Support Forum

Hello all,I'm having problem with AnyDesk and activated SSL Deep inspection.As soon as this is activated, the AnyDesk client can no longer connect to the AnyDesk server.I've already tried to exclude *.anydesk.com but no luck.I have already created a outgoing policy specialy for service "AnyDesk-AnyDesk" and set it to the top. But even this does not work.

Hello, I set up an explicit proxy a proxy on a fortigate 80F version 7.4.4. My configuration: Interface 4: 10.0.100.1/24, Explicit Web Proxy EnabledExplicit Proxy: Internal4 listener, HTTP port 8080Authentication scheme: Basic, localAuthentication rule: src all, Int4 inbound interface, HTTP protocol, auth scheme "test_proxy_schema"Proxy policy: wan1 egress interface, src all, dst all, webproxy service The IP of the proxy interface has been configured on a pc directly connected to the firewall port.My colleague who has control over this pc runs a continuous ping to 8.8.8.8.I don't see any traffic that matches with my proxy Policy. Can you help me, please?  

Hi All,I would like to get a list of all the BSSID's on a FortiGate, with the name of the AP it's assosiated with, so in essens a list like:AP1,BSSID1AP1,BSSID2AP1,BSSIDnAP2,BSSID1AP2,BSSID2AP2,BSSIDnetc.. Is there a way to do that, seems like CLI is needed, or do I look in the wrong place in GUI?

Hello team what is the course for the BGP not form neighbor between HQ and branch

I have two FortiGate 200D in HA mode currently and need to transfer one of them to the DR location. DR Site IP range and HO IP ranges are the same. Core Switch with different VLAN is having a gateway set to firewall LAN IP. Is it Possible to have an HA configured using Datalink connectivity between 2 different geographic locations?Do any other Changes are required on the Core switch?

Hi Team, I have a question about using DNAT and SNAT simultaneously. For example, my global IP is 100.100.100.100/32. I want to enable RDP (port 3389) access to a local host with the IP address 192.168.10.10/32 from the Internet.When a user connects to 100.100.100.100:42424, it should be forwarded to 192.168.10.10:3389 and also be SNATed to 192.168.20.10/32. Is the configuration below workable?------------------config firewall vip edit "vip_192.168.10.10_Office-RDP"  set service "TCP_42424"  set extip 100.100.100.100  set mappedip "192.168.10.10"  set extintf "WAN_v2000"  set portforward enable  set mappedport 3389 nextend config firewall ippool edit "192.168.20.10/32_LAN-Office"  set startip 192.168.20.10  set endip 192.168.20.10 nextend config firewall policy edit 10  set name "Internet->Office-RDP_allow"  set srcintf "WAN_v2000"  set dstintf "LAN_v2002"  set action accept

I have acquired a 60 day trial license for a fortigate VM with 1 vcpu.Can someone tell me what happens if the 60 day trial license is over? Will everything stopp working?With everything I mean VIPs and Virtual Servers with Full Deep Packet Inspection + IPS + WAF and some basic outbound firewall rules without UTM.

I'm a network guy, familiar with Juniper SRX and Palo a bit. I've installed FortiGate in Eve-NG  but the licences have now expired. What's the best root here for licencing? Ideally, I would like something permanent Performance is obviously not important. But it is really great to be able to simulate scenarios similar to the live ones we are deploying. I have asked our SE for temporary licences, but now, at the 3rd request, I've been politely asked to find a different solution. What is my best bet here for a permanent solution ? or is there a easy route to just keep renewing temp licences. Most vender seem to make trial licences freely available. Thanks in advance,  

Hi all! Still learning the FortiOS and have run into a issue and its time critical i get it fixed ( Sites need to print Paychecks tomorrow )  So 2 of my 3 tunnels when down and i started with trying to ping the Public IPs and sure enough from CLI Fortinet/windows i can not ping those public IPs but if i log into the comcast modem can ping the public IP addresses and if i go to the other 3 sites and ping the Main sites IP that come back as responding from Fortinet/Windows and the Modems. Any ideas on what may have gone down or broke? Any help is appreciated! 

Hi all,Fortinet 200f running 7.2.7Cisco CBS350Set up a LACP LAG on both the 200F AND THE 350. Refuses to come up. Anyone have any insight on this?Are there non compatible settings set by default on the Forti that need to be changed in order for the lag to come up? The lag on the Cisco side is a plain jane LACP LAG. Nothing special https://vlc.onl/ .Thanks

Hi everyone, I want to prevent anyone from being able to shutdown the Fortigate from GUI or CLI. Is there a command which can allow me to implement this on the Fortigate 100F?

I have ems server version 7.0.6 build 0358.my vpn client running version 7-0-7need to now if i can upgrad the server without the need to upgrades  all the  my vpn clients?thank youShahar 

hi I need to implement HIGH Qos for Microsoft services. I understand I need to use shaper.i need help how to configure it.1.should i give maximum band for shard or per ip?2.the Microsoft services need to be as source or destination?3.do i need reverse shaper? thank you for  helping

I have an internship and am currently learning Fortinet. Do you have any project ideas for starting from scratch and eventually working on a larger project? I am beginning with VLAN and inter-VLAN configurations. How should I proceed from here in the security field https://routerlogin.uno/ ?

