Fortinet Community

One of our remote offices has been having intermittent internet issues (thanks Comcast). From what I have been able to find, by default FortiGates don't do much health monitoring on WAN connections, and that if I want WAN health monitoring I need to configure SD-WAN. I have never configured SD-WAN before and wanted to avoid any gotchas. Some of the questions I have about SD-WANHow does configuring SD-WAN affect any WAN firewall policies? Do these need to be updated to point to the SD-WAN instead of WAN?We have a static IP, any concerns with SD-WAN and Static IPs?Will configuring SD-WAN mess with any IPSEC or SSL VPNs?We don't pay for FortiAnalyzer, without that will it make any Health Monitoring useless? 

Good afternoon!Friends, I'm using two images in EVE-NG, one from fortigate v7.0.15 and the other from fortimanager v7.6.0 build3340 (Feature).I connected to both with the forticloud trial.I configured a management interface on both and another Lan interface (where I would connect between them)They both ping each other and fortigate closes telnet on port 541.I activated FMG-Access on the lan port on the fortigate where I will communicate with the fortimanager.I reduced encryption in fortimanager, set low and also activated fgfm-ssl-protocol sslv3.I put the Fortimanager IP in the fabric connector > Fortimanager, on premises.I always get this error:The FortiManager's access to the FortiGate will be authenticated by the FortiManager certificate. The serial number from the certificate must match the serial number observed on the FortiManager. Could not connect to the FortiManager to retrieve its serial number.I tried everything possible, I have no more ideas. Please Help .

I wasn't able to connect to an IPsec VPN through FortiClient VPN (7.0.2.0090 free) when updated to Windows 11 (build 22000), SSL VPNs were working fine. When I downgraded to Windows 10 (21h2 build 19044.1415) the IPsec VPN started working again. This is the error that I got on FortiClient  And this is the log that I exported   12/28/2021 4:02:55 PM info sslvpn date=2021-12-28 time=16:02:54 logver=1 id=96602 type=securityevent subtype=sslvpn eventtype=status level=info uid=19AEBE88942A48F59578C42AA765D590 devid=FCT8003159070034 hostname=DESKTOP-5BJFTJ3 pcdomain=N/A deviceip=192.168.224.1 devicemac=<redacted> site=N/A fctver=7.0.2.0090 fgtserial=FCT8003159070034 emsserial=N/A os="Microsoft Windows 11 , 64-bit (build 22000)" user=bueno msg="SSLVPN service started successfully" vpnstate= 12/28/2021 4:03:04 PM info system date=2021-12-28 time=16:03:03 logver=1 id=96823 type=systemevent subtype=system eventtype=status level=info uid=19AEBE88942A48F59578C42AA76

We have a web rating override for deepseek.com, which is working as it should. Now I added two additional ones for a different category, and now the override is not working. The url is overridden to security risk/ mal. website, and the category in the used web filter profile is blocked.When opening this url again, even after some time, the url gets not blocked.How acn this be fixed, so that the URL gets blocked as it should?

Hi,We are using a Fortigate 60F firewall and we have recently experienced internet unavilability issue which was automatically solved with a firewall restart in one case. Our setup includes four internet connections from different ISP's . We have SD-WAN rules for certain websites /services and some PC's are included in policy route rule so that they always use specific WAN interfaces. The first time the issue occurred was , we had configured the firewall in Performace SLA to ping an IP such as 8.8.8.8. This Performace SLA rule would ping the mentioned IP from each internet interface to monitor its health for SD-WAN balancing. If the IP is unpingable from certain WAN interface then it makes the link as inactive. However, while the firewall was able to ping 8.8.8.8, the client PCs had no internet access.On the client PC's which are included in Policy route we have added 2 ping automation tasks , one for 8.8.8.8 and another to ping google.com . The logs from those PC's had no request

