Fortinet Community

Hi, I have a new Notebook, Windows 11 Pro and Snapdragon CPU. I cant install Forticlient. I tried different version, 6.4.7, 6.4.10, 7 and the latest one. I run as administrator and after installing the drivers it shows rolling back and it can not be installed. I tried the Remove Tool and the Laptop started again, but installing I dont have more luck. Any more suggestions? Thanks

Trying to understand all of this so I have a few questions around the setup:I want to do TCP forwarding to support SSH but we use an internal bastion host.  So all users login to the host with their own login and from there can SSH to host in production.  From what I can tell I cannot do host key checking since that would me all users need to login to a single account.When setting up the ZTNA server one of the questions is the Default Cert.  What cert is that?  If my destination host is jump.example.com would that cert be for *.example.com???  And if so I also need to copy it to the EMS server and tell EMS to push it down to the client????Lastly,  I am trying to setup ZTNA to use SSO thats connected to our ADFS.  So if I SSH to jump.example.com should I get prompted for SSO login?  At least once in a while?

Hi all,I'm experimenting on v7.2.11 with ADVPN, SD-WAN and BGP on loopback interfaces. My problem is that I can't understand or find information on how the underlay interfaces routing should be configured. Two or four IPSec tunnels are members of the overlay SD-WAN zone (both branch and HQ use two Internet uplinks). The tunnels are configured on different physical interfaces and should be active all the time, so encrypted packets should go out through the respective interfaces to the specified addresses. A default route through one interface, of course, won't do. Should there be two/four routes to 0.0.0.0/0 through all interfaces with the same distance? Or should there be another SD-WAN zone containing the underlay interfaces? But in the latter case, won't SD-WAN steer all encrypted packets through one "best" physical interface?While I'm at this routing question, I would also like to ask another, simpler one: when configuring a site-to-site VPN without split tunnel, I have to set a def

Hello guys! Got a bit confused with FG's auth process for remote ssl-vpn users. For now we have a simple LDAP/AD (w/o agent) based authentication for remote users and ACL based on AD group names, everything just works and works fine. Now I got the case that I have to implement MFA via an MS NPS(plus azure MFA) as a radius server (please don't ask why). I don't understand how to implement this transparently. Do I have to add all existing groups by name in the same way how I do this with LDAP into each ACL(that's could be long, but ok)? And how the FG knows in which group a user in ? What if the user is in several groups? So can anyone elaborate these moments ? I read this article , but it's still unclear https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-User-Groups-to-match-multiple-Remote/ta-p/358789 AFAIK the FG gets the group name AVP from the radius server (MS-NPS) , but is it all groups for each client or like a first group per client ? Do we have to change sett

Hi!  We have a pair of Fortigate VM64 in HA on VMware (provider is OVH).We are migrating clients from PaloAlto to this Fortigate. We have around 30 VDOM (and we need to add more), with VDL link to the root.We have EMAC VLANS for the interface (WAN, Private and DMZ). It is working, but when the sessions increase around 30K and higher, everything become very slow.The ping between private and dmz inside any vdom increase around 100-150ms with lost packets. The CPU is used max 20%, and the memory around 60%. We have a ticket with Fortinet, but for them , with a packet capture, there were able to show that the fortigate don't add any latency in the packets. We move back one of the client to PaloAlto and they are now happy!The PaloAlto use the same VMware farm. To be able to make the EMAC VLAN and VDL work, we needed to enable the promicious mode on the port group on VMware. Maybe this is the problem. The links are 10GBs, and the traffic on the trunk t

I've been tasked with implementing a FortiVoice 50E6 On-Premise appliance on our HQ. I've had Voice experience with Grandstream... but this feels like a totally different thing. I'd like to know if there's any type of documentation that can help me install an analog trunk.I'd deeply appreciate the help.

Hey guys, I got a weird one here. I know the FortiExtender is the device to make this happen but a need has come up to try and see if this works on a Dual 3G4G 70G. Idea is that the FortiGate WWAN interface would terminate the connection to the private cellular APN and then pass the assigned IP through to a device behind it. I also found this doc but I don't think it is quite what I am looking to do.https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/862747/direct-ip-support-for-lte-4g

If the FGT in the Azure V-hub isn't directly connected to the local network, the local network won't be able to access it and won't be managed by our local FortiManager.Azure V-hub doesn't pass its routes to indirect connections. What are your thoughts on this issue?

