Support Forum

Hi all,Is there any way to obtain the real IP address of a client that accesses EC2 instances through an Amazon Internet Gateway that is routed through a FortiGate VM? I know that Amazon performs NAT on their end to map public/Elastic IP addresses to the Private IP but this is causing issues with testing the feasibility of using FortiGate VM as a replacement to Amazon Security Groups.For testing, I have a simple WAN (public subnet) and a LAN (private subnet) attach to the FortiGate VM with the appropriate route tables. When I simulate an external user connecting to a web server in our private subnet via a reverse proxy, the logs show the connection as coming from the LAN interface of the FortiGateVM. If I disable NAT on the incoming firewall rule allowing HTTP\HTTPS access through the VIP but then I am unable to connect. It seems that Amazon forces a double NAT scenario making it difficulty to obtain the true IP address.Ideally I would like to have the following workflow where the true

Hi, All. I have a some network on my office. This network is use a fortigate, i try to build some network monitoring with Elastiflow. Activate a netflow on my fortigate success, but i have some issue. Why on my network monitoring netflow is not show me a TCP Flags, such as SYN, RST, ACK, and other. The software elastiflow is good working, because i try to my other device such as MikroTik is they can show me TCP Flag types.In my case, i need to show the connection with TCP Flag, because with them i can analysis some traffic port scanning or bruteforce with filter the TCP Flag (syn). Any one can help me what the problems ? FortiGate 

Hi,We've identified "gui websocket" issue on forti-vm 7.2.5 version. The temporary solution by killing "gui websocket" process doesn't support well as it is reoccurring very frequently during operational tasks.Do we have any bug id or latest release to resolve this issue.As i don't have active license to raise this concern on support portal, so thankful if anyone ack here. Issue : Device Manager doesn't load devices after initiating Install Wizard every time.

 Hi everyone,I'm facing an issue with FortiGate Application Control. I have a profile configured to block all applications, including Telnet and Unknown traffic. The problem occurs when I test Telnet using the command:  telnet pop.gmx.net 110Instead of being blocked, this connection goes through, and in the logs, it gets categorized as "Unknown" rather than Telnet. Even though I’ve set Application Control to block Unknown traffic, it still allows the connection.Configuration:Application Control: Blocking all traffic, including Telnet and "Unknown".Application Default: Enabled.Logging: Shows the traffic as "Unknown" instead of Telnet.The Issue:Telnet over port 110 (normally used for POP3) is not getting blocked or recognized as Telnet—it’s instead showing up as "Unknown" but still not being blocked.Questions:Why is Telnet over port 110 being classified as "Unknown" instead of Telnet?Is there any way to force FortiGate to correctly recognize and block Telnet traffic on non

Hi everyone,I`m new to forum :)My question is:Is there a way to drop (not block) external traffic into my WAN without logging it?By country or by IP range or single IP?The goal is to block certain IPs so they can't even port scan my firewall.I can`t find too much apart from Deny ipv4 policy which still logs everything.I have Fortigate 60F.Thanks

Hello, I have a major problem. I have many offices in UAE on FGT60B Firmware: 3.00-b0737(MR7 Patch3). When I try to logon to a major international bank website and go into their online banking page, IE gives me a page not found error. I can reach their main page but as soon as I click Log On the I get " Page not Found" error. I tried from home and I can access the page without any problems or time out. Also I can also access the page from office, if protection profile is switched off. I do not think its IE problems as the same users who have difficulty accesssing online banking from office can do the same from home using the same laptop. Please HELP!!!!!!!!!!!! Regards J

Hi all, I'm completely new to the Fortigate world so hopefully someone can help me. At the company I work we are setting wan connections at remote site, we already have a couple of fortigates managed via Fortimanager and the end result we want to accomplish is to setup fortiextenders at remote sites and extend our lan, and provide WiFi also to our workforce via the extender.  The main objective is to use a common FTTC, FTTP or ADSL line to connect to the extender wan port and manage the extender via Fortimanager and extend our lan and vlans to the remote site, we do not intend to use LTE at least at this point in time as we already have internet service at the remote locations. Is this possible to implement ?

