Support Forum

Hi Fortinet Community,I have a FortiGate 60F with a 7.4.4 with a Trusted Hosts configured for admins.But in Log & Report>System Events I see Alerts every 3 mins:Administrator remote2 login failed from https(188.124.36.193) because of invalid user name.How can I block this specific IP from login attempts?GUI tutorials are from couple of years old.Maybe someone can make CLI tutorial?Thanks in advance.

Customer has an existing Cert for CN a url eg ras.banatesystems.com Requested to generate a new csr as the above due to expire When creating this on the fortigate , unable to name as ras.banatesystems.comAmended to new_ras.banatesystems.com Resent to get this signed , however customer has asked that the name should be ras.banatesystems.com. Is there an issue using new_ras.banatesystems.com get it signed and imported then change name back ?Or does it have to be explicitly "ras.banatesystems.com" Is there any documentation to support this ?  

Hi all ¡¡ I have not worked with BGP on a regular basis and I would like to know your opinion. In brief, I'm going to connect my firewall to 2 different ISPs routers(same provider) and I'm going to obtain from each of them a default route (0.0.0.0). One of them (Router2), gives me the same default route with prepend (less preferred) using another BGP session. Router 1 gives the default route witouth prepend. In the other hand, I'm going to add these 2 default routes to my SDWAN (I have more defaults than these 2). Is there a simple way to configure these 2 default routes on sdwan , so it routes traffic allways to the default, witouth prepends (Router 1), and only routes traffic to the other default when the Router1 is down. I've read about route maps, route tag etc, but maybe there is a more easy way to do it? Can SDWAN check the prepend to choice the active route? Thanks for your help ¡¡¡  

Hello community I am trying to STOP / START ipsec tunnels via API. I sucessfully connected to the API and sent a "tunnel_reset_stats" command to the API and the tunnl statistics get reset. So far so good. I was choosing "tunnel_reset_stats" since that commad requires additional parameters via http POST and so does the tunnel_down and tunnel_up command which ist my goal to achieve. I am using Powershell and the following code to reset the stats and it works: ==== CODE ====$ApiToken = "[redacted]"$body = @{"p1name" = "[Phase1Name]"}$EndPoint = "https://[firewall-ip]/api/v2/monitor/vpn/ipsec/tunnel_reset_stats?access_token=$ApiToken"$header = @{ "Authorization" = "Bearer $ApiToken" }$action = Invoke-RestMethod -Method POST -Uri $EndPoint -Headers $Header -Body ($body|ConvertTo-Json) -ContentType "application/json"==== CODE ==== Now accoring to the API documentation the  tunnel_up and tunnel_down command needs 2 parameters (p1name and p2name). so I adapted my scrip

Hello,on friday one of our clients performed an update from Client 7.2.4 to 7.2.5 which ended in a problem. The other Clients connected to our FortiClientEMS (7.4) had no problems.This client only showed "Messages", "Settings" and "About" in the left pane. But this is a "Zero Trust Fabric Agent"!So I uninstalled the client, did a reboot and reinstalled the client 7.2.5. The only change was that "VPN Connection" now showed up (but does not work). I then used the SupportUtilities did a FCRemove and also RemoveFCTID. The FortiClient_Diagnostic_Toolx64 does no collect any information - I can click on Start a 100 times - nothing happens. I do not get this client to run as a "fresh" client with "Zero Trust Telemetry". Do you have any hints for me?

Hi there Using Microsoft Entra and InTune, I am able to deploy the Forticlient v1.0.1041 app, from the microsoft store. Question is though - is it even supported? I saw a post from, I think it was 2019, where it said that it was no longer supported. But it linked to a different Forticlient App. So before I start explaining the issues I have with it, then is it even supported? BrThomas

I have a site in Azure connected to my on-prem fortigate via site to site VPN. That is working. I have a second physical site connected to the main on-prem fortigate via site to site VPN. That is working also. I cannot get traffic to pass from Azure VM to the second site. I am trying to do this without setting up another site to site VPN from secondary to Azure but if thats the answer I can try and figure something out there. I just figure passing traffic through the main site would be fine.

Has anyone been able to import a list of devices via CSV file but using Ansible instead of manually adding the CSV file into FortiManager GUI?I am in the process of creating our SoT using Netbox, and ideally I'd like to have a playbook that gets all the IPAM for a new site and creates a CSV file which is imported to FortiManager automatically.I was looking at the Ansible modules but I was not able to find one that does this. Has anyone been able to do it? Or maybe is their another way?

I have implemented fortigate 100F. I was trying to upgrade firmware version 6.4.6 to version 7.2. Currently, the firewall does not boot, neither does it provide any menu to select. Below is the message it shows when I restart it: failed verification on /data/datafs.tar.gzfos_ima: System Integrity check failed...CPU1: stoppingCPU2: stoppingCPU0: stoppingCPU7: stoppingCPU6: stoppingCPU3: stoppingCPU4: stopping Kindly help.

Hello, We have a production FortiGate with multiple vdom configured. And we would like to use the Security Fabric Automation feature. However, its only visible under the global vdom and not in any other vdoms like root and custom vdoms that were configured. Is there a way this automation can be turned for specific vdom? Thanks,

I have for testing Fortigate F80 (7.6.0) where I created ipsec VPN for clients.I can connect correctly to FGWhen I enable/disable split tunel I have always the same ISP ip address. About what I have forgotten.I have created ipsec with wizzard and doc from Fortinet.    

