Support Forum

Hi everyone,  I hope you're well.  I am exploring possible solutions to seamlessly authenticate and allow our corporate laptops to connect to wired/wireless LAN VLAN and am currently looking into what is possible with either FortiSwitch NAC and/or WPA3 SAE-PK.  Currently, we have AVD/App servers in Azure with Entra ID and Fortinet Secure Branch consisting of FortiGate, FortiSwitch, FortiAP and FortiAnalyzer. Currently there is VLAN segmentation and all VLAN's terminate on the FGT.  I am looking at FortiClient ZTNA to support our laptop web-filtering when off site but this is a future project and would like to deploy a solution which meets the above scope preferably without incurring additional license costs etc. Has anyone done something similar and would be able to provide some guidance for design or implementation of, to further secure our environment. Many thanks, Dan.  

Hello everyone,I don't remember since when but already for several releases I have an anomaly in the list of users authenticated in wifi through WAP2 Enterprise protocol. User authentication is provided by a Radius server that authenticates users in an AD Domain ( NPS ) .After their authentication I also see in the user list a set of IPV6 addresses linked to the authenticated usernames . Where do these addresses come from ? from the fact that their laptops and smartphones also have ipv6 link enabled ? because the DHCP configured on the Fortigate does not have a lease enabled in IPV6..Has this happened to anyone?I attach a few screens to better understand the issue Regards Fabio   

Question... Is there anything which will alert me when a FortiExtender is "offline" or unable to be connected to? We have had a couple of instances lately where our FortiExtenders were needed, but weren't connecting to either the Fortigate or the cellular provider. Unfortunately, we weren't aware of this as there are no notifications when the Extender cannot connect to either. Is it possible to set something up that will let me know if the Extender can't connect to the cellular providers, or if the Fortigate cannot connect to the Extender?

Platform : Win11 23H2 - Intune Managed corporate device.Hello Everybody, hope somebody can help as I'm stuck, I work as a sysadmin and i've been tasked to disable forticlient from starting up on windows login.We have our network fully managed by a third party company from whom we also got Forticlient from which they also manage.They've told us that the startup config has already been configured via EMS and the software forticlient starting up is now down to us and to reconfigure the startup apps on through windows settings. I've been sent instructions, the generic one from microsoft.This is where I'm having issues with as Forticlient itself is not showing up from teh startup list through 'settings > apps > startup', its not on 'task manager > startup' either. I found FA_Scheduler under services.msc which is set to run automatically, im trying to change it to Manual, but it kept on coming back to me with 'incorrect parameters'. Hope somebody can help, thanks.  &n

HiI get the below error when I go to traffic on the fortiview tab and select policy hits. If I select top sources this works fine. Issue occurred after DB rebuild and firmware update. has anyone has this?   

I am currently setting up a 124F switch. My laptop is direct connected to the switch port1, and I disabled all my Windows firewalls. However, the ping test to my laptop is failed:I tried to do the same thing on another 124F, the ping was succeeded. Fortiswitch OS is 7.2.4.Any ideas? 

I manage 25 FortiGates. Assessing moving to FortiManager. But for now I have to manage each individually. Drives me nuts that every time I log in I have to reconfigure the views to show Description. I've tried a few ways to save the default views (Also adding things like Policy ID to Policy & Objects. Yet every time I log back in the custom views are back to defaults. V7.4.0 on 60E and 60F Models. Any help truly appreciated.

Dear All, I've been testing the image analysis feature in FortiProxy 7.2.6 Version,I already config and test the deep inspection, and all went well. When i try in duckduckgo.com and search bad content the image change to the fortinet Logo,but when i try in Google, the image still show as bad content. Been thinking does the Google change port like QUIC or other else ?Because i also already block QUIC Protocol to ensure the image is using HTTPS / HTTP Is there anyway to do the image analysis block in the Google Search Engine ? Thank You,Best Regards

Log in to the control panel of your web filtering or network security system. This could be a firewall, DNS filter, or any content filtering tool you use.Locate URL Filtering Settings: Find the section where URL filtering or content categories are managed. This might be under headings like "Web Filtering," "Content Filtering," or "Access Control."

