Fortinet Community

using Administration login via SAML, custom keycloak  serverconfig system saml set status enable set default-profile "no-permission" set entity-id "http://xxxxxx:8443/metadata/" set idp-entity-id "https://yyyyy/realms/realm_a" set idp-single-sign-on-url "https://yyyyy/realms/realm_a/protocol/saml" set idp-single-logout-url "https://yyyyy/realms/realm_a/protocol/saml" set idp-cert "keycloak-IDP" set server-address "xxxxxx:8443"endThis always worked, but suddenly fortigate introduced `http_authd` in 7.6.4 and since then SAML admin login is broken.just tested in 7.6.5 but same problem, had to downgrade to 7.6.3 which works fine, though it has a bug where SAML admin sso login session can't open the web terminal.

Hi everyone,I'm currently working with the following setup:We have a FortiGate 100FPort X1 on the FortiGate connects via 10G to a stack of 2x Cisco CBS350X (on the Ground Floor).From there, there's an uplink via 10G to another stack of 2x Cisco CBS350X (on the Upper Floor).The reason for using the stack is to expand port availability, not for redundancy.Now, I want to replace the Cisco stack on the Ground Floor with 2x FortiSwitch 448E but leave the stack in the Upper floor. What would be the most sensible and correct way here?Can the 448E also be operated in a stack?Does it make sense to connect X1 and X2 to a 448E each? And to connect both 448E to the respective CBS350X on the upper floor?Thanks in advance for your help!

There is a vulnerability on 7.4.3 and the remediation is to upgrade to 7.4.4, however 7.4.4 does not include the free version.The release notes state that it does not include the free version as no feature updates were made between the versions but i've heard rumours that 7.4.3 will be the last free version ever.Will the 7.4.4 free version be released, or do those client need to be vulnerable until 7.4.5 is released and hope this includes the free version? Does anyone have any idea when this will be released?

Hi!I assume, that fortinac supports multiple AD directories.I have connected NAC to two separate AD domains(directories).Let's say(for example):Domain 1  is "domain1.local"Domain 2 is "something.domain2.local" Auhtentication is done with EAP (TLS) host certificates, so hosts are for example: host1.domain1.localandhost2.something.domain2.local dNSHostName is used as identifier, because we use only machine certificates Directories are synced normally and groups can be selected from Directory settings.Seems that Fortinac can search LDAP data only for domain1.local. (Group membeship etc) BUT for domain something.domain2.local LDAP queries don't work.(getLdapHost(), found ldapHost: false ) Is there a limitation, that only domains with 2 parts work?so:a.b domain works, but c.d.e not, because it has three parts? BR, A

Of course, "scanunitd" does not use 16 petabytes of RAM...

Hi,We have a fortimanager which connects to a fortigate. Whats the best way to create a read only account for the fortigate? Is there a way? If there's a best practices for this, happy to review it.We have an ADOM in fortimanager which manages all the firewalls. Thank you!TIA :) 

hello all,I have two Nexus 9000 switches connected via a vPC Peer Link. Two catalyst stacks are also connected to both NX's via vPC's. How can I be able to have redundant paths between the fortigate and the NX's? Do I set up a "hardware switch" with two ports on the Fortigate.. and then run one cable to NX1 and one to NX2? Do I need to vPC those? Obvious goal being if one of the NX goes down.. traffic will still go over the other one.  Thanks! Happy to provide more details if needed.

I found this article:Technical Tip: Enabling the JUMBO frames on the Fo... - Fortinet Communitywhich seems to be exactly what I'm looking for, except that the CLI commands which are offered, are NOT commands which are valid on the FortiGate, which from the title, is what we are dealing with.  So when FortiSwitches are managed by a FortiGate via a FortiLink interface, and you make changes to the switch config on the FortiGate, the FortiGate pushes those changes to the FortiSwitch, and overwrites any changes which have been made directly on the FortiSwitch.  So the changes offered in the sited article above are TEMPORARY!!.  Ignoring the fact that the person posting this couldn't be bothered to say what device the CLI commands are entered onto, it's still no help, because the changes the poster offers will be removed at some point when the config gets updated by the FortiGate. Please, PLEASE!  If you are going to offer CLI commands, for FortiSwitches, when t

