Support Forum

The most common issue we encounter is a client getting on a web page claiming that they have a virus, must call a number, pay them money, etc. We use FortiGate firewalls with UTP bundle. We have most of the Security Profiles within the Policies turned on and set to seemingly reasonable settings. Are there one or more setting issues that we can check to assure we have set correctly to reduce the risk of users getting to these malicious pages? Or are these large unstoppable even with good firewall settings? I will be off-line from the forum on Sunday.

Hi all,Looking for some help deploying FortiClient with EMS using ClearPass for auth, rather than using AD/Azure directly.ClearPass is already integrated with AD/InTune and has the required info, can we leverage this info to auth FortiClient VPN users? Anyone got a solution doc that can be shared?Thanks.

I am not permitted to access my data center from outside the country, but I can use my Fortigate with Forticlient IPSEC to access a machine inside my LAN and then RDP to servers in the data center. Is it possible to configure the Fortigate itself to do Windows Remote Desktop Connections using the LAN IPs? That would eliminate the need to rely on any LAN machines being up.Thanks,Ben

Hi Guys....I'm a stranger in this town, dyed in the wool Cisco and Meraki wireless designer/operator but I've been tasked with looking at a Fortinet installation. I'm pretty sure from RF indications that the channels and TX powers that the APs are set to is not being managed automatically (several interfering APs not changing channel/power when they can see each other). Is there documentation that will show me how to set up and manage Automatic Radio Resource Management? I know what I want to do, done it before on Cisco/Meraki/Aruba, and could probably fumble my way through if this was not a customer's production network, but I'm being a bit careful Thanks for any help!

when setting something like this up does the fortiweb typically send logs to fortianalyzer cloud directly or does it use a FortiGate for example and the Fortinet fabric?

Recently, I have changed the telephone system in our company. We have chosen the FortiVoice 300E-t, with some FortiFones 480B and some FortiFones 580. Unfortunately, there are some issues with the calls, whether internal or external, and the problem mainly focuses on those using the FortiFones 480B devices. During the calls, there are random momentary interruptions or it seems like words are being lost.The telephone line used for the calls is an ISDN PRI E1 and it is connected to the FortiVoice 300E-t. The network is divided into a data VLAN and a voice VLAN; the telephone devices correctly receive IP addresses from the voice VLAN and have communication with the telephone system. The telephone system and the telephone devices are connected to FortiSwitches (148F-FPOE), which are managed by a FortiGate 60E. The telephone system and the phones have the latest firmware installed.Can someone tell me if they have encountered a similar issue or if there is a way to find out what is really ca

Hello,How we can enable VPN always ON on FortiClient VPN?

Hi, i want to create an app signature for our Forcepoint Web Proxy and i have been trying to create the signature but I get the same error: F-SBID( --name "Forcepoint-Forcepoint.Cloud"; --pattern "webdefence.global.blackspider.com)"; --service HTTP; --service HTTPS --protocol tcp; --protocol udp;) 

Hi All, I want to allow WhatsApp and WhatsApp file transfer through application control, I blocked all categories under Application control and under application overrides allowed DNS,WhatsApp and Whatsapp_File.Transfer, I am able to send text messages but not able to send images. Any idea? -SaimCategories

I have the following configuration now - Site A with FGT and Site B with MKT in the lab. I'm able to to up the IPsec tunnel between both sides and ping each other subnets but I want to route the internet traffic from site A to site B as well. I was looking for some solution but was no manage to make it work. I saw its possible to use GRE tunnel but I don't want to. Is it possible as configuration at all or not?

Hi, I want to configure a FortiClient Telemetry connection key for FortiClient EMS. So FortiClient must provide this key during the initial connection. Is there any way how to store the key in the FortiClient XML Profile without entering it manually by a user?I cannot image distributing the key for thousands of users during a rollout phase. Thank you for any hint. RegardsJozef

on a fortiswitch with Firmware v7.2.4.How to ensure that traffic between port 01 (SW1) and port 02 (SW2) is tagged with the correct VLAN IDs and is not set to VLAN 1 by default. Should I change the native VLAN on each port?

Dear Comunity,how to configure my FortiGate (FortiOS 7.2.8) to not stripping TCP option 19 (used for BGP MD5 authentication)? The same problem is in the Cisco world as well and it is nicely explained (with solution) here: https://learningnetwork.cisco.com/s/article/how-to-allow-ebgp-md5-authentication-when-asa-firewall-in-between I am looking for the same solution. Until I figure it down, I can't replace the Cisco ASA used in the production. Best RegardsBm

hello freainds I want to monitor per IP bandwidth usage traffic on the link. How can I do it???could be used with the apps Zabbix or PRTG?I will be glad to help you.

