Support Forum

Hello FortiClient adminsFortiClient 7.4.0.I testes FCT's ZTNA proxy on Windows 10, Mint 21.3 (Ubuntu) and Ubuntu 22.04.On Windows and Mint it works well: FCT proxies the queries (I can see it in tcpdump) and sends them to the remote FortiGate's public IP.However on Ubuntu 22.04 (same package that is installed on Mint) the queries never reaches the remote FortiGate. And I can see in tcpdump that the my queries are not proxied as expected, they are sent to the final destination private IP directly.Any idea?

Dear Forti Support,it has happened today again (twice in last two weeks), that our box stopped working without any obvious reason. Our box:FG-40Ffirmware v7.2.8 build1639In the log there are lines (in this order):stitch:Security Rating Notification is triggered.The system has activated session fail modeKernel enters memory conserve modeKernel enters extreme low memory mode.Both RAM and CPU got to >90%, network stopped working and we had to power it off & on again. Regards

Hi, I am running a captive portal for a hotel, using a Fortigate100D as a hub FortiAP 221B, and works very well, but I have a problem, the tiket generated, allowing the connection of multiple machines at the same time, and need is to allow the connection to one machine, with one tiket generated. I appreciate your attention, and I hope you can help me

HelloI have installed a Fortigate 60F firewall at a customer. When the customer uses FortiClient VPN they cannot access their Microsoft Dynamics Navision. If they use the Windows native VPN client, everything works as it should.So why not just use this all the time? This is because the firewall does not allow two simultaneous Windows native  VPN clients from the same IP address…I get this error (see the attached file, and bear with the fact that it's in Danish. I'm sure you can translate it).

Hi all, Setting up a pair of Fortiswitch 108F connected to Cisco Switch. Due to most of the switches are Cisco, so will need to deploy in rpvst. Configured the Fortiswitch interface that connected to Cisco Switch as "set rpvst-port enable" to match with Cisco rpvst.When the Cisco VLAN priority is higher priority (numerically lower), Fortiswitch will get an error "STP priorities inconsistent" and the port will enter discarding state.If Fortiswitch configuring same or higher priority, everything was working fine, both sides interfaces are Forwarding and learning the correct root bridge.Anyone face this issue before? Can advise for this?Many thanks in advance.

Hello, I Have added a computer group to be synced to the EMS server. However, no computers were found in that group on the EMS server. I observed that it syncs only with users, not computers.The only way that computers sync is by syncing the OU. But I need to test something on a pilot group.How can I resolve that? FortiClient Thanks,Alaa Elrayes

Hi, We are currently running FortiOS version 7.2.7 which is the recommended release for the FortiGate virtual appliance. However, we are running into multiple Conserve Mode issues, meaning that we see that the WAD process slowly starts creeping up to eventually reach converse mode. With an automation stitch we can kill the WAD process on time but this does cause a small interruption for our customers. Looking into the version 7.2.9 release notes I see that it seems that this is fully solved in that version hence that I would like to upgrade to this version. However, I see the recommended release is still version 7.2.7. Is there any sight on when the recommended release document will be updated to this version?After quite a few issues we've had with other versions we don't want to run any version that isn't the recommended version. Thanks in advance for any response :)

I want to block access external (Difference Location) users connect to the internal users via anydesk (Application) but I need to use anydesk among internal users in same location. How can I do this from fortigate firewall?

Hello,Some our user can't connect to the Azure SQL Server with error I try to disable my App Control and the user is able to access to Azure SQL.Here my App Control settingThen i try to disable 'Block applications detected on non-default ports' on the app control, enable this app control on the firewall policy and the user is able to access to Azure SQLSo anyone can help me to make more understand why the 'Block applications detected on non-default ports' should be disabled?

