Support Forum

Hi All, I know how I can negate a session filter from CLI, but haven't found a way to do it in the gui. I don't like much the search box in gui isn't very intuitive/easy to use, but at least it does offer a nicer view of sessions ;) So anyone know how we could negate a session filter in GUI, as an example, I would like to list all session that aren't port 53 or all session aren't using the "HighPrio" Traffic Shaper.. Thanx for you help!

Hi all, I provide users with Fortinet Wifi and ISE captive portal. After users fill in the required information on the captive portal, ISE drops an e-mail them their credential. For checking their mailbox, the user needs limited access. In order to get this access, they need to exit the captive portal, by clicking 'Cancel' and 'Use Without Internet' at the top right. Then, they will be able to go to their e-mails and get user information with the limited access they receive. When they open a page and redirect to the captive portal, they will be able to log in with their information. I don't want users to have to click 'Cancel' and 'Use Without Internet' to get restricted access. My request is that when the user clicks on the ssid, IOS and Android should not direct them directly to the captive portal. If they open a tab, let them be redirected. However, they will have received the network IP and I will be able to give them restricted access. They will open a web page, and

Bom dia, Estou com duas redes separadas, faixa 192.168.1.0/24 e 10.1.0.0/24 ambas separadas fisicamente. faixa 192... navega normalmente, mas na faixa 10.1... entrega IP, DNS. mas não navega, toda rota está configurada para navegar normalmente. Alguém já pegou essa falha?.

Hello, I have restored an archive on cluster of 2 gates from the master gate, but now it's unable to connect (GUI, CLI, console ..) with anyone local account on them ..... This cluster is in production and all the traffic is ok  ;  On Fortimanager, members are ok and synchronized , the state (active-passive) is ok ; I can push new configuration from FM to Gates etc...   All to be seems ok but impossible to connect on gates ! I have tried to push a retrieve since FM but same result. Any idea please ??For information, the maintaner function is disabled.  Thanks

Hello everyone, I'm kind of curius at this point if there is any solution to this problem: I have a Fortigate 60f (v7.0.10) setup to handle my ipsec VPN connections. There are site to site and end to site tunnels configured and working. The Fortigate is directly connected to the internet with a public IPv Adress.One of the end to site VPN's is using the old Shrew Soft VPN Client and I want to switch to FortiClient. After a few frustrating failed tries to set up the tunnel I realized all the internet connections I tried used DS-Lite. When I connected my notebook with the FortiClient (v7.0.7.0345) installed over the SIM card it immediatly worked. I saw for SSL VPN there is an extra configuration implemented to accept sessions over DS-Lite https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/766455/dual-stack-ipv4-and-ipv6-support-for-ssl-vpn .Is there anything similar for ipsec VPN's or am I missing something? The config which worked with FortiClien

Hi All,  Customer is running non forti APs with a Wireless Controller located over an IPSec VPN from my Fortigate to their ASA.   AP's are losing their connection to the controller, and the customer is confident the Fortigate isn't sending on CAPWAP traffic.    I thought this might be an MTU issue, with ASA side set to 1500, Fortigate was set to 1420 so I've increased it to 1500 but issue is still ongoing,  Any ideas, or debugs I can run to help determine the cause?   Thanks, 

Hi! i've already sent an email to Fortinet Support and they told me to post here.I've done a fast research on how forticlient vpn store and crypt data inside the register of Windows and i've wrote  a PoC that succesfully decrypt them, i've tested on 3 PCsI want to send to you the code to review it if i canTy

My company is a computer management system developer. There was a problem detecting viruses. From the firewall base of "Fortinet"When I checked the file on the virustotal website, it was not detected by the "Fortinet" database. I need your help to verify its authenticity. or give me adviceThe software I develop requires communication between the server and the client. So I want to inform you that the file My "OfficeaAgent.exe", "Officetools" do not contain any virus components. Please continue the investigation. and update virus information at the websiteYour detect has greatly affected the way my program looks. Can you give me some advice? and my partner to resolve the problem quickly.Attachment :fortinet_recheckvirustotal :https://www.virustotal.com/gui/file/9d86abb7bf6a3ab10dd35c119bab06ec1029e00eb8c827ec42a99a4b0a272d07/detectionThis my site :https://starcatsoftware.com/best regards----Position: EngineerCompany: MOSCII CORPORATION CO.,LTD.Site: https://starcatsoftware.com/Country:

Hello, We have fortigate f100 and as we discovered there is no any disk for logs.... As I see we need f101, but we already have f100, is it possible to somehow add disk to this f100? 

