Unanswered questions

Hi,I would like to understand whether FortiClientVPNInstaller 7.4.3.4726 requires version 7.4.3.8758 to be installed in order to fix vulnerabilities.I’m using ManageEngine Patch Manager, and it says that I need to upgrade to version 7.4.3.8758. However, I cannot find this version anywhere.

Hey everyone,​I'm currently working on my PFE (Graduation Project) focused on deploying a Zero Trust Architecture using the Fortinet Security Fabric. I’m finalizing the deployment strategy for the FortiClient custom installer distribution, and I'd love to get some architectural feedback from the community.​The Goal: Securely distribute the custom installer generated in EMS to remote endpoints during an initial onboarding period, and then tightly lock down registration afterward.​The Environment: My core EMS server lives inside the secure Server LAN.​For both options below, the download page is protected by a FortiWeb WAF that requires Active Directory (AD) pre-authentication before a user can access the installer. However, given the recent high-severity vulnerabilities (like the 8013 auth bypass CVEs), I am highly paranoid about zero-days and expanding the internal attack surface unnecessarily.​Here are the two design paths I am debating:​Option 1 (Dedicated DMZ Server + WAF + AD Auth)

Hello,I’m facing an issue with EMS endpoint alert emails. The email includes a report link for full details, but when I open it, I get the following message:“Redirect Notice – The page you were on is trying to send you to an invalid URL.”Has anyone faced this issue before or found a solution for it? 

Hi,we have such problem that fortigate fortios 7.4.11 is blocking copilot.microsoft.com the error we get in the browser is:net::ERR_CERT_AUTHORITY_INVALIDSubject: Fortiguard SDNS Blocked PageIssuer: Fortiguard SDNS Blocked PageWhat we did:1.in DNS profile --> static filter we created:- wildcard name *.microsoft.com and allowed it-allowed regex .*bing\.com-allowed regex .*trafficmanager\.net2.In the deep ssl inspection profile, we created the exempts:-wildcard *.microsoft.com-wildcard *.bing.com-*.trafficmanager.netBut all the time, this site is blocked by SDNS, any help?

Fabric contains a FortiGate cluster and managed FortiSwitches for internal and external purpose. Is there any solution to shut down all the devices from the downstream connected device such as a desktop. As per my understanding, the challenge is the FortiGate is the brain here. so I am facing a chicken and egg problem. Please let us know if there is a good solution for this. Thank you

Does the fortigate consider a specific configuration for SAP Cloud . Cisco ASAanything or changed the parameter.IKEv2  

I am experiencing recurring FortiGuard DDNS failures causing VPN outages. Our FortiGate-100F (v7.2.12 build 1761) cannot update DDNS when our dynamic PPPoE IP changes.Issue:GUI shows "Unable to load FortiGuard DDNS servers list" error DDNS updates fail intermittently When IP changes, DDNS doesn't propagate new IP to public DNS Remote VPN users cannot connect via hostnameDebug output shows root cause:Certificate verification failed, error 62 (hostname mismatch) depth 0 Expected: ddns.fortinet.net Received: CN=sdns.fortinet.netFortiGuard DDNS servers (173.243.138.226) are presenting certificates for sdns.fortinet.net instead of ddns.fortinet.net, causing SSL verification to fail? Impact:Second VPN outage in 4 days Every IP change requires manual client updates Production access affectedTicket opened since May 21 - support has not addressed the certificate mismatch issue shown in debug logs.Is anyone else experiencing this? Is this a known FortiGuard infrastructure issue? Any workarounds

I have configured the following in a new Active-Passive setupUnit A (setup as Active 120 HA) - mgmt IP address 10.1.1.5/24 (set management ip and dedicated-management)Unit B (setup as Passive 115 HA) - Mgmt IP address 10.1.1.6/24(set management ip and dedicated-management) HA on both group ID 1tracking port2“port2” configured on both units as IP address 10.1.1.10/24 Both units are only pingable sometimes, MAC flapping messages appear every 5 seconds on both Arista switches setup as a MLAGBoth units have the same virtual MAC address (get hardware nic mgmt) other units I have setup exactly the same a-p, have different mgmt MAC’s between A and B! If I remove the group-id from Unit B, everything works, both units pingable and accessible. When I add the group-id back into Unit B,  problem persists. I have even changed the group-id on both from 1 to 256, same problem.  How can this be, I have checked pretty much everything but obviously there is sometime I am missing? Thanks all for any inpu

I got a FS108D from work nothing crazy about it. I created a VLAN on it but after I did that it doesn’t show anything else on the page I inspected the browser and it says 500 Server error. It has 8 ports and I want to create some VLAN for my devices.Whats is the issue here? 

