Recently active topics

Description This article discussesSite-to-site VPN configuration between AZURE and FortiGate. When Azure sends a ping to FortiGate then Fortigate responds and when FortiGate initiates the ping traffic Azure then it is dropped by Policy 0.   Scope   FortiGateSolution The traffic is being denied by policy 0 since the captive portal was enabled on the interface level.When the authentication is disabled on the interface then traffic will move from the correct policy.This is the error message that usually gets in the flow debug.   id=20085 trace_id=548 func=iprope_policy_group_check line=4367 msg="after check: ret-no-match, act-accept, flag-00000000, flag2-00000000"id=20085 trace_id=548 func=fw_forward_handler line=599 msg="Denied by forward policy check (policy 0)"   To resolve this issue, disable the captive portal on the interface or add an exemption or enable the captive portal on the policy level.Note:The above issue occurred in site-to-site VPN. It can be valid for

For FortiEdge Cloud, how do you assign different user accounts to have access to different networks?I believe this used to be accomplished using the Multi Tenancy license and sub accounts, correct?Since this can’t be ordered anymore and is going away, how do you do it using the new organization method?

 Looking for a reliable ICUANUTY coupon code to reduce the cost of your next display upgrade? The exclusive coupon code EBUBE gives collectors an additional 12% discount on a wide range of premium display solutions, including LEGO display cases, Formula 1 display frames, acrylic showcase boxes, and collector accessories.Activate Your DiscountUse the official referral link below and enter the coupon code during checkout:Coupon Code: EBUBEDiscount: 12% OFFOfficial Store: ICUANUTYUpgrade Your LEGO Collection with Professional DisplaysEvery LEGO enthusiast knows that building a collection requires both time and investment. Protecting those creations is just as important as building them. ICUANUTY specializes in display products designed specifically for collectors who want to showcase their models while keeping them protected from dust and damage.Whether you own LEGO Technic supercars, Formula 1 race cars, Star Wars sets, or Speed Champions collections, ICUANUTY offers elegant display opti

Good day everyone,I have been trying to look for this or googling it.However, one of our non-production firewalls was hit by this FortiBleed. unfortunatly the logging does not show much.I've gone through the firewall to see what exciting things was done. and I noticed the firewall has 13 administrator accounts now. (It's connected to FortiGate Cloud)Did anyone else experience that accounts was created? and any other things to look out for?Hope you could share some experiences!

Hi , would like to ask if there is a way to edit interface name on fortigate. In particular in configuration of 4 fortigates  with High Availability, where one is master other slaves. If in this configuration the method used to change interface name is to download backup configuration file of master FW edit the configuration file and load it with interface name changes, would this be a correct approach? Or maybe something should be done also on the slaves configuration? Or the best way would be to delate interface and re do it with the new name? Many thanks!

Description This article describes the FortiClient path lists to be excluded in third-party security applications and software, such as Antivirus, EDR, and XDR, when running the FortiClient/FortiSASE agent concurrently. The paths apply to both the FortiClient EMS solution and the FortiSASE solution. Scope FortiClient. Solution As a best practice, whenever considering running FortiClient/FortiSASE agent in parallel with other third-party security applications such as Antivirus, EDR, and XDR, it is suggested to configure FortiClient folder/file paths in the third-party security application's exclusion list.   This is to prevent any conflict and crashes, performance degradation, false positives and detection, and reduced effectiveness due to overlapping features when they interfere with each other's processes.   Paths to be excluded for MacOS:      /Library/Application Support/Fortinet/FortiClient/bin/fctservctl    /Library/Application Suppo

FortiGate 90G (FortiOS 7.4.12) - FortiClient IPsec VPN (7.4.3) Times Out, No UDP 500/4500 Traffic SeenI am configuring a remote-access IPsec VPN using the FortiClient Dialup VPN Wizard on a FortiGate 90G running FortiOS 7.4.12.Environment: WAN Interface (x1): 184.180.43.35/28 Gateway: 184.180.43.33 Dynamic DNS/FQDN: vpn2.dhansol.com FortiClient VPN Version: 7.4.3.4726 Testing from home Internet (external network) VPN Configuration: IKE Version 1 Aggressive Mode XAuth enabled User Group: VPN_ONSITE_USERS Client IP Pool: 10.10.70.10 - 10.10.70.99 Split Tunnel enabled VPN Policy created by wizard: Source Interface: DHN-ONSITE Destination Interface: VPN_VLAN50 Destination Subnet: 10.10.50.0/24 Phase1 Configuration: type dynamic interface x1 mode aggressive mode-cfg enable xauthtype auto authusrgrp VPN_ONSITE_USERS Verification Performed: WAN connectivity verified. FortiGate can ping Internet. vpn2.dhansol.com resolves correctly to 184.180.43.