When I add FGT v7.2.8 build1639 (Mature) in FGTM v7.2.6-build1632 240809 (GA) a Detect Failed message appears. Can anyone help me? Fortimanager does not ping Fortigate. Fortimanager does not ping Fortigate. They are on the same network. I configured allowed ping. 

Hi, Team!Do you have any suggestions on the recommended version of FG-401FI noticed that the firmware marked as mature has been updated to 7.2.9, while the recommended version in Recommended Release for FortiOS is 7.2.5.Considering that Recommended Release for FortiOS has not been updated for 5 months, I am hesitant about which version to use. (According to the update frequency, Recommended Release for FortiOS should have been updated.)Thanks for your suggestions.

I am under Security Fabric > Automation > New > Add Trigger > +Create > FortiOS Event Log. Here is a looooooooong list of events that I can send to my SOC, but I do not know what is smart to send to them. Any suggestions? List of events:802.1x authentication failed802.1x authentication succeededA device upgrade failedA device upgrade was completedA federated upgrade could not be completed by the root FortiGateA federated upgrade failedA federated upgrade was cancelled due to the CSF tree not being readyA federated upgrade was completedA federated upgrade was completed by the root FortiGateA step in a multi-step federated upgrade was completedAction performedAdd new entry to IPAMAddress allocated by FortiIPAM and applied to an interfaceAddress received from FortiIPAM could not be applied to the interfaceAdmin disconnectedAdmin login disabledAdmin login failedAdmin login successfulAdmin logout successfulAdmin overrode VDOMAdmin password expiredAdmin performed an

greetings,here is the scenario:1. there are 2 interfaces on Fortigate at A site as the SD-WAN member interface to Azure, they are link 1(port 17) and 2(OL_INET) in the following picture.2. normally, FortiGate uses link 1 as the outgoing interface for traffic from site to Azure (so as for the responding traffic from Azure to site), when link 1 fails its performance SLA (let's say, packet loss reached its high threshold), sd-wan will use link 2 for the traffic from site to Azure, but the responding traffic from Azure to site will persists with link 1, as of now, there is only one link (MPLS) from Azure to each site. question: if there is an existing session established between site and Azure based on link 1, and then link 1 fails its SLA (let's say, packet loss reached its high threshold), which results in a link failover to link 2, what happened to the session? Is the session bundled with the interface which is used by the initial (SYN) packet of the session? why I ask th

Hi guys. So I’m new to firewall management and had a question. I’ve put some deny rules the firewall and have added some source ips and some destination ips. The thing is, if the rules are not being hit even after the policy has been pushed. The destination ips are NATed, so I need to know, do I put the IPs the real IPs are mapped to ( from the NAT pool)? Or the real IPs in the rule?

Hello Team,                 I am paloalto more guy and I used to utilize Paloalto's EDLs, so I wanted to ask about any Dynamic group that contains Malicious IP addresses, URLs, or domain lists that are included in the FortiOS and I can use them in my policies.If not, what are recommeded other sources "feeds" to add as External groups as feed that I can use for more protection in my policies?or also any  Malware Hash feeds that are valuable.TIA                  

I've been trying to transfer the FMG appliance firmware via TFTP in the boot loader, but hitting a road block with "Return to BIOS menu." when attempting to initiate the transfer. Backup firmware returns empty unfortunately. So long as I could resolve that return to BIOS, I'm pretty much golden.  

Good day, team,I have a question. I am currently implementing an SSL VPN and an L2TP VPN on a FortiGate 200F. My question is: can I use the same user group and the same IP address pool for both, or what would you recommend?

