Fortinet Community

Hi Guys, Just a few things to raise about the way FC handles external browsers for SAML auth.If you initiate a connection that is configured to use the SAML auth via external browser from the FortiClient GUI, the external browser is not given focus when the tab opens.If the connection is initiated via the context menu from the system tray, the browser is given focus as expected, even when the FC GUI is currently in focus.I appreciate that because it just opens a new tab in the existing browser, it can take advantage of existing login sessions, but it would be nice to have an option to open in a new window and/or private browsing window of the browser.This would allow for greater flexibility in scenarios where you have a password manager that is able to fill out the details on each connection, which is preferable to establishing a session (say in Okta) because you want to be somewhat frequently switching between user accounts in the same Okta tenancy which the SAML auth process doe

Hi FAC adminsI noticed FAC 6.6.6 has only 2 resolved issues among 45 known issues on 6.6.5 (and still known on 6.6.6).I wonder why so few issues have been fixed in this patch.Is it worth updating?

SDWAN SLA performace in spoke1 choose shortcut tunnel to spoke2 because the latency is more small than main tunnel to the hub.SDWAN SLA performace in spoke2 choose main tunnel to spoke2 because the latency is more small than main tunnel to the hub.With this case spoke1 and spoke2 can't communiate. DOing the packet sniffer i can see traffic from LAN spoke1 is reach to spoke2 but spoke2 will reply using main tunnel to the hub.How we can deal with asymetric routing like this due to different SLA performance result?

Hi everyone, I've been working on a dataset to extract the number of FortiGates by model that experienced a conserve mode event. The query works, but it seems like the DISTINCT function isn’t actually returning only the unique entries. For example, I only have one FortiGate-40F-3G4G, but the query returns more than one device. As shown in the attached image, during the period when I ran the report, this same device triggered four conserve mode events, and the query counted all of them instead of just once.I've tried everything and still can't figure it out — lmao.  Here's what I'm trying to achieve:Get the list of unique devnames that triggered conserve modeIdentify the model of each deviceCount how many unique devices per modelAny help would be much appreciated!Here's my query: SELECTt1.platform AS tipo_dispositivo,COUNT(DISTINCT t2.devname) AS total_dispositivosFROM$func-fgt-inventory AS t1JOIN (SELECT devnameFROM $logWHERE $filterAND LOWER(TRIM(msg)) LIKE '%

Hello, I was digging into creating NAC policies using user-based policies. Currently, I am using FSSO user groups in the user group attribute.I did create a firewall policy to allow traffic between the onboarding VLAN and the collector agent server, and the user is authenticated without hitting the NAC policy. I am wondering if I can use FSSO user groups in NAC policies. Any ideas?

We have 2 sites (SiteA & SiteB) that have 2 VPN tunnels with HQ. e.g.:  SiteA ---- HQ ---- SiteBNow I can access to HQ on site A and access to HQ on siteB.Can I access to SiteB devices on SiteA?

If spoke1 have MPLS connection to the hub then hub have advpn to site2, can spoke1 talk to site2?

I ADVPN with BGP and SDWAN enabled, is add route in the VPN Phase1 Interface should be enabled or diasbled? 

Good morning friends.In the Fortigate firewall I see that the log and report "summary" option is blocked. According to the knowledge base https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-System-Event-Summary-is-disabled/ta-p/245747, this is resolved by enabling some options from Logging and Reporting -> Logging Settings. However, when I accessed that option, I did not find the "Enable fortiview history" option. My question is, to enable this option, do I need to have a FAZ license? or fortigate cloud?

Hi everyone,I wanted to give Fortigate a try, and I installed it as a VM with an evaluation license.Unfortunately, there doesn't seem to be much you can do with such a license, especially the inability to set VLANs up (due to interface limitations) is a big drawback to me.So, I was wondering how I could get a 60-90 day trial license.Could you please help me find out? Thanks

Hi everyone,Our office will be moving to a new location in a few weeks, and we recently purchased a new FortiGate. We need to transfer the FortiToken Mobile token license from our old FortiGate to the new one (the license was purchased about two years ago).I understand that I’ll need to open a support case with Fortinet to request a new license code. However, what I’d like to know is how long it typically takes for Fortinet to issue the new license once the case is opened.Specifically, since we’re moving on a Friday night, if I open the case at that time, is there any chance I’d receive the license code later that night? Our management team wants to ensure that users can connect to the VPN with 2FA by Monday morning.I already reached out to Fortinet directly, but I haven’t received a clear timeframe. If anyone has gone through this process recently, I’d really appreciate it if you could share your experience.Thanks in advance!

