Fortinet Community

Connect vpn IPsec via command line...I'm using de forticlient  to connecto to a IPsec vpn site, there is any way to do this via command line? because I will use this via Securden PAM to connect, . Can't find any documentation or post with this information. Now I'm using via sslvpn....

Hi FNAC adminsIf I have FortiNAC with valid license and valid support subscription (FNC-CAX-VM + FC-10-FNVXA-248-02-DD), with X endpoint license (LIC-FNAC-PLUS-100), but without FortiCate support for the endpoints (I mean there is no FC2-10-FNAC0-240-02-DD).What can be the behavior of my FNAC and what can be the impact on both operation and support? 

Hi everyone, I'm trying to configure an IPsec tunnel with IKEv2 protocol. I'm using PacketFence v15 as my radius server. I'm also using FortiClient on my laptop. When I'm trying to connect on my VPN , my FortiClient say to me "Wrong EAP Credential connecting to X.X.X.X". On my Packetfence I'm having theses messages : Also when I'm testing the connection to my radius server I'm having this error:  But on my packetfence the test is ok when i'm using a user that i have add i my radius User Group.I know that i can disable message authenticator but even when it's disable the vpn connection doesn't work. Also i'm using FortiOS 7.4.8. I'm using Forticlient 7.2.12. If anyone could help please. Thanks in advance 

Hi all, we use FortiClientVPN free 7.4.3 on MacOS Sequoia 15.7.1. When we did import of FCT xlm configuration then all manually created VPN profiles had been removed. When we did import of same xml config to windows FCT 7.4.3 then all manually created profiles are kept and new config from xml is added. Does anybody have same behavior on Mac? Can it be fixed in some way? Another question is about managing this imported xml configuration - we don't have option in FCT to remove this Company VPN profiles - there are only options about view configuration but we are not able to remove this profile. Is it by design or can we customize it? Thank you. Best regardsPetr

Hi all, a new fortianalyzer VM, located in a datacenter, everything is setup and working properly, latest version.Added a single device, status shows "down", device was added using its serial number, external IP automatically detected. Port 514 forwarded into the fortianalyzer VM.On the FGT, a fabric connector to the FAZ was successfully setup, showing "connected" status, and even log traffic is being shown.What am i missing?

Hello, No question, but some experience when adding FortiGate device to a FortiManager VM trial.Situation, devices:1x FMG-VM64 v7.4.83x FortiGate 60E v7.4.9 When adding the FortiGate devices to FortiManager, all 3 at once, you run into 3 unauthorized devices. The FMG licenses goes from 0/3 to 3/3. It is not possible to authorize them.When adding a FortiGate device 1 by 1 to FortiManager, you can add 2 devices including authorizing them, but when you want to autorize the third, that is not possible because the license is already 3/3. But when no devices are added/authorized (new starting situation), on the FortiManager you can add devices by "Import Model Devices from CSV file". On the FortiGate no actions have been taken sofar.After "Import Model Devices from CSV File", all 3 FortiGate devices are "Managed FortiGate (3)". Then configuring the FortiGate to be managed by FortiManager, they are already "Authorized" due to the import.Then you have a working FortiManager

Hi Every,Hoping to get some guidance here possibly with a new 431G deployment. We are currently using a FortiGate 120G to manage our 431G FortiAP's. The firmware on the FortiGate is 7.4.7 and the FortiAp's is 7.4.5. Currently when 6GHZ is enabled we get extremely poor RSSI levels on the clients. This even happens when we are standing directly under the access point. When we join the network, the device initially shows a good RSSI of -45 dBm but then jumps to -75 to -85. It will bounce back and forth and is basically unusable. The RF environment looks extremely clean as there are really no devices broadcasting on that spectrum. We are currently using a 624F-FPOE to power the units which deliver BT power so that is not an issue. This seems to be firmware related but we have tried 7.6 for both the gate and AP's with the same result. 5GHZ works perfectly with no issues. 