We migrated the FW from SonicWall to Fortigate 201G  after completing all configuration it’s working fine but the SAP tunnel having issue on migrating time we resolved it, but after 1 week facing flapping issue continously . Using ikev2 and pfs disable as recommended by SAP cloud.Also we are using separate subnets in phase2. Attached VPN logs.Our device Fortigate and SAP device Cisco ASA  Kindly recommend if any things need to be check on Fortigate.current version fortiOS v7.4.11 build2878 (Mature)

Hey everyone,​I'm currently working on my PFE (Graduation Project) focused on deploying a Zero Trust Architecture using the Fortinet Security Fabric. I’m finalizing the deployment strategy for the FortiClient custom installer distribution, and I'd love to get some architectural feedback from the community.​The Goal: Securely distribute the custom installer generated in EMS to remote endpoints during an initial onboarding period, and then tightly lock down registration afterward.​The Environment: My core EMS server lives inside the secure Server LAN.​For both options below, the download page is protected by a FortiWeb WAF that requires Active Directory (AD) pre-authentication before a user can access the installer. However, given the recent high-severity vulnerabilities (like the 8013 auth bypass CVEs), I am highly paranoid about zero-days and expanding the internal attack surface unnecessarily.​Here are the two design paths I am debating:​Option 1 (Dedicated DMZ Server + WAF + AD Auth)

I have requirement to use one SSID for employee and guest, the employee will use EAP-TLS for authenticate and if authentication failure because the client no have certificate then the endpoint will access to guest network.This was done for wired connection (employee and guest) but on wireless connection only employee was work, if the wireless client not have certificate then the client is asked to enter the username and password. Anyone know how to achieve this? 

Hello everyone,Is it possible to configure webhooks in FortiSIEM using a different application type?I wanted to know if FortiSIEM can create or add a new application type outside of the normal selections since I want to use webhooks to integrate a custom application or device.If anyone has experience with this setup or knows the recommended approach, I’d appreciate your guidance.Thank you!Ghada

Environment: FortiGate VM v7.6 Lab environment, no actual WAN connectivityBackground: I have configured static routes using Internet Service (ISDB). FortiGate internally treats these as policy-based routes. I also have a link-monitor configured with update-static-route enable, update-policy-route enable, and update-cascade-interface enable.Expected behavior: When the link-monitor detects a failure, I expected the ISDB-based static route to appear as flags=0x8 disable in the output of diagnose firewall proute list, which is the same behavior described in the official documentation for standard policy-based routes.Actual behavior: When I simulate a link-monitor failure, manually configured policy routes (config router policy) correctly show flags=0x8 disable as expected. However, the ISDB-based static route continues to show flags=0x0 with no change.Output of diagnose firewall proute list after link-monitor failure:id=2113929218(0x7e000002) static_route=2 dscp_tag=0xfc 0xfc flags=0x0 tos

I have guest ssid on the cisco wlc9800 and if there are user want connect to this ssid then the user will authenticate by captive portal with entra id.After the authentication successfull the client should be move from isolation network to guest network, in my case the client was moved to guest network if i see from fortinac policy but the client itself still connect to isolation network.Already ask to cisco support then they said the cisco not receive the coa to change the vlan. Anyone know here how to change thje vlan to teh cisco wlc9800?

We have policy to allow all servers access to microsoft then i have a firewall policy and set the destination to all microsoft internet service.However i found some microsoft url still blocked by implicit denied and this mean microsoft internet service not contains all microsoft url. Anyone know how to solve this?  

I got a FS108D from work nothing crazy about it. I created a VLAN on it but after I did that it doesn’t show anything else on the page I inspected the browser and it says 500 Server error. It has 8 ports and I want to create some VLAN for my devices.Whats is the issue here? 

Hi,I am looking at using a small FortiGate setup on Azure for lab practice. I have found this to be relatively simple and looks like I can use the PAYG model to simply create a VM and use it.What I am struggling with is FortiManager, all the guides indicate a BYOL licence is needed, but during the setup it gives the option for FortiFlex which looks to be the right idea but I have no idea if I can buy a small number of points anywhere or do PAYG… Also this marketplace item exists and I am not sure if this is what I should be using as a way to pay all through Azure? Fortinet FortiFlex Usage-based Licensing - Microsoft AzureI can see this has a purchase option which then gives an option of 1,2,3 years but also it gives the create option which does create a VM?

