Fortinet Community

Dear Community,We would like to request assistance with configuring traffic forwarding from our Fortinet Next-Generation Firewall.Currently, we have approximately 40 policy-based client VPNs terminated in GCP. Our objective is to utilize the FortiGate firewall as a transit gateway, terminating all client VPNs and forwarding their traffic to Azure, as illustrated in the attached network diagram.In the diagram:    :white_heavy_check_mark: Green checkmarks represent established/working connections.    :cross_mark: Red crosses denote connections that are currently not established.We are seeking guidance on setting up the appropriate routing or forwarding mechanisms from FortiGate to Azure to complete this integration.Please let us know if you require any further details to proceed.We appreciate your support in identifying the best approach for this configuration.Regards,Aneesh Gupta

Good evening Fortiweb admins, I have noticed an issue with the "URL Encryption" feature on FortiWeb. When I enable my URL Encryption policy, the URLs are successfully encrypted.However, this distorts the design of the protected website:The site’s appearance is no longer the same.Some elements are missing.Colors change.In some cases, only the HTML code is displayed without the CSS, Bootstrap, and other resources.Does anyone have any idea about the root cause of this problem? 

Hello Team, I need some help, please. I have an architecture where two FortiWeb ports are used. Both ports need to operate in one-arm mode and receive traffic from the Internet, as we have two firewalls connected to the two WAF interfaces performing DNAT. Since it is only possible to configure a single default route, how can I make the FortiWeb accept Internet traffic on both ports simultaneously? Note: I have already created a policy route, but it didn’t work. Is there a way to make this work?

Wireless Authentication using SAML Credentials and Azure as IdPHelloI have a problem when once logged in with the Azure user I am redirected to the Fortinet captive portal -> https://portal.mydomain.com:1003/saml/login, I get the following error in the browser:Your connection is not private NET:ERR_AUTHORITY_INVALIDI have a wildcard certificate installed in the forti *.mydomain.comUnder "User & Authentication" -> Authentication Settings I have FQDN checked and under "Certificate" I have the wildcard certificate.In protocol settings I have checked all protocolsAuthentication Scheme, Captivce portal and HTTP redirect are unchecked (I don't know if they have to be checked).Under User&Authentication -> Single Sig-ON ->Single Sing-On configuration, I have the option certificate -> MyCertificate Wildcard checked.In this Forti version I could not apply the following configuration because of the IOS version:config wireless-controller vapedit "SAML-WiFi"set auth-cert "My_

Hey, first of all I'm already running the persistent agent with this certificate and I'm not facing any issues. I've also installed the same certificate for the Portal and Admin UI and even after restarting the services, I'm still getting a certificate warning when accessing the portal and Admin UI. Although I have the certificate and can see it in the page's certificate details, I still get the warning. 

Hello,Forticlient: 7.4.3Forticlient EMS: 7.4.3 (Cloud) We are testing configuring firewall rules with ZTNA Tags with an AD Group called "East Coast."Inside the Group East Coast, we have NY, MD, DE, PA, CT, & MA. So, we have nested groups...When we go to Forticlient EMS Cloud > Security Posture > Tag Monitor >  East Coast. We do not see any users...If I add the AD groups one by one (NY, MD, DE, PA, CT, & MA) with the "or" logic, it works...All the users are under (NY, MD, DE, PA, CT, & MA) and not East Coast.Is EMS cloud not able to do recursive lookup on LDAP AD groups?The only thing I could find about it is:ZTNA AD group lookup rule improvement | FortiClient 7.2.0 | Fortinet Document LibraryAccording to the above link, EMS is not able to do so....

I would like to create an email notification when someone accesses my firewall, sending an email with the user name and date. Is there something like that?

Hi, We are looking to manage traffic with identity and endpoint based policies. We are also planning on getting EMS to get as much ztna in place as possible. It seems that the best option for managing identities is fsso. Is it compatible/recommanded with EMS ? Which should we go witch ? Any advice before with start going in all directions ?

