Fortinet Community

 Hi all, How FMG deals with SNMP events that are supported by FMG but aren't supported by the managed device Ex: a system template with SNMP settings includes some SNMP events enabled. One of them is a Fan failure event. On the other side, a managed device, FG x, doesn't support the fan failure event in its SNMP settings. What happened when we tried to push this template?

I have a fortigate 60F in HA, I see the tokens, but when I want to assign them to users a message appears informing that the device is not registered, but if it is, the OS is 7.2.11 1740, The error appears when I want to send the email to the user

Greetings! I've been trying to set up a lab using FMG and FGT trial licence VMs on Hyper-V. I'm able to run both VMs alright individually, problem is when I try to register the FGT on the FMG.It appears that none of my FGT VMs are able to get their serial number under the CN or SAN fields on the Fortinet_Factory certificate and that makes FMG refuse connections to those VMs. I've tried redeploying the VM but that makes it "unlicensable" and its SN shows "FGVM00UNLICENSED". In this state, it refuses any attempts I make of licensing it, be it via login to FortiCloud or via license file upload. I'm running FMG VM version 7.4.7. I would try a lower version to avoid that issue but all the VM images available for download on FortiCloud currently have the same restriction regarding the fgfm-peercert-withoutsn command.  I'm running Hyper-V because I've had no luck downloading VMWare Workstation Pro from the Broadcom portal.Any help would be appreciated.

Hello everyone,I have a network that was configured a few years ago with a FortiGate (FG) using a "hardware switch" on ports 1, 2, and 3. The setup is as follows:"internal1" interface:Contains three VLANs:VLAN 1: Used as the core VLAN (I know this is not ideal, but I am not authorized to change it).VLAN 100: Network exclusively for wireless clients.VLAN 1005: Network for phones.Network topology:FG -- Cisco Switch-- FortiSwitch 108 (FSW)The FSW is connected to the FortiGate through "internal1."I configured the FG to recognize and manage the FSW via FortiLink, even though it is not directly connected.FortiLink configuration:I created VLANs 100 and 1005 within FortiLink, assigning them IP addresses and DHCP servers different from those in "internal1."Issue:The VLANs configured on the FSW via FortiLink have no connectivity and do not receive IP addresses via DHCP.I have already configured the ports on the intermediate switches (Cisco and HPE) to allow all VLANs, but the issue persists.Any

Dear Team,This email seeks assistance with a recurring issue experienced by field users attempting to access our internal asterisk-based VoIP web application, located at https://aaa.bbcone.com, through a FortiClient IPsec VPN tunnel.While the application functions flawlessly when users connect via FortiClient SSL VPN, Now we are planning to shift all users to IPSec VPN. A subset of users connecting through IPsec VPN are encountering browsing difficulties. These users are able to successfully ping and telnet the application's domain/IP address, confirming network connectivity at a basic level. However, their web browsers are unable to establish a connection to the web application itself. Initial troubleshooting included manually adding an entry to the hosts file on the affected Windows 11 workstations, which resolved the issue for some users. However, a significant number of Windows 11 users continue to experience the problem, indicating a deeper underlying issue.Based on rese

Hi everyone,I’m running into an issue with FortiClient VPN Only 7.4.3 (VPN with SSO/EMS support) on macOS 15 Sequoia (15.6). What’s happening:The VPN requires SSO via web browser (SAML) + 2FA.On macOS 15 Sequoia, FortiClient never triggers the required Automation (AppleEvents) TCC permission.I have reset TCC (tccutil reset AppleEvents com.fortinet.FortiClient), reinstalled the app, and checked Automation, Accessibility, and Full Disk Access settings — nothing changes.Without the Automation permission, the embedded SSO browser cannot complete login, and the VPN connection fails.Environment:Personal Mac (non-supervised, no MDM)FortiClient 7.4.3 (VPN + SSO)Tested: full uninstall/reinstall, TCC reset, permissions check — still no Automation promptQuestions for the community:Has anyone managed to get SSO working with FortiClient on macOS 15 Sequoia without MDM/supervision?Is there an older version (e.g., 7.2.x) that still works on macOS 15 for SSO?Any info on when macOS 15 Sequoia will

i am using 2 FG61F (7.4.8 Mature) with IPSEC IKEv1 Tunnel to same HUB which is not under my care. Config is basically default with no more additional config. First FG (let say FG-A) , no issue , all is working properlybut FG-B had issue with Packet Loss , it happens at random time & no pattern. Tunnel is up , no error log. i already enable ike debug to monitor but no output in process. i wonder if anyone had issue similar to mine , i have tried everything but still no luck , the only way to make tunnel stable is to zero the traffic by cut lan connection. Thanks before.

