Fortinet Community

Hi all, we want to switch our FortiClient dial-up connections from IKEv1 to IKEv2, but we are having problems with this. I have created a new IKEv2 Test-VPN on the Fortigate and a test user that is authenticated via RADIUS. Everything in the setup works fine with IKEv1, but as soon as I change the parameters to IKEv2, the login fails. Device is a FortiGate 300E cluster with OS 6.0.10, I tested with different FortiClient-VPN versions from v6.4 to 7.0. Here is what an IKE debug shows me: ike 0: comes 178.2.99.151:64916->20.30.40.50:4500,ifindex=11.... ike 0: IKEv2 exchange=AUTH id=xxxx/xx len=80 ike 0: in xxx ike 0:IKE-v2:31239: dec xxxA65 ike 0:IKE-v2:31239: responder received EAP msg ike 0:IKE-v2:31239: send EAP message to FNBAM ike 0:IKE-v2:31239: initiating EAP authentication ike 0:IKE-v2: EAP user "testuser" ike 0:IKE-v2: auth group IKEv2-Users ike 0:IKE-v2: EAP 1195273714 pending ike 0:IKE-v2:31239 EAP 1195273714 result 2 ike 0:IKE-v2: EAP challenged for user "testuser

I have created an MCLAG between the two switches using the graphical interface. Each switch is connected with one port to a cluster of 100F firewalls in active-passive mode. For now, I’ve only connected a single physical cable because I don’t fully understand the situation yet, so I’m keeping things as simple as possible.I don’t understand why all the links always appear in a disconnected state.Additionally, I would like to use multiple LAGs, both between the switches and also between the firewalls and the switches, but I’m not sure what the correct configuration should be.My firewall is running firmware v7.6.3 build3510 (Feature), and the switches are on S248EF-v7.6.2-build1085,250526 (GA).

Hello,I have a setup with SD-WAN where I have multiple sites, on one of the sites I have two ISP connections.To made failover I created Internet SLA to made failover possible. So I created this in SD-WAN -> Performance SLAsLast week the wan2 which was the active link went down (ISP told me they cut fiber cable during some repairs on the street). The problem is that the failover didn't worked and I needed to move SD-WAN VPNs manually to wan1 link. What I do wrong here ?

Is there a way to use dynamic learned OSPF in address objects?What I'm trying to achieve here is create an sdwan rule to direct traffic to certain routes that are learned from OSPF to a certain sdwan zone.I know that by default implicit deny will route traffic to these IPs correctly however I want to control it through sdwan rule.

SPOKE Endpoint:Has two WAN links (wan1 and wan2) with private IP addresses, requiring NAT traversal.HUB Endpoint:Has a single WAN link with a public IP address, no NAT traversal required.Type: "dynamic Dialup user" (Dynamic PPPoE Connection).Tunnel Aggregation Requirement:Merge the two existing IPsec tunnels (from SPOKE to HUB) into a single "IPsec Aggregate" tunnel. The Spoke can only have one tunnel established online at the same time and cannot have two tunnels established online simultaneously.May I ask what method can be used to establish them simultaneously and complete the tunnel aggregation? spoke config：config vpn ipsec phase1-interfaceedit "spoke_test1"set interface "lan3"set ike-version 2set peertype anyset net-device disableset aggregate-member enableset proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256set localid "88"set dpd on-idleset network-overlay enableset network-id 88set remote-gw hub address-xxxxxset p

Hi Community  Is there anyway to enable Dynamic Threat Detection on the FortiSASE managed Forti Client   Thank You, #FortiSASE

Hi Has anyone managed to solve a problem with FortiSASE (and it's probably the same with Fortigate) where the Fortiguard DNS lookups for the likes of device.autopatch.microsoft.com will return an IP address that matches another service that's hosted in Azure? Which ends up conflicting with policies when you're trying to create explicit ones for MS services and updates, but then random websites get bundled in...?

When we setup BGP to other neighboor such as to Azure or to accros fortigate devices is BGP interface and update source is mandatory to be set? And also is needed to make static route to the BGP peer?

Hello everyone Network requirements:One SSID100 - fortilink vlansThere will be wired and wireless devices in each vlan, they must be in the same subnet/broadcast domain.400 devices What is better to use? SSID with MPSK in bridge modeorSSID with MPSK in tunnel mode + software switch (ssid vlan + fortiswitch vlan) or is there another solution?

