Fortinet Community

Hi everyone,I would like your input about a design discussed with my technical manager.We have 2 on-prem Fortigates inlcuding SPA licences with each (part numbers used FC2-10-FGVVS-662-02-12 and FC-10-0400F-662-02-12), one is a VM hosted in the cloud, the other is a FG-400F in the HQ. My question is, is it possible to make FortiSASE as a central point of security enforcement between both sites, knowing that the HQ doesn't host anything, the users will basically access cloud resources hosted behind the virtual FG. remote users will have accounts in fortiSASE directly.I'm wondering if this setup is valid, if not, doesn't require anything special in terms of licensing ? Might be helpful to include FortiSASE licenses here:Enhanced Support PremiumTelephone Support PremiumFortiTrust ZTNA & CASB (users)FortiTrust ZTNA, EPP & CASB (users)FortiTrust SASE & CASB (users)FortiTrust Forensic Analysis Service Thank you in advance  

Looking for info on creating the QR code for IOS ( deploying to about 100) with us replacing SSLVPN with IPSEC using SAML ( SSO )

Hi Team, Is there a way to clear the cached PMK for the FortiWifi authentication connection? This is to ensure that when end devices reconnect to the network, it will be forced to reauthenticate and not us cached data. Can confirm that the setting for the existing Lifetime of the PMK-R0 key can be set in:config wireless-controller vapset ft-r0-key-lifetime < integer> Is there a way to see the sessions related to this? and also clear this? Thank you!   

Hello Community,I will try to be as brief as possible.A couple of months ago, we installed the collector agent to our two main DCs and respectively the DC agent to a number of DCs across our SDWAN topology. Since the begin the majority of the users are not getting in "Currently logon users" list in FSSO even though when I try to logoff and logon again, even restarting the machine does not help, but when I check Event Viewer on DC the user is successfully logged in / Authenticated. Same thing for new user creation. What we have observed is that the DC agent has the information of the logged in users but the collector does not, it is like they are not synced. Another observation is that the same users appear constantly, a different users will be added to the users that appear on the FGT once in a while. We have a TAC case opened for 2 months with not much progress, we updated the collector to the version they suggested, we checked the registry in the KERBEROS on the DCs, we unistall

Hi, dear community.We are facing the following problem:We have FortiAnalyzer v6.4.13 and have been receiving the following notifications for several days: Disk usage for Adom XXX has reached the delete threshold of 90% of total 50.0GB. Archive Usage at 89.6% (13.4GB) and Analytics Usage at 90.3% (31.6GB).I read that the logs should be automatically deleted after this message. But I don't think so, because we received a notification before that: Disk usage for Adom XXX has reached the delete threshold of 90% of total 50.0GB. Archive Usage at 88.8% (13.3GB) and Analytics Usage at 91.0% (31.9GB).Please tell me if we should do something about it. Because the messages are coming every day and we don't want our storage to be full.Best regards.

hello and sorry for my english, I have Ucopia server. When external users are connect to wifi VLAN, the portal is open and the can create account and connect to internet. i know that my fortigate offer portal but it is possible like Ucopia that users can create account to register before go to internet ? thanks

Hi, on a new installation (all new products never used) I can't get FortiAPs to appear on a FortiGate. The FortiGate (100F) is connected via Fortilink to a FortiSwitch POE 8 port to which two new FortiAP 231K are connected. I have as reference these guides which I have followed to the letter.https://community.fortinet.com/t5/FortiAP/Technical-Tip-Manage-a-FortiAP-with-FortiGate/ta-p/223348https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-Integrate-FortiSwitch-and-FortiAP-into/ta-p/385127From the CLI of the Fortigate I see that the FortiAPs have taken the IP addresses of the DHCP Server configured on the VLAN and I can also connect. But the FortiAPs are not shown in “Managed FortiAPs.”The firmwares are:Fortigate v7.2.11 build1740 (Mature)FortiAP v7.4.5 build6183FortiSwitch 7.6.1 build1047 What can I check?Thank you. 

I'm looking to purchase an FTTP internet circuit 1000(DL)/100(UL), the ISP authenticates over PPPoE.I haven't PPPoE'd through a firewall in years, and remember there being a significant performance penalty back then - as I believed it couldn't be offloaded to ASIC (probably still the case). Trying to avoid needing another piece of equipment.Does anyone running either the 70G and/or 90G know if there is a big performance penalty? (and can share stats please?)Thanks!

