Fortinet Community

Hi all,  I hope you're well.  I am installing 4 x 120G FortiGates into a DC, but these firewalls will not be on the edge therefore no direct internet access. Another layer of firewalls is in front, I need to create an explicit list of IPs, domains, services etc to provide to the individuals who currently manage them to ensure the FortiGates has access to required services for NGFW features.    I am currently building a policy on a lab firewall with what I know and can see is required but is there an explicit list available so I can ensure everything is covered? Thanks, Dan. 

Hi. I've set IPsec VPN for the entire company and all the users except from one are connecting with no problems.this user had the problem with an older PC.i replace him with a new one and all worked good for a while.we came back after two weeks and have the same issue with the new one.the settings are right and in logs you can see he is successful  connecting and disconnecting after a sec,from the user FortiClient it seems like the connection is taking too long.he get a massage the connection is timeout.what to do about that?

I need the 32-bit version of FORTICLIENT VPN ONLY  

Hello! About a year ago I took the FortiGate Certified Professional - FortiGate Administrator Exam (NSE4), and was able to prepare with a free study guide from the training.fortinet.com website. I am now trying to take the same course on FortiManager, but can't seem to find the download for the Study Guide.  Is that still available? Thanks! NiftyN9

Hello, I am a monitoring analyst, and I have access to FAZ1000F v7.6.3. When I go to “Incidents & Events,” I find a large number of incidents, but when I take the source IP of these events and go to “Log View,” I find that the event was blocked by the firewall. I understand that for FAZ it is an incident even if it has been contained, but it generates noise for me. I am interested in seeing only the incidents that were not blocked. Is this possible? If so, how can I do it? Thank you.  

Dears, I come from an F5 background and have one key question: how can we deploy FortiWeb in a one-arm in reverse proxy mode, and how can we enable source NAT to avoid asymmetric routing issues as Fortweb will not the gateway of the application server, or will not in inline between the public and App server 

I have a FortiGate 70G (tested with FortiOS 7.4.8 & 7.4.9) in use at a customer site. The FortiGate is connected to FortiClient EMS Cloud and FortiAnalyzer Cloud. When I enable the most basic web filter (in the policy’s security profiles: only Web Filter: “Default” and SSL Inspection: “certificate-inspection”), websites take an extremely long time to load for users — and eventually they just pop up all at once.Following the packet flow, where you can see that it takes 23 seconds before the next data packets appear. I can’t explain this behavior and don’t really know how to analyze it further in detail — maybe someone has an idea or suggestions for additional analysis. I’ve already checked the processes (wad), but couldn’t identify any anomalies there.The accessed page was timebutler.de, but the issue also occurs on other sites. If I remove the web filter, everything runs completely normal. The logs don’t show that anything is being blocked when the web filter is enabled. 

I have been testing some changes to my FortiAP 231F profile over the past couple of days and the only thing I can say is.... are the FortiAP profiles broken? I have been testing and make changes over the past week and have noticed several concerning "issues" or trends. Consistently, anytime a change is made to the FortiAP profile all APs assigned to that profile reset their 2.4 and 5Ghz channels to Channel 1 and Channel 100 respectively.Even after manually rebooting the APs, APs that are right next to each other will select the same channels.Does 80Mhz wide channel width work on the 231F? How can I verify? As the FortiGate does not clearly report what the channel width it is using. Devices in question:1 FortiGate 101F running FortiOS 7.2.12 build1761 9 FP231F APs running firmware v7.2.0 build0424

Hello everyone,I’m new to this community and to Fortinet products in general. I’ve been working for years with a Cisco ASA Firepower 5506-X, and I’m now migrating the entire setup to a FortiGate 100F running firmware 7.6.4.Overall, the FortiGate configuration process has been quite straightforward — except for the VPN part, which has caused me quite a few headaches. I’d like to share what I had configured on the ASA and what I’m trying to replicate on the FortiGate (note: I don’t have an EMS license).On the ASA, I had two WAN interfaces (primary and backup), each with its own self-signed certificate issued by an internal Active Directory CA (Windows Server 2022).Within the ASA, I had four VPN profiles:• VPN Normal• VPN IT• VPN Advanced• VPN ExternalEach profile had its own split tunneling configuration, allowing users to see only the networks relevant to their access level.Each profile also had a dedicated IP pool and DNS settings (internal AD DNS for corporate users and public DNS for