Hi, I am new to Fortinet devices and routing in general and have a change to apply, we have a user that moved into the office locally recently from remote work needs to access an address, https://gis.********.co.nz/portal/home/index.html  and this leads to a local server onsite. There is an SSL cert applied for this server. I am assuming that there need to be a route to allow for the traffic going to that address to still work, where can I start looking at this or if someone can point me in the right direction it would be great. Kind Regards,

Hi everyone,I'm experiencing an issue with my IPsec VPN setup. I configured a VPN client using the wizard on my FortiGate 60F (firmware version 7.4.6). I completed all the necessary settings for Phase 1 and Phase 2, and then configured the FortiClient accordingly.However, when I try to connect using FortiClient, I receive a timeout error. The connection attempt fails without establishing the tunnel.I've double-checked the configuration, including:Phase 1 and Phase 2 parametersAuthentication methodPre-shared keyRemote gateway settingsStill, no success. Has anyone encountered a similar issue or have suggestions on what to check next?Thanks in advance! 

I'm currently trying to configure a Captive portal with SAML authentication for a specific https traffic.My issue is how can implement this only in my firewall policy and not on my interface which will impact my other traffic. I'm running 7.2.7 version on 1500D.Do you guys have an idea about that?  

Step to reproduce:Install FortiClient  VPN 7.4.3 onto macOS SonomaUpgrade to latest macOS SequoiaAnd here we go, ,no Add Profile or Add New Connection Optionbefore on Mac OS Sonoma it work correctly, and im configure everything- create profile- add new connectionafter upgrading to macOS Sequoia i'm experience this issue, my configuration and connection is gone been trying to reinstall but still can't add or load my existing connection

Hello everyone, I'm trying to figure out how I can allow one of my Fortinet inferface to be able to ping the "IPsec VPN" IP of my remote users (connected with Forticlient). From the Fortinet itself, I'm able to ping those IPsec VPN connected workstations just fine, but I'm unable to do the same from any other interfaces (i.e. like from a server behind the Fortigate). I already created an IPv4 Policy to allow the "PING" to go through between one of my internal interface to the interface of the "IPsec" interface, but that does not seem to work...I also tried adding a static route, but that did not seem to help. Anyone faced a similar issue like this before ?Thanks for your help and best regards,--Eric 

Hello, Team!  I’d like to ask about our FortiGate 300E. Its license will expire in January next year, but I saw online that its EOL (End of Life) is in July 2026.If we don’t plan to buy a new firewall next year and instead move the purchase to 2027, should we still renew the license? Also, if we renew but the unit reaches its EOL, will we still receive FortiGuard services and updates after that? Thank you! So sorry I'm kinda new to this

I have a Fortinet 200F hardware controller setup in an High Availability Cluster.  The version is v7.2.8 build1639 (Mature). Background: - The dedicated MGMT Interface IP address is X.X.30.254. IP address.- The FortiGate LAN interface is using a X.X.99.X IP address.- My workstation is using X.X.210.X IP address. Problem Description: I can login to the FortiGate FW Web interface just fine using the assigned LAN IP Address (X.X.99.X) from my workstation (X.X.210.X) ; but, I cannot get a web page or ping the IP address assigned to the FortiGate MGMT Interface (X.X.30.354) from my workstation.  I can access and ping other devices on the same X.X.30.X network from my workstation; hence the problem is specific to the X.X.30.254 Interface.  By the way other devices on the same subnet (X.X.210.X) have the same problem with the FortiGate MGMT Interface address (X.X.30.254). I have set the following configuration on the FortiGate "MGMT physical Interf

Dear Community Members, I have setup my FortiADC (192.168.1.142-MGT IP) on VMware Esxi host. i have to create LAB setup. I configured 2 real servers (192.168.1.4- 192.168.1.8) and added those real servers into single pool and created 1 virtual server (192.168.1.200). I have enabled IIS service on both real servers. when my client (192.168.1.9) hits the virtual server address (192.168.1.200) in browser, it gets Err_CONNECTION_TIMED_OUT. while my virtual servers have reachability to both real servers and virtual server is also pingable from the client machine, this has been confirmed with health check options via Http profile. Any one from the community could help me out. network flow is mentioned below Client (192.168.1.9) ---> FortiADC (192.168.1.142) ---> Virtual Server (192.168.1.200) ---> Real servers Pool Thanks

