Fortinet Community

Our FortiManager and FortiGates are running 7.4.6, and we ran into the bug where when we deploy a change, the rule ID is appended to the global-label. Whereas before, we may have 10 rules under a section, there is now a section above each an every rule, with the rule ID added off to the side of each section. For example, "out to internet'rule 1rule 2...rule 10 is now"out to internet(1)"rule 1"out to internet(2)"rule 2etc. The solution is to "workaround by creating a CLI template related to the configuration and assigned to the device." I've been looking at this off and on today, but I can't figure out how to accomplish this. Can anyone point me in the right direction? Thank you.

Hi,I operate two FortiGate 120G devices in an Active-Standby HA configuration with a BGP connection.When an Active-Standby failover occurs, there is a  BGP interruption of approximately 30 seconds.The following KB article states that the BGP process only runs on the daemon process of the active unit, and that a new process is launched upon failover.Could you please provide detailed documentation or evidence regarding this point?KBhttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-FortiGate-HA-and-BGP-graceful-restart/ta-p/196150On a FortiGate HA cluster, the BGP router daemon process is only running on the Primary unit. When there is an HA failover a new BGP process will be launched on the newly elected primary.Additionally, I observed a outage of 25-30 seconds during failover.I understand this is not related to the BGP keepalive timer (30 seconds) but is simply the time required for the BGP process to launch and establish a connection on the new primary unit.I

Hi, i'm wondering if there is a solution for the following concept... Suppose user A is on site A in vlan A.  He/she wants to use a resource which is on site B and does this by using Forticlient vpn.  User A can also use any resource in vlan A on site A. Suppose user A want to access a resource in vlan B of site A.  With an active Forticlient the result depends of what routing table info the user gets back after initiating the Forticlient vpn.  If the destination subnet of vlan B happens to be in there, then the trafic will get tunneled through the ssl vpn, and then back over an ipsec site-to-site vpn.  Which is kinda lame, as the data is actually local.  You could ofcourse remove the destination subnet from the received routing table info, but this would mean that it would stop working for any other user at any other site... Configuring the site-to-site vpn correctly is naturally also a very viable solution, but in this case study

FortiGate GUI public IP not reachable - Azure HA with ELB-ILBHi all,I have deployed a FortiGate HA solution, Active-Passive, FortiOs: 7.4.7M, license model: PAYG, in Azure.I am currently unable to access the GUI despite having actioned the following:* Created the internal and external load balancers, with backend pools mapping to the NICs of the internal (trusted) and external (untrusted) fortigte subnets* Enabling http redirect to https and explcitly setting the admin port to 443 for https* Enabling https, probe-reponse and other access capabilities on both the management and wan interfaces.The port structure is as follows:- port1 = wan- port2 = lan- port3 = hasync- port4 = mgmt* Ran a debug and can only see that SYN packets are sent, but no ACK```fgta-p-uks-01 # diagnose sniffer packet any "host 10.202.1.68 and port 443" 4 0Using Original Sniffing Modeinterfaces=[any]filters=[host 10.202.1.68 and port 443]3.393207 port4 in 84.51.233.23.57711 -> 10.202.1.68.443: syn 27649927603.405

Hi! We're a Fortinet distributor in Canada and we are surprised for the prices offered by some US-based stores.Does anyone know if there's a different price list for the US? Are partner levels discounts (Select, Advanced, Expert) different compared to the rest of the Americas?It would be amazing if someone could share one of these price lists with me.

Hello Team,i have configured VXLAN over VPN  with MP-BGP EVPNVLANs that are part of VXLAN have VRRP enabled .VXLAN  and VRRP are working as expectedThe problem is when traffic is traversing the DCs (From the Secondary DC to the Primary DC - VRRP-wise) ,At the destination DC, the traffic is not returning as there is no routing pointing to VXLAN for the return traffic.There is BGP between DC and the network that is trying to reach the VXLAN IP, which is advertised over the IPSEC.The strange thing is that when i runed POC on FG 7.4.7 it was working. attached the config:    

I have an environment in which industrial switches (not fortiswitch) needs to be on the same mgmt vlan for all subnets. I am not finding a way to have the mgmt vlan passthrough on a foritgate with v7.6.x while also having the interfaces for the OT subnets.Confused? Here is an example:- Port WAN1: vlan 200 interface (main OT network), tag vlan1000 (mgmt) without creating interface- Port 1: Contains vlan 801 interface- Port 2: Contains vlan 802 interface- Port 3: Contains vlan 803 interfaceVLAN1000 must be tagged on Ports WAN1, 1, 2, and 3, without interface (passthrough). This is used to manage the managed switches.This can be done on industrial firewalls from Siemens and Hirschmann. How is it done with Fortigate?

