Support Forum

Hello every one, Kindly i have issue with fortigate 80f the connection not fully established, it shown in connected peers for 10 seconds without any traffic and the connection was dropped. the firewall is after fiber router and i'm using DMZ to forward traffic to firewall. below you can find debug log.for help please   ike 0: comes 51.39.30.90:2369->192.168.100.10:500,ifindex=5....ike 0: IKEv1 exchange=Identity Protection id=1e979cdc9e8163c1/0000000000000000 len=408ike 0: in 1E979CDC9E8163C100000000000000000110020000000000000001980D0000D40000000100000001000000C801010005030000280101000080010007800E0100800200028004001480030001800B0001000C000400007080030000280201000080010007800E0080800200028004001380030001800B0001000C000400007080030000280301000080010007800E0100800200028004000E80030001800B0001000C000400007080030000240401000080010005800200028004000E80030001800B0001000C000400007080000000240501000080010005800200028004000280030001800B0001000C0004000070800D00001

Hi, is the above possible to do globally for all interfaces instead of having to go to each interface one by one to disable PING? 

I have a 40F that I've configured to allow SSL VPN connections from remote computers (work from home primarily).  I've got Forticlient to connect, and while connected can still connect to the internet (split tunneling) and ping the 40F at 192.168.2.99.  However, I can't access our server or any other devices on the office network. I've read on other responses to similar questions that I need to set up a policy to allow the SSLVPN traffic to access that same subnet.  I can't figure out for the life of me how to do that. Using ipconfig I can see the remote computer gets a correct ip pursuant to the configuration I have (192.168.2.200).  However, I also notice that the subnet mask is 255.255.255.255.  From what I understand, that's putting it on a different subnet than the rest of our office lan (192.168.2.0 255.255.255.0) What else do I need to do? Thank you.

I am not sure if this is normal behaviour or a problem?Our Fortiproxy cluster loses the sync approx. every 10 minutes, then it is out of sync for 1-2 minutes, then it syncs again. I can see it in GUI, on the CLI and also with SNMP.It is active-passive HA with unicast heartbeat on explicit HA-interfaces in VLAN which is only used for this.I've already rebootet both devices (VM64 v7.4.2 build0577).Switchover worked fine.It is not a network issue!When I captured the traffic I've not only seen UDP-traffic between the peers, but also TCP on ports 703 and 700.703 is mentioned in the Fortiproxy port table, but 700 is not in the list (seems to be harelay).https://docs.fortinet.com/document/fortiproxy/7.4.0/fortiproxy-ports/758533/incoming-portsAny tipps?Thanks.

Hello Expert, I config ssl vpn on my fortigate 400E firewall but would like to enable 2FA for my user account.I would to use the forticloud option for the 2FA.Could any one provide guidance most of the videos online are using fortitoken or email method for their demonstration because I suspect the presenters done not have a forticloud account. My organization has a forticloud account.  Thank you.

Good morning, I was trying to use Fortinet via script on windows to connect to a client vpn. From now I have been using without License Fortinet Client to connect to VPN. I have found lots of information that I need to download Fortinet Tools to find FortiSSLVPNClient.exe, that was available on previous versions of forticlient.  I'm not able to find this tools and download this file. I would be pleased if anyone can help me with that issue. Thank you in advance.

Hi sir, I have a 81F on hand, last week I tried to flash the bluetooth ptm firmware thru command: diag bluetooth program ptm  It fails to set bluetooth broadcast name so when I use the FortiExplorer I got name 'FortiBlue' detected but not serial number.  Even I try to flash back the firmware to original version but it still is no change.  Please advise how to change back the bluetooth broadcast name to serial number. Thanks,Jacky

Does the latest FortiOS (v7.4.4) support FTM-Push for IPSEC authentication? I see a number of posts in this community on this topic that indicate this is not supported with older revisions of the FortiOS.  If this is a supported method to authenticate an IPSEC remote connection, I have an issue where the IPSEC connection process does not wait for the FTM-Push to be either received or approved.  As such a connection can not be established with this enabled.