Dear All,We recently completed a migration from F5 to FortiADC, and the applications are functioning well through FortiADC. However, we observed an issue specifically with the SAP mobile application:The application works properly on both computer and mobile browsers.But it does not work on the mobile application.If we revert back to F5, the mobile app works fine. The only noticeable difference is that we configured a URL redirection policy on this virtual server in FortiADC. Other than that, all configurations are identical to the working setup. Has anyone experienced similar issues or can provide insights on this behavior? Your valuable inputs will be much appreciated.Thanks, SivaG

Hello expert. i Humbly request some guidance. I have a fortigate 80F and tried connected  to manage the  fortiswitch 524D via fortilink but the following error  "offline" (see screen shots) I have included a two screen shots for clarity.    Regards

Hi all, I'm an experienced network guy with 28 years of experience, but it's all Cisco. I'm new to Fortinet. Here's my question: I'm working on a design for a customer with multiple satellite offices that connect back to two datacenters (primary and DR). They are all interconnected with two layer-2 ELAN WAN meshes.  I want to centralize all of my routing onto the Fortigate firewalls at each location. But because the WAN links are from two separate vendors each Fortigate is going to have two physical handoffs, one to each vendor's network. My plan is to create a WAN zone on each Fortigate and then put both physical interfaces in that same zone. (I don't need any filtering/firewalling between those interfaces.) I'm trying to find out if I am going to run into any asymmetric routing issues. The WAN circuits will be load balanced so I can't promise that packets  from a particular session that go out on one vendor's circuit won't return on the other vendor's circuit

Sorry if this is not the correct place to post this:Hi,I'm new to FortiNet and started at a small company that uses it. It fell into my role as I'm the most technical person on the team, and my predecessor had long left before i started, so no handover.I'm struggling to know where to start. Any recommendations? Good YouTube series etc?I've been experimenting with adding new devices/servers to test existing firewall and port rules, but i can't get anything to communicate off its local subnet so i didn't get very far.Thanks

 Dear Team, I would like to seek your support regarding SSL certificate deployment. I have added the firewall SSL certificate into the AD server via Group Policy, but it seems not to be working as expected. Currently, the only way users are able to access the internet is if I install the certificate manually on each workstation. Since we have 3 branches with AD hosted in the DC, and more than 500 users, it is not feasible to install the certificate manually on every system. I need to ensure this certificate is deployed successfully via Group Policy so that all users automatically receive it. Could you please assist me in resolving this issue? Thanks in advance for your support. Best regards,

Based on another solution by @funkylicious we created a FQDN that was addressable from the internet. We also created a certificate with the FQDN in the common name and the IP address in the Subject Alternative Name. When Forticlient tries to connect to the FQDN the web browser states the connection is not private and lists that the Cert Common Name is Invalid. I notice in the address field that instead of the FQDN being listed it is showing the IP address. I thought that have the IP address in the SAN would address this. Our security policies do not allow users to continue if there is a security certificate mismatch. So trying to figure out why the IP address is showing up when connecting to the VPN instead of the FQDN. Do I need to make another certificate that explicitly names the IP address instead of the FQDN?

Hello All, I am testing free Forticlient VPN only in Ubuntu-24 and Fedora 41, unfortunately it doesn't works after 1 month trial period expired. It's showing "Forticlient- Zero Trust Fabric Agent" only. However, free forticlient working fine with the Windows and MacOS even after 1 month free trial.Note: I am using latest version of free forticlient vpn only.https://www.fortinet.com/support/product-downloads#vpn- For the Linux I tested Strongswan VPN (CLI) and that works fine, but not with GUI "Network manager"  

Hello, I'm using Fortigate 201E firmware version 6.4.4.I have a traffic received from the port3 which needs to be translate to the broadcast address of port3. It means that the traffic needs to go from the same interface (ingress = outgress). So, I did the following configuration: In the port3 I have disable the anti-spoofing and enable the broadcast forward. edit "port3" set vdom "root" set ip 192.168.1.126 255.255.255.128 set allowaccess ping set broadcast-forward enable set vlanforward enable set type physical set src-check disable set alias "SERVICE" set security-mode captive-portal set security-exempt-list "port3-exempt-list" set role lan set snmp-index 11Then, I have create the VIP like this edit "DNAT_SERVICE" set uuid 14e3dde2-8a4d-51f0-58aa-109e4a3fac68 set extip 192.168.1.126 set mappedip "192.168.1.127" set extintf "port3"

Rule that use SNMP for a method seem to be very inconsistent. Have devices all configured from a clone image but some will not meet the rule but others will. I there a way to see why?  

