Support Forum

I'm working on migrating my home OpenSUSE machine I'm using for freeradius server to authenticate admin and VPN users on my FG40F(7.2.8) from Leap 15.3 to 15.5(on a new machine). Obviously 15.5's repo has a newer version of freeradius-server image.Then when I simply copied "clients.conf" and "users" file to the new machine and pointed the RADIUS config at the 40F to the new machine, the RADIUS auth request was simply dropped without showing much reason in debug output other than "missing mandatory attribute".After some research and investigation, I figured out I had to set "require_message_authenticator = no" in the client config for the 40F at the server, which was not required with the older version of freeradius, in order to let the server accept those requests from the 40F.So I found a way around but now wondering why 40F wouldn't send the Message-Authenticator attribute with the request.Even with 7.4.4, the admin guide says it doesn't send the attribute.https://docs.fortinet.com/d

Hello,We migrate our firewall to Fortinet and after that some of SAP user have network problem like attached picture. The SAP server located in Azure Virtual Machine and traffic from onprem connected to Azure via VPN site to Site.Anyone know here how to improve or fixing this issue? Trying to increase session-ttl for port 3200 with not helping.

Hi, when I try to open the next columns it doesn't show me any information and I can't apply any filter or anything, at first it only happened in Google Chrome, but now it also happens with Edge and Firefox.

BackgroundWhen a FortiGate downloads package updates directly from Fortinet FortiGuard (FDN), the package files are downloaded and then expanded into the FortiOS without any user control over which subcomponents (within each package) are installed. Thus, the process is "all or nothing". The user (or the configured schedule) triggers the update and the FortiGate obtains the package, then expands and installs all of the package contents. This means that the user has no control over which subcomponents are installed. However, when using the FortiGuard service within FortiManager, the administrator has the ability to control which version of specific packages can be downloaded by FortiGate. In the FortiManager scenario, FortiManager downloads packages from the Fortinet FortiGuard (FDN) service, and then the downloaded packages are expanded into FortiManager. Administrators are presented with a full list of all of the subcomponents that have been downloaded. Most importantly (to t

Fortinet Radius authentication using Azure AD

Hello.I'm managing a Fortigate 40F v 7.0.11 and I'm getting in System Events logs many line reporting that my lan interface is going down and up with log id = 0100020099.When Fortigate logs those lines I can see my ping tests to 8.8.8.8 failing and usually I get customers complaining about a no stable internet.The main problem is that it's not constant. I'm getting this behavior a lot of time during a day.I'm using SD-WAN in lan3 and "a" ports (I just disabled tha Wan port because I have an disabled link in this port) but even when I had Wan port available I was getting the same error but less often.I really don't know what is causing this behavior.. could it be cable or a faulty port in my switch?I'm almost loosing my customer because of this weird behavior.Appreciate any help.Thanks

HelloI have the following issue.I need to do a routing by http content with fortiweb, as an examplewww.informacion.go.rx/vista/1_inicioI have already made the policy in which when it finds www.informacion.go.rx it redirects to the server 10.22.130.5 through port 80.The problem I have is that it is not finding the URL /vista on the web server since vista is located in the following route10.22.130.5/www/vista.In nginx as a proxy server I can add a specific routein the proxy "proxy_pass" from where to start looking for the URL, but in fortiweb I have not been able to find it.I hope you can help me to see if there is a way to do the same in Fortiweb

Need evidence where FortiGate IPS detecting the Covert Malware communication detection.FortiGate

Hi,I have a FortiGate 61E configured for SD-WAN, with WAN1 as an Internet broadband connection and WAN2 as an MPLS link. The company uses an internal web application, and I've configured the MPLS link for accessing the internal web. However, when the MPLS link goes down, I'm unable to use the broadband link to access the internal web via VPN to HQ. What should I do to resolve this issue?

I cant install my FortiSIEM Linux Agent on my Ubuntu 21 with the last install script from Fortinet Support.  The Error message：No matching OSINSTALLATION FAILED Try to install with Linux Agent scriptView my os-release information file or link  The Content of the last version FortiSIEM Linux Agent Script  If my Costumer ask me just use Ubuntu 21 to install Linux Agent, how to solve this Issue?    

Hello, The Web Application Firewall on FortiGates is blocking access to two URLs due to the following event IDs: 1. URL: [https://web.domain.com/page.php] Event ID: 60140003 Event Type: waf-signature Sub Type: waf Type: utm FortiGate # diagnose waf dump | grep -f 60140003 60140003 - This signature prevents attackers from performing RFI attacks to include a malicious code from a remote resource. <---  2. URL: [https://web.domain.com/file.php]Event ID: 40000141 Event Type: waf-signature Sub Type: waf Type: utm FortiGate # diagnose waf dump | grep -f 40000141 40000141 - This signature prevents attackers from injecting SQL Databases using "\*". <---  Could you please guide me on how to add exceptions in WAF profile for these two URLs in FortiManager, so that access will be granted? Thank you!

 Hello,I am currently using FortiAuthenticator version 6.4.9. Additionally, my firewall is running FortiOS version 7.2.9, and based on the documentation I reviewed, these versions are compatible with each other. However, I am facing the following issue:I have completed the integration between FortiAuthenticator and the firewall, and all necessary configurations have been made. On the first attempt, the user I want to apply MFA to receives the email without any problems. But on subsequent attempts, the user can log in directly without being prompted for a token, and then the email is sent. The logs in FortiAuthenticator show an OK log indicating that the email was sent, but the user is logged in without seeing the token entry screen.Could this be a bug related to the version, or is it possible that I have missed something in the configuration? If this is a bug, it is not mentioned in the "Known Issues" section of the release notes.Best regards

The handsets (FON450i) reportedly support RTTTL ringtones. I created a text file, entered the tune, and saved the file. When I try to upload I get an invalid format. What extension should the file have? Since there is a 5 (custom) ringtone limit, how do I check or erase an existing tone? Are there changes outside of the standard specification we need to conform to (such as case-sensitive input)?

