Support Forum

hi, can anyone please advise how to check fortigate interface current transmit and receive speed via cli? the command "diagnose hardware deviceinfo nic port 2" only shows the overall packets sent or received on that interface. Thanks in advance!

Hi all, Trying to implement Citrix rendezvous V2, according to the documentation I should be allowing *.*.nssvc.net, has anyone been able to successfully allow *.*.url as an fqdn firewall object? Or would this need to be part of a static URL filter?Thanks!Y

How do we prevent a scenario when the first email is sent to a particular recipient within the IBE system, being intercepted by a hacker? After this hackers can create accounts in IBE and read emails. 

Hello,  I would like FortiClient to show the end-user a notification when their VPN connection drops/is disconnected. I can't seem to find any info on this in forums or documentation. Is there a way to enable this? Thank You! 

I understand this sounds silly but in my DNS settings I have "Use Fortigate Servers" enabled but both the Primary and Secondary DNS servers are listed as unreachable. However, at the bottom there is a section which says Dynamically Obtained DNS Servers where two DNS server addresses are listed for my WAN1 interface. What happens as soon as my Fortigate is able to reach Fortinet DNS servers? Does it stop using the dynamically obtained DNS servers and is there a way to enforce the Fortigate to use the dynamic ones?

Hello Everyone, I am facing a weird issue where WhatsApp File Transfer (images, voices,...) is being blocked when I enable web filter (the default with allowed unrated category) and application control (attached snapshot for reference).The Firewall policy is very basic with deep-inspection enabled and the ceritificate is added to each users device in the root certificate authority.Everything is working fine but we are unbale to send/receive images or videos on whatsapp windows application (the web and mobile version of whatsapp is working fine). Thank you for your support.

I am trying to add a device on Fortinac, the device is being added but the cli settings are not valid.Fortinac:9.4.4The error I got was as follows,Spoiler (Highlight to read)Unable to negotiate key exchange for server host key algorithms (client: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-rsa,ssh-dss / server: rsa-sha2-512,rsa-sha2-256)Unable to negotiate key exchange for server host key algorithms (client: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-rsa,ssh-dss / server: rsa-sha2-512,rsa-sha2-256)&nbs

HiSo we are testing deep SSL inspection and have a policy setup with our own cert (tried it with default as well).If I go to a site that is outside of the allowed categories on the web filter I get the usual FortiGuard Intrusion prevention blocked, have the page re-evaluated or override.The page shows it's connected by HTTPS and has a valid certificate.If i click on override I'm taking to the same URL but on port 8015,eg : https www.cdn-national-lottery.co.uk:8015/ovrd?fblob=UE-1  but this site returns a "This site can't provide a secure connectoin" and ERR_SSL_PROTOCOL_ERROR, on closer "inspection" (cough) it doesnt seem to have a certificate against the site.   I can't see how the initial page has a valid Certificate but the 8015 port override page doesn't have a cert, any ideas?  If I change the 8015 URL to HTTP it then loads the page,  Login to override gets to to http on port 8015 with ERR_EMPTY_RESPONSE and "This page isnt working

Resolvido     

Hello, I am looking for a solution to the problem, I have 2 fortigates connected via an Ipsec tunnel, I would like the second fortigate to have the same network as the first one but without nating.the first fortigate on which I have the entire network is fortigate 100f, I would like to have several vlans from this fortigate on the second fortigate 60 which is in the second location and they are connected by ipsecis this possible to do?  

