Support Forum

If sender alignment is used on Fortimail, it will block emails sent by some third-party applications for example from smartphones even if a domain of the sender (e.g. gmail.com) is legitimate. Would you happen to know how to avoid it?

If we configure an installer on /ems with "Deployment & Installers" -> "FortiClient Installer" to use a specific invitation and profile the installer itself (neither exe nor msi) actually installs a fortiClient which has EMS registration and connection during the first start... Up until an invitation code is entered. Why is the configuration of an invitation and default enabled modules for the installers possible, when it isn't baked into the installer? Do we have to run the FortiESNAC.exe -c REG_REG_TO_CLOUD -r [Invitation Code] process and option in all cases a FortiClient is installed - independent from what had been configured on the EMS to create and download this exact installer?

Hi expert, I’m going through the API document but cannot find any API endpoint to release quarantined email.Does any body have ideas on how we can automate the quarantine release? Best regards!

hi,i'll be doing an OS upgrade on a FG HA pair.if for some reason I need to "downgrade", do I just select the OLD firmware, reboot and then restore the config referenced to the OLD firmware?is the downgrade the same as upgrade process, i.e. i only upload the firmware in the primary/active FG, it will auto push firmware to secondary, auto reboot secondary, then auto reboot primary?

I have a LAN with 2 FGT's.  SSLVPN coming in to FGT1 can not reach FGT2 and server on FGT2.  Not sure where my issue might be.

Hello Engineers,My FortiGate is 601F and Frimware V7.4.4I’m encountering an issue with scheduling backups from FortiGate to our backup server. The backups are being executed successfully, but the filenames do not include the date and time as required.Here is the script I used:execute backup full-config sftp /FortiGate-FW/%%log.date%%.conf 10.220.210.10 admin klJKdfhd#54@dm,fI need the backup files to include both the date and time. Could anyone advise on how to modify the script to incorporate timestamps in the backup filenames?Thanks

Hi guys,  I hope you're well. Wonder if someone can help, I discovered a FortiSwitch on port8 and after the discovery I wanted to create a trunk group to my firewall to connect multiple ports (port1, port2). However, the problem is despite the switch being connected on port1 and port2 the port8 is still displaying as a reserved FortiLink interface and I cannot remove it.   I have tried to reboot the firewall, switch and sync configuration etc but nothing has worked. Port8 is no longer on the trunk and I can see no other configuration on the switch which would cause this to still display. Does anyone have any ideas? Thanks, Dan. 

Hello. I have a problem with my Forticlient access. I get a java error. Can You help me?

To allow a website from a blocked FortiGuard category on a FortiGate firewall, follow these steps: Log in to FortiGate: Access the FortiGate web interface using your admin credentials. Go to Web Filter: Navigate to Security Profiles > Web Filter. Edit the Web Filter Profile: Find the web filter profile being applied to the policy and click on Edit. Override the Category: Under the "Static URL Filter" section, click on Create New or Override, then enter the URL of the website you want to allow. Set Action to Allow: Change the action from Block to Allow. Apply Changes: Save the profile and ensure it is assigned to the correct firewall policy. Test the Website: Verify that the website is accessible and the policy is working as expected. Make sure to review the organization's security policies before allowing any website. 

Mua nhà trả góp: 5 lưu ý quan trọng, điều thứ 2 không nên xem thường!Mua nhà trả góp hay vay tiền mua nhà là chuyện vẫn thường xảy ra khi người mua chưa đủ vốn để trả cho toàn bộ ngôi nhà, tuy nhiên khi tiến hành vay mua nhà bạn nên cân nhắc thật kỹ lưỡng để không rơi vào tình trạng vỡ nợ. Để đảm bảo an toàn, bạn nên tham khảo thật kỹ 𝟓 𝐥ư𝐮 ý 𝐪𝐮𝐚𝐧 𝐭𝐫ọ𝐧𝐠 khi vay mua nhà cùng Lâm Thành Tiến, hãy chú ý điều thứ 2, chớ nên xem thường!  1. Vay mua Bất Động Sản phải chọn căn phù hợp khả năng thanh toán:Việc chọn ngôi nhà có giá không phù hợp với khả năng chi trả là một trong những sai lầm lớn nhất của người mua nhà lần đầu. Theo chuyên gia địa ốc Barbara Corcoran, bạn nên chọn căn nhà mà chi phí dành cho nó không vượt quá 30% tổng thu nhập hàng tháng.Việc này vô cùng quan trọng, đặc biệt là khi bạn mua nhà trả góp. Bạn cần đảm bảo rằng, tổng chi phí gồm số tiền phải trả ngân hàng mỗi tháng, phí cải tạo, phí bảo trì... không vượt quá 30% thu nhập.Bạn c

