Support Forum

I have 60F V.7.2.8 and I'm configuring automation to receive e-mail when the user connects to the SSL VPN and when they leave, but I'm not receiving the e-mails.

Hi, I have a script to block IP's for a given reason for Fortigate 400f, I am able to create addresses and apply to address group. However, I want to apply a form or rotation to avoid large address group. I am able to clear up the members in the address group, however, I also want to remove the addresses. I know this can be done individually as an API call. But is there a way to bulk remove? I would likely be looking to remove 500 addresses as part of the rotation and I would not want to go down the route by removing one per API call

We geo block all inbound connections to our web servers that aren't from the United States. Our Let's Encrypt http certificate renewals are failing due to this geo block policy, as the inbound http requests from Let's Encrypt come from other counties like Sweden and the Netherlands. Unfortunately Let's Encrypt does not publish their IP ranges or FQDNs to create a geo block exception, and DNS challenges are not an option for our environment at this time. Is there a way to geo block all inbound connections EXCEPT for inbound http requests to this directory: /.well-known/acme-challenge This was listed as a potential solution in this support article, but I'm not sure how this would be accomplished on a FortiGate firewall:Whitelist LetsEncrypt Server IPs - Help - Let's Encrypt Community Support I thought it might be possible using a web filter profile, but I haven't found any FortiGate specific articles about this so I wanted to raise the question to the commun

HelloI have FortiGate 40F ,it's working fine but I have NVR Hikvision (IP : 192.168.70.5/24) I Need to login NVR From Anywhere I have Public Domain But i need Exactly when i put this URL in browser immediately open NVR in Browser best regards,

Hi everyone,  Is it possible to implement to limit resources to 50% in a Fortigate-100F? 

Hello, We are using FortiMail and we want to forward a copy of every incoming email to another server. Is this possible and how can we do it? I have made a diagram to explain it, can you help?

 how I get WAF logs

How many sections does a vdom support?

i have the following setupSite A -> Has static public ipSite B -> Has no public ip The two sites are connected via Ipsec. I am trying to do a port forwarding over public IP while the VM itself is located in Site B.  I can't see to get it to work. Moreover, when doing a ping I can ping it and telenet from any machine located within Site A. But can't do it from the fortigate console itself.  Any advise plz?

Hi,I was wondering if FortiToken Mobile APP had a roadmap to support the HarmonyNext OS.My understanding is that the existing mobile app support HarmonyOS or Andriod 12 below by IKEv1.Anyone knows about it?     

WAN1 - Spectrum COAX internetWAN2 - Spectrum eLAN to HQ. We have a problem with this location where the internet goes down more than it should. When it goes down, we're able to route internet traffic over WAN2 which is usually just for internal traffic. I'd like for this to happen automatically. I set the administrative costs on the static route to 0.0.0.0/0: 10 for WAN1 and 110 for WAN2. This works just fine if I manually disable WAN1 for testing. I think the problems lies with the Spectrum router we're forced to use in order to have a static IP address. WAN1 is connected to the Spectrum router and gets an IP address from DHCP. 192.168.0.2 or whatever. If the internet goes down, the link for WAN1 stays up, so the Fortigate doesn't realize there is a problem. Any ideas?

Hi, Our users work via Remotedesktop on Windows Server 2016 (VM-Ware ESXi VM-Version 19) with FortiClient VPN 7.2.4 (free).Their SSL-VPN with one predefined Gateway to an external Partner works fine. Some of the users now have to connect at the same time to another SSL-VPN. Can I realize this kind of "multiuserconfiguration" on this single Windows Server ?What would be the recommended Best Practice ? Thanks, Roland

I haveA 200 E Firewall. It is configured with two WAN members in SDWAN Zone 1 for all devices in my network. Is it possible to add 3rd wan to another SDWAN ZONE and make it accessible to only one particular device. I tried to create two sdwan zones. Some of the lan devices are connecting to wan3 eventhough no policy created for zone 2. My aim is that to only my video conferencing system can use wan 3(zone 2) and rest of the lan device can use wan 1& 2. (Zone1)

Hi, I am hoping someone can help me out in setting up a custom report. I want to get a report via FortiAnalyzer that includes source user source interface or vlan and destination user destination interface or vlan bandwidth information. How can I do this? Thanks in advance,

Hello, I need a version of forticlient for 32 bit, debian, I've been searching but can't find any.Where can I download this.Best regards 

I am trying to learn how to setup a webportal so that users can connect via the web to our Fortigate and get proxied over to a specific internal website.   What documentation should I be looking at to learn how to make this happen?  I am running Fortigate VM in AWS version 7.4.4

FortiClient is not connecting to Windows 11 Pro.  I already updated the network card driver and nothing, I already disabled IPV6 and nothing connects.  

