Support Forum

I am running Forticlient 7.4.0.1636 under Ubuntu 22.04 to connect my company's VPN.My problem: In the settings menu, if I unlock it , change some settings below, and then connect to VPN, my changes are not saved, and they return back to original values as below:  I want to change these settings because :1) Logging causes constant pressure on the disk I/O2) I have to click multiple popups to accept invalid server certificate and unnecessary confirmation dialogs everytime I connect.See below for screenshots: How can I modify the settings so that I can reduce number of steps when connecting to VPN ?

I'm in the lookout for a new VPN Client as FortiClient has been a pain in the behinds. Especially as some core features are behind a paywall...I'm currently seeking alternatives that support SSO. Unfortunately i'm not aware of any.Is there any client VPN you guys use that is much better than FortiClient and support SSO?

Invaild port number 255scsi_print_error[1130]scsi errorFORTIGATE 300D

Hello everyone, I'm currently having an issue with the SAML SSO option in FortiClient (V7.2.2 -> V7.4). We use the feature "Enable Single Sign On (SSO) for VPN Tunnel" to authenticate. We also enabled the feature "Use external browser as user-agent for saml user authentication". In the past, when signin in, we had the option to choose a microsoft account. Because we have multiple clients that use this configuration, this feature worked great. Since a few days, the button "SAML Login" signs me in with the account that is already signed in (my personal work account). However, this account is not recognized in the tenant of our customers (of course). Are there any other people having this issue? What did you do to resolve it? It seems that the Sign-On URL withing the SSO Configuration is wrong. We need the option to choose between accounts back :). Thanks in advance!

For FortiDeceptor is it possible to configure a different port than port 1 (used by mgmt network) with function for license validation, FDS services, Web filtering and other ?Speaking of the physical appliance can ports 2 through 8 be used only to deliver the decoy services ?Thank everyone in advance!

I've recently migrated our primary firewall from an ASA to a FortiGate 600.  Don't get me wrong, I love Cisco but the FortiGate firewall has been a HUGE improvement and I don't regret the change for a moment!  However, there was one thing about the ASA that I loved and has saved my butt more than once.  With every "commit" I made, I had the ASA spit out a CLI of what change I just made.  So like if I made some new service ports in the ASDM, when I hit "apply" I'd get an out put like so:object service TCP-7046service tcp destination eq 7046description Nav Client Servicesobject service TCP-7047service tcp destination eq 7047description Nav SOAP ServicesThen I would copy that info and place it into my own personal change log with a little note of what I was doing, so I've got my own personal change log of every change made.  An example entry:4/30/20241. Create the NAV ports on the ASAobject service TCP-7046service tcp destination eq 7046description Nav Client Serv

Hello, I hope this message finds you well. Below is the detailed information regarding the issue we are experiencing with our Fortigate 6300F with FortiOS 7.2:1. Detailed Problem DescriptionWe are using a Fortigate 6300F configured as an explicit proxy. The Fortigate restricts access to certain categories, such as Instant Messaging (e.g., https://zoom.com). When a user attempts to access these restricted categories, a warning page is displayed. The Fortigate generates a certificate signed by a custom CA certificate that we uploaded (not the default one). However, after the user proceeds past the warning page and is redirected (e.g., to https://zoom.com:8010), the Fortigate uses the default certificate instead of the custom CA certificate. Please note that we have cloned all the default SSL inspection profiles and configured them to use our generated self-signed CA certificate. We are only using the certificate inspection profile, not full inspection. We would l

Hi all,  I hope you can help me, I have a 2-Tier MCLAG setup with 4 x FSW443 and 2 x FG80 appliances. I'm having some unusual network behaviour which let me to investigate and upon running the diagnose switch mclag peer-consistency-check command on my FSW I could see that the link to my FG didn't look right as below:   On all of my other deployments, I have checked and confirmed that these FortiLink interfaces when running the same command are OK, UP, OK and do not display the "NOT-FOUND" like this. The switches are visible, online and accessible from my FG and I have tried deleting the trunk and re-establishing but I cannot get this state to change.  Anyone have any ideas as to what the issue may be? I'm currently running 7.4.4 FG, 7.4.3 FSW and 7.4.3 FortiAP.  Thanks, Dan.  