Hello FCT/FGT adminsI have FGT 7.2.9, FCT 7.4.0 (Windows, MacOS & Linux).Trying to configure IPsec with IKEv2, with authentication from Windows NPS, to use multiple AD groups in different firewall policies (access based on group id).The procedure is described in the below tech tip.https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-multiple-groups-with-EAP-for-IKEv2-SAML/ta-p/334453Basically the authentication is working fine when tested on a sample group, and remote user can connect properly.The above tech tip mentioned the below tech tip to configure VSA attr on NPS for group matching.https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-FortiGate-and-Microsoft-NPS-Radius/ta-p/213024My problem is that I have multiple Windows groups (more than 10), and such case is not covered by the tech tip (only one group is given as example in the NPS tech tip). So I'm not sure but I'm afraid if it will require to configure 10 times the above config on NPS (for

I would like to disable CDP and have noticed it is referenced in certain CLI commands in the CLI reference. However, I have been unable to find how it might be disabled globally. Is there a command to achieve this?

Hi I' ve a little problem and don' t know how to solve it. What I want: Since years we have a Corporate VPN Box in our LAN with the IP address 172.17.36.6 and this box connects our internal Network with the range 172.17.36.0 with the corporate Network 172.124.3.0 over this VPN tunnel. In their Network is a Intranet Webserver (172.124.3.215) and we can reach this server from our internal Lan without any problems. So now I tried to configure a SSL VPN on the FG 110C so that a remote User can get this intranet webserver from outside also but I always get the error " SSL VPN Proxy Error" The proxy server could not handle the request GET/proxy/http/172.124.3.215/ Reason: Access Denied All bookmarks to our internal network worked like a charm. The internal DNS which I configured in the SSL-VPN Settings can resolve the address. Also I created a SSL.root -> internal policy but I get all the times the same error. What I' m doing wrong? Thx

Hi all¡ I would like to protect some of my public HTTPS servers from DoS Attacks. The question I have, is how to check the normal use of my servers under normal conditions so I can configure correct tresholds to adapt them to my scenario. I imagine that each situation has its own circumstances. For example, to configure TCP_SYN_Flood I have looked the HTTPS sessions stablished with one of my servers in one hour. With "accept" on "firewall action" column (not srv-rst, or close etc) the result is 50 active sessions. For example, a good threshold could be 150 for TCP_SYN_FLOOD (50x3)?  I use this criterion because I don't know which could be a good way to find this information. Could you help me to set these thresholds correctly and how to get information to do it? Where do you get this information? Thanks ''¡¡¡¡  

I am using FortiClient Single Sign On on our Windows devices. When I download a large file from the internet and lock the computer, the transfer is interrupted. Is there anything that can be done about this?

I am setting up a new FG200F.  Running the current recommended firmware 7.2.7.  I have discovered a problem with setting up some VPN tunnels to remote sites.  I know all the settings work and are correct as I am mirroring an existing old firewall that is going to be replaced by the new FG200F.Once the site-to-site VPN tunnel is configured the only way I can get the connection to start working is by rebooting the FG200F.  This does not seem right to me and my concern is if the VPN tunnel was to drop for any reason currently I would have to reboot the Fortinet.  This is not acceptable for me.  Is there some configure I am missing that allows me to restart the FG200 VPN tunnels with the need to reboot the entire appliance?  What is the correct procedure for bringing site-to-site VPN tunnels up and restarting them when required?

Upgraded the 200F Fortigate cluster from FortiOS 6.4.15 to 7.2.8, which caused an interruption in SSL VPN services. Any reason ?

Hello,When making a backup of a fortigate configuration, what does this file contain apart from packaged policies and interface configuration?  

When ADOMs are activated, When ADOMs are activated, Hello, I'm a beginner and I've activated ADOM in my lab.I have 2 ADOMs:  - ADOM Si1 - ADOM Si2 And a third ADOM that was created automatically. THE ROOT ADOMThere is no policy package in this ADOM.What is it for? Thanks for your help.

We just completed a 350 phone migration from Cisco Unified Communications Manager to FortiVoice. We were using Unity Connection for Voicemail / Auto Attendant and Informacast for emergency notification. We retained Informacast with the FortiVoice.  We are using a combination of PRI and SIP trunking. We replaced all of the Cisco handsets with FortiFones. We replaced the CUCM specific ATA's with Cisco ATA 191 as third-party phones.  For posterity, I am a certified CCNP Collaboration and Digium Certified Asterisk Professional. Happy to advise or give direction if I can help anybody.

