Support Forum

  Most of the Source in Log & Report -> Secuirty Events -> Application Control not showing user name in source  UserName(Ip Address) eg E10293(10.20.10.55) few of them appearing IP Only 10.20.10.66  Please guide how to fix this we need to see UserName(Ip Address) in Source column for all devices

I have azure networking backend hosting azure subnet with my DC and computers subnet x.x.x.x/16 and then I have another subnet in azure hosting my fortigate VM y.y.y.y/22. On my fortigate VM I have the local LAN z.z.z.z/26. I have configured the fortigate with FortiClient and would like the DC and computers in Azure to only be reachable through connecting to the FortiClient.  

Hello;As mentioned at multiple posts here, the fnsysctl command may provide some helpful possibilities, including access to ifconfig, ls or other very useful commands. I tried to use it, unfortunately, not possible. Had installed education Lab with a bit older Fortigate FortiOS version, user as initial, admin, with super_admin profile (accprofile command in that version for change). Also, had installed (not fully yet) the Trial version of the Fortimanager with newer FortiOS, there's admin with super_user profile (and command for changing that is different, includes profileid instead of accprofile). Command fnsysctl does not work on both (even it should work at the admin user with super_admin profile). Two questions:- How and where to elevate privileges for admin super_user to admin super_admin at Fortimanager FortiOS (and to get the fnsysctl command work)?- Why the fnsysctl does not work even on the Fortigate FortiOS wher the admin has super_admin profile?

Hello, I´d had to configure PPPoE for use with an external VDSL-Modem on several FortiGate. The data in the PPPoE tunnel have to be tagged in VLAN 7. I have the following questions on that:1. What in general is the difference between "config system pppoe-interface" and "set mode pppoe"?2. How can I set VLAN-tagging for the interface which is configured with "config system pppoe-interface"?3. Any hints why the first config ("set mode pppoe") did not run on the FG-61F?  On the first Fortigate 100F with FortiOS 7.4.4 it worked fine with the following configuration. config system interfaceedit "ppp0"set vdom "root"set mode pppoeset allowaccess ping https ssh http speed-testset alias "VDSL-Bridge VID7"set role wanset snmp-index 18config ipv6set ip6-mode pppoeendset username "xxxxxxx@yyyyy.zzz"set password ENC xxxxxxxxxxxset interface "wan1"set vlanid 7nextend But on another FG-61F with FortiOS 7.4.3 and the same provider the above settings did not work. I had t

Hi, I'm working with a new client who has Fortigate, and have not done much work with them in the past.  They've got a very active security department and frequently need IPs added to their block list on 15+ firewalls.  I decided that I should try to script something to make that less painful, so I looked up the appropriate commands and created a script that prints out the appropriate CLI input.  When I run this in the script execution area of the GUI, however, it just says "Some or All Commands Failed to Execute" without giving me any additional info Here's what I'm running as a test (note, these commands work when I paste directly into CLI) config firewall addressedit Block_1.2.3.4set type ipmaskset subnet 1.2.3.4/32set visibility disableset comment "Added on 05/28/21 per INC012345"set associated-interface wan1nextend I've tried it without the "next" and "end" lines as well, as I saw them in other examples, but weren't sure if they were necessary Is there

Hello!  So I am completely new to FortiClient, but its management in my organization has been dropped into my lap. There have been complaints from users that the time that they have to log into the VPN is too short. I am just looking to see where exactly that timer can be changed.  Thank you.

Hi All,  I am little confused between the role of administrative access and local-in policy, aren't they do the same function ? administrative access can be enabled by using the interface level command "set allow-access" and we can only allow few protocols to access the FGT interface, I know there is a huge list of protocols available in firewall local policy but aren't these protocols are already blocked and only those allowed which are configured by set allow-access command, I tested this with my FGT firewall with main IP by using different ports  telnet 1.1.1.1 514telnet 1.1.1.1 179 and each time it shows this error "Could not open connection to the host, on port 514: Connect failed" and I didn't configure any local policy so my question is that after all what is the benefit of configuring the local policy when we have administrative access or what is the difference between the local policy or administrative access ? 

