The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Recently active
I can never delete Security Fabric > External Connectors > Malware Hash - Threat Feed that I created on root user on fortigate 600E device with FortiOS v7.2.3FortiGate
I am in the process of rebuilding my network, I currently use cisco 9300's to carry traffic to each site via metro-e. The cisco's currenlty have Vlans and DHCP configured. I would like to implement at each site a fortigate 200f and 2 cisco 9200's to physically seperate vlans. I still for the meantime want the vlans and dhcp to be distributed by the cisco switches, we have different vlans one has internet, the other doesn't by design. I want a port from the fortigate to have the vlan from the internet to the cisco that will have internet acccess, and i want another port on the fortigate to carry the network to the other switch, again while the cisco's still assign Vlans and Dhcp. How would I go about doing this? I will eventually move all to the fortigate but we have to prove that it works for what we need. And i would need the cisco's to still pass traffic to the other cisco sites that will not have a fortigate (we will move to foritgate at each site if we can get this working).
Every now and then some users will not receive the correct dhcp address when connecting to a wpa2 enterprise ssid. This ssid is bridged with another vlan for physical ports under end users desks. DHCP is handed out by the fortigate, so no relay server. Users will have a dhcp lease assigned in the fortigate but when checking WiFi clients it shows them with a 169.254 ip address and doesn’t allow them to connect via WiFi. Logs show discover and offer but no ack. The next day these users will be able to connect just fine but then this problem randomly happens again. Not sure what would be causing this issue. Any suggestions would be greatly appreciated. Thank you!
Hi,I would like to ask, which protocol ALGs does Fortigate support? From the admin manual, it looks like only SIP and RTSP are supported. Thanks very much.
I'm facing issues while trying to set up FortiClient VPN on KUbuntu 22.04. The installation goes smoothly after manually adding a dependency package. However, when I attempt to connect using Single Sign On (SSO), the authentication window briefly opens and closes, leaving me stuck on the "Connecting..." stage. This is the window where I should enter my username and password and then use a 2FA app for verification.Even after enabling "Use external browser as user-agent for saml user authentication," the problem persists. The same behavior occurs, and an external browser doesn't open as expected.I had no trouble with this kind of connection on Kubuntu 20.04. Has anyone managed to successfully establish this type of connection on (K)Ubuntu 22.04?
Hey all - running into an issue deleting an address object that was used in an IPSEC configuration. I was able to delete the tunnel completely successfully, but as last part of clean up was to remove the address object I created to reference in the tunnel configuration. When I go to delete the address object, I get an error stating "Failed to delete object due to the following reason: used - object is copied to VDOM xxxxxx-efw.root." Any idea how and where to remove the reference from the root VDOM? I do not have any per device mappings for this object so not sure where the reference is coming from. Any help is appreciated.
Is it possible to change the title shows on the login page? With a VM deployment, it says "FortiManager-VM64" and at minimum we would love to remove the -VM64" suffix.
Hello, We use a Fortigate FG100 (7.2.8) and create a GRE tunnel to our Netskope tenant. The tunnel shows as up on the tenant and shows up as a static route when I run "get router info routing-table all" We have a test VLAN set up to test connectivity. We have setup a firewall rule with the VLAN as the source and the GRE tunnel as the destination, allowing HTTPS traffic along with setting up a PBR for HTTPS Am I missing something? DNS and https isn't working. I can't go to websites and can't ping any names or IP addresses.
Just want to make sure, that Fortinet is aware of:https://devblogs.microsoft.com/microsoft365dev/retirement-of-office-365-connectors-within-microsoft-teams/
Hi, When I tried to connect Fortinet VPN, it will be stuck at status: Connecting 0% with no error message after that. May I check if anyone know how to deal with this issue? the connection can be tracerouted.
The client has a Sophos Red Router which will be sitting behind my firewal and will just be using out our WAN for internet connection so there is no need to setup from my end regarding their VPN tunnel. There is no tunnel to be created from my side. What we need to make sure is that all traffic from this device, and all other devices behind it, passes through my fortigate firewall without any issues. FOS 7.2.14FG200F Does my current Any Any rule allow all their traffic in and out? Any suggestions or comments is highly appreciated. TIA :)
Dear Concern,I was saw that someone can try nmap port scanning to findout the open ports or services via WAN side or LAN side and then he attempt the attacks like brute force etc. Can you help me that how can I find the source IP of attacker and how can i configure to block this IP for 10 minutes while he can try port scan automatically. Thanks and waiting for your helpful appreciable response.
