Support Forum

Hi, since yesterday I have problems getting a ZTNA tag which was always present at clients.Yesterday I changed the rules of the TAG. Allthough all rules are matching with the client setup the Tag is not assigend to clients. But on EMS Server in ZERO TRUST TAG MONITOR those clients are showing up in a section named "LOW". I don't know what has happend. KR Christoph

Hello, really strange thing. We are preparing a FG200F cluster and we updated from 7.4.3 to 7.4.4 and after checking we saw that in the policies sometimes the idestination interface or sometimes the source interface was blank, almost in all policies. Anybody with the same issue? I am not worried since we have to check all policies anyway, but that woould be a horrible bug in production mode, no?Thanks

Hello community,I have noticed that there is a fabric-admin present in GUIbut when I try to edit this using CLI it shows this output. It cannot be deleted. X01KF102 (sso-admin) # edit "fabric-admin"table name 'fabric-admin' can't be added or edited because of duplication or reservationCommand fail. Return code -515X01KF102 (sso-admin) # showconfig system sso-adminend I just wonder what is the purpose of this fabric-admin.Thank you

We have two WAN link and when primary link is down, traffic is not switch over to  the secondary link. When primary is down, secondary link and all the vpn tunnels in the secondary link are up but there is no traffic through it.In primary link vpn tunnels are down but in 'enabled' mode. When we manually disable all the vpn tunnels in primary, traffic is switch over to the secondary and working properly.Our requirement is to automatically switch over the traffic to secondary when primary is down.

I am try to access my smart system from internet after allowing port forwarding but still not working

 I need to install a few FortiSwitches (FS) as replacement for very old cisco switches in a quite remote site.I already got the switches here in my office and wanted to prepare them before I go onsite. How should or could I prepare the FortiSwitches here in my lab to reduce onsite time? The FS will be connected via FortiLink (FL)to a local Fortigate 40F with FortiOS 7.0.1440F(FL)---FS124---FS148---FS148                    |                FS148 Uplinks are FO 10GB, no reduncancy, so I need to connect the switches mostlty in serial order. See in the schema above. I should be able to connect the FS with FortiLink in parallel to the Cisco setup.The old Cisco setup is pretty straightforward. Just two VLAN's.   Actual Cisco Switch (CS) setup looks like this here:40F(LAN1)---CS24---CS48---CS48---CS48                   

Hello,I need advice on a problem, or to make sure that this is indeed the case. I have a FG VM in a cluster (FortiOS 7.0.14) and I updated the license from 2CPU to 4CPU but only on the Master (Master 4CPU, Slave 2CPU). HA worked correctly and everything worked but after 24 hours the cluster stopped working and blocked all communication with a message: VM resource exceeds license limit. Master/Slave must have the same license? (number of CPUs) Thx :) 

hi, can someone please advise how to check the fortigate log to confirm the traffics are blocked by the ssl security profile? The policy looks allow. Thanks in advance. 

Hi, How do we block FortiClient via Application Control?I tried to work on this using this KB: Block a specific VPN application by using... - Fortinet CommunityBut I am still seeing traffic from our FortiClient users, but Application is tagged as 'SSL_TLSv1.3'. I hope you can share how to block FortiClient via Application Control effectively, and why is 'SSL_TLSv1.3' reflecting in the logs? Thank you!

Hi, We have upgraded Fortigate to v7.4.4 and Fortiswitch to v7.4.3.Post that Fortiswitches are showing not register.Please guide.. 

Hello,I have installed client version 7.4.0.1636 and I can't connect. It works for my colleagues. Neither the GUI nor the CLI part works for me. Here is the output from the CLI: $ forticlient vpn connect test740 -u XXXXXConnect VPN: test740Password:Status: Connecting...Status: DisconnectedNotification: Config routing table failedDONE.On the log, I can read:20240610 20:25:02.119 TZ=+0200 [sslvpn:DEBG] route:102 route backup START20240610 20:25:02.120 TZ=+0200 [sslvpn:DEBG] route:154 route backup DONE20240610 20:25:02.120 TZ=+0200 [sslvpn:DEBG] route:396 begin route config20240610 20:25:02.120 TZ=+0200 [sslvpn:DEBG] route:397 Remote IP: XXX.XXX.XXX.XXX20240610 20:25:02.120 TZ=+0200 [sslvpn:DEBG] route:398 Local IP: 10.XX.XX.XX20240610 20:25:02.120 TZ=+0200 [sslvpn:DEBG] route:399 Tunnel mode: Full tunnel20240610 20:25:02.120 TZ=+0200 [sslvpn:DEBG] route:400 Exclusive routing: Disabled20240610 20:25:02.120 TZ=+0200 [sslvpn:DEBG] route:453 Can't find dev for IP 10.XX.XX.XX (tun)202406

Hi,Hope can someone assist me.How can I get the FortiAP Bridge mode work with multiple VLAN + Third-party DHCP server?I'm trying to run multiple SSIDs in different VLANs. Here's my setup:1. FortiGate 100F > FortiAP Controller2. Cisco L3 Switch > VLANs and DHCP Server are configured here3. FortiAP > Will hold multiple SSID with different VLANs Cisco L3 Switch>connected to FGT via trunk port FortiGate 100F>All VLAN interfaces are addedFortiAP>Connected to Cisco L3 Switch via port trunks with Native VLAN assigned and all other VLAN set to allow>SSID VLAN settings assigned>Management VLAN set to 0 FortiAP able to connect to FGT100F using Native VLAN IP.SSIDs are broadcasting. However, unable to get IP address from other VLANs configured.

