Support Forum

Hi there, I did several tests but it seems - really?? - that the template type "Web Account" acts with completely different permission settings in the background than other launchers. Testing with launcher like PuTTY or WinSCP or RDP ... I could test this with a user that should only be able to see the entry and can launch this - so using the permission type "Viewer" - without beeing aware ot the stored password nor can change this secret. So far, this is running fine with several launcher types. The same scenario using a "Web Account" secret is not possible. It seems as "Launch target" could be possible for the test user (with "View" permission for this target as well as for the underlaying folder) because it is not greyed out in the secret list. But clicking on "Launch Secret" leads to the details of the entry - and there the mouse over message over the (now greyed out "Web Launcher") tells me that this launcher cannot be started because of not enough permissions.&nbsp

Dear Concern, I am visiting a website, but the page is not opening. In the forward logs, I see 'TCP reset from client' under 'action', and sometimes it shows 'accept'. The webpage says 'refused to connect'. How can resolve. I have FortiGate 201F firewall and firmware version is 7.0.10 If I check from another network, the webpage opens properly. can anyone help me to resolve the issue

When using VPN, the user does not receive the local IP assigned by FGT (not the wrong IP). Sometimes it happens like this.

FG-601E and FOS 7.0 GA.To list image dia fdsm fds-update command is not working.(global) # dia fdsm fds-updateTimed out. Appreciate your advise on how I resolved this issue. TIA :) 

We would like to enable MAC based internet allow policy for our office premises devices. For kind of your information, We are using the FortiGate 300E firewall supported by you. Please let me know how many devices or MAC can be allowed on the FortiGate 300E firewall.

Hi everyone, I have a Linux virtual webserver in ESXI that I would like to be accessible over the internet. Currently it's accessible locally but I have tried all the settings on Fortigate to make it accessible over the internet to no avail. I am plugging the 2nd Physical NIC directly to either internal 4 port and bridging the virtual webserver connection in ESXI to that 2nd NIC but not getting any good luck. I also did create VIPs in Fortinet to the Internal 4. I would really appreciate any help I could get.

So quick questionI have upgraded Fortimanager, and a test fortigate to 7.2, the eventual plan is everything upgraded to 7.2.At the moment I cannot import configuration because 'device firmware is different to adom version', should I upgrade the adom version from 7.0 to 7.2 next before upgrading all the gates?

Hi, in my lab I'm exposing FMG WebUI on the public internet behind Cloudflare reverse proxy. I did basic Cloudflare configuration and I do reach FMG WebUI with using FQDN over HTTPS connection without any issue.  However, once I am logged in, after few seconds of activity I am forced logged-out. And I have to log back in. Sometimes before I am forced logged out and I am moving around different sections of WebUI, I get red banner on FMG WebUi saying "Invalid IP address".This behavour is not present if bypass Cloudflare. i.e. I browse WebUI using IP address and not FQDN. What I suspect is that at some point (in the middle of the session) Cloudflare is changing IP address of the reverse proxy. i.e. FMG sees that the session is coming from different IP address and it forces user to log out.  Has anyone manage to expose FMG WebUI behind Cloudflare reverse proxy?

Hi All, Is there a way to check or determine in the Fortigate firewall if the difference in bandwidth of MPLS site (our site has 20Mbps and our client has 2Mbps only) will result in slow in traffic?We and our client have both 2 ISPs for redundancy, but the client's other ISP is much slower, so they prefer to connect using the other. When our main ISP was down, we swung to the other resulting in much slower traffic. But our client checked their current bandwidth and said that they were only using 60% of the traffic and insisted to check where the bottleneck was. I'm trying to figure out how to check and present to the client that the issue is their bandwidth unfortunately, when I check the bandwidth monitor in Dashboard, I can only see the grouped MPLS tunnels of ISP1 (interface 1) and ISP (interface 2) with Hardware Switch as type. There is no option to check the separate interface. Even the VPN Event logs don't help that much. Is there a way to check this? Thank you in

Dear Forti Support I am writing to you because my Fortigate VM02 yesterday presented an unexpected increase in CPU resource of 97 - 98% for almost an hour, this event generated denial of services and intermittency and slowness on the internet. During the event, there was no significant increase in memory, concurrent sessions or sessions per second, no intrusion attempt, nor any adjustments made to the hypervisor. InformationFORTIGATE VM02v7.2.8 build1639 (Mature)Hipervisor: OVITR (based in KVM)  I appreciate your comments and help 

I have two firewalls.At one end a firewall with a dedicated link and at the other a Sophos firewall with dynamic IP.I will have to increase the Dialup Type configuration.Does anyone have any documentation that covers this type of configuration.The biggest problem is at the Sophos end, I've already tried several ways.But without success, I've seen several ways on the web but without success.If anyone can give me some direction, I'd be grateful.

Can FN-TRAN-QSFP28-BIDI or FN-TRAN-QSFP28-BIDI-I work with single-mode fiber?