Hello , can we do user based ztna web proxy with using local user of Fortigate local database with mac binding , mean ztna web proxy is opened with only same user with same mAc of machine , otherwise rejected 

Hi everyone,I'm trying to change the redirect IP address of the authentication portal on a FortiGate running version 7.4.12.I currently have a captive portal that intercepts user traffic and authenticates users via SAML with Entra ID.The issue is that after changing the IP address under: FGT_1 (auth-portal) # showconfig firewall auth-portal set portal-addr "10.0.0.1:1003"endand, of course, updating the SAML configuration on both the FortiGate and Entra ID, when a user tries to log in using the new IP address (10.2.0.1), the FortiGate redirects them to: https://10.2.0.1:1003/fgtauthHowever, the connection just times out, as if port 1003 isn't listening.If I switch everything back to the original IP address, the authentication works normally again.I inherited this firewall already configured this way, so I'm not sure if there's another setting I should be checking.Has anyone experienced this before or knows what else I should look at?Thanks in advance!

Hello.First, I apologize for my imperfect English. Recently, I started learning about networking using FortiGate.When running FortiOS v7.6.6, I configured IKEv2/IPsec VPN on a FortiGate 60F.At that time, the VPN connection worked correctly.However, after upgrading the FortiGate to FortiOS v7.6.7, the VPN connection stopped working.No VPN configuration changes were made between the upgrade and the failure.Based on the FortiGate logs and packet captures taken with Wireshark,I suspect that during the certificate authentication process,the intermediate certificate that should be sent from the server to the client is no longer being transmitted. After rolling back to FortiOS v7.6.6, the VPN connection started working again.I also confirmed that the VPN connection works on FortiOS v7.6.7when the R12 intermediate certificate is manually imported into Windows.This seems to indicate that the client is not receiving the intermediate certificate from the FortiGate during authentication.The follow

Hi all,I’m troubleshooting a remote access IPsec issue on a FortiGate 200F running FortiOS 7.4.12 and wanted to see if anyone else has run into something similar.When NAT-T is enabled, remote users get noticeable packet loss / stalls over the tunnel during normal traffic — pings, file transfers, throughput tests, that kind of thing. When NAT-T is disabled, it gets a lot better.A few things I’ve already confirmed:the tunnel comes up fine the issue is reproducible when NAT-T is enabled the issue improves significantly when NAT-T is disabled I tested with NPU offload both enabled and disabled with offload enabled, tunnel error counters were higher on the problematic tunnel with offload disabled, those RX errors were much lower or zero in my captures, but the user-visible stalls still weren’t fully explained by the lower-level counters PDQ snapshots looked balanced during testing HPE dropping stayed at 0 in the snapshots I collected anomaly-drop output was empty we also contacted our ISP a

Fortigate 40F firewall upgrade firmware 7.2.12 to 7.4.12 then firewall goes to memory conserve mode issue how to reslove

WAN1 STOPPED WORKING- I have two FortiGate 60F setups as stack (HA1 and HA2)- I have Juniper router - I have a Rogers modem with 2 public IP 187.x.x.x/30 and 184.x.x.x/30- link 1: Rogers modem port1 > FG60F WAN1- link 2: Rogers modem port2 > Juniper router- I also have a 2nd ISP (TELUS) for failover- WAN1 link shows Green UP in the GUI; WAN1 led light is blinking green/yellowProblem: WAN1 is not pulling the public ip whether in static or DHCPTS:- reboot the modem, connect my laptop with correct IP details used in FG60F (SM, GW and IP) = WORKING- leave Juniper plugged in = WORKING- turned off the modem for 10mins, removed the laptop, reconnected the FG60F = FAILED- Juniper still working- Replaced modem, reprovisioned and performed laptop testing again and still working. - Tried disconnecting Juniper from Rogers modem and leave only FG60F connected = FAILED- Internet works because of WAN2 (TELUS)Question:1. Why WAN1 not pulling the public IP? why there is no internet from WAN1? 2.

Based on the news by SOC Radar I have a customer asking what should he do. In spite of the news I was not able to find any, let´s call it official, comment from Fortinet.I had the customer to open a ticket.Has anyone any experience or knowledge of this Fortibleed?Thanks 

How to push Fortinac persistent agent to all Windows PCs using group policy on Fortinac 7.6 and also disable windows popup for credentials using registry keys ?

I passed my exam 7 days ago. I made mistakes with the registered email on PearsonVUE. I know know that was the problem. I should have used my company's email when I registered. I contacted Fortinet support to associate my FortiID but no response.https://ftnt.freshdesk.com/support/solutions/articles/73000524133 I contacted PearsonVUE, but they asked me to contact Fortinet. How? How can I reach Fortinet training support?They said I can create a ticket with them on the above link. But nobody is monitoring that ticketing system. Just wait for another 2-3 weeks? I need to provide it to my company. :( 

