody! A few days ago, I encountered a problem with my Fortigate F40 hanging. The problem was solved by rebooting, after updating to version 7.2.10, it went into the boot loop. The firmware for an earlier version 7.2.3 helped, then updated to 7.4.5. The Internet disappeared in the evening, then appeared in the morning by itself.Here is the crash log:  1: 2024-10-27 03:36:16 the killed daemon is /bin/sflowd: status=0x02: 2024-10-27 03:36:29 the killed daemon is /bin/sshd: status=0x1003: 2024-10-27 03:48:34 the killed daemon is /bin/getty: status=0x04: 2024-10-27 03:48:46 Interface a is brought down. process_id=1700, process_name="cmdbsvr"5: 2024-10-27 03:48:46 Interface lan1 is brought down. process_id=1700, process_name="cmdbsvr"6: 2024-10-27 03:48:46 Interface lan2 is brought down. process_id=1700, process_name="cmdbsvr"7: 2024-10-27 03:48:46 Interface lan3 is brought down. process_id=1700, process_name="cmdbsvr"8: 2024-10-27 03:48:46 Interface wan is brought down.

Hi, i'm wondering the following... I have 4000 endpoints registered in EMS.  I need to free up some licenses.  I can exclude some endpoints which actually never use the vpn. The endpoint receives a 30 day grace period where they can still connect to the vpn.  What happens after 30days?  They can no longer connect, that's clear.  But the endpoint still exists in the EMS environment?  Or is it cleared up? Secondly, with the Forticlient comes the fsso agent (authenticator).  What happens when an endpoint is excluded from management?  Does the fsso service stop?  Immediately, or after 30 days?  Of does this just continue to work (as the license for this is basically on the authenticator server)...

Does anyone know what's going on with the psirt advisories lately?  They used to drop once a month but they have posted multiple times in October and it looks like they just posted a bunch of old vulnerabilities today. https://www.fortiguard.com/psirt

Hi How do you ensure that when the user locks the pc ,the fortinac disconnects the user from the network ,until when the user logs in again?The user has a persistent agent installed.

Could someone please advise me. I have setup SSO login for SSL-VPN via AAD, but in AAD I have groups for example finance and tech support, but in fortigate I have it all as one group azure - Remote sso, problem is I need different rules for finance and different for tech support, how to make me use SSO, but have multiple groups in fortigate and the female from finance don't have access everywhere like tech support. Thank you for your help!

Hi Guys, New to the forum. I have recently purchased a FortiWifi 30E for home. I would like some opinions and thoughts on what and how to set it up in the best way. For eg. Guest Wifi and Normal Wifi. Would you make a captive portal for guests ? Just use WPA2 ?  Regards,

I'm currently testing out the trial version of FortiClientEMS 7.4, however I've been unable to use it to for one of the key purposes we would need it for - to configure VPN connections on FortiClient devices. The device in question is running Ubuntu 24.10 with a FortiClient installer generated by the EMS. The FortiClient successfully registers and continuously syncs with the EMS, but despite having SSLVPN enabled within the EMS, and a tunnel defined, the "Remote Access" tab just does not show up at all. Interestingly enough, the "Remote Access" tab is there *before* the user connects to the EMS, but once connected it goes away. Within the settings of FortiClient it also has "Enable SSL VPN Feature" unchecked, but there is no way to change this while connected to the EMS. Everything works perfectly fine on Windows clients (which would end up being a small minority if we were to fully deploy FortiClient). I'm kinda at a loss here as none of the logs seems useful. Does

Hello Forti Guys and girls. I have 2 Fortinet devices, 60C and 40F. I want to use 60C as a lab device to test some features, routing policies. But there is a problem. They both have different firmwares. While 60C has 4.0 (can bu updated to 5.2.13) the 40F has 7.2. So there is a question: is there any major differences between two firmwares, mainly differencese in firewall, routing policies? I want to test policies in 60C and then make the same in 40F. Of course I have to make some changes, like interface's names and others.Have a nice weekend!