Hey, Looking incorporate are existing Duo 2FA setup into our FortiGate VPN, I've followed through the guide but falling at the last hurdle. I've gotten as far as adding the Duo Proxy host as a radius server in Forti and if I do "Test Credentials" here it all works as expected, I get a prompt on my phone and a success message when I accept it. I've then tried to apply this to the VPN by creating a new user group linked to the radius server and changing the group in the SSL VPN Settings > Authentication / Portal Mapping section to be the new group. Unfortunately when I then try to connect to the VPN it never prompts for verification, just fails to authenticate. I have also ran the following at the CLI to increase the timeout but it didn't help. config system globalset remoteauthtimeout 60end I'm sure I've missed something super simple, but can't see what at the moment.

Hey Team, So My setup is as follows, the issue is that i can only get to my unifi device over the internet on the unifi UI website and i cant access it locallyInternet > Fortinet WANTwo networks on two interfaces 172.16.1.0 and 192.168.1.0Fortinets UI is 172.16.1.99172.16.1.0 is a virtual switch to my IT gear and network192.168.1.0 is for my family and runs a unifi gateway which then runs their network via DHCPThe Unifi gets a DHCP Address and detects the internet on 192.168.1.112The Unifi then runs its own internal network 192.168.0.1 which is also the Unifi's UI IPIt then translates via NAT to the fortinet on 192.168.1.112 for internet accessIt is an odd setup and yes i know a unifi gateway wasnt meant for this purpose but it works for me and makes my familys access point easy to control and networkSo the issue is, 172.16.1.0 cannot talk to the unifi's little internal network 192.168.0.1 to access the UI over the LAN, i can only access it over the internet as its added as a g

I'm facing a critical issue with our FortiGate 30E devices significant number of dropped packets across all LAN ports, while the WAN port continues to operate normally without any loss

Hello   I'm having trouble configuring an IPsec VPN. I configure one IPSec VPN and everything works fine. Clients connect and everything works fine. When I add another VPN, the previous one stops working. Below is the configuration of the first working VPN:                  I'm adding a second VPN    After adding a second VPN, "VPN_Gamma," the first one stopped working. Only after disabling the vpn_VPN_Gamma_remote policy did the first VPN start working again. What could be causing this?

Hello,Is FortiClient suitable for installation on hypervisors? What devices is FortiClient designed for? Thank you

Hi Friends,I need some help and I hope you all will assist me.I have a problem with a FortiGate firewall. I’m using FSSO (Fortinet Single Sign-On) in agentless mode to communicate with the Active Directory (AD) server for user authentication.The AD server is located at the data center (DC), and the users are located at branch offices.Note:LDAP connection status is upIPsec tunnel is upSD-WAN is also properly establishedBut the problem is:Users are not being authenticated properly. Sometimes they get authenticated, but within seconds or minutes, they become unauthenticated again.I have already checked the AD connection from the branch firewall, and communication is working (SYN-ACK is happening), but still, there’s a problem with authentication.To resolve this temporarily, I have to restart the user’s system repeatedly.Due to company policies, I cannot use agent-based authentication.Please help me with a solution.  

Hello,I'm trying to do a local lab by using Authentik as an IDP to establish sso login on Fortigate admin web interface.I'm using Fortigate VM (FGT_VM64-v7.6.0) I'm following this official Authentik tutorial: https://docs.goauthentik.io/integrations/services/fortigate-admin/ I downloaded two Authentik Self-signed certificate including certificate file and private key file (.pem extension). When I upload/import these files then it said "Incorrect certificate file key size for CA/LOCAL/REMOTE cert.". Can anyone explain and help me fix this issue? Thank you.