Support Forum

Having a buggy client install that wont connect to EMS and wont disconnect from EMS either with the proper password.  Cant shut it down so we can't uninstall it. All documentation points to FCRemove thats supposed to be included in the FortiClientTools download for each version but can't seem to find it in the downloads for Mac Forticlient v6.4.9, v6.4.8, and still searching...

Hello. I read the article FG-IR-23-460 that was released last month.https://www.fortiguard.com/psirt/FG-IR-23-460 The document contained the phrase 'allow an authorized attacker'. While this doesn't change the fact that I need to apply the security patch, I can't imagine what kind of attacker this is or how easy it would be to launch an attack, so if anyone knows, please let me know. 1. Is "allow an authorized attacker" correct as an attacker who has been authenticated by FortiOS (i.e. an actor who has gained unauthorized access)?2. Is my understanding that in order to exploit this vulnerability, the attacker must be able to reach the FortiOS command line interpreter correct? Best Regards,

If I want to create a policy where an AD user, for example USER1, cannot access a specific website like Facebook. Is there a guide on how to create a firewall policy like this: Source: USER1 Dest All Web Filtering: Block_Facebook? I really need specific instructions on this. I am using FSSO in Fortigate. This user is From AD DOMAIN CONTROLLER #FortiGate 

Hi,I am trying to send syslog from a Fortigate40F to a syslog server encrypted. On my collector server i have generated the certificates below (just for this posts purpose, these now wiped and ip is changed). Which of these should be uploaded to the firewall and what method under certificates > create/import. Also which should be specified in the syslogd config stanza?Current syslogd settings:config log syslogd setting    set status enable    set server "<ip to the syslog server>"    set mode reliable    set port 6514    set facility syslog    set enc-algorithm high    set ssl-min-proto-version TLSv1-2    set interface-select-method specify    set interface "wan"end These are the files, contents below:Files rootCA_34.88.136.235.pem-----BEGIN CERTIFICATE-----MIIDhTCCAm2gAwIBAgIUEh/nFq08nWxeRR8JSI8sK7rKgN8wDQYJKoZIhvcNAQENBQAwXDELMAkGA1UEBhMCTk8xDTALBgNVBAgMBE9zbG8xEzARBgNVBAoMCkN

Hello, I'm trying to setup agentless fsso polling mode. I want to know, what permissions is required for user which is connecting to active directory? and also want to know, if this method is good to setup firewall policies per AD user/groups.  

Firewall: FortiGate 101FApplication: FortiClient 6.0Token: FortiToken220VPN method: SSL-VPN ***************************************[Updated] My username and password must meet the following requirements:- At least 8 characters- At least one uppercase and one lowercase letter- At least one number- At least one special character (*)=> After removing the special character in the username, I can VPN. That so stupid bug!(Example: Account test/123456 can VPN normal, but test&/123456 can't VPN because it stuck in Enter Token code) ************************************************* Before using token: I can VPN on laptop and my phone.After using token: VPN was fine on the laptop OK, but I can't VPN on my phone. Detail error:1. Authenticate by username/password => OK2. Enter token code => Error "Insufficient credentials. Please check passwords, client certificate, etc..." Call the account I'm using is A. I think account A have problem, so I re-created i

Hey,So here is my problem:I have two accounts on Microsoft. First from my own tenant with abc.com company and second xyz.com.The first one is for managing my devices and using SSO.The second one is for access for sharepoint, office, teams and generally just working. There is no problem when I just have one account on my laptop, everything is working correctly and users are connected to VPN from start without issues.But the problem starts when users are adding another account from xyz.com. Then Forti is getting confused. And we have to use two accounts. We are part of group. I've got EMS and Intune So my question is:How to set that only abc.com account is connected all the time on Forti VPN?

I have a small lab setup consisting of a Fortigate 40F-3G4G (7.2.8), a FortiSwitch 108E-POE (7.2.7) and a FortiAP 221E (7.2.3). They are being managed by FortiManager Cloud (ADOM Version 7.2). I am trying to configure some basic NAC policies for both the wired and wireless network. I have been able to get the wired network NAC working, but am having issues with the wireless NAC. I understand that with these Switch and Gate models connected directly NAC VLAN Segmentation is a no go, but I was able to still get NAC working on the wired LAN by disabling this. With the wireless NAC, I am following this guide here (page 41). All the commands can be entered without issue, however step 4 (Enable NAC on the SSID and select the configured policy), just doesn't stick. If I enter it directly via CLI or via the CLI Configurations section of FortiManager, you do not seeing any errors. But, then, when I check either via the CLI or on the CLI Configurations section of the GUI, the NAC