HI everyone i am deploying Hub and Spoke ADVPN BGP over Loopback Topology in Real Environemnt . After Deploy full configuration follow by Fortinett Documents i can see Spoke A can talk to Hub and Spoke B can talk to Hub but when Spoke A try to Talk to Spoke B it create Shortcut Tunnel but after shortcut they cannot talk to Each other... When i check in Spoke A routes for Spoke B it showing next hope Underlay/WAN not Overlay/VPN. same at Spoke B for Spoke A . can anyone know that in BGP Over loopback what could be the issue that Spoke to Spoke cannot send traffic via Overlay after shortcut?Port1 and Port2 are WAN Underlay Ports .Spoke-A-Dent # get router info routing-table allCodes: K - kernel, C - connected, S - static, R - RIP, B - BGPO - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area* - candidate defaultRouting table for

Hello everyone!I have a question: What is the difference between Fortinet Single Sign-On (FSSO) and Radius Single Sign-On (RSSO)? What are the biggest differences between them? In what situations should I use FSSO and RSSO? Can I combine both?If I want to use them for user authentication during VPN connections, which one is best?Thank you!

Hey guys,I'm failrly new to terraform and I was curious if fortigate managed app deployment within Azure vWAN is a good option/approach? Keeping in mind that rest of the infrastructure (vWAN, HUB/s, VNETs, NSGs, subnets..etc) is deployed using terraform, would there be any harm if NVAs are deployed manually?ps NVA deployment would be one time setup, no multiple environments (dev, prod, test) nor requirements for NVAs to be deployed more oftenEvery comment is appreciated 

in FortiGate troubleshooting, you already know diagnose debug flow is the single most useful diagnostic tool on the platform — and also one of the most intimidating the first few times you read its raw output. A live capture throws dozens of lines at you per packet, each tagged with a func= value that tells you exactly which internal processing stage that line belongs to.Enabling Function Names in Debug FlowBefore any of this is useful, you need function names switched on in your capture:diagnose debug flow filter addr <ip-address>diagnose debug flow show function-name enablediagnose debug flow show iprope enablediagnose debug console timestamp enablediagnose debug enablediagnose debug flow trace start 100 A quick clarification worth knowing: function names appear to be produced in the output regardless of whether show function-name enable is set, but Fortinet still recommends explicitly enabling it. The show iprope enable line is separate and important on its own — it reveals th

Hi, We have FortiPAM. We have our users who use SqlServer Mgmt Studio for connecting to database and they using windows integrated authentication. External users have also account and they connect the same while they are logged on some domain PCs. But sometimes external users need to connect from their own laptops which doesnt belong to domains. We created secret with sql template and ssms launcher and when they launch we see that SSMS is not run with user who can log choosing option windows integrated authentication and also login is failed because natively it using sql server authentication.Is there anyway to say fortipam agent when launch secret to run as different user ssms (using defined credential in secreet)? I see that is option With FortiPam 1.9 and FortiClient 8.0. I have PAM with 1.9 version but i dont see 8.0 version of PAM agent? Can someone help or give some idea how to enable users to connect to db?

DescriptionThis article describes the support for new MANA (Microsoft Azure Network Adapter) hardware for existing VM Size Families. The new hardware provides higher throughputs and lower latency, and is only supported on FortiOS v7.6.1 and later. Previous FortiOS versions 7.6.0 and below do not support the new MANA Network Interface.Microsoft plans to roll out the MANA NIC on legacy Infrastructure (Standard_Dv5 and lower). This change will impact all FortiOS versions below 7.6.1 that are paired with MANA NIC, and will cause the network driver to switch to the default synthetic path driver (NetVsc).The use of the network driver (NetVsc) can result in lower firewall throughput compared to the Mellanox ConnectX hardware equivalent.  Thus impacting the performance of FortiGate-VM deployed on Azure.Scope FortiGate-VM on Azure Cloud.SolutionTo prevent FortiGate VMs from being provisioned on MANA-enabled hosts, it is recommended to use the temporary opt-out mechanism (effective until May 31s

Hi Fortinet team,So, we are upgrading our VPN to the latest software version, and we are changing from SSL VPN to IPSEC VPN, and we are thinking to deploy it via Intune, but we have encountered failures when trying to install the package.We follow the next steps:Changed the encrypted Preshared Key inside the conf file for the actual Preshared key Create Installer.ps1 with the following command: Start-Process -FilePath "C:\Program Files\Fortinet\FortiClient\FCConfig.exe" -ArgumentList "-m vpn -f <"$ConfigFile"> -o import -i 1 -p <"ConfigPassword"> -Wait  Inside Intune we set up detection rule for the reg key: “HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FortiClient\IPSec\Tunnels\IPSEC VPN” The weird part is that if we try running the Installer.ps1 locally/manually it works perfectly fine and it imports the conf file without issue but if we runs it via Intune, it directly says Installation Failed  Can you please help us?

Can we use third party authenticator like google auth in Fortigate?

Currently using FortiToken for MFA on our fleet of gates and been looking at switching over to SAML via Entra to take advantage of conditional access policies + our ITDR against the accounts.Looking for other experiences to see if people are currently doing this and if they are any known issues or drawbacks to this change.