Fortinet Community

greetings all,here is the topology. let's focus on the left part. MPLS router is a Cisco router, the left L2 switch connected to MPLS router is FortiSwitch (108F).we occasionally lost MPLS connection, and we did see there are some input drops on port 2 (blue arrow pointing to it in the above diagram) of the FortiSwitch (left  L2 switch in the above diagram). see below screenshot.vendor engineer recommended to replace the cable between the mpls router and the left L2 switch. Yes, of course we can do it, but may I know what's the common reason for input drops. MTU on MPLS router is 1500 by default, I don't think this is the problem.Thanks a lot!

This is a weird one. When Forticlient is installed on an iPad, the current update filesize is 12.16Gb. When Forticlient is uninstalled, the iPad only tries to download 3.6Gb. I'm assuming that what's happening is, for some reason, Forticlient changes whether the iPad can use the full update or just the incremental update, but I have no clue as to why that would be the case. Has anyone run into this before?

i have fortigate v 7.4.3  and i see that i use high outbound bandwith and this is not correct their is no one use this value   does it related to update my fortigate

I need to know EOS for FG 3000D

HiCustomer have web connection to local server and I get following error:Profile defaultAttack Name HTTP.URI.SQL.InjectionAttack ID 15,621Reference https://fortiguard.fortinet.com/encyclopedia/ips/15621Incident Serial 73,033,816Direction outgoingSeverityHighMessage web_misc: HTTP.URI.SQL.Injection It seems that Firewall discovers and block malicious access.Now i disable ips on policy rule.How can enable it on this specific server?  

We currently have a dial-up SSL VPN configuration that requires a user to connect using both their Windows AD (LDAP) credentials AND a local computer certificate issued from our internal Windows CA.  On top of that, we use FortiToken with push notifications for MFA on the LDAP user accounts. With the recent push to migrate away from SSL VPN and switch over to using IPsec IKEv2 VPNs instead, I have not been able get the same requirements to work via IPsec. Our setup includes:FortiOS – 7.4.8FortiEMS – 7.4.3FortiClient – 7.4.3FortiToken  Subscription (not cloud)Windows NPS for RADIUS (not FAC) Is this even possible with the above?  Seems like it is supported, but I can not get it to work with NPS. According to the article below, I should be able to get FortiToken MFA push notifications working using local RADIUS user accounts:https://community.fortinet.com/t5/FortiGate/Technical-Tip-IKEv2-Dialup-IPsec-tunnel-with-RADIUS-and/ta-p/220818 …but as soon

I have been making no progress on this for weeks now.  Using FortiClient 7.4.4 I am unable to successfully configure an IPsec IKEv2 remote VPN connection using LDAP machine certificate (not a user certificate) authentication.  We have an internal Windows CA.  All clients have a Machine certificate issued by our internal CA with an EKU for Client Authentication and the FQDN set in the certs subject name (ex:  CN= ComputerName, OU=Computers, DC=domainname, DC=local) in their local computer personal store.  All client machines also have our internal CA’s root certificate in their local computer Trusted Toot Certification Authority store.  The FortiGate has a server certificate installed that was issued from our internal CA (appears properly in the FG Local Certificate store) and it also has our internal CA’s root certificate (appears properly in the FG Remote Certificate store). All of the Certificates mentioned above are still valid and not expired.&nbs

Hey forum. Real life issues has risen in our short time with fortigate and IPsec.Boss man had issues connecting to the VPN while at a car dealer. Tried on the old ssl Palo Alto and connected right away.How is the issue of many places block IPsec traffic? I think we had our marketing guy get blocked at hotel but he didn’t complain until he came back.

In the device edit section, there is a place to enter the FortiGate user and password.Why is this item needed?The OS of FortiAnalyzer is v6.0.8. https://docs2.fortinet.co...ing-device-information