Hi, To set up email alerts for high bandwidth utilization on each WAN interface when usage exceeds a specific limit, I referred to the document. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Automation-stitch-configuration-for-inbound-and/ta-p/211515 However, based on the document, the configuration is subject to the following conditions: It applies only to specific FortiGate models and versions that are FIPS-CC certified.The setup must be performed when the unit is in its factory default state.If FIPS-CC is not enabled, the configuration will not be applicable.Upon verifying our environment, we have confirmed that FIPS-CC is currently not enabled. Before proceeding, we seek clarification on the following: Does Fortigate 300E support FIPS-CC certification and this configuration?What would be the implications of enabling FIPS-CC in our existing setup?What dependencies should be considered, given that the configuration is supported only on specific ve

We are trying to configure Link aggregation in Fortigate with downstream Cisco Nexus device which is in VPC. The connection is as follows:FortiGate Aggregate Interface├── port40 <--> Nexus1 Eth1/20 --> vpc 11└── port44 <--> Nexus2 Eth1/19 --> vpc 11 LACP flags: (A|P)(S|F)(A|I)(I|O)(E|D)(E|D)(A|P) - LACP mode is Active or Passive(S|F) - LACP speed is Slow or Fast(A|I) - Aggregatable or Individual(I|O) - Port In sync or Out of sync(E|D) - Frame collection is Enabled or Disabled(E|D) - Frame distribution is Enabled or Disabledstatus: upnpu: nflush: nasic helper: yports: 2link-up-delay: 50msmin-links: 1ha: masterdistribution algorithm: L4LACP mode: activeLACP speed: slowLACP HA: enableaggregator ID: 5actor key: 97actor MAC address: e8:1c:ba:c4:5b:f3partner key: 32779partner MAC address: 00:23:04:ee:be:0amember: port40index: 0link status: uplink failure count: 3permanent MAC addr: e8:1c:ba:c4:5b:f3LACP state: establishedLACPDUs RX/TX: 81/130actor state: ASAIEEact

Dear Concern,I need to configure an IPSec VPN on my FortiGate firewall, where user traffic should be NATed to a specific set of dynamic IP addresses before reaching the remote side. This is necessary because the remote side will only allow traffic from a few specific IP addresses. Kindly assist me in configuring this setup. My Firewall Details:Model: FortiGate-201FFirmware Version: v7.6.2 build3462 (Feature)

Hi all, Device: HA-pair 61F v7.2.10 Per subject, IKEv2 debug log was stuck in phase2 INFORMATIONAL state, the traffic cannot pass through even phase1 and 2 is up. For example, the sniffer log can show the icmp echo request and echo reply through the tunnel interface, but in fact the icmp request sender didn't receive the icmp reply packets. The VPN resumed normal automatically after 12 hours [43200s] after the phase2 was rekey, or by resetting the tunnel directly. This issue happened twice. So I just afraid the issue will happen 3rd time. diagnose debug application ike -1diagnose debug enableike 0:VPN: HA state master(2)ike 0:VPN:7: dec XXXXXike 0:VPN:7: received informational requestike 0:VPN:7: enc XXXXXike 0:VPN:7: out XXXXXike 0:VPN:7: sent IKE msg (INFORMATIONAL_RESPONSE): x.x.x.x:500->x.x.x.x:500, len=80, vrf=0, id=XXXXXike 0: comes x.x.x.x:500->x.x.x.x:500,ifindex=10,vrf=0....ike 0: IKEv2 exchange=INFORMATIONAL id=XXXXX len=80ike 0: in XXXXXike 0:V

Hi We have hundreds of windows desktops VMs on top of VMware Horizon VDI, we have tried to auto deploy the FClient agents using AD GPO, but, the agent does not auto connect to EMS after msi installation. when i install the same agent manually, auto connection works fine Please, can someone help here (FortiClient EMS 7.2.5)   

Hey, we have a quite a lot FGs in our network but sofar no G model, any bad experiences with this model? We are thinking to trade up a FG81E to 90G, comparing the specs it is quite a huge step but I would like to know if we can expect this hardware change as an easy one. For example we are testing with a 30G model and the updates are quite strange. The only thing that bothers me right now is that in this location we have more than 30 user assigned with FortiToken.Sofar we never changed Tokens from one FG to another, as I have been told it should not be so hard but I would like to know if we later can keep the same tokens for the users. Thanks for your information!