Hello,this is not an help request but something I stumbled upon while configuring IPSec VPN Access fom my users.It's a long post, so be warned. Here are the symptons:- Client doesn't connect on first try, only on second attempt (and sometimes at third)- Subsequent connections fails in the same way- Sometimes, after connecting, I got a disconnection message BUT VPN remains active and I still can access remote resources).Looking at wireshark, I saw that IPSec packets were sent out long after client timed out, like it takes lot of time before establishing the tunnel.At the beginning I pointed my attention to other cybersec tool we have, but turned out they were not doing anything.After some digging I finally discovered something I'd like to share- When Forticlient IPSec tries to connect, it first stop and then disable Windows IPSec services (namely IKE and AuthIP IPsec Keying Modules and IPSec policy agent) and then raise his IPSec process (IPSEC.EXE) which, in turn, manages the tunn

I have a Fortigate where I have two VLANs with different networks configured with hotspot. Both point to the same external radius server. When I connect to the SSID of VLAN A, the portal pops up and I register without any problems. My username (which is the MAC) appears in Firewall Users along with the IP.When I connect to the SSID of VLAN B, the portal pops up again because the user and IP pair is not the same. So far, everything is normal. But I have MAC authentication bypass enabled “set security-mac-auth-bypass enable”. As I understand it, MAB should be pre-authentication, and when I connect to SSID B, before the portal pops up, it should consult the server. When the server sees that the user is already authenticated, it responds to Fortigate with an “accept” and puts the user with the new IP in Firewall Users without the portal popping up.But it doesn't work as I expect, and when I connect to the SSID, the portal pops up directly without consulting the radius. The s

Hi There, I have recently created 3 VPN Tunnels for production, UAT and FSS Environment, now the issue i am facing is production and UAT working fine but the issue with FSS as this one having the same subnet of 10.0.0.0/16 similar to UAT i am trying to fix the issue but its not working only one Tunnel FSS or UAT working at a time. But i will to run them at the same time. Appreciate any help. Regards,Ravindra

I have two managed Fortiswitches that I need to connect over P2P. I am following this KB: https://docs.fortinet.com/document/fortiswitch/7.0.8/devices-managed-by-fortios/801183/fortilink-over-a-point-to-point-layer-2-network I believe the KB details the steps needed for unmanaged Fortiswitches. I say this as the config switch physical-port does not work when I enter the CLI on a Fortigate. Does anyone know the required to enable P2P on two managed Fortiswitches? Thanks.

Good day everyone,I’m planning to deploy a hub-and-spoke IPsec VPN design, where the HQ uses a FortiGate 100F as the central security gateway, and branches use regular routers (not FortiGate).Objective: All branch traffic should pass through HQ (full tunnel) for inspection and centralized security.Challenge: With full tunneling, HQ bandwidth will become a bottleneck and could be heavily overloaded.My questions:What are the best practices to keep HQ as the main security hub without hairpinning all branch internet traffic?Does FortiGate support any selective/split-tunnel policy in this scenario, even if the branch device is a non-FortiGate router?Are there recommended design options so that sensitive/critical traffic is still inspected at HQ, while general internet traffic (updates, streaming, etc.) can break out locally at the branch?

I'm new to configuring sdwan with bgp, I've worked on both separately very well but have found it difficult to integrate them together. The scenario is as follows:I want SDWAN communication between 2 Fortigate with 4 site to site ipsec VPNs and BGP routing. Neither of the 2 is hub or spoke so the ADVPN functionality I think does not fit in my scheme. Basically it would be a SPOKE-SPOKE or HUB-HUB communication if we see it in some way. FGT 1 -------- 4 VPN in SDWAN --------------- FGT2 The idea is that it works as it does with static routing; when a link is degraded by packet loss it switches to the next link and vice versa when the primary link improves it returns the traffic.I have tried to follow the guide below:https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan-self-healing-with-bgp/559415/overview But most of the documentation you find refers to HUB-SPOKE or ADVPN. I have tried to make adjustments to make it HUB-HUB but the configuration has not worked for me

Anyone know what best value for sdwan SLA performance to improve network quality to microsoft teams?