Hi Team, I am facing the issue where dialup vpn ipsec tunnel is not coming up while another ipsec tunnels are up via same wan connection. When i am debugging at dialup server site - below is the error message.from Dialup Server ( Responder)mmm-tt-tmes-rvm-01 # 2025-12-03 13:36:51.231140 ike V=root:0:ISP2_MGMT:1188888: negotiation timeout, deleting2025-12-03 13:36:51.231237 ike V=root:0:ISP2_MGMT: connection expiring due to phase1 down2025-12-03 13:36:51.231247 ike V=root:0:ISP2_MGMT: going to be deleted2025-12-03 13:36:51.519365 ike V=root:0: comes 65.12.12.75:500->48.12.12.74:500,ifindex=6,vrf=0,len=341....2025-12-03 13:36:51.519408 ike V=root:0: IKEv2 exchange=SA_INIT id=fc1507345c5cadc2/0000000000000000 len=3412025-12-03 13:36:51.519416 ike 0: in FC1507345C5CADC200000000000000002120220800000000000001552200003800000034010100050300000C01000014800E01000300000802000005030000080400000E030000080400001300000008040000152800008C00150000010F39F1C50804667975B4ED9FCA8E2EAC4809C3330

since we upgrade our fortigate from 7.6.4 To 7.6.5 we have problem to access the vpn from android clientdh-group configured is 14 and aes128 sha1 we have the free version of forticlient

HI EMS adminsI have an EMS installation (VM deployment) initially was at 7.4.3.When I updated it to EMS 7.4.4 I was able to create FortiClient 7.4.4 package installer.Then when I updated it from EMS 7.4.4 to EMS 7.4.5 it doesn't propose to create FortiClient 7.4.5 package installer. It still propose only 7.4.4 and lower.For info all required traffic to internet is allowed and we can't find any denied traffic in firewall logs.Also I waited more than 24h after the update operation but still the same.Any hint?

Hi all, I just have a very simple port portward config for my wan:8888 to my Lan Web server:80 There is nothing special on that webserver, what just a page to say "Hi". Even is no HTML coding. My Firewall policy for this server like below: config firewall policyedit 13set name "Incoming-NAS-Web"set srcintf "virtual-wan-link"set dstintf "Lan"set action acceptset srcaddr "all"set dstaddr "VIP-NAS-T8888"set schedule "always"set service "ALL"set utm-status enableset inspection-mode proxyset ssl-ssh-profile "CA"set logtraffic allset webcache enablenextend The port forward is: config firewall vipedit "VIP-NAS-T8888"set mappedip "172.30.0.2"set extintf "wan1"set portforward enableset extport 8888set mappedport 80nextend Why my webcache keep 0 hit in this case? 

Dear team, I'm stuck with an error message: gw validation failedI'm using strongswan 6.0.2 on Linux.I'm able to communicate with the FW, but it seems that something is not recognised or misunderstood communication between the client and the server.swanctl.conf :connections { fortigate { version = 2 proposals = aes256-sha256-modp1536,aes256-sha256-modp2048,aes256-sha1-modp1536 local_addrs = %any remote_addrs = 192.168.14.250 fragmentation = accept mobike = no send_cert = always local-pkcs11 { auth = pubkey round = 0 cert { handle = 040840f509340ed8a314 slot = 0 } } remote { auth = pubkey id = 192.168.14.250 } local-eap { auth = eap-mschapv2 eap_id = tdupont round = 1 } children { net { local_ts = 0.0.0.0/0 remote_ts = 10.226.2.0/24,10.226.3.128/25,10.226.4.80/28,10.226.20.0/24,10.226.101.0/28,10.226.130.0/24,10.72.10

When trying to login to our Fortimanager trial version with a Forticloud account I get:Response validation failed. SAML response rejected I followed the outline of document and verified I have the right permissions and am using an IAM account in the same tenant.https://community.fortinet.com/t5/FortiAnalyzer/Troubleshooting-Tip-FortiCloud-SSO-login-error-Response/ta-p/320401 This feature should work, even with a trial license right?

Hey forum. Real life issues has risen in our short time with fortigate and IPsec.Boss man had issues connecting to the VPN while at a car dealer. Tried on the old ssl Palo Alto and connected right away.How is the issue of many places block IPsec traffic? I think we had our marketing guy get blocked at hotel but he didn’t complain until he came back.

Model: ForitGate-50GI would like to assign the same IP range subnet to between physical interface and internal wifi interface:Lan 1: 192.168.1.1/27internal wifi: 192.168.1.1/27 by default system be return warning msg some Lan1 or wifi interface subnet used. as above case, does it should be add a FortiAP or switch device to solve it? 