Hello,I am monitoring Fortigates using SNMPv3. Among other things I monitor the status of DHCP scopes to be informed if they are near to get full. The main (and the only) OID related is 1.3.6.1.4.1.12356.101.23.2.1.1.2. It returns per line the amount of assigned leases in percents of the total IP addresses in the scope. I can see the following situation: if there are reservations in the DHCP scope and if a device with a reservation got a lease, this device (this lease) is not counted in the SNMP response. It can lead to situations that some IP addresses are assigned and not free anymore, but the number of assigned leases according to SNMP is still 0. Which is wrong. Different Fortigates 100E, 100F and 200E and FortiOS 7.2.11 and 7.4.8.Could anyone please check this and let me know if I am missing anything? 

We have multiple Fortiswitches managed by a Fortigate.  I need a command to see the MAC addresses on a specific port on a managed switch.  For example, I need to see the MAC addresses on port 1 of switch "1234."  I can use this command to see "port1": diagnose switch-controller switch-info mac-table | grep port1 But this command lists all the port 1s for all the managed switches. I need a command that let's me specify which managed switch I want to view. Thanks.

We are converting checkpoint configurations to fortigate (finally getting rid of it)But I have seen the interface setting and here is something I am not used to itIn Checkpoint the LAG interface itself (the physical) has a network without VLAN the Forticonverter converter exactly the same settings. see screenshots bellow:I am used to put all IP addresses and betworks to logical interfaces with VLANIDSo my question is, will this work normally in fortigate? with VLAN ID 1 ? untagged ? can this interface (the physical) be assigned to policies later ? Thanks 

Using the FortiClient VPN to connect with SAML authentication, logins worked before we created a Conditional Access policy that enables "Require device to be marked as compliant" and "Require Microsoft Entra hybrid joined device". When we connect Microsoft blocks the login because it doesn't recognize the device with the following info. You can't get there from hereThis application contains sensitive information and can only be accessed from:domain joined devices. Access from personal devices is not allowed.The current browser is not supported, please use Microsoft Edge, Internet Explorer, Chrome or Firefox 91+ to access this application.If you're not planning to do this right now, you might still be able to browse to other domain sites. Otherwise, sign out to protect your account.Sign out and sign in with a different accountMore detailsError Code: 53001Request Id: RequestUUIDCorrelation Id: CorrelationUUIDTimestamp: 2024-09-14T20:46:27.958ZApp name: My VPN Enterprise AppName

We are using 200F firewalls in an HA pair on 7.4.8.  We use CSNAT.  We have SIP ALG disabled.  We need to NAT SIP traffic from one port on the firewall to another port on the firewall. Local Phone Server (Mitel) <=> ATT IP Flex Router. We need to make sure when the local phone server communicates with the ATT IP Flex Router, all traffic comes from a specific IP. We have setup the necessary NAT rules. For some reason, SIP traffic is not NATing.  All other traffic NATs fine- just not SIP traffic. For example, if I ping the ATT IP Flex Router from our local phone server, NAT works. When I initiate a SIP connection from our local phone server to the ATT IP Flex Router, traffic is not NATed- the ATT IP Flex router sees the local IP of our phone server, not the NATed IP. Is there a setting that enables SIP NAT?  Any other configuration tweaks needed? Thanks.

Hey there, We have a website whose domain is the same as our internal Windows domain name. We have external and internal DNS in place along with a trusted GoDaddy certificate on the website and the specific webpage I'm referencing. This web page runs an inframe that links back to Salesforce. On the Fortigate side, I have the website, webpage (it's a subdomain) both with wildcard allow rules on the Web Filter. I also have Salesforce allowed on the Application Control. However, the webpage is in a weird state to where it's mostly blocked with "connection reset" errors when you use any of the browsers. When I check the logs in the Fortigate, it shows me UTM Blocked because of SSL. However, the SSL is perfectly fine with a latest and greatest 1.3 certificate. To make matters worse, sometimes the webpage actually isn't blocked on Firefox and when I check those Fortigate logs, it shows as UTM Passing with SSL 1.3 through Microsoft Edge even though its Firefox. So, I'm not sure

Hi,I have a problem.I'm trying to deploy a Fortigate HA Active/Passive SDN connector cluster.If I go to marketplace, Choose the Fortigate Azure application and with the plan "Active-passive HA with fabric connector failover", I can't choose the desired VM type that is in the sizing guide.The sizing guide says that I should choose the D2s_V5 VM. But it isn't in the list.If I instead choose to deploy a single firewall from the marketplace, the D2s_V5 VM is there to choose.Any suggestions? Am I missing something?

