Fortinet Community

Hi Team Is there any best practice for deciding Scan for Vulnerabilities need execute Event-based scanning or Scheduled scanning.  

I'm using IPsec VPN with FortiClient 7.4. I've configured two IPsec VPN servers (primary and backup) and deployed the settings to clients via FortiClient EMS. However, during usage, the connection to the primary server consistently drops every 30 to 60 minutes, while the backup server disconnects even more frequently and irregularly.All components are running version 7.4, and there’s no packet loss between the public networks involved. This issue affects all users in our environment.Has anyone encountered this behavior? Any suggestions on how to troubleshoot or resolve it would be greatly appreciated.

I use my FortiAnalyzer (7.4.8) as a "poor man" syslog server and am trying to see if I can incorporate logging from Cisco Umbrella. Cisco Umbrella only sends to AWS S3 storage and I have the path and keys for said bucket. I saw where FortiSIEM has said functionality, but I don't own that product... so seeing if there is a way to handle this via FortiAnalyzer in any form or fashion. This might end up being my final push point if it cannot, to go with something more dedicated as my new syslog platform.

We have our Fortigate firewalls configured for Syslog offloading to Cynet.  We are then trying to take action, to block IP addresses of users trying to brute force VPN credentials.  We are using a script provided to Cynet by Fortinet named Fortigate-Remediation V0.2.exe, and when it tries to block an IP address, it is getting back "Max retries exceeded".  Any chance anyone knows what the fix for this is?

Hi all, Could I use the FANT-5IN1-TG-5M-FEV antenna with the FortiGate 50G-5G? Thanks a lot Best regards,

Hi everyone,I built a small public-facing web app that calculates Air Force PT scores using the latest standards. The site is fairly simple (just data inputs, PFT calculations, and score outputs), but I want to make sure it's properly secured since it’s starting to get more traffic.I’m running it on a cloud VPS and have a FortiGate VM set up, but I’m not totally sure if I’m configuring things correctly for this type of lightweight tool. Specifically:Do I need full Web Application Firewall (WAF) features for something this small, or would basic IPS + URL filtering be enough?Are there recommended settings for protecting simple form-input sites from script injection or bot traffic?Should I be using any FortiGate-specific features to handle potential spikes in traffic or prevent abuse?And lastly, is there anything I should check to make sure my HTTPS setup is fully compliant?I’m not handling any personal data, just the PT scoring inputs, but I still want to lock it down correctly.Any guida

New to Fortinet and VPN... I setup my Fortigate-60 similar to the example from the documentation: " Dialup-Client IPSEC VPN Example" When I try to connect I get the following error in my Forticlient log: status=negotiate_error msg=" Negotiate SA Error: protocol_id=1, notify_msg=18 (INVALID_ID_INFORMATION), ispi_size=0 " . When attempting to connect I' m behind a Linksys router with no firewall. Anyone know why I' m getting this or is their some better documentation I can follow to figure out this message? Thank' s

Hello, Could please let us know if 70G Support Agentless ZTNA.  We want to use it for RDP Bookmark access. Thank you

Hi , I have few firewalls - virtual machines running v7.4.8 all the virtual firewalls are configured with SD WAN rules. This is a SD-WAN setup - Hub & spoke topology. My requirement is DSCP values configured on a Fortigate firewall should be left untouched on other Fortigate firewall.  My setup is a hub and spoke setup.  Can anyone please give practical example of configuring DSCP values on a firewall from Forti manager GUI or FortiGate firewall CLI so that same DSCP values are reflecting on other firewall

Hi, i currently met with an error i cannot fix no matter how many hours i put into it.The workstation is currently working on Windows 11 pro 24h2 with 7.4.3.1790 FortiClient vpn Only with ARM based processor SnapDragon X Elite - x1e78100The app was working just fine until one day it stopped, happened for 2 ARM based laptops around the same timeI tried:Reinstalling the app, vcredists, javasRemoving all folder, also the hidden ones relating Forticlient VPNRemoving everything with the word "Forti" from regeditUpdate the windows system and the deviceTon of reboots, launching app as admin, changing permissions to folders in windowsCurrently im losing hope because i keep trying and trying everything i can find on the web and forums and its not working.I will really apreciate any help.Kind regards.