Good morning, I use the Fortinet 60f and I would like to know if it was possible to deactivate the DHCP server at the LAN interface to give priority to identification via the Mac address (IP address assignment via the Mac address ) ?
Hello, I have a Fortigate with several VDOMs (root, VDOM1, VDOM2), all managed with Fortimanager. For debugging purposes, I need to give the administrator of VDOM2 access to the CLI of VDOM2. How can I do this? From Fortimanager? From Fortigate? Thank you for your assistance.
IPsec VPN DatasheetThe VPN Datasheet below can be exchange with your VPN partner in order to work on the same information basis. VPN Site 1VPN Site 2Company ACompany BRequested by:Requested by:Planning contact:Planning contact:Responsible for installation:Responsible for installation: VPN GatewayHardware Vendor & Version: FortiGate V _._._Hardware Vendor & Version:External IP address:External IP address:Encryption Domain / Crypto Map:Encryption Domain / Crypto Map: VPN Phase 1 (IKE)Key Management:• IKEv1 (Aggressive)• IKEv1 (Main ID protection)• IKEv2 Key Management:DH-Group (Diffie-Hellman):• Group 1 (768 bit MODP)• Group 2 (1024 bit MODP)• Group 5 (1536 bit MODP)• Group 14 (2048 bit MODP)• Group 15 (3072-bit MODP)• Group 16 (4096-bit MODP)• Group 17 (6144-bit MODP)•&n
Hi, I would want to ask a question on the issue that was raised earlier.I have two wan lines, I have set up both tunnels on WAN1 I'm not sure if his setup is accurate. Should one tunnel be installed in Wan 1 and the other tunnel in Wan 2? Still, I have one of them tunnelled in shut down. The problem is that the client from the SAP server does not reach an AWS server, but the person from the AWS server reaches the SAP server for my client. Any thoughts?show system interface "TO AWS 2"config system interfaceedit "TO AWS 2"set vdom "root"set ip 169.254.85.6 255.255.255.255set allowaccess pingset type tunnelset tcp-mss 1379set remote-ip 169.254.85.5 255.255.255.252set snmp-index 69set interface "wan1"set mtu-override enableset mtu 1427diagnose debug enableFortiGate1 # diagnose debug flow filter daddr 169.254.85.5FortiGate1 # diagnose debug flow trace start 1FortiGate1 # id=65308 trace_id=1 func=print_pkt_detail line=5795 msg="vd-root:0 received a packet(proto=1, 169.254.85.6:83->16
Hello, I have a problem with traffic shaping. I have a simple traffic shaping policy to limit the bandwidth when browsing some streaming websites and it's been working perfectly for a while. However, all those websites can't be accessed anymore, no changes were made in the policy. When I check the logs, it shows that those requests are UTM Allowed but the most of the times the received data is 0 kb and a "TCP reset from client" message. When I disable the traffic shaping policy everything goes back to normal. I'm not sure if I'm missing something or there's a flaw within my firewall (FortiGate 400F, V7.0.12).Any ideas or hints ? Thank you in advance.
Hello Dears I asking about if the user can change the password of SSLVPN account without need for admin interaction from forticlient portal take in mind the forticlient is free one without using any external system Bests
Having an issue where SSL-VPN traffic is limited to about 20Mbps. After multiple rounds with TAC they don't call it an issue, but more of a limitation. The issue seems relegated to any platform with the NP6 and is not limited to any version of code. Is anyone else seeing a similar issue? TAC seems to want to say that it is only for 10G to 1G interface bound traffic, but it is also visible on 1G to 1G interfaces. Highlights: Regarding your first question, when traffic goes from 10 Gig interface to 1 Gig interface, it causes the congestion at the egress on the QSGMII interface of the NP (which means the 1G interfaces on this platform) and this is represented by TX_XPX_QFULL counter increase. This also impact traffic from other interfaces that is egressing through port1. Therefore, even though SSLVPN terminated on Internet VDOM, it still would be impacted. After testing this in lab and discussing with QA engineer, to stop the NP6 drops, there are thr
Hi Team, I am currently working on this KB:FSSO breaks after installing Microsoft KB... - Fortinet Community Do I need to reboot the server or will the permanent solution work without a reboot? I just need to double check on this one. Permanent Solution:Create a new 'string value' registry entry under the following path. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Entry name: Auth4Entry type: REG_SZEntry value: dcagent This key must be added to the target server under Show Monitored DCs -> Select DC to monitor -> Select Domain Controllers for Monitoring User Logon Event -> DC Agent or Pooling mode. Thank you!
