Fortinet Community

Hello, since we cant use SSL VPN with the G model we are trying to move to remote IPSec.We are testing first with the IT department. Last week, everything was fine, no problems connecting to IPSec.But yesterday one of our technician was not able to connect. The problem was the Token, while connecting he was asked to put the token and he got denied. He tried like 2 times and than switched to SSL VPN where the Token was working the first time connecting. That makes us really uncomfortable thinking about switching all users to IPSec which we have to do some time soon.I checked the Log files and I dont get an idea about the failure. First it seems OK:Action negotiateStatus successResult XAUTH authentication successfulAn than the last Log is: Action delete_phase1_saThe thing is that there is no failure with FortiToken since it works fine with SSL VPN so I dont know where to look for a possible failure.Thanks!

After upgrading FortiGate 101F to firmware 7.4.9, SSL VPN authentication via Azure AD SAML (Microsoft MFA) stops at 40%.

Hello,I have an existing network with a Dell server (192.168.62.251) running Active Directory, DHCP, and DNS, and a ZTE router (192.168.62.1).I want to configure a new Fortinet 60F (192.168.1.99), but I would like to keep my current network configuration.

Hello.   I'm trying to set up an 81F (FortiOS 7.6.4) as router on a stick. It would be a staight forward action, however I'd like to have other interfaces set as access mode on one of the VLANs that are supposed to go through the trunk. For example, internal5 would be the trunk (VLANs 10 and 20 tagged), and internal2 and internal4 should also allow untagged access to VLAN 20.   I've stumbled on this article https://community.fortinet.com/t5/FortiGate/Technical-Tip-Comparing-Hardware-switches-Software-switches-and/ta-p/210092 and it kind of addresses the issue, if I set a virtual switch per each of the trunk's VLANs, while leaving one interface dedicated for trunk (instead of declaring dot1q entries).   Is there a proper way of accomplishing this?    Thanks in advance for any insights, and all the best. 

 Hi all! I am working with a FortiGate firewall that has an internet connection with a static IP.Our goal is to route the default gateway through an IPsec tunnel that breaks out via the headquarters. When configuring SD-WAN, a default route (0.0.0.0/0.0.0.0) is created toward the SD-WAN zone.Inside this SD-WAN setup, the IPsec tunnel is included with a performance SLA, so that the route is automatically disabled if the tunnel becomes unavailable. In this case, traffic should then fail over to the physical WAN interface.However, for the IPsec VPN, an inbound and outbound policy is required without NAT.These policies are placed at the top of the policy list: from IPsec to SD-WAN, and from SD-WAN to IPsec.The complication arises when the physical WAN interface is also placed inside the SD-WAN zone.In that scenario, NAT is required; otherwise, internet traffic via the local ISP will not work. One possible solution is to configure the physical WAN interface outside

Installing 7.4.0.1658 on two different Windows 11 (Dell Vostro and Dell Inspiron) Laptops.  Both laptops were Wiped and Prepped with the same Windows 11 23H2 Pro OS and are set up using very basic Intune Profiles (Intune barely does anything). The VPN Client, when launched, only goes as far as "Connecting".  It never times out and appears as if its stuck.   Are there any Windows Settings I should be looking at which would impact the clients ability to establish a connection?  Logs dont appear to show anything indicating the VPN is even attempting to connect.

After deploying FORTIEMS 7.4.4, the Webserver certificate was replaced via the GUI, under EMS Settings → Webserver Certificate, changing from FCTEMSXXXXXXXXXX.cert to fcems-server.cert.After this change, access to the console was immediately lost. Even after restarting FORTIEMS, access could not be restored. Would it be possible to: Restore the console to its default settings; orRevert/change the certificate again through the EMS CLI?

I have an upcoming job where I’ll be installing and configuring a FortiGate to serve as the edge router at a facility currently running an all-Cisco internal network (from a previous contractor). The long-term plan is to replace all Cisco devices with Fortinet gear, but to avoid downtime, the Cisco network will continue operating through the FortiGate for now.Currently, a Meraki MX400 is acting as the edge router. Since we’re unsure of its configuration and I haven’t worked with one before, we don’t want to remove it yet. Instead, the MX400 will connect to the FortiGate, which will then connect to the ISP. We’ll begin building the new network off the FortiGate while keeping the existing Cisco network running through the MX400.The MX400 already performs NAT, so I want to avoid double NAT on the FortiGate. Would the correct approach be to create a firewall policy on the FortiGate for the interface handling Cisco traffic and simply disable NAT? 

