Support Forum

Hi All, We are experiencing anomalous behavior with our FortiGate-3300E v7.2.7, build 1577, 240131 (GA.M). Specifically, when our clients attempt to access certain government websites, the firewall blocks the sessions for SSL, while allowing SSL_TLSv1.2 and SSL_TLSv1.3 protocols.The issue persists even after adding the websites to the override web filter as exempt and configuring the Application Control for Network Service to allow all. Please refer to the attached screenshot for more details.Your assistance in resolving this matter would be greatly appreciated. Omran MohamedBest regards, FortiGate  Application ControlForward Traffic LogsWeb Filtering

Hey everyone,I'm currently working on setting up SNMP monitoring for my network and could use some help. I have a VM running LibreNMS, which is already configured to monitor my FortiGate successfully. However, I'm struggling with configuring SNMP for my FortiSwitches that are managed by the FortiGate.Has anyone here done this before and can guide me through the process? Specifically, I'm looking for steps or tips on how to:Enable SNMP on FortiSwitches managed by FortiGate.Ensure that LibreNMS can discover and monitor these FortiSwitches correctly.Any help, resources, or pointers would be greatly appreciated!Thanks in advance!

Hello, Is it possibile use the let's encrypt certificate with web filter? The goal is to set up a web filter and configure overrides without installing the certificate on all clients. Would a self-signed certificate be better?

Hello everyone,Is CVE-2018-13379 applicable for FortiGate OS version 7.0.12 build0523? 

I am the Network Engineer for a 7 location Medical Imaging Company here in Leesburg Florida and have been in the position for a year and a half. The issue I am having is decommissioning a FortiGate 200D firewall and migrating it over to a 600E that have both been running in tandem at the same location. An Aruba Switch has static Ip routes going to both Firewalls. I am on attempt 7 to get this done and have had to roll back the configs on the switch and the 600E each time because I keep running into a couple of things that are not working depending on how and what physical connections I move from the old 200D to the new 600E as well as making the necessary route changes in the switch and because we only have a limited time frame to get it done between 4 AM and 6 AM and only on Tues, Wed,  or Thurs, before our doctor/s come into work and/or log into the VPN to read from home. I am also new to FortiGate Firewalls, the majority of my IT career has been working with Cisco Meraki Equipm

Hello everyone, While I was reading about IPS and how it is being used when in flow based for various security features, such as Antivirus, Web Filtering any many more. What I was intrigued about is the behavior when it is in proxy mode and I found a thread about it, but when I click on it all I see is "This Content was Archived". I can read the first two sentences of the thread from the google search, but it ends right when the person is explaining what happens in proxy based.  Here's the link: https://community.fortinet.com/t5/contentarchivals/contentarchivedpage/message-uid/72266  

Hello, everyone!I hope you are all doing great. Our company's Fortigate license has FortiCare Support included. The company through which we bought the license have been giving us poor support. I have been contacting them for weeks, but they have only answered my phone calls and messages a few times. They didn't contact me back except one time or so. What rights do I have against this company? It's a Fortinet partner, and yet we don't get proper support.They were better in the first few months, but they slowly started changing. Best regards, #fortigate #forticare

Hi all, We've got a number of sites using Fortigate 60E routers and they are connected via Hub and Spoke to our Head Office which uses a Fortigate 100F using BGP. There is currently no connection between the sites themselves across the HUB (that I'm told) so site A can't connect to Site B but Head Office can connect to both but I've been asked to allow a connection for CCTV (the CCTV is on the normal LAN.... no VLAN) from Site A to Site B which I can't seem to get to work in that as there are IPSEC tunnels from the sites to Head Office then do I need any static routing in place on any of the sites routers (although I've tried this) and where do I need Firewall rules (again I've tried various ones)? I've tried every combination that I can think of without success however there does seem to be a connection between site A and site C that was already setup as I can ping site C from site A but again I can't see ANY static routing or firewall rules in place for this so I can't see how t

Hi,I´m tring to integrate my Fortigates with an script.My script can add any already created address in an specific group, but I can´t find a way to remove only one address, all I can use is add just an address or change all adresses all at once. Any help would be appraciented.