I recently installed a forti image V7.0.11 on pnetLab. I set up my lab which contains the forti, the cloud and a computer. I configured everything and I was able to go out on the internet. After some time the ping to the internet no longer works from the pc but the forti pings the internet well. At first I said to myself I may have changed something without realizing it. So I set up another lab, it was the same thing. I set up a third lab and I set the timer to about 1 hour the ping to the internet stopped. Every 1 hour I have to set up a new lab. I need your help.

Hi all,I'm not a Fortigate or Freeradius expert by any means but I usually manage to do things if I get some notes how to do things.I would like to accomplish the following.Part 1Authenticate windows 11 native ipsec vpn users with certificates (EAP-TLS)Firewall is Fortigate with 7.2.7 firmwareRemote user ipsec vpn with certificates, users are stored in LDAP (Not AD) directory, certificates contain e-mail address and cn.Freeradius is used as Radius server, connected to LDAP Backend, want to use that LDPA server to verify certificate and return authenticated/not authenticated. Part 2WPA2 authentication for windows 11 users with certificates (EAP-TLS)Wireless authentication for primary Windows 11 users, Fortinet Access Points connected to Freeradius server via Fortigate Firewall. Part 3802.1X authentication for wired clients, Fortinet Switches connected to Fortigate firewall and Freeradius server.There are lots of playbooks for doing this with Windows AD and Windows NPS server,

Hi ZTNA admins We were accessing ZTNA destinations with FQDNs from our Windows Clients, but since few days we are not able anymore, without any apparent reason or change.For now the ZTNA destinations can still be accessed by IP addresses.Following some tests I found that FortiGate and EMS can resolve the related FQDNs properly (back-end servers).However when trying to resolve the related FQDNs from client side I noticed that they dont resolve to the right IP addresses, but to strange addresses like 10.235.0.2, 10.235.0.3 and so, which are not part of our network! Anyone had the same issue?Anyone knows what is this range (10.235.0.x)? Is it internal to FCT as part of the proxy system?

I have an environment with 3 Azure datacenters (US, EU and APAC) and over 60 branch offices spread among the US, EU and APAC.  I have been trying, futilely, to get a definitive answer on the best way to deploy the security fabric in this environment.  The key hangup in the 35 maximum downstream devices statement in the FortiOS and Best Practices doc.  In my mind I envision a single fabric with our Azure US Fortigate as the root, but this doesn't square with the doc, unless I'm reading it wrong.  Does anyone have experience with deploying the fabric in larger distributed environments?

Hello,I have a problem with FortiClient (7.0.5.0238). I lost internet connection when connecting SSL VPN via FortiClient. I found this article: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Lost-internet-connection-when-connecting-SSL/ta-p/286345 but this solution is not working because: "After connecting to the VPN, do another 'route print' command. Note that, in the results displayed, the 'gateway' IP for the '0.0.0.0' entry has changed." - NOT, the gateway is still the same for both adresses and deleting route 0.0.0.0 is useless. Do you have any other ideas how to solve this problem?

My user is unbale to access FTP server from ssl vpn which protocol need to add in firewall policy when I add all services to the firewall policy, the SSL VPN user able to access FTP server but when  i  add FTP services in firewall policies the user unable to access FTP Serveris there any other services need add in firewall policy to access FTP server 

I am trying to achieve granular access control for each user, with strong definite unspoofable identity with IPsec user identity. IPsec login uses user account, and by allowing each user to only access the network through IPsec, I thought I should able to let Fortigate know which traffic is from which user, and create firewall policies on each user. (ChatGPT told me it's doable on Fortigate that's the reason I bought it :loudly_crying_face::loudly_crying_face::loudly_crying_face:) I have a Fortigate 60F on 7.2.8 After setting up a Remote IPsec connection, I found out IPsec identity is only good for IPsec login, but NOT for user traffic identification. If Fortigate can associate the IPsec VPN traffic with the user identity used for IPsec login, so firewall rules can be applied, then it would be so powerful. But... it's not working. In the FortiView Sources, after connecting, it just appears as a source with NO user identification, or MAC address, just a IP addre