Fortigate 60F Setting up a new IPsec VPN. Phase 1 matches but I am still getting a "AUTHENTICATION_FAILED" error.  Please. Any assistance would be great.  Here is my debug:ike 0:VPN1: schedule auto-negotiateike 0:VPN1: auto-negotiate connectionike 0:VPN1: created connection: 0x17fc6a00 5 152.x.x.x->174.x.x.x:500.ike 0:VPN1:VPN1: chosen to populate IKE_SA traffic-selectorsike 0:VPN1: no suitable IKE_SA, queuing CHILD_SA request and initiating IKE_SA negotiationike 0:VPN1:5538: out 96957CD2C74F75B60000000000000000212022080000000000000100220000300000002C010100040300000C0100000C800E0080030000080200000203000008030000020000000804000002280000880002000086A849256EF1101F60E86751929A4896EED0779F5F87BDF45945E20F4B30C518FED4175841908A76BC901152045CC7B57E820894EA827C9A6615D2C9991D80DA35DA82CF10A58217A3622CF13CB96EDA10B8B8F1355EE0ACEBB35599C40FD933BD32F16EB670B8F2946A971143AD63331C999EC38A6070C818F7CF35C2A2AEE329000024B9D125ECBEFCCDB03E7D6E5EB3AFFC1013E3D6BD26AD55C8EA46CFD

hi there. i have a problem with fortigate IPSEC actually i'm not using the fortigate products thats why im posted my problem. So... i have 2 tunnels VPN between  fortigate and zywall - successful installed no problem but between cisco and fortigate c300 i have the error message from VPN LOGs (scn attached below) i dont now what it is mean. i asked from google whats going on whats the problem...? ok this's my [style="background-color: #ff9900;"]diag debug[style="background-color: #ffffff;"]   from ssh[/style][/style]  DYU-T1-FF-MIT-FW-01 $ ike 0:IPSEC_AMADEUS: auto-negotiate connection ike 0:IPSEC_AMADEUS: created connection: 0xa5230e8 2 10.10.10.1->10.10.10.2:500. ike 0:IPSEC_AMADEUS:IPSEC_AMADEUS: chosen to populate IKE_SA traffic-selectors ike 0:IPSEC_AMADEUS: no suitable IKE_SA, queuing CHILD_SA request and initiating IKE_SA negotiation ike 0:IPSEC_AMADEUS:702734: out 354748B3240D3BDD00000000000000002120220800000000000000EC220000300000002C0

I’m working on a project where a client is installing a new camera system. The vendor will provide their own router and PoE switch. We need to connect this router to the client’s existing firewall (91G), and the client has available public IP addresses. Can I configure the 91G firewall to pass-through mode, allowing the vendor’s router to use a public IP directly? Or is there a better approach to integrate the vendor’s router with the client’s firewall? BTW, the camera vendor will handle all system management independently and requires full access to their equipment, which will be completely separate from the client’s network. Thanks!

Hi all, i am trying to get a certificate for a cmp client from the FAC (6.6.0).In beforehand igenerated a .pem keypair on the cmp client. (openssl genrsa -out key.pem 2048)generated CA cert for FACgenerated server cert for cmp server on the FACThis the command:openssl cmp -cmd ir -server http://192.168.1.99/app/cert/cmp2/ -subject /C=Country/ST=State/L=City/O=Company/CN=PFC200/emailAddress=placeholder@company.com -newkey key.pem -certout cert.pem  The problem is, that the cmp client throws the following error:CMP info: sending IRCMP info: received ERRORCMP error: missing protectionI could not find any hints as to how i can resolve the error/what the reason is. Unfortunately i cannot see any log entries in the logs of the FAC to further investigate. A capture from the answer of the cmp server on the FAC in wireshark shows the following:It was not possible to enter the screenshot, but it also said "missing protection" and failinfo was "BadRequest" with the error code being 4865

Hi, I have these strange entries in the System Events logs: Log Description: Scan error - traffic passedScanunit failed due to internal error: content decode failedService HTTPSFile libs_weather-globe-globus_dist_index_js.7993b0de93c1ce3da1d6.js This entry appears every time someone opens weather service in MS Edge (from taskbar in win11)is this a known issue? Firmware 7.4.4 

Hi everyone,Fresh out of the box and upgraded, no previous Fortigate here, so I am very green to this. Anyway, I have a rule from my LAN to SD-WAN with Source and Destination "All" and I have ICMP, DNS, Web Services, UDP 443, and Speedtest.net all allowed Services. Yet it gets Zero traffic. Meanwhile below it I have specific VLAN in the interface and source and ALL /ALL Destination and Service and that is catching all my internet traffic. FG is top down correct? Any idea where to look, I thought LAN interface (all the VLANS are under the LAN Virtual Switch) and all would cover the VLANS as well....seems to work for the implicit deny.    Here is the "all" address edit screen:SD-WAN is only a single local LAN address while I set it up...and that only Static Route is 0.0.0.0/0 to the virtual-wan-link.Thanks for any help and pointers...wondering if I went to "high" on the version.