Hello Everyone,We are currently working for a pretty “gigantic” client in the Middle East, whose final request is to route, and apply security policies to the Customer support department before we finish the implementation and contract.I dont have any experience with routing networks with heavy SIP usage through firewalls, especially NGFW with security features enabled. Now, the technical part… So the branch office has it’s own 100G box, which is not connected via SDwan and will not be since it is completely separated by the main network. The end-user devices will pass through the firewall, while the Cisco call manager servers will remain routed via the dedicated router. The end user devices have a “virtual phone” installed, and communicate with these servers to provide support to customers. Judging by the numerous issues we have encountered with more sensitive protocols, we suspect SIP will be the same. I want to ask you, fellow members, for any tips, tricks and guides you can provide

Redirect after Captive Portal not redirecting not working with www.google.com. its a simple setup. users getting authentication page. they enter username and password. but its not redirecting to url we set redirect after captive portal field. what could be the reason captive portal has setup under ssid. we have fortiap and fortiswitch in this setup fortigate 121Gversion 7.4.8 

Dear All, Description - I have two IPsec tunnel interfaces for the same destination, want to give preference tunnel 2 over tunnel 1.I have two IPsec tunnel interfaces which is the member of SDWAN ZONE. I wanted to give preference tunnel 2 interface for the same destination with using priority inside the static route.  but did not get preference tunnel 2 over tunnel 1.If I use SDWAN rule to give preference tunnel 2 interface over tunnel 1 interface. it is taking tunnel 2 interface to forward the traffic for the same destination. but when I use route priority inside the static route then preference is not getting to tunnel 2 interface. I just want to confirm with you all if any IPsec tunnel interfaces are member of SDWAN ZONE cannot be used route priority to give the preference  over other tunnel.Instead of we can use SDWAN Rule to give the preference over another tunnel.  Also please share source of knowledge if related it.a Thank you all.  R

Hello Community, I am facing an issue with FortiNAC policy matching and VLAN enforcement.Environment:FortiNAC FJuniper switch (dot1x authenticator)Current Behavior: On the switch, the session is shown as Authenticated via RADIUS. VLAN assignment only works when I manually force the Registration or Authentication VLANs.However, FortiNAC displays the following:Auth Type: MABNo policy matchedThis occurs even though the Network Access Policy is configured with:RADIUS Auth Type: 802.1XGroups: UsersGroupLocations: AnyObservations: MAC-RADIUS is enabled on the switch interface. Although the device is configured for 802.1X authentication and FortiNAC correctly learns the user identity (DOMAIN\username), FortiNAC does not seem to classify the session as 802.1X, only as MAB. Port Group Membership shows Role Based Access is enabled, but no policy hit is recorded. What checks or actions can be performed to resolve this classification issue?

Hello Everyone,We are currently working for a pretty “gigantic” client in the Middle East, whose final request is to route, and apply security policies to the Customer support department before we finish the implementation and contract.I dont have any experience with routing networks with heavy SIP usage through firewalls, especially NGFW with security features enabled. Now, the technical part… So the branch office has it’s own 100G box, which is not connected via SDwan and will not be since it is completely separated by the main network. The end-user devices will pass through the firewall, while the Cisco call manager servers will remain routed via the dedicated router. The end user devices have a “virtual phone” installed, and communicate with these servers to provide support to customers. Judging by the numerous issues we have encountered with more sensitive protocols, we suspect SIP will be the same. I want to ask you, fellow members, for any tips, tricks and guides you can provide

Hello dears! I have been struggling to find a solution for my problem! by mistake I have activated the two way authentication token on my fortigate dashboard and I have only one account admin no backup account and no backup configurations as well ! I have tried to access through SSH. & serial port it keep asking for the token ! on mobile token I could generates the code but on dashboard it says that authentication failure ! 

Current Setup:I have configured FSSO with FortiGate.By default, when defining users in a firewall policy using FSSO, I have to select users via CN (Common Name) rather than sAMAccountName.To resolve this, I created a User Definition on the FortiGate with the type Remote LDAP. This allows me to define the user in the firewall policy using the sAMAccountName. Observations:In my testing, this works well. When a user logs in/out of Windows, FSSO detects the event and sends the log events to the FortiGate.Even if a user changes their IP while logged in, FSSO detects the new IP and updates the FortiGate.Overall, the tests are successful. Questions:1. Because I cannot find any official documentation supporting this specific configuration. Are there any hidden risks?2. Is this feasible for a production environment?3. Can someone explain the mechanism and the difference between this and the standard configuration?

We've been working with private cellular, and one of the requirements is that SCTP be sent over the network. With a 60E or 60F, there are no problems. With a 90G, we aren't seeing the COOKIE-ECHO packets, at all. Put a 60F in, we see them in a packet capture, put the 90G back in and they don't show up.Has anyone been successful in getting SCTP to work with a 90G?