Our School Resource Officer needs access to a site to order security items for our school. This is blocked because it is a site that sells tactical equipment as well as guns. He is literally the only one that needs to get on this site but Fortinet refuses to respond with any help in this. Is there anyway to bypass a blocked site for a single user?

 Hi,I downloaded vpn forticlient 7.4.0.1658 with Windows 10 pro 22H2. I configured properly following my organization steps, configure authenticator..., but I'm the only one having issues connecting to vpn. I'm using user and pwnd correctly, in other case vpn fails at beginning, but after setting up correct credentials, a new page is created with vpn connecting info message (does not finish to connect) and then in error log I discovered this error:[7020:7024] [FortiVPN 1401 error] !!! fortivpn::StateMachine::HandlePreflight_GetCredentials failed to obtain tunnel credentials Someone have information about which means this error?.Thanks a lot

Hi all ¡¡I want to configure 2 stand alone fortiswitches, forming an MCLAG with ICL. Afther that, I want to define 3 VLANS, each one with a layer 3 address. For example: 192.168.1.1/24 Vlan 1192.168.2.1/24 Vlan 2192.168.3.1/24 Vlan 3 The fortiswitch will be configured with default route 0.0.0.0 0.0.0.0 192.168.1.2 (firewall) connected to VLAN 1. Finally, I want these 3 Vlans can route traffic (using the static route configured) but , I don't want these 3 Vlans can route traffic between them witouth previously leave Fortiswitch. For example, we have a server1 connected to VLAN 1, with IP 192.168.1.200/24 and default gateway 192.168.1.1 that wants to connect with server2 192.168.3.200/24 connected to Vlan 3 with default gateway 192.168.3.1. The flow traffic that I'm looking for Layer 3 is:  SERVER1 --> FORTISWITCH --> ROUTER -->FORTISWITCH-->SERVER2 I have read about offload IP options, but Im not sure wether enable or disable it, the layer

hello Experts', We currently using forti-os 7.2.7 firmware version, ssl vpn client certificate authentication not happening Before we used 7.0.14 version ssl vpn client certificate auth worked as expected, after upgraded to 7.2.7 its not working  Any one faced this kind of issue.? share your thoughts on this issue 

 Hello Fortinet Community, My customer is transitioning from a Palo Alto firewall to a new FortiGate 401F, which is configured in policy mode. The existing Palo Alto firewall uses rules based on App-IDs, and the following App-IDs are in use:(adobe-creative-cloud-base; adobe-update; hp-update; ms-update; ms-update-optimization-p2p; windows-push-notifications; xbox-live)I've configured the FortiGate firewall with equivalent application filters to match these App-IDs from Palo Alto. My question is: will the application filtering rules on the FortiGate function properly without enabling deep inspection (Note:- existing Palo alto firewall is not using decryption (similar to Fortinet deep inspection )).? Thanks! 

Hi All !On my FG201F device dashboard, I see the status of "System DNS Servers" has unstable latency (sometimes very high). It seems to be affecting our network performance.Note: This device is running firmware "v7.4.5 build2702 (Mature)" with 4 Internet lines (divided into 3 SD-WAN groups), the system is also divided into VLANs.Could you please assist us in diagnosing this issue? Any guidance on potential configurations or troubleshooting steps would be greatly appreciated.Thank you for support.

I was working on a Dial Up VPN setup between 2 Fortigate firewalls, I wanted to test the automatic addition of routes from the phase 2 selectors, however, I haven't been able to make it work properly.On The Server FG besides defaults I set mode-cfg enable.On the Client FG besides defaults, I eet mode-cfg enable mode-cfg-allow-client-selector enable.VPN is up, the server FG automatically created a route as per its selector, however, client FF hasn't added any route.Could anyone clarify this for me? Thank you!

What is RVPN in FortiGate and uses? Why using?  How to create a RVPN? RVPN prerequisites? How to configure RVPN in FortiGate?

Hello,by accident I formatted  the firewall FortiGate 30E, and for sorry I don't have a business account to download the firmware.i need to boot the device to work on it for studying, so please any one can help me to download the firmware ?