What the h...? Why is the psksecret-remote command in the ikev2 configuration removed in version 7.4.7? Although it is still there in the command reference, the command is no longer recognized. There is also no notification about this in release notes or has anyone seen it?

Hello everybody,I'm new to FortiNAC-F and currently using the latest version (7.6.4). I would like to implement the following endpoint compliance policies with FortiNAC, but since I’m still learning, I’m seeking your help.My goal is to configure the system so that any endpoint without an enabled antivirus, without an updated OS, or with medium to critical vulnerabilities is denied access to the network and redirected to quarantine.Do you have any ideas on how I can proceed, or any tips? Thank you so much in advance!

Dear Concern,I had established primary and secondary IPsec tunnels with a cloud server through two different ISPs. Both tunnels had been working properly for the last 2.5 years. However, for the past few days, I have encountered an issue with the primary tunnel: when the primary ISP is up, Phase 1 of the primary IPsec tunnel comes up, but Phase 2 does not. No configuration changes have been made on my side—this issue occurred on its own. For the time being, I have manually forced down the WAN interface of the primary ISP on the FortiGate, so that all traffic, including the IPsec tunnel, is running through the secondary ISP.Troubleshooting observations:From the primary ISP, the cloud server’s WAN IP is reachable with stable ping response and latency.Traceroute results from both primary and secondary ISPs are identical and complete in terms of hop counts.Using nmap to check port-based traceroute towards the cloud server’s WAN IP confirmed that both standard ports (500 and 4500) are open

Hi, I'm trying to connect my EMS to FortiGate but error below appears.  FortiOS 7.4.7FortiClient EMS 7.4.3 build1926Connection failed with unknown issueEMS Cloud# execute fctems verify 1Error in requesting EMS fabric connection: -101issue in getting capabilities. EMS server connection failed with unknown issue. curlcode: 7Error (-1@_get_capabilities:461).Command fail. Return code -9999 # diagnose endpoint fctems test-connectivity 1Connection test had an error -101: EMS server connection failed with unknown issue. curlcode: 7 Any help would be highly appreciated. Thank you :) 

Hello, we need to switch from Dual Stack SSL VPN to v4 only, since we need SNAT4 on some policies for traffic originating from SSL-VPN. Is it safe to "set dual-stack-mode disable" or will this remove / invalidate all existing policies? The current policy set contains both v4 and v6 address objects. The IPv6 address objects can not be removed from the SSL-VPN policies as long as dual stack mode is enabled. Can this be done without downtime? Or do I need to edit the conf file and deploy the new config without dual stack and without v6 address objects at a time? Kind regards

Hi,have got a problem with the signal of my mobile internet at a site.The sim card is recognized by the system, but seems like there is no 4G (lte) signal, as the FG is not able to connect.Now I am thinking of using an external antenna or at least an antenna to put as near as possible to the outsite wall. Right now the 40F is in the rack, which I assume, is the problem. While searching for a solution I saw many suggested an extender, but I don´t want to use an extender, as we had so much trouble with them.  Specifiyng my question:Is the a recommended antenna?Any specifications, if I need to use a long SMA cable to connect the default dipole-antennas? Thanks for your help.RegardsMarc

I successfully installed forticlient from the official website. but after installation i am getting status as connecting.  After that i checked in the "/var/log/forticlient/sslvpn.log" file and found below "certificate failed" error root@ubuntu-client:/var/log/forticlient# tail -f sslvpn.logHostname: 114.143.xxx.xxxReason: X509 verify certificate failedCertificate:Subject name: /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=support/emailAddress=support@fortinet.comFingerprint (SHA1): 16:B7:61:19:82:62:2C:B8:3C:14:D7:06:37:7A:15:0E:7D:55:3A:9920250929 14:16:40.057 TZ=+0000 [sslvpn:DEBG] main:1707 543 bytes sent.20250929 14:16:40.057 TZ=+0000 [sslvpn:DEBG] vpn_connection:664 http request error: 1   Just for testing i also installed forticlient vpn 7.4 on windows 11 system and it is working fine ( i am using both machine from my same network). Please help me to resolve this issue. RegardsSantosh kumar+91-9041915296santos