Hi, I have been using the FortiClient iPhone app for some years, and as long as I enable the save password feature on my Fortigates the SSL-VPN Client will be allowed to store the password on the device. However after either iPhone IOS upgrade I observe this feature no longer works for my connections, and I need to input password manually every time. Of course I can try to completely remove the FortiClient on my iPhone, but I was just interested in checking if someone else is experiencing the same issue here in the forum. The app settings have always survived IOS upgrades, and also the save-password feature always have been working. Now the app always requires password, the save function never works..

Hello Folks, windows environment seem to be somehow complex to me when dealing with ZTNA, especially when knowing that some transactions need line-of-side connections between clients and the DC, many ports being used on both TCP and UDP. In my scenario, I have configured a ZTNA server to the LDAP, included all ports required. UDP seem to work, cause I have tried to resolve names from the client side. However, when it comes to the user login (with a new username that is not cached on the client machine or after resetting a domain user`s password), things not working. I have seen this kb about the need for a KDC proxy for accessing shared folders. Do I need a KDC also to allow users to login to their machines when they are at home (especially after a password change?) ZTNA access proxy with KDC to access shared drives | FortiGate / FortiOS 7.4.1 | Fortinet Document Library Secondly, for the sake of troubleshooting, sometimes I needed to analyze packets from

hi,i need to convert the ASA static NAT on a subnet to FortiGate.the FGT GUI doesn't allow me to add/configure a LAN subnet.just wondering how to implement this?do i configure individual LAN/mapped IP in a VIP, add to a VIP group to the same external/public IP?can i also configure the same external/public IP for both DNAT and SNAT? does FGT allow this? ASA:object network obj_LAN_SUBNET subnet 172.16.1.0 255.255.255.0 nat (inside,outside) static 89.1.1.1 FGT:config firewall vipedit "lan-vip-1"set extip 89.1.1.1set mappedip 172.16.1.1set extintf "any"endedit "lan-vip-2"set extip 89.1.1.1set mappedip 172.16.1.2set extintf "any"endconfig firewall vipgrpedit "lan-vip-group"set interface "any"set member "lan-vip-1" "lan-vip-2"edit DNAT 1set srcintf "port 1" <<< WANset dstintf "port 2" <<< LANset srcaddr "all"set dstaddr "lan-vip-group"set service "all"set schedule "always"set logtraffic enableset status enableset action acceptset nat disableend

Hello,I need to design a report on VPN Remote IP countries. There is no srccountry or similar field in the VPN event logs, so I wonder if the Geo IP Location info is available in SQL as a table that can be queried in a dataset.Alternatively, I wonder if the Dataset design interface would allow me to create this table, operation that would require the interface to accept a quite large amount of text in the CREATE TABLE command. Also I wonder if in 7.4 ar more recent releases the possibility to create permanent tables (not temporary!) has been restored.Thanks

Hello,  we have two firewalls. We started upgrading the first over automatic upgrade -> 7.0.17 to 7.2.11 to 7.4.8. This was fine. The second had to be updated manually -> 7.0.17 to 7.2.11 ok. Now the upgrade moved to System/Fabric Management. However there I can't choose a file for upgrade anymore. This is availalbe in 7.4.8 again but not in 7.2.11. How can this be solved? Kind regards,David

Hi, We have SDWAN VPN Dialup with fortios 7.4 we used BGP for routing HUB 10.220.1.1/24                                SPOKEN1 10.220.1.2/24                                                                SPOKEN2 10.220.1.3/24 We have ping from spokens to hub  but no ping from hub to spoken. we check this links and we see that same problem,  then we tray the solution but it does no worked. https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Connectivity-issue-between-Dialup-hub/ta-p/328641 https://community.fortinet.com/t5/FortiGate/Technical-Tip-Potential-routing-issue-on-the-Dialup-VPN-hub/ta-p/307683 please help me

I'm running a FortiAuthenticator RADIUS (v_6.6.2) with Trusted CA policy, with the trusted CA being a Windows Server. We have a GPO setup to use either a machine or user cert and confirmed all the settings are consistent with the wireless SSID's auth settings. Clients are taking 60-100secs at times to authenticate.When viewing the PCAP, the communication is seamless between the FG and FAC, but the client takes several Access-Challenges to finally present its certificate https://19216801.onl/ .Has anyone else experienced this?