Hi Forum,Hoping to get some technical help please. On my FGT-40F i have quite a lot of policies configured and i want to 'Change Security Profiles' but it is greyed out so now i have to edit each Firewall Policy individually. I should be able to select multiple Firewall Policies and then click on 'Change Security Profiles ' but something is causing that option to be greyed out so hoping anyone might have any idea why?

Hi All, General question about memory optimization and firmware. I have a 60E that does a lot of work and runs quite high in memory, and has recently started hitting mem conserve mode. I'm aware there are a few ways to bring the memory down, and I am exploring those, but what about firmware? Are there any memory efficiency gains from potentially updating firmware from 7.0.11 to another version? If so, would Fortinet be able to advise which version to try upgrading to? Cheers 

Hi, We have a simple architecture :- a wan int for incoming request to our servers with static nat- several int for internal servers and users ressources- a single default route for outgoing and reverse traffic- several static routes for different ressources and sites All goes well. We recently had to manage a new public range, with new internal servers. For different internal reasons, the two public wan have to be separated and using the same vdom. We dedicated a wan int to the new range. Default route is still on the old one.When we try to reach the new public int from outside, the famous "msg="reverse path check fail, drop"" raised. Doc : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Detailed-Guide-on-dual-WAN-setup-for-targeted/ta-p/276308 was very good information, but does it apply only for egress traffic, or is it for ingress traffic too ? In other words, we want to expose services on internet on two separates wan int on the same vdom. B

 Hello,I am experiencing issues when sending logs from a FortiGate 60E device running FortiOS v5.6.4 to a Logstash server using syslog over TCP. Upon inspecting the packets reaching the log server, I can see the traffic arriving correctly, but the logs contain messages like: 2024-10-03T18:06:49.773760+00:00 169.254.106.82 <greeting />#0152024-10-03T18:06:59.924314+00:00 169.254.106.82 <greeting />#0152024-10-03T18:07:10.093023+00:00 169.254.106.82 <greeting />#015 Instead of the complete data I need (ACK, hostnames, etc.).The same setup works fine on another FortiGate device sending logs via UDP, but in this case, I do not have the option to configure the transport mode as UDP on the Caseros device. I've tried different configurations, including adjusting the log severity and filters, but the issue persists.My questions are:Is it possible to configure logs to be sent correctly over TCP in this version of FortiOS?If not, is there a way to force the use o

Does fortinet allow rapid spanning tree protocol on fortigate and fortiswitch with the switch as the route bridge?

I've been having issues getting my AP to work while building my network. I have a Fortigate 40F connected to a Fortiswitch 108F connected to a a FortiAP 221E. The Fortigate is running 6.4.15 and the AP is running 6.0. The AP shows up in the Wifi/Switch controller > Managed FortiAPs and shows that it is online. Its broadcasting the SSID I setup, but when I connect to it, it shows connected with no wifi. It also has a VLAN with a manual IP config.I'm confused and need help, would anyone know why this would be doing this?Also does anyone know how to delete VLANS, its not giving me the option to delete them. I want to try and put them on the fortigate instead of the switch

I am accessing the site when I go to generate a file to download it does not download, would there be any way I can check and the domain is blocked, I did the release of the site, it was already F12 in Sources and nothing.

Hello there, I created a CLI template to generate CSRs on Fgt units as follows: execute vpn certificate local generate rsa $(y) 4096 10.$(y).0.1 DO STI STI TEST SEG b@domain.com IP:10.$(y).0.1,DNS:s$(y).x.org,DNS:s$(y).x.org x/app/cert/scep/ password Where $(y) is a meta variable for branch ids, but the result is error: "-999 - invalid value - syntax error". If i input the same script substituting the meta variable with the branch id directly on the units console it works just fine. Appreciate any help,BoddenBF.  

Hello,I’m experiencing an issue with my FortiAP after performing a reset, changing the password, and configuring a static IP address. When I connect or add the FortiAP to the FortiGate and try to log in to the FortiAP, the password I set no longer works.Additionally, I am unable to access the FortiAP via SSH because the password is being rejected.Could you please help me resolve this issue?Thank you in advance for your assistance.