Hi everyone, I've configured an openLDAP server as an LDAP server for my FortiAuthenticator, connection is establish successfully. I need to import a specific user in Remote Users, but the user is located in an OU that contains more than 500 users so the Fortiauthenticator is not able to display the full list of the members of the OU. I've tried a bunch of filter but I still get a "No result found" each time, because example filters have found and adapted are all Windows AD based and that's not my case here The username attribute on the OpenLDAP server is "uid" Is there a way to filter only a specified uid using LDAP filter when querying the openLDAP server ? so the Fortiauthenticator can display it and let me import it For Example, I have the following Base DN : ou=users,dc=domain,dc=com The User DN is : cn=vpn.user,ou=users,dc=domain,dc=com How can I return only "vpn.user" in the list since the "users" OU has too more entries to be displayed on the FortiAuthenticator GUI Than

Having had quite a few issues, there is one annoying one that is remaining, I have a Fortigate running an SSID using the FAC as the Portal for registration etc, which is working fine on Android, Laptops etc. but any apple device when selecting the SSID redirects to the "captive.apple.com" page on the phones and displays the message "Hotspot login, cannot open the page, the server cannot be found" if the user browses to this captive address you do get the "success" message. Im raising this here as there are a few articles that tell you , on the Fortigate to "exempt" captive.apple.com from the SSID, which I have done. this article: Captive Portal on Apple devices - Fortinet Community doesnt do anything, is anyone able to offer some assistance? is this because the iphone has cellular data turned on or related setting?thanks

Dear Experts, By 2 separate vlan switches, can we have 2 different LAN subnets?Here is an example. "internal" (original vlan switch) has physical ports 1-3. 192.168.10.1/24New vlan switch called "switch2' has physical ports 4-5. 172.16.1.1/24Both "internal" and "switch2" have routes to wan.There is also route between "internal" and "switch2". I tried, however, I cannot realize it. The device is Fortigate 60F. Any comments would be appreciated. Best regards,  

Hey all, Using the Forticlient VPN for Android (mostly with Samsung phones but other varieties).Connecting to a Fortigate 81F. I want to enforce MFA via Microsft 365.  It works fine on Windows desktops, but there is an issue with the Android app. Firstly it requires Google Chrome which is strange but... when Chrome opens to the M365 login page I go through the motions, switch to the authenticator app type the number in, switch back to the Google Chrome sign-in page but it still has the Approve sign in request page, and Forticlient doesn't  seem to recognise that anything has happened. I have 2 other apps that work similarly and they work fine.  Is this an issue someone else has come across and hopefully solved? thanks j

Hi We would like to migrate our 2 ISPs to the FG200G for SDWAN configure as load balancer. Our current load balancer, Mushroom, supports a maximum throughput of 300 Mbps. This limits our setup. Question Our current setup is  Mushroom load balancer has four ports: two are connected to our ISPs, one goes to HSIA Xpossible, and the last one goes to the firewall. I would like to decommission the Mushroom load balancer. Can the FG200G handle a large /16 network with a single VLAN for HSIA Xpossible? Have you tried this setup? Do you have any ideas for a more efficient approach?

Hello everyone!Just a quick question,  how should I prepare for it? Is retaking the FCP_FGT_AD-7.4 Learning Path quizzes enough, or should I practice with other types of tests as well? Any advice would be greatly appreciated! Thanks in advance!