I’m using Fortilink to manage switches from the Fortigate.  When searching to find the port for a device MAC I can dump the mac table using this command: # diag switch-controller switch-info mac-table This gives me pages and pages since I have 25 FortiSwitches on this system.  When I use grep and add the MAC, there can be one line for every switch that has this entry in its table.  I can tell from the output below that the device is on Port43 but no good way to tell which FortiSwitch in Foritlink. # diag switch-controller switch-info mac-table | grep 23:27MAC: fc:0f:e7:17:23:27  VLAN: 249 Trunk: _FlInK1_ICL0_(trunk-id 0)MAC: fc:0f:e7:17:23:27  VLAN: 249 Trunk: 8EPTF24001548-0(trunk-id 11)MAC: fc:0f:e7:17:23:27  VLAN: 249 Trunk: E24TF24002765-0(trunk-id 1)MAC: fc:0f:e7:17:23:27  VLAN: 249 Trunk: E24TF24002765-0(trunk-id 1)MAC: fc:0f:e7:17:23:27  VLAN: 249 Trunk: _FlInK1_MLAG0_(trunk-id 0)MAC: fc:0f:e7:17:23:27  VLAN: 249 Port:

Hey guys. I have 2 60F v 7.2.11 and I'm monitoring via Zabbix 6.0.4. We use the oficial template to fortigate and cluster. I'm having an issue with an HA cluster where Zabbix keeps alerting from time to time that an HA member is down, when accessing the firewall. Everything is fine and synchronized. I've already restarted the service, rebooted the firewalls, and still the HA alarm keeps triggering.The same template is used for other firewalls.

Installing the Fortinet VPN Client on a Windows 11 machine does not create a virtual adapter. Reinstalling the client does not resolve the issue either. I’m hoping that manually creating the virtual adapter will solve the problem, but I haven’t found any documentation on how to do this. Has anyone else encountered and resolved this issue?

i everyone, i want to configure https access to reach my internal web access. i have configured virtual ip, i used a port different of 443. my 443 port is used for another server. i use ssl inspection with the fortigate certificate on the policy, but i cannot show the certificate in the web browser . i have used a purchased certificate for the domaine url name , but i cannot see the certificate in the browser .

Hello Bro,               I have new deployment that include 1801F appliance and my question is that :Does this appliance supports Cisco SFP "TenGig" tranceivers ? which part-IDs ? I have Few Cisco ones such as "Transceiver 10Gbase-SR PID: SFP-10G-SR-S" and I want to use if supported.TIA to you all.

Hi, I have a new FG50G with 7.4.8 and I created on the Web GUI a LAG Interface to connect lan1 and lan2 to port 1/1/1 and 1/1/2 of aruba6000 Switch. Under the LAG Interface I created different Vlans with DHCP. Connecting to the aruba I dont get automatically an IP, also on the Web Gui, the LAG and the Vlans show Link Down. I connected both correctly and the Aruba shows VLANs on the Aruba CX 6000 are up and assigned correctly to the LAG so that the failure has to be on the FG side. I deleted the config and started new, creating the LAG Interface with CLI but when I configure and type NEXT, I get a a failure: Attribute 'vdom' MUST be set. Command fail. Return code 1 I dont use a vdom (FGT50G-7.4.8-FW-build2795-250523:opmode=0:vdom=0:user=admin) Is this a limitation on the FG model or my FortiOS so that I cant create a LAG Interface? Thanks and regards,

Hi, FortiManager Cloud - v7.4.7 build6767 I am trying to configure DHCP on one of our FortiSwitch VLANs. The VLAN uses a variable. The basic VLAN itself is fine and has been applied to a switch template and pushed to our FortiGates. variable = branch_numberVLAN IP Address =  10.${branch_number}.20.1/255.255.255.0 When trying to enable the DHCP server on the VLAN, I am unable to even close the Edit VLAN Definition page on the GUI. It comes up with the error dhcp-server/ip-range: Invalid IP Range.  If I remove the variable, it does accept the config and let me click the OK button. Its the same if I set the Netmask to 'Same as Interface Netmask' Thanks in advance!

I am having issues with my IPSEC VPN not working. What I have boiled it down to is, it looks like when I try to send a ping from my computer to the firewall (B) using the internal interface IP on the the other side of the VPN. The firewall (A) I am behind does not forward the packet to the wan interface.here is the flow trace filtered to the internal address of firewall (B). from the CLI of firewall (A)The VPN appears to randomly stop working. Sometimes after a while it works. id=20085 trace_id=25 func=print_pkt_detail line=5617 msg="vd-root:0 received a packet(proto=1, 10.0.0.83:1->10.2.0.254:2048) from internal. type=8, code=0, id=1, seq=18205."id=20085 trace_id=25 func=init_ip_session_common line=5787 msg="allocate a new session-1d680973"id=20085 trace_id=25 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-10.2.0.254 via StG"id=20085 trace_id=25 func=fw_forward_handler line=777 msg="Allowed by Policy-37:"id=20085 trace_id=25 func=ipsecdev_hard_star