Dear Fortinet Community. We want to start with a WiFi project and we are faced with decisions to made. We want to choose good FortiAPs and after checking together with our Fortinet suppliers they stated that a FortiAP 231g could be a good solution. Have you some experience with FortiAPs? Which ones are good which ones are not so fine? An does anyone know if a FortiAP 233g is much better than a 231g? This is a very general question :) So feel free to give me some input about your experience :) Every comment is very much appreciated. Ah and before I forget it. We use a Fortigate 100F (7.4.5) at the moment and think about a Fortigate 400/401F for the future. So we already know the limit for FortiAPs when it comes to the point that they should be managed centrally by the firewall. Fortigate 100F can manage up to 128 FortiAPs. Fortigate 400F can manage up to 512 FortiAPs. With kindest regardsFortiLover

For the FortiDeceptor is there an official document (matrix compatibility type) as is done for FMG and FAZ ?Also among the Fortinet Fabric I mentioned below, can you confirm that the ISOLATOR interacts only with these: Fortigate - YESFortiAnalyzer - YESFortiManager - NOFortiSandbox - YESFortiIsolator - NO Best regards

Hello,We have a hybrid configuration on our domain. When we receive mail from our M365 mailboxes to our on-prem exchange mailboxes, the mail is classified as fortiguard spam outbreak. We has opened a case. Tac engineer gave the following suggestion;1) Change the level from 'High' to 'Medium'.2) Place the domain or sender IP in the Safe list (it will bypass the entire AntiSpam profile).3) Create a specific Recipient policy with the AntiSpam profile where FortiGuard Spam outbreak protection is disabled.4) Set the spam outbreak protection time to minimum (6 minutes).I wonder if I change the outbreak protection level to low or medium, how will this affect us?

Model: Fortigate 60C (FGT60C) When connect to console it has the following error message. The firewall can boot up and functioning. Is there any way to replace this disk ?And what disk is this ?What is the function of fgtag.c ?  Thanks.   

Hello everyone,I have a single IP address on which I'm going to publish multiple websites.IP is set on one of Fortigate's interfaces. How can I tell FortiGate to: External DNS:aaa.test.com -> My Public IP1bbb.test.com -> My Public IP1ccc.Hello.com -> My Public IP1 1. DNAT "https://aaa.test.com" To "192.168.1.50"1. DNAT "https://bbb.test.com" To "192.168.1.60"3. DNAT "http://ccc.hello.com" To "192.168.1.70" *192.168.1.50,60,70 are VIPs on FortiWeb. It should send traffic destination-ed to each VIP to desired web server.* All client's requests must point to default HTTPS port. All web servers also must only listen over default HTTPS port.

I am using FortiGate 81E, running OS 6.2.3 with the following setup:- Two WAN ports are connected to the ISP using PPPoE mode. WAN1 has a distance of 5, and WAN2 has a distance of 10. Both are ON with the option "Retrieve default gateway from server" and OFF with "Override internal DNS."- WAN1 and WAN2 are members of SD-Wan at the exact 0 cost.- A static route 0.0.0.0/0.0.0.0 -> SD-wan interface has been added.- There are multiple VLANs configured under Aggregate Link (downstream LAG to my Cisco switch), let's say vlan-10, vlan-20, vlan-30.- Policies to access the Internet have been added for all Vlans above (source is vlan-x interface, and destination is SD-Wan). ** When there is just a default implicit SDWan rule with its Load-Balancing Algorithm, all nodes from above VLANs can access the Internet but are unstable due to sessions being switched between WAN1 and WAN2 continuously (look at the Forti View -> All Sessions and see the destination interface switching b

Hi all, I have a device nas with static ip 192.168.10.10 and I would like if a user mount a disk with ip 192.168.100.10 the fortigate had to redirect 192.168.100.10 ip to 192.168.10.10. it is possible? if yes how can I do it?many thanks in advancebest regards

Using a combination of a Webhook automation stitch, External Connector, and a Linux machine running a simple webapp, it is possible to automatically add malicious IPs (e.g. brute-force SSLVPN login attempts or otherwise) to a threatfeed and prevent the IPs from accessing the resource. This tutorial will walk through the setup for banning IPs that have multiple failed SSLVPN login attempts.Full disclosure, I'm not a programmer and ChatGPT helped with the python code.  On the Linux machine, install fail2ban: sudo apt-get update sudo apt-get install fail2ban  Create a custom Filter to match the malicious IP in a log file. sudo nano /etc/fail2ban/filter.d/fortigate_remote_ip.conf[Definition] failregex = remip=(?P<ip4>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) ignoreregex =  Configure a Jail (note: creating a jail.local file will override the default fail2ban jail settings):Adjust "maxretry" depending on number of times you want to permit failed a

Dears, I recently configure SSL-VPN on my Fortigate 40F.The connection is successful in my iPhone.Howevver, I found that I can only connect to our internal NAS/server using its private IP, like 192.168.3.x.I have set the A record of our NAS/server with their private IP but it not works. Can you advise what should I do to connect to our internal NAS/server with its FQDN?Thank you.

