Fortinet Community

Hello,  I was wondering if there was any way to forward the Google Id Token to the backend when using a Google Oauth2.0 Server.Right now, the fortiweb puts in "authorization" header "Bearer + Google AccessToken"But I would like this header to contain "Bearer + Google IdToken"The difference for me is that Google IdToken is a Jwt that can be decoded and verified easily in my backend and so can be used as is to authenticate everything in my backend.On the other hand the AccessToken is opaque and only give me access to GoogleApis. So this means I would need to mint my own Jwt with the infos I get from /userinfos google endpoint.Thanks in advance,  Jules

I have deployed FortiNAC in HA mode. And use its radius server to authenticate users when they are login to the network devices. When the primary unit is active user can login using their name and password only. However when secondary unit become active users should include name@domin name to access it. Can someone explain wh

Hi everyone.I have a question about IPsec phase 2 in FortiGate. I need to create nearly 60 IPsec site-to-site tunnels. At the center site, we have 8 different subnets. Is it better to create a separate Phase 2 for each subnet or use 0.0.0.0/0 as the local and remote site in Phase 2?

Hi,I need to configure policy-based routing and I'm testing it, but it doesn't work even though the configuration is correct.According to a veteran's advice, I temporarily enabled asymroute, and when I immediately disabled it, the routing started working.I'm reluctant to use this method. Is this a well-known workaround?Do you have any advice on a better way to handle this? Hardware: FortiGate 120G OS: 7.4.8Thanks,Kenji

Hi,I'm having issues generating Let's Encrypt certificates on our FortiGate. We have a connection to Let's Encrypts ACME server, DNS was also checked. Our subdomain resolves to the correct IP address. FortiGate also says that the renewal was successful, however the certificate cannot be used in any service (we are generating a cert for SSL-VPN). When you try to view the details of the cert this is what you get:get vpn certificate local details SSLVPN == [ SSLVPN ] ACME details: Status: Unprovisioned Staging status: The certificate for the managed domain has been renewed successfully and can be used (valid since Mon, 08 Sep 2025 12:32:13 GMT). A graceful server restart now is recommended.We also tried restarting Fortigate, no luck.How can we troubleshoot this ?Thank you in advance!

Hi All,We have Azure SAMl configured for VPN client and has a conditional policy as well to only allow login from domain joined devices.This is working as expected, how ever the auto connect with azure ad option is not working.Tried with different documentation and articles still same, logs also doesn’t have much info.

Hello we have Fortimanager giving the Error message appearing every time trying to edit variable mapping."Failed to add per-device mapping to FMG variable"we tried :diagnose dvm check-integritydiag cdb upgrade check objcfg-integritydiagnose cdb check policy-packagesdiagnose pm2 check-integrity alldiag cdb upgrade check reference-integritydiagnose cdb upgrade check +allBut the above commands, unfortunately, didn't workAny Advice?Thanks

Hi, Analytics is currently set to 90 days and Archive is set to 730 days.We have two years' worth of archive logs. What should I do to watch a year's worth of Analytics? Should I change the Analytics period to 365 and then db-rebuild it? Thank you. 

If the Fortigate have multiple vdom, can we directly enter to the vdom global without issuing 'config global'?Currently when i ssh to the fortigate i must enter that command first before i can execute 'get system global'

Hi,I've a corporate laptop that uses Forticlient to establish a VPNconnection to corporate resources.When working at home, when this corporate laptop is connected through the ISProuter, there's no problem connecting to the VPN server. Now, I'm setting up my own router/firewall.Using simple NAT rules, other systems can connect fine to the Internet, also the corporatelaptop can connect fine for everything except the VPN resources.When I try to connect the VPN, Forticlient 2.7.8.1140 returns:"a network error prevented updates from being downloaded". It seems that for this kind of ssl vpn there are some special rules.Can you please tell me what rules, protocols, ports, etc should Iconsider in my router/firewall?If you could show Linux iptables rules (or FreeBSD, OpenBSD, NetBSD equivalents), it would be very kind of you.Thank you

I currently have two FortiGate 60F devices running in an active-passive HA pair. I am monitoring the active device in N-Central via the management IP, but I am wondering what is the recommended method to monitor the standby unit as there is not a management IP of the standby device. I was planning on monitoring fgHaSystemMode (OID: .1.3.6.1.4.1.12356.101.13.1.1) via SNMP and querying against the OID to ensure that the value of this 3 to match active-passive as I will know if the passive device is down if this value is either standalone or active-active. Currently we are only monitoring the active device so we would not be aware if the secondary goes down 

Hi,We are preparing to migrate from FortiClient EMS 7.2.10 to 7.4.4.We deployed EMS on a Hyper-V VM.Copy/Paste doesn't work in EMS CLI 7.4.4.How can I enable the clipboard functionality? 

Hi everyone! I have this scenario.. FSW124D-POE ---> Ubiquiti NanoStation M5 <---> Ubiquiti Rocket M5 <---Fortigate100EI want to administrate the Fortiswitch from fortigate... i get to authorize the Fortiswitch but Fortilink the CAPWAP tunnel naver came up.Can anyone help me with this?!Regards!

Hello everyone ,  I want to know the number of users each model can support based on your experience.I know that sizing must be based on other metrics: use cases, activated licenses, ISP throughput, interface configuration, etc... But , The number of users can give an idea of ​​the size of the environment, so I want to know how to relate the number of users to the range of fortigate models that might be suitable. I then use these metrics to determine the best model among the other models in this iteration.I'm talking about the F and G series. Thanks for your supportRegards

dear expert, I'm about to integrate my FML to GWS. I have 1500 mailboxes, and the company purchased only 1300 mailboxes.Questions.1. How is the FortiMail able to identify, filter, or inspect 1300 email addresses?2. Customer requirement. 1300 identified email addresses/users will only hit/pass the FML for inspection in both directions (inbound/outbound). The remaining 200 email users should bypass FML inspection3. How do we count licenses if a user (x) is a member of a single or multiple aliases or groups? Appreciate any inputs. Thank you.

