Support Forum

Hi, i try to connect my new switch F148 with my SonicWall GW.I create VLAN on my sonicwall (ID 5), connect sonicwall to switch to port 23, and connect one PC to port 21. On the switch create VLAN 5, and set native VLAN 5, Allowe VLAN 5 on port 21 and 23. But i have not communication with SonicWall.This is my first Switch from Forti and maybe i somting set wrong. Please suggest what I did wrong

I have integrated my fortigate with the Radius server and working fine,but parallely my local authentication is also working,how shall i set my radius authetication as primary and local as secondary.

Fortigate L2TP IPsec vpn - Windows nativeL2tp IPsec vpn configuration using GUI -Below are the following steps what I have configured in Fortigate Firewall for L2tp IPsec vpn.Step1 - Fistly created local user let's suppose - test, password test123.Step2 - created one group the name of group vpn_group and added that local user in vpn_group.Step3 - Now I went to VPN section and under the vpn section, selected IPsec Wizard.Name - L2tp_IPsecvpntemplate type - Remote access vpnRemote device type - native then next windows nativeStep4 - Authenticationpreshared key - test@123usergroup - vpn_groupStep5 - In Policy & RoutingLocal interface - Port2 which is connected to LAN switchLocal address - 50.1.2.0/24Client address range - 1.1.1.100 - 1.1.1.110subnetmask - 255.255.255.255 (leave default)then click ok.Now Policy configuration -Incoming interface - tunnel interfaceOutgoing interface - port2 (which is connected to LAN switch)source address - 1.1.1.100 - 1.1.1.110 (vpn range address)outgoi

Good morning friends, a question, in the antispam logs I see a large number of emails classified as "recipient verification". Is there any way that these emails do not appear in the logs?According to the "disposition" that the antispam takes is "reject", which, I understand that the antispam is rejecting those emails, correct? In those logs I see emails that do not exist in my organization.

Good day,Though accessible, should access to the bulk/personal quarantine folder be granted to regular staff or only to IT Admins?

Hello, I need your help. I have the following issue: I work with Fortigate Firewall, and my task is to connect my network to another Cisco router. My OSPF is working fine; it sees the internal LAN networks. However, I also need to set up NAT. I need to NAT from my other LAN, 192.168.0.5, to 10.10.10.10 (for example), and ensure they can see this route. I tried using Virtual IPs, but it didn't work out. How can I set up destination NAT and advertise the route in OSPF?FortiGate #OSPF #virtualIP 

Hi All, my mail server (Exchange) is getting a number of brute force AUTH login attempts. What have others done to prevent this? Should I create a custom IPS signature with a " RATE" option on port 25? or should i setup some type of Dos Sensor on tcp sync (or other Dos option?). Here is a snippet of my SMTP log to expose the guilty, as you can see it' s mass connections attempts from a single IP at a time. My windows server logs show the actaul failed authentication attempts and the logins they are trying (sales, support, orders, info, etc.) 2013-10-11 18:18:50 97.86.64.162 361OPERADB SMTPSVC1 WEBSAN08 10.0.0.16 0 QUIT - 361OPERADB 240 5672 76 10 1094 SMTP - - - - 2013-10-11 18:18:50 97.86.64.162 361OPERADB SMTPSVC1 WEBSAN08 10.0.0.16 0 QUIT - 361OPERADB 240 5656 76 10 1063 SMTP - - - - 2013-10-11 18:18:50 97.86.64.162 361OPERADB SMTPSVC1 WEBSAN08 10.0.0.16 0 EHLO - +361OPERADB 250 0 306 15 0 SMTP - - - - 2013-10-11 18:18:50 97.86.64.162 361OPERADB SMTPSVC1 WEBSAN

Hello,We have a Nexus switch 5548 connected to FortiGate 100D via regular trunk port. All intervlan routing will be done on the Nexus switch and also has a transit vlan between Nexus and Fortigate that will carry other vlans for the internet access. Right now I can access the internet from Nexus from Transit vlan 254 but unable from other vlans. What am I missing? I've attached configs from both devices.Thank you in advance!Fortigate config: https://drive.google.com/file/d/1W_GrNUxOCHpK5YIoU3JtxavXwc9hginL/view?usp=sharingNexus config: https://drive.google.com/file/d/1wVegIRtnjyKz6cd_yw5SJcY-C3FFrzC1/view?usp=sharing(sorry, couldn't figure out how to attach files directly here)

Hi, We are using Fortigate, Fortiswitch and Fortinac.They are using static ip configuration in their client system.We wanted to push Dynamic access control lists via fortinac.Can someone please guide in this case.

