Support Forum

I would like to have the fortigate update its webportal URLS dynamically using some kind of script or tool or pull method.  As an example the Fortigate periodically pulls in a file from some linux server internally to create the webportal URL list that is then presented to the usergroup assigned to that portal. Any one know how to do something like that?

Hi everyone,  The full message descriptions present in the Fortigate events (e.g. Administrator X accpeted login disclaimer and logged in successfully from https(Y)) are not shown in the Log Message Reference Manual. If I go for the the log entry with the same Log ID (i.e. 32001), it only refers to successful login entry (LOG_ID_ADMIN_LOGIN_SUCC) but does not mention anything about the banner. This is really frustrating for me as I need to monitor certain events and I must how they will show in the Fortinet logs or if they will appear at all. In this case, where does acceptance of login banner appear in the log reference manual? It shows up in the GUI's Systen Events and in the log text file if I download the logs but not in the manual.  

HI All, I have 4 interface as below: Port 13 = WAN 1 x.x.x.x Port 14 = WAN 2 x.x.x.x Port 15 = WAN 3 x.x.x.x Port 9 = Internal 192.168.1.1 I have 4 static routes as below: destination 0.0.0.0/0 gateway x.x.x.x (WAN 1) destination 0.0.0.0/0 gateway x.x.x.x (WAN 2) destination 0.0.0.0/0 gateway x.x.x.x (WAN 3) destination 192.168.1.0/24 gateway 192.168.1.2 192.168.1.2 is their proxy server. Computer that access internet need to point their gateway to the proxy server to access internet. This is working fine. Customer request that they want certain PC to bypass the proxy server and point directly to Fortigate. To bypass the proxy server, the computer needs to point their gateway to the firewall interface which is 192.168.1.1. The computer that bypass proxy have speed problems. How do i configure the routing for the computer that needs to bypass the proxy?

I am using a Surface Pro 11 with a Qualcomm Snapdragon X Elite X1E8010, running Windows 11 Pro. I have installed FortiClient version 7.x, but I am unable to successfully activate the VPN. The connection always drops at 98%. Could you please provide assistance?

Hello, i'm currently struggling to set up a FortiExtender so that I can establish an LTE connection with my Telekom SIM card in Germany.I've already tried the following:- complete settings reset (factory reset)- Plan set up with information for APN (internet.v6.telekom and internet.telekom)- Firmware updates (v4.1.9-build0318) and modem firmware (19.0.0 Europe) to current versions I get the following error message:Failure Code: 0xE00A - IPV4 is down and IPV6 is uporFailure Code: 0xE009 - IPV4 and IPV6 is downFailure Type: Call Manager definedFailure Reason: NO SRV: data call is brought down because traffic channel request got rejected by CM(Call Manager) since device has no service I have already managed to get a FortiExtender online after several attempts - but with the America modem firmware.with the second one - no chance - other SIM Cards like Telefonica works.   many thanks in advanceGreetings

greetings, I'd like to know what is the meaning of the time duration next to the DNS server in Fortigate.When it is showing thousands ms, we can still ping it without issue.

Hi everyone,I'm encountering a strange issue and I need some help.I have two spoke sites and one hub in my network. The design involves Active Internet 1, Active Internet 2, and Backup Internet 3. I've noticed that the hub site is advertising the best routes, originating from other spokes' Internet 1 and Internet 2, to the backup BGP peer. This is causing routing issues and incorrect shortcuts.However, I managed to find a solution to prevent this by configuring a community on the hub. Now, whenever the hub receives subnets from the backup with a certain community, it will only advertise them to other backup spoke circuits with the same community and deny anything else.But now, I'm trying to advertise all paths to the spokes, not just the best one. Is there any way I can achieve this?I've configured IBGP multipath with the "adv-multipath" command, but I've noticed that this command only advertises the best routes from the routing table of the hub, not the least preferred routes. Therefo

Hello, i created an report in the fortianalyzer to find out all downloaded files. I use the Chart "File Transferred by Applications" for that. In the result i`m missing files. So i cant see downloaded exe and zip files. The sql uses the variable $log. How can i resolve that? Thanks for some feedback Walter

I am trying to block known malicious IP and created appropriate address group, added the IPs then created a rule to deny traffic coming from this group. I have seen an IP that came in which means that the new access rule which is on top of the list isnt working.Here is the link I follow but it doesn't work.https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-specific-external-public-IP-address/ta-p/195128Is there also any source of known malicious IP from somewhere and feed it to my firewall. That way I don't have to manually update each time. TIA :) 

Hi!is Master session information showing "helper=sip" applicable to Proxy-based (ie. ALG), or Kernel-based (SIP Session Helper) or both types?And, what does 'state=' specifying "inherit_sockport" value mean?R's, Alex 

Hello, when configuring Fortigate based SAML authentication (for client browser initiated auth) is there a way to allow specific URLs before SAML auth takes place ?

Hello I have a bunch of Lenovo X1 Carbon's using Forticlient. Those. restarts themselves constantly. Any ideas? Thanks in advance. 

