Support Forum

hello team i am getting probe failed when i adding fortiAnalyzer to FortiManger, i have configured the FortiAnalyzer interface to be managed with fortimanager

We currently have ZTNA deployed. Is there a way to use Thales MFA when authenticating ZTNA connections.Does fortinet EMS supports SAML with 3rd party IAM ?

HI support, I hope all's well on your side of the world. So here’s a bit of background;In order for our users to connect to the company vpn:1) They need to be added to a vpn member on Active Directory ( Synced changes thereafter)2) Have SSL-VPN configured with the remote gateway and custom port 10447a. VPN Version 7.4.0.1658 for all at the moment3) Authentication: Prompt on login4) Client certificate: prompt on connect5) Nothing furtherFor some strange reason, on one laptop, my creds work just fine, but on another laptop, it does prompt to accept the certificate BUT it fails with an error message: Permission Denied -455. Any advice on what I can check would be appreciated Thank you. Kind Regards.

Hello team We have configured the SD-WAN network, now the FGT 70 is at brach and FGT 200F at HQ, now all Underlay Network is reached through ISP means 70F at branch can ping 200F at HQ ,but LAN network is not reached trough Overlay what is the issue?

Hello everyone!I am Sattarov Jasur representing the Unicom company. I am from Uzbekistan, Central Asia. In our country, prices for Fortinet products and firewalls are greatly inflated, I have proof that prices for similar products are 6-7 times higher than in other countries. This terribly spoils the reputation of Fortinet in our country, I called the head office in America many times but never got through. Contact me urgently +998994354858 WhatsApp available

 Hi Team,The customer is experiencing communication issues between the BAN LAN and CHE LAN. After reviewing the policy and routing for both firewalls, it appears that the BAN FW is not forwarding traffic to the Chennai FW.Issue Summary:Source: port 10Destination: port 7Source IP: 10.80.151.185Destination IP: 10.44.6.31Findings:Debug Logs:Traffic is incoming on port 10 (LAN).No outgoing traffic on port 7 (MPLS).Sniffer Logs:Requests are captured on port 10.No output seen on port 7.Session Traffic:No traffic is seen in the session.Attached are the debug logs, sniffer logs, session information, routing information, kernel logs, and configuration files for your reference. Team Kindly share any idea about this issue. @nithish.k@snsin.com FortiGate 

Hello friends, I would like to know if there is a way to set up 2FA for logging into Fortigate. I understand that it can be done for VPN-SSL and I have done it, but is it possible to set it up for Fortigate administration via email or any other method? Thanks in advance.

I would like to increase the default ARP timeout on my Fortigates.  The docs say that for version 7.2.7  The command is: config system global  set arp-timeout [value-seconds] However on my Fortigate there is no "set arp-timeout [value]" command on the CLI.  Why not?  Where is this command? Please, no one from Fortigate post with ANY questions about what I'm running, where I'm looking, how I'm connected.  If your docs say I can connect to the CLI and just run this command then I should just be able to connect to the CLI and run this command.  If there is more required to be ABLE to run this command THEN PUT THAT IN YOUR DOCUMENTATION!!!! If anyone knows a way ACTUALLY change the ARP timeout on a Fortigate, please help me out.  This should not be this hard or frustrating. 

Good night all, I tell you that I applied the firmware to the FortiAP FAPU231F and FAPU431F version PU231 and PU431F-v7.0.4-built0132 from the Fabric Management of the FW 600E but now the FortiAP of both models is disconnected to the clients every n seconds and cuts off their videoconferences Among other queries to the Internet and the local wired network, the Fortigate technical staff tells me that I have to downgrade to the previous version so that the Wi-Fi clients are established again and thus avoid disconnections, the issue is that I do not have with the previous firmware. Is there a configuration that helps me correct this error.If this situation happens to anyone, I would appreciate your comments. Greetings

Hi all,,, I have analyzer and can anyone help me to create a daily configuration change report for managed fortigates???? thanks  

HelloOur pair auf 100E is up for support renewal. Keep or replace?Dealer suggests 100F, its not that much of price difference if looking at price per year.What to look for when replacing the devices? just switch the cables plus the config-backup and -import?Dealer has a bit of personnel problem, knowlegeable person has fully booked calendar, other person can only talk the talk, but lacks the walk capabilities https://tutuapp.uno/ .How to prove that the 100E is a bottleneck? Is there a ready tool for hat?the 100E is used for lan-segmentation (company is on health-sector) and as vpn-gateway for about 50 users (RDP).I'm a database guy, other guys in my company are java-guys so not much knowledge here.Thanks & bye.

