Support Forum

Hi all. My college asking to me their FMG 7.4.3 have an issue. when device discover or adding manual serial number, task even said successful without any problem. but when he check on managed device, there is no shown any device that he add before. when trying add again, it said "device with serial number xxx already exist".also, when I check with my college, I notice there is no "unauthorized device" menu on device manager. I already check on release note but there is no mention about this. I notice on 7.4.0 there is an issue with FOS 7.0.12 but solving (i guess) on 7.4.3 (only mention issue with 7.2.9). And I check on compability matrix, 7.4.x still support to 7.0.x version. Is this new bug or something?also when I check on FortiGate fabric connection, it said "connect" and "managed by fortimanager" but the IP/FQDN are blank.there is no issue when testing on fmg 7.2.5. here is the complete detailFGT40F with 7.0.12FGT60F with 7.0.14FMG-VM64 with 7.4.3

I am trying to use two IPoE lines in one fortigate. The configuration is as follows.IPoE①: for InternetIPoE②: for maintenance such as Windows UpdateHow should we configure it?I know how to set up only one line.Should I use VDOM?It is version 7.4.3. Thank you for any answerBest regards

Hi All,I currently have a client who uses the FortiClient VPN (Zero trust Fabric Agent) Version 7.4.0.1658. Using the GUI work fine, no problems. However, when trying using the CLI (from this article) it fails. The process I followed was. Execute FortiSSLVPNclient.exe (version 7.4.1658)Click settings,Create a new connection (eg: MyCo), [Note the Client isn't saving the 'Do not warn about server certificate validation failure' or the 'User Name' and 'Password' in the Connection Settings dialogue box.] I'm running the exe as Admin.Once I've created the connection, the command line I'm using is: FortiSSLVPNclient.exe connect -s MyCo -h [IP]:[Port] -u [userid]:[password] i -m -qAll that happens is the GUI appears, then if I click connect it flashes "connecting", then immediately back to "Disconnected". I've upped the logging of the FortiClient SSLVPN to "everything" but can't find the logs - LOL.Any help would be appreciated.Regards:Tony.

Hi all.  I'm in a pickle.  My network guy just left and I have a situation where I have 2 subnets that I need to comunicate with one another.  I am not a network guy and Fortigate is very hard for me to understand.  I really need someone to explain to me, like I'm 5, how to get these subnets to communicate.  For some unknown reason one of the subnets is a /32 and only contains the IP of a domain controller.  The client devices are all grabbing IP addresses on a totally different subnet, so my client is unable to join their new PC's to the domain. I've tried reading all the documentation and watching videos but it's all Greek to me.  Address groups and interfaces and VLAN's oh my.  If anyone out there is willing to assist me with understanding what I'm doing here I would be forever grateful.  Thanks.

We upgraded our SIEM to version 6.3.1 earlier this year to position ourselves to upgrade further.  Our last upgrade failed twice for different, undocumented issues before getting the support from TAC to complete it successfully.  Because of that, I've lost a lot of faith in future releases.We are partnered with a third party who also manages multiple FortiSIEM installations, and they have found that the only stable version beyond our current version is 6.4.1 and they have reported failed upgrades for many of the other available versions. We are working on getting a lab environment in the next month or so where we can test upgrading to various versions, however, I'd like to hear about success and failure stories from anyone who has upgraded from legacy versions. Thanks, and I hope to hear from everyone!

Hello all, Since yesterday I got a flood of our IPS about the following: date=2024-10-10 time=09:55:22 devid="FG100XXXXXXXXXXXX" devname="100f_serverroom" eventtime=1728546922552439440 tz="+0200" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" severity="low" srcip=xxx.xx.xx.xx srccountry="Reserved" dstip=157.240.247.61 dstcountry="Netherlands" srcintf="VLAN72" srcintfrole="lan" dstintf="wan1" dstintfrole="wan" sessionid=1996577 action="dropped" proto=6 service="HTTP" policyid=6 poluuid="016585d8-cf8c-51ec-1bc2-98b96e341900" policytype="policy" attack="HTTP.Suspicious.Headers.With.Special.Characters" srcport=49694 dstport=5222 direction="outgoing" attackid=48934 profile="high_security" ref="http://www.fortinet.com/ids/VID48934" incidentserialno=168450119 msg="http_decoder: HTTP.Suspicious.Headers.With.Special.Characters" crscore=5 craction=32768 crlevel="low" The destination is a meta-whatsapp service. This seems to happen with ev

