Fortinet Community

We are migrating our network infrastructure to FS1048e switches. We have some legacy equipment that  refuses to communicate at a port speed of 1Gbps. The transceivers we are currently using are FN-TRAN-GC. Copilot suggested FN-TRAN-SFP+GC, but the website it referenced is a third party site that doesn't give me much confidence in its accuracy. Our requirements for the transceiver are an RJ-45 connector, compatible with the FS1048e that can operate at a speed of 100Mbps. Has anyone else run into a similar need and found a working transceiver for the FS1048e?

We have been going through the process of setting up our Firewall to access Forticlient connections. All went well with connecting via just a Pre-Shared Key but we wanted to implement Saml using Entra ID. We went through multiple documents and have everything setup correctly (At least we think so). When we try to connect we get the popup to provide our credentials. After the credentials are submitted we are shown a <FQDN> server IP address could not be found. I made another connection using an external browser and when I make the connection I can see it sending the request to our Public facing IP address and then resolves to <FQDN>/remote/saml/login. The message in this window is 'can't reach this page'. There are Firewall policies setup to allow all traffic from the VPN Tunnel so we can verify that it works before scaling back but still does not work. The only thing that comes to mind is I read that the <FQDN> needs to be reachable from the internet. Ours i

Hi,I am planning to use ADC in transparent mode and would like to know if there are any limitations compared to L3 mode. I couldn’t find clear information on this.For example, are there fewer load-balancing methods or health check options available in transparent mode than in L3 mode?Regards, # https://docs.fortinet.com/document/fortiadc/7.2.4/handbook/592141/transparent-mode

Is anyone experiencing an issue with FortiClient VPN when 'Enable Local LAN' is checked with an IPSec configuration? For example, when 'Enable Local LAN' is checked, the VPN will not connect whatsoever. If so, what setting on the FortiGate needs to be changed in order for this to work?

Im asking because in the last three years i upgraded over 200+ fortigate 60E/F 100F and 500E and never had any issue. I always follow the upgrade path and do it through fortimanager. I have to upgrade some devices tomorrow and I got the bad thinking what would I do if the device does not get back up after reboot... Tell me your stories and how did you fix the unexpected upgrade fail?

Hi FNAC AdmisFortiNAC-F 7.2.9Ruckus ZD1200 v10.xThe WLC doesn't support CoA. So if I understand well the FNAC will send a RADIUS disconnect request in order to change the client's VLAN. But this doesn't happen.The test I've made is to fail the scan of the client. When the client is in wire network it is sent to quarantine, however when it is on WiFi it is not sent to quarantine and not even disconnected.Furthermore when the host is at risk and I try disconnect and reconnect to the SSID, it is put in the production VLAN instead of the isolation VLAN.Followed FortiNAC's "Ruckus Zone Director Wireless Controller Integration" document, but it doesn't mention anything about the issue and its resolution.

Hi Fortinet Team,I would like to know how to remove the OT SKU from the customer portal. I also want to clarify whether OT Security is no longer part of the Enterprise Protection plan, as I understand it has been moved to a separate bundle.In our company, we are not using OT services. However, when I log in to the FortiCloud portal under Assets, it shows some expired licenses related to OT Essentials. Could you please assist me in resolving this issue and guide me on how to remove the expired OT SKU from our portal?I have attached Photo for you reference  Thank you in advance for your support. 

Setting up a FortiGate for multiple distinct schools (30). Each requires custom web filters. We manage all sites under one VDOM. Configuring custom web filter settings were a category is blocked and they want to allow a specific site. Block social media but allow Facebook. Once a category is blocked, an allow does not work. So we started to create custom categories for web rating overrides. We must of hit the limit of custom categories "maximum number of entries has been reached", we have 52. Is there a way to increase that number per VDOM? v7.4.8

Hi,I am tryingt to switch form ssl-vpn to ipsec dial up vpn. I worked on this for days now. No success. I have got a Fortigate 80F with Fortios 7.2.1 and FortiEMS & Forticlient running (Forticlient 7.2.11 / FortiEMS 7.2.10) There are 4 IPSEC Site2Site tunnels Forti to Forti1 Dialupconnection (IPSEC) with fixed IPs (local and remote)1 Dialupconnection (IPSEC) with variable dial up IP (IKE V1) And now I try to add an additional IPSEC-Dialup-Access.I configured the Fortigate as follows:NetworkRemote Gateway Dialup, Interface WAN1IPv4 client range: 172.16.10.1-172.16.10.30/255.255.255.255 (even tried 255.255.255.224)IPv6 is not used but there is: ::-::/128 AuthenticationPre-shared KeyIKE Version 2Accept Peers: Specific Peer ID: homeoffice.local P1 ProposalAES128-SHA256 / AES256_GCM-PRFSHA384DH: 18Key-Lifetime: 86400 P2 SelectorsName HomeofficeipsecLocal Address 192.168.10.0/255.255.255.0Remote Address: 172.16.10.0/255.255.255.224 P2 ProposalAES256 SHA

Hi FNAC adminsI see FNAC-F doesn't support SCEP.Anyone knows when it is planed?

Hi FNAC adisOn FortiNAC-F 7.2.9 we can see logs of local RADIUS but can't find anywhere the logs of RADIUS proxy.Any idea where we can find that?