I am having a problem with a virtualized firewall in EVE-NG. One box does not bring up the static route 0.0.0.0/0 to the internet.Below is an example of a box with an error. When it is in this state, I cannot communicate with the external IPs I have in the lab.  Here is an example of a box that has the 0.0.0.0/0 route to the internet and is functioning properly. how is possible enable this option ?    

Has anyone looked at possibly adding memory to the 60F that seems to be experiencing all of the conserve mode issues? We have quite a few recently purchased and I'm regretting the 60-month contract. However, I'd gladly swap a chipset, even if I lose some warranty protection.

I have a similar problem. I cannot ping from the router. I want to ping from OPPA to MTAVARI_FILIALI at 192.168.0.136, but I cannot. OPPA can see the route. this is photos this is OPPA router routes this is MTAVARI router routesHow can I connect from the OPPA router to the host at 192.168.0.136? In the FortiGate interfaces, I have allowed ICMP (PING), and OSPF is configured to redistribute static routes. The connection between OPPA and FortiGate uses OSPF, while the connection between FortiGate and the MTAVARI router uses static routing. Please let me know if you identify any issues.FortiGate 

Forticlient VPN 7.2.3 works just fine, but 7.4 just gets stuck on 'connecting' no matter what I change in the settings.  Is there a fix for this beyond just going with an older version? It doesn't seem to matter whether I upgrade an existing 7.2.3 install or if I install fresh. Update with Fix: Per this post Fix for FortiClient VPN app being stuck at "Connec... - Fortinet Community the fix is to install the Visual Studio Redistributables from this link https://answers.microsoft.com/en-us/windows/forum/all/dll-files-missing-after-windows-11-update/d9b03703-4c1b-48b1-9707-22eddfc2c637 After installing this the issue is resolved.

Hi Team, We are currently using FortiOS version 7.2.8 for our network security needs. Recently, we have encountered an issue with our SSL VPN users. Despite specifying particular policies for these users, they are able to access other policies as well, which is not the intended behavior.Our SSL VPN users authenticate through FortiAuthenticator for Multi-Factor Authentication (MFA). The expected outcome is that they should only have access to the resources defined in their specific policies.  If you have any idea about this case please share it.I need help on this @nithish.k@snsin.com #fortigate#fortiauthenticator 

Hello,I'm configuring FSSO for SSL VPN via syslog. I configured the environment and I can see the logged user on the Fortigate. I have a strange behavior with the IP address showed by the firewall under User and Devices. It is the IP of the domain controller instead of the ip address of the VPN client. I'm on 7.2.8 version.The collector is installed on one of my domain controller and it is configure in DC agent mode.The agent is installed in all domain controllers. How I can investigate about this problem? I think there is a misconfiguration. Thank you.

Hi,I am facing a strange issue regarding Tacacs setup:it works well without any problem with a specific server (which is a Cisco ISE PSN), and my login attemps seen in Cisco ISE Live logs.but when I configure another PSN , I can login to the device, but my attempts is not seen in Cisco ISE Live logs. It's also strange, when I test it by 'diagnose test authserver tacacs+...' then my login test/attempt is seen in ISE Live logs.I have captured traffic on this firewall to see what happens on packet level and found that when login attempt is not seen in Cisco ISE Live logs then firewall simply resets connection during TCP handshake right after syn+ack packet coming from PSN. So connection is not established at all.Thanks,

Hi, Here are using two FSW 1024E , now It is working in active-passive setup with MCLAG and VVRP config.now we need it as active-active setup can anyone send the doc to do with A-A setup configuration. Regards,Prakash.k