Support Forum

Hi,Got a bit of a weird issue with our EMS. Users are somehow generating a link that looks like data[:]application/9IZCADpxCi (random text follows) (without square brackets). I can see in our FortiAnalyzer there's a log for them looking up the "rating" of this URL, and it comes back as unrated (obviously, it's not a real, reachable or resolvable FQDN). I've tried exempting both data[:]application (without square brackets) and http://data/* from the web filter, which syncs from the FortiGate to EMS (as this is the URL that FC EMS actually logs as being blocked) but FC EMS is still blocking the URL locally on the user's device. I'm no expert with this stuff, but this seems like a URL used to access a local server/filestore or something like that? I'm really not sure, it's obviously not resolvable over the internet, I've run Wireshark capture and can see that my network adapter doesn't send a DNS query when I enter this URL into my browser. Any advice would be greatly appre

I want to download the FortiClient VPN software which version is 7.0.10.0396, how could I find the version. Also want to know could this version compatible with macOS 

Hi allI am supposed to configure OSPF peering between a Fortigate and a Meraki Hub (MX?). Unfortunately there is not much to configure on Meraki side (it has the correct ospf ID and an unique router ID and identical Hello and Dead timeouts). So I suppose I need to do that on my site on the FGT. Has someone an idea why the meraki does not show up on my neighbor list? Information I have:I made a new OSPF subarea ID (1.1.1.17) which is configured on Fortigate and MXThey are connected to the same LAN 10.x.x.x/23 and FGT can ping the MX (and vice versa)Both devices send out proto 89 packets to 224.0.0.5The LAN segment is on port1 of the FortigateI added that port1 as OSPF interface (which I guess is correct)The OSPF interface is on network-type broadcast at the momentThe OSPF interface (port1) is coming up as in area 0.0.0.0 instead of 1.1.1.17 according to "get router info ospf interface port1" (see [2])The reason might be, as the network 10.x.x.x/23 is already configured in

Dear all, good afternoon! All good? Recently we detected a behavior in our Fortigate cluster, where there are 3 boxes configured, and one of them presented a Not Synchronized error. When you see the HA screen, the synchronization error was due to "system.npu" . We noticed that in box 01 (which is operational), there is no configuration that exists in box 03 (problematic), which is a configuration line called "config np-queues" Could you tell me why this problem occurs?

Hello everyone, I have 4 FortiAP 431F (FP431F) with firmware v7.0 build0134, the issue is that memory usage increases with and without connected users. I restart them and they start with 38% of the memory occupied, after 3 or 4 days the memory reaches 93% usage which makes browsing slow when users are connected. I have to restart it again to free up memory and the same thing happens again. Do I have to update its firmware to a more stable version? Thanks!

hello we have just switch from watchguard to fortigate, and we are now fine tuning our policies :). - I have a standard flow policy for all traffic, with a webfilter and application control.LAN -> WAN  ANY SERVICES (webfilter + appcontrol)- i have block the game category on webfilter and application Now i have to authorize the Steam website only ; but block the Steam application. I try to put a webfilter override category for steam, but it's still detected by the app control. I have try to add this policy before to check only the web portsLAN -> WAN (HTTP+HTTPS) (webfilter + appcontrol).-> still no luck, going on the web page steam is detected as "Steam application". and is blocked. Any ideas to implement this rule ? thank'sI try to add another policy 

Hi Folks,I'm technical, but not an IT person.  It is less than once a year I need to do something with my Fortigate - so I always have a big knowledge refresh and ramp-up for any simple change.   I have a Fortigate 60F and two (2) Fortiswitches - a 108E and a 124D.  The 108E has servers and the 124D is family and household. My fortigate can see all of my FortiDevices no matter how I configure them ... My question is:  What is the better configuration?A) Connect 60F A -> 108E -> 124D (Daisy Chained switches)B) Connect 60F A -> 108E and 60F B -> 124D (Two switches off the firewall)C) Other? I don't care about redundancy or failover.   I was watching the guy on YouTube with the hair and it seemed like I should daisy chain, but 'm not sure.Thanks,TFPJ

We are in the process of migrating our VLANs from our core switch to our Fortinet 600Fs, While most aspects of the migration have been successful, we are experiencing difficulties with the integration to our mobility controller, where all our wireless access points are managed. has anyone else experienced the same issue?