I have Fortigate 7.6.2, FortiManager 7.6.2 and FortiClient EMS 7.4.   We are switching over to ZTNA and I have created a wildcard.example.com proxy for port 443 that most users see.  I have another wildcard.test.com proxy port 443 that is not seen by most people yet I have a few users that have some background process that is trying to access something that matches wildcard.test.com on port 443.  This connection fails and floods the user with ZTNA error 65 popups. The 2 users are running Macos so I got a copy of the logs but I am not seeing the real URL they are trying to access.  Only that they are trying to match the policy for wildcard.test.com proxy port 443 and its failing.  I see the same thing on the Fortigate. Is there anyway I can see what the real url is they are trying to go to?

I am looking at setting up Performance SLA on Fortinet which i have done on Fortimanager, however what the requirement is for this is over the network report on this within the FAZ if possible. What I need is a list of the devices that are on the network then along with this a count where it may have failed the various SLA targets, so for example.Device     Ping     ICMP80f-1 -      3              0So I am only interested where the SLA has breached my target of say 20m/s on a monthly basis across the various SLA's not every single one. Is this possible at all out of the box as can only see a handful of reports that can provide some kind of SLA but this a generalisation across the board.

Hello, I have a FortiVoice 200F8 verison 7.2.1 running a VOIP trunk with fax setup. T.38 is enabled on the trunk SIP profile. I took a packet capture of an inbound fax and this is what I found (I am the client). Maybe I am misinterpreting the packet capture, but it looks like my 200F8 is trying to use T.38, the sender ignores it, and then the FortiVoice hangs up. What I find interesting is this setting under Fax: The packet capture shows multiple attempts at T.38, doesn't fallback to G.711, and ends the call. What constitutes T.38 failure for this setting to work? 

Hi i have a problem to ativate double stack for  vpn ssl   config vpn ssl settings set dual-stack-mode enable end Response in cli mode   set dual-stack-mode enableTo enable dual-stack-mode, all SSL-VPN policies must be configured with IPv4 and IPv6.node_check_object fail! for dual-stack-mode enable    I have only one vpn policie. do you have an idea ? Regards

I have the following situation: I have a website that in our config is allowed per cathegory due to FortiGuard rating. Now  we want to temporarily have webfilter block that site.So I added a web rating override to a local cathegory that is set to action block in our webfilter profiles.However that site does not get blocked. It does get blocked if I do it via static url filter. It also does get blocked (but without blocking page) if I deny it by a policy.Then tried the same with www.ccc.de and it was blocked by webfilter due to the rating override correctly. For debugging I had the webfilter debug log running while I tried to access the site: Log says this;[334@2136]urlf_query_fgd: id:1187 sess:2136 action:2 error:0 src:1 host:myurl.com url: rate_ip:0 ssl_exemption_query:0[334@2136]ips_urlf_add_query: id:1187, queue:1, ssl_exemption: 0[334@2136]urlf_query_fgd: session:2136 suspended, query id:1187 for www.cccc.de it says this: [334@2128]match

Hello guys , I have a problem with reports from FortiAnalyzer.  I'm gonna explain my 'topology' the best way i can.Firstly, there is a standalone EMS that pushes the logs of the hosts to the FortiAnalyzer. I can see the logs in Fortianalyzer , so we are sure that we have them in the right place and there isnt a conneciton problem. It seems that when i run a report (new or old) it's contents its the same almost every time and there is only one host in its results. I use the default report editor (i have tried use different choices in the graphs but no desired result). Also i give it a try with and without  the extended log filtering and checked all the options (device , source ip, dest ip, endpoint id....). Enable High Accuracy Caching also checked in case there is a problem with the number of logs.  FortiAnalyzer uses ADOM (the correct one selected) , version v7.6.3 build3492 (Feature)

We are doing evaluation of cloud DR solutions.one of the recommendation is to create same subnet/same ip address in the cloud DR so that in the event of DR, we can swing over to cloud once local data centre is confirm not accessible.Question, can we do ipsec tunnel with same local and remote address in the phase 2 selectors?eg. local address - 172.16.0.0/24 and remote address as 172.16.0.0/24. 

I have scenario :My SDWAN rule contain 2 member, ISP-1 and ISP2, have 2 performance SLA, and the strategy using Best Quality with Latency Criteria.Since there are 2 performance SLA, when the sdwan will switch the connection? Is my understanding below correct? SLA1 meet & SLA1 meet = not swicthedSLA1 not meet & SLA1 meet = swicthedSLA1 meet & SLA1 not meet = swicthedSLA1 not meet & SLA1 not meet = go to other sdwan rule. 

I am having issues with SSH access on Fortigate.When I log in via LDP, it works correctly.However, when I use a "local account," I get the following error on Fortigate after entering the username:Administrator pam login failed from ssh(XXXXX) because of blocked IPI should mention that I am using the "Restrict login to trusted hosts" option with the correct IP already configured, and the IP shown in the log as failed does not match the one I am accessing from. Could you help me understand what is happening?

Greetings, all. I have 60 site-to-site IPsec tunnels, and in order to create a policy for each one, I will need to write numerous policies due to the varied zones. I am inquiring as to what the most effective practices are at this time. Should I establish Zones or Interface Groups or enable multiple interface policies?