Hello, I want to test a FortiGate with its security functions in my existing home environment without changing the existing internet connection or any other network configuration on the router with its WAN access. For this I place the FGT inside the local (same) subnet. I put static routes on my client so that google.com and www.google.com are going through the FGT. On the FGT there is only one static route that points to the router that has WAN connection. Actual setting is as following: Client (192.168.0.15)  >>  FortiGate (192.168.0.245)  >>  Router (192.168.0.250)  >>  WAN After set up the static routes on the client for Google the ping and traceroute on the clients points to the FortiGate.Also on the FortiGate there is this ICMP traffic visible in the diagnostics packet view. However, all of the test policies I created on the FortiGate do not have any hit, also the forwarding log is empty, no traffic, and so

Hello everybody I hope you are all doing well,we are facing a problem with a certain client of ours so we usually give FortiClient VPN to our customers so that they can access certain websites but the problem is with one certain client is that every week he is having a problem that his FortiClient needs to be uninstalled and set again it shows only connecting for a sec and then goes away the problem will not be solved until I uninstall the FortiClient and install it again keep in mind we are using an old version of FortiClient as our firewall is not updated to the latest version.

Hi, we have firewall with central NAT enabled. Some communications are  initiated from inside network and going towards outside network. Original Source IP - 172.19.60.100Original Destination IP - 192.168.23.5Source NAT IP - 192.168.48.12 as per the central NAT rules defined this traffic is getting source NATed to the 192.168.48.12 when going through the firewall.Also, we have configured some DNAT & VIP like below for traffics which are originated from external side.External IP - 192.168.48.12Mapped IP - 172.19.60.120 When considering this 192.168.48.12 is the source NAT ip for the traffics initiated from 172.19.60.100. Also this is external IP for the traffics initiated from external and its map to the inside ip 172.19.60.120 which is different than 172.19.60.100. will this works as expected or will there be any issues ? Thanks

Hello Dears i am trying to configure policy route making the outgoing interface is SD-WAN interface , i am not seeing the SD-WAN interfaces on list interfaces any suggestion plz? Bests 

Hi all,I have found two events with the same session ID and with the same URL but one had action block and the other had pass-through.So is it passed or not? In other words, is it possible for one request to have pass-through and block actions in the same time?

Question, with the new Windows Copilot+ PCs, will there be a version of Forticlient for Windows on ARM that will also support ZTNA?I have SSL VPN setup at the moment, so tried using the version of FortiClient from the Windows Store, but while it connects it will not pass traffic. The regular Forticlient on another device works just fine. I'm getting ready to work with ZTNA to learn more about it, but I have a Windows Copilot+ laptop which the native Forticlient cannot be installed to. Yes, I can go back to my other laptop, and probably will for the testing, but if this is something that's going to be coming then I can wait to do so (while working on the SSL VPN issue, or setting up an IPSec connection, instead).

We use the EMS server to configure the FortiClients on our laptops.How can I ensure in the EMS server, that only our laptops connect to the EMS and that no foreign devices ? RegardsChris

Greetings,My organization uses Gmail through the Mac Mail app. Incoming emails are working, but outgoing/sending is not. Below is a log of my co-worker trying to send a message. I am kind of a noob and hoping for someone who can help translate.OR maybe I am not even looking at the right log? Thanks! 

Hello everyone, FortiOS: 7.2.4Fortigate: 200E We have two FGCP clusters and FGSP between them. FGCP clusters are georaphically spaced and RTT between them around 40-50 ms. Session sync is configured over L3 link between FGCP clusters.We have configured pickup sessions(also expectation and connectionless). 1st FGCP cluster:config system ha  set group-name "cluster 01"  set mode a-p  set session-pickup enable  set session-pickup-connectionless enable  set session-pickup-expectation enable  set ha-mgmt-status enable  set override disable config system standalone-cluster  set standalone-group-id 1  set group-member-id 1  config cluster-peer    edit 1      set peerip x.x.x.xdiagnose sys ha standalone-peers  Group=1, ID=1  Detected-peers=1  Kernel standalone-peers: num=1.    peer0: vfid=0, peerip:port = y.y.y.y:708, standalone_id=2    sess

Greetings. 4 users are banned from the internet.But we want these users to access a local website. What should I do? Waiting for your help.  