Hi,Is it possible to downgrade my FGT 40F from version 7.2.6 to 6.4.6 directly and without any issues?Thanks 

3/11/2024: I've made some progress and have updated my original post below as needed. Thank you very much, @Anthony_E, for continuing to look for support! I know this topic has been covered, but I need help. I have a fortiswitch in a separate building from the main firewall and switch. I am trying to connect to that switch via fortilink, but each time I enable the fortilink-p2p on the REMOTE switch ports, my AP's go into a reboot cycle. Here's my configuration: FG100F(port12) <-> (port23 via fortilink)Fortiswitch(port 7) <-> FAP432F <-> FAP432F <-> (port2)Fortiswitch(port3) <-> clientThe VLAN for the APs is 10.The VLAN for the client is 20. Following these guides...Technical Tip: FortiLink over P2P wireless bridge/... - Fortinet CommunityFortiSwitch FortiSwitch Devices Managed by FortiOS 7.0 (fortinetweb.s3.amazonaws.com)Fortilink Managed Switches over Wireless P2P Bridge – J's Stuff (jsstuff.com)...I have done the below: Remote sw

Hello,I am trying to assign snat pool to virtual server. I am getting error message: "The source IP Pool is conflict from other virtual server.".Does it mean I can't use shared NAT source Pool for multiple virtual servers? Thanks for answer,Zdenek

Just getting started with FM, and I' trying to upgrade an AZ Fortigate from 7.4.3 to 7.4.4.The FG shows that 7.4.4 is an available update, but FM does not.If I go to the FG in FM, in Device Manager, and select the Upgrade Firmware icon , the dropdown for Available Upgrades shows nothing. "local images (0).Trying to solve this, I downloaded from the support site, and uploaded."FGT-VM64_AZURE-v7.4.4.F-build2662"  in FortiGuard -> Firmware Images.hoping that FM would see it.  No change. Even downloaded some of the other Azure images. They all show up there in "Local Images".  But do not show from the specific device in Device Manager.This is a new installation in Azure, and the FM was installed using the Marketplace. 

Hi,I need to know whether iBGP routes that learnt in FortiGate can be redistributed to OSPF by default or not?Because in other router like Cisco, iBGP can't be redistributed to OSPF by default, it needs command like 'bgp redistribute-internal' Thank you

Fortigate is blocking the website https://shop.meyco.eu/main/ : High Security AlertYou are not permitted to download the file "" because it is infected with the virus "HTML/RedirBA.INF!tr".URL https://shop.meyco.eu/main/Quarantined File Name [disabled]Reference URL https://fortiguard.com/encyclopedia/virus/8065247Virustotal shows an clean state incl. Fortinet.https://www.virustotal.com/gui/url/c798a22c5ab03d8c93c17795c08ca850cbdde956313717a9efcb4a417d89d05aI have already tried to clear the web cache and reboot the Fortigate like it is describte in this technical tip:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Scenario-on-FortiGate-Antivirus-false-positive/ta-p/216802But it doesn't help. What can we do else?Thanks in advance

How exactly do we look at the historical logs in FortiAnalyzer? Although 720 days of logs are selected, it shows a maximum of 400 days, what could be the reason for this?

