Support Forum

We use the EMS server to configure the FortiClients on our laptops.How can I ensure in the EMS server, that only our laptops connect to the EMS and that no foreign devices ? RegardsChris

Greetings,My organization uses Gmail through the Mac Mail app. Incoming emails are working, but outgoing/sending is not. Below is a log of my co-worker trying to send a message. I am kind of a noob and hoping for someone who can help translate.OR maybe I am not even looking at the right log? Thanks! 

Hello everyone, FortiOS: 7.2.4Fortigate: 200E We have two FGCP clusters and FGSP between them. FGCP clusters are georaphically spaced and RTT between them around 40-50 ms. Session sync is configured over L3 link between FGCP clusters.We have configured pickup sessions(also expectation and connectionless). 1st FGCP cluster:config system ha  set group-name "cluster 01"  set mode a-p  set session-pickup enable  set session-pickup-connectionless enable  set session-pickup-expectation enable  set ha-mgmt-status enable  set override disable config system standalone-cluster  set standalone-group-id 1  set group-member-id 1  config cluster-peer    edit 1      set peerip x.x.x.xdiagnose sys ha standalone-peers  Group=1, ID=1  Detected-peers=1  Kernel standalone-peers: num=1.    peer0: vfid=0, peerip:port = y.y.y.y:708, standalone_id=2    sess

Greetings. 4 users are banned from the internet.But we want these users to access a local website. What should I do? Waiting for your help.  

What's up, I'm trying to get the categories of each of the profiles that I have in web filter in the firewall, I'm using this statement "/api/v2/cmdb/webfilter/profile" it seems to work, but it only shows me filters with action block ( It only gives me the ID, but I don't know what object it refers to or where the dictionary is with all the IDs to know what filter and category it is) and the ones that have action allow it doesn't show them to me, is there a way to get all of them? Filters configured for a profile by the Fortigate API?Thanks 

Dear Concern, We have Active Directory Domain environment & all workstations are joined with AD.Fortigagte is acting as centralized firewall + SSL VPN Server & our users using Fortclient SSL VPN client to connect with our office from remote locations to access shared resources. Fortigate is configured with AD Domain SSO so that remote users can connect using same ID/PASSWORD for vpn (which they uses for windows login) . SSO is used for VPN because we have large number of users & we donot want to create local users in Fortigate local users to avoid overhead management & centralized management.Recently we added some Logon Secruity in AD users that user can “Logon to specific workstation” only. like user A can LOG ON to computer A only & likewise for all. This restriction part is working fine on local network, but now the user cannot logon to VPN (work from home dueto Logon to specific workstation) restriction.What is the workaround ? 

I was wondering if anyone here has experience with this or has any advice. I’m averaging -6 ish on logic games because I run out of time and usually have to guess for at least half of game 4.I’ve started redoing sections untimed and have been getting only 0-2 questions wrong by taking 5 or less minutes extra, but every new section I do ends up following the same pattern of panic mid game 3 and guessing for game 4. I’m reading the LG Bible too. Would appreciate any advice.Thank you for your time!!Hi guys,I've got an invite from Fortinet HR for a manual technical assessment & HR Interview.I've never expected this as I did badly in the HackerRank assessment.I come from a voice network background (11 years).Just wondering what this manual technical assessment looks like.Cheers

Hello,We have actually a wan1 connection with the interphace ip 80.xx.xx.xx (it's a private ip of our FAI named "SFR"). We have 5 VPN connection between our fortinet and other pfsense. All pfsense use the remote ip 80.xx.xx.xx of our fortinet. And also we have domain names that point to ports on our fortiner. For exemple test.mydomain.com:8080 point to 80.xx.xx.xx and a rules nat the port 8080 in a server behind the fortinet. Everything works fine.But now we will install a backup internet connection on wan2 with a other FAI named "ORANGE" with the private ip 193.xx.xx.xx. For our users continue to use internet if wan1 is offline, i have to create a new sd-wan contains wan1 and wan2. This should work for the user continue to have internet transparently by wan2.But for the VPN connection and the redirect port 8080 will it work ? Actually without sd-wan, the VPN is broken if wan1 80.xx.xx.xx is offline (it's normal). And we needs to have a backup link for if wan1 is offline, vpn can conti

