Support Forum

Hello world, Can you tell where can i download FSSO agent. I can' t find it in https://support.fortinet.com/Download/FirmwareImages.aspx. Thank you for your help Georges

Client have loaded a faulty configuration and have lost access (cannot login). We want to factory this unit.FGT 800D does not have a RESET button, only a NMI button. The below link does not work because we do not have any consolse access.https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-reset-a-FortiGate-with-the-default-factory/ta-p/196896Is there a way to factory reset the FGT 800D model as per below link?https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-To-Reset-To-Factory-Default-Configuration/ta-p/198660Appreciate Y'all. TIA :) 

I am looking for information about:https://www.cve.org/CVERecord?id=CVE-2024-28910https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28910 We have FortiClient 7.0.11.0569which runs under a Windows 2019 Datacenter server version 10.0.17763 number 17763 The version of MSOLEDBSQL 18.6.5.0, Microsoft OLEDB product, has been vulnerable since April. We need to upgrade to version 19.3.3.0. How can we get our EMS server back into compliance with the vulnerability rules? 

Hello ZTNA adminsI can access all my back-end server through ZTNA destination except the FGT WebUI.I guess there is a special config (if any) so it allows access to itself through ZTNA, right?Any idea?

New install of FortiEMS, I have turned on settings for Software Inventory in the relevant policies, but the inventory collect process never actually starts on my clients, no software is detected. How do I start to troubleshoot this? 

Hello, we are just starting to implement SD-WAN and I have a question on how to setup IPsec tunnels because I am sure I am overlooking something or making things more complicated than they are. If both sites have a Primary WAN and a Secondary WAN, do I have to create 4 tunnels and 8 policies to make all the possible combinations to keep the traffic flowing at all times without manual intervention or is there a better way to accomplish that? IPsec tunnel sourceIPsec tunnel destinationPrimary WANSecondary WANFortigate 1Fortigate 2WAN1 WAN2 Fortigate 1Fortigate 2WAN1BACKUP WANFortigate 1Fortigate 2BACKUP WANWAN2Fortigate 1Fortigate 2BACKUP WANBACKUP WANFortigate 2Fortigate 1WAN2WAN1Fortigate 2Fortigate 1BACKUP WANWAN1Fortigate 2Fortigate 1WAN2BACKUP WANFortigate 2Fortigate 1BACKUP WANBACKUP WAN

Greetings all,I'm having an issue which I get the sense will be a simple fix but I'm at a bit of a loss. I'm trying to add a certificate to iOS to use for connecting to a fortigate vpn. I have no trouble getting the certificate onto the iphone and forticlient detecting it, but its asking for a passphrase. I generated a certificate key pair via Easy-RSA and was able to upload them to the Fortigate without issue. The private key has a password so I was able to enter that into Fortigate without issue. But on the iphone, my understanding is its just the one file, and it needs to be the certificate, which does not have a password. But the app will not let it be used without a password, and leaving it blank returns incorrect passphrase.  What am I doing wrong? I'd appreciate any help. Thanks!

Hello,i set up a vlan with public ip adress. I want to set up dhcp server with clients wich receive adress on pool 10.1.0.0/24 with  private ip address (different than public ip address). I set a secondary ip address on Web UI with private ip adress.When i try to set it, Fortigate denies and displays dhcp pool adresses must belong to same subnet than public ip adress. I conclude than it doesn't consider secondary adress for dhcp allocation adresses. Am i right ? How can i achieve my configuration ?Clients are on same vlan than fortigate dhcp server. The interface is type Vlan with public ip adress. Best regards.

hello,My forticlient VPN suddently can't connect and i can see on the local traffic log the traffic is denied.Anyone know why?

Can we disable the hit count in the rule?