My Lab setup has a few VDOMS, I'm working on the root VDOM, from this vdom, I can ping FortiGate licence servers ( from the root VDOM )Yet, when I access the GUI I'm met with a "cannot access licence server" message.Does this access need to be provisioned from a particular VDOM or port ?Thanks 

I have purcased a Fortigate 40F that I have put at a small office.I want to send syslogs to a Syslog Server with TCP. I managed to send syslog using UDP protocol, however when I switch to TCP protocol it stops working (with no error message). The setup:Config for syslogd settings:config log syslogd setting set status enable set server "81.164.196.77" set mode reliable set facility syslog endGoogle Cloud Platform compute engine:I have created a compute engine VM instance with Ubuntu 24.04.I have tagged the compute engine with network tag "collector".Google Clout Platform firewall:I have created a Firewall rule named "collector-allow-ingest" withtarget tags=collectorsource filters ip ranges=0.0.0.0/0protocols and ports: tcp:514, udp:601This rule applies to the compute engine "collector". Log receiving software at Compute Engine InstanceThe compute engine runs LimaCharlie Adapter (https://downloads.limacharlie.io/adapter/linux/64) to receive syslog.I start it wit

Dears, Does FortiEDR scan an external HDD or USB once connected to a PC?Does FortiEDR scan an external HDD or USB when I perform a scheduled scan or Ad hoc scan?  

HiI have started with a new company 6 months ago and inherited a strange issue. Occasionally, a user or 2 will get a "Fortiguard Intrusion Prevention - Access Blocked" message when trying to access any website. Other users are able to access the websites. What I see in FortiAnalyzer are logs with no username specified. We have FortiSSO, and it appears that it is not picking up the user logon event. Sometimes, getting the user to reboot will solve the issue but may take a few reboots. Another fix is to get the user to connect to another wifi network, then reconnect to the original network connection.  This issue has been happening intermittently for different users for well over a year now and the fixes mentioned above usually resolve this. However, I now have a user, who has been unable to access the Internet all day, so I'm looking for any possible help.  This does seem like an identity issue, where FortiSSO is not picking up the logon event but I do know

Hello Everybody, I hope someone can clarify a situation for me.My Customer has existing 2x FGT100F with LACP (X1,X2) and around 30+ SVIs connected via L2-LACP-Link to HPE(Core) & NetGear(remote-cabinets) Switches running.Now he bought 4 new FSW-148 (remote-cabinets) from me, but did not buy the 2x FSW-1024E for the Datacenter (Distribution-Layer). He want's to keep the 5406R from HPE (lots of 10G-SFP+ Ports) for Distribution-Purposes and Server-Connection.I on the other hand wanted (of course) to use FortiLink to all the new Switches.All the customers networks (VLANs 5 through 51 tagged - no VLAN1, no untagged) are on the existing LACP (X1&X2) to the HPE-Core. Here are my three big questions:1. Is there a chance (for now ;-)) to keep the HPE-Core and connect all new switches to 10G-Ports on the HPE and still manage the Switches througt fortilink?2. Is it possible to use all the existing VLANs on the new Forti-Switches (aka. Bridge existing VLANs 5-51 to FortiLink

Hi everyoneCould anyone please share their experience or best practice regarding firmware updates for a very big envirnoment (50 plus firewall clusters including Fortigates 200F, 600E, 1200D, 1500D and 3980E?is it prefered to have the lastest FortiOS Version? Or a bit older but mature version?Do you perform the firmware updates manually or do it automatically / schedule it? what else useful tipps can you give?It would  be great to hear from IT experts in other big companies.Best regards

Hello, I am looking for older version of FortiClient VPN version 7.0.7. Can someone please help me with the information about where I can get the software. Thanks,Chaitanya

Hello, I am new to Fortinet and new to this level of networking gear in general. I set up a Fortigate 60F in my home lab a few months ago, and it also happens to be my home router. I am a SE and have a pretty extensive home lab, consisting of an Aruba switch, some Aruba instant APs, a NAS, Hyper-V host and some clients. The only ISP available to me where I am is Xfinity and they have a bandwidth cap of 1.2TB/mo. I am a power user but I traditionally only ever used about 75-80% of the cap ever month. The last 2 months, they are reporting I have gone over the cap by quite a bit. My usage habbits haven't changed and have reduced, if anything. So I am struggling to figure out what, if anything, is using this extra data. I set up a Fortianalyzer VM to try and get a better view, but a clear picture isn't emerging. I can get traffic stats but I can't figure out how to get a clear, total inbound data over just the WAN port. My question is, what would be the best w

