Fortinet Community

Hi I have a 400F Fortigate with v7.4.9 build2829 (Mature). There is a policy that has always worked but since the upgrade to the current firmware I have had issues with users reporting no internet however once i remove the FSSO group from the rule internet access is restored. Both LDAP server show connection status as successful. Both external connectors are up. Collector agent status is running.

Good afternoon. I need to transfer my certifications from my partner account (carlos.san@tmoviles.com.ar) to my personal account (sanromancarlosenrique@gmail.com).Fortinet Certified Associate in CybersecurityEarned on: May 23, 2024Expires: December 26, 2026 Fortinet Certified Fundamentals in CybersecurityEarned on: April 4, 2024Expires: December 26, 2026

How does the scheduled Forti Phish cloud upgrade effect on prem FortiGate firewalls

Hi! So I have a problem with my VPN connection. I had Forticlient VPN 2 years before with the same settings that I try to run it right now. It was running exactly fine but I deleted it because I wasn't using it anymore. 2 years later and right now I am trying to run it again but I am getting "SSL VPN Connection down: Permission denied" error. It is a problem with my pc because I can log in to my friends computer with my student number. My university advicing me to reset my pc but I don't exactly want to. Is there any solution to my problem? Can you please help me with that?FortiClient

Hello FNAC admins,Does the L2 and L3 polling in FortiNAC depend on the network type selected (Layer 2 or Layer 3)? For example, if I choose Layer 2 as the network type, will only L2 polling be used?BR,  

I have a Fortigate FortiWiFi 50G-5G  device. As per upgradation path in forticare it's showing the 7.0.17>7.4.9. But when i upload the file to fabric management to upgrade the firmwire,its showing file not match the device. I've downloaded the correct file. Can anyone help me?

Hello FNAC admins,I’m reading this article about the recommended way to deploy FortiNAC:FortiNAC deployment I got to part 3 about polling, specifically the REST API section. It says:“The API key allows FortiNAC to bypass the need to authenticate every time it connects, improving performance.”I’m not fully sure what that means in practice. What exactly does the API key do, and is it really necessary to configure it?There’s also another line that says:“It is also important to verify that L3 devices that are added in FortiNAC will not be automatically included in the L3 polling feature.”I’m a bit confused about this part, if we add Layer 3 devices to FortiNAC but don’t include them in L3 polling, what’s the point of adding them? Does that mean I shouldn’t use polling on firewalls and only use it on access switches? If so is there a specific list of devices to exclude from FortiNAC Thanks in advance for your helpBR, 

I am starting the planning for the implementation of FortiEndpoint - XDR (FC1-10-EMS05-1041-02-60). The solution will be used on OT servers. These servers use legacy operating systems such as Windows XP and Windows 7, etc... We have not contracted any other services for this client, only FortiEndpoint - XDR and BPS for the aforementioned PN. Is it possible to use the XDR functionalities of FortiEndpoint in this environment?

Hello, I have a FG1500D bundle configured for a University.Almost entire traffic of University and also the campus is passing through it.Routing and policies are working correctly, but I had an issue and maybe you can help me in debugging it.So, after few days of normal traffic, suddenly connection to some Google servers was blocked and I saw lots of "Failed connection attempts" messages.Other sites and traffic was working just fine, only the connection to those servers was blocked. Actualy Google wasn't working.The security profiles for the traffic contains AV in monitoring mode, IPS sensor with all signatures and default action. Nothing special in the rest.In attach some images with Failed Connection Attempts messages.I disabled the security profiles - the problem was still there.I rebooted the equipment, the connection was still blocked for about half an hour.After half an hour, the connection to Google was working but it was resolving in a different class of IPs.Next day, Goog

Hello, I am skeptical of purchasing a registered and licensed FG-60 F (  expires  12/2025  )  but need to know if the license can be transferred to a FG-300E . Am upgrading from Cisco ASA5540 to Fortigate FG. Please advise.Best RegardsDavid

Did anyone notice also problems with SNMP after the Update to 7.4.9? Before we run this Version there where zero issue with snmp on the gate. Now we got several times a day a SNMP Error xxx.xxx.xxx.xxx: Timeout: No Response from xxx.xxx.xxx.xxx (Exit-Code:1) CRIT.[piggyback] Success (but no data found for this host) Missing monitoring data for all plugins WARN, execution time 6.6 sec.The wired thing is that it worked most of the time without any issue.

Hello Experts,I'm curious about addition/change of alias name for interface at SD-WAN.Here is our situation. At SD-WAN, we use IPsec aggregation called "AGG" which consists of WAN1 and WAN2At first, we confirmed both SD-WAN and AGG were established.Next, we added alias name for WAN1 and WAN2, such as SAT1 and SAT2.After the addition of alias, SD-WAN was down, although IPsec aggregation itself was established. Is this situation kind of SD-WAN specification?When we created SD-WAN, we should have added alias name, I understand. Any comments are helpful.

 edit: Self-answered disregard

Does anyone have a solution to block the Fizz Social app in the firewall.  I have a 200F deployed.  Thanks.