Hello Everyone, I've been having this issue with staff at my company being kicked off the VPN regularly, to the point they cannot work effectively from home. I myself can work from home on the same VPN without issue and have done hours at a time. When I export the logs from an affected client it shows this: "sslvpn FortiSslvpn: 7664: Did not find interface for local_gwy 6721a8c0". If I quit their Forticlient and re open it using admin credentials, it will work fine for X amount of time, but it will soon hit the same issue. I have updated all their drivers, ensured all windows 11 updates are installed, the client is up to date, the VPN URL and port is correct. Yet it will still randomly disconnect then continue to disconnect through out the day without warning or reason. Has anyone faced a similar issue to this before?I appreciate any input that can be given, thank you very much! :)

FortiClient is disconnecting immediatly after clicking connect, debug shows SSL error: 2024-05-29 11:23:15 [308:PLATTLING:1263]allocSSLConn:310 sconn 0x7f47c7b8b000 (1:PLATTLING)2024-05-29 11:23:15 [308:PLATTLING:1263]SSL state:before SSL initialization (62.159.210.6)2024-05-29 11:23:15 [308:PLATTLING:1263]SSL state:fatal decode error (62.159.210.6)2024-05-29 11:23:15 [308:PLATTLING:1263]SSL state:error:(null)(62.159.210.6)2024-05-29 11:23:15 [308:PLATTLING:1263]SSL_accept failed, 1:unexpected eof while reading2024-05-29 11:23:15 [308:PLATTLING:1263]Destroy sconn 0x7f47c7b8b000, connSize=0. (PLATTLING)2024-05-29 11:23:15 [309:PLATTLING:1274]allocSSLConn:310 sconn 0x7f47c7b21000 (1:PLATTLING)2024-05-29 11:23:15 [309:PLATTLING:1274]SSL state:before SSL initialization (62.159.210.6)2024-05-29 11:23:15 [309:PLATTLING:1274]SSL state:fatal decode error (62.159.210.6)2024-05-29 11:23:15 [309:PLATTLING:1274]SSL state:error:(null)(62.159.210.6)2024-05-29 11:23:15 [309:PLATTLING:1274]SSL_ac

Hi Experts,can you help me,What method can I use for Fortigate devices to apply multiple rules? For instance, I want to block Instagram login and similar activities, while still allowing access to Reels and posts.

Good day all, having a weird issue, was hoping for suggestions as to where to look for the cause. Have a FortiGate-61E v7.2.8,build1639,240313. The WAN interface connected to the ISP switch drops every 10 minutes, almost as though scheduled, on the hour, 10, 20, 30, 40, and 50 minutes after the hour. It drops for about 20-30 seconds, then comes back up. I lose pings to that interface from the outside.  The ISP switch also has a Verizon router (different external IP). This connection does not drop.The Fortigate also has a connection to a Velocloud (which also connects to the ISP switch) for an SD-WAN connection. This connection does not drop.  The "get system interface physical [interface name]" command shows the interface never going down physically (and I never lose the remote webui connection, but that's using the SD-WAN route). We've rebooted the router, tried different DNS servers for the dns probe health check, tried to use pings for the health c

We want to extend our support licences for our fortiweb 400d device with a 24x7 FortiCare plus AV, FortiWeb Security Service and IP Reputation support licence. When we contacted our distributor he told us they could only extend it up to 2026-01-14 which we can see on our asset management site is the hardware lifecycle end of support date. But on the software lifecycle page we can see that the end of support for the software lifecycle is 2027-06-16.  So our question is when our hardware support ends do we also lose software support since we can only buy a 24x7 FortiCare plus AV, FortiWeb Security Service and IP Reputation support up to the hardware end of support date? Or does the software support continue without paying for it? Or is there a separate license that is just for software support?

Hello all.Our VPN is getting hammered with spoofed IP addresses and a brute force attack using some of our old (and a few current) company user names.  This is causing account lockouts for several users.  Our third party guys have put in some IP address blocks, but it's partially effective due to the spoofed IPs/user account combinations, which cause valid users to be blocked intermittently. We have geo blocking turned on and limited to countries we need to be able to access, but some of the spoofed IPs are within those parameters. There hopefully is a solution here at Fortinet somewhere, but throwing this out there in case one of you guys have seen this type of attack and found a good solution to shut it down.  We can't keep adding IP address blocks forever. Thanks!

