Fortinet Community

We have recently enabled 100G links on our FortiGate firewalls towards non-Fortinet devices. As we require to leverage existing OM3/OM4 LC Duplex cabling, the FN-TRAN-QSFP28-BIDI optic was chosen on the FortiGates. The other end is a Juniper QFX5120-48Y switch with the JNP-QSFP-100G-BXSR optic. Both optics are 100GBase-BXSR (sometimes called 100GBase-SR-BiDi) and thus should be able to communicate with eachother. However, with system default configurations, the link will not come up. Both ends will report good light levels but no active link. There were no clear indicators why the link remained down even though light was good. After fiddling around with various settings, with some interesting results, I have found that we need to explicitly disable FEC on the interface on the FortiGate (enabled by default). In the end, it resulted in the following settings for the 100G port on the FortiGate for the link to come up:config system interface edit "por

Dear community, I am configuring DC agents to push logons information to Collector Agent (CA on dedicated server).I am using this msi setup command line:msiexec /i DCAgent_Setup_5.0.0302_x64.msi COLLECTORAGENTLIST="10.y0.xx.11;10.y0.xx.11" DONOTRESOLVE=1 IGNORELIST="mydomain\?*-s;mydomain\HEALTHMAILBOX?*" ENABLELOG=1My question is about IGNORELIST parameter. It seems that my DC agents is still sending information about service accounts (mydomain\?*-s) that are supposed to be filtered. This syntaxe is working well to filter at Collector Agent level, but I would prefer to filter as early as possible in FSSO process, so at DC agent level.The msiexec command is accepted, collector agents list param is well used to setup DC agent but not ingnorelist param.Thanks for any advices. 

ince FortiOS going to obsolete SSLVPN from 7.6 onward,InformationDitch away the idea user group, it unable support user grouping like SSL VPN did.FSSO is a must for user grouping except local database, but FSSO has some restrictionFSSO deploy with DC agent mode for better performancePlease test with your own mobile data, example I connect my office wifi and the office WAN IP is use to peer with DC via IPSec, when test this remote access I always matched with the office IPSec profile.If you have multiple IPSec dailup profile, it could be matched to other IPsec profile that contain same phase-1 variable, especially the NAT-T option. Example, your Remote Access profile name F, FortiGate will try match the proposed variable from top to bottom (Profile A-F), let say the proposed proposal profile match variable at Profile C, firewall will take the NAT-T value at Profile C and negotiated based on it, but your remote user Profile F is without NAT-T but FortiGate will keep communicate with NAT-

Hi All, We have an ISP providing us layer 2 to several sites via a QinQ tunnel. I have seen having an ISP in between devices is not supported for a L2 FortiLink; however, several people have had success doing so. The issue is currently that FortiLink establishes for a small period of time if freshly factory reset and mgmt vlan settings are changed to 4094. This will establish the link, then FortiGate sends configs. After a while the CAPWAP tunnel goes down and the switch never comes back online. FortiNet support mentioned this could be an STP issue, though they weren't willing to further investigate as the ISP devices may be playing a role. I confirmed via packet capture the only STP packets being received are that of the upstream FortiSwitch.  Any insight to how these setups are working, or configuration that assist this would be helpful! We are very close with the ISP, and they are always willing to work with us, so any insight to what they might be able to d

Hello Fortinet community, I am experiencing an issue with LDAP user authentication failing on one Aruba switch using FortiAuthenticator as the RADIUS server. The admin local password login to the switch works fine, but LDAP users fail with the error logged on FortiAuthenticator: "remote LDAP administrators authentication with no token failed: invalid password" Notably, the same LDAP users authenticate successfully on other Aruba switches with the exact same FortiAuthenticator and LDAP policy configuration. What I have checked/tried so far: Verified RADIUS shared secret matches exactly on switch and FortiAuthenticator. Confirmed LDAP users and groups are correct and working on other devices. Compared Aruba switch configuration with working switches — config is identical. Confirmed no special RADIUS attributes are set in FortiAuthenticator policies since other devices work fine. Verified FortiAuthenticator can ping the problematic switch.&nbsp

I have a fleet of managed iPads that are older Air2s running iOS 15.8, and the recent update not only deleted all previous VPN configurations, it also no longer displays the login screen with the new configs. All of my other iPads are able to connect, it's just these older ones that cannot. It appears that it's trying to use SSO, even though that is deselected in the config. When they try to connect, this window appearsBut tapping on OK results in this window:They are never offered the regular login window to enter their username and password.I have submitted a ticket but have yet to get a response, so thought I'd ask here ot see if anyone else is experiencing the same.

Hello everyone, I tried to exempt an DDNS FQDN, but it still gets blocked by the FortiGate.SSL-Log:SSL connection is blocked, certificate-status: expired untrusted I tried with an Address FQDN object and also via this method https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-Exemption-based-on-FQDN-in-Proxy-based/ta-p/387569 . The connection to the FQDN still gets blocked. I also have to add we are using a different HTTPS port to reach the address (3438) and yes the remote certificate is expired since it came with the device.

Does anyone know if FortiNAC(-F) will ever support MPSK?

Hi All, As I know Internet connectivity required for fortiswitch and fortiAP to get the license register with fortinet support. Can I give one time internet access to switch and AP and later on remove post getting registered?