We have separate VDOM for each of our clients on our 2000E FW. The clients have access to their respective vdom only. However, when they do route lookup they can see all interfaces on our 2000E.    

Hello team! We have 2 Fortigates 100F in HA 7.6.4 and a FortiClient EMS cloud 7.4.3We already have 3 dialup IPsec IKEv1 VPNs for each WAN working, all authenticating with ADAlso we have 1 dialup IPsec IKEv2 VPN for each WAN working, also authenticating with ADI recently added another existing AD domain in the Fortigate and EMS (Both domains are in different DCs), installing the agents needed The authentication server was correctly added in the EMS Cloud and we could see AD objectsIn the Fortigate, we have added an external connector (FSSO Agent on Windows AD), like in the other domain, and created a new LDAP Server, like in the other domain.  The external connector is up, and the new LDAP server passed both tests ("Test Connectivity" and "Test User Credentials") I then created a new local user group, using 1 remote group (In the second AD) and created 1 new IKEv2 dialup VPN for each wan, using this new groupIn the EMS, I duplicated the working IKEv2 VPN profile for

On August 26th, I attempted to log into my client's network using FortiClient VPN only.  I received a JavaScript error.  I came here, found a solution and performed the suggested steps.  I don't have the JavaScript error anymore.  The problem I have now is that the FortiClient FortiToken input field does not display.  I receive the 2F token code via email; however, I have no way to input the code.I have been trying to fix this for four weeks and I'm hoping someone can suggest a solution I might try.Note: It is not the user name case sensitivity Thanks in advance.

I'm attempting to setup remote access VPN using IPSec and authentication with SAML using Entra ID. There are a couple of tricky parts about this setup:1. Dual WAN for failover/redundancy2. Different groups need be configured for different VPN access I have been able to successfully configure and test the connection individually to a single WAN but having issues connecting individually to the 2nd WAN. The connection to the 2nd WAN gives a WAN1 cert error. I have verified that the WAN2 Entra enterprise app and the WAN2 IPSec VPN configs do not reference the WAN1 cert.I also have not figured out how to sperate the different VPN access groups without building a bunch of enterprise apps in Entra the reference specific access groups. My hope is to have a single app for each WAN connection with different groups for access, then limit network access by the group membership in the policy. I can find plenty of documentation on how to do this with SSL-VPN, but I'm trying to stay away fr

Does anyone have any references for how to configure the digital I/O on a Fortigate rugged? I would like to be able to set up one of the outputs to alarm on failure of one of the power inputs.

Hello,i'm stuck in creating an Ipsec dialup vpn ikev2 with cisco DUO.During the Phase1 negotiation i see errors on the EAP failing negotiation, following the screenshot directly from the firewall gui and the log taken from cli.I double checked all the settings, configured even the following for EAP:    set eap enable    set eap-identity send-request    set acct-verify enable But i'm still facing "FNBAM_DENIED" followed by the "connection expiring due to EAP failure", what am i missing and should do?My radius is DUO_MFA with ip 192.168.20.125105.94.83.72 is the remote ip and 25.36.47.58 is my public ipjohn.week is my userFw version is 7.4.7Forticlient version is 7.4.3 and 7.4.0.1658     VPNFWISDB (Vpn) # ike V=internet:accepts ike tcp-transport(vd=1, vrf=0, intf=0:55, 88.51.233.52:4500->157.245.243.118:36001 sock=0 refcnt=2 ph1=(nil)) (53).ike V=internet:Wrong IKETCP prefix(OPTION)ike V=Vpn:5: comes 25.36.47.58:500

Hello, i'm trying to set up a Dialup ipsec vpn with cisco Duo as Mfa in order to allow remote users to connect to my company.The fortigate version 7.4.7 has 4 Vdoms (root + internet, mydmz, myvpn).the internet vdom is used to manage internet traffic inbound and outbound.mydmz vdom exposes my public services and has ip 161.10.10.1/28, the myvpn vdom instead is where i want to terminate the vpn and has ip 161.10.10.6/28 (this is the ip configured in forticlient).I'm able to ping ip 161.10.10.6 and from a debug flow i see  the traffic passing correctly from port 10 associated to  internet vdom to port11 associated to mydmz vdom (i'm not able to see traffic arriving to port 12 in the myvpn vdom but the ping is ok....).However when connecting via forticlient (version 7.4.3 or 7.4.0) i see in the log UNIDIRECTIONAL flow from outside to inside and never viceversa; internet to mydmz vdom.What could be the problem?The policy to allow traffic from internet to myvpn vdom

Hi. I want to get license for fortinet on VMware, can you help me?