Hello everyone,I am currently testing FortiClient EMS. When trying to set smtp server to STARTTLS a username and password field appears - well I do not have a username password because the mail filter gets verified with our external ip address (microsoft 365 mail connector).  Any workaround on this? (Having the same smtp server on my fortigate, I do not need username & password there but it seems to be mandatory in FortiClient EMS... ).

Hello togetherI encountered two problems with the ZTNA deployment.1. proxy policies can no longer work with Geolocations, i.e. as soon as Geo Location has been defined as the source, the proxy policy can no longer perform matches even though the IP in the database originates from Switzerland.2. if I have two defined tag groups on a policy (e.g. Windows tag group and Linux TAG group), it is also no longer possible to match a policy(tag selection in policy set to any).Have anybody already had experience with this?Thanks for your support and kind regardsFabian FortiOS 7.2.8FortiEMS 7.2.4 FortiClient FortiGate #ztna

Hi, I get errors when I want to add a device to Fortimanager.The devices are on the same network and have icmp access to each other. All outputs are as follows. Why am I getting errors, can you help me?  Manager # Request [dvm/cmd:dvm/cmd/discover/device ...:5825:2]: { "client": "dvm\/cmd:dvm\/cmd\/discover\/device ...:5825", "id": 2, "method": "exec", "params": [{ "data": { "host": "192.168.1.17", "passwd": "******", "usr": "admin"}, "target start": 1, "url": "probe\/device"}], "root": "deployment", "session": -1} Chkperm Response [dvm/cmd:dvm/cmd/discover/device ...:5825:2]: { "id": 2, "result": [{ "status": { "code": 0, "message": "OK"}, "url": "probe\/device"}], "session": -1} start_dmsvc_probe_device,788: dev_oid=0, host=192.168.1.17, flags=0x0 __enter_state,440: dev_oid=0, start check_reachable Start probe_dev.check_reachable ... __on_state,446: dev_oid=0, check_reachable, done, events=16 r=0 __enter_state,440: dev_oid=0, start start_probe_session Request [dmserve

Hello fellows, I have a problem with the DNS resolution of www.epicgames.com in particular. I have not yet noticed any other FQDNs. The following configuration at my home:Fortigate assigns an IP address to all LAN clients and is the local resolver and gateway, this is set via DHCP.My private Fortigate 61F (FortiOS 7.2.8) is (sometimes) not able to resolve this FQDN. Accordingly, the browser reports back that the domain could not be resolved (DNS_PROBE_FINISHED_NXDOMAIN).Same result when I try it with nslookup (** server can't find www.epicgames.com: SERVFAIL)It also does not work on the Fortigate itself (execute ping www.epicgames.com - Unable to resolve hostname.).However, if I use nslookup to query the server 9.9.9.9, for example, it works fine. It also works with the server 96.45.46.46 from Fortinet (both upstream resolvers). There are no security profiles set in the rules. What should I do, how can I find out what the problem is?After restarting the FortiGate, i

Hello, I'm testing a configuration using aggregate dial-up IPsec but I'm having trouble getting it to work. The thing is that in the IPsec Tunnels configuration the aggregate "Test" shows up in green, but when I create the static route in Network -> Static Routes it shows the aggregate "Test" as down in red. Did I miss something in the configuration that most be done to work? If I change the VPNs to IPsec site to site not dialup the aggerate shows up (green) in static routes. Can't use SDWAN because I used up all 512 members already.Fortigates have Firmware 7.0.15  Thanks for any help you can provide!

