Support Forum

Ever since the firewall was set up, the DNS to contact the domain hmf.local is not working. Does the firewall inspect internal DNS queries? The local DC is the DNS server and FG is the DHCP server. The DC can be pinged from workstations. The FG is connected to the DC via LDAP. For e.g., This stops VPN users from changing their passwords remotely.This stops Windows machines joining domain.

Hi Guys, Normally when i use FortiClient VPN in my corporate network it works without any problems but as soon as i want use it with my home network to get access to the university network it shows "SSL VPN permission denied" without even asking FortiToken. I did all necessary sittings as my university explained in the video but still did not work. could some one please help me solve this problem!   I use Windows 10 thanksFortiClient FortiToken FortiAuthenticator 

Maybe not a FortiToken bug, but very annoying. When sizes of display/characters are larger than normal, there is no way to click 'allow' or 'deny' in the FortiToken app when accessing. GrtzS

Hello,  I need to configure Direct Connect on AWS using a Fortigate 90G.Does anyone have a step-by-step guide or any configuration documentation for this task? Thank you. 

Hello,I've been trying to report on how much time my users spend in the 'Streaming Media and Download' category on FortiAnalyzer for a while. I noticed that the reports I created weren't working correctly, so I started to dig deeper into the issue.According to my findings, the main source of the problem is that the 'ebtime' parameter is missing in the raw logs for some categories.The 'Streaming Media and Download' category is one of them. Since the 'ebtime' parameter is not present in the log, 'FAZ' cannot calculate the 'Estimated Browsing Time' value for these categories. How can I solve this issue? How can I ensure that the 'ebtime' parameter is included in these categories?The traffic logs of the 'Streaming Media and Download' category that do not contain the 'ebtime' parameter; date="2024-08-29" time="14:40:17" id=7408525277996777492 bid=39320003 dvid=1064 itime=1724931709 euid=1110 epid=3405 dsteuid=3 dstepid=101 logflag=1 logver=702071577 type="traffic" subtype="forward

hi , i am facing problem in 121g firewall , when we update firmware to 7.2.9 than HA is not synchronized but in 7.1.5 it's work , kindly help

Good Morning, Has anyone ran into issues when updating the firmware on MCLAG switches that would cause the switches to disconnect? I'm wondering if the MCLAG group of switches need to be updated to the same firmware at the same time? Topology:FW1 & FW2 (HA Active/Passive)SW1 & SW2 MCLAG Group 1 (SW1 connected to SW3)(SW2 connected to SW4)SW3 & SW4 MCLAG Group 2 (SW3 connected to SW5)(SW4 connected to SW6)SW5 & SW6 MCLAG Group 3 SW1 & SW2 are running FortiSwitchOS 7.4.1SW5 & SW6 have been updated to FortiSwitchOS 7.4.3 After updating SW4 to FortiSwitchOS 7.4.3 last night we lost access to switches 3-6. The log message that stands out is "action="unsup-cfg" status="none" msg="MCLAG: **peer software mismatch local-software(v7.4.1,build0787,230921 (GA)) peer-software(v7.4.3,build0830,240422 (GA))"" Disabling the port on SW1 that connects to SW4 gave us access back to SW3-5 but SW6 is still down. I'm assuming that updating SW3 to 7.

Hello,Currently we use FortiClient for SSL-VPN connection to our corporate network.We have licenses to use ZTNA also.Plan is to implement ZTNA.Is FortiClient needed or it can be without it?

Hello guys i need your helpHow can I configure the Traffic Shaper so that the set value applies equally to all users? For example, if I set the value to 20, it should be the same for all 30 participants, without needing to divide this value among the 30 users. Thank you

Hello All, Purchased an Fortigate 201 F, where i need to use 2x 10 GE SFP+ fortilink Slots as normal L3 port and further add it into portchannel. Is it possible.

Hii guys  i am using FG100F with OS v7.4.3 yesterday i install FAP-231F AP .My a 

Hi, we are in the middle of changing a FG300 cluster to a new FG200 cluster. In the old config we didnt use SD WAN, we had like one WAN1 for the MPLS connections and WAN2 and WAN3 for Internet Access. WAN1 mainly has all VIPs and VPNs, also it is a shared Internet Access so thats why we got WAN3 for all outgoing traffic. Now we would like SD WAN for Load Balancing or primary failover reasons but I am not sure what would be the correct configuration. If I do the implicit rule with 99%  - 1% or what is the best way? Thanks for your suggestions!

The secenario is that I was using Forticlient VPN (vpn only version) for remote access. On windows, it works fine with the .crt and .pkf local certificate. However, on Ubuntu, I tried same with those cert and receive a fail to create SSL.I did research but there was the FortiManagerr and FortiAnalyzer at https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-verify-the-ciphers-used-in-a-PKCS-12/ta-p/327734 but I'm not sure it works the same.The debug log is as below: 20240823 09:08:53.049 TZ=+0700 [sslvpn:DEBG] vpn_connection:307 SSL error: error:0308010C:digital envelope routines::unsupported20240823 09:08:53.049 TZ=+0700 [sslvpn:EROR] vpn_connection:463 Failed parse PKCS#12 file20240823 09:08:53.049 TZ=+0700 [sslvpn:EROR] vpn_connection:1518 Failed create SSL Anyone that got into such problem and found the way to overcome? Thanks and appreciate any help would come up! 

I would like to disable directed broadcast but have been unable to find how it might be disabled for all interfaces. Is there a command to achieve this?