Hello I'm having problems with local traffic generated by Fortigate and SDWAN rules. When one of the links that make up our SDWAN goes offline, I receive the following error message: "unable to connect to fortisandbox. Either the appliance is not reachable or this fortigate is not authorized" Then users start receiving SSL certificate error messages when they try to access a web page, or a message like this: "Web Page BlockedAn error occurred while trying to rate the website using the webfiltering service. Web Filter Service Error no correct FortiGuard information" I tried the following commands (available at: link  ) but the problem persists: config log fortiguard setting set interface-select-method sdwan end config system fortiguard set interface-select-method sdwan end I have a 60F with version 7.0.13 build 0566 (Mature)

I can't access internet from my pc that is in the same subnet as the LAN port,  Firewall policies are created (LAN-WAN) dst lan port address / src all, and (WAN-LAN). 

I'm using Forticlient EMS 7.2.4 and Fortigate 42000F 7.0.12 (on-prem). Currently all our policy rules are the traditional system to system or area to area type i.e. IP/CIDR/HOSTNAME to IP/CIDR/HOSTNAMEI'm looking for a modern approach where I can govern network level access from system to system based on the user initiating the traffic. For example, if I have a support person working on shared laptop I would like to them to be able to get to back-end SystemA but not neccessarily another user that might user the same laptop from time to time.I assume this is a ZTNA type solution but wondering if my existing stack/kit would already have this capabilty? 

Hi , trying to update fortiweb running in an esxi host when i go to the Fortinet support portal , i see so many different versions , which one i need to download ?mine is v7.4.3 build 638(GA)  thank  you

Hello, we are having trouble with wifi clients clinging on to APs too far away.We are unable to modify the local Windows roaming aggressiveness settings.What options do we have via ForitWifi to force clients to disassociate with an AP if they are connecting at too low RSSI signal strength?

Hello,How can i activate HA failure email alert on fortigate ?I have already a CLI rules and i would like to add this to deploy on every fortigate.Ty for your help.

Hello All,I'm new to Fortigate, so be gentle :)I have a Fortigate 400F that's set up and working, connected to the internet through a cellular router (temporary for now) that gives the fw a dynamic IP on the WAN port.  I want to route https traffic from the WAN port to an internal IP address.  I've followed the admin guide (FortOS 7.2.10), followed multiple online articles and youtube tutorials, and although the setup seems very simple and easy to understand but I cannot seem to get it to work. My basic understanding of the process is:1) Create virtual IP with source address of 0.0.0.0 mapped to my internal ip 10.35.1.11 and select port forwarding of 443.2) Create firewall policy to accept traffice from WAN interface to Internal Interface, source = any, destination = internal IP, service = https. To rule out my ISP being the problem, I tried to just connect directly to the WAN port with my laptop, set the IP of the WAN interface to a static address, set my laptop to

Good morning friends, I have the following problem, I have a 1801 computer which when updating it to version 7.4.3 or later generates problems in the connection between servers and units mapped by nfs, they disconnect or do not allow writing on the mapped units. Has anyone experienced this situation?

Hi, Has anyone encountered the situation where a user disconnects from idle-timeout ( 300s ) and the Reconnecting just keep happening after a good couple of seconds ( about 60s ) and lots of logs with SSL web application blocked ?FGT : 7.0.15 and FCT 7.2.4 ( other FCT versions also have this issue )The sslvpn configuration looks like this ( some lines have been left out ) : config vpn ssl settings set ssl-min-proto-ver tls1-1 set banned-cipher CAMELLIA 3DES SHA1 STATIC set ssl-client-renegotiation enable set auth-timeout 43200 set login-attempt-limit 3 set login-block-time 300 set idle-timeout 300 set login-timeout 120 set dtls-hello-timeout 30 set default-portal "no-access" config authentication-rule edit 1 set groups "SSLVPN" set portal "tunnel-access" next end set tunnel-connect-without-reauth enable set tunnel-user-session-timeout 60 end   config vpn ssl web

Hello! Please, help me. We use FortiGate 200E in our company.I have difficulty using the VPN. The speed when connecting to VPN is only 1-2 mbps. How can I fix this? The channel at both ends of 50 mbps

Hello I have 3 links on my Fortigate 60F v7.0.13:- 2 WAN interfaces with manual mode- 1 WAN interface with PPPoE modeI also have an SDWAN rule in "maximize bandwidth (SLA)" mode with the three links.On my local network there is a Zabbix server that pings 3 IPs on the internet and each ping to a specific IP must go out through a specific link, thus validating connectivity on that link. I then created a Policy Routes to specify the outgoing interface, where I specify the source address as the Zabbix server and the destination address as a specific IP on the internet. However, when the PPPOE interface link goes down, the ping continues to respond and is routed to another interface. When the link on the other interfaces (manual mode) goes down, the behavior occurs as planned and the ping is interrupted. Is there any special configuration that needs to be made in the policy routes when it comes to a PPPoE interface?

HiWe have noticed a large amount of attempts hitting our SSL VPN from 1 particular country. The attempts are coming from a variety of IP addresses but are listed as this one country. We want to block these attempts but our issue is that we have an office in that country. The users are in a shared office but use SSL VPN to connect to us. The shared office has a static IP.  Is there a way in Fortinet to create a group to block all IP addresses from this country except the 1 that we one that our users connect from? Many thanksRoy