Hello everyone, I have a question. Thank you. My FortiGate 401F is used as the data center egress firewall, establishing IPSEC tunnels with firewalls at various branch sites. The headquarters has a fixed public IP address, while the branches do not. The branches access the Internet via PPPoE dial-up.Current Version: V6.4.13 build5455 (GA)Target Version: v7.2.10.M-build1706Mode: NATDevice Model: FortiGate 401FUpgrade PathFirst Upgradeform:FGT_401F-v6.4.13.M-build5455-FORTINETto:FGT_401F-v7.0.12.M-build0523-FORTINETSecond Upgradeform:FGT_401F-v7.0.12.M-build0523-FORTINETto:FGT_401F-v7.0.14.M-build0601-FORTINETThird Upgradeform:FGT_401F-v6.4.13.M-build5455-FORTINETto:FGT_401F-v7.0.12.M-build0523-FORTINET 1F-v7.0.14.M-build0601-FORTINETto:FGT_401F-v7.2.10.M-build1706-FORTINETAfter upgrading FortiGate to v7.2.10, one branch site experienced network anomalies (network communication at other sites was normal). The branch site's IPSEC tunnel was established normally, but the branch's private n

Hi Fortinet Community, When I try to get logs to FortiAnalyzer via EMS and ems endpoints, I see that the endpoint sends logs directly to FortiAnalyzer. Logically I thought that it sends it to the analyzer on the EMS, but I realized that this is not the case.  How exactly does FortiAnalyzer and FortiClient EMS log collection logic work? Best Regards,İsmail Ürek

One of the suppliers has recently changed their email provider, and FortiMail is now quarantine messages from them with a SPF Failure. Their domain is manulife.com.   Their SPF record has syntax I haven't seem before.  There is an include with what I think is macro syntax.  Their SPF record is:  v=spf1 include:manulife.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all The manulife.com._nspf.vali.email has a -all  (hard fail)  which is why I think their messages are going to quarantine.   My question is;  how will FortiMail interpret  the  include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email  ? Thanks,Mark

What is your opinion the base firewall rules everyone should have for traffic inside -> outsideI often see firewall rule just permit any any inside -> outside, no SSL inspection. No bot net / spam filters, no IPS not IDS.Why is there no good template fortigate provides that recommends anything -> outside

Hi FNAC admins and It seems on FortiNAC-F 7.4 and 7.6 (didn't test on 7.2), when doing enter-shell the user admin can't do sudo.Is there a special way to do that or has it just been removed?

Hi I did a FQDN to get access to EMS via https but I can't modify or add configurations, inmediatly a banner is showns with the message "Permission denied...Your permissions might been update, please refresh this page" and then I click Refresh but nothing happen. Does anybody know what I missing? I used a Public Certificate wildcard "Digit Cert". Attahed you will find the image. Thanks and regards. 

Hi, is anyone have experience on setting up vpn for this use case? I need some guide on how to set up correctly as I am currently facing issue where the radius server response with reason code = 3 (access-reject). This issue only happens when using version 2 and not version 1 (aggresive mode + XAuth). Thanks in advance!

Had this working briefly, but somehow , something has changed in the environment, I have followed: https://docs.fortinet.com/document/fortiauthenticator/6.5.0/cookbook/578250/fortiauthenticator-as-a-wireless-guest-portal-for-fortigate A few tweaks here and there, but essentially, the Client connects to the OPEN ssid, the interface uses system DNS to look up the address of the external portal., then should be able to access the captive portal, this part is completely broken, no traffic arrives at the FAC, meaning the client just cant resolve the FQDN (it used too!)  I checked the clients ipconfig, and it gets the right DHCP IP, gateway (Fortigate wifi interface) and correct DNS (it picks up public DNS, but there are DNS-DATABASE entries for the FAC)  there is an EXEMPT captive portal rule, from the GUEST source network, to the FAC on HTTPS, so that it can use the form to register, before browsing. there are no hits on this rule. I have tried everything now, I ju

What are the possible reasons for the error "Fortigate time is out of sync" even though the current time is correct?The settings of the time zone and NTP server address are correct.