Dear Forti Support I am writing to you because my Fortigate VM02 yesterday presented an unexpected increase in CPU resource of 97 - 98% for almost an hour, this event generated denial of services and intermittency and slowness on the internet. During the event, there was no significant increase in memory, concurrent sessions or sessions per second, no intrusion attempt, nor any adjustments made to the hypervisor. InformationFORTIGATE VM02v7.2.8 build1639 (Mature)Hipervisor: OVITR (based in KVM)  I appreciate your comments and help 

I have a issue in NAT, one of our customer we are connecting with ipsec vpn its used for printing we gave seprate segment to this IPsec For internal from that internal segment we are NAT to one of the operation segment. In remote end (customer) they have some servers and given the ip address which i have added in the remote segment in our ipsec tunnel in this case i do able to print from one of customers iP to our end successful but from other customer server to same end user ip its cannot print please advise us #fortigate 100F @gowtham

after set vpn ssl user and password in forticlient from end device OS windows 10-home or 11-home certificate pop up didn't appear and no traffic is no received by fortigate 60F os 7.2.7 but throughout web mode is allowed to log into vpn successfully. 2nd issue is throughout web mode, using FTP quick connection didn't allow to reach root folder, this location is reachable from another windows os vpn clients through vpn client app directly 

Hello, I am facing an issue on DM after Guest self registration on a port used with dot1x the vlan never get changed. The capture of Disconnect-Request :The Disconnect-NAK :  After shut no shut the port, the correct vlan get applied, do i need to apply cli configuration with port bounce as a workaround ? any other options ?@ebilcari Thank youRegards! 

After we upgrade from version 7.4.1 to version 7.4.3 we are facing a lot of problems with memory leak.The memory starts the business hours with 65% and increase during the day, in the other day start with 71%, the other day starts with 75%.... Always increasing until the moment we have to kill the process to not enter in conserve mode.We made the upgrade to version 7.4.4 last week, but the problem still persists.We have a HA cluster active-active, model 1101E.

Hi Experts,I'm using FortiGate 80E with firmware version 7.4.1 for my network. I have an Asus RT-AC88U as access point for my wireless access. My carrier Wifi Calling not getting enabled on our mobiles. Is there any specific port or services that i need to enable on Lan to Wan policy? Kindly guide me. Thank you.

I am new to FortiGates and need a little configuration help. We have two FG200F's at our datacenter as the firewalls and some remote sites that are using FG40F's and are connected via VPN. What I want to do is have two WAN's, one as primary and one as a failover. I need all traffic that is destined for our network that is traversing the VPN to swap VPN's in the event of a fail over. Not sure how that configuration looks.Current set up is 1 WAN to remote site, VPN connect back to our network.

 Hello everyone! I'm newbie and I have a question about the SSL VPN on Fortigate. I'm using a 501E for the DMZ zone, I config SSL VPN with Mac host check following this guide: https://kb.fortinet.com/kb/documentLink.do?externalID=FD41648 and It works fine with windows and MacOS. The Forticlient send MAC of the device to the firewall so only the specific device can connect to the tunnel.But the problem is on the iphone device ( I'm using IP XR with IOS 13) the Forticlient doesnt send MAC to Fortigate so It cannot connect to the tunnel. The IOS LOG is attached, please kindly review it for me. Thanks a lot!  

olá,sempre ao meio-dia, e minha rede interna fica lenta, muito lenta.Alguém tem alguma dica de por onde começar a procurar pelo problema?

Good morning, My name is Daniele Milani and I am the Tech Sales Leader of Ermes Cyber Security, an Italian cybersecurity firm. In order for our browser protection to operate, we need to communicate with a desktop application, and we do so through native messaging (https://developer.chrome.com/docs/extensions/mv3/nativeMessaging/). Unfortunately, the Forticlient Anti Exploit module marks that communication as malicious on chromium-based browsers, as evidenced by the log line below.msg="AntiExpoit has detected violation" action= ae_api=CreateProcess ae_reason="Run payload in protected process" app="C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"msg="AntiExpoit has detected violation" action= ae_api=CreateProcess ae_reason="Run payload in protected process" app=C:\Users\username\AppData\Local\Google\Chrome\Application\chrome.exe Could you kindly mark this detection as a false positive? Thanks so much,Daniele

Hi Team, I have Fortigate in HA. I shut down one chassis and was running it as standalone for some time. During this time i upgraded active fortigate with 2nd chassis shut down. Now i want bring up HA but my 2nd chassis is on older version. My question is:Do I need to break HA and upgrade 2nd chassis separately before connecting in HA again?Or it will be get updated automatically if i power on?

Hi Everyone, We have a Expiration notification and would like to ignore it like the others.Looking at: Operational Technology (OT) Security Service Expired (Expiration Date: 2024/02/12)As you can see in the image, it has been more than 40 days since the expiration and is showing as an Error instead of a Warning. We have done updates and reboots. I couldn't find a solution online.Could anyone point me in the right direction? Version 7.4.4Serial: FGT80ETK18011906 

Hi! I would like to ask why my firewall policy reflects only on my phone and not on my laptop, even though they’re in the same group (Semi-restricted) that I created. I blocked or restricted some websites using their MAC addresses, but the restrictions only apply to my phone.”