What's up, I'm trying to get the categories of each of the profiles that I have in web filter in the firewall, I'm using this statement "/api/v2/cmdb/webfilter/profile" it seems to work, but it only shows me filters with action block ( It only gives me the ID, but I don't know what object it refers to or where the dictionary is with all the IDs to know what filter and category it is) and the ones that have action allow it doesn't show them to me, is there a way to get all of them? Filters configured for a profile by the Fortigate API?Thanks 

Dear Concern, We have Active Directory Domain environment & all workstations are joined with AD.Fortigagte is acting as centralized firewall + SSL VPN Server & our users using Fortclient SSL VPN client to connect with our office from remote locations to access shared resources. Fortigate is configured with AD Domain SSO so that remote users can connect using same ID/PASSWORD for vpn (which they uses for windows login) . SSO is used for VPN because we have large number of users & we donot want to create local users in Fortigate local users to avoid overhead management & centralized management.Recently we added some Logon Secruity in AD users that user can “Logon to specific workstation” only. like user A can LOG ON to computer A only & likewise for all. This restriction part is working fine on local network, but now the user cannot logon to VPN (work from home dueto Logon to specific workstation) restriction.What is the workaround ? 

I was wondering if anyone here has experience with this or has any advice. I’m averaging -6 ish on logic games because I run out of time and usually have to guess for at least half of game 4.I’ve started redoing sections untimed and have been getting only 0-2 questions wrong by taking 5 or less minutes extra, but every new section I do ends up following the same pattern of panic mid game 3 and guessing for game 4. I’m reading the LG Bible too. Would appreciate any advice.Thank you for your time!!Hi guys,I've got an invite from Fortinet HR for a manual technical assessment & HR Interview.I've never expected this as I did badly in the HackerRank assessment.I come from a voice network background (11 years).Just wondering what this manual technical assessment looks like.Cheers

Hello,We have actually a wan1 connection with the interphace ip 80.xx.xx.xx (it's a private ip of our FAI named "SFR"). We have 5 VPN connection between our fortinet and other pfsense. All pfsense use the remote ip 80.xx.xx.xx of our fortinet. And also we have domain names that point to ports on our fortiner. For exemple test.mydomain.com:8080 point to 80.xx.xx.xx and a rules nat the port 8080 in a server behind the fortinet. Everything works fine.But now we will install a backup internet connection on wan2 with a other FAI named "ORANGE" with the private ip 193.xx.xx.xx. For our users continue to use internet if wan1 is offline, i have to create a new sd-wan contains wan1 and wan2. This should work for the user continue to have internet transparently by wan2.But for the VPN connection and the redirect port 8080 will it work ? Actually without sd-wan, the VPN is broken if wan1 80.xx.xx.xx is offline (it's normal). And we needs to have a backup link for if wan1 is offline, vpn can conti

Hello, I have the following problem. I have a FortiGate and a tunnel set up between two companies. I receive two IP addresses via OSPF for routing, as we use OSPF. The problem is that the other party has set up an access list and they only receive the IP 192.168.0.136/32. The issue is that this network is on my FortiGate. How can I send them this network? I tried to set up port forwarding using a blackhole; I activated a public IP and set up port forwarding from 192.168.0.136 to 10.185.195.15. They receive this IP but cannot establish a telnet connection. Can you help me with a way to make the /32 network accessible via OSPF? Below are screenshots of the configuration. Friends, I’m waiting for your help, I really need it.     

Please can some explain the below senario. These firewalls are on the same physical site, they share an interconnect VLAN / subnet that has nothing else on (better than a IPSEC VPN). I am in the process of segregating Dev from Prod, previously they were on the same firewall with a lot of over-lapping services. I want it to work using specific IPs as source on the Prod firewall and without NAT. But it wouldn't work and I don't know why. I have static routes in both directions, so I don't understand why this won't work without NATing. Any help is much appricated, Thanks! Working setup:Dev Fortigate:  Interfaces:    Dev subnet / VLAN    Interconnect subnet / VLAN  Static routes:    IT Users subnet via Prod Fortigate on Interconnect network    Prod servers subnet via Prod Fortigate on Interconnect network  Policies (in order):   1:      From Int: Interconnect,  &nbsp

Hi, Recently we installed fortigate 200F with 7.0.11 OS. We are using one policy to allow Google Workspace access and randomly users need to refresh the browser to send emails. It says "Message could not be send check your network and try again". when incident happen log shows as below and once refresh the browser same user allow to send email without any issue. I'm using web filter & application control Can anyone suggest a solution.