Hi,  I am checking the documents for security best practices and found that we can use the command set dh-params 8192 to force the second entity to use the stronger group for encryption, I want to know what is the overall impact of this command and specifically impact of this command on existing IPSEC configurations. For example if I have installed IPSEC tunnels in my environment with group 4 or group then how this command will impact me and secondly if tomorrow another client comes and say that he does not support 8192 in its system or for any reason he doesn't want to use the same group can we use other groups for that particular IPSEC ?

I have a Fortigate 60D which, I believe, is EOL and is bricked.  I want to format and re-upload the firmware but no longer have the image. (long story but lost a HD).  Would someone be willing to provide the 6.0.16 firmware for a Fortigate 60D to help try and unbrick?  I am not sure I can even get support any more none to less purchase it.  Also, not sure it will even work.  Any help would be greatly appreciated. Regards,johspa

Hi Experts I am putting up a startup podcast streaming business and looking to secure and manage/shape bandwith of my network giving traffic priority to STUDIO VLAN to streaming server in the cloud. Currently running with 5 staff all workstation connected wirelessly to ISP wifi router. Im looking to segment my network into three.- Studio VLAN- all streaming devices will be connected to this vlan- Workstation VLAN - all employee's laptop are connected wirelessly- Guest VLAN - Guest wifi access with no access to internal networkAppreciate if you could point me with the correct solution (features to enable in Fortinet and switche, Fortinet NGFirewall device model, and Fortiswitch) Thanks/JZ

Hi Guys, I know my device is old but I was hoping someone can help me. I am trying to block all traffice coming from a device group My device is FortiGate 200B 5.2.15I was testing and I created a device group and I added oneAccess points to it. I created a policy and I blocked all traffic coming from this device group. however other devices in different groups keep gowing through this policyand geting blocked. 

I am trying to set up automated backup over FTP on my FortiGate firewalls. I have the FTP server set up and running and have confirmed it is accessible through FileZilla. However when I enter the command through CLI I get an error message that I cannot decipher. Here is my command: execute backup full-config ftp [filename] [ftp-server] [username] [pword] And here is the error message I am receiving: Connect to ftp server 10.10.10.100:21 ...Please wait...Send config file to ftp server via vdom root failed.Command fail. Return code 5 I have searched but I cannot find anything specific to that error message. There are no entries in the log files on my FTP server, so it appears this error is directly related to the FortiGate.

I took my NSE4 exam on 29 September and passed.So far, I haven't received my certificate in my Fortigate training institute account.I've created a ticket to the support team, but no response from them.They were supposed to give me feedback within 48 hours, but they haven't responded.Is there any other way to contact them about issuing the certificate?

Hi Guys, I have FortiClient/ZTNA working fine but I am having issues connecting to our internal VCenter applience. I was wondering if anyone has this setup and working? When we set it up we get this error when we go to the login page. [400] An error occurred while sending an authentication request to the vCenter Single Sign-On server- An error occurred when processing meta data during vCenter Single Sign-On setup:the service provider validation failed. Verify that the server URL is correct and is in FQDN format, or that the hostname is a trusted service provider alias. Any Ideas, I have tried all the VMware/Broadcom solutions but no luck. Cheers John. 

Hi Guys,  does anybody knows why FortiClient does'nt work on my home network?  it shows always (Permission Denied). On the cooperate network it works flawlessly but i don't need it then on the cooperate network! and can anybody help where can i type following commands:diagnose vpn ssl debug-filter src-addr4 X.X.X.X-------> (x.x.x.x is public ip of user)diagnose debug application sslvpn -1diagnose debug enable Windows 10 thanksFortiClient  FortiAuthenticator  FortiAnalyzer  FortiToken 

We have a bunch of 60F and 60E still running 6.4. It's working great for us but with Fortinet sunsetting support for that next month, we're looking at 7.2.9 as the best upgrade path. Or do you have any version that you recommend?