Hi, i'm using VIP to redirect traffic based on hostnames to my NAS  I'm using Origin Server Certificates obtained from cloudflare that also manages my DNS.  Anyway, i'm seeing this error while trying to visit the login page: The certificate is considered valid. Anyway in the logs i see a lot of accepted but timed out connections.Any tips?

HiI have created an event handler on FAZ to identify which IP is trying to download the virus and then created a stich on FGT to ban ip of that user, but it does not work when i try to downloaf eicar test virus. The screenshot is my FAZ configuration. Thanks.  

Hello everyone,I have a problem with the DHCP service no longer working after reconfiguring fortinac using the configuration wizard.I tried to restart it via cli but without success.Can you help me?

Hi, some months ago we changed from 100D to 100F HA (7.4.3). Sofar, no problem at all ;) but it happend like 3 times that our Zabbix reports for some time critical CPU utilisation (I think it marks critical if it is some min >75%). Than I log in to the FG100 and in the dashboard I see like 2-3% of usage in the last 6 hours.  We had the same Zabbix with the old FG100D and never got this message. Anybody any idea? Is this data real or a failure in the syslog? Thanks

I'm looking to see if there is a way on a FortiSwitch (version 7.4.2) to view the current rx and tx optical power level for the SFP module.We are having some unusual issues and am trying to figure out if I have a bad fiber or possible bad optic

Hello all, FortiPAM's Administration Guide describes that when a target is not reachable directly from FortiPAM, we can use the Gateway feature. FortiPAM can then use a FortiPAM, a FortiGate, or a FortiProxy device, to proxy the connection to the target. (see this link)FortiPAM's documentation is very explicit in showing the configuration needed for FortiPAM to connect to a target through a FortiProxy acting as the gateway. (see this link) But in my case, I don't have a FortiProxy available at the remote target's location. I have a FortiGate. And the documentation is not clear on what configuration should be done on the FortiGate. Can someone shine a light on what configuration is needed on the remote FortiGate device so it can act as a proxy for FortiPAM to connect to remote targets? Thanks in advance.

Hi I have this issue when im connected on wifi and try to RDP to one of my servers the fortivpn disconnects immediately, but when i have my lan cable connected it works perfectly fine i have a disconnect every now and then, but with the wifi it keeps happening.I have check my network nothing is being blocked on the network and we have other people connecting to the same server and they are not disconnecting.Is there a setting that might be blocking me specifically?

HI there,i am here to know that which forigate update is more stable and have less issues regarding preformance.

Hello, everyone!I hope you are all doing great. We have already implemented 3 SSIDs, one of which was supposed to be for guests only, with WPA2 Personal, and the other two were for employees and managers. However, since some employees had Android phones, which did not accept WPA2 Personal, we had to share the guest SSID password with them. The number of such users increased, and made it more difficult to ekep track of the users traffic, and the worst was that they also shared the password with other employees. I have also created another SSID for the residency building, but I have not shared it with the residents, except one for testing purposes. My question is, does Android have a solution for this? What should I do if I want to create a new SSID for the employees and residents with a new WPA2 SSID with same privileges as the guest SSID? Note: We have Fortigate-100F and multiple FortiAP-231F. Best regards,

Hello. I am quite new.I used Forticlient VPN only with a Centos 8 box with no problems.Yesterday I upgrade my box to Centos 9 and reinstall  then Forticlien VPN from the this rpm packagehttps://www.fortinet.com/support/product-downloads/forticlientas I did on my Centos 8.Unfortunately, although I have exact the same  configuration as I had on my Centos8, now I can not connect to VPN.Is there something I should concerned on Centos 9? Thank you in advance.

I have a FortiGate 100F on OS version 7.4.4. I have the Interface Bandwidth widget on my dashboard. When I have the timeframe set to 1 hour, I am getting granular detail, showing data points around every 10 seconds.    When I go to the 24-hour view, the data is aggregated to every 5 minutes, which is not useful. Is there a way to look at bandwidth usage more than 1 hour in the past but with finer granularity?  FortiGate