Hi guys,I have my main FGT which has area 0.0.0.0 and some other areas which are connected to other sites via OSPF.When I am directly connected to a subnet which lies in area 0.0.0.0 I can access everything, also I see that every route is propagated nicely. Now as I use OSPF I do not have any routes to the sites nor do I have policies with IP-ranges - just the regarding OSPF-interface tunnel with destination all.Now my problem is when I connect via IPsec or SSL I cant see anything. I read already that you should do a static route to blackhole/ssl.int with the right ip-range and then redistribute static... I then saw the subnet on my branch-sites, but couldnt access them nonetheless. The policy was sourceintf SSL/IPsec - destintf Site1/2/3/xxx. sourceip the right IPsec or SSL range and destination all... I had the right network in the OSPF-network list, I had them as passive,...What is it I am missing? ThanksRaffa

Hi. I would like to modify something. Nowdays I have a App Control that block some sites like FB or Windows Update Application. I would like to restitct it and create a speed limit to thath Apps. I read something, but I don't know is my idea a good solution for that. I reda about Traffic Shaping. Maybe I write point which I want o do:1. Create Traffic Shaping named "limited" with max bandwidth of 256kbps and guaranteed of 100kbps ond Medium Traffic priority) and apply sharper "per policy"2. Create 2 sharping polucy for that  all sources to wan port. One is "high priority" and one is "limited". In limit it by choose "windows update and YouTube in Application section".3. Whats the good order for that policies? First "limited" and then "high prioity" or vice versa? I musct create a "high priority" policy or I can create only "limited" to restict YT i Windows Update transfer? How can I see that this is working?  Thanks and have a nice day

Hi Fortinet communityI’m currious to hear if anyone has experience or would share their journey towards SD-WAN / SD-WAN zones from a running production FortiGate. I’m managing serveral firewall, all currently build with “normal” interface added to zones etc.FortiOS v6.4.9FMG v7.0.3The interfaces and zones are all referencer in many different policies.I do manage all FortiGates via FortiManager. I’d like to add the interfaces / VPN-interfaces from zones to SD-WAN zones, to start using some the SD-WAN features i.e performance SLA for best egress port. Many of our FortiGates have Dual ISP connection (WAN1 + WAN2) and redundante IPSec / ADVPN tunnels and using BGP for dynamic prefix announcements. However, as I can see - I can’t just move an interface from a zone to a SD-WAN zone, without removing it from the zone first.Then I have to deal with the change to all the IPv4 policies in regards to source / destination interface, where the SD-WAN needs to replace the old zon

Hi,  I was reading the FortiGate antivirus topic from Fortinet website. Also I tested them in my test environment by downloading the file from ecior.org. What I found, until or unless you don't use SSL/SSH decryption profile, this antivirus profile is  helpless which means that unless or until we don't do the SSL decryption the encrypted files cant be scanned. Is this correct assumption ? Moreover, can any one please help me to point in right direction that where can I find more information about CPRL ?

Hi,  I am looking for an ideas to test the proxy based and flow based mechanisms. Today in my lab environment, I configured FGT-VM and windows machine. FGT is carrying all the traffic from Windows machine to internet. First I configured FGT with flow mode and then tried to open different websites such as cnn.com, bbc.com. I also checked the load timing (loader timer extension is added in chrome) for these websites and then marked that timing.Then I changed the inspection mode in policy to proxy mode and checked again, I didnt find any visible difference in loading time. Its quite possible that this is the lab environment and couldnt able to see the difference because of low traffic but is there any way we can actually test both inspection modes apart from features which are only used for specific inspection mode ?

We recently made some changes to our DNS server which now has a new IP addess.  When connecting via Forticlient, all network adapters are reverted back to the old IP address causing network drive mapping issues. Changing the settings on the adapter will work while connected through the VPN, but no matter what, the next time a user logs in, the old settings take precedent again. I have manually configured the adapters to the correct DNS address.I have done all the ipconfig / related commands I have tried other solutions from similar posts on this forum and others, but nothing prevents the VPN from changing the settings. Has anyone run into this before, or know of a solution?

Hi guys,  We would like to seek similar encountered issue and how did you guys resolve this. We're currently encountering an issue regarding our Web Filter as wherein all access going through internet policies with Web Filter encountered web rating error occured. Had to create a temporary policy without added WebFilter Profile however this impose risks.  What should be the workaround for this one for it to work properly again? Suggestions are highly appreciated. Thank you in advance.