Hello, I have created a ipsec ikev2 remote access vpn but when i trying to connect to it from forticlient in android or pc it shows an error stating: "protocol timeout reached" . Here is the fortigate (V 7.6.3) vpn config: config vpn ipsec phase1-interface edit "ITC VPN"set type dynamicset interface "port2"set ike-version 2set local-gw wan ipset peertype oneset net-device disableset mode-cfg enableset ipv4-dns-server1 192.168.0.46set proposal aes256-sha256set comments "VPN: ITC VPN -- Created by VPN wizard"set dhgrp 14set eap enableset eap-identity send-requestset wizard-type dialup-forticlientset authusrgrp "IT_Users"set transport udpset peerid "reza"set ipv4-start-ip 10.60.70.1set ipv4-end-ip 10.60.70.3set save-password enable cA2TeDH7DfQItGyaCzAdm+nyAodhdjOn3pkCw8DFQLoaMjfSMf1u69g/r/ivZ5K1Q82sP8X6ZvKzUf2ZhFxxACq3Xu8nextend In vpn Logs i can see that ipsec phase 1 failes with error : gateway validation failed

I would like to view my certifications, but I am unable to log in to the website. It says that my password is incorrect. When I try to reset my password, I do receive the reset link by email, but the link does not work (as shown in the attached screenshot).  

Wanting to see if anyone has any configuration steps/notes connecting FVE to an Intercom System via SIP.  Specifically, a GALAXY Paging system.  I'm hoping to get more than just the manual of menu items ("to set up XYZ navigate to ABC" etc)  Possibly actual notes/screenshots, maybe from an actual deployment, that can be used as a reference/guideline.  (If I had access to such an existing deployment, I'd reference it, but alas, I do not.)

We used to do extensive app troubleshooting on 7.2 decrypting the traffic using a trusted ROOT CA installed on the client machine.  After upgrading to 7.4, it no longer works, what we would do is (on 7.2):create a loopback interface, create a decrypted-traffic-mirror with the loopback bound to it, create a firewall policy with decrypted-traffic-mirror enabled to the mirror. then create a firewall sniffer with the loopback interface. and voila, plain text https came out n pcap form. the issue now seems to be the firewall sniffer has gone, and the new packet capture thing does not let us use loopback as an interface. Has anyone got this working and could share the steps?

Having trouble with FortiGate REST API calls for automated policy updates. We're using Python scripts to bulk modify firewall rules but getting SSL certificate validation errors when connecting to our FortiGate cluster.Individual policy queries work through the web interface, but programmatic access via API keeps failing on certificate handshake. Need someone experienced with FortiOS API authentication and certificate management.Requires 2-3 hours remote session to resolve the SSL connectivity issues. Timeline is urgent - need functional by Wednesday for security policy rollout.

Hello Fortinet Community Team,We are experiencing an issue while creating a custom Windows Server decoy image on FortiDeceptor.After completing the Windows Server installation, we add the IIS, ADDS, DNS, and SQL Server roles.We then run fdc_toolkit.exe as Administrator. At the Save step, we receive the following error: “Failed to save the virtual machine, please retry again.” What is notable is that when we perform the installation without adding any roles and directly run the toolkit, the Save operation completes successfully without any issues.We have tested this scenario three times in a row, and each time the error occurs when roles are added. The screenshots are attached. What action should we take regarding this issue? What should be done to avoid this problem? Best Regards,