Support Forum

Hi everyone, I have read that in previous FortiOS versions, for fortigate devices without onboard memory, it was possible to store logs to an external memory. Is this now possible, or do you still need a Fortinet-licensed product (e.g. FortiAnalyzer or FortiCloud) to do so?

Hi Team, I am having trouble with FortiGate connection to FortiGuard server with this error reflecting in the GUI:"Unable to connect to FortiGuard servers" Current topology is:FortiGate (with Issue) ---- Router ---- Another FortiGate ---- Internet I can ping below:exec ping service.fortiguard.netexec ping update.fortiguard.netexec ping guard.fortinet.net Diag Debug Rating:2 Servers Listed and has F flags in it Already changed between protocol 8888 and 53 (no 443 available in my FG)Already enabled and disabled the anycastManagement VDOM is 'root' Config:config system fortiguardset fortiguard-anycast disableset protocol udpset port 8888set sdns-server-ip 208.91.112.220    <-end Anything else which I can try to make the server reachable?  Thanks!

Hi,Does anyone tried to pass internet traffic from a remote site that has VIP configured via IPsec =>without<= using NAT in the policy for the inbound traffic for that VIP?Basically what i am trying to do here is to pass the Public IP source info to various servers in following inbound flow: Internet -> VIP -> FTG-site1 ->IPsec->FTG-site2->ServersDue to local restrictions something like VIP -> FTG-site2->Servers won't be possible, so my only option is the one above via FTG-site1.I have no issues revealing Public IPs via VIP inbound that are connected to local LAN on FTG-site1 by having disabled the NAT on the responsible inbound policies, but when comes to IPsec, such approach does not work only with NAT enabled in the policy so now the servers on the remote site FTG-site2 only sees the IPsec interface IP for each session that is not ideal for security logging purposes.

Hi, Can we get the list of url's to connect forticlient to fortisase.

Hi, I saw many posts but no solution that worked for us. Since yesterday, after the update to 7.4.4 we cant connect via SSL VPN with LDAP and FortiToken Users. Local Users are working fine. We tried with different users (NO user can connect and we have like at least 20 per day), different PCs and different Forticlient Versions. We did not change anything from yesterday and on the other office with FG100F and 7.4.3 it still works without any problem with the same LDAP configuration. Is it possible that this is a bug in 7.4.4. Any ideas o suggestions? Thanks!

Hi community, We have configured site-to-site VPN between FTD and FGT, the VPN is up and works but suddenly after few days traffic stops from one side even tho VPN is still up,  as show0n in the screenshotThe only way to fix is to delete all the configuration from FGT and FTD and reconfigure again.I would appreciate any kind of help to fix this.I tried to upgrade FTD and FGT but no the problem  is the same.  

Hi everyone, I'm just want to block appsheet.com website on my site. I have create a security profile with Web Filter to block it and create a policy for it. But User still access. What wrong with my web filter ?. 

I'm starting my studies on the Fortigate Firewall and I'm trying to create two small networks by myself in PNET Lab. The topology consists of a Fortigate and 2 Cisco Switches. The objective is to create the VLANs, a for each port on the Fortigate, deliver IP to two PCs one on each switch and the VLANs must communicate. I've already created the VLANs, the DCHP server on them, trunk mode on the switches, but I can't receive IP via DCHP. I did a test on another port with another PC without the switch and it worked normally, but I need it to work with the switches. I decided to ask for help, as I've been looking for a solution on my own for 2 days and haven't found one

hi all,I happened to find there are compromised host under Security tab of dashboard, why are they here? Are they attacked?And the host are dynamically displayed. 2 days ago, it displays 2 host, now it displays only 1 host. What are the criteria for this?How can I remove them from here (to really solve the problem).Thanks!

We have a specific VLAN setup for some Android Tablets to join, and we built some Android Apps that is hosting in AWS.We would like to limit our Android Tablets to run the Apps that we built, but restricting them to access internet and other stuffs including software updates. Is it possible?Thanks,

I am new to managed fortiswitch configuration.I currently have 60F Fortilinked to manage a 108E with the B port to the switch. Everything seems to be working, however I am worried about bandwidth issues over just the one link. Well, I tried to also connect the A port to the same switch, but the firewall froze up. I assume that having more than on fortilink to the same switch caused some sort of conflict. So, suggestions on how to expand the bandwidth between the firewall and the switch? Is adding an additional fortilink connection correct (and I just screwed it up), or would I be better off adding a connection between the switch-internal vlan and one of the firewall internal interfaces?