Hi all,We want to use IPsec VPN, and we have some Debian users. We have tried to use the package "strongswan" but we haven't  succeeded to connect it. We want to use verification with ldap to authenticate and accept it.In our FortiGate we have this configuration:For the 1st phase:  For the 2nd phase: In our Debian machine, we have tried this configuration:In the ipsec.conf: In the  IPSec.secrets: In the updown.sh: Here, it's the test of our configuration: Do you have any idea about it? Ali

Hi,2 weeks ago I configured another syslog server from the CLI and it worked fine. Now I tried the same with the same information on another FG100F and I dont get anything at our local Greylock Server.>config log syslogd2 setting > get shows me on both sides the same information: FG_MASTER_XXX (setting) # getstatus : enableserver : XXX.X.98.58mode : udpport : 1514facility : local7source-ip :format : defaultpriority : defaultmax-log-rate : 0interface-select-method: autoThe rule on the FG in the DC is for all the same. What am I missing? Thanks 

I need to configure VXLAN in the presence of Fortinet configured with SD-WAN and multiple WANs. Resolved by following the community KB below: https://community.fortinet.com/t5/FortiGate/Technical-Tip-VXLAN-with-SD-WAN/ta-p/198690 

hi guys, How can i download forti-authenticator vm for evaluation? i got the demo ver from forti support but that seemed to be shared with same platform being used by multiple people. i do not want to use that to integrate with our setup as its not safe to do so. I need to integrate it if we are going to do any meaningful testing. so is there a way i can download a vm which works for a 1 month or so for evaluation purposes? thanks 

Hello,   I'm using FortiGate 60E, firmware v7.2.8. I have 2 internet connections in one of my locations, main and failover. I always set it up with the same distance in static routes, in this case, 10 and different priorities for each, for the main one for example 5, and the failover one 6. In this scenario usually both connections work at the same time, I can ping external IP addresses etc.The problem is when I set it up this way, the failover PPPoE connection doesn't work, it doesn't respond to pings and the failover connection doesn't even show up on the routing table despite adding it as a static route. It looks like the problem is only when it's a PPPoE connection, for others it works fine.The way to bypass it is to click the option: retrieve default gateway from server: It starts working, but you can only set here the administrative distance and it will supersede the main connection, which I don't want. But turning it on allows me to create a static route with

Hello,When I try to access the following website address https://alcservis.com/, I am blocked by Fortigate firewall because it is under the "Phishing" category. Why is this website address blocked under the Phishing category? This website belongs to a company we work with. I can access this website without any problems via mobile internet access or internet access that does not have FortiGuard service.I think the website address https://alcservis.com/ should be removed from the Fortigate Phishing category.I would like your help in accessing this address.Kind regards

Hello, I performed captive portal authentication on external server fortiauthenticator, and whant use a open wifi and restrict access for captive portal. config is ok, i think, but, after the login, before redirect to desirable URL, web browser show an warning mensage of insecure conection, and ask to accept the risk. shows URL http://<ip interface fortigate>:1000/fgtauth. this page present an fortiAP certificate. How to correct this for that warning mesage dont show?

received email to enable 2FA for logging in to fortinet support but the instructions not clear.the part to enable 2FA for sub users      If you are a Master Account Admin looking to enforce for 2FA for your sub users  Log  into https://support.fortinet.comb.    Select Services and then IAM.c.    Go to Account Settings and enforce 2FA. Once 2FA is enforced, all the sub users will get an option to select FortiToken Mobile or EMAIL to get one time code to login.When they try to login to their IAM account, the website will not allow them to proceed until they configure 2FA. 

Morning, I have two questions that i need help with, if anyone has an explanation please comment below. 1/ Can you know the FortiMail's mode only with a report log ? If so, what field you must check, with the explanation for each one of them ? 2/ In the access receive rule, in my knowledge the RCPT TO field has to be the protected domain to match the rule (like the Fortimail checks the RCPT TO field first then checks the MAIL FROM), my question is do you need an access receive rule for internal emails, ex : the protected domain is "Fortinet", MAIL FROM : userA@fortinet.com RCPT TO : userB@fortinet.com does this enveloppe need an access receive rule ? Thank you in advanceKind regards, FortiMail 

Hello,I create SSL VPN for specific user with tunnel-access enabled. The client can access the internal resources using forti client but the user not able reach to the internet.I already create security policy to allowing vpn client to access to the internet, the rule was hitting but the client still not able connect to internet. Anyone know why?