Fortinet Community

I am starting the planning for the implementation of FortiEndpoint - XDR (FC1-10-EMS05-1041-02-60). The solution will be used on OT servers. These servers use legacy operating systems such as Windows XP and Windows 7, etc... We have not contracted any other services for this client, only FortiEndpoint - XDR and BPS for the aforementioned PN. Is it possible to use the XDR functionalities of FortiEndpoint in this environment?

I want to encrypt traffic through firewall and also want to disable remote user to connect to vpn and access organization resources.

Hello everyone, Is there a way to create a domain in Fortimail but disable it without deleting it ? Kind regards,

Hi all, We have a Fortigate 40F (7.6.x) with the following configured:1) WAN x.y.z.138 public address (connected to Internet)2) LAN 192.168.1.2543) VIP : x.y.z.136 --> 192.168.1.6 4) Two firewall rules: one allowed all sources to access the VIP , the other allowed x.y.z.0/24 to access the VIP The VIP forwarding is working fine except for client with x.y.z.133 (same network with Fortigate's WAN), from which all requests are just time-out and no response. Any idea is appreciated !Kenny Lin

We recently migrated from 7.2.13 to 7.4.4.If you initiate a VPN connection with 7.4.4 and accidentally enter the wrong password, you'll receive a message saying "<Name> VPN" is down.I'd expect an incorrect username or password messageYou'll also see a "stop sign" on the FortiClient icon.Despite the above status messages, there are no issues with FortiClientThe "VPN down" message will cause users to unnecessarily call or submit tickets to the service desk instead of re-entering the correct password.I thought I'd submit a ticket to Fortinet, but maybe someone else has beaten me to it, and the answer is already known.

Hi, This one is a little hard to explain, but we and active/passive pair of Fortigate 120G's that have 802.3ad aggregate parent interfaces with multiple VLAN subinterfaces.  The strange thing we are seeing is that when traffic passes over one of the VLAN subinterfaces, we're seeing roughly 10% of that bandwidth appear on the other interfaces. For example, we have LAG1 with VLAN sub-interfaces of VLAN10, VLAN20, and VLAN30. All VLANs are idle, but if I run a speed test on a machine that sits on VLAN10, I'll see the VLAN10 bandwidth jump to 1000Mbps as expected, but the bandwidth graphs for VLAN20 and VLAN30 will each show between 50-100Mbps of traffic on them. This is causing havoc with our monitoring and billing systems. Any idea why this is? We recently migrated the configurations from 60Fs and didn't have an issue with those.We've tested with a completely new LAG and VLANs with a separate Arista switch stack and a single device in each VLAN. The devices in th

Hello FNAC admins,What's the most recommended method(s) in device profiling rules ? I know it depends for each scenario. Also I wanna know if it's best to use many methods in one rule, or each rule better have one method ? Thanks in advanceBR,

Hi all, We are facing issue where seems that the FortiAnalyzer does to use properly the variable which creates during the workflow of a playbook.  So, I am gonna brake it down so it can be clear. The initial goal is to use the playbooks so can send API calls to a target point in order to automate the creation of customer tickets. The playbook has 3 components.    1. Event trigger   2. Get token from the target point   3. Post the actual payload along with the token which was received from the above task. Event trigger: We use handlers to monitor the status of the devices' interfaces and the actual status of the device (online, offline).  That works fine. Get token: Using get method, FortiAnalyzer (API client) requests a token from the target point. Along with that, in the header we using a x-client-id which is the Client identification. FortiAnalyzer has been registered to the API IBM portal and a key has been associ

We are mostly cloud but do have a DC in our datacenter. We are about to acquire a firm that just bought Meraki firewalls and need those offices to have site-to-site VPN connected into our Azure Datacenter.The plan is to just connect an IPsec VPN from the Meraki to our Azure VM FortiGate but have heard this doesn't work well has so many issues. Anyone have an IPsec VM between FortiGate and Azure?