Hello!I have multiple VRFs configured on a Fortigate device and I can see that OSPF creates a separate process per VRF: OSPF Router with ID (10.10.10.10) (Process ID 1, VRF 1) OSPF Router with ID (10.10.10.10) (Process ID 2, VRF 2) OSPF Router with ID (10.10.10.10) (Process ID 3, VRF 3) ...  Each VRF should be isolated but when enabling "Redistribute Connected", OSPF starts advertising all directly connected networks across all VRFs, causing routing loops.I have tried using route-maps to filter the redistribution, but the issue persists. It seems that Fortigate treats redistribution as global per VDOM rather than per OSPF process/VRF.Questions:* Is there a way to ensure that "Redistribute Connected" only applies within its respective VRF and does not affect other VRFs?* If this is expected behavior, what is the recommended best practice for redistributing directly connected networks while maintaining VRF isolation?Thanks in advance for your help!

Hi all,I am configuring various VLANs (for internal routing & internet access etc) on the "VLAN Switch" feature of the Fortigate. Everything is working correctly but I would like to add more Physical Ports to the "VLAN Switch" interface. My question is, how does that work, if I plug 5 more physical Fortigate ports into my Switch with the correct VLAN tagging/untagging and add them to the VLAN Switch, will it just use all the ports for the traffic? Will it cause loops ? Not finding any information that explains that.Thanks

Hello, I work for a company with 3 office sites. There are about 30 peoples working on each site.We are planning to replace our actual firewall solution with 3 clusters of 2 Fortigate 70G or 90G and "Enterprise" licences. During my information research regarding the different models and licenses to be sure to make the right choice, I've found this article:Single FortiGuard license for FortiGate A-P HA cluster 7.4.6 The problem is the last Firegate generation (xxG) are not listed in the compatibility list. Do you know if it's planned to propose these kind of licence for the xxG series?I asked to the support but didn't received any response...Thanks.

Himy FG 60F v.7.0.14 is not sending any syslog at all to the configured server. This is a brand new unit which has inherited the configuration file of a 60D v.6.0.14 and was then updated following the suggested upgrade path. I already tried killing syslogd and restarting the firewall to no avail. sg-fw # config log syslogd setting sg-fw (setting) # showconfig log syslogd settingset status enableset server "172.17.100.16"set interface-select-method specifyset interface "management"endsg-fw # get log syslogd setting status : enable server : 172.17.100.16 mode : udp port : 514facility : local7 source-ip : format : default priority : default max-log-rate : 0interface-select-method: specify interface : managementDestination is reachable:sg-fw # exec ping-options source 192.168.101.254sg-fw # exec ping 172.17.100.16PING 172.17.100.16 (172.17.100.16): 56 data bytes64 bytes from 172.17.100.16: icmp_seq=0 ttl=63 time=3.0 ms64 bytes from 172.17.100.16: icmp_seq=1 ttl=63 time=2.7 ms64 bytes

Hi Community, Unable to find wall mount mechanical drawings ref : SP-FG60F-MOUNT-20 for the FG-80F firewall. Could someone help me on this?  Thanks in advace.Regards, Benbx

Hi FWB admins In FortiWeb, when using SAML authentication to access a protected server, can FWB protect against Credential Stuffing?I think something in the admin guide says it does when using site publish, but it is not 100% clear if it does.https://docs.fortinet.com/document/fortiweb/7.4.10/administration-guide/272565 So the three questions are:Does FWB protect against credential stuffing when using SAML authentication via site publish?And does it protect against it when using SAML authentication directly with the protected server without using FWB's site publish?And in case you confirm it does then please explain how it can, given that the authentication is between the client and the IdP

Hello NAC admins,My question is, which scenario is recommended, FortiNAC acting as DHCP server for isolated devices or Fortigate acting as a DHCP server ?BR,

Hello NAC admins,I would like to know which network type is recommended in FortiNAC configuration, Layer 2 or Layer 3 ? What's really difference between the two ?Thanks in advanceBR,

I have installed FortiClient VPN on two Win 11 machine, one on a domain the other one as a separate workstation. First, I don't know why but you need to add the FortiClient to the firewall either manually or through some gpedit modifications, crazy extra process! Can't it just show a pop up like other apps to ask for network access?Anyway, the computer on the domain is still struggling to connect to the SSL VPN server. FortiClient has been added to the firewall on the machine. The configuration is 100% correct on FortiClient. And, if you are asking for the error message, there is not. After entering user and pass and pressing connect button, it immediately shows the disconnect button. Additionally, if you hit disconnect button, it turns to "disconnecting..." and just freezes there and you need to "X" FortiClient.   What I expect or what I usually see on FortiClient on other machines is to show a percentage on the top and ask for MFA.I used the same login creds

Hello,I received credentials for FortiAuthenticator -Demo, but I’m unable to log in with them. Could you please check if they are correct or let me know if I need to take any additional steps