Hi, I am looking to increase security for my BGP set up and found validated ROA payload, which can make a BGP announcement Valid or Invalid. Is this something that can be configured/done in FortiGate? I hope you can share official links about it. Valid ROA links:Using RPKI Data — RPKI documentationValidated ROA Payload - Glossary | CSRC (nist.gov) Thank you!  

Hello, Today I updated Windows 11 to the new version (22H2) on 2 PCs. FortiClient VPN worked seamlessly on the previous version (21H2) but after the update it doesn't connect and gives the following message:  Is it a known issue with FortiClient VPN? Is there a solution? Thank you in advance,Costas

Dear Team, We have upgraded FAZ from v7.0.12 to v7.2.7 and post that getting error message "Please register this device" while trying to login to the FAZ gui.Please find attached snap and guide. Regards,Ganesh 

Hi,I have a Windows11 PC with FortiVPN client on board, it works like a charm.I would also have to get a second network device (Voip phone) out on the Internet on whose configuration I cannot access.This phone only works if it goes through my company's VPN (the same one that runs the client).How could I make this connection phone <> PC?Thank you

Hi All,So have a strange problem. We recently started testing Entra Only computers (we use hybrid AD computers currently)In our old setupComputers connected to LAN - IP address updated in DNSComputers connected via SSL VPN (Forigate) - IP address updated in DNSIn Our new setupComputers connected to LAN - IP address updated in DNSComputers connected via SSL VPN (Forigate) - IP address NOT updated in DNSI cannot work out why. I have checked the following.DNS will accept dynamic updatesThe fortigate SSL network adapter is set to register with DNS and the correct servers.Any ideas what else could be causing this? As we move forward with the roll out of Entra / Azure AD computers this will become more of a problem.Thanks

Internal Interface of Fortigate: 10.10.10.10Dial-Up Clients network: 10.20.20.20 - 100 Gateway: 10.20.20.5DHCP Server: 10.10.1.7 I've got three different IPSEC VPN's published off of a single 500 series gate but because our AD DNS isn't registering the machines properly, I want to move this to so that the dial-up clients are getting their addy's from a member dhcp server... I've even got the 2FA working on these but when the dhcp request hits the server, it's using the LAN interface of the gate so dhcp is trying to assign addresses based off of the internal interface on the gate and not the network that the dial-up clients will be using. In the dhcp request I can see this happening: corp500gw: diag app dhcp-relaydhcprelay: checking if we need to reconfiguredhcprelay: no changes detectedProccessing RTM_NEWLINK event.Relay client interface: vpn.segra2_0netlink message!Proccessing RTM_NEWLINK event.Proccessing RTM_NEWLINK event.dhcprelay: checking if we need to reconfigured

Hi, would like to seek for your advise for the current setup attached, basically we have another firewall on the right side of the diagram that connect to L2 switch, and on the FW side the port is configured as LAG while on the switch is under port-channel, but take note the switches are two separate standalone (not on stack). every time we connect the cable c3 and c4 the network is disrupted, is it because the aggregated ID is different from the firewall perspective? I always see this setup as common, but they always use stack switches.

I want to disable SSH Key logging completely. Also I have an ssh key configured in my Fortigate but I am unable to delete it. I have tried using delete, unset and setting the SSH key as an empty key but the key does not get deleted. How may I delete my key and disable SSH key logging completely?

Hi folks, I have a setup at home with a FG40F firewall and a 124F fortiswitch.I have 3 vlans in my network, and my switch is connected to my FG with fortilink. Since the new subnets (and vlans ofc) my connectio to the SMB server dropped down to 500Mbit/s. Is there any option to skip the traffic to FG while i want to reach another subnets devices? eg.: I have an SMB server in vlan 10And my workstations in vlan 20 I have no clue how could i achive this, i used mikrotik devices before fortinet. 

Kinldy let us know when the updated FortiOS 7.4.5 is getting relased. On 7.4.4 there is a known bug for SDWAN SLA performnace issue without any packet loss. The same seems solved on 7.4.5. 

I have the problem that when I use my personal PKI certificate of our domain under a Windows FortiClient VPN I have no problems, but when I want to use this or another certificate created for the Mac, I get a “Permission denied”.If I use a certificate created with Open SSL, the connection works. Does anyone here have any idea what needs to be changed in the certificate template in the PKI so that the certificates also work with the FortiClient for Mac, or where the problem lies? With best regardsMichael

Hi, maybe it can be already done, and I am blind, and maybe ;-), someone has an idea.It is possible to limit access for example using ZTNA to destinations.What I am looking for is a possibility, to restrict access requesting 2FA on a virtual server, virtual IP, based inside the policy itself.To limit outgoing access, it is possible to secure the network port or VLAN using a captive portal, but I want to achieve it INGOING to force 2FA for special services.If this would be possible, including groups from Radius-Server for example, it would make me smile. What I want to reach: limit access to, for example, Radius based users, in and outside the VPN while accessing a virtual server, to achieve a 2 nd layer of authentication out of the box without modifying the application itself. ThanksRonny

Hi All, I am little bit confused, why do we have to assign secondary IP address on the interface and what is the use of secondary IP address. Regards,Umesh

Hello Friends,                    I have DNS filter profile and applied on the internet accessing security roles.I need "if possible" to configure what like a dynamic object group that contains all hosts that are trying to connect to any malicious domain.is this applicable in fortios? and how please.Fortios ver. 7.xTIA,