Support Forum

Hi guysI've a question about de vulnerability scan result from FortiClient.On the client in the scan results there is found an application which uses log4net. On the client I can see whats the vulnerability an in which path it's located.But on the EMS server I only see the vulnerbaility and not where it's located. Maybe I failed to see it on the EMS server... Can someone help me out??Patric

Dear All , hope you are doing great, i have FortiGate 60D, just unplugged it from the server room to hardware reset everything, put on my desk, plugged the power and all i got the power button is contiguously flashing green,it was working fine. tried to putty it with no access. your support much appreciated if anyone faced this before. RegardsGhadamsi

i recently upgraded my macbook and now need to install forticlient vpn on it.which version should i download?those that i tired download from fortinet support all comes with EMS with one month validityi just need the forticlient ssl vpn client

I have a below setup. Spoke locations:  Single WAN link sites (Single Underlay) & Dual WAN link sites (2 Underlay)Hub location: Single Hub with Dual WAN link Single Underlay sites having 1 Overlay to Hub locationDual Underlay sites having 2 Overlay to Hub location I have a ADVPN with SDWAN setup, spoke-to-spoke communication is happening via shortcut tunnel. In this case some fail-over scenarios are there between spoke-to-spoke communication, Single Underlay Site - Overlay 1 is UPDual Underlay site - Overlay 1 is down (WAN 1 down) but Overlay 2 is UP (WAN 2)But communication between these sites are not happening via Criss-Cross tunnel.Question:How to achieve this communication (Criss-Cross tunnel)?Fail-over: As per TAC, Its not possibleI want to cheek anyone achieved this solution or design or not, If possible how it is done?anyone having any idea? Need your suggestion.  

I have downloaded the FGT_VM64_SVM-v7.0.15.M-build0632-FORTINET.out.ovf from the Fortinet downloads portal This appliance will be used with NSX integration. I have deployed the OVF on the ESXi host. I accessed the Forti VM via url and have the serial number. This is a trial license. I do not have a paid license here. When I try to register the serial number on the Forti portal it returns an errorPlease enter a valid registration number I even tried registering the appliance from the UI portal however it did not work too. Any suggestions here

Fortinet provides open source (GPL3) Ansible Galaxy modules that are available from github at https://github.com/fortinet-ansible-dev/ansible-galaxy-fortios-collection. These are also available via the Ansible Galaxy website at https://galaxy.ansible.com.I am unable to determine if these Fortinet modules are officially certified on the Ansible Automation Hub. If Fortinet does officially support these modules for Ansible subscribers, then Ansible subscribers can engage Red Hat for Ansible support for the Fortinet modules. Does Fortinet have official support for their Ansible Galaxy modules?If not, is it planned to do so in the future?Are there any other ways (SKUs) that customers can purchase to obtain official support for the Galaxy modules?

Hi, I have configured an automation stitch with an Email action following this technical link: Replacement messages for email alerts | FortiGate / FortiOS 7.0.0 | Fortinet Document LibraryHowever, the email I received is missing the FortiGate logo on top of the email alert.  Instead of the FortiGate logo/icon, I am seeing this: Hope you can direct me on which steps to work on to successfully to load the Fortinet logo. Thank you!

Hi, i have this problem. I didnt have this problem when i was at my old notebook. I am trying to reach my University VPN - but i have error - i reach 10% and it write Unable to establish VPN connection. The VPN server may be unreachable. I tried to solve this but i dont know what to do anymore.I also noticed that i cannot ping server that i want to connect toThe weird thing is - i once was able to connect - so i thought it is solved...

Hi there,Is it normal that FortiOS doesn't log admin user creation events? I figured it was standard practice. I can't find anything regarding admin user events in the log reference. Thank you. While I'm here, I actually have a few more questions about different logged events. For example, is there any reference to explain the difference between Log ID 00003 (Traffic violation - deny) and Log ID 00011 (Failed connection attempts)? To my understanding, these are quite similar. Does log ID 00011 only get logged for TCP syn packets and 00003 for any packet/port/protocol? Thank you!

Hi everyone, How can I find the memory size of my Fortigate-100F? I have not found it listed in the Data Sheet nor have I been able to find the total amout or the free amount using the "free" command which is not recognised by the Fortigate.

Hi All, I am facing a problem with the site to site vpn (fortinet to Cisco ASA). Frequently tunnel is getting down and it is not come up automatically. Manual restart is required to come up the tunnel. Auto Negotiate and keep  alive options are enabled already. Can anyone give me a solution to resolve it. Thank You

I have Fortigate with SSL VPN portal and I have set up host check. I want to ask: can Fortigate run applications (.exe files or some scripts) having done host check? For example if host check is failed and some program isn’t running Fortigate VPN server will initiate to start this program (by sending some command to the host). And one more question: can Fortigate VPN server run some interactions. For instance if host check is failed and some program isn’t running Fortigate VPN server will initiate to start this program (by sending some command to other device that it will run the program by some management protocols on host check device).

