Support Forum

HiWe have a case where we need to block IP of SSL VPN login fail for an amount of attempts within like 5-10minutes repeated attempts using automation stitch.We already have the FortiAnalyzer and Fortigate Setup. The only problem we have is that the FortiAnalyzer is giving the wrong value in the $remip variable in the FortiGate Event HandlerAn example of IP 192.168.1.1 becomes 192.168.1.1,,With two commas in which the FortiGate CLI does not acceptWhat possible solution will be able to be done to get the IP without commas or sanitize the string in the CLI script?Or make sure that FortiAnalyzer is giving the correct IP format?

Dear peope, please cooperate in this problem. You already have AD and fortigate LDAP configured correctly, but it happens to me only with a few random users that when they change the password, it expires sooner in the forticlient VPN, throwing error -7200, therefore the password must be re-entered without change option in AD and it works again. It is tested with a VPN account without LDAP and it connects, ruling out a VPN problem.Does anyone know why this happens and how it can be solved. The configuration works correctly for everything else, but it only happens to me with 3 or 4 users at random.

Hi Team, I currently have an automated stitch to restart a process when the FortiGate reaches conserve mode - following this link: Restart WAD or IPS when conserve mode hit... - Fortinet Community Is it possible to have SNMP traps to be sent when the CLI script/automation is triggered in my FortiGate? Is there an OID intended for this? or others which must be configured? Currently using this CLI Script as Action: diagnose test application ipsmonitor 99 Thanks 

Hello, I am trying to block all traffic from Russia except Yandex mail. I have an address group for all Yandex IP addresses. Can someone explain why my Allow Yandex rule doesn't get priority and SMTP traffic still trying to go through Country Block rule and getting denied? I am attaching the screenshot.  Thank you very much!  

Hi support, i want to check detail infomation about threats in FortiAnalyzer. It's show threat type PUP and Threat Name is Spyware. I want to check what the user's device is using so that it has the above notification ?? and is it dangerous to my system?? 

We have Fortiweb VM running ver 6.4. How do I upgrade to latest version 7.4. Can I upgrade straight to latest version?

Hello. Please help me. Currently, I have set up FortiAnalyzer to send an email to the administrator when a compromised host is detected. However, since I receive notifications for everything detected, I end up missing critical ones. I want to receive emails only for high-priority alerts. Is there a way to do this? If it cannot be done with the standard settings, I would like to use an API or other method to achieve this.

Good morning,Does anyone know if FortiCloud is currently offline? I am trying to access the FortiGate logs in FortiCloud.

Hello, I currently have a hub and spoke SDWAN solution, using ADVPN, IBGP and SDWAN rules to steer traffic across the overlay or breakout locally across the internet. I need to add another Hub that will provide access to more infrastructure and advertise specific prefixes to the spokes, but this Hub also needs to communicate with the existing Hub. I currently have x2 overlays on the existing Hub to each spoke. My plan was to continue this design on the new Hub and create x2 new overlays so the spokes can reach the new hub. I will then make both the hubs spokes of each other. My worry was that if I make the hubs spokes of each other, that they might try to shortcut to other spokes. Is what I have proposed above along the right lines, appreciate any advice/recommendations. Thanks

Hello,I would like to retrieve information about compromised hosts and threat types from FortiAnalyzer's FortiView using either the API or CLI, but I am unsure of how to proceed. If anyone has experience or knowledge about this, could you please provide some guidance?

My current setup is as follows: ISP using PPOE---- Cisco RV340----Four (4) NetGear lvl2 Switches.The Cisco RV3340 has the Firewall turned on and does VPN using Cisco AnyConnectI also have the following VLANS on the Cisco RV340: VLAN1 (Default) using private IP subnet 192.168.6.x/24VLAN 20 192.168.20.x/24 DHCP enabledVLAN 30 192.168.30.x/24 DHCP enabledVLAN 40 192.168.40.x/24 DHCP enabledVLAN 50 192.168.50.x/24 DHCP enabledVLAN 60 192.168.60.x/24 DHCP enabledVLAN Ports to Table have tagging enabled for Lan 1 to Lan 4 for VLANS 20 to 60 with VLAN1 untagged.NAT is enabled on the WAN 1 interfaceI want to setup a Fortinet F80 in front of the Cisco RV340. The reason for this is to setup a Site-to-Site VPN connection with another Fortinet F40 that will allow me to do DR for my backups from one (1) QNAP NAS to another QNAP NAS.My setup would be:Site 1. ISP using PPOE---- Fortinet F80----Cisco RV340----Four (4) NetGear lvl2 Switches----QNAP NAS.Site 2. ISP using PPOE----Fortinet F40----QNA

I have a Fortigate firewall with x2 VDOMs, root and user created called "management access". root and management access have an inter-vdom link between them to exchange traffic and because of the requirements root is the "management vdom" and used as management access for us to manage our customers firewall. The problem I am facing is that you cant configure SNMP in a non "management vdom", so I have configured SNMP on the inter vdom link in root as a workaround which the management access vdom is directly connected to. The problem is I cant seem to SSH onto the firewall using the intervdom link from our management jump box.Does anyone know if its possible to SSH to a Fortigate on an intervdom link from outside the Fortigate firewall? I have checked routing+firewall policies but it does not appear to work.