Hello FortiNet, We have found an error when calling the FortiClient API.Basically the problem is when we use the FortiClient API and the tunnel(the name of the VPN in FortiClient config) has a space in it for example "IPSec Test" it won't start the vpn when we call "vpnManager.Connect("tunnel name");

Good day I am trying to install Forticlient on Microsoft Surface Laptop 7 (ARM64 processor) and I am getting FortiClient VPN Setup Wizard ended prematurely error message. I have used ARM64 installer. May someone please advise how to resolve it

Hello, I'm a bit newbie in Forti environment, but I'm trying to rename the appliance name with the "Device Name" entered in FortiManager:     I thought about CLI:config system global    set hostname ${Hostname}endbut for sure ${Hostname} is unknown   I thought about TCL:#!puts [exec_ondb "/adom/FortiProxy/device/." "config system global    set hostname XXXend" "# "]But with what replace XXX ? Maybe there is another easy solution? Thanks in advance

Hi, we would like to protect our web service with WAF profile but activating WAF in the policy we get a webfilter violation error message and we can only activate withou SSL inspection which makes no sense.  Than we tried to import our wildcard certificate as local certifcate to use in SSL/ SSH Inspection just to find out that without a CA certificate we cant use it for our policy.  Any suggestions how we can get WAF profile running in proxy mode for our VIP? Thanks!

I'm having difficulty blocking the sending and receiving of files on WhatsApp by extension such as .pdv, .doc and .xlsx

I was trying to establish a VPN IPSec tunnel against a Cisco Meraki MX90.We are using FortiOS 7.2.11Config matched on both sides.P1IKEv1 - AES256-SHA256 DH14P2AES256-SHA256 DH14Both P1 and P2 were up, although, P2 was flapping sometimes.No packets going through.Found this in the logs:Invalid ESP packet detected (payload not aligned)After a Google search - Solved: Invalid ESP packet detected (payload not aligned). - Fortinet CommunityWhen P2 was changed to SHA1 we were able to establish connectivity.Does anyone know why does this happen?

https://www.avfirewalls.com/FortiSwitch-124D.aspI see there "limited lifetime warranty" QUESTIONS: 1. is that means if faulty, I'll get replacement if the hardware still available2. is that global warranty or local warranty only, because I was asking Fortinet Indonesia guy, he doesn't know FortiSwitch has "Limited Lifetime Warranty" 3. if I bought from eBay and bring to Indonesia. Can I transfer ownership? tq

I have three static routes to reaching my bgp Neighbour via ipsec tunnel by using ike/32 injection with same AD,metric and priority how fortigate will select the best path for bgp control plane message.@Jean-Philippe_P @msingh_FTNT @Anthony_E 

Newbie question here, I'm working in an MSP, and one of our clients Fortigate FW license expired which caused web browsing to be blocked. I've look into this and was able to get things working before we renewed the license. Our team is planning to give recommendations on purchasing a similar fortigate appliance with identical license but with different expiry dates. I just want to be sure if this will work, if the primary FW loses its subscription will the 2nd device take over if the subscription on it are still active?

 Dear Fortinet Support, We are currently using FortiGate Cloud to manage firmware upgrades for our FortiGate 60F device.To avoid conflicts, we have explicitly disabled the automatic firmware upgrade on the device itself using the following CLI command: config system fortiguard set auto-firmware-upgrade disableendInstead, we have enabled automatic firmware upgrade through FortiGate Cloud by applying a firmware profile with the following settings: ・auto-firmware-upgrade-delay 3・auto-firmware-upgrade-start-hour 1・auto-firmware-upgrade-end-hour 4 ・Additionally, the central management configuration on the device is as follows: config system central-management　set mode normal　set type fortiguard　set allow-push-configuration enable　set allow-push-firmware enable　set allow-remote-firmware-upgrade enable　set fmg-update-port 8890　set enc-algorithm highendDespite this configuration, the automatic firmware upgrade has not been triggered.Our device is current

I've noticed that Devices what Device Inventory shows (in the Web Interface you can go Users & Devices > Device Inventory) aren't being updated, I can see old IPs for some devices in there. Is there some way to force the update of this view? Is this like a cache?  Thank you all. 

Hi, I am a beginner who just started my journey with Fortigate.  I am using Cisco ASA which is configured with remote access SSL VPN and users connect to VPN through Cisco AnyConnect client. I am implementing FortiGate in the lab environment. I want to find out if it is possible to use Cisco AnyConnect client with FortiGate in SSL VPN? If you happen to know any documentation or video tutorial related to configuration please share.

Is there a timeline when the SAML issue for SSLVPN on Forticlient 7.4.4 will be resolved?  When I try to login the SSLVPN auth fails.  Have to downgrade to 7.4.3 for it to work again. 

Hi All,I am using Windows DNS servers and I initially had it setup to use Google as the external forwarders.Since all my devices are set to send traffic through my Fortigate, and I had DNS security profile on my firewall policies, I thought that was fine. However, I recently read a post that said that the Windows DNS server should be set to use the Fortigate as the external forwarding destination, and that the Fortigate should have interface configured under Network > DNS Servers, and then forward to system DNS in order for DNS filtering to work.  Which of these is correct, or best practice? Thanks.   

Hi FWB/FAC adminsFWB 7.4.9FAC 6.4.10I configured SCEP on FAC and my FGT works well with it.However my FWB doesn't I get this error when I try to generate CSR: "pkcs7 unwrap error" (screenshot).FAC says the request was properly received and we can see in Pending status in Enrollment Requests.FWB doesn't keep the new key following the issue.   Any idea?

Obviously local passwords are encrypted. If you were to copy the config from one model Fortigate I would assume a different model Foritgate won't like those encrypted passwords?Is it the case that you would have to redo all local username/passwords on the new Fortigate? How does Fortinet do it when upgrading Fortigates with their conversion service?thanks!