Hello, I'm following this guide : https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-permanently-block-SSL-VPN-failed-logins/ta-p/287171#:~:text=Creating%20the%20Automation%20Stitch%20(Part,for%20the%20new%20Automation%20Stitch.&text=Next%2C%20select%20Add%20Trigger%2C%20then,by%20selecting%20FortiOS%20Event%20Log Trying to do an automation to create a new group each day.I 'm on a FG100E with OS 7.0.17 I manage to create the group with the date :edit VPN_Failed_Login_%%date%% But when I want to add this new group to my config firewall local-in-policy with append srcaddr VPN_Failed_Login_%%date%% I got this : entry not found in datasource value parse error before 'VPN_Failed_Login_%%date%%' Command fail. Return code -3 Any help? Thanks, 

I have SAML SSO enabled on the FortiGate using Azure as the IdP, and it's working well. I'm now trying to enable the SP certificate. I tested several certificates from the FortiGate certificate list, but each one fails with the error:"Signature algorithm used to sign data is not supported." The IdP metadata shows Azure requires this signature method in SAML metadata:<SignatureMethod Algorithm="...rsa-sha256" /> How can I generate or issue a certificate on the FortiGate that will produce RSA with SHA-256 signatures via CLI? Please help with CLI commands or steps. 

Hi, we're migrating to IPSec Tunnel from SSL-VPN to get in front of SSL-VPN support being removed in the near future. Some of our users use Linux desktop at home and I was wondering if there's anything in the works for full support of IPSec on Linux forticlient in addition to Multifactor Authentication. We have integrated Entra into our Fortinet Tunnel. This is fine with SSL-VPN, but nothing for IPSec.  StrongSwan doesn't work as far as I can tell as it doesn't have the ability to interactively take the auth token for Entra and appending the token to my password doesn't work.  Thanks!

🧱 EnvironmentFortiGate model: FG-101FFortiOS version: (please add, e.g. 7.4.3 or 7.2.6)VPN type: IKEv2 IPsec (remote access)Authentication: LDAP users & groupsClient: FortiClient 7.4.3 (Windows 10 Pro 64-bit)🪪 ScenarioI’m configuring an IKEv2 IPsec remote access VPN that authenticates users via an LDAP server.The connection is established from FortiClient successfully up to Phase-1 (SA_INIT), but it fails during user authentication (EAP phase).EAP failed for user "test"EAP response is emptyconnection expiring due to EAP failure

FortiGate VPN Device Integration to FortiNAC.I am currently working on integrating FortiGate with FortiNAC.I need assistance with the configuration steps and the guide that outlines how to properly integrate FortiGate (FGT) with FortiNAC (NAC) for VPN-based access control.The officel guide I already read.Is there have any guide for this .   

Hi there im trying to create this setup for 2 buildings. FortiGate - FortiSwitch(Switch1) - FortiAP <---Mesh link---> FortiAP - FortiSwitch(Switch2) Is it possible to have all devices online on the Fortigate 60F running 7.6.4 ?

I have deployed the FortiGate Firewall in GCP with HA Active and Standby, and Fortiweb in Active Active, but in the GCP load balancer is showing only the healthy status of active, not standby. Is this the normal behavior? any anyone has suggestions, please advise.

I ran into this issue on our FortiMail and wanted to let you know: We found a mail going out of the FML that should have been quarantined due to failing DMARC check. However the mail went through to the user even without any filtering. The log only states the failing DMARC check but no action and no further checks/filters while there is more checks/filters in the recipient policy and also the antispam profile in the policy does specify the action to quarantine it upon failing DMARC check. I opened a ticket with TAC on this and they sent me to the right path: The reason is a new option which was introduced in 7.4.0 first. Since 7.4.0 there is a dmarc generic action option in security=>options=>antispam. Per factory default this is set to not perform any action.This leads to the FML still detecting a failed DMARC check but ignore any specified action. However due to the failing DMARC check it still skips the rest of the checks/filters and lets the mail out compl