Can I upgrade the fortigate version from 7.4.3 (feature) to 7.4.8 (mature).?

When i configure my fortigate lab as ssl vpn client to connect to the fortigate at office, why when ssl vpn connected then internal network under fortigate lab is not reachable to connect to the intenret by hostname? Actualy fortigate on the lab act as dns server also.Traffic from lab to the internet is working fine, i can ping by ip (8.8.8.8) but the issue i can't ping by hostname.

I have 2 VPNs configured in my forticlient VPN, one of those works fine but the other after it connects I can't acess any server in my network.I checked that it shows that Received bytes are constantly at 0. I was using an older version of the client for years until it stopped working for this 2nd VPN, then I updated it to version 7.4.0.1658, but the problem continued. Can anyone help me understand what is the problem?

Please, i need help on the fortigate VM license expiration.  I have tried to link the device to my FortiCloud but it keep given a serial number error. If you can help with the detail below i would be grateful.      

Android tablet showing up in wifi logs 8x per minute with "client ip detected" by Fortiap in home lab stack. Other devices including other android tablets "check in" maybe once every day or two. Tablet works fine and stays connected to wifi. Is there some setting in my SSID or gate or tablet that should be changed and any idea what is causing this constant behavior? Using 2.4Gz band. Hyper vigilant because of malicious activity from neighbour

Hello Fortinet Community,I recently updated to the latest version of FortiClient VPN v7.4.2.1737 software and noticed that it is using an End-of-Life (EOL) version of the OpenSSL library, specifically v3.1.7. Given the importance of maintaining up-to-date security protocols, I am concerned about the potential vulnerabilities associated with using an outdated library.Could anyone provide information on whether Fortinet has plans to address this issue in upcoming updates? Is there a timeline for when a fix might be implemented?The affected paths are:c:\program files\fortinet\forticlient\libcrypto-3-x64.dllc:\program files\fortinet\forticlient\libssl-3-x64.dllc:\program files\fortinet\forticlient\x86\libcrypto-3.dllc:\program files\fortinet\forticlient\x86\libssl-3.dll

Hello, in the proccess of troubleshooting my Entra SAML DialUp IPsec tunnel I noticed something weird. While SAML auth via TCP 9443 worked fine, the handover to the IKE negotiation didn't work. There were no packets being received by FortiGate referring to IKE negotiation or ESP, only SAML via 9443. I was blaming my ISP first but running a local Wireshark on my WiFi interface revealed that there aren't even packets leaving my device for that peer IP referring to IPsec. To limit potential sources of errors, I replaced the SAML auth with a local firewall user and tried to log in. However, that doesn't work as well. Now there are NONE outgoing packets to the gateway IP! Upon login, FortiClient freezes for a bit and then says "IPsec connection is down" - like without even trying. I tested on 3 diferent devices now and I can't get it to work. My only assumption is that Wireshark doesn't capture the traffic to the gateway and that there's an iussue somewhere in the config

Hello, I have a FortiWifi-60F, Firmware v7.0.17 build0682, it has less the 2Gb memory. My understanding is that in the current firmware 7.6.4 for model with less then 2Gb memory SSL VPN is removed from 2GB RAM models for tunnel and web mode and also Agentless VPN is removed.  My question is for the FortiWifi-60F, with the firmware 7.6.4 does is support the ZTNA agentless web access mode? Would the model Fortinet-70F support ZTNA agentless web access mode and or Agentless VPN? Regards Scott 

Hello Team, We have integrated the Fortigate with the Forticlient EMS along with Azure IdP for MFA authentication. The forticlient gets connected and Azure IdP with MFA is also working as expected.  Now we are trying to implement Hybrid Azure AD Joined, we are experiencing an issue where FortiClient is not able to recognize that laptop is Hybrid Azure AD Joined, even after the Hybrid Join feature has been enabled in the Conditional Access policy in Azure Active Directory. Also, we have followed the below link and check the mark the check on Use External Browser as user-agent for saml user authentication, but its not working. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Implementing-device-based-Conditional-Access/ta-p/267878 Anyone can help on this?

Is is possible to set up a FortiGate (40F) as PPPoE-forward. Just to forward the /29-block I am given by the provider.

FGT-A have 2 different link to FGT-B, 1st link must enable the NAT and the 2nd link not use NAT.How we can create policy to enable NAT only for 1st link, since in the firewall policy we use sdwan interface for the destination?

We are in the process of moving our VPN users to IPSec RA VPN, but we need to use SAML SSO. This requires some port to be opened up, so we're using tcp/9443 like the documentation. The reason we're moving away from SSL VPN is because of the large number of security flaws being discovered and attacked in the wild. Is the port we open up for SAML going to keep us susceptible to newly discovered SSL/TLS security flaws? Thank you.

Since I upgraded to 7.2.4 on my FMG, the install preview is absolute garbage. 80% of the time it never loads anything. I can SOMETIMES "view policy difference" to verify I'm not about to push out an unexpected change, but that loads slow as hell too. Is it just mine? Is this a known issue?

When creating a Fortigate interface, I have to select an interface role as per the title (WAN/LAN/DMZ)What behaviour does this role actually change https://omegle.onl/ ?Thanks!