Hi everyone, There are some specific events I want to log. I have been reading the FortiOS Log Reference Manual and from what I understand for the logs listed there to show in the fortigate, their corresponding category has to be included in Event Logging within Log & Report - > Log Settings. However for some of the logs listed in the manual, their category (e.g. SSL and wireless) does not show up in the Fortigate Log Settings. If I wanted to log these categories, how would I do this? Also could someone confirm me if by including the category (e.g. system) in the Log Settings, it means all the events whithin that category will be logged, or must someone enable/disable a specific feature for some events to be logged?

Hi everyone,  I want to be able to choose specific system events (e. g. failed login attempts, policy changes, etc.) to be logged. I have been reading the admin manual but have not found how I may achieve this. Within Log & Report - > Log Settings - > Global settings, there are only log categories (e.g. System activity events) but no explanation as to what specific events they refer to. Would you mind telling me how I may choose the events I want to log?

Hello Everyone! I didnt found a similar post , so here I come.We got a Fortigate 600E at our company and we are trying to block Whatsapp Videocall only (voice call, text and file transfer should work). I know there exist Whatsapp signatures in app-control, but I can't figure out how to disable only video without affecting voice. Is there any workaround to only block Video calls? No matter if is using firewall policies, app control, etc. Thanks!!

Hi, recently we viewed in our logs a large number of attempts to gain remote access from a bunch of different ip addresses.  In Checkpoint it's possible to quickly block a large amount of ip addresses by doing something like 'fwaccel dos deny -l filename'. Is there something similar in Fortigate (Forti Manager)?  We're running 7.0.12 btw.__PRESENT

I've got an IPsec VPN configured on a Fortigate 61e and FortiClient VPN is working fine for Windows users. FortiClient version 7.4 However, MacOS 14.4 Sonoma are unable to reach the remote network once the VPN is connected. Connecting to the VPN itself appears to be working properly.  The connection is established, and the Mac receives an IP address, and adds some routes to the routing table (split tunnel) for the remote network. Why might I not be able to reach anything on the remote network when it's perfectly fine from Windows?

I received this spam email: Carlos Benson bahri@benvcard.comBitcoin deposited: €2,304,987.84GreetingsYour BTC wallet has been replenished with 40BTC, making a total amount ofof (€2,304,987.84) as requested by you. Please log in with the details below to confirm your BTC balance.bitsbot.netID: 21562666PW: suc2689Confirm your account balance. Why did this get through the spam filter? 

Hi, since yesterday I have problems getting a ZTNA tag which was always present at clients.Yesterday I changed the rules of the TAG. Allthough all rules are matching with the client setup the Tag is not assigend to clients. But on EMS Server in ZERO TRUST TAG MONITOR those clients are showing up in a section named "LOW". I don't know what has happend. KR Christoph

Hello, really strange thing. We are preparing a FG200F cluster and we updated from 7.4.3 to 7.4.4 and after checking we saw that in the policies sometimes the idestination interface or sometimes the source interface was blank, almost in all policies. Anybody with the same issue? I am not worried since we have to check all policies anyway, but that woould be a horrible bug in production mode, no?Thanks

Hello community,I have noticed that there is a fabric-admin present in GUIbut when I try to edit this using CLI it shows this output. It cannot be deleted. X01KF102 (sso-admin) # edit "fabric-admin"table name 'fabric-admin' can't be added or edited because of duplication or reservationCommand fail. Return code -515X01KF102 (sso-admin) # showconfig system sso-adminend I just wonder what is the purpose of this fabric-admin.Thank you

We have two WAN link and when primary link is down, traffic is not switch over to  the secondary link. When primary is down, secondary link and all the vpn tunnels in the secondary link are up but there is no traffic through it.In primary link vpn tunnels are down but in 'enabled' mode. When we manually disable all the vpn tunnels in primary, traffic is switch over to the secondary and working properly.Our requirement is to automatically switch over the traffic to secondary when primary is down.

I am try to access my smart system from internet after allowing port forwarding but still not working

 I need to install a few FortiSwitches (FS) as replacement for very old cisco switches in a quite remote site.I already got the switches here in my office and wanted to prepare them before I go onsite. How should or could I prepare the FortiSwitches here in my lab to reduce onsite time? The FS will be connected via FortiLink (FL)to a local Fortigate 40F with FortiOS 7.0.1440F(FL)---FS124---FS148---FS148                    |                FS148 Uplinks are FO 10GB, no reduncancy, so I need to connect the switches mostlty in serial order. See in the schema above. I should be able to connect the FS with FortiLink in parallel to the Cisco setup.The old Cisco setup is pretty straightforward. Just two VLAN's.   Actual Cisco Switch (CS) setup looks like this here:40F(LAN1)---CS24---CS48---CS48---CS48                   

Hello,I need advice on a problem, or to make sure that this is indeed the case. I have a FG VM in a cluster (FortiOS 7.0.14) and I updated the license from 2CPU to 4CPU but only on the Master (Master 4CPU, Slave 2CPU). HA worked correctly and everything worked but after 24 hours the cluster stopped working and blocked all communication with a message: VM resource exceeds license limit. Master/Slave must have the same license? (number of CPUs) Thx :)