Hello, I have the following problem. I have a FortiGate and a tunnel set up between two companies. I receive two IP addresses via OSPF for routing, as we use OSPF. The problem is that the other party has set up an access list and they only receive the IP 192.168.0.136/32. The issue is that this network is on my FortiGate. How can I send them this network? I tried to set up port forwarding using a blackhole; I activated a public IP and set up port forwarding from 192.168.0.136 to 10.185.195.15. They receive this IP but cannot establish a telnet connection. Can you help me with a way to make the /32 network accessible via OSPF? Below are screenshots of the configuration. Friends, I’m waiting for your help, I really need it.     

Please can some explain the below senario. These firewalls are on the same physical site, they share an interconnect VLAN / subnet that has nothing else on (better than a IPSEC VPN). I am in the process of segregating Dev from Prod, previously they were on the same firewall with a lot of over-lapping services. I want it to work using specific IPs as source on the Prod firewall and without NAT. But it wouldn't work and I don't know why. I have static routes in both directions, so I don't understand why this won't work without NATing. Any help is much appricated, Thanks! Working setup:Dev Fortigate:  Interfaces:    Dev subnet / VLAN    Interconnect subnet / VLAN  Static routes:    IT Users subnet via Prod Fortigate on Interconnect network    Prod servers subnet via Prod Fortigate on Interconnect network  Policies (in order):   1:      From Int: Interconnect,  &nbsp

Hi, Recently we installed fortigate 200F with 7.0.11 OS. We are using one policy to allow Google Workspace access and randomly users need to refresh the browser to send emails. It says "Message could not be send check your network and try again". when incident happen log shows as below and once refresh the browser same user allow to send email without any issue. I'm using web filter & application control Can anyone suggest a solution.  

I'm setting up a forticlient enterprise management server and the forticlient agents on the computer show real time protection is disabled.  The correct profile is assigned to the group and the Scan Files as They Are Downloaded or Copied to My System option is enabled on the profile.  Any suggestions why real time protection wont enable?

Hi, I checking on my FortiAnalyzer, seem the resource for the CPU really high. I monitored it almost 1 day and restart some of the service but still same. Based on the exe top output, some application that utilized most of the cpu are siemagentd & postgress. Its take a lot of time to generate a report when the cpu high. Anyone can assist me on this ?  

Fail:(errno=131):datasrc invalid. object: system zone. detail: "Fortigate name"[root] interface:DATA How would I go about removing this object so I can upgrade the FMGs ADOM? The FMG is at 7.4.3

greetings, I created an SD-WAN rule (source = all, destination = all) for Internet access with two member interfaces. One is the underlay interface and will forward traffic to local egress (DIA), the other one is an overlay MPLS ipsec tunnel that will forward traffic to our offshore office in another country (RIA). underlay interface is the primary for internet access, overlay interface is used when underlay interface is inactive. They are judged by an SLA that uses ping as the probe to a public www server (but we are gonna change to use DNS soon). There is only one default route (0.0.0.0/0.0.0.0) pointing to the underlay interface. my concern is, when underlay interface becomes inactive, will the overlay interface be able to forward internet traffic? according to the SD-WAN routing logical, when primary interface is down, the default route via it will be updated (removed I think), then there is no route through any of the SD-WAN member interface for internet traffic.&nb

Hi, I've had an issue with a 200F v7.2.8  We have an issue where policies for VLANs attached to a port that is part of a Zone labelled DMZ are not applied when using the Zone in the firewall policy. for example Port 2 has multiple separate VLANs that are various DMZ networks.Port 2 is assigned to the DMZ ZoneOne such DMZ VLAN is a quarantine DMZ (for testing suspicious USBs etc) Port 24 is our main internet connection assigned to the WAN zone If I create a rule From DMZ Zone to WAN Zone with source set to the IP Range used on the quarantine DMZ destination all, service all I see no traffic hit that rule and logs show traffic from the IP of the device being blocked. Even if I use a DMZ Zone interface source all to WAN destination all I still get not policy hits. If I modify the rule so that the incoming interface is the Quarantine VLAN instead of the DMZ zone then the policy works. I've worked around this by using the VLANs for the

Hi everyone,  Does the Frotigate come with any malware-protection software to prevent the device itself from becoming infected? Or are users exclusively dependent on security patches pushed by Forticare? 