 I am unable to click on Install Now button, 

Hi, I am using a Starlink Bussiness with public IP, to create a VPN between a Mikrotik to a FG1500D. Without the VPN on the, a laptop connected to the Mikrotik on site can reach 250/50 Mbps (Minimum 80/15 Mbps); but with the VPN Stablished the speed down to maximim 15/10 Mbps. The connection is Laptop <--> Mikrotik RB960 <--> Starlink <--> Internet <--> F1500D <--> Internet I tried changing the MTU, but nothing happen, I know that satellite system use tcp spoofing optimization techniques, but i cant confirm with starlink if thta feature is on his plattform and if this affect the VPN. Somebody had the same issue? Thanks in advanced  

Is there a way to add a link that will direct a user to request a blocked site be allowed and a email will be sent to help desk for further review? 

I have a fortigate that was in my fabric from before I started with this company. The last admin registered this Fortigate with his personal email account and I am now trying to change it to the email address we use for all of our fortigates.   I have tried config system fortiguardset service-account-id <the new email address>endBut this does not work in 7.0I am not able to connect this Fortigate to my Fortimanager cloud instance, until I change this email address. 

I am trying to find a way to disable daylight saving time on the active timezone on FortiOS 7.2.7.But apparently the option presented in the following posts is missing!https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-disable-daylight-saving-time-DST-feature/ta-p/198881https://community.fortinet.com/t5/FortiGate/Technical-Tip-Retrieve-Daylight-Saving-Time-DST-start-and-end/ta-p/255953 

How should I solve this problem? Fortigate had experienced an unexpected power off!  

When enabling the Explicit Proxy feature on a FortiGate 40F(ver6.4.11) and performing several thousand Kerberos authentication tests from a test tool, 1001 users appeared in the authentication list on the web management console, but no additional users were shown beyond that. We had not considered the configuration or limitations regarding the number of concurrent authentications, so we researched the related settings and found the following website. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Limiting-concurrent-user-authentication/ta-p/199277https://community.fortinet.com/t5/FortiGate/Technical-Note-Limiting-concurrent-user-authentication/ta-p/190373   When we checked the configuration on the tested FortiGate, the value of "policy-auth-concurrent" was set to 0. So far, we have not been able to obtain information on the maximum number of concurrent authentications possible. Please tell me the maximum number of concurrent authenticated u

I have an issue on a 200F, running 7.2.8. I have two EMAC vlans. One where the ansible host is running (VLAN1818). And another that is shared across multiple firewalls and vdoms across the network (VLAN0998).I have an ansible playbook with 20 tasks in it. When the ansible host is on vlan 1818, If I start the playbook it will randomly fail on any of the 20 tasks. If I try often enough it may make it through all 20 tasks.If I move the ansible host to vlan 998 the playbook will complete 100 percent of the time across the 100 tests I have performed.This does not appear to impact 200E, 201E, 101E, 60F, 1100E, or 1500Ds that also share this architecture. It is only the 200F that is experiencing this problem.

we have 4 fortigates run v7.0.14 build0601 (Mature), one per each WAN site.I tracert from a host behind one fortigate of site A, to a target host behind the fortigate of site B C:\Users\ADM-name>tracert 10.80.131.12Tracing route to hsot.company.com [10.80.131.12]over a maximum of 30 hops:1 199 ms <1 ms 26 ms 10.250.14.12 <1 ms <1 ms <1 ms 172.29.7.223 216 ms 216 ms 216 ms 10.250.29.15 (Y)4 243 ms 242 ms 242 ms 172.16.10.175 242 ms 242 ms 242 ms host.company.com [10.80.131.12]the 3rd hop is not the desired one by SD-WAN. We have 2 tunnel-type interface (let's say X and Y) in SD-WAN outgoing interface bundle. The tracert shows Y but actually X is the selected outgoing interface.and if we do diag sniffer with interface X, it has traffic result, and no traffic result if diag sniffer with interface Y, meaning traffic is going through the correct interface. what is the logical of fortigate replying tracert request? Why it is like this?