Hello Team, I am unable to connect to my client's VPN.When my team in USA/Canada uses the same SSL-VPN configuration, they are able to connect to VPN successfully. At 40%, I get "SSL VPN Connection is Down".Client has also confirmed that they are not blocking any IP from India.I have Windows 10 Pro and Forticlient Version is 7.2.4.0972 Please help me solve this issue. Thanks,

Hello team!! Is there a way to create an asymmetric per IP traffic shaper or a traffic shaping policy with different shapers for each direction?For example, if we need to configure 10 Mbps for download per IP and 5 Mbps for upload per IP, is this possible? how?The "Reverse shaper" option in traffic shaper policies, just let me select shared shapersFirmware version: 7.4.4 Thanks in advance.Regards,Damián

How can i collect the Serial number of Network devices those are monitor on Fortimonitor via POWERBI

hi I'm trying to ping 8.8.4.4 from my wan interfaces of my fortigate 40F (v7.0.13). Interface 'a' can ping correctly but interface 'wan' cannot reach the destination. Interface 'wan': #execute ping-options source 138.99.23.193 #execute ping 8.8.4.4 PING 8.8.4.4 (8.8.4.4): 56 data bytes --- 8.8.4.4 ping statistics --- 5 packets transmitted, 0 packets received, 100% packet loss Debug:  # diagnose debug enable # diagnose debug flow filter addr 8.8.4.4 # diagnose debug flow filter proto 1 # diagnose debug flow show function-name enable show function name # diagnose debug flow trace start 100 # id=20085 trace_id=729 func=print_pkt_detail line=5864 msg="vd-root:0 received a packet(proto=1, 138.99.23.193:14760->8.8.4.4:2048) tun_id=0.0.0.0 from local. type=8, code=0, id=14760, seq=0." id=20085 trace_id=729 func=init_ip_session_common line=6043 msg="allocate a new session-0509fe9d, tun_id=0.0.0.0" id=20085 trace_id=730 func=print_pkt_detail line=5864 ms

Greetings -Sometime within the last couple of weeks, our users' Google Drive App stopped syncing with the Web App and vice versa.I set up a Google Drive account as a test and couldn't even sign in.We removed SSL inspection from our firewall policy for a minute and everything started working.Adding an an exemption in SSL inspection for *.google.com did not fix the issue.Note: We are a Mac environment. Any advice would be welcome.Thank you in advance!FortiGate 

Hi there, how can a playbook be made so that it connects to the actual primary of an ha cluster? It seems that one can only chose one FortiOS Connector that is bound to a specific serial number and not to a HA cluster. So if the device i bound it to goes down - the playbook will fail - even if the HA cluster itself is available. Has someone any hint for me on this?

When creating new VMs on Promox 8.x or higer , the VM license validation fails for FortiOS VMS (FortiGate/FortiAnalyzer/FortiManager etc).Reference https://community.fortinet.com/t5/FortiGate/Technical-Tip-VM-shows-License-status-Invalid-Copy/ta-p/230958Time of writing June 2024 using Proxmox 8.2.2This can be validated by showing the current UUID inside the FortiOS VM. (FortiGate VM used in examples)# diagnose hardware sysinfo vm fullUUID: 00000000000000000000000000000000The UUID will either show all 0's or conflict with an existing running instance.This UUID can be altered in Promox, but the VM needs to be shut down to alter these settings.GUI : The UUID of the VM can be found when opening the VM settings > Options page > SMBIOS settings (type 1).CLI : Use qm config <VMID> | grep uuid. Replace <VMID> with the ID of the VM.It should have a UUID in the form of a large number and letter sequence.If the UUID in Promox is missing create a new UUID. This is rare as this va

Hello! I need help with setting up agentless polling configuration on FortiGate.I have a FortiGate device and an AD server where our company's users are located. I've been exploring the option of using agentless polling to implement and monitor these AD users in FortiGate. I'm having trouble adding FSSO-CA (FSSO Agent on Windows AD).I can see the server and can telnet using port 445, but the FSSO-CA status shows as disconnected. Could the issue be related to the user? What privileges and rights does this user need? How should I correctly configure this setup so that FSSO Agent on Windows AD can see FortiGate and function properly?Please assist me.#FortiGate FortiAuthenticator FortiAnalyzer 

Hello everyone, im testing a fsso solution where i have one machine that work as a collector agent, and another machine thath act as a DC, all the connection fortigate/fsso, fsso/dc and policy match work fine but i have a mismatch in the logon user list under the voice Type, which tell me is "DC-Agent" even if i have specified in the collector agent to work in pooling-mode. I have restarted more than one time both dc and collector just to see if something change but nothing. I dont know if this is just a bug or a real problem  BR, Giuseppe