Fortinet Community

I am using Fortigate Firewalls between Windows clients and domain controllers. In this case by allowing DCE-RPC, does the firewall allow the required return sessions without allowing dynamic port range? What are the requirements like firmware, IPS etc?

any help " device is already added in a different domain , please contact Fortinet support 

 I have two network segments: 10.100.x.x and 10.200.x.x networks. I've successfully established a VPN tunnel between these two different subnets using Fortinet FortiGate-60F(SD-WAN). I have configured a virtual server with the following setup:Virtual IP: 10.200.0.250Mapped to real servers: 10.200.0.102 and 10.100.0.102Health check is configured for both serversIssue: When I shut down the server at 10.200.0.102, the traffic is not being forwarded to 10.100.0.102 as expected. The load balancing/failover mechanism doesn't seem to be working across the VPN tunnel. Network Topology:10.200.x.x subnet: FortiGate internal IP 10.200.0.254, Server 10.200.0.10210.100.x.x subnet: FortiGate internal IP 10.100.0.254, Server 10.100.0.102VPN tunnel: IPSEC connection between the two subnetsVirtual IP: 10.200.0.250Questions:What could be preventing the traffic from failing over to the cross-subnet server (10.100.0.102)?Are there specific firewa

In our environment, we use FortiClient VPN version 7.0.14.0585. We started researching into the possible benefits of Intune, so I configured enrollment, compliance polices, and a simple BitLocker requirement. Those are the only changes to our Entra/Intune environment that I made. Soon, I had rolled Intune out onto a few computers in our division. One of our employees notified us of issues connecting to the VPN, and we suspected Intune to be at fault. Sure enough, when Intune was removed the issue went away. Screenshot is attached. When clicking yes, you are brought a blank page with a 300 second time out.

Hello, I found this thread: https://forum.fortinet.com/tm.aspx?m=68922 from four years ago discussing whether or not there is a bug tracker that is accessible.  I couldn't find one so I have to guess no is still the answer.  That leads to the question, if release notes only tell you the following bugs were fixed, how are you supposed to know if the fixed bugs are actually relevant to your environment, and/or a security concern?   I'm running 2.5.3 and 2.5.4 just came out.  It fixes seven bugs, identified only by ID number.  Are they critical security issues?  Display issues that I could care less about?  Should I schedule an emergency outage now?  Or never since the bugs don't matter to me? How does one make the decision with no information?  

Hello all,I have a client where WIFI is prompting as though captive portal is enabled while set to WPA2-Personal.We've updated both firewall and APs to the most recent version 7.2, to no avail.Next attempts will be a downgrade to observe if the issue persists on 7.0I will be happy to add details or information as needed. Hoping someone can help.**EDIT**This issue started last Friday 11/4 (no changes or updates that we are aware of)Current config:config wireless-controller vapedit "guest-test"set ssid "testSSID"set passphrase ENC set intra-vap-privacy enableset schedule "always"nextend

  Normally our internet speed at company should be 500 mbit/s corporate internet.Here is my configuration SO: GPON router LAN/WAN > Forti WAN Port > PORT1 > HP managed switch > AP devices.But We get 70-80 mbit/s internet speed.Because of this installation ( which I think is something wrong ) I created a DMZ Host on Gpon Router     

Hello,I am trying to configure my home FortiGate 40F as an L2TP client. I have followed the steps in the official Fortinet technical article, but the connection is not working as expected. I would like to ask for help with the following points: 1.Are there any additional configuration steps needed beyond the guide? 2.How do I properly configure L2TP with an IPsec pre-shared key (PSK) using the CLI? Where should I enter the PSK? 3.When I run diagnose vpn l2tp status, it shows “disable.” What could be the reason? 4.After setting up the L2TP client, are there specific firewall policies, NAT, or routing configurations required for proper connectivity? Here is my current configuration:config system interfaceedit "wan"set status upset l2tp-client enableset l2forward enableconfig l2tp-client-settingsset auth-type autoset defaultgw enableset mtu 1460set user <user_name>set password <password>set peer-host <host_IP_address>set peer-port <port>end

Hello everyone, Im curious if there is a way to filter inbound IPSec VPN connections by source address per tunnel on Fortigate. So far i saw that you can do it if you use IKE v2 and select the option "set remote-gw-match", but this only allows any, iprange, ipmask or country. Theres no way i can use an Address Group for this? The reason is that i have people that connect to my Fortigate that have 2 (or more) different outbound public addresses that do not belong to the same IP block, so i cant wrap them on a ip range or ipmask without adding unwanted IP addresses. Thank you in advance! 

I want to ask, how to change registration email to another email in fortigate?

I have a Fortiwifi 30g running OS v7.2.11I have a Fortiswitch 108F-FPOE running OS v7.6.1 connected to the Fortilink A on the 30g.Both devices are on the latest available OS version.I have a Playstation 5 connected to port 2 on the switch on it's own VLAN.I want to create a dedicated wifi network that is only connected to the same VLAN the PS5 is on.The 30g doesn't support bridge network mode.I've created SSID and put the VLAN ID into the "Optional VLAN ID" field in the SSID config but when I connect to the SSID I don't receive an IP address.I have looked through the forum and help section and nothing has worked.I have tried: How to create a new Bridge SSID with its VLAN dedicated for users Combining WiFi network and wired LAN with a software switch for DHCP leases Plus watching multiple tutorials on YouTube.If I make a Bridged SSID I cannot add it to the FortiAP profile and see a message stating"Bridge mode is not available on local WiFi radio" I have created

