Support Forum

As the title suggests, I have a number of small web applications that I need to refresh the firewalls for. Currently using cisco asa5506-x which was fine until we started doing more layer 3.Externally, we currently have around 25mbps with peaks at around 100mbps and we are looking for the basic security functions, probably just the IPS (ATP license). We have no internal users, little VPN and 10 vlans.Internally, network is 10gb and we are running Vsan/vmotion but these would not go via firewall. At most, the internal traffic will not go over 1gb and that's probably due to backups running directly from servers.Looking at the specs, it suggests it will do well in excess of that. However, in the real world does this sound sufficient?I was looking at the G series for the new hardware.Thanks

Hello,Our newly deployed Fortigate firewalls at our DC, which are managed via FortiManager. At the time of deployment we created a tunnel with one of our offices. Now I want to modify the Local Address on the Fortigate firewall. When search in Policy & Objects tab on FortiManager for the address group used as Local Address in the IPSec tunnel, I cannot find that address group. However when I login to firewalls directly, i can find that address group. I cannot (should not) be making changes directly on Firewall as these changes will be wiped out upon next policy push from FortiManager.  So how do I find the address group in FortiManager which is used as Local Address in IPSec VPN configuration so that i can edit it.  Thanks.

Hello FortiNAC community, Recently i started a new projet where i have to deploy and configure FortiNAC, keep in mind i know nothing abt FortiNAC so bear with me please I encountered an issue when i was trying to add a device(Switch in this case) in the inventory, my client told me that they have unconfigurable Switches Does anyone have a solution on how to add a Switch that you can't configure an IP address in ? Thank you in advanceBest regards,

Need to understand if the FG-70F in my hand can be able to support two IPSEC VPN via WAN interfaces connected to two different ISP in active active mode (with load balancing). This is branch and at central side we have other FG with different model but same motive.  Please let me know how is it possible to implement this. 

Hello good evening dear friends, we have an issue with the nmap command nmap -sV -p 161 but we have a segmentation firewall which the destination is there, currently we only have the ips in the security profiles but as a monitor, but it still appears like this filtered instead of open, do you know the reason? Thanks

hi,i'll be getting a new FG 401 but don't know yet which FortiOS code.i usually get OS 6.4.6 with newer device.my question is, since this is a new/blank FG, can i jump directly to 7.2.9?or do i still follow the "lengthy" upgrade path? 6.4.6 > 6.4.8 > 6.4.10 M > 7.010 M > 7.2.5 F > 7.2.7 M > 7.2.9 Mto my knowledge you follow the upgrade path when the FG is configured/in production so that it will "update" CLI syntax/command with the newer OS. 

Hello everybody,we are currently using a Fortigate and ForticlientOnlyVPN with an IPSEC XAUTH configuration.Since we are now moving to Forticlient EMS (up to date server and client) and after testing Forticlient 7.4.0.1658 the following problem occurs:If I manually add the IPSEC connection we are using with the OnlyVPN to the new Client (managed with EMS), succesful connection is possible.If I config the same IPSEC parameters on EMS and distribute it, remote access does not work.The error message on the client states something with Error: Aggressive Mode and the log files hints a certificate error (I replaced some sensitive information):21.08.2024 08:12:21 error ipsecvpn date=2024-08-21 time=08:12:20 logver=1 id=96567 type=securityevent subtype=ipsecvpn eventtype=error level=error uid=664559DDC9CC478DBC0D3A5B686BAA87 devid=FCT8002127206410 hostname=PC pcdomain=domain deviceip=IP devicemac=MAC site=default fctver=7.4.0.1658 fgtserial=N/A emsserial=FCTEMS8824006969 os="Microsoft Win

Hi people,I did some testing because our upload/download speed is nowhere where it should be.We have 1000/1000Mbps contract with our ISP.When I test the speed without Deep Inspection we got 925/925, that is pretty great.When I enable Deep inspection our speed goes to 850/350 which is really bad.Testing is done in this way:Client PC > Access Switch > Core Switch > FortiGate > ISP > InternetAnybody has some ideas ?

Hi people,I did some testing because our upload/download speed is nowhere where it should be.We have 1000/1000Mbps contract with our ISP.When I test the speed without Deep Inspection we got 925/925, that is pretty great.When I enable Deep inspection our speed goes to 850/350 which is really bad.Testing is done in this way:Client PC > Access Switch > Core Switch > FortiGate > ISP > InternetAnybody has some ideas ?