Hi guys. I have a consult about How i understand each option in Forward Traffic.for example i have consume in app zoom, in the option  "result" Accept(84.64 MB / 260.05 MB).   Understand total consume is 260, but 84.62??Put doble clic for more details in the option DATA, received Bytes: 260.05 MB , Receeived Packets: 392.072 , Sent Bytes: 84.62 MB y Sent Packets 158.634.  btw i have a shapper for this , maximum 3 Mb.  sooo   how this 84Mb app zoom entrance in this 3 Mb. for me is confuse. any help is good received.Regards   

Good morning experts. Maybe you want to help me with a problem that is killing me..?I’m trying to configure a solution for a remote office using CISCO switches and a Fortigate 60E. Difficult to explain but that is almost fixed, no problem with that.The problem is a behavior about how Fortigate manage VLANs in its Internal ports hard-switch:When all infrastructure is connected, the testing host is able to ping all VLANs. But when a physical trunk link is down between two of the Cisco Switches, the testing host loses connection to its default gateway (which is the Fortigate...!) I mean that the testing host can ping 5/6 time more from the moment the link goes down and after that it loses connection and pings are not more answered until the link is reestablished. I drew my infrastructure so that it is understood, I hope you can help me. Technical data:* Interfaces used: ports 1 to 5 of the Internal hardware-switch* Five VLANs configured on it: IDs 15, 30, 35, 50, and 101.* VLAN

Hi All,Good day! I have a very specific environment. Diagram attached.I have two Internet circuits from two providers trying to achieve diversityPlanning to connect these two circuits to two FG devices - not decided if I have to do a Active/passive or Active activeI have an existing environment where my Cisco based DMVPN is running. which I need to run for a few more months and eventually move them to Fortinet SD-WAN For now my plan is to connect these two FG devices and run them as a CPE to pass the DMVPN setupCan I configure the FG's as layer 2 ( switch mode) configure the HA which might pass all the DMVPN?Any specific observations here?After the FG's Do I need two switches to connect to the DMVPN router?

How can i block youtube on mobile phones 

Hi everyone, I want to allocate X, Y, etc. amounts of memory to storing certain log categories. Is it possible to do this in a Fortigate 100F?

HelloWe use the Forticarrier license in VM08 to inspect GTP traffic and to place necessary restrictions. We want to block protocols such as Ping, SSH in GTP. Can you help us with this?  I also want to filter SCTP messages in GTP and block some of them. I can write sctp message filter and give the ppid value and block it, but this is not what I want. I want to catch the payload in SCTP and block it if it exceeds the hit count. How can I do this? Thanks in advance

I would like to have the fortigate update its webportal URLS dynamically using some kind of script or tool or pull method.  As an example the Fortigate periodically pulls in a file from some linux server internally to create the webportal URL list that is then presented to the usergroup assigned to that portal. Any one know how to do something like that?

Hi everyone,  The full message descriptions present in the Fortigate events (e.g. Administrator X accpeted login disclaimer and logged in successfully from https(Y)) are not shown in the Log Message Reference Manual. If I go for the the log entry with the same Log ID (i.e. 32001), it only refers to successful login entry (LOG_ID_ADMIN_LOGIN_SUCC) but does not mention anything about the banner. This is really frustrating for me as I need to monitor certain events and I must how they will show in the Fortinet logs or if they will appear at all. In this case, where does acceptance of login banner appear in the log reference manual? It shows up in the GUI's Systen Events and in the log text file if I download the logs but not in the manual.  

HI All, I have 4 interface as below: Port 13 = WAN 1 x.x.x.x Port 14 = WAN 2 x.x.x.x Port 15 = WAN 3 x.x.x.x Port 9 = Internal 192.168.1.1 I have 4 static routes as below: destination 0.0.0.0/0 gateway x.x.x.x (WAN 1) destination 0.0.0.0/0 gateway x.x.x.x (WAN 2) destination 0.0.0.0/0 gateway x.x.x.x (WAN 3) destination 192.168.1.0/24 gateway 192.168.1.2 192.168.1.2 is their proxy server. Computer that access internet need to point their gateway to the proxy server to access internet. This is working fine. Customer request that they want certain PC to bypass the proxy server and point directly to Fortigate. To bypass the proxy server, the computer needs to point their gateway to the firewall interface which is 192.168.1.1. The computer that bypass proxy have speed problems. How do i configure the routing for the computer that needs to bypass the proxy?

I am using a Surface Pro 11 with a Qualcomm Snapdragon X Elite X1E8010, running Windows 11 Pro. I have installed FortiClient version 7.x, but I am unable to successfully activate the VPN. The connection always drops at 98%. Could you please provide assistance?

Hello, i'm currently struggling to set up a FortiExtender so that I can establish an LTE connection with my Telekom SIM card in Germany.I've already tried the following:- complete settings reset (factory reset)- Plan set up with information for APN (internet.v6.telekom and internet.telekom)- Firmware updates (v4.1.9-build0318) and modem firmware (19.0.0 Europe) to current versions I get the following error message:Failure Code: 0xE00A - IPV4 is down and IPV6 is uporFailure Code: 0xE009 - IPV4 and IPV6 is downFailure Type: Call Manager definedFailure Reason: NO SRV: data call is brought down because traffic channel request got rejected by CM(Call Manager) since device has no service I have already managed to get a FortiExtender online after several attempts - but with the America modem firmware.with the second one - no chance - other SIM Cards like Telefonica works.   many thanks in advanceGreetings