HI All I need to get some guidance on how we can deploy below network Firewall HA ( 2 LAN port1 and port2 in same hardware switch), Port 1 on both FG connect to cisco switch 1 and cisco switch 2 respectively. Port 2 on both FG connect to cisco switch 1 and 2 respectively alsoCisco Switch 1 and 2 also interconnected(trunk port). Cisco runs RPVST+. Switch1 runs as STP root primary, Switch 2 runs as STP root secondaryAbove topology eventually create loop network. How should it be configured to avoid the loopFortigate hardware switch if disable STP, it eventaally create loop, and broadcast storm starts. Enable STP on FG hardware , eventually the  broadcast stops.  But i found some weird result. When i check Switch2 STP, it blocks the port connect to FG1, but port connect to FG2 becomes root, and forward state. Switch2 can still somehow reach FG IP, the mac-address also shows it learned from port to FG2. But FG2 runs as HA passive state. i try diagnose sniffer on FG2, nothing captured. How

I'm struggling a bit with my performance SLAs and SDWAN Rules. My typical branch office will have 2 internet connections, one is usually better than the other (i.e., Verizon FiOS plus Comcast or true DIA Fiber plus a business broadband).What's the best-practice strat for SDWAN rule? I've been mostly relying on Best Quality rule with a performance SLA that pings Google DNS (8.8.8.8), but I'm seeing more flapping than I would expect.I think my first question is: Do the Performance SLA settings under Link Status (Check Interval and Failure before inactive) affect the SLAs themselves? If I have my latency SLA set at 250ms, is the interface in violation of the SLA the first time if sees latency greater than 250ms or if my check interval is 1000ms and failure before inactive is 5, does it take 5 seconds of 250ms latency to violate the SLA?Any best-practice recommendations on these rules and Perf SLAs? I'm starting to think that Google DNS might not be the best candidate host for my probe. Do

I setup a lab environment with a FortiGate evaluation. All good… I needed to blow it all away and start again… I can see the asset in my portal, and I can download the lic file, but on a new install it does not accept it and gives me: Am I missing something here?

Why oh why does Fortinet make all this so difficult, it seems like they actually don't want people to even use the trials… I finally have a FortiGate trial VM and a FortiManager trial VM, but can I get them talking? No! Lots of commands that are no longer valid etc... FortiManager reports a probe fail, from online searches, I have tried lowering the encryption settings and allowing VM registration on the FortiManager. I have tried registering from the FortiGate side also.Now it transpires that my FortiGate trial VM does not have the right factory cert because it is does not contain the serial of the virtual appliance, just a generic "Fortinet". I have tried regenerating the certs, tried re-execting the VM commands but it does not accept them either… To be honest it feels like a battle just to make the trials work, which is hardly a good starting point.

I had automatic updates turned on on my fortigate 60F. After Installation of OS 7.4.12 none of my VPN-Clients were able to login anymore. No idea why. Reverting to 7.4.11 resolved the problem. Does anyone have an idea what exactly caused the problem? I am not an fortigate expert but that a minor update to the os breaks a basic functionality, at least on my device, doesnt make me happy. First thing i learned was turning off automatic updates. But thats not a longterm strategy.  

Hi,One of my clients have sip traffic passing through firewall. When we view forward logs firewall shows lots of logs with "0 Bytes sent/received". What does it mean?. 

Hi all,I have struggled with the above but now have this working on a 61F.However there are a few bits I am still struggling with that I am trying to work out if they are a limitation of Windows or how I am configuring…I need an IPSEC VPN with split tunnelling without requiring:Free Fortinet VPN client due to lack of admin rights External RADIUS/AuthenticationI have got this working using Machine certs as I believe the Windows client requires the use of EAP-TLS for a user account based tunnel which the FortiGate cannot directly achieve by itself?Once I got this working, I then wanted to enable split tunnelling, Windows appears to need DHCP option 249 to send over these routes, but also needs mode-config to assign the IP.I have tried to create a DHCP server on the VPN interface, dummy DHCP servers on loopbacks etc, but cannot seem to get this part working… is it even possible? If I change the IP address mechanism by specifying DHCP the client connects but never gets an IP, unless I enab