Hello, Can I please have my nickname changed to sifr? Thanks

Hi there, So after upgrade forticlient from version 6.4.8 or 6.4.9 or 6.4.10 to forticlient (any version) of 7.0.XX to 7.2.XX, I starting have issues with FortiAMSI.dll: C:\Program Files\Fortinet\FortiClientx86\FortiAmsi.dll is not designed to run on Windows or it contains an error. Try reinstalling the program using the original installation data or contact the system administrator or software vendor for support. Error status 0xc0000428. Is randomly in some PCs, starting from Windows 10 - vs. 1909 Fortinet support means that Microsoft will have to resolve this. I don't believe that Microsoft does it, "per client" and not on a global level. Does anyone have a similar problem? I ask the question here, that someone may have had a similar problem, and found a solution. We have added ticket at Microsoft, since, in principle, it will be Microsoft's issue/problem. 

We are using FortiEMS in our organization. And recently we have received a vulnerability related to Oracle JAVA on EMS server side. So, please suggest whether JAVA is required on EMS server side. Apache 2.4.x < 2.4.62 multiple vulnerabilities - HighOracle JAVA SE multiple vulnerabilities - High Please refer attached snap. Thanks.

Hello all, i need help making sense of a malware log in FortiAnalyzer.The log only show the Threat as a bunch of numbers and letters and i am having a hard time deciphering its meaning. Can some one help. It seams a "generic" threat ID but i really don't know for sure since the source is a blog in wordpress and it has already been the target of defacing and redirect before. I would appreciate any help.

Hi all! how are you?I upgrade all our Fortigates to 5.6, but now the Analyzer doesnt  process logs.Can anybody help? I have to downgrade the Fortigate Firmwares to get back to work my Analizer?There is any news about new version of FortiAnalizer?I upgrade my FortiManager too, and if I execute a downgrade of Fortigates, my Manager stop work normally...There are some with the same problem?Thanks you all!Best regards. 

Hi, I´m using a Fortimanager (v.6.2.6) to serveral Fortigates (also v.6.2.6). Over time the Fortimanager looses the FGM-Acces to some Fortigate´s and I already debbugging it with this cookbooks: https://kb.fortinet.com/kb/documentLink.do?externalID=FD33882 https://kb.fortinet.com/k....do?externalID=FD48001 https://docs.fortinet.com/document/fortimanager/6.2.0/cli-reference/861511/fgfm-reclaim-dev-tunnel (he dont get the tunnel, but over time he get it without this command) [size="4"]But in the end I dont find the issue. Also i checked the ports for Input/Output errors (zero tx/rx errors, only sw_in_drop_pkts : 4  errors!?)[/size] [size="4"]What can be the issue here?[/size]  

 Good Morning,  I have in my office 5 APs FAP231F connected to a Fortinet Switch and then to our Fortinet Firewall FW80. The FW provides DHCP to all our devices and then connect using IPSec Tunnel to our Domain Controller for DNS Services. A couple of months ago we updated configuration in the Firewall and activated antivirus and file filtering, ssl/ssh inspection and web content filtering. These are the only changes done recently and are my starting point for any possible changes in the environment that could be affecting my wireless network. I disabled all the fw security features I enabled a couple of months ago and seems to bring stability to the wireless network, yet in the last week I started experiencing the random issues of APs not broadcasting SSID or if connected to the SSID disconnecting from internet. Please find below our current AP configuration: Any help or guidance in what to do next would be much appreciated.    

We are ussing Fotigate 201F- Captive Portal applied and LAN User authenticate but Wifi Users not authenticate, both Networks are different segment (LAN- 10.161.0.0/16, WIFI- 10.172.0.0/16while applied the Captive portal, LAN Users properly authenticate but WIFI users trying to connect the the authentication but page not open however did not get dhcp IP but when disable the Captive Portal then users connect properly through DHCP IP. Connectivity-- Users---LAN/WIFI >> L3 Switch >> Fortigate >> Internet.

I added SSO login to VPN with these guides:https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Companion-for-troubleshooting-SSL-VPN-with/ta-p/217719 Currently, I can connect to the VPN using SSO via the SSL-VPN realm link, connect and it's working great.When I'm trying to connect via FortiClient I have an issue, if I connected to a session from the SSL-VPN realm portal it opens the browser with the session, if not it will open 'This page isn’t working'.On Google Workspace side and on FortiGate side, everything looks OK in terms of configurations. The fact that I can connect to a session with the SSL-VPN realm portal prove it.I'm trying to troubleshoot this issue with no luck, what am I missing?I'm using FortiGate 60F version 7.2.9  

I'm having a DUP! ping on Fortigate 100E. please guide to find the error and how to fix it. thank you