IkeV2 VPN with EntraID SAML All configured and working to a point ! SAML authentication works fine but as soon as I authenticate the connection Immediately drops !Last Disconnect Reason: HostnameResolveNonRecoverableError Can anyone suggest where to start with troubleshooting this ? I've tried the following but found not errors.diagnose debug application fnbamd -1diagnose debug application saml -1diagnose debug application ike -1diagnose debug application eap_proxy -1  

Hello,after deploying FortiAnalyzer on Azure (version 7.6.4), I am receiving the following error:"You have exceeded your daily logs GB/Day licensing limit within the last 7 days"However, a valid license for 5 GB/day is present and correctly uploaded on the portal (even if it not actually visible).Below are the screenshots and CLI outputs for reference.Could this be a bug?Is there any way to force the license to be re-read or refreshed?The file license has been downloaded and uploaded on the Faz after installing This the output from CLI:faz-xxxxxxxx # diagnose debug vminfoVM license is valid.fds_code: 200Expires in : 363 days 3 hours 51 minutesType: VM-SLicensed GB/Day: 0Max devices: 10000Management IP: 10.10.125.3Serial Number: FAZVMVM UUID: 56a1c1xx-xxxx-xxxx-xxxx-xxxxxxxxxxxxfaz-xxxxxxxx # get system statusPlatform Type : FAZVM64-AZUREPlatform Full Name : FortiAnalyzer-VM64-AZUREVersion : v7.6.4-build3579 250825 (GA.F)Serial Number : FAZVMBIOS version : 04000002Hostname : faz-xx

Hi Fortinet People, I've just seen the latest version, v7.0.18. Do I need to upgrade to v7.0.18M, 7.4.8M, or another version like v7.2.12M? Please advise for long-time use and stability.    

We just got FortiCloud Premium license to manage our customer's FTNT cloud services like EMS Cloud under our master account/org. But I'm struggling to set those customers under "Organizations". Originally I thought we would have to create an Sub-OU per customer then put the customer "account" under it. However, I realized a Sub-OU can have multiple accounts under it. Also when I "Add Account", I have to put Company Name in addition to name and email address of the account.So now I'm wondering if I should create an Sub-OU like "Customers", then I might need to create customer accounts like "Customer1", "Customer2" and so on.I'd like to ask people who work for an MSP/MSSP how your company is managing your account under "Organizations".Also I'm wondering if the email address and the name I fill when I add an acount to suborg automatically becomes "Master User" in the diagram of this documentation page.https://docs.fortinet.com/document/forticloud/25.4.0/organization-portal/999189/use

Issue:SAML-based IPsec VPN using FortiClient 7.2.4 and Microsoft Entra ID is not working. When accessing the SAML login URL (https://[redacted]:9443/remote/saml/login), the browser returns:ERR_EMPTY_RESPONSEFortiGate does not respond on the configured auth-ike-saml-port.What We’ve Verified:auth-ike-saml-port is set (tested 9443 and 10443)SAML server is bound to the WAN interfacePublic cert (Let’s Encrypt) is valid and applied (set cert, set auth-cert)FortiClient is correctly configured for SAML IKEv2No output from diag debug application samld -1 — SAML daemon appears inactiveRequest:Please assist in confirming why the SAML listener is not responding on the configured port despite correct configuration. No known issues are mentioned in 7.4.7 release notes.

Model:FGT-61EOS:v7.2.12.M-build1761

HelloI noticed that when installing FortiMail VM without license on KVM we don't have 15 days evaluation period, while the 15 days are available when we install it on VMware.Besides I noticed that FortiWeb provides 15 days eval on both VMware and KVM.Why this difference? Can we have the same for FML on KVM?

Hello FNAC admins, After reading FNAC documents and some articles by the Fortinet staff, I've concluded that these are the steps to follow to configure FortiNAC, please correct me if I missed something or If the order is wrong. 1- Config the interfaces (port 1 and port2 and they shouldnt be on the same subnet)2- Config wizard, config layer 3 isolation (its recommended to have one that regroups all devices)3- Config VLAN interfaces on fortigate4- Config MAC notif traps on Fortiswitch and disable linkup linkdown if its enabled 5- Config DHCP relay on fortigate (which is Fortinac's IP add)6- Add the network devices to the inventory (fortigate and switches)7- L2 or L3 polling to get the needed informations8- Config LDAP with FNAC9- Config persistant agent on endpoints10- Create user/host profiles11- Create a network access policy Any help would be much appreciated to make these steps even more detailed and correctBR,

Error 1: The webmail login portal does not redirect to the OTP page.Error 2: Forti Authenticator shows “Local user authentication partially done, expecting SMS token.Error 3: Another Forti Authenticator log shows “Local user authentication from 0.0.0.0 with SMS token failed: invalid password.