I plugged my new 50G in before going away for a week. Everything seemed fine in the 24 hours prior to me leaving. When I got back, it seems there are issues, and I notice about 12 hours ago, I was upgraded to 7.4.9 from 7.4.8. It's like there is an MTU mismatch, but I have my WAN set to DHCP and it's auto selected 1500, so I think that looks fine.Are there any other issues that might cause packet loss or intermittent internet issues, esp on wireless devices (connected to the Fortigate by TPLINK AP's).Sorry, it's a bit vague, this is definitely new behaviour since either the switch to the 50G from my 60F (brand new install) or since the deployment of 7.4.9 by Fortinet.

We would like to enable and define the SLA Targets option in 'Performance SLA' section of the SD-WAN configuration in Fortinet console. We are having Fortinet version 7.2.11 as part of FortiGate device.In our environment, most of the traffic is normal internet browsing , emails and net searches. We do have around 2-3% of traffic to our WFH Windows Servers. We use Microsoft Teams ( free) version for internal communications, which is not self hosted. Further, there is no 'business critical' application such as VOIP or such real-time traffic. We don't have VPN or Proxy network.Therefore, considering the above factors in mind, we would like to know whether these Latency threshold, Jitter threshold and Packet-Loss threshold mentioned below would be okay for our use cases  ( 250 ms,  55 ms and 1% ) ?  These values were taken from 'Defining WAN performance SLA' section of the official document found here.  As per online searches, the recommended values lie b

does sdwan steer the traffic by modify the static route? If yes why i can't see static route created by sdwan rule when execute command 'get router info routing-table static'?

Hi! Recently the new FortiOS 7.6 was released, so being an enthousiast I upgraded a new F40 straight out of the box.After the update the devices booted but I could not reach it by it's default IP.Booting the device via console, I got error messages about interfaces en the configuration. A few of these messages are:Initialize config error 44010The config file may contain errors.Please see details by the command 'diagnose debug config-error-log read'. The initial boot gives strange characters until it shows "system is starting" and after that everything is perfectly readable.After the device booted I am unable to type anything in de commandline.So, after this line it is stuck: Please see details by the command 'diagnose debug config-error-log read'. I also tried different serial configuration (baud rate etc.). But that doesn't do the trick.During boot I'm able to press a key but all the characters are gibberish, so a flash format is a challenge.  I

Problema:En FortiClient VPN, al iniciar sesión con SAML Authentication, aparecen usuarios antiguos en el formulario de login, sigue estos pasos para borrarlos.Solución:1. Abrir la consola de FortiClient 2. Hacer clic en el ícono de Configuración (⚙ )3. En la sección Avanzado, pulsar [Clear Cookies]4. Reiniciar el login → el formulario se muestra limpio y sin el usuario incorrecto

I have an Remote Desktop Services (RDS) Gateway service running on port 443. I am trying to implement IPS rules on FortiOS 7.4.8 that block unsuccessful attempts at logging in. I can see in the HTTP/IIS logs that a 403 unauthenticated code is given when users enter an incorrect password. I tried leveraging the HTTP.Authentication.Brute.Force policy and configuring it with a threshold of 3 for a duration of 60 seconds but that did not seem to work. I then proceeded to create a custom rule (below), however it yielded the same results. F-SBID( --attack_id 1870; --name \"HTTP.401.Unauthorized.Multiple\"; --service HTTP; --protocol TCP; --pattern \"401 Unauthorized\"; ) Does anyone know how to configure the IPS to detect unsuccessful login attempts against an RDS GW server? FortiGate 

We are using the Fortigate 200F running FortiOS v7.4.8 build2795 in front of our web hosting stack.  I want to block these AI training bots because they are not respecting robots.txt and using too much bandwidth.  I was thinking of using using a custom Application Signature to filter by the user-agent like "ClaudeBot" for example and then create a custom Application Control to block those requests.  I found a similar example but could not get it to work.  Below is the Application Signature I am using, any help would be much appreciated.   F-SBID( --attack_id 9003; --name "ClaudeBot.Simple.Block"; --protocol tcp; --flow from_client; --seq =,1,relative; --data_size <0x500; --pattern "ClaudeBot/1.0|0d 0a|"; --context packet; --distance 0,context; --weight 20; --app_cat 28; )

Hello Everyone, I am having forticloud with free license. Earlier i was using old forticloud account and i would like to use new account so i changed email in the old account and given that email in the fortigate, as soon as i commit that change all logs in forticloud got deleted.Kindly let me know how i can achive this requirement 

Anyone know are we able to query the SDWAN SLA performance to geeting information about jitter, packet loss and latency using CLI, SNMP or any other way?I have requirement to insert the SLA performance to the SQL database so I can make custom report for specific SLA performance.If we see in the SDWAN performance SLAs there are graph but is limited only to 10 minutes time window and i need more longer.