Hello. I'm working on putting together a test topology for a private Datacentre and I've run into some troubles with NAT & Routing when passing traffic over an NPU Inter-VDOM link. My design is to have an internal VDOM to handle all local policies and inter-VLAN routing, and an External VDOM to take in the WAN links and handle broad-scope security such as DDoS protection, IDPS, etc. I have multiple Public IP addresses to use and would like to be NATing from the internal VDOM using IP Pools and sending this traffic over the NPU and out to the internet, however, I have not been able to get this working with this design. The only way I've gotten this working so far is by performing the outbound SNAT from the externally facing VDOM by passing private IP traffic over the inter-VDOM link instead of Public IP traffic. I'd like to avoid this, as it would include double-handling IP address objects between VDOMs. My first hunch was to play around with the static routes /

I have a FortiGate 61F. Can I upgrade from 6.4.6 directly to 6.4.15? Has anyone done this without problems? I am managing it remotely via VPN so I would like to avoid problems that require me to be there to do any physical resets.  I have asked support as well, but I'm looking for real life experiences/advice. Thank you !

Hi, I'm new with firewalls in general, and I need to do a simple set up for both DMZ and SNMP, both of which don't seem to be working, I'm using Fortigate v5.4.6 VM. For DMZ I need to add a server to a DMZ and only network clients from 1 LAN interface should be able to access it, I have managed to get client to access DMZ Server but everybody else can also access it ?! My question is particularly about the Static Route, which interface should it point to ? This gallery shows the Interface, Static Route & Policy configuration.

Hi, I wanted to ask about ZTNA. Is it mandatory to use a ZTNA server? If we don't use it, who handles user authentication and authorization? Will EMS itself or Fortigate do this?  

I have a simple question about a Fortigate VM in cloud.Iam hosting multiple websites where Fortigate (mini) WAF Features are enabled like XSS, XSS Adv, SQL Injection, SQL Injections Advanced and so on.The problem is that website editing with "FCK-Editor" in the administrative webgui of the hosted sites triggers XSS basic and extended and also sql injection basic+extended. Since this is the mini waf i cannot finetune the policies.Can i do some kind of Internet-FSSO where for example a website admin can authenticate before editing a website so that I can create seperate firewall policy for authenticated admins? All the admins are workgroup Windows Computers not domain joined or something all stand alone computers.

Hola, estoy tratando de obtener las categorías de cada uno de los perfiles que tengo en web filter en el firewall, estoy usando esta sentencia "api/v2/cmdb/webfilter/profile/" profile parece funcionar, pero solo me muestra filtros con action block (solo me da el ID, pero no se a que objeto se refiere ni donde este el diccionario con todos los ID para saber que filtro y categoria es) y los que tienen action enable no me los muestra, hay forma de obtenerlos todos? ¿Filtros configurados para un perfil por la API de Fortigate?Gracias por tu tiempo Gracias por tu tiempo

this log MSI_CreateDB(), failed to launch appear to me when i try to install with remotely sql server with cause installation failure.any one have solution?   

Good day team,Case: Caught a staff member, she enabled hotspot on their laptop because the staff wifi was temporarily down, found her pc name in the ssid list on my phone LOL. Many devices were connected in her dhcp client list. LOL, i mean, we IT staff doing so much stuff, we dont actively monitor this. Additionally, in all the major IT corporation that I have worked and managed, this feature was never really acted on or considered to be changed/disabled by the IT Bosses. Even my fellow sys engineers as myself did not pay this much mind. Something as simple as a hotpsot. Crazy world.Which is the best method?What did you do in your LAN?Which method worked for you? Is this possible with Forticlient? Would love some direct responses/suggestions/steps here.