Hi everyone,I’m having an issue with FortiManager Cloud and I’m hoping someone can point me in the right direction. I have a FortiGate HA pair already added into FortiManager Cloud. Everything was working fine until today, when FMG began showing errors whenever I try: Retrieve ConfigInstall PreviewPolicy Package DiffThis seems to be a system-level object FMG expects, but it no longer exists in the ADOM database. Because of that: Retrieve Config failsADOM revision cannot be syncedInstall Preview tries to remove “system.telemetry default”Any push/install fails  Even when I manually create a telemetry object in Objects, the ADOM still throws the same error. I’ve checked: Device databasePolicy packageSystem objectsDevice mappingADOM-level objects  But the TELEMETRY object does not appear anywhere in the ADOM tree. This looks like an FMG Cloud ADOM DB corruption / missing system object, not a FortiGate configuration problem. 

Hi thereI need your advice on what is the best IPsec design for our setup.We have one HQ with dual ISP's and 14 other sites with single ISP.Now my question is should I implement it, via static routes like here Technical Tip: Redundant IPSEC Tunnel using single WAN connection , IPSEC Aggregate or something else? (Fortigate v7.4.9 build2829)Thanks for your recommendation and have a nice day.

Hi there, I want establish two ipsec vpn remote access tunnels with different vlans for admins and users via single WAN on fortigate 70G. its possible? thanks for answers

Hi, Have anyone been able to get a Fortigate VM run on MacOS with an ARM chip? The M-mac's have been around for quite a while now, but I still haven't found anyone who actually made it work. BR,Per

Hi experts,I am experiencing a certificate warning when users browse HTTPS websites such as Google.The browser shows:Your connection isn’t privateNET::ERR_CERT_COMMON_NAME_INVALIDDevice Details: Model: FortiGate 100EFirmware: v6.2.16 build1392 (GA)SSL Inspection Mode: Deep inspection (certificate inspection using Fortinet_CA_SSL)Web Filter: EnabledFortiGate certificate is already imported into client trusted root storeFortiGate DNS cache has been flushed (diagnose test application dnsproxy 8)Tested browsers: Chrome, Edge (same issue)  Troubleshooting Done: Verified system time on FortiGate and clientFlushed DNS cache on FortiGate and PCImported Fortinet_CA_SSL into Windows and Chrome storeChecked if FortiGate is presenting a mismatched CN (shows FortiGate CA instead of Google CN)  Question:Is this a known issue with v6.2.16 build1392?Any official Fortinet patch or workaround to fix SSL deep inspection mismatch?

Hi, our Scom team raised the following voulnearbility in 7.4.3. Support offers upgrade to PAID! version 7.4.4. and doesn’t offer any vulnerability mitigation process. Is that normal approach in Fortinet?? Summary: An Uncontrolled Search Path Element vulnerability (CWE-427) exists in FortiClient Windows versions 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, and all versions of 7.0. This vulnerability allows a local low-privileged user to execute a DLL hijacking attack by placing a malicious DLL in the FortiClient Online Installer installation folder. Impact: Exploitation of this vulnerability could enable unauthorized execution of malicious code, potentially compromising system integrity and security. Remediation: Upgrade to the latest version of Fortinet Forticlient.

Looking to see if anyone has suggestions or a resource for automation stitches. There are some good ones out there for automatically blocking IPs and stuff, but want to see if anyone has some really cool automation stitches they have been using directly on their fortigates

I am trying to figure out a way to allow "msrpc" application to a server using application control.  It looks like in order for it to work I need to create a policy to allow any service and apply an application control profile. Because service is set to allow any I guess I will have to block all applications in application control profile and only add an exception to allow "msrpc".  For this reason this rule has to be put at a place close to the bottom of the policy list so it won't block services or applications I want to allow.  This seems to be working but it just does not seem to be ideal.  In Palo Alto firewall I can just set up a rule to match the specific application only so other type of traffic will not match this rule, therefore neither be allowed or denied.  I am wondering what is the best practice in Fortigate in this scenario? 

I’m currently using a dialup IPsec VPN with Entra ID MFA.  The FortiGate is connected to Entra ID using SAML. My questions are: Is this basic SSL certificate the proper type? https://www.ssl.com/certificates/basicssl/ Do I need to purchase a certificate for each user? Any comments would be greatly appreciated. Thank you