Hi all, I'm having trouble getting 2 fortigate firewalls to connect via VPN, it looks like the phase1 is up but the phase2 never gets triggered. Even if I execute a ping between the two sides it never comes up. I've attached a screenshot of the VPN settings at both ends as well as the static routes and the firewall rules that I've got configured. I've tried running the Fortigate to Fortigate IPSEC wizard and I get the same result. I currently have NAT disabled at both ends but I've tried it with it enabled and enabled/disabled at both ends. I've checked and the preshared keys are the same and they're both using AES256-SHA256 DH14 on both the phase1 and phase2s I'm really confused, can anyone offer any advice?  

HiFortigate 60F, blocked after upgrade to release 7.4.9.i can't access via https. Can someone help me to troubleshoot it?Message: Secure Connection FailedAn error occurred during a connection to 172.16.1.1:11443. PR_CONNECT_RESET_ERRORError code: PR_CONNECT_RESET_ERRORThe page you are trying to view cannot be shown because the authenticity of the received data could not be verified.Please contact the website owners to inform them of this problem.

I am using Fortinac F version 7.2. I have the following issue. A user joins the network using a persistent agent. They obtain an IP address from the relevant VLAN to which the necessary policies are applied. However, when the user removes the persistent agent, instead of being moved to quarantine, they continue to obtain an IP address from the same VLAN.

Hii wondering, the thing is i need to intergrate and AD to Forticlient Cloud EMS, but am wondering where to install the AD connector, am thinking to install it on the Windows Server associated with the AD, but my windows Server is Lisening on a private IP, the AD connector should be installed on the device that is accessible by both the EMS and the AD how can i manuever this, which environment do you recommened i should install the AD connector Thanks for your feedback

I’m seeking clarification and a possible solution regarding the recent change in FortiGate’s SAML authentication requirements. The issue is described in the following Knowledge Base article:https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SAML-Authentication-fails-after-firmware/ta-p/407859 According to the article, the new specification requires that both the Response and the Assertion within the SAML response be signed.I understand that some IdPs, such as Microsoft Entra ID or Google IdP, support signing both elements as shown in the examples. However, what is the recommended workaround or solution if we are using an IdP that can sign only one of them? I also have two questions regarding this policy:1. Is this requirement a permanent change?2. Could you share the rationale for requiring both the Response and the Assertion to be signed? From my understanding, the Assertion is already a component of the Response, and signing the Response should i

Hello everyone,I currently have two FortiWeb VMs configured in an HA cluster (Active-Passive mode). However, I’m facing an issue during the HA setup. When I enable HA, the master node completely overwrites the configuration of the secondary node, causing it to lose its initial settings. In addition, after the negotiation process between the two FortiWebs, the cluster does not become active — both devices remain separate and do not synchronize properly. I would like to know how to prevent the master from overwriting the configuration of the secondary during synchronization, and how to fix the issue that prevents the two FortiWebs from forming a functional cluster.Thank you in advance for your help and advice.

On MacOS 15 (FortiClient version 7.2.6), at the MacOS login screen a message appears prompting for credentials.  The message states: FortiClientAgentYou are making changes to your Certificate Trust Settings.Enter the name and password of a user in the "(null)" group to allow this. No matter what credentials are entered, it won't accept them. I've opened a case with support, to no avail so far.They referred me to this article (for an older version of FortiClient), and I added all the services it mentions that need full disk access and checked the other settings:https://docs.fortinet.com/document/forticlient/7.0.9/macos-release-notes/223986 I would investigate downgrading to see if that helps, but we want to be on the latest release so that we are up-to-date on security patches. Does anyone have any suggestions? Thanks in advance for any advice.

Hi, I do have a new deployment for the EMS 7.4.4 server for the ZTNA project. I do follow the guide about how to change the default settings, such as DNS and IP. It shows "$ sudo nano /etc/netplan/01-netcfg.yaml" to modify the initial setup. But when I did the installation. It was totally different. There is no Sudo command allowed. Kindly provide your support to guide on the basic CLI command on how to change the initial setup to let EMS access the internet and activate the license. Meanwhile, I do have the BPS license. How can I use that to let the Fortinet team help in the setup?