Support Forum

Hello, I'm not getting traffic in an ipsec vpn tunnel (HUB-SPOKE). When running the command "diagnose debug flow filter addr 192.168.1.254 192.168.13.254 and" on my HUB I get:  id=20085 trace_id=204199 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface HUB-WAN05, tun_id=0.0.0.0" id=20085 trace_id=204199 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel HUB-WAN05_0" id=20085 trace_id=204199 func=ipsec_common_output4 line=778 msg="No matching IPsec selector, drop"  HUB-WAN05 phase2-interface configuration is the same as HUB-WAN04 (HUB-WAN04 works perfectly)  edit "HUB-WAN04" set phase1name "HUB-WAN04" set proposal aes256-sha256 set dhgrp 5 set replay disable set keepalive enable next edit "HUB-WAN05" set phase1name "HUB-WAN05" set proposal aes256-sha256 set dhgrp 5 set replay disable set keepalive enable next  on both HUB-WAN04 and HUB-WAN05 the Phase 2 Selectors LOCAL ADDRESS and REMOTE ADDRESS are set to subne

Hi, I have an FG-100 with factory settings. When I go to Network -> Interfaces, I notice that there is only one IP assigned for all 20 VLAN Switch interfaces. Why is this so? The FG-100F is a layer 3 switch so every interface should have a different IP and MAC address (even a layer 2 switch should have every interface with a different MAC address). Please, would someone mind helping me understand what is going on here? 

Hi All,I am trying to configure User Tracking for OWA (on-premises Exchange Server 2019) on FortiWeb-VM.I do not fully understand what I should enter for the Session ID Name. I have already tried some of the default cookie names like X-OWA-CANARY and ASP.NET_SessionId, but nothing works. I still cannot track logged-on user activity.  

Good morning,Since 1 week ago, Forticlient EMS is reporting vulnerabilities in some Forticlient's own DLL libraries, as you can see in the attached screenshot:  We find it quite strange that Forticlient detects itself as vulnerable, when there is no new version of Forticlient.We need some indication of how to proceed and why this vulnerability is being detected.Thank you very much and best regards,

Hello everyone,  the FortiManager has 2 IP addresses and the FortiGate is authorized to IP 1 in the Security Fabric/Fabric Connectors/Central Management Settings but I need to change the authorization to IP 2. How do I do this? If I use:  config sys centralset type noneendconfig sys centralset type fortimanagerset fmg x.x.x.xend I remove the FortiGate from FortiManager and i have to remap the interfaces right? Is there an easier way? Thank you 

I spent way too much time trying to solve this, so I hope this helps someone else.Trying to install FortiClient and it kept failing because it found some residue of Sophos Antivirus.Every trace of Sophos was thought to be eliminated... until we found this... Problem You remove antivirus software from an endpoint, but the antivirus continues to show up in antivirus list for that workstation.Solution The probable cause is that the antivirus did not properly remove itself from the listing in the local workstation's security center. To correct this, run through the following steps on the workstation:[ol]Open a command window as an administratorRun the command:  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProductRun the Windows Management Instrumentation Tester command:  WBEMTEST Click the "Connect..." buttonEnter: root/securitycenter2Click the "Connect" buttonClick the "Query..." buttonEnter:  SELECT * from AntivirusproductSelect the antivi

Hi, Everyone.I have a plan to upgrade FortiGate firmware FortiOS 6.4.15 to 7.2.8.The FortiGate is models on NP6 platform.Before I'll do it, I have read the Document Library about FortiOS 7.2.8 in Fortinet official web page. and I found the Bug ID 1012518 in known issue.Here is the citation from the Document Library. https://docs.fortinet.com/document/fortigate/7.2.8/fortios-release-notes/236526 ---Some FortiGate models on NP6/NP6Lite/NP6xLite platforms experience unexpected behavior due to certain traffic conditions after upgrading to 7.2.8. Traffic may be interrupted momentarily.Workaround: Users impacted by this issue can contact Fortinet Support to request a special build with a fix for this issue. Alternatively, users can disable the processing of traffic by the IPS engine’s nTurbo using the following command:config ips global set np-accel-mode none end---I'm gonna do the workaround that using the command.But When I use the workaround, I'm wonderin

Dear Support Team,I hope this message finds you well.I am a Java developer working remotely and have recently encountered connectivity issues with our internal servers following the implementation of the Zero Trust Network Access (ZTNA) policy. Previously, I was able to connect to our servers using a VPN without any problems. However, since the transition to ZTNA, I am consistently facing connection timeout errors.