Hi everyone,I’m having trouble configuring SIP on my Fortinet firewall and could use some guidance.For inbound calls, I receive traffic from an external IP (a.a.a.a) to my server (b.b.b.b). I’ve created a Virtual IP (VIP) to map this to an internal IP (c.c.c.c). Currently, I have two VIPs configured:One for SIP signaling on port 5060 (UDP)One for RTP traffic on ports 16384–32767 (UDP)For port 5060, I can see hits on the corresponding VIP. However, for the RTP range, there are no hits at all, and when I place an inbound call, there’s no ringing or audio.I’ve set up a firewall policy with the source as a.a.a.a and the destination as my two VIPs. The policy only registers hits for port 5060 traffic.Could someone confirm whether this setup is correct? Or should I instead use DNAT for inbound and SNAT for outbound traffic? I tried running debug commands but didn’t see any traffic being blocked. I also enabled SIP debugging, but I’m not sure what specific indicators I should look for.Any ins

Hello Community, is there any way to set a default Number in the Guest User Print Option?I edited the HTML Page of the Print Template so far that one Guest Voucher on the print page requires less space on the Page.Now i can technically print 10 Guest Voucher on one page. But the default value of "Break Page After" is one and before every Print i have to edit this to the value of 10. Next question:Is there a way to set the multiple Vouchers on the print page in a Table of 2 colums? My goal is to use the whole page as much as possible to reduce the paper waste. If somebody even created such a HTML Template it would be a great help if you send me this page :)My HTML Page is here: Spoiler (Highlight to read)<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv=Content-Type content="text/html; charset=UTF-8"><meta http-equiv=Pragma content=no-cache><title>Gues

Can anybody help we are trying to blockhttps://xanthorox.netIt does not seem to be a straightforward web filter block

I'm new to the Fortinet switch world.  We have a customer that is replacing their existing Fortigate 60F firewalls that also manage the switches and access points.  We're replacing the APs, so those aren't an issue.  I'm looking for guidance on the switches though. I think i have the process down for changing the management method and ChatGPT tells me the config will stay in place (for the most part). Is this the proper command to change the management and is ChatGPT correct about the config?set switch-controller-mode standalone I'm also having a hard time connecting CLI to the devices from the Fortigate management UI.  From what I've read the admin credentials that I'm using to log into the Fortigate should work on the switches, but some refuse those creds and some give me a message that my password doesn't conform to the policy, must be changed, then it spits me out of the command and returns the same message if i try to connect again.  I'd like to get i

Hello everyone,I'm having the following problem: I'm migrating configurations from an ASA with an SSL-based VPN that uses certificates to authenticate users (certificate-based authentication). I've tried to migrate this to a FortiGate 100F running Windows 7.6.4, which uses IPsec with iKE (version 1 or version 2), but I haven't been able to get it to work, even after configuring both the FortiGate and FortiClient VPN (the free version without EMS).After much trial and error, I concluded that when using FortiClient VPN, the certificate only works for Phase 1 authentication of IPSec, essentially replacing the IPSec secret. However, for EAP or XAUTH (Phase 2), it uses the user's credentials and password, not the certificate provided in Phase 1.Can anyone tell me if there's a way to perform certificate-based authentication (without the user entering a username or password)? Or is my conclusion (previous paragraph) definitive, and therefore impossible?THANKS

Hi, we are facing a problem with the transition from SSL-VPN to IPSec DialUp for remote users.The problem is that we want to maintain the functionality of the split tunnel from SSL-VPN, that means that all the subnets declared in the policies that affect the group that the user is part of, create an entry in the routing table of the client machine.Just the subnets in the policies, and not the whole subnet(s) declared in the phase 2 of the IPSec tunnel. Is this possibile ? Also, some remote resources are reachable from the users only through the VPN client, because we declared the FQDN of the remote peer in the policies. To access those, should we disabling split tunneling at all ? Currently we are working on Fortios 7.4.9, but we are planning to update to 7.6.2 Thanks 

Hello FNAC admin,Correct me if i'm wrong, apparently if you register a host through the host view (users & hosts > hosts), the user doesnt have to go through registration again. Does that mean that the user is like in a safe/whitelist ? Register host to user  BR,

Hi all,To summarize, FortiClient does not work on Dell Latitude 7350, because of the Intel BE200 card.I can't get the prompt for the token.In the logs, I can see "no response from the peer".It works on wired connection, and it works also with an external USB wifi adapter.Apparently, FortiClient and the Intel BE200 card are incompatible. What can be done in this case?