Baddi_Aw # 2024-08-31 10:17:53 id=65308 trace_id=8 func=print_pkt_detail line=5836 msg="vd-root:0 received a packet(proto=6, 172.27.138.59:39491->20.190.145.140:443) tun_id=0.0.0.0 from PORT-CHANNEL251. flag [S], seq 1152205440, ack 0, win 29200"2024-08-31 10:17:53 id=65308 trace_id=8 func=init_ip_session_common line=6020 msg="allocate a new session-3e06eec6"2024-08-31 10:17:53 id=65308 trace_id=8 func=vf_ip_route_input_common line=2612 msg="find a route: flag=00000000 gw-223.30.9.17 via port3"2024-08-31 10:17:53 id=65308 trace_id=8 func=__iprope_tree_check line=539 msg="gnum-100004, use addr/intf hash, len=55"2024-08-31 10:17:53 id=65308 trace_id=8 func=get_new_addr line=1258 msg="find SNAT: IP-223.30.9.18(from IPPOOL), port-39491"2024-08-31 10:17:53 id=65308 trace_id=8 func=av_receive line=480 msg="send to application layer"2024-08-31 10:17:53 id=65308 trace_id=9 func=print_pkt_detail line=5836 msg="vd-root:0 received a packet(proto=6, 172.27.138.59:39491->20.190.145.140:443) t

Hi all,I need to create a firewall policy for AD communications but RPS service is using a lot of high ports and we need to avoid this, I heard that Juniper can use UUID mapping at app level and I'm wondering if also with Fortinet we can do that, any idea?thanks 

Hello, from day to day I started having problems starting the FortiClient application. Before that it worked for me for about 2 weeks. After startup, FortiClient shuts down after about two seconds. Can't click on anything in the app. No error appears anywhere. They could not advise me even at the IT department in the company. I am said to be the first to come up with such a problem. Reinstalling didn't help.Version: 7.2.4 (other version is not available in our company)Thanks for any help

Hello,I have issue with RIA by Tunnel in case of main WAN link is down or IP SLA is not meet... I have two sites  (MAIN and SMALL) and FGTs 100F in each.  This SMALL Site has three interfaces:WAN1 - Internet accessIPSec Tunnel0 - P2P Link between sites IPSec Tunnel1 - use WAN1 Internet Interface   I have one SDWAN zone with all these interfaces above and two rule: 1. To_MAIN Site (use Tunnel0 -prefered,  and Tunnel1) (for traffic between sites)2.To_Internet (use WAN - prefered, and Tunnel0 when WAN int has issue or is down (IP SLA))   I have FW rule to from SMALL to MAIN site and destination interface is SDWAN zone Issue is when WAN link has issue (or is down) and is removed from RoutingTable (thanks to SLA) -  Internet don't work, I see in debug that trafic is going to tunnel0 but not work, I found also in debug that FGT is still do  NAT using IP of WAN Interface , but why ?? When I disable NAT on FW rulle

Hi, It is trying to do certified EAP-TLS for remote users on ldap.I created a Fortiauthenticator local ca as CA.While there is no problem with local users, it gives an error with remote ldap users.On the Create New User Certificate screen, I used the remote user name as Name (CN).I imported the CA and user certificate to the PC, but it did not work.The same process works with local users.What could be the reason?    2024-09-02T12:08:04.633327+03:00 fac radiusd[16808]: (144) authorize {2024-09-02T12:08:04.633338+03:00 fac radiusd[16808]: (144) [preprocess] = ok2024-09-02T12:08:04.633345+03:00 fac radiusd[16808]: (144) [chap] = noop2024-09-02T12:08:04.633350+03:00 fac radiusd[16808]: (144) [mschap] = noop2024-09-02T12:08:04.633356+03:00 fac radiusd[16808]: (144) [digest] = noop2024-09-02T12:08:04.633363+03:00 fac radiusd[16808]: (144) eap: Peer sent EAP Response (code 2) ID 204 length 172024-09-02T12:08:04.633368+03:00 fac radiusd[16808]: (144) eap: No EAP Start,

Hi Team, I have configured a FortiSwitch 108F-FPOE // version S108FF-v7.2.4-build5148,230530 (GA) // via fortilink and everything works ok, but when I reboot the Fortiswitch, I start getting messages saying "FortiLink: ISL timing-out for trunk". Info  Before restarting the Fortiswitch After restarting the FortiswitchFortiswitch Trunk configuration config switch trunkedit "_FLinkDhcpDisc_"set auto-isl 1set static-isl enableset members "port10"nextend What can this be due to? Thanks & Best Regards,Juanmi