Hey! Can you help me to generate a report from this widget? Its the interface bandwidth from Fortigate and its for my ISP usage. We have FortiAnalyzer and couldn't find any chart for this. So we need this in FortiAnalyzer because to see when the port has reached saturation (peak) in the weekly reports we generate. 

Based on the following network structure below, I am unable to ping from the router to the VPC and vice versa.Fortinet firewall does not reply to the ARP request when I run the "diagnose sniffer packet" command. ARP table contains information of the router and the Virtual PC. FortiGate-2 # get system arp Address Age(min) Hardware Addr Interface 172.16.101.3 0 50:00:00:09:00:00 port2 11.1.1.2 0 00:50:79:66:68:08 port3 Sniffer output when I ping from Router to VPC: 2.4294596056 port2 out arp who-has 172.16.101.3 tell 172.16.101.1 2.4294597165 port2 in arp reply 172.16.101.3 is-at 50:00:00:09:00:00 10.4294304486 port2 in arp who-has 11.1.1.2 tell 172.16.101.3 12.4294304079 port2 in 172.16.101.3 -> 11.1.1.2: icmp: echo request 14.4294304828 port2 in arp who-has 11.1.1.2 tell 172.16.101.3 16.4294305817 port2 in 172.16.101.3 -> 11.1.1.2: icmp: echo request 18.4294305479 port2 in arp who-has 11.1.1.2 tell 172.16.101.3 36.4294756214 port2 out arp who-has 172.16.101.3

I am currently exploring the differences between IPS and APP, specifically in the context of securing HTTPS servers. Here is my rule for testing:   #For APP, working good at http, a lot of ip not blocking in https. F-SBID(--name "Http 403"; --pattern "403 forbidden"; --protocol tcp; --no_case; --flow from_server;) #For IPS, both http & https are working good. F-SBID(--name "Http 403"; --pattern "403 forbidden"; --protocol tcp; --no_case; --flow from_server,reversed;)    1. IPS and APP can use the same syntax. If I want to protect an HTTPS server, should I use IPS or APP?2. Have any more details about IPS and APP?3. Looks like App have issue for https traffic, maybe is bug?

HowdyI'm asking for your help with a problem with the infrastructure I'm implementing. I have a FortiGate with a fortilink interface configured.The infrastructure requires one, or more, not fortinet switches between FortiGate and FortiSwitch. For example:The third-party switch is configured as follows:int 1 (connected to the FortiGate fortilink)Native VLAN 1allowed VLAN 400,401...int 2 and int 3 (both connected to interfaces 24 of the two Fortiswitches)Native VLAN 1allowed vlan 400,401....Fortiswitches take IP directly from the fortilink physical interface. The problem I'm having is that every once in a while fortiswitches go offline.If I go to enable the Fortilink Split interface and turn it off again, the fortiswitches come back up.Do you know how I can fix it?  

Friends a question:I have a Fortimail device, according to the logs it appears that the Fortimail let a SPAM email through.Reviewing the AntiSpam Profile, it appears that the action selected is "Dafault", my question is what action does the "default" take?What configurations do you recommend to prevent Fortimail from letting spam emails through?   

Hello Group, I am having trouble with my FortiClient software. As soon as I connect to our VPN, the software says connected and then immediately says disconnected. My credentials are correct and others are able to access from other laptops without issues. My Environment Info: Client PC OS: Windows 8 FortiClient Version: 4.3.5.472 FortiNet Hardware: 200B Firmware Version: 5.0 SP3 I have tried to uninstall FortiClient and re-install with a system reboot in between without any luck. Has anyone seen this behavior before? Thank you very much,

Does anyone have experience configuring 2 FortiADC Virtual Devices in Active-Passive HA mode within a VMware environment? We are having a problem when the 2 VM's are on different hosts.