I have the following working Dialup IPsec config working for one of my SAML user groups and now I am trying to expand it to cover other SAML groups.config firewall addressedit "OpsVPN-US2_range"set type iprangeset start-ip 10.254.128.1set end-ip 10.254.128.254nextendconfig firewall addrgrpedit "OpsVPN-US2_split"set member "Internal_10.0.0.0/8" "Internal_172.16.0.0/12" "Internal_192.168.0.0/16"nextendconfig vpn ipsec phase1-interfaceedit "OpsVPN-US2"set type dynamicset interface "port1"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset proposal aes256-sha512set dhgrp 20set eap enableset eap-identity send-requestset wizard-type dialup-forticlientset transport autoset fortinet-esp enableset assign-ip-from nameset dns-mode autoset ipv4-split-include "OpsVPN-US2_split"set ipv4-name "OpsVPN-US2_range"set save-password enableset psksecret ENC *******nextendconfig vpn ipsec phase2-interfaceedit "OpsVPN-US2"set phase1name "OpsVPN-US2"set proposal aes256-sha512set dhgr

I have a FortiGate 401F。 I would like to know the MAC chip model of 401F. What CLI command can I use to obtain the relevant information?

 Hello everyone,I have two Fortigates:A Fortigate 60F and a Fortigate 70G.On the Fortigate 60F, there is a WiFi network, where I reserved the IP address 172.16.10.110.The Fortigate 60F is connected to the 70G via a link and a static route:  All traffic destined for the 70G must pass through the 60F.Conversely, on the 70G:   The connection works well, everything works fine.Now, I tried to restrict access to the 60G GUI (https://10.0.1.0:40443) using two local-in-policies: config firewall local-in-policy    edit 1        set uuid 5c0a2180-47a5-51f0-1e8d-733b986f1a94        set intf "any"        set srcaddr “My_IP_ADDRESS”        set dstaddr "login_group"        set action accept        set service "HTTPS-40443"        set schedule "always"    nextedit 2        set uuid 71f5a26c-47aa-51f0-2

Hi everyone,I’ve configured my FortiGate to allow access to Google Docs only for certain users. However, I noticed that those users were still able to access YouTube.Upon investigation, I found that Google Docs and YouTube share some of the same IP addresses, which makes it difficult to block one without affecting the other.When I created a policy to block YouTube, it ended up blocking Google Docs too.Has anyone found a way to allow Google Docs while effectively blocking YouTube? Any suggestions would be appreciated. 

Hello everyone,I have two Fortigates:A Fortigate 60F and a Fortigate 70G.On the Fortigate 60F, there is a WiFi network, where I reserved the IP address 172.16.10.110:The Fortigate 60F is connected to the 70G via a link and a static route:  All traffic destined for the 70G must pass through the 60F.Conversely, on the 70G:   The connection works well, everything works fine.Now, I tried to restrict access to the 60G GUI (https://10.0.1.0:40443) using two local-in-policies: config firewall local-in-policy edit 1 set uuid 5c0a2180-47a5-51f0-1e8d-733b986f1a94 set intf "any" set srcaddr “My_IP_ADDRESS” set dstaddr "login_group" set action accept set service "HTTPS-40443" set schedule "always" next edit 2 set uuid 71f5a26c-47aa-51f0-21c9-79d49494eb3e set intf "any" set srcaddr "all" set dstaddr "login_group" set service "HTTPS-40443" set schedule "always" set status disable next login_grourp is the GUI address and My_IP_ADDRESS is 172.16.10.110

Hi community, I have a doubt regarding FortiGate HA active-active mode. There are some articles explaining this mode operation, I have taken this one:https://www.fortinetguru.com/2016/10/natroute-mode-active-active-cluster-packet-flow/ Briefly and without going into too much 3-way handshake detail, when the primary unit decides that the subordinate unit should handle a packet, and forwards it to the subordinate unit internal interface, the primary unit forwards further packets in the same session to the subordinate unit. Is that correct? If so, every packet of the same sessión will pass first through the primary unit and then through the secondary unit? If so, then will link 1 be much more loaded than link 2?   Regards,Julián

FortiClient EMS Using the "Send Test Email" from the SMTP Server settings tab the test is successful, however, no actual alert emails are being sent.

Today we update our Fortigate 90G witn 8GB ram from 7.4.7 (with sslvpn tunnel mode active) to 7.4.8 and the SSLVPN dissapears!!!!THIS IS REALLY WEIRD!!!We contact to support a give me this answer:---> https://docs.fortinet.com/document/fortigate/7.4.8/fortios-release-notes/743723/new-features-or-enha... <------> Resolved issued -> bug id 1026775 Remove SSL VPN from FG9xG. WTF!!! Fortinet delete SSLVPN a publish in a resolved issue??????????