Hi, we use a bunch of FortiSwitch-448E-FPOE for different puposes. Two of them are used for management access to different devices - two of them being MikroTik CRS309-1G-8S+. The problem we face is, that those MikroTik switches can be powered by PoE but no matter what settings I apply to the FSW ports PoE-wise, the FSW won't deliver power to the MikroTik switches.When I use a HPE 2530 switch or any PoE+ capable power injector, the MikroTik switches get powered by PoE like a charm. Has anyone else experienced this phenomenon? I did not yet create a case with support, just asking the community first. Thanks for you input!

Hi, I'm translating the login page replacement message on a FortiGate 80F. How can I modify the "Please enter your username and password to continue" contained into %%QUESTION%% variable. Ok, I can delete the reference and insert a static text, but I'd like to find out some better solution. Thanks

I have implemented a sidecar container to forward my main application logs to splunk. Have used universalsplunkforwarder image. After I deploy both my main application and forwarder seems up and running. But anyway not recieving any logs in splunk index specified. To troubleshoot splunkd log or any specific splunk internal logs are not found in /var/log path. Can someone please help how we enable this splunk internal logs?

Hi everyone.. I'm new here to the forum.. So, my question could be an old one, but I didn't see it in the submitted messages..I have an issue concerning my protected domains that I need your help with.. I have a Fortimail 200F, with two protected domains. I can see the incoming and outgoing emails to each of the protected domains in the logs, but I can't see any emails that are sent between those domains (i.e. From protected domain1 to protected domain2, and vice versa), although the emails reach their destination successfully, but no logs for them at all.. Is this a common issue that can be modified in the configuration? If so, could you help me with the steps to resolve this issue..FortiMail 

Hello! Could you please help me find out where I can check the end-of-life and end-of-support dates for FortiGate Firewall devices? If you could guide me on how to do this or provide assistance, I would really appreciate it. Thank you!I am interested about FortiGate 90G and FortiGate 80F

Hello Fortinet Community. I hope you have ideas on how we can solve our problem. At the moment we have massive problems with BruteFrce attacks on our Fortigate 100F - V 7.2.9 - Our users connect to our company network via FortiClient VPN. The bruteforce attack uses frequently used names in our country, such as Smith, Meyer etc. and exactly these users are blocked daily. Now the question is whether a Mac address filter or the OS check can be used here or whether the whole thing is useless, as the credentials may be queried in AD beforehand and only then is the OS, Mac address etc. checked. We were unable to find this out from the documentation. Thanks in advance, Alex.

Hello,I hope everything everything good, im reaching out for help i've seen your solutions and that you have good knowledge in fortigate/forticlient we are having an isse with some forticlient on some windows laptops were we enter configs correct but its gets stuck on connecting or after i install the vs c++ redistributable it pops up but blank and after a while it shows to enter credentials for authentication and 2fa after that it disconnects on its own no error no nothing.do you have any idea on what can be the problem cause im starting to think its a windows problem maybe a network adpater problem or something else 

Basics for my config:FGT60Fx1 - Dynamic External Address (Comcast)FMG VM - Internal address behind the FGT60Fx1FGT60Fx2 - Dynamic External Address / CGNAT (T-Mobile Home Internet) I am using FMG to configure both devices. I am trying to configure a VIP for FGT60Fx1's external port to allow inbound FMG traffic (ports: TCP 541, 542, 53, 80, 8888, 8889, 8900, 8890, 443, UDP 53, 8888, 8889 per https://docs.fortinet.com/document/fortimanager/7.6.0/fortimanager-ports/465971/incoming-ports). However, FortiManager won't allow me to use 0.0.0.0 / 0.0.0.0 as the "External" address. Since the external address will change at my provider's whim, how do I get around this? I do have DDNS setup, but that also didn't work when setting up the FQDN option as it continually tells me I need a change note, even though I've entered one. I've tried using 1 character, 5 characters, 50 characters, but the field says I haven't added a change note. What is the trick to setting up VIPs in FortiManag