Hi,our firewall is in version 7.6 and we have multi-vdom. I notice that from the vdoms, I can configure tacacs: #config user tacacs+, however when I'm in global, I don't have this command. is that a way to configure it under Global (#config global #config user tacacs+ ) rather than going to individual vdom and do it (#config vdom #edit x #config user tacacs)? Also if I have a ha cluster (active-passive), I suppose I don't need to config anything on passive devices, as the config getting synchronised through all the firewalls? Thanks

https://kb.fortinet.com/kb/viewContent.do?externalId=FD40170&sliceId=1 - the settings are made according to this manual. On one A-fortigate a vlan comes to the port, on the other side a B-fortigate with a regular port, where the traffic is untagged. Why do I see the mac-address of the host network B on the VxLan-IPsec-interface, and not on the port3? It seems to me that it does not work precisely because of this. Expectation: Real [size="2"](00:50:56:01:05:32 - local_host[not_ok], 00:50:56:97:b5:05 - remote_host[ok])[/size]: 

Hello everyone.I have five Fortinet devices:1 x FortiGate 120G2 x FortiSwitch 1024E (SW01-C and SW02-C)2 x FortiSwitch 148F (SW03-A and SW04-A)FortiLink is configured to manage switches on ports X1–X4, which are connected to ports 19 and 23 on the FortiSwitch 1024E.I've also created an MCLAG between the two 1024Es on ports 25 and 26.I'm currently trying to create an LACP connection between the core and access ports. The connections are as follows:SW01-C port2 → SW03-A port49SW01-C port17 → SW04-A port50SW02-C port2 → SW04-A port49SW02-C port17 → SW03-A port50After connecting the patch cords, everything worked automatically, but port 49 on SW03-A doesn't work at all.I've tried changing cables, ports, and settings—to no avail.I'd appreciate any ideas or tips on where to look.I'm attaching a screenshot of the diagram below.  

Hello FNAC admins,I'm reading this part of the administration guide "DNS configuration and I don't quite understand what this configuration actually do, is it a mandatory step in fortinac's deployment or we can skip it ? Thanks in advance.BR,

Hello FNAC admins,What's really the difference between normal guest/contractor profile and guest kiosk profile ? I've seen that in guest/contractor you have to send the user their credentials and in kiosk they can create their own account. Can anyone give me a use case to use the guest kiosk instead of guest/contractor ? BR,

Hello FNAC admins,I came across this in the admin guide "You must have a license for the guest manager feature" in the Guest and contractor chapter, do we need a specific FNAC licence to manage guests and contractors ? BR,

Hello,I would like to configure a FortiGate SSL VPN policy with the following requirement:For one specific user only, I need to allow SSL VPN access only if the connection originates from a defined external (public) IP address.Other SSL VPN users should not be affected — they should continue to connect normally without any source IP restriction.I’ve tried using Allow IPs / Deny IPs in the SSL VPN Settings, but that applies globally, so it doesn’t solve this case.I also tried to handle it with the SSLVPN-to-LAN firewall policy, but that doesn’t seem to work as expected.Even Local-In policies didn’t help.Do I need to create a separate SSL VPN portal and apply a host check rule, or is there another recommended method to achieve this in version FortiOS 7.2.11?Best regards,

I have a FortiWifi 30E that runs FortiOS 6.2.17 which it seems it came to its EOL and support wont be continued.The plan is to upgrade to a FortiGate 40F or a FortiGate 50G.The configuration file from the 30E can be restored with no problems on the 40F/50G or are there extra steps to take in consideration for this change?