Hello, I have a FortiSIEM on VM, the license expires in 1 month and we will not be able to contract support again until the first days of next year.The question is what will happen when the license expires, what limitations does it have?Is FortiSIEM still functional?Thanks.

Hello everyone,We are using the vulnerability scanner from FortiClient.The scan takes one hour and 15 minutes on Windows 11.I have already tried different versions of FortiClient (7.2.5 and 7.4), but with the same result.Has anyone else noticed the same behavior, or is there a solution?Thank you very much. 

Hello Team! I am using a FortiGate 40F model FG-40F with a configuration which consist of a VDOM root (management, operation mode NAT) and a VDOM transparent (operation mode transparent).  The VDOM root is only use to give access to internet:  The VDOM transparent is only use to stablish a firewall between a network called LAN and a network called WAN:  My objective is to monitor the Fortinet sending get SNMP from a PC connected to the port 2 (Inside lan 2).I have configured the System > SNMP in this way:  My problem is that the Fortinet receives the SNMP get but not answer me:  I am sending the get SNMP with iReasoning Browser: I amnot using HA or trusted hosts (I have tested to add my pc to trusted hosts but the behaviour does not change), I have checked the threads: SNMP don't response traffic, SNMP response and SNMP no response: timed out but I can not solve the problem. I give you more information that could

Hello all,I have a problem, probably in connection with my Fortigate100F to establish a RadSec TLS 1.3 connection from a UniFi AC Pro AP to an external RadSec Server (RADIUS). The connection is made via a Ubiquiti UniFi AC Pro AP and Ubiquiti UniFi Application 8.5.6 and RadSec is official supported.The connection via RADIUS works, but as soon as I activate TLS for this connection with the required certificates (root, client, private key), no connection is established.In the log files I do not actually see that the connection is blocked. The only thing I see is action=“close” - What does this mean?When I add the external IP in my exclusion list from my SSL Deep Inspection, I can't connect either.Even if I temporarily deactivate IPS, SSL and App Control, I cannot establish a connection.I can establish a telnet connection to the RadSec server from the Fortigate and from the UniFi AC Pro AP. However, this is terminated immediately  date=2024-10-21 time=13:42:13 eve

Hello community, I recently replaced a SonicWall with a FortiGate 100F in my SCADA network. The problem is that I have Site-A connected to Site-B via a VPN, where I have a ThinClient that needs to connect to the ThinManager server in Site-A and pull the configuration. The ThinClient's PC has a static IP, and when it tries to connect to the server, I see that the packets are being dropped. I've tried everything! I even contacted support, but they can't find an explanation... Any suggestions?

I have a fortiweb on AWS on version FortiWeb-AWS 7.20,build0311(GA),221216...  i am looking to upgrade it to 7.4.5 but i am not sure which file to download for upgrade from support portal... can some one please guide ?

Hi, I'm trying to figure out a good way on how to log and store the logvolume from a specific adom in my FAZ overtime. I've looked into tapping into the API and/or Ansible but I haven't found anything that shows me this particular data. The data I want to store is the one obtained from the command:diagnose fortilogd logvol-adom <adom>Does anyone have any good tips for me on how to get this data stored in a good way?  BR,Per Rosenlind

Hello,I installed fortivm on an esx in the datacenter.Maybe it may sound a little strange, but the following configuration is requested.Datacenter gave me an external ip for example; 10.20.30.40/29 subnet.As a gateway, I was informed that it was 10.20.30.43.Step - 1 ) I will define the ip addresses 10.20.30.41 and 42 as wan ports on the port2 interface in the firewall. Servers in the local network will be able to access the internet via this wan port. Port1 is set as internal (Lan) and port2 as wan port and I can access the internet by giving static route (gw 10.20.30.43) and writing lan to wan rule.There is no problem in this part.Stage - 2 ) 1 db and 1 web service (iis) server 2019 machines that I have installed (iis) server 2019 machines without giving ip address from local network, giving 10.30.40.44 and 10.30.40.45 addresses statically from direct wan ip block and I am expected to pass the traffic on these machines through the firewall. If I write 10.30.40.43 as gw to the machines