All,I find it quite unbelievable that you can't change the VLAN ID of an interface once it has been created. This must be the only network equipment we own that does not allow this. And we have a lot. So - this I do want. /BT

Hello, I have Fortigate with a lot of sslvpn portals.in the sslvpn settings I have entered local DNS servers which are replaced on the network card of the end device during the Forticlient connection and this is ok.But I have one portal that needs to use different dns than those in settings. does setting split dns replace the DNS on the network card of the computer with forticlient?the problem is when computers with AD are used and have a different DNS than the domain controller, which is sometimes problematicFortios 7.0.14

I am using a FortiGate 40F with version 7.2.8 and I attempted to download a license for FortiAnalyzer Cloud, but when putting in my timezone and clicking "Submit" to proceed, I get this error below: Fail to download license, please give it try later. [Error_code: -3040] I am not sure what may be causing this error but I am curious to know if others may know what this error entails as I was unable to find an answer for this.

Hello !  I'm new witth Forti Technologies and I work at an IT department.I've earned a gift for working a lot of hours straight for weeks and this gift is a FortiGate 200A. I absolutely don't know this firewall, so I just got home, plugged the console port to my computer and launched Putty but unfortunately, nothing appaers, just a black screen. (WTF is this poisoned gift) Reading this forum, I tried to reboot the firewall while watching the putty window.It displays this : FG200A (19:06-02.28.2006)Ver:0400000300000000000000 And then nothing, so I can't go on an eventual maintenance menu or execute a factory reset. Could you help me to access to the firewall or reset it ? Thanks a lot !Have a nice day,Hamza

Hello, We are hosting a client on our infrastructure and have set up VDOMs as follows:  We use FortiManager and have created an ADOM that contains the client's VDOM. The client can manage their firewall rules autonomously. We have assigned them 10 public IPs and I would like them to be able to manage these autonomously as well. How should we proceed? Thank you for your help!

Recently fortisniff2.sys driver has caused multiple BSODs on our Win 8.1 computers when waking from sleep. We have tried to find the cause and ran into this which states different Forticlient driver, but is otherwise very similar issue: https://answers.microsoft.com/en-us/windows/forum/windows8_1-hardware/getting-multiple-bsod-since-upgrading-to-win-81/c84de019-e84e-494e-9ac1-848674e63755 Can someone from Fortinet comment on this please? We use registered 5.2.1.0605 clients. Thanks in advance, Ivan

Dear All,         I'm new in fortigate firewall, and i have a simple question would like to ask regarding on fortigate 100F firewall, and the firewall now are behind a internet gateway. i want to make use of the fortigatae to act a internal firewall, the wan port connect to dmz switch (192.168.81.0/24) and lan port connect to core switch (10.1.12.0/24), so that i can create policy from wan to lan, and lan to wan with security profile ? is this design look correct to you ? and if this look correct, can i use for example create a lan switch (name external) and add interface port 1 connect to dmz switch, and create another lan switch (name internal) and add interface port 10 and connect to core switch ? and create policy from external to internal and internal to external ? or i must use wan port instead ? and if the fortigate are in transparent mode it can not achieve above ? any help would be appreicated  Keith

Hello, I am trying to use our FortiManager to configure SAML (using Azure) for VPN access to our remote FGT's as a "break glass" means of getting access to our FGT should the FMG be offline or the HQ site is destroyed.  The idea is that we can VPN in to the remote FGT and then access the Admin console from the inside rather than have the Admin console facing the outside. I have entered all the Azure url's and certificate per what instructions I have found.  When I go to the VPN Settings and attempt to add the Azure user group I get this error. user/saml/azure/ : datasrc invalid. object: vpn ssl settings authentication-rule.1:groups. detail: <group name>. solution: datasrc invalid I have poured over the user group and I can find nothing that points me to what this error is referring to or how to resolve it.  I understand that the "datasrc is invalid" but I have not found the datasrc that is causing the issue.  I've tried following this link.

While connecting a remote machine(eg: ubuntu) from windows machine via connecting with forticlient vpn for accessing corporate network , it is not possible somehow to get connected to the machine. Please suggest or resolve this case. 

We are unable to reach remote VLAN however VPN seems to be up

Hi All, I need to restrict FMG-Access to a certain IP.Could you please advise if this is what I need?  Or this is the only way to restrict FMG-Access?https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-restrict-FMG-Access-FortiManager-Access-to/ta-p/295120 Thanks in advance.