Hello,I need help configuring VLANs and DHCP for my clinic Wi-Fi setup. Here’s my setup and the issue I am facing:Setup / Concept:Goal: Segregate Wi-Fi into 3 SSIDs:Corp → VLAN11 → Internal network (192.168.11.0/24)Employees → VLAN20 → Separate subnet (192.168.20.0/24)Guest → VLAN30 → Separate subnet (192.168.30.0/24) with captive portalFirewall: FortiGate 30E Firmware v6.2.15 build1378Acts as DHCP server for all VLANs.firewall Port lan2 used as uplink to my managed switch.VLAN sub-interfaces on lan2:lan2.11 → VLAN ID 11 → IP = 0.0.0.0 (since lan1 is already 192.168.11.1)lan2.20 → VLAN ID 20 → IP = 192.168.20.1/24, DHCP enabledlan2.30 → VLAN ID 30 → IP = 192.168.30.1/24, DHCP enabledSwitch: D-Link DGS-1210-10P (Managed PoE)Port 8 = Uplink to FortiGate lan2 (untagged VLAN11,tagged VLAN 20 & 30)Switch management IP = 192.168.11.7Ports 1,2,3 = For UniFi U7-Pro APs (untagged VLAN11, tagged VLAN20 + 30)Controller: UniFi virtual controller at 192.168.11.50 (inside VLAN11)APs: 3× Uni

I am trying to upgrade the firmware of a 108F-POE switch from 7.0.5 to 7.4.8. In Fortigate interface, I can upload the firmware image, but the upgrade process does not start. Any idea what might be wrong? I tried other firmware versions as well (e.g 7.2) but no success 

Hello everyone, I am publishing this post because I would like to know if any of you have updated a FortiGate with several VDOMs in use in version 7.0.17 to 7.4.9 or 7.4.x, if anyone has done so and if they had any incompatibility problems, specifically if they have done so with any 81F or 2601F model, I would appreciate your positive comments.

I recently purchased a Fortigate 50G, and the firmware on the device is v7.0.17 build7598 (Mature). I see possibility of upgrading beyond 7.0.17 but it doesn't see to be possible through the GUI. Also when I check the Firmware images available in Support section of Forticloud I don't find any firmware for 50G, I find them only for 50G-5G.Any info how I can upgrade?   

Hi Newbie Question here I am new to Fortinet as our company just changed over from Cisco for our 300 stores. One thing i have noticed is that when im logged into FortiGate for a particular store and I've changed an IP for a device, the new IP is not showing up changed in the ports section.  How do i make it "refresh" the IP's without having to reboot the FortiGate and taking a store down.     

Hi all, In FMG, when I click on the policy block tab and then select the " where used option, a new page appears that includes a list of policy packages where this policy block is used. I'm wondering what the entry column refers to?   

I am preparing for my Fortinet NSE 6 - FortiAnalyzer 7.2 Administrator NSE6_FAZ-7.2 exam and i am seeking the best exam preparation resource. Could some recommend me NSE6_FAZ-7.2 practice test?

We are experiencing an issue where BYOT devices ( eg; Android ,IOS), excluding computers/laptops, are frequently marked with an "Invalid physical address" status. This issue appears to have started after upgrading to version 7.6.*. In version 7.4, this problem did not occur.To temporarily resolve the issue, I’ve been manually adding the MAC addresses of the affected devices to the NAC OUI settings. However, this is not a feasible long-term solution given the number of devices on the network.I have already executed the scheduler, but it did not resolve the issue.Request:Can you confirm if this is a known bug in version 7.6.*?Is there an alternative or automated method to resolve or work around this issue?Environment Details:Affected version: 7.6.*Previously working version: 7.4Device types: BYOT devices (excluding computers/laptops)Current workaround: Manual MAC address entry in NAC OUI settingsScheduler: Already executed, no resolutionPlease advise on how to proceed or if a patch/fix i