 FortiGate firewall running FortiOS firmware 7.0.12I see from older previous posts control-v ? was not supported from the cli window within the GUI and was hoping this may have  been changed in newer releases.If this is still not allowed within the GUI cli window or is there an alternative way to enter the ? character as part of a username?Thank you.  

Hi, I have an HA setup, but firewalls are currently out of sync.Tried to check the configuration for both firewalls, and seeing the difference is only ENC value for the password. Is it normal to have different ENC value for password for HA configuration? I have tried to recalculate the checksums already but still getting an out of sync status. Thanks!

Hello I am a user of Fortigate 7.4.4, with an architecture based on this: https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/335646/inter-vdom-routing-configuration-example-internet-access On my internet connection, connected to my root VDOM, I have two pools of public IPs. One pool (pool1) configured on my interface, and a second pool (pool2) only routed to my Fortigate's WAN interface. I want to route an IP from pool2 to vdom1 (a child of root). And create a VIP in vdom1. When I configure this, no packets arrive at the IP: FG01 # config vdomFG01 (vdom) # edit rootcurrent vf=root:0FG01 (root) # diag debug flow filter clearFG01 (root) #FG01 (root) # diag debug flow filter proto 1FG01 (root) #FG01 (root) # diag debug flow filter addr 42.149.274.112FG01 (root) #FG01 (root) # diag debug enableFG01 (root) #FG01 (root) # diag debug flow trace start 10### no log on screen #### At one point, I created a VIP on the root VDOM with the IP f

we have users connected FortiSASE and the traffic from a user to FortiManager Cloud & FortiAnalyzer Cloud showing Accept: session timeout on FortiSASE.any one had this issue before and what's the fix? 

Hello, there is something I don' t understand with my log files. It is the " duration" value. As an example let' s consider this line: WTsyslog[2007-02-06 12:46:17 ip=Z.Z.Z.Z pri=5] id=firewall time=" 2007-02-06 12:46:18" fw=FGT400SomeSerial pri=5 SN=AnotherSerial duration=163 rule=83 policyid=83 proto=443/tcp service=443/tcp status=accept src=Y.Y.Y.Y srcname=Y.Y.Y.Y dst=X.X.X.X dstname=X.X.X.X src_int=port2 dst_int=port1 sent=1180 rcvd=1052 sent_pkt=21 rcvd_pkt=20 src_port=53092 dst_port=443 vpn=n/a tran_ip=W.W.W.W tran_port=443 dir_disp=org tran_disp=noop It has been extracted from a log file of a WebTrends syslog, and comes form a FG400 in WELF format. This connection was done on purpose over 5 seconds long, but the " duration" value is 163. As it is supposed to be the duration of the session in seconds, how can the log say it was more than two minutes long if I closed it after 5 seconds? Is this value specified in another time unit (cents of seconds)? The only

Hey TEAM, I will try to be clear as I can. My manager wants personal quarantine emails (that are passed as clean) to be automatically released to recipients/staff inbox(exchange)over a particular retention period e.g. 5 days. I told him the only way that I am aware of users releasing their own mails is via quarantine reports -  https://docs.fortinet.com/document/fortimail/7.4.2/administration-guide/907026/managing-the-quarantines My inspection rules are working perfectly, spam reduced SIGNIFCANTLY in my environment, I have full control of inbound mails. I am also manually releasing quarantine mails for staff, not daily, but from time to time, this can be a bit of an overhead though. I suggested to him the quarantine report/release method, but he does not want that method lol. Can he get his wish and if yes, how can this be done? I welcome all suggestions/feedback.

HiI'm new to the board and also very new to Fortigate. Have a lot of experience using asa firewalls but now migrating to Fortigates. But I need some help. We are migrating using the forticonvertor.I’m looking for a simple solution to add the option“set logtraffic-start enable” on every ruleIt there a option to do this easilyI tried using the cli config firewall policyedit 0 - 4294967294set logtraffic-start enable But it does not accept the command “edit 0 – 4294967294”Enabling it by hand on every rule is not a option. I hope there is a global command or at least a option to edit a range of rule numbers in one go. Kind RegardsEduardThe Netherlands