Goal: Set up VxLAN over IPSEC to stretch LAN over Internet to another location Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-setup-a-VXLAN-over-IPsec-deployment/ta-p/297665 Device: FG-60F v7.2.6 Configuration: factory default, wan1 set as Internet interface, internal VLAN Switch as LAN interface with members internal1-5 Problem: adding existing LAN interface internal1 to soft switch interface causes an error:entry not found in datasource Steps taken: IPSEC tunnel is already configured Set up the VXLAN peer based on the IPsec tunnel interfaceconfig system vxlanedit "VxLAN-Interface"set interface "VPN-DR-IPSEC-VxLAN"set vni 11set remote-ip "10.10.11.2" Create a switch interface to bridge the local LAN interface with the newly created VXLAN interfaceconfig system switch-interfaceedit "VxLAN-Switch"set vdom "root"set member "internal1" "VxLAN-Interface"---> entry not found in datasource 

Dear all, I just read this KB https://docs.fortinet.com/document/fortigate/7.6.0/new-features/634909/socks-proxy-supports-utm-scanning-authentication-and-forward-server , and it looks good to my operation.So I tried to set up one Evaluation Fortigate and see if Form-based Auth is also supported. But seems no luck here. The Form-based auth only appeared when I selected HTTP protocol. If I selected Socks. No luck then.  Is there any way to achieve Captive portal + Local User DB + Socks-based proxy Auth on Fortigate?  

Hello everyone,I observe strange behavior with ACME client. I use it to generate certificate for firewall's web management running on default HTTP/HTTPS ports (not using any form of SSLVPN). When Let's Encrypt certificate successfully renews, it still remains in staging for some time (maybe day or more) and only then is deployed to the firewall's management webserver. Meanwhile previous certificate is still in use. Why is this happening? Is this by design?   fw # get vpn certificate local details LTSNCR == [ LTSNCR ] Name: LTSNCR Subject: CN = example.com Issuer: C = US, O = Let's Encrypt, CN = R10 Valid from: 2024-06-20 08:02:07 GMT Valid to: 2024-09-18 08:02:06 GMT Fingerprint: 7E:16:DE:13:E0:35:DC:52:F0:A4:DE:B8:CB:56:17:88 Serial Num: 36:00:5a:3e:a6:1d:15:13:6c:e3:14:03:92:06:58:00:ec:9d ACME details: Status: The certificate for the managed domain has been renewed successfully

Getting logs in system event in FortiGate about "Admin login failed" and showing ip of the (Server connected to the internal network) as the source ip what to do? Is disabling SSH will work for it. or SNMP will work. Please suggest what solution we can do?

I have successfully imported my certificate which is signed by my CA. The problem is I cannot choose it as HTTP server certificate. I see only two options, even though I have many more certificates in System -> Settings -> Certificates. I 've tried also via command line but again I only see these two options.Thanks in advance. Edit: I have also imported both Root CA and Sub CA certificates.

Hi everyone, I've been trying to understand if it's possible to assign an IP when using ZTNA.What I mean is when using SSLVPN I reserved a single IP for every user, is there some way to implement something like this using ZTNA?

Hi all,I achieved the NSE4 - FortiOS 7.2 Certification on September 21 2023. I am trying to get FCP certified but because of the certification transition, I am unsure which certificates I still have to achieve in order to get FCP certified.I think there are only two options possible:Option 1: the cert is invalid and I have to do a Core exam + one elective.Option 2: the cert (NSE 4 FortiOS 7.2 cert) is equal to the current Core exam so this means I only have to achieve one elective exam. I only have to make sure that it is before september 21 2025Can someone confirm or explain how I can become FCP certified in this situation.Regards

I understand Fortigate must do this by default but I have not found this stated in the documentation. In my case, the Fortigate-100F seems to have no TPM and even if it had the admin manual does not mention that login credentials are encrypted by the TPM. Therefore, is there any official source which confirms login credentials are encrypted in a Fortigate-100F?