Hi everyone.I need to create two phase2  interfaces for IPSec Remote access to allow users to connect to two different subnets. I have created phase 1 and phase 2 interfaces, but the VPN connection failed. config vpn ipsec phase1-interfaceedit "IPsec_Clients"set type dynamicset interface "wan1"set mode aggressiveset peertype anyset net-device enableset mode-cfg enableset proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1set xauthtype autoset authusrgrp "DC-VPN"set ipv4-start-ip 172.16.17.129set ipv4-end-ip 172.16.17.254set ipv4-netmask 255.255.255.128set dns-mode autoset ipv4-split-include "IPsec_Clients_split"set save-password enableset psksecret ENC 2kvF93dFz+5UvJw0S50Bor9tCqr6vYz7pPR2fvGbrWd4W3cblxHIHxhyLTYFOYGM0l+bq65DpcnqU4ij5S3C0jKgglRrnnRbK1gLljGNYeR1C1OgVmJ3xuJMDxPBifR2FjFeZ8I8WzdaEuIg5Zx60CYvbuUCak80vyBcpzauEUyURIq56C7kguCO5AFJN/f4l8lffw==nextendconfig vpn ipsec phase2-interfaceedit "IPsec_Clients"set phase1name "IPsec_Clients"set proposal aes128-sha1 aes25

Hey yall, I have a firewall that I’m trying to connect to ssh via the forticloud interface in order to fix the syslog. The firewall itself is not down, but when I attempt to connect via ssh it just says “connected” until it eventually says “disconnected”I believe I need to update the firmware so that the firewall can connect to fortimanager, but other than that I cannot find any other relevant solutionsAny help or suggestions?

Hello,  We are using FortiAuthentiticator to configure 802.1x EAP-TLS with computer authentication, we have to create two realms "host" as we have two domaines but FortiAuthenticator does not accept to create two realm with the same name.  is there any workaround? 

Hi I have a Fortigate 40F running v7.2.2 and I am trying to configure a DLP profile to block downloads of files 100MB or larger.  This profile is applied to a proxy policy. I've been testing the profile with various sizes of downloads and it doesn't appear to be blocking the download correctly.  I got some downloads blocked but the size-file value doesn't seem to be right, it's set in kB but doesn't seem to relate to the actual file size.  Below is the profile config config dlp profileedit "Block100"set feature-set proxyconfig ruleedit 1set name "Block100MB"set proto smtp pop3 http-get http-post ftp nntp cifsset file-size 102400set action block I've been testing different file-size values and it doesn't seem to work correctly.  The value is kB, so 102400 should block anything above 100Mb, however it isn't. Is there any config I've missed?  Alternatively is there any other way of blocking downloads of files of a certain size in v7.2.2?&n

Hello, What default bandwidth reference for OSPF in fortigate?

Hi all.I recently had a problem with publishing web services to users in my local network which i resolved with the help of comuinity.https://community.fortinet.com/t5/Support-Forum/Internal-users-can-t-reach-web-service-on-WAN2-interface/m-p/331839#M248297Solution was hair-pin featurehttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-Hairpin-NAT-VIP/ta-p/195448Once again thank you @xshkurti @GauravPandya  Following up on that topic, I now have several users who are connecting via SSL VPN. When they establish the VPN connection, they can no longer access the web services published on the WAN2 interface.All traffic from the VPN tunnel needs to go through FortiGate, so split DNS for the VPN portal is not an option, and public DNS records are held by a third-party registrar.I tried creating another firewall policy with the hairpin feature, but when I select the incoming interface to be the "SSL-VPN tunnel interface (ssl.root)", I can't select the virtual serve

Hi!There seems to be a severe limitation with 'firewall local-in-policy' as scalable substitute for 'system admin' limit of 10 trusthosts. Since (a) 'firewall local-in-policy' cannot reference 'system admin user' as allowed source; nor (b) 'system admin user' can specify a 'firewall local-in-policy' that may enforce access we seem to be stuck with trusthosts. For example, a simplest security requirement is: two ('system admin' with 'wildcard' and 'remote-group') administrator users A & B, where A are only allowed from login from host X, and B are only allowed to login from host Y, how can this implemented using local-in-policy (or any other way except 'system admin' trusthosts)? Feren 

LAN ports became very slow, the browser return "unresponsive page" error. the GUI can be accessed through WAN port and console normally. LAN ports throughput is not exceeding 2Mbps!