Good morning, I checked his laptop and it should work without any problems, but it still won't connect for some unknown reason. I fixed and updated everything, but the problem persists. It seems that something is wrong with the Windows system. Here’s what I did:Updated the BIOS firmware to the latest version (Dell Latitude 3540).Updated several drivers from Dell to the latest version.Used SFC (Windows tool to repair missing or corrupted system files) and DISM (Windows tool to repair the system image or modify the installation media).Uninstalled ESET (reinstalled it after finishing the work).Disabled the firewall.In CMD as an administrator, I executed: ipconfig /release, ipconfig /flushdns, ipconfig /renew, netsh int ip reset, netsh winsock reset.Added 1.1.1.1 and 1.0.0.1 to DNS.Reinstalled FortiClient.Added the certificate to FortiClient.The same problem still occurs. It just stays on "Connecting" and nothing happens after clicking the "Connect" button. Dell Latitude 354

In "Document Libarary > FortiOS Log Message Reference > Log Messages",The "Description" of some "Log Field Name" is blank.Is there any documentation or method to know the "Descripion" for "Log Field Name" where "Descripion" is blank? example:https://docs.fortinet.com/document/fortigate/7.4.4/fortios-log-message-reference/8192/8192-mesgid-infect-warning  FortiGate 

Hello, I have SD-WAN controlled ADVPN tunnels via BGP.How do I clearly view if a shortcut route is being used in the route table ? 

Hi,      I have 2 Fortigate 501E that were configured  HA peer. Every 3 months. I have a maintenance window for restarting the server/network. Would it be okay if I also reboot the FortiGate?       Previously for the maintenance period I only tested failover by CLI "execute ha fallover set 1" Thank you. FortiGate 

I would like to ask some questions about "virtual servers" in FortiGate. I deployed my firewall on azure with three subnets: 1) External Subnet: 192.168.200.0/242) Internal Subnet: 192.168.90.0/243) Protected Subnet: 192.168.100.0/24My two database servers are deployed on Protected subnet 192.168.100.10 and 192.168.100.11. They are listening Port TCP 1521. I would like to load balancing these two servers in FortiGate. The virtual ip will be 192.168.100.240. My configuration cannot route TCP port-1521 from client to this virtual Ip. I can access from client VM to each server with TCP port 1521. Any suggestion?   My firewall Rules:

Hello. Is it still true that Linux Forticlient still does not support IPSEC CLI configuration when using FortiClient (I was following https://community.fortinet.com/t5/Support-Forum/Fortclient-VPN-Client-Linux-IPSEC/td-p/232278 )? I aim was to replicate Macosx forticlient IPsec configuration onto Ubuntu 22 (against a small 40F / 70F with tested and working IPSEC VPN configuration). I got Forticlient installed following https://repo.fortinet.com/  , which, as of today (5th of April 24) installs as 7.2.4.080 on Ubuntu 22.04 LTS, and IPsec functionality does seem to be there, but then the configuration goes somehow pearshaped (I only got sudo apt install gnome-keyring to improve the situation slightly but still got an issue - not sure if this is expected - it looks like it somehow uses GUI key chain infra, even when explicitly operating in CLI space so "forticlient vpn ..."(VPN CLI interface)). ubuntu@server:~$ forticlient v

Hello all of you. Can anyone recommend me the best cybersecurity certifications that are widely recognized in the industry, along with information on their respective prerequisites, exam formats, and career benefits? plz suggest me.