Hello, How could we solve the problem on FortiAnalyzer license that display license is duplicated in License Status. # get sys statusPlatform Type                   : FAZVM64Platform Full Name              : FortiAnalyzer-VM64Version                         : v7.2.1-build1215 220809 (GA)Serial Number                   :BIOS version                    : 04000002Hostname                        : Max Number of Admi

Hi everyone, I'm using FortiGate version 7.4.4 and have configured DDNS with FortiDDNS on three devices: two FortiGate 40F units and one FortiGate 60F. The WAN interfaces on all devices use IPv6, and each device has been configured with FortiDDNS using different domain names. Here’s the issue I'm facing:~The two FortiGate 40F units are successfully obtaining and resolving their IPv6 addresses using DDNS.~The FortiGate 60F, however, is not able to resolve its DDNS hostname, returning a "non-existent domain" error.~The strange thing is, when I use diagnose ipv6 address list on the 60F, I can see that the WAN interface has a proper IPv6 address, and it can be pinged successfully.~All three devices have the same DDNS configuration except for their unique domain names. Any ideas on what might be causing the 60F to fail while the 40F devices work fine? Any suggestions would be appreciated!Thanks in advance!

How integrate AD with FortiClient CLOUD EMS

I'm planning a deployment to migrate stateless router ACLs centrally managed by Ansible to FortiGates/FortiManager. I'm experienced with FortiOS but new to FortiManager and I'm trying to solve a policy management problem. We have multiple sites and we'll have one FortiGate at each site. Each FortiGate will have about 70 rules in common, but most of the sites additionally have between five and a dozen site-specific rules.To manage this, I'd hoped to be able to layer multiple policy packages accordingly on each FortiGate. For example:Rules 1-70 - Shared policy packageRules 71-85 - Site-specific policy packageImplicit denyThis is trivial with Juniper's Security Director, which allows you to apply as many "group policies" to a firewall as you want and commingle them with device-specific policies. I was expecting similar functionality from FortiManager, but, as I learn the platform, I find that it doesn't really work that way, and you're not supposed to apply multiple policy packages to a s

Hi, We're going to be changing our EMS registration to invitation only. I cannot find clarity on whether this disables existing registrations that didn't have an invite originally, or if existing registrations stay enabled and the change only affects new endpoints. Any insight appreciated!

Dear Fortinet Community. First of all the infos:Firewall model: Fortigate 100Fversion: 7.4.5 We have a thing I cannot explain to myself. I think the behaviour to handle it like this is since we have updated from 7.4.4 to 7.4.5. But I am not sure. We see a WebFilter violation when opening a http (not https) website. This website is in the category Phishing. We encountered it when installing a program that wants to download a executable file from this http source. Category Phishing is set to block in the WebFilter. Just to let you know. I made a ssl expection exception for the website. This helps to open the webpage when using SSL (https) but not without SSL, so http. The installer wants to reach the website by http. Probably I am wrong now but in the past we have added websites to the static URL Filter in the webfilter settings in order to reach them and to override a category filter. I have understood the static web filter as something like an override for categorie

Hello, We are encountering an issue when  EMS creates FortiClient packages that are not signed by a certificate and blocked by the Microsoft Defender smart screen on Windows 10 only but it works on Windows 11. However, EMS was creating packages with CA.The last changes on the EMS server are renewing that certificate and upgrading the EMS to 7.2.5 build 1061. Please advise. FortiClient Thanks,Alaa Elrayes

Hi, I need to connect the FG-80F via multimode fiber at 100Mbps (the remote end supports 100BaseFX only). Does the FG-80F support the Fortinet FS-TRANS-FX? https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/Fortinet_Transceivers.pdf 

Where is the problem? tunnel up no ping

I have did the format in Forti ManagerNow I can't boot the device without the firmwareAs I have the limited devices am not planning to purchase the license nowSo Kindly anyone ADVICE to get the Firmware of Forti Manager 200GI want to test the device and then I want to purchase the licenseIt is the new deviceFortiManager   

Hi All ,  We trying to figure out if we can use ubikeys with FortiGate SSL VPN for 2FA without the Forti authenticator?Ubikeys supports fido ,ooauth ..  Now we do need Forti authenticator can we use the cloud version ? thank you :)