Hi— I use FortiClient with cellular data both directly on a Verizon iPhone and through ‘hotspot’ (on the phone) to connect an iPad and Windows laptop. As of about 2 weeks ago, I began receiving an Error: Invalid DNS Server message each time I try to connect any device through the cellular network. Any WiFi network works without issue and connection is no problem, however the cellular network can not connect. I used a colleagues Verizon phone with FortiClient and entered my credentials— no issue. I’ve contacted Verizon who says there’s nothing wrong with my line and to contact Apple or Fortinet for support. Uninstalling and reinstalling the app has not yielded any result. Anyone else experiencing? Any ideas or suggestions on how to resolve? Thanks!!

Hello I went through the documents here https://api2.panopta.com/v2/api-docs  I couldn't find any endpoint that could send/trigger a notification (alert timeline) Is it possible to do such a thing using API? In our use case, we want to run a test somewhere outside fortimonitor and if it fails, trigger an alert in fortimonitor Thanks

Hi everybody,Its possible to make that Fortimonitor execute a command on a Fortigate when detect a SD-WAN incident?Thank you for the time

Hello, the ssl vpn client, when DTLS is enabled, the VPN connection is lost when copying a SAMBA file from the client to the VPN.with DTLS off, the problem does not occur, but I need it to improve performance. I was able to reproduce the problem on two devices. Both devices have firmware 6.2.10.The problem already existed with 6.2.9 firmware. Devices: FGT 50E and 301E  Thanks! --FBK

Hello if we purchase a 5 pack of FortiToken Mobile license does this add-on to the 2 license you get by default? ( So we would have 7 total license?)  SKU = Mfg # FTM-ELIC-5FortiToken Mobile - license - 5 usersPlease confirm. 

In our internal LAN we have the DNS server set to be the same as the Interface IP of that subnet. This DNS server is set in recursive mode and exists only to translate some domain names to IP address for internal uses. I would like to have this same functionality over the SSL VPN for some of our remote users but am unsure how to go about setting it up. 

Hello, I've got a problem with my DKIM on associated domains. When people receive mail from us, for parent domain no problem, i've :dkim=pass (signature was verified) but for associated domains dkim can't be verify, i've :dkim=fail (signature did not verify) i've the same key on all my parent and associated domain, In Domain "DKIM signing for outgoing email" is enable, an in session "Enable DKIM signing for outgoing messages" is also enable. Could you tell me what is wrong in my settings ?  Thanks

 We use sslvpn web portal to reach http/https server. We are not able to proceed after browser hits the url https://hostname-fortigate/proxy/xxxxxxx/https/login.microsoftonline.com/common/GetCredentialType?mkt=en-USI did debug for sslvpn and following is the error:[313:root:5dd]SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384[313:root:5dd]do_http_validate:442 method (POST) on uri (/proxy/xxxxxx/https/login.microsoftonline.com/common/GetCredentialType) not allowed.[313:root:5dd]sslConnGotoNextState:309 error (last state: 1, closeOp: 0)[313:root:5dd]Destroy sconn 0x7f0f70cae000, connSize=0. (root)[313:root:5dd]SSL state:warning close notify ()

Hello EMS adminsFCT EMS 7.4.0 and FCT agent 7.4.0 on Windows 10 client.For off-fabric clients we configured multiple ZTNA destinations, including one destination to access EMS WebUI.All destinations are accessible and working fine except the one for EMS WebUI (browser just shows connection closed).When inspecting ZTNA traffic on FG we see all ZTNA traffic except the traffic for EMS WebUI (there is no related log).Any idea on what's going on?