Hi to all!I upgrade my Fortigate 90G from 7.4.7 to 7.4.8 and force to migrating to IPSec VPN dial-up tunnel. The auth for the users was config with Groups connected to LDAP (Windows AD) and all is ok.The IPSec VPN tunnel Phase1 XAUTH type = "autoserver" and user group = "Inherit from policy" When I try to monitorize "Security Fabric -> Asset Identity Center -> Identity" is empty, but with SSLVPN i can see the auth users for vpn connections.  Any ideas or help? PD: I also have it setup "Security Fabric -> External Connectors -> FSSO agent on Windows AD" Thanks!

In our FortiGate environment, both BGP and static routes are configured for the same destination. However, the system currently prefers the static route, which remains active at all times. As a result, during an IPsec tunnel failure, traffic does not automatically fail over to the BGP route. At present, we are required to manually disable the static route on both ends to allow BGP to take over. We are seeking a solution that enables automatic failover from the static route to the BGP route when the IPsec tunnel goes down. Ipsec tunnel not showing in interfaces  

Hey Folks  I was hoping I could get some help on the best practices on setting up 3 ISPs in an SDWAN configuration from my 100F to my 60E at a remote site that houses a few servers .   I have a 5g modem  , att fiber connection and spectrum business service all plugged into my 100F firewall . Wan1 SpectrumIPSECTUNNEL1 Port11 ATT BusinessIPSECTUNNEL2 Port12  ATT 5gIPSECTUNNEL 3 I have 3 ipsec tunnels built between the two fortigates as well and they are all the same phase 2 selectors . All I am trying to do is put the 3 ips into the SDWAN and have the fortigate fail over from 1 downed isp ( wan1 wi/ ipsectunell1)  to the second Wan connection  (Port 11, ipsectunnel2)  etc  .  I've tried setting this up once and had issues with different communication going over different isps when all I want is all the communication going over 1 isp and one tunnell until the need to fail over.  I've been knocking my head

I upgraded to FortiClient VPN 7.4 (whatever the latest download is) from 7.2.10.1217 and it just flat doesn't work. I can VPN into our foritgate and connect as normal, however every other application that tries to connect to the internet on my client computer just fails. Fix was to downgrade back to 7.2.10.1217. Uhm, is this a thing? I was trying to get our IT department to allow us to use Windows standard VPN client instead of this proprietary vpn client, but they can't seem to figure out how to do that with our fortigate firewall.

I have about 12 remote sites connected via BGP with ADVPN. At each site, I have Shoretel VoIP phones. They connect and register just fine. The issue I run into is that if a phone gets disconnected, it does not seem to want to connect again. I do have the VLAN going to a black hole if the site-to-site goes down, but the issue comes if it is just one or two phones that disconnect. Not sure how to reset the phone connection over the VPN. If I go to the Shoretel phone system and move the phone from one server to another, then back to the original server, the phone reconnects. Not sure if anyone else has seen this issue and can give some feedback.

I have a home lab environment, and I have created a VIP for my Citrix Lab with NetScaler frontend. Regardless of what I try traffic to the VIP is being dropped based on debug view, but I don't see any traffic in the logs. This used to work with another service but that stopped working as well. Fortigate-70FFirmware: 7.6.1   Debug Trace 2025/06/12 09:31:54,"vd-root:0 received a packet(proto=6, X.X.X.X:30212->X.X.24.153:8445) tun_id=0.0.0.0 from wan1. flag [S], seq 3633665461, ack 0, win 65535"2025/06/12 09:31:54,allocate a new session-0005eb2b2025/06/12 09:31:54,"in-[wan1], out-[]"2025/06/12 09:31:54,len=12025/06/12 09:31:54,checking gnum-100000 policy-10612025/06/12 09:31:54,"result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"2025/06/12 09:31:54,find a route: flag=80000000 gw-X.X.24.153 via root2025/06/12 09:31:54,"in-[wan1], out-[], skb_flags-02000000, vid-0"2025/06/12 09:31:54,"gnum-100017, check-ffffffbffc02ca54"2025/06/12 09:31:54

Hello all, We use IPsec Dialup VPN with SAML via EntraID. When I try to connect via IPsec VPN inside same network in which the Fortigate is located, I get the error "ERR_EMPTY_RESPONSE" when calling SAMLIs this an expected behavior? If not, what could be the issue and how can I fix it?If I'm connected outside of my Fortigate, all is working fine.Similarly, we also have an SSL VPN via SAML EntraID and the login works within the same network.Also the Single Sign-On settings for the IPsec SAML looks similar to the SSL SAML. Fortigate: v7.6.3 build3510FortiClientVPN 7.4.2.1737 / 7.4.3Best Regardsfabs

we want to permitt user to authenticate on captive portal  one a time during 2 months and reauthenticate after 2 months.is it possible with fortigate ? please help .