So. The 8 port 108f seems to have entirely disappeared from their website, but I can still see it from 3rd parties.I have a brownfield industrial environment and there's a handful of places where it doesn't make sense to run new lines. But I'm trying to move the ransom mishash of network switches over to one vendor. Something like the 108f could fit that niche quite nicely. Especially with the option to power it via POE https://tutuapp.uno/ .

We have a bunch of 60F and 60E still running 6.4. It's working great for us but with Fortinet sunsetting support for that next month, we're looking at 7.2.9 as the best upgrade path. Or do you have any version that you recommend?

Hello Everyone, I am considering switching from Sophos and trying to make sure I have matching capabilities. I have a number of internal web servers for which I would like a reverse proxy with HTTPS (and ideally basic authentication). I also would like to be able to use Lets Encrypt certs for these proxies. My questions are After posting my question (below) I kept reading docs and it appears Virtual Servers are not exactly what I though but rather simple load balancers without ability to change protocol or map urls or I am missing something. The only reference I found is in Network/NAT/Virtual Server Load Balancing Are Virtual Server supported on FortiGate with 2G of ram (considering 50G) or they are related to proxy functionality which is not supported and require 70F or 90G?I understand WAF is not supported for 2G servers what's its relationship with Virtual Servers?Can Virtual Servers be on internal network without public IP/DNS?Can I use Lets Encrypt with s

haven't been able to find anything on knowledge base or while searching in general but maybe not (well) documented. is there a way to check for hits on routing route map / acl / prefix lists counters. like when you create one that allows some and denies other, can you see which of the options is hit how often?

Hello,I work for a company we have a mix of equipment (Fortinet, Cisco) some of my wireless computers keep disconnecting. What I am seeing from ISE logs is(5440 -Endpoint abandoned EAP session and started new - Latency (ms) 35187)We recently had issue with our Cisco wireless controller and we found out the EAP key intervals were set to low, and authentication intervals were also set to low. Pushing these intervals out so it didn't occur so soon seem to fix the issues. I have l looked all through this Fortinet MC4200 controller  I don't see any settings for this kind of thing. Could anyone please assist.

Hello,i try to learn more from this type of scenario so any help would be appreciated. I want to provide internet connectivity for 4 adjacent buildings that can be connected together either by running fiber or over the air with antennas.I was thinking of using two different ISP. One in each of the 2 main building selected.The goal is to have building 1 serving building 3 and building 2 serving building 4 but in case of issue from one of the main building with an ISP connection, operation would continu provided by the other main building. (for example building 1 would serve building 4 in case of building 2 failure).From my reading so far i try to implement an active active high availability scenario with policy based routing or i might be wrong ! should i got vrrp or ospf ? Can someone provide me guiding to achieve the best deployment possible in this type of scenario ? Thanks. 

I am working on designing a solution that requires a 'spoke' network to communicate with other 'spoke' networks without the other spoke networks being able to communicate with each other.There is a remote operations center, 2 datacenters (these will be hubs), and then 60+ remote networks.  The ROC needs to communicate with every remote site.  The remote sites all need to communicate with the datacenters and possibly an additional remote site (ie spoke) with strict source/destination and services rules.  These will also need to communicate via primary and secondary ISP connections.I am looking at the ADVPN/BGP solution from Fortigate documentation, but it appears there might be a couple ways to do this and am not sure what the best method is.  What would be the case for OSPF vs BGP? 

Hello, I've looked at fortinet's documentation and upgrading the fortimanager seems straightforward.What are the recommendations and important points to check when upgrading the fortimanager? For example, do WE have to check the ADOM versions ? The database ? Thank you

Hello,I need to upgrade the fortimanager from version 6.4.5 to version 7.2.7.The global database adom is in version 6.4.Will I also need to update the adom global database ?How do I know if this is necessary?Thanks