Hi Team,We have configured SAML authentication for SSL VPN. Everything works. But Fortigate with os version v7.2.7 works with Forticlient inbuilt Embedded browser but Forti OS v7.4.3 works only when we change the settings to External browser. Please suggest how we can use the Embedded browser itself? We dont use EMS to make changes in XML file :( Regards,Sanjay S

Hi, I just want to know why the FortiClient on Windows display "Not Reachable" status even if it connected to telemetry. It was happen after connecting it to VPN,  Thank you,

Hi everyone, If both web filter and DNS filter are enabled, and someone tries to access a website via a malicious IP (not hostname), which filter would be the first to kick-in? The web filter or the DNS filter? What would happen if the website has not DNS records which filter would be applied here? What if the website does have DNS records, would the reverse DNS process trigger first the DNS filter before the web filter? 

I have two fortigate 60F which connected via ipsec (HQ office and branch office)I need to allow users from branch office to connect to HQ's web server. currently i can ping from HQ to branch office users, but not able from branch to HQ's office.I am new to fortigate configuration, guys can u help me what i need to configure? 

Hello everyone,I am testing FortiClient EMS trial because we want to get EPP/APT for our clients till end of the year. I went for a direct install of version 7.4 because it runs on Linux. In the Remote Access Profile there is no way to create a SSL VPN tunnel in the gui, I can only see IPsec there.Does someone else having this issue? (Couldn't find it in the known issue list and wanted to ask here before asking official support) 

How to register and manage a Fortigate Device behind a dsl router with dynamic ip address? Fortimanager is in LAN private network of a Fortigate behind a dsl router with static public ip. FMG(priv ip)-->FortiGate-->(NAT)-->dsl-router(static ip)-->internet andFGT-->(NAT)-->dsl-router(dynamic ip)-->internet  

When I turn on scanning in FortiSandbox for Jpg and jpeg file types, there is a queue of more than 50 days. with which adjustments I can shorten this time.

From 2024-07-03 19:00 till 2024-07-04 05:00 (CEST) we experienced IPS blockage of nearly all traffic on our 200F with IPS FG-VD-56112.0day. I'm pretty sure it was in issue within the database from Fortinet. Does anybody else experienced this? Since it seems to be totally false positive how can one prevent against this, cause every legimit traffic was also blocked by this.

My Fortigate firewall and Fortiswitches are defined and working synchronously on Fortimanager. I want automatic backups of the firewalls and switches on a regular schedule, for example once a week. How can I do this?

Hi, I just migrated from a cisco router to a Fortigate 40F. And since the migration I have had problems with Cisco ISE and MFA authentication. The FGT40F Branch connects to a FGT1000F in HQ, via 2 site-to-site VPNs over the internet in a sdwan zone. Behind the 1000F is the AD server and Cisco ISE. The authorization and authentication path goes through the 2 FGTs to the AD/DNS and ISE servers located in the HQ.PC --- AP ---- FGT60F ------FGT1000F-----Core----AD/DNS/ISE I have no communication problems with ping, traceroute, DNS. I have checked MTU on both FGTs and they have the same size. I also checked Security Profiles (IPS, DNS filtering, AV, DoS policy) At log level the only thing I can see are several events to DNS, AD, ISE destinations with action: Accept ip-conn. Previously the traffic arrived directly to the CORE located in HQ, so it did not go through the FGTs.Does anyone know what it could be?

Hello team, I am a Network specialist and worked a lot with FortiGate firewalls, For the first time I wanted to try this FortiGate VM image "FGT-VMv7.4.1.F" on Vmware workstation pro to do a basic LAB, I have configured everything correctly but for some reason the traffic can never go through the FortiGate, it seems that the firewall policy to allow traffic from one port to another doesn't do anything, I am 100 % sure that my config is correct (NAT, allow incoming traffic from Port1 to Port2 as an example, Service "ALL"...etc"The weird thing is that everything works with it (Interfaces are fine and do respond to Ping, IPSEC "SDWAN" Tunnel are Up and responding) except the firewall policy doesn't do anything. Is there a specific license for the FGT VM to make the firewall policy work properly ? Thank you, 

Hello community,A few weeks ago we migrated the AWS vpn from static to BGP, and since then we have noticed that there are several Hold Timer Expired messages received “IP AWS”. I have checked physical cables, and connectivity and there are no problems. The problem is also not due to saturation because it occurs at night when there is no staff working.What else could it be, or if anyone else has had this happen. 

I have 50+ remote branch offices that use Fortigates with a single WAN connection, which uses one IPsec tunnel back into our Primary HQ. However, we would like to add a second IPsec tunnel as a backup path at another location at Secondary HQ FG. Is there more than one way to set this up? If so, what are those setups, and which is more feasible to do? My end goal is when the IPsec tunnel goes down because Primary HQ route is not active, it should route to the Secondary HQ automatically. Also, FG is running firmware 7.2. I heard others recommend using two IPsec tunnels and also creating a BGP neighbor as an option. I wasn't sure if there were any other ideas.

What is the difference?  Any pro's con's to one or the other? Why would you need DNS filtering if you're already doing web filtering? If you do not use the FortiGate as a DNS server does DNS filter do anything?