Hi Team, When the user registers his account on the portal, he must select a prefix for the phone number. The question is how to set my country to be my favorite or by default will be chosen. The current default setting is +1 and I don't know how to change it. To clarify the question, how to change it so that the +48 prefix is always shown to each user. I traied change that in html code, but i failed. I searched the forum but didn't find anything. A request for help Fortiauthenticator 6.5.3  

Hello everyone, Our Firewall was configured with several virtual IPs (static NATs) to forward internet traffic do our internal services.Currently we do have three public IP adresses but I want to merge them. So I do want to use virtual IPs with FQDN.I guess I need to enter the External FQDN in the top field, and the internal fqdn in the bottom field (mapped address). We use windows DNS server for internal name resolution (so that our clients can find each other). When we do intern name resolution the public domain name gets overwritten with the internal IP address... (e.g. service.company.at gets an private IP adress in our company lan and no the public one) so traffic does not have to use the internet. So I guess I somehow need to add two different DNS to FortiGate - one for public dns name and one for the private IP adress (=mapped address). Does that even work when both names are identically? 

FG 400F - FortiOS 7.2.8I'm trying to export  root certificate with password and private key.  I tried exporting using TFTP however, I can't export build in certificate off the Fortigate. "built-in certificate 'fortinet_ca_ssl' is not allowed to export". KBs that I've run through:Export a certificate | FortiGate / FortiOS 7.2.8 | Fortinet Document LibraryProcedure for exporting and re-importing ... - Fortinet CommunityExporting or importing a local server cer... - Fortinet Community - How can I export the cert in p12/pem format so I can extract the private key and password?- How can I decrypt the private key and password? Appreciate your feedbacks. TIA :) 

Hi,I can't get a reverse rule to trigger for VLAN communication. VLAN 30 is able to ping VLAN 100, but 100 can't ping 30. VLAN 30 Laptop[10.0.30.2] can ping 10.0.100.200, and 10.0.100.1, and 10.0.30.1VLAN 100 Laptop[10.0.100.200] can't ping 10.0.30.2, but can ping 10.0.100.1 and 10.0.30.1FG and Laptops are connected to 8 ports switch. FG is trunk port. Laptops are VLAN Access Ports 30 and 100 respectively.0 bytes go across 100 -> 30 rule, unless I do Policy Match, then its the 40bytes FG tests withI am going to re-start the FG after posting this...just in the event something rules wise effect its. I have about 50 rules, and nothing worked as expected, so I cut down to 3 rules and smaller test setup. The other rules not included are 30 -> Wan (working fine) and Implicit Deny. Here are screen shots from the Firewall:Reset counts to ZeroBoth Laptops doing PING to each otherPolicy MatchPolicy Match ResultPolicy After Policy MatchVLAN settings

Can a fortigate act as the hub for multiple hub and spoke instances? Such as a Hub A for 5 spokes....and a hub B for 5 other spokes. Dont want the A and B spokes to see each other. I didnt want to run through a second hub wizard if I was going to break something. It appeared to setup a different routed network but the AS number was going to be the same. I guess the single fortigate cant run multiple instances of BGP?Would there be a way to do this and separate out the routing?

Hi, When remote user client system trying to access the internal application via Fortisase to SDWAN SPA, it is not showing actual ip of the client system. Instead of it shows the tunnel interface ip of the Fortisase.How can we get the actual client ip details on sdwan spa.Please guide. Regards,Ganesh

An endpoint previously had a vulnerability for an application flagged by FortiClient vulnerability scan.The application has since been uninstalled and the vulnerability is not being detected. However the application is still showing in the Software Inventory. It has been a number of weeks and I can confirm multiple vulnerability scans have since been ran as expected. This issue is occurring with multiple applications but for this application in particular I can see that a vulnerability is no longer detected. I cannot find any executables for the applications on the endpoint. Along side uninstall is there anything else to do to ensure an application is removed from the Software Inventory? If this is an issue is there a location I could provide the application name for further review? I'm curious if this is linked to Issue 73790 for 7.2.4 but just wanted to ensure I've covered all checks from my side. Thanks

DearsAppreciate your support to advise with expected action here for below scenario: I purchased standalone fortigate 100F without forticare or any license 1 year ago and still not registered till now and now I want to order UTP bundle license for itDuring activation of this new UTP license, would be effected by AutoStart policy and maybe license will be backdated? And if so , all UTP bundle will be effected or only forticare/warranty RMA part? 

Good morning,Every time our user goes to connect to the VPN to access the server, reaching 98% he disconnects or sometimes he connects and falls, only the second time it works. Is there anything I can check to see why this problem occurs?

Hello,we have SSL VPN enabled for our employees, based on policy destination.with that we're routing only certain services via VPN to for example whitelist our public IP for services and make a service reachable for employees.the rule contains an address group which contains several FQDNs.The problem we see here randomly is that the firewall resolves 2 IPs for an FQDN, which is fine and intended, but the routing table on client side only contains 1 sometimes."suddenly" (without reconnecting or similar) the 2nd IP also appears in the routing table, but why? So randomly its working or not working to get routed via VPN.As it is not working properly to route all needed traffic via our SSL VPN we added a 2nd rules directly below the main one.that new rule should route all “amazon aws” traffic via VPN - this was implemented for testing and troubleshooting.This rule does not get hit very often, assuming the routing table does not get populated with all routes, as routing all amazon-AWS traffi

I want to implement something like this, with the same public ip and diferent dns names to redirect to diferent ftp servers behind the fortiweb. Like http content routing but for ftp?any idea