Can a FortiGate firewall used for data center (east-west) monitor traffic within the same segment or within the same VLAN?

I have a FortiGate 70F running 7.4.7 and I'm trying to set up a DNS server on it to resolve some internal server host names.  The system DNS is pointing to the FortGuard DNS servers.  I am using FortiSwitches connected via FortiLink for clients on multiple VLANs.  I enabled DNS Servers in Feature Visibility to add that option and noticed that it already had an entry for the fortilink interface set to Forward to System DNS, and a DNS Database entry for fortiswitch set to Primary/Shadow that has 5 entries, one for each of my FortiSwitches.  I did not make any of these, so this is apparently done automatically when you install a FortiSwitch.  I am trying to get clients on the Lab VLAN to resolve host names for 3 servers in our environment.  I went through the steps to add a new DNS Database using Primary/Shadow and added 'A' and 'PTR' records and a domain name for the 3 servers on our internal network.  I saved this and then added a '

This may be too broad of a question, but will ask in the event some replies or questions may provide any guidance at all. We just ordered FortiPAM, but am struggling on placement of the device based on the design documentation as per this link https://docs.fortinet.com/document/fortipam/1.6.0/administration-guide/541708/fortipam-designs. Most VLANS at HQ (1st floor, second floor, 3rd floor, servers...) reside on an Layer 3 Aruba 5406Z switch and the respective VLANS are trunked down to access switches. Our FortiManager and FortiAnalyzer also belong to the server VLAN on the 5406Z. We have one switch port directly connected to the firewall with appropriate routes in and out. We also have SSL-VPN on this firewall and connectivity to remote sites are via SDWAN ADVPN. Additionally, we have FortiClient EMS cloud. Any suggestions on placement of FortiPAM? Does it need to be on it's own interface on the firewall? There is mention in the article about single or multiple interface design b

Hi, I'd like to share with all of you a python script to perform full FortiGate config backups. It started as a simple automation for my work two years ago and has become a hobby. Along with today's new release i decided to do this post and maybe help some of you who do this task often. As i no longer have access to an appliance, my tests are done with a FortigateVM. Feel free to try out this tool and share your thougs here. All suggestions, comments and feedbacks are welcome. It requires Python 3.8+ and support FortiOS 6.x and 7.x versions. https://github.com/mcarneir0/fortigate-backup-api 

After upgrade, one particular large user group (1400 members) is seeing a high number of incidents where Forticlient SSL VPN authenticates, sets up tunnel and then exits after 1-2 seconds with "User requested termination of service". Eventually it works so not consistent on any client. Any ideas?

Good evening, everyone. Is there any version of FGT KVM that allows you to create more than 3 firewall rules with an evaluation license for studies?

Hi, I really need help to solve following problem. When I try to install device settings via FortiManager I get error 'Installation to real device failed' It's really simple configuration just allow web management on interfaces. Don't know how to debug this issue. ReagrdsPeter 

I'm very new to networking, and I'm a bit over my head. The current situation is we have two firewalls (Firewall 1 and Firewall 2) and two different WANs (VDOM Prod = 1.2.3.4/32, VDOM Nonprod =5.6.7.8/32) on physical ports on Firewall 1. There are no WAN connections are Firewall 2, so when there's a failover, we lose connection to the outside.  My end goal is to have a physical port on each that can support both VDOM WANs without adding more physical WAN drops to the greater network. So, here is my concept:Firewall 1:Physical Port-1 1.2.3.4/32 (Prod VDOM)   VLAN 5.6.7.8/32 (NonProd VDOM)Firewall 2Physical Port 2 5.6.7.8/32 (NonProd VDOM)   VLAN 1.2.3.4/32 (Prod VDOM)Is this a feasible solution? Should I make the connection identical?  Thank you for your time. 

Hi all Need to know what are the feature that are available in Fortigate box without any security bundle.  

Hey all! We've ran into some issues regarding FortiClient IPsec connections with two gateway IPs. I've noticed if you change the IP to another one the connection still goes to the first one that was configured. Has anyone had this same issue?  Best regards!

Hello,on Fortigate 100F how I can monitor the PSU state without execute a commenad in a shell? When a PSU is disconnected the system LED should be amber?I tried to disconnect one of the PSU and I not have any alarms from the hardware led and also in the GUI. Thank you.