I am login with partner account but i am not getting service option beside support and i am not create a ticket please solve it

Hi.I've got a 60E that I'm replacing under the trade-up as it is EOL next year July.The reseller told me it would simply be deactivated which is fair enough that I don't have to ship the old one back, but what exactly does that mean?Is the old device going to be nothing more than a paperweight going forward, or could it be used as a basic firewall without all the subscription features. I.e. could I used it at home and create forward/blocking rules etc.Or do I simply send it off to an e-waste recycling center?

Hi GuysI'm testing FortiNAC with a FortiGate (as a wireless controller) and FortiAP's.During testing, I noticed that coa does not work as desired. The VLAN is only changed during disconnect/connect of the client.I use the command "sendcoa -ip 172.xx.xx.xx -mac XX:XX:XX:XX:XX:XX -dis" on FortiNAC.With "execute tcpdump -i any port 3799 -v" I get the following output: tcpdump: data link type LINUX_SLL2dropped privs to admintcpdump: listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes10:44:49.640276 port1 Out IP (tos 0x0, ttl 64, id 43159, offset 0, flags [DF], proto UDP (17), length 78)s-test-fncesx01.42844 > _gateway.3799: RADIUS, length: 50Disconnect-Request (40), id: 0x25, Authenticator: aafde2cc1e57197d88bdfac5632f91abCalling-Station-Id Attribute (31), length: 19, Value: XX:XX:XX:XX:XX:XXUser-Name Attribute (1), length: 11, Value: host/XXXX10:44:51.641526 port1 In IP (tos 0x0, ttl 64, id 3676, offset 0, flags [none], proto UDP (17), length 78)

If we have 2 sdwan rule where each rule have same source, same destination but only have different sdwan member like below, will the source will be switched from rule 16 to rule 17 if internet1 have bad performance?

When I logged in today, I got a network error message. The request timed out. On my Mac, where it was previously working, I deleted the app, redownloaded it, and reinstalled it, but the problem is the same. Is there a solution?

Hello, I use commande : diagnose sniffer packet any 'port 541' 6 0 l i have :42 packets received by filter0 packets dropped by kernelbut the command never show packets, i don't understand why ? I tried in CLI web and sshthnaks

Hi everyone, I am planning to shift my authenticator HA to my DR location, primary will be in Primary site and secondary will on DR site, they both will have different subnets and all IP addresses will be different as it has to be configured on DR site, kindly share your input on how I can make it work

All of our Windows Laptops are joined to our Active Directory domain when we send them out to users.  With VPN a user could change their AD password and the password would sync to the Laptop over VPN while connected.  Now that we are changing over to ZTNA there is no VPN for users to sync their AD passwords.   I could setup a proxy (more like 10 proxies) for all the ports needed by AD to allow password syncing but this sounds a bit over kill.  There must be a solution that others have come across to do this.

Hello everyone, I have a FortiGate 400F and updated it from version 7.2.11 to version 7.4.8. I'm currently trying to access Zabbix via SNMP, but I'm getting errors. When I try manually using snmpwalk on my Ubuntu server, I get No Response From... and Timeout errors. I've tried SNMP v2 and SNMP v3, removed the AUTO settings, and still the same thing.The servers I am testing are added as trusted hosts, SNMP is active on the interface side, there is no Local in policy, and even if I manually add and allow them, timeout errors continue.Another server in the same src network was already accessing via SNMP before the update, so there is no problem with the firewall policies.diagnose debug application snmpd -1diagnose debug enable commands do not produce any logs. They are currently being tested.When I examine the issue at the kernel debug level (with the commands below)diagnose debug flow filter cleardiagnose debug flow filter saddr 192.168.1.212diagnose debug flow filter daddr 192

forticlient shows SSL VPN connection is down as soon as user clicks on connect nothing comes on debug commands too