Hi All,Issue: whenever we try accessing the URL connecting to the VPN through office network it WORKS. but at the same time if we try accessing the URL out-off the office network with VPN it does not work. kindly share your suggestions and steps to fix it.and can anyone share me the support team contact number or email ID so that we can connect at the point of incidents

Hello - does the FortiGate 121G support "hardware switch"? I searched around and found this tip, but, the 100G series is in neither of the supported, or not supported lists: Compatibilities of Hardware Switch with F... - Fortinet Community (Edit to add, I submitted feedback on that link to request the 100G series be added; here's hoping they add it for clarity)

Hello, I am a user of Fortigate 7.4.4. I have an architecture based on a root VDOM, where my WAN connections arrive, and then interconnection links with my child VDOMs (as shown in this diagram visible in the Fortigate documentation).  My infrastructure is shared with a client. My client wants to set up an IPSEC VPN on their VDOM. I followed the configuration available here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-IPSec-VPN-tunnels-on-VDOMs-that-do-not/ta-p/195596 This configuration is based on a NAT on the root VDOM. My client does not want NAT. How can I completely remove NAT? Thank you for your help.

Hi,In the FortiGate, I can see there are traffics initiating from FortiGate' IP address (10.90.0.2) to IP Public which is globalupdate.fortinet.net.I have configured the FGT so that it will use FortiManager as local FDN, but seems like the FortiGate still trying to IP Public by itself. How to disable it in FortiGate? config system central-managementset type fortimanagerset fmg "10.1.71.57"set fmg-source-ip 10.90.32.11config server-listedit 1set server-type update ratingset server-address 10.1.71.57nextendset interface-select-method sdwanend 

Just lately a lot of legitimate emails seem to be being blocked via our Fortigate 100A running the latest Firmware, has anyone else seen this? Also we are getting more actual spam through which at the moment is not my main problem due to legitmate emails being blocked from clients. Everyone is saying to move onto FortiMail but this is not an option at the moment so is there anything I can do to stop these legitimate emails being blocked? An example of the emails that are being blocked are as follows " Hi Jennifer I have attached our latest backup for you, please can you confirm all is o.k with attached for you to do below? Thanks Karen From: Sent: 10 June 2009 12:48 To: Subject: 2009 P11Ds Karen As discussed please could you print off the sage nominal codes for the year 6 April 2008 to 5 April 2009; codes from 7000 onwards. Sarah was able to do this for me last year as she must have had a back up; if you have any trouble getting this report please

Sorry but I’m new to the Fortigate world so I’m looking for advice or direction.  We seem to have intermittent issues with Zoom while UDP_flood is enabled.  When the option is disabled everything seems to be fine.  Is there a way to create a policy that would pertain to only Zoom connections and just disable those? Or is there a better way to handle Zoom traffic? 

Dear All, Need support as we have two Fortigate Firewall with valid contract and both in HA (A-A). Fortigate has two forti token. My Requirement is - We have to setup two factor authentication with using Forti token. While assigning token to one user. (user - ABC). getting error - Unable to provision mobile token with forticare... Object set operator error, -7567. Can anyone please provide solution for it. Thank you.

Hi there!We are installing a new Fortigate 60F. It will be quite a basic configuration, we have 3 VLAN defined in a VLAN switch attached to a L2 switch port in trunk/tagged mode and have created several policy rules to allow traffic between them (working fine). We also have users connecting through SSL VPN (planning for IPsec in the near future), and also created the respective rules to allow traffic from the VPN network segments to the different VLANs. We are not 100% sure if Fortigate is working as expected or we are missing some rule, since users connecting through SSL VPN can see/access only hosts directly connected to the Fortigate (fortigate as GW) and not all hosts in the VLAN. Would appreciate if someone could shed some light on this. Thanks in advance. BR

I want to ask if this vulnerability can be deferred as it requires an authenticated vpn user. https://www.fortiguard.com/psirt/FG-IR-23-225 

Hi, Based on this KB: https://community.fortinet.com/t5/FortiGate/Technical-Note-ICMP-and-UDP-traceroute-functionality-with-the/ta-p/195339#:~:text=The%20FortiGate%20is%20designed%20not,a%20from%20a%20Cisco%20Router.I know that the UDP based traceroute will be dropped by FortiGate if I try to traceroute to FortiGate' IP address (e.g. management IP).But for endpoint behind the FortiGate, does FortiGate also drop this UDP based traceroute even I have allowed any in the firewall policy? Thank you