Hi, I have this situation:an on-premise network that connects to the internet via the local Fortigate through the local ISP. I have a single VM that I need to force to use the tunnel from the on-premise Fortigate to a Fortigate in the cloud and connect to the internet using the VPN. I have tried all possible configurations, but via PBR, the VM continues to use the local ISP and does not use the VPN. I can't figure it out.odg is the signle ip of the vm 

I have a Fortigate on AWS and want to put it on FortiManager.What is the best way to do this without having to use the public IP?

Hi, We have currently migrating Cisco Firewalls to FortiGate. The client purchase FortiConverter Service license, and correct me if I am wrong, we will be registering the FortiGate devices to the FortiCloud including the FortiConverter Licenses attached to that devices? Then will need to open a ticket and upload the config files? What if we have more than 10 config files from more than 10 firewalls. It is possible to consolidate it?

All, We are a self managed small but growing design practice utilizing a FortiGate 60E in our file server.  Our office is expanding to the floor above our current space.  We currently have the following hardware in our rack: - Apple Mac Pro (Mostly a mac environment)- FortiGate 60E- Cisco SG200-50P Switch- Comcast Router- 4G Cellular Failover Router- Sonnett Tech Echo (NAS)- Security Camera Headunit Everything else is just monitor, keyboard, battery backup etc.  We are expanding to the second floor and will be moving both the Mac Pro and the NAS upstairs.  We purchased another Cisco SG200-50P for upstairs switching.  Currently, the Comcast Router (WAN1) and 4G Router (WAN2) are connected to the FortiGate which then routes to the Cisco Switch.  We are currently utilizing about 32 ports which is a mixture of data only endpoints and some VOIP endpoints.  We additionally have a UniFi software controller and a couple of WAPs serving int

Hi , Recently we are observing Cloud Activity log ingestion failure detected every hour. The alert information shows only about resource of lacework subscription event created in lacework gcp project. Subscription is active.  Is there any way to debug this scenario? 

Hi there.I am having some issues installing FortiClient 7.4.3 on MacOS 15.6 (24G84)Macbook Pro M4 Pro Using the terminal, I found that the installer fails at around 97%. installer: Package name is FortiClient installer: Installing at base path / installer:PHASE:Preparing for installation… installer:PHASE:Preparing the disk… installer:PHASE:Preparing FortiClient… installer:PHASE:Waiting for other installations to complete… installer:PHASE:Configuring the installation… installer:STATUS: installer:%17.931671 installer:PHASE:Writing files… installer:%39.280230 installer:PHASE:Writing files… installer:%64.101310 installer:PHASE:Running package scripts… installer:%64.661962 installer:PHASE:Running package scripts… installer:%65.221900 installer:PHASE:Running package scripts… installer:%65.786566 installer:PHASE:Running package scripts… installer:%66.347237 installer:PHASE:Running package scripts… installer:%66.911340 installer:PHASE:Running package scripts… installer:%86.516746 ins

I have firewalls in HQ and Branch. The goal is to send all traffic, internet and LAN from branch to HQ, so Branch will use the HQ internet. And HQ will have access to Branch LAN. The branch has dynamic IP from the ISP and the ISP router handles PPPOE. So the firewall is connected behind the router, since the router handles VOIP lines as well. For now I'll leave it that way until I can test and confirm if IPsec is a suitable option for this project. The tunnel is up and everything is working but my Branch internet download speed through the tunnel is 40Mbs which is acceptable since the HQ upload bandwidth is 50Mbs, but the Branch upload is only 8Mbs. This seems too low. Direct internet at the branch without tunnel is 100 down/50 up. I have the tunnel set up as below. Please help me check if this optimal, or if anything is done incorrectly. I have two Phase2 selectors. This is on HQPhase1Transport: UDPNAT traversal: EnableDPD: On DemandDPD retry count: 3DPD retry inte