Hi all, I would like to clean up Custom Categories created in Rating Overrides Section. In CLI I enter ' config webfilter ftgd-local-cat' and then ' purge' command, but every time I get error: Local Category ID is used by protection profile WEB_FILTER_NAME. I checked WEB_FILTER_NAME and try all options (Allow, Block, Disable...) to this Category, but always errors appears, when I try to remove this Category. Thanks for help. Best regards, Michał S.

Hi Team,I went through the below linkhttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Access-to-Specific-FQDN-using-Split-Tunnel-SSL-VPN/ta-p/190062 As per the link we dont need to call the FQDN object in the split tunnel config but just creating the ACL with FQDN will create a route in the routing table? Is my understanding right? Regards,Sanjay S

Hi, FG-60F instead inter-vlan routing sends packet to wantraceroute 10.102.9.3traceroute to 10.102.9.3 (10.102.9.3), 30 hops max, 60 byte packets1 _gateway (192.168.1.99) 0.404 ms 0.382 ms 0.373 ms2 customer.abc.net (X.X.0.0) 83.877 ms 73.327 ms 83.850 ms...Routing table looks well:get router info routing-table allCodes: K - kernel, C - connected, S - static, R - RIP, B - BGPO - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter areaV - BGP VPNv4* - candidate defaultRouting table for VRF=0S* 0.0.0.0/0 [10/0] via X.X.0.1, wan2, [10/0][10/0] via X.X.0.1, wan1, [15/0]C 10.0.2.0/30 is directly connected, Wireless-BC 10.0.3.0/30 is directly connected, Wireless-CC 10.102.1.0/24 is directly connected, vlan-10C 10.102.2.0/24 is directly connected, vlan-20C 10.102.3.0/24 is directly connected, vlan-30C 10.102.6.0/24 is directly connected, v

Is it possible to disable the web portal login for SSLVPN if SSLVPN is configured on a Fortigate firewall, as I manage some devices for which this would be desirable.  For various reasons, for the Fortigates in question, it is not practical to limit the hosts that are allowed to connect to SSLVPN to specific addresses / subnets.  I have deleted content on the login pages through  System -> Replacement Messages to lockdown these devices somewhat.  Was just wondering if there is any way to overall disable this page from appearing on the firewall when accessing through web browser using https://<ip address of fortigate>:<port of SSLVPN> .  It is my understanding that Forticlient access to this configured port, as well as web portal access, both are enabled together, and one cannot be disabled without disabling the other.  Is that correct? Also, if I needed to whitelist a specific subnet for inbound traffic for port 541 for Fortiguard,

HelloWhile installing FortiClient EMS 7.0.13 on Windows Server 2019 I got this error. However when I clicked OK the installation seemed to have finished successfully and EMS GUI started.I did the same before on Windows Server 2016 and there were no such error. Can the error be safely ignored? Do I have to do something and redo the installation?

Dear All, I need to allow only below Websites and Mobile applications, Also need to block everything else on Fortigate 60F Gmail, yahoo and outlook emails websites and company websiteGmail, outlook, Appstore and Playstore mobile Applications. Block other sites and applications kindly support to implement these rules.@fortigate @Fort @FortiD FortiGate 

I have a Fortigate 501e (FotiOS v7.2.7) with SSL-VPN where local users authenticate via LDAP. This LDAP has a password policy and it is configured in SSL-VPN that users change their password on the first login.The password change occurs correctly and is reflected in LDAP, but we have noticed that when making this password change, in LDAP it is saved as plain text instead of SSHA as it was originally. The procedure is as follows: - We create the user in LDAP and assign it a temporary SSHA password.- We create the SSL-VPN user (LDAP type) in Fortinet.- On the first login, FortiClient (or Web Portal) asks the user to change the password. At this time, the password is updated in LDAP, but in plain text instead of SSHA, with the security problem that this entails. In Fortinet, the LDAP connection has this related setting:set secure ldapsset ca-cert "USERTrust_RSA_Certification_Authority" set port 636 set password-expiry-warning enable set password-renewal enable  We have