Hi,Looking for clarity in DNAT vip in fortigate. I have vip vip_123.1.1.10 [ external ip 123.1.1.10 & mapped ip 10.1.1.100]. And below is my rule,Src 174.1.1.1Dst 123.1.1.10Port httpsNote, I haven't used vip, but used an actual ip. And I belive it will not work, but can any one explain how fortigate process this traffic. Did fortigate still do vip lookup as I used external ip in my policy?Thanks in advance

Do you have to use the Fortinet DNS servers in order for all the filtering subscription services to work properly?

Hello,I'm pretty new to FAZ but we were sold on it based on it's ability to trigger actions based on log events.  Now that we have it, I'm not sure it can do what I had planned though. Problem:  We're trying to phase-out SSL-VPN but can't right now.  We see constant attempts from certain subnets trying random user-names to log in that we'd like to block, but we don't want to block legitimate users that may have mistyped they're username.  The FAC log we see for this is "AUTH_FAIL_NOUSER" in the Log Description field. Solution:  I'd like to detect instances of "AUTH_FAIL_NOUSER" and note the <User IP>.  If the User IP makes more than 5 attempts in 5hrs.  Add that IP to a threat feed (maybe on FMG), or at least send an alert. Currently I'm doing this manually by checking the logs whenever I have time, and adding it to a threat feed we host on an internal github server. I was trying to search for a solution like this but haven't

i have one Fortigate 100F having issues connecting to FortiCloud.there management connection is show inactive.how do i enable the management connection to active again ?

Can we specify a custom port in a FortiWeb health check? I'm using version 7.4.8 and would like to use a port that isn’t part of the default options (TCP, TCP Half-Open, HTTP, ICMP, TCP SSL). For example, can I configure a health check to use port 4433?

Hello ,I’m planning to change My current setup from SSL-VPN to IPsec remote access, but I have a few questions first.How can we handle geolocation restrictions, MAC-address allow/deny, and host checks when using IPsec? For example, will geolocation and MAC binding be enforced only through the firewall policy, or is there a different approach for IPsec remote connections?Thank you.

Hi all,We're looking at Fortinet firewalls and I had a query with the sales person around user/host identification for company devices especially for Entra Joined Devices.We use a different remote access solution so Fortisase isn't an option currently.They mentioned the free FSSO agent but from checking, this would only really work for legacy Active Directory joined machines?Other options (we'd prefer cloud hosting) would be Fortiauth cloud and giving every device a paid Forticlient version?

Hi all,Need help with FortiGate 7.4 SSL inspection setup:Setup:Internal API: 10.10.10.99:8000 (HTTPS)External access: 3.3.3.33:8000 → DNAT to internalCorporate CA certificates imported to FortiGateSSL/SSH profile: "Protecting SSL Server" modeWAF profile: Monitor modePolicy: Proxy inspection mode with SSL + WAF profiles Issue: Traffic passes through but SSL inspection doesn't work - no SSL logs, WAF not inspecting content. Has anyone configured "Protecting SSL Server" for inbound API traffic? What's the correct architecture?Thanks!

EnvironmentWe have two separate FortiGate-VM HA clusters:Cluster-A (VM-A-HA): 2 nodes (active–passive)Cluster-B (VM-B-HA): 2 nodes (active–passive)Both clusters run FortiGate-VM BYOL licenses (one license per VM node).Background / What HappenedThe licenses on both nodes of Cluster-B expired.To maintain service availability, we performed a temporary workaround:Powered off both nodes of Cluster-A.Downloaded the valid license files for both nodes of Cluster-A from the FortiCare portal.Uploaded these two licenses respectively to the two nodes of Cluster-B.Cluster-B resumed normal operation with those temporarily reassigned licenses.Cluster-A has remained powered off since the license transfer.Current SituationWe have now purchased new licenses (one per node) for Cluster-B.Our intention is to:Apply the new licenses to both nodes of Cluster-BRestore the original Cluster-A licenses back to the two nodes in Cluster-ABring both clusters back into healthy HA state with proper licensing.Before do