Hello!I am quite a beginner giving a hand in a NPOrganisation (and French, in addition...)Forticlient has been set up by some guy at HQ on my PC. From home, I can access to a NAS in the group of devices we have at the office. So, it seems that the VPN access by itself is working.But when I want to access to a specific PC in the same office and network, under Windows 11, having the same XXX.XXX.XXX first group of IP adress, it cannot be accessed (time out). I can access to this PC via other softwares, like 'anydesk'.So, I guess that something must be set up on this PC, like firewall or whatever. I had a look at some couple of docs, but it seems to be always speaking about settings on 'my' PC, not the office PC.Could anybody kindly help?Thank you.

Hello         We are facing the tunnel error. Both side tunnel are up but we received reply packet 1 time after that cannot ping each other. Both side using IKEv2.

Use custom source interface to exit, but the traffic will check the default route and exit through the found route interface, not the custom interface ip.But after configuring the source ip, there is no problem.Why is this? config system ntpset ntpsync enableset type customset syncinterval 1config ntpserveredit 1set server "10.0.0.17"nextendset source-ip 10.0.64.114---------------Canend------------------------------------------------------------config system ntpset ntpsync enableset type customset syncinterval 1config ntpserveredit 1set server "10.0.0.17"set interface-select-method specifyset interface "port1"----------------------Can'tnextendend port1=10.0.64.114

Hello, I want to create specific access rule per one user from AD While selecting source, and user, I get error  One address, address group, external resource or Internet service is required as read a solution, I have to select "all" address object, but I have question, if I select all, will it affect on all users, or it will work on a single user written under "all" ?    

Hello my friends,i need your help. I have a Fortigate firewall and need to filter traffic.Specifically, I want to prevent users from watching movies or accessing NETFLIX.I have an LDAP Server implemented on Fortigate, which integrates with our Active Directory, allowing me to see all employees.How can I filter traffic so that, for instance, USER1 cannot access NETFLIX?Your urgent assistance would be greatly appreciated.FortiGate #LDAP #User #Policy #webfiltration

Hi there, I configured two FortiGate that are running on smaller locations. This FGT have internet access and DHCP enabled. All of the traffic of the clients of the location network is routed straight through IPsec-VPN to the bigger FortiGate in the main office. On this bigger FGT every traffic runs through policies etc. So on the small FGT there is only an allow in/out policy and a default route pointing to the S2S VPN tunnel. Inside the tunnel there is also the 0.0.0.0/0.0.0.0 defined. Now I wonder how I can assure that the FGT can perform their connections fo FortiGuard services, performing signature and ISDB updates etc. as well as checking for firmware at Fortinet directly from the FGT itself without going the whole way through the tunnel towarding the main office. Actually I configred at least the both external internet DNS servers that are configured on the both FGT in the routing table as static route pointing to the gateway from the provider. A static route for

Hi, Users are using zscaler proxy for internet.We are having zscaler s2s vpn tunnels configured and added default route for internet. Zscaler tunnel - distance - 10, priority - 1Internet ILL - distance - 10, priority - 2 Now if we do the ping to ILL wan ip we are not getting ping of wan ip.If we do priority 1 to ILL and priority 2 to Zscaler tunnel then only we are able to ping to wan ip.Can someone please guide in this case.

Hello,When I scanned my Ubuntu server for vulnerability I found: "The remote web server is not enforcing HSTS, as defined by RFC 6797". It affected Port:8010 which used by FortiGate to authenticate.I am not sure how to fix it: Did I need to change my Ubuntu or my Fortigate configuration.Best Regars

Hello all, We just upgraded to FortiClient 7.2.4 and having a strange issue, not sure if this is a bug or if there is some configuration change we can make to prevent this.    We are using SAML login, but for some reason FortiClient keeps trying to use certificates that exist in the users personal certificate sore that are totally unrelated to our VPN.  We have never used certificate based authentication, its not even configured on the firewall.   But for some reason when we try to connect using SAML it fails and the log below is generated in the certificates log for Forticlient.   If i disable single sign-on and just connect with un/pw then it works fine and the certificate issue doesnt happen. This is happening on a per-user basis, meaning that on the same computer with the same exact configuration if 2 different users try to use FortiClient it will work for 1 but not the other.   I found that the issue is related to certifi

Hello everyone,I am wondering if you can help me with my problem.I found out that everyone can modify the title and msg parameters in the message function.What is the intended usage scenario for this function and is there a way to disable it?Thanks in advance.

I have a couple of user that for some reason got assigned to the Default policy when they should have been assigned to our internal policy.  One of the users is our CTO.  So my question is there a way from FortiCloud EMS to move the user to the correct policy?  Or really anyway that does not involve interrupting the end user.

We configured SSL VPN (SAML authentication) with external IDP (Entra ID). We want to allow only compliant devices to connect to VPN. According to the Fortinet document here this is possible and upon testing it is working for window devices.  However, the instructions are not working for MacOS devices. When we connect from MacOS device we notice that the sign-in log in Entra ID has "Device ID blank". We tested with an embeded browser and with an external browser as suggested in the link but it is still not working.Please guide me on how to to resolve this issue. 

Anybody manage to compile a list of error code descriptions?  We use, mostly, FortiClient 6.4 with an external MFA provider (PrivacyIDEA).  Anytime there is a connection issue, we get the error message, 'The server you want to connect to requests identification, please choose a certificate and try again' followed by an error code in parenthesis.  This is incredibly frustrating, especially when the uninitiated starting asking about certificates when the actual issue is the user entered their password wrong or they failed host checking.  Globally, cert checking is disabled, though we have a couple portals that have cert checking enabled, this error is displayed on all of them.