Hello,Yesterday i facing issue where from client not able access to Azure MSSQL, then i found some information from Azure team that deploying MSSQL on azure have 2 kind of connections policy such is :Proxy : With this policy the client only need connect to one single port for MSSQL TCP/1433Redirect : With this policy, the connection need other port range from 110000 - 11999 beside TCP/1433The issue yesterday is on our Fortinet application control the MSSQL is already allowed but the client still not able to connect because the MSSQL using redirect mode which is need open port range from 11000-11999.On the log i also can see there is MSSQL is blocked and also I can see the port used is 11050.Here i want to know how application can knowing this port 11050 is belong to MSSQL? 

Hey everyone.I had a quick question about the following:SetupManagement - FMG 200GHUB - FG 201F HA pairSpokes - FG 40F HA pairsSDWAN overlay config is set to use ADVPN and spoke to spoke connectivity has been confirmed.Our customer is asking for reports related to performance SLAs between spokes.  I understand that performance SLAs generally point to the hub as configured by the FMG SDWAN overlay template.  I've read up on how the spokes build the shortcuts between themselves, but I haven't been able to find anything related to building a performance SLA between spokes.Is SDWAN with ADVPN able to do this or is this something that's easier seen in a custom report?  I've tried a few shots in the dark with configuring performance SLAs between spokes, but I've had no success so far.  I feel like having a standing SLA between spokes might mess with things and create a huge processing overhead for every device involved.I appreciate any insight or help and thanks in advanc

Hello, There is any solution to send a email with TCL Script or CLI ? I need to send information after script Schedule execution. Sorry for my English, I'm French. Thanks,Jimmy

Hello,Good morning! I am using FortiClient to connect to my clients. I am using version 7.4.0.1658:Serial:FCT8003717107945UID2:91110A75512C464DA96D06F1F00C54AD However, every time I connect, my CPU exceeds 90% and even after closing the connection and turning off FortiClient, the consumption remains above 90%. So to solve this, I need to restart the machine every time this happens. I am using Windows 11. Is there some kind of incompatibility? Is there a fix for this? Could you help me? The image below shows the processing after connecting to the VPN using Forticlient. And in the image below is the processing before connecting to the VPN using Forticlient:  Thank you!

Hi, I'm trying to configure an old FA100C with my FG30E. In the FG30E GUI I get the following error when adding the FA100C under the log settings: Error occurred: SSL error.  I don't know if the FA100C uses ssl or if it can be used with a newer FG30E?Regards, 

Hello everybody, I have a lab where we have some clients which i need them to reach a router thro the firewall so the main idea is to not use routing protocol or any default route i need to make the PC ( clients ) ping the router interface without routing what is the alternative of routing is there any solution ? many thanks in advance 

Hello team,   On Firewall FGT, When a user with administrative privileges is added\modified\removed on a Fortigate firewall is there a specific event that we find in the logs? Or is it something that needs to be manually enabled?   Thanks in advance BR

 Hi everybody.Is there a way to apply a policy traffic shape for a firewall polilcy?I tried with this article https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-apply-traffic-shaping-in-a-firewall-policy/ta-p/191943 but it didn't help :') Let me explain: I have a lot firewall policy where I have my users in level permisions with theier policy. But I want to limit the traffic in social media and streaming for those users that have permisions to Youtube and Facebook. Is there a way?

Hello,We use SSL VPN to allow user's specific access by AD-linked group. We have the case where a user belongs to 2 different AD groups which each correspond to a portal profile. A specific policy is created to manage access for each portal. What is the criterion that applies to define which policy will be used? in my case, the policy that should be used is before the other policy but it doesn't work. It is the 2nd which is applied. Fortigate version 7.2.7