We were having trouble accessing a specific website and the issue ended up being our Geo Blocker policy was preventing access to the website. We have temporarily resolved the issue by disabling the Geo Blocker policy but would like to reenable this policy while still allowing access to the website we were previously experiencing issues with. I called the company that owns the website/server, and they gave me the public ip address for their webserver I created both a subnet allow policy and an ip range allow policy to hopefully allow access to this server while the Geo blocker policy is on. Neither allow policies seemed to work and when I looked up the company's server ip address it is located in a country that is not blocked by out firewall. I am assuming they either gave me the wrong ip address, somehow the webserver is associated with a country that is blocked by our policy, or I configured the allow policies wrong. Would anyone be able to assist in listing out the steps required to

When i inserting HTML into the templateThe recipient receives the plain text, i.e.!DOCTYPE html><html><div><strong>Ihr ASWO WLAN Zugang</strong></div><div></div><div></div><div></div><div> <p>Lieber Gast, wir freuen uns auf Ihren Besuch bei uns in Eime!</p> </div><div></div><div>DamiThe document is not converted to html by the recipient. The offered Format isMessage Format: text/html Also the question, is it possible to change the description of the template also?Is there a solution to this?Templates are not supported by the Forti Support.Thank you

I’ve been working on integrating LDAP with FortiClient EMS server v7.4.0 build1793 running on Ubuntu 22.04 but am getting "Auth Method Not Supported" when trying to add LDAP authentication server.In the EMS web console, when I go to Administration > Authentication Servers, I select "ADDS" from the dropdown, enter localhost and the admin creds, but when I hit "Test", I get an "Auth Method Not Supported" error.slapd is running and listening:# netstat -aptn |grep LIST |grep 389tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 326786/slapdtcp6 0 0 :::389 :::* LISTEN 326786/slapdAnd doing a tcpdump, I can see the traffic (although not the username and passwd being passed):17:30:52.956097 lo In IP (tos 0x0, ttl 64, id 42008, offset 0, flags [DF], proto TCP (6), length 115)127.0.0.1.41008 > 127.0.0.1.389: Flags [P.], cksum 0xfe67 (incorrect -> 0x25f2), seq 1:64, ack 1, win 512, options [nop,nop,TS val 3342323866 ecr 3342323866], length 63E..s..@.@..j.........0.......d[......g......7...7..0=...`8.

Hi ALL,We have requirement for website, want to allow only specific websites at fortigate firewall. but we don't any web filter license on the firewall. I want to confirm if can we do it or not.

Hello,My board is wanting to buy Firewall via Amazon site , will I have any issue with configuration or support problem ? today I pay for this personal service of putting ready license , do I need to do some kind of registration at fortigate ? As I'm just starting to work with firewalls, I'm afraid I won't be able to configure the equipment.https://www.amazon.com/FORTINET-FortiGate-FortiCare-FortiGuard-Protection/dp/B08126TLGJ/ref=sr_1_1?crid=1GCVFTC60DS9R&dib=eyJ2IjoiMSJ9.NkFXLMZMwVINF-vHID1IVIvS4VAG98wBT9ISu4tag6lKAwEZ9MRlWo5Mo9HI7LzbTOIWZgcw7FcyE1rDCxU00Ae0SCs6bFn9FVDey5XWBgKF7ci2gBL8btbuX1qfhXssSYw8NrMGxrAetBCWMuaHKA.GZY71woOBcUqaQ2hzu19lFsB98ekh-cIm84kPKhRhFc&dib_tag=se&keywords=fortinet%2Bfirewall%2B60f&qid=1724073149&sprefix=firewall%2BForti%2Caps%2C200&sr=8-1&th=1Translated with DeepL.com (free version)

Hello, we are using EMS version 7.0.9 and 7.0.10 in our company. we are using an old program that has no update in our users and we want to hide this application from EMS.  We can whitelist it on Forticlient, but we want to do it on the end users' computers. for example, unregister the application from regedit. but I don't know how to do it in the most correct way, can you help?

Hi All, I'm trying to find out how to configure our FG100D (6.2.14-FW-build1364-230411) to send to our Syslog Server (ELK) just every 5 mins. There is no option in the WebUI or even in the CLI to configure this. Is there any way to do this? All I can see is in the FortiAnalyzer option. Thank you. Oliver