I just download a VM machine of Fortigate 7.0.2 (I tried with 7.0.1 also) and i cant access with https to the forti GUI. I checked the interface and is perfectly configured: with "allowaccess ping https ssh fgfm"I also tried to to access with ssh and works perfectly fine.Even i tried to configure the interface and add "http" and worked too!(but i want https not http) The Chrome error that appears to me is the typical: [ This site cant be reached ---- "ERR_CONNECTION_REFUSED" ] (i also tried to disable the windows firewall, but nothing works) Its a new and default Fortigate VM System, so i dont know why doesn't work.Anyone knows what is happening? Thanks!

Hello, we are facing a number of issues using Forticlient version 7.2.4 , i undersand they may be fixed in future versions. Is there a plan and date to release a version 7.2.5 of Forticlient anytime soon? Thank you Martin

Hi all,  I hope you're well.  I currently have 4 x FortiSwitch and 4 x FortiAP devices being managed via FortiLAN but am in the process of deploying HA cluster 90G's. Because we will now have FortiGate's in place, I would like to move our FortiSwitches and FortiAP devices from FortiLAN to FG managed but rather than manually import configuration I would like to use the fortilinkify.py script.  I have downloaded the script and have reviewed documentation available on the FNDN site however, it isn't very detailed and doesn't explain how to carry out the entire process. Can anyone with experience of using the migration tool be of assistance or provide me with a better way to automate this instead of manually pasting configuration? Thanks, Dan. 

Hi, I have a hybrid network setup with a FortiGate firewall (60 F) and Ubiquiti UniFi access points. I've configured two VLANs in FortiGate: one for guests and one for the main network. The Apple TV is connected to the main VLAN, but users on the guest VLAN are unable to see or mirror content to it. How can I enable communication between the guest VLAN and the Apple TV on the main VLAN so that users on the guest network can connect to the Apple TV? Thanks!

Hi everybody, we have a FortiGate acting as a VPN gateway for a client VPN for home office users. Authentication is done using Azure AD with SAML and the FortiClients are managed by an EMS though we only use the remote access profile. Whenever I try to connect to the VPN, FortiClient asks for the Azure credentials and then fails with error "FortiClient VPN unable to establish VPN connection. The VPN server may be unreachable(-6005)". Connecting through web mode however, works, so the problem's not with the VPN or SAML config. I created a custom VPN connection using the exact same settings that are configured by the EMS profile. Yields the exact same result. If I disconnect the FortiClient from the EMS however, the connection established without any issues. The problem is independent from FortiClient version (tested with 7.2.3, 7.2.4 and 7.4.0), so my guess is that some setting on the EMS is interfering with the VPN but I haven't managed to find a solution yet.Thanks in advanc

Hello community,I have installed the FortiPAM 1.4.0, and I also have the FAC 6.5.1, I configured the FAC as IDP SAML (proxy to LDAP server), and the PAM as SP. So, when I login in PAM I will use the credentials of LDAP server with MFA configured in NAC. But, after the correct flow login, I obtain in FortiPAM the  "authentication failed.SAML authentication failed.If you wish to use a different SAML account to login, please use incognito mode with your browser or manually clear your browser cookie of SAML IDP site." But in the logs FortiPAM's logs I see:ActionauthenticationStatussuccessReasonAuthentication succeededAuthentication ProtocolHTTP(10.50.200.176)Authentication IDfortipam_saml_auth_rule  Someone that is in the same situation?  Thanks in advance!

Hi,my customer is running a FG-100F v7.2.9 with FAP-221C on the latest firmware. It wokred pefectly fine until from one day to another it didn't. Clients try to connect to  SSIDs, it takes very long and often fails. When it works the conenction is very slow with high packet loss (~85%). I checked the logs and saw high numbers of log entires for "wireless ip assigned" and "wireless client authenticated". I checked the details of these entries and saw the same mac-addresses doing this in short intervals as if they frequently re-connect. Has anyone else experienced this? What could be the issue? I checked config wireless-controller settings -> fapc-compability enable, config wireless-controller wtp-profile - 221c-profile -> dtls enable but nothing helped. I saw high CPU usage for cw_acd process and a matching BUG ID for resolved issues on fortiOS 7.2.9 so i upgraded from 7.2.8 to 7.2.9 and it made no difference. I have no ideas anymore.