 Recently, FortiClient has been alerting me about the following OpenSSL vulnerabilities:OpenSSL CVE-2024-0727 Denial of Service VulnerabilityOpenSSL CVE-2023-5678 Denial of Service Vulnerability        Despite updating to FortiClient version 7.0.12, these vulnerabilities are still being flagged, and I am concerned about the security implications for our systems. 

Hi everyone,A customer has two FortiGates in Azure, configured in an active-passive HA cluster with internal and external load balancers. As per template, both firewalls have a different IP on the WAN interface, being NATed by the ELB.This HA cluster should be managed by FortiManager, deployed as a VM on premises and behind NAT, so reachable directly by public IP.I configured the central-management settings as on all the other firewalls, but this weird thing happens: only one of the two is able to be correctly managed by FMG (when it becomes active, of course). While the other one is active, if I run a sniffer on FMG I see packets from/to the host, but it seems that the firewall is not able to contact FortiManager. If I run a "execute telnet x.x.x.x 541" I can connect, showing that there is reachability. Also, both firewalls are being NATed by the same public IP.Did anybody have this kind of topology and already had to deal with this problem? Is there any KB I should refer to to troubl

Hello All, After a little help from those much smarter than myself. We are looking at SSL VPN through FortiClient (There are reasons we cannot go to IPSec just yet).We have configured SSL VPN and that works fine in "web mode" can access local lan resources and internet services however when we enable just tunnel mode and use FortiClient we lose access to local lan resources , internet services are fine.The policy rule looks like  - d-fwivfo_a (d-vdom1) # show firewall policy "3"config firewall policyedit 3set name "allow SSL VPN access"set uuid d3819b0c-448c-51ef-8bfc-42a0334bb27bset srcintf "ssl.d-vdom1"set dstintf "dev-trust"set action acceptset srcaddr "SSLVPN_TUNNEL_ADDR1"set dstaddr "production servers"set schedule "always"set policy-expiry enableset policy-expiry-date 2024-08-17 10:35:00set service "ALL"set groups "LU IPSec VPN"nextendSo not completely sure what we are doing wrong ?.We are using 100F's running 7.4.4  Any help appreciated . 

Hello all,  I found TWO VM images available from Fortinet as said Fortigate and FortiFirewall. What is the difference between them?  Thanks 

Dear All,Anyone can tell me what is mean by the command set auto-asic-offload disable. In which situation we can use this command and how it can impact a production environment if we are using this command. Thanks

Hello Team,Is there any Knowledege base to restore a FortiManager VM unit operation, following an RMA replacement Method by doing via HA

Hello everyoneI want to go to FortimanagerCreate a report that outputs the firmware status and system uptime as well as the host name.Unfortunately my attempt below shows nothing. SELECThostname AS "hostname",SUM(sysuptime) AS "Total sysUptime",version AS "Firmware Version"FROM$logWHERE$filterGROUP BYhostname, versionORDER BY"Total sysUptime" DESC

We have LDAP configured and working for VPN authentication, but need to of course have secure auth, so need to change to LDAPS. LDAP is working with a regular bind account. When I change to LDAPS, both the connectivity and the user credentials test pass successfully. However, nobody can log into the VPN; Permission denied. (-455). The documentation is pretty vague. To keep things simple for testing I haven't toggled the 'Certificate' option and assume that is not a requirement. I haven't been able to locate any logging to get more information, either. I'm puzzled as to why the LDAPS tests show success, but logins fail. I appreciate any insight.

Hello, we use internal Freeradius 3.2 server to manage traffic consumption by users. Since version 7.4.4 we found that users ask for new credentials not so often as before. We implemented python3 module to see log of data server receives from FortiGate NAS FG-60F and for case of downloading 100Mb file, we can see that there is 50 times less data sent by NAS than it should be.Our log:Before downloading:2024-07-12 11:57:01,067 - Parsed packet: User: %Username%, Acct-Input-Octets: 1086186, Acct-Output-Octets: 1022799, Current Packet: 2108985 bytesAfter downloading 100Mb:2024-07-12 12:01:01,070 - Parsed packet: User: %Username%, Acct-Input-Octets: 1188278, Acct-Output-Octets: 1101556, Current Packet: 2289834 bytesTreat this message as bug report, because in case of Mikrotik router with same server it calculates correctly on test files 100Mb and 1Gb

I am attempting to open our Fortigate firewall for one specific IP to troubleshoot some issues with an external vendor. How would I go about this? Fortigate 100F v7.2.7 build1577 Any help would be greatly appreciated! 

Hi everyone, I would want any changes in configaration or whitelist to require the user to write in their password before doing making the changes. I would want secure my Fortigate-100F in this way but have not found anything in the manual which suggest this can be implemented. Please would you mind telling me if what I want can be done?

Hi!various "diagnose internet-service" commands show Country, Region and City codes in its printouts.Whilst Country codes can be translated to names using ISO 3166-2, there doesn't seem to be equivalent standard for for Region and City codes. Is there a way to translate ISDB Region and City codes into names, using CLI?R's, Alex

I have 60F V.7.2.8 and I'm configuring automation to receive e-mail when the user connects to the SSL VPN and when they leave, but I'm not receiving the e-mails.