Hi Team  FortiClient Androide Manged by SASE request password for install Certificate. How can i config or find the password ? FortiClient  FortiCloud Products 

Hi,  Would like to manage the web-server certificates automatically for some Fortigates using ACME protocol connecting to an internal PKI ACME server. As far as i can see, there is only the option of connecting via ACME to Let's Encrypt. Is there any option of using ACME via Fortigate but using a custom ACME server? Othewise, will have to create a custom script to manage the certs leveraging FortiManager/FortiGate API. Thanks,

We have encountered a problem that the VPN version 7.4.1 cannot connect. The following is a screenshot of the specific cause

Pleas check my website - trainingcq.comIt is on black list,I cleaned all the files and scanned for virus Thank youAvihay

Hello Fortinet Community, I'm encountering an issue with application control on my FortiGate 60F running firmware version 7.4.8M.Scenario:I created a WAN access policy that allows NTP, DNS, and PING services only.  Additionally, in the Application Control profile applied to this policy, I allowed only the following applications:NTPDNSPINGAll other applications are set to block.Issue: Despite allowing DNS in the Application Control settings, I'm seeing legitimate DNS traffic being denied in the logs. This traffic is:Port: 53 (UDP)Destination: 8.8.8.8 (Google DNS)Action: DeniedDetected Application: GitHub    It appears the firewall is misclassifying some DNS traffic as the "GitHub" application, which is not allowed by the control policy, and thus it's being blocked. What can I do to fix this without disabling Application Control Profile.Any insights or suggestions would be greatly appreciated. Thank You.

Hi All,  I hope this email finds you well.I am writing to request your assistance with configuring multiple VLANs on our network. Below are the details of the configuration we need:VLAN Configuration on Firewall LAN Port:We need to configure two VLANs on the LAN port of our firewall, each with a different IP address.DHCP Configuration:Enable DHCP for both VLANs to ensure proper IP address allocation.L2 Switch Configuration:We have an L2 switch that needs to be configured under the firewall LAN.Could you please provide guidance or support on how to proceed with these configurations? Any documentation or step-by-step instructions would be greatly appreciated.Thank you for your assistance.  

Hi,I've been trying to create an IPSec VPN connection following the IPSec VPN Wizard but for some reason this connection is not working, I tried several ways but without any success... Any suggestion, help or ideas of how can work are welcome... 

When I am creating FortiManager instance on AWS I am unable to pass through second step of configuration wizard "FortiManager Setup - Register and SSO with FortiCare". I am always receiving "An unexpected error occurred message". Connectivity to this instance seems to be ok, i am using default security group, pings from FortiManager VM cli are ok, dns works fine etc.What can be the reason? Is there any way to skip this step?  

Hello,I have a question about FortiGate 500. I have an OpenVPN server with a private IP address of 192.168.1.2. I have assigned this server a public address like 1.2.3.4 and my server uses this address to connect to the internet. Now I want to assign a public virtual IP address, such as 1.2.3.5, for users to connect to this server via the Internet.Is it possible? Thank you.

I am looking for NSE7_OTS-7.2 course material ,could any one pls. share

Hey guys, I'm having a problem installing the VPN with Forticlient. The installation stops prematurely and displays this message. Have you e xperienced something similar?  

What's up people, sorry for my imperfect English but I will do my best to make myself understood, sorry in advance.Just a week ago I changed the way some branches were connected to my matrz. I was using openvpn on my ubuntu machines and from matrix I could access the machine via terminal to do updates, install packages, see how the network connection was and so on.Now, I switched to using the VPN of Fortigate, I saw some documentation but I still do not understand if you can do something similar to see the ip of the computers of my branches, because if before I saw their individual ip from openvpn, now I only see the ip of my forti, which is my gateway.Because of this, I can't access my computers as the ip is the same for each and every one of them (my forti's).I wanted to know if anyone knows a way to correct this and be able to simulate what I had before but with the fortigate VPN.Part of the problem is that also from my branches to matrix I can see my equipment by Ip but not from my

Hi,I'm working with the following setup:FortiGateFortiAuthenticatorFortiSwitch (wired access)FortiAP (wireless access)User identities are synchronized into FortiAuthenticator via SAML from Azure AD. Based on SAML group membership, I assign users specific VLAN IDs and group name attributes.Wi-Fi Scenario (FortiAP):802.1X authentication is handled by FortiAuthenticator.FortiGate acts as the NAS and receives RADIUS accounting.FortiGate successfully builds RSSO sessions, including username, IP address, and group name.I can create identity-based firewall policies based on the group – :white_heavy_check_mark: this works perfectly.LAN Scenario (FortiSwitch):802.1X authentication is again handled by FortiAuthenticator.FortiSwitch acts as the NAS and communicates directly with FortiAuthenticator.FortiAuthenticator assigns the correct VLAN ID, but FortiGate does not receive any identity/group info.In Firewall Users, no username or group is shown – only traffic from IP within the VLAN and have na

Our hub and spoke have two ISP's. However when one of our wan connections fails over on a spoke, BGP will continue to try to send the routes to the hub over the downed interface. The only way to make it flip to the correct interface is by editing an SDwan SLA rule or a reboot. I worked with TAC for 4 hours tonight, but didn't have any luck solving it.We are using BGP over loopback and on version 7.4.8. Anyone else have this issue? If you have a working config, could you post it?Thank you