We would like to create a policy route to allow all users connected to an AP to route their internet traffic over a specific WAN port. The AP is an aruba instant on connected to the same interal port as all clients, DHCP will be handled by the fortigate How would we configure this? any help would be appreciated.
Looking on the licencing portal, I have registered one of these before. this has been long since deleted.The serial number has been moved to "Decommissioned Units" on the licencing portal FortiFirewall-VM64-KVM # execute vm-license-options account-id xxxxxxxxxxxxxxxxxxxxFortiFirewall-VM64-KVM # execute vm-license-options account-password xxxxxxxxxxxxxxxxFortiFirewall-VM64-KVM # execute vm-licenseThis VM is using the evaluation license. This license does not expire.Limitations of the Evaluation VM license include:1.Support for low encryption operation only2.Maximum of 1 CPU and 2GiB of memory3.Maximum of three interfaces, firewall policies, and routes each4.No FortiCare SupportThis operation will reboot the system !Do you want to continue? (y/n)yRequesting FortiCare Trial license, proxy:(null)Failed to download VM license.FortiFirewall-VM64-KVM # get syste, stcommand parse error before 'syste,'FortiFirewall-VM64-KVM # get system statVersion: FortiFirewall-VM64-KVM v7.4.4,build2662,
After firmware update 221E bricked. Trying to connect thru console pin (j44) inside AP. Maybe some information how to repair this ap. from console i can see only:â–’â–’â–’fâ–’â–’fâ–’`~`â–’â–’â–’â–’â–’â–’fâ–’â–’â–’â–’â–’â–’â–’â–’â–’â–’fâ–’â–’fâ–’`~`â–’â–’â–’â–’â–’â–’fâ–’â–’â–’â–’â–’â–’â–’â–’â–’â–’fâ–’â–’fâ–’`~`â–’â–’â–’â–’â–’â–’fâ–’â–’â–’â–’â–’â–’â–’â–’â–’â–’fâ–’â–’fâ–’`~`â–’â–’â–’â–’â–’â–’fâ–’â–’â–’â–’â–’â–’â–’â–’â–’â–’fâ–’â–’fâ–’`~`â–’â–’â–’â–’â–’â–’fâ–’â–’â–’â–’â–’â–’â–’â–’â–’â–’fâ–’â–’fâ–’`~`â–’â–’â–’â–’â–’â–’fâ–’â–’â–’â–’â–’â–’â–’
Hi Team, I installed and configured Forti-Manager on agent box and actions were also working fine. Suddenly now I am seeing that connector is stuck with message "awaiting response from agent" Agent Box is up and running, Connector is also green, Agent in UI is also green and i even ran the command "
I'm trying to add Fortigate to FMG have tried version 7.0.15, 7.2.0, 6.4.10 and always get probe failed, even after emabling low encryption: config system globalset adom-status enableset enc-algorithm lowset fgfm-ssl-protocol tlsv1.0set usg enableend Anyone have any idea if any other config needs chaing? I also tried FMG 7.0.12 and got probe failure as well.port1 on the foritgate VM is enabled for FMG-Access I installed FMG on eve-ng and ESXi, every time I get probe failed. This is the debug from the fortigate, it shows connectivity is fine? FGVMEVWXJNWHYO97 # diagnose debug enableFGVMEVWXJNWHYO97 #FGVMEVWXJNWHYO97 # diagnose debug application fgfmd -1Debug messages will be on for 30 minutes.FGVMEVWXJNWHYO97 # FGFMs: Create session 0xfb19c50.FGFMs: setting session 0xfb19c50 exclusive=0FGFMs: Connect to 172.16.10.100:541, local 172.16.10.110:4840.FGFMs: set_fgfm_sni SNI<support.fortinet-ca2.fortinet.com>FGFMs: Load Cipher [ALL:!RC4:!EXPORT:@STRENGTH]FGFMs:
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