AWS allows versioning for the Fortinet OWASP Top 10 - The Complete Ruleset.  Do all versions such as Main 1.13 and Main 1.14 have the same signatures loaded for the rules it protects e.g.    Web-Application-Injection-01    Web-Application-Injection-02    Web-Application-Vulnerability-Exploit-03To be specific there was a resent signature added for React2Shell, is this signature released to older versions 1.13 or 1.314 or only the current 1.15 ?Thanks

Hi support,  am currently preparing the deployment of FortiPAM for SSL VPN access. Today, users authenticate with username + password + a token generated by FortiAuthenticator. FortiPAM is also integrated with the FortiAuthenticator.My question is: how can I change the configuration so that when a user connects through the SSL VPN (username + password + token), the authentication is redirected to FortiPAM, and once inside FortiPAM, the user is not asked to enter the token again since they are already authenticated through FortiAuthenticator? Br 

Hello,  I just competed FSE1 and plan to work my way up. How do I claim my certificates? There doesn't seem to be some kind of automatic or straightforward mechanism. I have spent quite a bit of time looking. Thanks.

I have two FortiGate firewalls located at different sites, connected through ISP links as WAN. An IPsec tunnel is established between both firewalls. LAN subnets on both sides can reach each other and ping successfully. However, when I try to ping the remote LAN subnet from the firewall itself, the ping fails. The ping only works when I manually set the source interface on the firewall. I want to understand why the firewall cannot ping the remote LAN subnet without specifying the source interface. Please assist in identifying the cause and provide the required configuration guidance.

I have replaced the current firewall an old 50E with a new 60FSadly we could not use the config file from the old one. 1. I have setup VirtualsIP for our meters(we have meters that collects info for our building)2. And then i did a virtual IP Group, with all the meters3. Then i setup Firewall policyThe issue i have is that i cannot access the meters when i am on another network(over internet).Here is how i have setup the firewall, have i forgotten something. Must say i am not used to work with firewalls at all.

Hi Everyone, Hope you guys can help with this issue.Today, I imported a new CA certificate at D300 and lost GUI connection.I can access the firewall through putty so it is online.Please see the detail I found. I can see set admin-server-cert " " there is no certificate on it.Compared with another firewall and I  can see it is self-sign added.Please share if anyone has any ideas or suggestions. Thanks in advance!! ******* # sh sys gloconfig system globalset admin-https-ssl-versions tlsv1-2set admin-server-cert ''set admin-sport 443set admintimeout 20set alias "**************"set hostname "********"set ldapconntimeout 1000set log-uuid-address enableset proxy-auth-timeout 5set timezone 65set wifi-ca-certificate "Fortinet_CA"set wifi-certificate ''

Hi,on Fortigate 1100e (7.4.9) we set up an SDWAN like this  We would OpenNMS pinging a public ip (8.8.8.8) through the line of ROUTER1 and another public IP (8.8.4.4) through the line of ROUTER2. So we set up these policy routes: SOURCE         DESTINATION      GATEWAYOPENNMS      8.8.8.8                  ROUTER1OPENNMS      8.8.4.4                  ROUTER2 In static routes we have:0.0.0.0/0      SDWAN In SDWAN policy we have the default (selected members by source IP) When both interfaces WAN1 and WAN2 are up all works, but:If we disable WAN2 interface both ping worksIf we disable WAN1 interface both ping not workswhen both interface are up, traceroute show that the routes are correct  (the ping towards 8.8.8.8 choose WAN1 , while the pings toward 8.8.4.4 choose WAN2) Any i

We have Fortinet 600E Firewall in High availability configuration. Recently we have configured our new Fortinet manager in high availability with VRRP setup because both Fortinet managers are in different subnet and in different Geo location.After completing the Fortinet manager setup when I add my Fortinet Firewall in Fortinet manager (primary) everything looks good so in my next step I do a Failover of my Forti Manager and After Failover I notice out of my two one of the firewall show unreachable. I try to install a policy it fails. then I try to push the system configuration, now here when I try to push the system configuration a major issue notice that all my running traffic stop working and I am not able to access my firewalls. then when I take a console access to the firewall I notice my HA was break (On hardware also HA LED was off) both firewalls are in stand alone state. so I restart my first primary firewall and then my traffic became normal and the primary firewall shows pri

Which tags would be best if we have users with FortiClient + EMS that connect to our datacenter to our RDS cluster(s)?What is the best way to authenticate them? SAML SSO? Ztna tags? Certificate based?