Hi,I am struggling to make a configuration in my LAB to work, which involves setting up a ZTNA HTTP Proxy which should redirect the traffic based on virtual-host/hostname. I am running FortiOS 7.2.11 , EMS 7.4.3 and FortiClient 7.4.3 in my environment. In EMS I have a ZTNA Destination with the FortiGate Public IP/Proxy ( Proxy Gateway:80 > Destination Host on ports 80,81 and DNS entries locally in hosts for test1.lab.local and test2.lab.local with the PUB IP/Proxy GW and if i switch the entries to the private IP I get: ZTNA Access Denied The page you requested has been blocked by a ZTNA restriction. Details: API Gateway Denied. Tried switching from Service HTTP to TCP Forwarding, no luck The firewall rule is in place and works for HTTPS/SMB , our focus in the matter at hand is for LAB-WIN config firewall policy edit 17 set srcintf "wan1" set dstintf "any" set action accept set srcaddr "all" set dstaddr "LAB-WI

Good day everyone,I added to my repo folder with FortiAnalyzer  Handlers collection ready to use.Your feedback, and ideas for new Handlers are always welcome.Repo: https://github.com/yuriskinfo/Fortinet-tools/tree/main/Fortianalyzer-handlers  Thanks.  

 I am having trouble accessing the website https://concesionarios.gpat.com.ar/webconcesionariosI see that my two Fortinet 80F and 100F devices are automatically blocking me without any blocking filter. I tried creating a web filter and DNS filter to allow me to access the page, but it still won't let me in. That's why I need your help to see what options I can try to allow me to access the page mentioned above.I'm attaching screenshots of the settings I've configured. If you need more information, I can provide it. Thank you very much for your help.  Screenshots:                

Buenas, tengo un problema y es que mi fortigate-30G entra en modo conserva y esto provoca que se bloquee el trafico de red. Hace poco tuve que aumentar un parámetro que es el system session-ttl. Por defecto esta puesto como una hora pero yo lo tuve que subir a 8 horas para que me almacenara mas tiempo las conexiones inactivas. No se si esto ha podido provocar que el forti se sobrecargue y entre en modo conserva en determinados momentos.

hello to you all,I want to get regular backups using SCP But Fortinet doesn't seem to support backing up to SCP=================================FW # execute backup config ?        ftp           Backup config file to ftp server.        management-station          Backup config file to management station.        tftp         Backup config file to TFTP server.        usb         Backup config file to USB disk.        usb-mode             Backup config file for USB mode. FW # execute backup config====================================Firmware version is 5.2 -----------------------------config system global   set   admin-scp enable-------------------------------There is a SCP enable setting, but it seems to be unavailable for backup

Hello Community,We are planning to add a second uplink on our FortiGate firewall. Currently, VLAN 92 and VLAN 93 are configured as sub-interfaces under Port13.Now we have a requirement to:Add Port14 together with Port13.Create a Redundant Interface (Port13 + Port14),Move all existing VLAN sub-interfaces from Port13 to this new redundant interface.My questions are:After creating the Redundant Interface, do we need to reconfigure all existing firewall policies, routes, and objects that are currently using Port13?Is there a way to migrate VLANs from Port13 to the new redundant interface without deleting/recreating all VLAN sub-interfaces manually?Does this change affect existing VPNs, static/dynamic routing, or HA configurations?Are there any best practices or recommended steps to perform this migration in production to avoid downtime?Can anyone share official Fortinet documentation or KB articles regarding redundant interface + VLAN sub-interface configuration?In GUI/CLI, which option/me

I see a big discrepency between 7.2/7.4 and 7.6 for maximum values.On a 1500D, 1100E, 2200E, and 3301E the maximum number of server-load-balance is 2048 when running 7.2 and 7.4For 7.6 these values drop to 64. Why is there such a big discrepency?  firewall.vip type=server-load-balance (virtual server)

i have an issue on fortipam windows application filter profile, i have created the target and secret and apply a windows application filter profile to block or prevent user opening CMD or PowerShell but it dos not work as expected and always give me log tell me skipped for privileged account

I am trying to use a FortiAP 221E without a FortiGate, but thus far have been unable to get it work. This FortiAP was previously used with a FortiGate and I can reconnect if needed to put in Standalone mode. I attempted to Factory Reset the AP using the reset button, but even after Factory Reset it doesn't broadcast an SSID and attempting to connect to via web GUI does not work. I am posting here to see if I am missing a step in putting into Standalone mode or if that is not even and option on this model.

Hi Team, Is it possible to configure an IPSec VPN tunnel in which its traffic will be terminated on a VLAN interface (In physical LAG interface) for DMZ?  Seemed like I cannot find a related KB link for this. I hope you can help me. Thanks!