Hi!there are three to-the-Fortigate policies - Local-in, Auto-provisioned and Admin-in Policies.However, I'm unable to find documentation listing the order of execution/priority in which these are processed to determine which will occludes (ie. prevents access allowed by) others - is this documented? Otherwise, if it's dead-simple, provide answer?R's, Feren(Edit: removed "vs")

Hello.We have 200 FortiTokens registered with FortiAuthenticator (FAC).There is a single synchronization rule, to synchronize users from LDAP server (ActiveDirectory). The rule automatically assigns a free FortiToken to new user, when he is found in AD and pulled to RemoteUsers list in FAC. The problem is, there are about 120 tokens already assigned and all remaining tokens are in pending status, even though no user has been assigned to them yet. If I login to FAC, I can manually refresh the status of tokens, and it always free up some (not all!) unused tokens. What is the reason behind it? Why are tokens being pushed to the pending status without any assignment?

Hi Trying to connect up a Forti AP with a Dell switch but struggling I have put the port in trunk mode created a VLAN that matches the AP interface on the Fortigateassigned the native VLAN to that port But still my AP isn't picked up by the Fortigate. What have I missed? Thanks

Hello everyone,currently we are hanging in the SAML Entra SSO Setup. I checked the recommends Articles here in the Support Forum and watched serveral Videos.Firmware: v7.4.5 build2702Model: FortiGate 101F After the SAML login via the FortiClient and Enter the M365 Credentials, follwing Error Appear: Configuration on the Fortigate:User & Authentication > Single-Sign-onService Provider ConfigurationAddress: "forti-fqdn:6443" Entity ID: "http://forti-fqdn:6443/remote/saml/metadata/" Assertion consumer service URL: "https://forti-fqdn:6443/remote/saml/login" Single logout service URL: "https://forti-fqdn:6443/remote/saml/logout" Identity Provider ConfigurationEntity ID: "https://sts.windows.net/xxxx/" Assertion consumer service URL: "https://login.microsoftonline.com/xxxx/saml2" Single logout service URL: "https://login.microsoftonline.com/xxxx/saml2"  Certifcate Import from Entra  Additional SAML AttributesA

Hi,Is it possible to have the Fortigate perform a ICMP-ECHO to a IP Address before it sends a DHCP Offer to a client device. Have had an issue with duplicate IP Addresses on overlapping scopes / ranges that have static IP Addresses configured. This could be resolved with the DHCP server testing to see if the IP address is already in use in advance rather than relying on the client device to perform this function, I.E sending out an arp before accepting the DHCP Offer.  Any help would be much appreciated, thankyou. 

Hi!Is it possible to store the keys for intercepting TLS sessions in the Web Filter with an HSM device? I looked at the manuals and only found references to the FortiADC. If it is possible would you mind answering these questions?[ul]Is the key transaction made once per TLS session, or at machine startup?Would you recommend against having a HSM centrally and connecting to it over the internet?[/ul]Is there any other ways to protect the keys in remote locations? Any reply is most appreciated! Kind regards,Patrik

Hello, does anyone use an HSM (Hardware Security Module) to store the private key of a Fortigate used for Deep Packet Inspection ?I would like to know if this is a feasible option ? Thank you.

I have Fortigate 600F (FW 7.2.10) which acts as wireless controller for FortiAP 231g.I have configured configuration profile which changes Management VLAN ID for APs following this article. https://docs.fortinet.com/document/fortiap/7.4.5/fortiwifi-and-fortiap-configuration-guide/809346/operations-profiles-entry I have applied configuration profile to FortiAP profile. However settings defined in configuration profile are not applying. I'm not sure why. Here is the setting from the configuration profile:

VM is not licensed or license is invalid for current VM configuration. Upload a new license or reconfigure the VM.