Hello all. I have for long time thinking about how i can remove the bundles of dedicated interfaces per VDOM and relying only on vdom-link to go and come from other VDOMS and a single or dual 10/25G interface to go to DC and internet for all VDOMs.My structure is as follow:2x FGT 600F in HA.VPN VDOM 1: 2 UTP cables (interfaces) in LAGServer VDOM 2: 4 UTP cables (interfaces) in LAGUser VDOM 3: 4 UTP cables (interfaces) in LAGMPLS VDOM 4: 2 UTP cables (interfaces) in LAGI have a BGP /24 ASN running on a pair of Mikrotik, and it is broken with /27 and /26 pointing via routes to VDOMs.Each VDOM has a dedicated VLAN transit to my DC network and each of them receives my "internet VLAN from my Mikrotik" so every vdom has a public IP address on an vlan interface (same vlan id on all vdoms and on the Mikrotic so the internet gateway of every vdom is reachable from another) (outgoing internet policies are natted with this IP). My future goal is to have a s

Good day, team,I have a question. I am currently implementing an SSL VPN and an L2TP VPN on a FortiGate 200F. My question is: can I use the same user group and the same IP address pool for both, or what would you recommend?

I am seeking guidance on using the FortiGate automation feature with FortiOS event log. I have configured a stitch to trigger on OSPF neighbor changes, specifically when a neighbor goes up or down. This setup works as intended for individual OSPF neighbors. After the trigger, then it performs the CLI script that does what it supposed to do and it works great. However, I want to adjust the configuration so that the stitch triggers only when two individual OSPF neighbors are down simultaneously. I have attempted to create this condition, but I am encountering an issue where only the first message field activates correctly, while the second message field does not do anything. Also, this is setup using the parallel option. Does anyone have guidance on how to set up the automation so it triggers correctly when both OSPF neighbors are down? Are there specific configurations or troubleshooting steps I should follow to address this issue?

Hello.I need help, we are receiving more than 10k alerts about this signature app.control.signature.testOur Hosts generate traffic to various IPs belonging to Symantec, Rapid7, etc. This signature app.control.signature.test does not exist and no information appears on the fortiguard page http://www.fortinet.com/ids/VID27840

Hello  I am getting a large number of entries related to the DNS.PTR.Records.Scan signature. The origin is one of my servers making requests to 8.8.8.8 or 1.1.1.1 What actions do you recommend? eventtime=1725978564223549647 tz="-0400" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" severity="low" srcip=19.19.12.101 srccountry="Reserved" dstip=8.8.8.8 dstcountry="United States" srcintf="z2" srcintfrole="wan" dstintf="Internet" dstintfrole="wan" sessionid=88096527 action="dropped" proto=17 service="DNS" policyid=229 poluuid="79818ba8-59a9-51ef-f294-51bc44ab72d9" policytype="policy" attack="DNS.PTR.Records.Scan" srcport=59436 dstport=53 direction="outgoing" attackid=51391 profile="high_security" ref="http://www.fortinet.com/ids/VID51391" incidentserialno=45804839 msg="name_server: DNS.PTR.Records.Scan" crscore=5 craction=32768 crlevel="low"

Hello.I upgraded my gate firewall to 7.2.9->7.4.3->7.4.4 and the SSL VPN menu is gone.I can't find it when I look for it in Feature Visibility.Does anyone know?I've done 7 of them, and this is an issue with 2 devices that don't use a VPN.I also found that it is enabled in the preferences below. ----config vpn ssl settingssetstatus enable------ Does anyone know anything about this? Oh , For gate is 101F.

Hi everyone,I need to plan upgrade of FMG/FAZ and since it's my first time I am trying to gather as much info as possible.Can anyone please tell me if I can do direct upgrade to 7.2.7 as stated in the release notes or do I follow upgrade path tool which has FMG/FAZ as well? In this case it suggests I should go via 7.0.12 first and then 7.2.7.Thank you.

Hello everyone, I have a problem with our fortiGate 60E in the office. I found when I arrived this morning that no connections were going through, after looking for the problem we found that the fortiGate was down. Currently we have disconnected all the cables and turned it back on but the LEDs do not light up. When we turn it on only the three-line LED on the left at the bottom of the FORTINET logo lights up. Thanks in advance.Forti concerné