 I am new to FortiPhish solution and I don't have a license yet. Does the FortiPhish offers a trial period?I explored based on the admin guide I found.I added my domain under FortiPhish Domain settings and it gave me a token. Followed these steps:To add the token to your domain:1. Log in to your domain.2. Go to the domain settings, and navigate to the DNS management area.3. Change the text record setting to TXT.4. Enter the token you created in FortiPhish.5. Test the token with nslookup. Here is my DNS TXT entryTXT at fortinet-fortiphish-site-verification=9Lv3ybeyhJZBQC3QpPGXXX The problem is that the domain Status didn't change from x to green check. Below FP admin guidehttps://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/60ced68d-997a-11ee-a142-fa163e15d75b/FortiPhish-23.4.0-Administration_Guide.pdf Regards

SSL_VPN/Https/SAMP SP signing Certificate is about to expire. I have been able to import it in our other firewall  1 via the GUI after changing private key format to UTF-8 but I have a difficulty on the other firewall 2 that Im unable to import the certificate and getting this error "Incorrect certificate file format for CA/LOCAL/CRL/REMOTE cert." - 2 FGVM -FOS 7.0.14  Thank you!

I recently became a part of this project because the site had been initially hacked. I cleaned the site and moved it over to a better server as well as added a couple tried and true security implementations as well as a CDN. Is this the forum to submit that the client's site is indeed cleaned and ready to be unblacklisted? Site: https://newtoncountyjournal.com/ Thanks for your time!

Hello Guys, I had an issue when using the Default web filter profile with a blocked static URL for Youtube and other sites. I used the certificate inspection not the Deep inspection option, and when the any website should be blocked like Youtube, I got the certificate warning and only solved if I install the certificate on my machine, the goal is that how can I solve this issue to get the replacement message for FortiGuard web filter or the known error "This site can’t be reached". I have another firewalls and with the same configuration but without the certificate error. I opened a case with Fortinet TAC and they told me that you have to install the certificate on the machines! below is their message: " As per my findings, for https websites we need to install the CA certificate (in our case the FortiGate CA certificate) to the browser trusted store in order to get the replacement message. Without the certificate we received the same error as the error that you received. PFA the scree

Hi,PBX Fortivoice FVC 100-DB: I have been trying to find this answer for a little while now, I cannot find where to set or reset a users/ext default VM passcode?I don't see it anywhere in the tech manual and we have tried any code that we did find already. Thanks 

Dear Fortinet Community,We need to verfiy that if there is any policy in FortiGate to route traffic towards two destination with specific ports. For example, we have a source address "192.168.10.10" and we have created a NAT policy towards destination "192.168.20.20". Now we need to route a single service i.e. "SFTP-22" towards another destination like "172.16.30.30". Can we create NAT or PAT policy with dual destination in FortiGate?

Hi All,  I have a client who we are moving VMware ESX from a Data Centre to the head office. They have FGT's at both ends. Soon to be v7 And we have about 2 VLAN's at the DC we wish to have replicated over to the head office. Head Office: 192.168.2.0/24Data Centre: 192.168.100.0/24 (Default VLAN)Data Centre: 192.168.101.0/24 (VLAN 101) - VMware Vmotion The customer already has an existing IPSEC tunnel to the Data Centre from the Head Office and vice versa. If I add the VXLAN as per the cookbook. I am assuming this will break the routing of the existing IPSEC tunnel? I am also assuming that I can run multiple VLAN's over VXLAN?  So should I tell the Head Office Fortigate to route 192.168.100.0/24 & 192.168.101.0/24 to the local VXLAN interfaces? and remove the configuration for the existing IPSEC tunnels?   And when I get this setup, do I just leave the default gateway at the same at both sites? And when a device wants internet

i can login to gui but not ssh. is there a way to enable ssh access via the gui? or how would i go about resetting the root ssh login?

Hello everybody,I've FortiClient EMS in my network. The filtering is working correctly, but I can't understand how to view generated logs. Is it mandatory to send logs to FortiAnalyzer or to an external server?Where can I view generated logs on FortiClient EMS?Thank you 

having the same issue as quite a few people, i have managed to resolve the issue of having users not seeing the remote access feature in their forticlient GUI's.  Within the EMS server - goto Endpoint profiles - Remote access - Click and edit the required profile - Click on the XML option (top rightish) - Scroll down to bottom, look for the following   All you need to do is edit the file and change the 0 to 1, save the file.The new profile changes will be updated on the client and they are than able to see the remote access feature.    

We would like to know more information about the Crowdstrike issue. Just wanted a confirmation that this issue could happens to Fortinet Products too such as Forticlient or any?  Does CrowdStrike has any impact on Fortinet products?  TIA :) 

Hello everybody,on my PC I've FortiClient, and in my network I have a Fortigate. Essentialy, regarding web filtering, FortiClient and Fortigate have the same settings and the same exceptions.When I visit a "tobacco" site, this site is correctly blocked. Reading the logs, how can I understand if the site was blocked by FortiGate or by FortiClient? date=2024-07-23 time=14:26:54 id=7394806744431460361 itime="2024-07-23 14:26:54" euid=1026 epid=1030 dsteuid=3 dstepid=101 logflag=3 logver=702081639 type="traffic" subtype="forward" level="notice" action="close" utmaction="block" policyid=6 sessionid=6330623 srcip=10.1.10.31 dstip=104.26.14.200 transip=192.168.1.4 srcport=55936 dstport=443 transport=55936 trandisp="snat" duration=140 proto=6 sentbyte=220 rcvdbyte=4659 sentdelta=104 rcvddelta=260 sentpkt=4 rcvdpkt=13 logid=0000000013 unauthuser="xyz" srcname="MacBook_Pro" service="HTTPS" app="SSL" appcat="Network.Service" fctuid="92CB99E956C6570AB48FD3B7E84960C7" srcintfrole="lan" dstintf

Hi Team, I have created web-filter based policy by allowing web-based email access.But I want to restrict only for gmail access with tenant based.Anyone can help me out for this. ThanksSrinivas.