Fortinet Community

HelloI have my AD controler on the SAMBA 4. I have question: My FSSO can get Logon sessions data from my AD controler? Maybe FSSO work only with Windows AD controler and it's a waste of my strength in the fight against FG acticity with Samba AD?BR

hi there, I need to add override url so won't be blocked.what I understand, there are two way:1. create custom web category2. add url on web filter profile am I correct?there are hundreds url address that I need to add. what is the best practice to add locally, without add manually one by one?thanks

All our FortiGates (running 7.2.8) are managed by a virtual FMG (running 7.2.5), and backups have run consistently since they were setup. We recently implemented FAZ, and as soon as we setup a root for the security fabric, every backup has been failing except for the one that is the root. The backup for the root FortiGate is now creating 5 files every night (file sizes are different) and we get 5 alerts; also, all files are in the same folder. Files are encrypted, so I don't know if they are all from the same firewall, but I may disable encryption for a night to see what I can find inside the files. Incidentally, we have 13 FortiGates and should have 13 backup files. Can someone point me in a direction to look at to figure why the backups are no longer running? Thank you.

Hello,we have different sites connected between us via three vpn ipsec with different isp using sd-wan and static routing.We want to move from static routing to bgp and started some test on one vpn using the normal neighbor configuration and all is working, the peering is ok and i see the routing table.Using three vpn ipsec ffor each site connected ivolve a lot of neighbor to configure.I want to use neighbor-group and neighbor-range, but the documentation about this is lack of details.Can I use the neighbor-group on each side?And also the neighbor-range implementation is not clear, what infomation I must insert when I declare a network range?I implemented a test configuration, but the peering process is not started.Below the schema  For test purpose I using only vpn over isp3.In network range I declared the ip configurated in system interface for interface peer.On phase1-interface I disabled net-device.I set also the policies to allow ping and tcp 179 between loopback interfaces.B

In 1801f (version 7.4.7 )Email is configure, how we test it 

I have 2 offices, Site A is Sophos and Site B is Fortigate. I have established Site-To-Site VPN for the two sites. The tunnel between the two sites is UP, but the Tunnel Interface IP cannot ping each other and the two sites cannot ping each other. The server under the site cannot ping the opposite endpoint. The following is relevant information:Site A (Sophos)WAN IP : 11.11.11.11LAN IP Subnet : 172.29.21.0/24, Server IP: 172.29.21.11 (LAN Gateway under Sophos Firewall)Tunnel Interface IP : 10.212.0.1/29Firewall Policy: Accept LAN(172.29.21.0/24) toVPN(10.210.101.0/24) Site B (Fortigate)WAN IP : 22.22.22.22LAN IP Subnet : 10.210.101.0/24, Server IP: 10.210.101.11 (LAN Gateway under Fortigate Firewall)Tunnel Interface IP : 10.212.0.6/29Static Route: 172.29.21.0/24 via interface S2S_DCOF_MFirewall Policy: Accept LAN(10.210.101.0/24) to S2S_DCOF_M(172.29.21.0/24)  (Below Fortigate IPSec Tunnel Status)   Here I'm using Route-based to establish a Site-To-Site VP

I am able to connect to my IKE v2 IPsec tunnel for remote access using my local laptop plugged directly in to internal1 port, however I cannot ping lan (VLAN gateway 172.16.10.1) that sits behind FortiGate. FortiOS version is 7.4.7 and FortiClient on laptop is 7.4.3.1761I configured IKE v2 using API POST/PUT and this is what the final phase 1 tunnel looks like:{ "name":"IPSEC_VPN", "q_origin_key":"IPSEC_VPN", "type":"dynamic", "interface":"internal", "ip-version":"4", "ike-version":"2", "local-gw":"0.0.0.0", "local-gw6":"::", "remote-gw":"0.0.0.0", "remote-gw6":"::", "remotegw-ddns":"", "keylife":28800, "certificate":[ ], "authmethod":"psk", "authmethod-remote":"", "mode":"main", "peertype":"any", "peerid":"", "default-gw":"0.0.0.0", "default-gw-priority":0, "usrgrp":"", "peer":"", "peergrp":"", "monitor":"", "monitor-hold-down

Hi Community, We have 2 IPsec Tunnels (Tunnel 10 and Tunnel 20) between Fortigates (Remote and Concentrator) with only 1 Phase 2 Selector configured and auto-negotiate disabled. Both tunnels are working as expected where we have connectivity from both sides.  Tunnel 10 is presenting 2 Phase-2 Selectors via GUI und CLI, where the first Phase-2  is UP and the second one is DOWN. We have already deleted the entire Phase 2 Interface and reconfigured it, restarted the entire cluster (A-P) and nothing helps. We really don´t understand why there are 2 Phase Selectors in a scenario where we have only 1 configured, please any idea how to troubleshooting and solve this issue? FortiOS 6.4.11 and keep in mind that Tunnel 20 with the same setup in the same device has not this issue and we have several others FGT with the same setup and also not presenting this issue.  I really appreciate any comments, thank you!FortiGate 

We are using Forticlient 4.2.4.0271 Recently we started noticing that Forticlient changes a DHCP assigned DNS setting on the NIC to a static DNS setting while it is connected (and uses the DNS settings of the IPSEC VPN connection from a Fortigate as the static settings). It then changes it back to automatically assigned when the Forticlient is disconnected. However, if the system goes into hibernate while the Forticlient is connected, it doesn' t seem to revert these DNS setting changes back to DHCP automatically assigned, causing an issue when the user tries to use the Internet on another network that requires DHCP assigned DNS. Has anyone else seen this problem?

The only link I can find on the support site with this scenario I am wanting to achieve is https://community.fortinet.com/t5/FortiGate/Technical-Tip-DNS-database-with-FortiGate-as-a-slave-to-a/ta-p/192942 where it gives the basic items to do to get this working. What I am making further inquiry about is what might need to be done on the Windows side? i.e... since this is going to a secondary DNS, is the FortiGates's DNS, BIND, and thus I need to set the Windows DNS properties to allow BIND secondaries? Do I need to turn off DNSSEC for remote responses? Just those types of inquiries since the article did not expound on that at all...and since I am running into errors, this has gotten me to make further inquiry. From the Windows side of things, I get a "Validation error, please try again later".  From the FortiGate's side, when I do "diag test application dnsproxy 8" from the CLI, I do get record information like the example output of the link provided, yet from the G

I’m setting up EAP-TLS for Entra-joined devices using FortiGate NAC Lite (7.4.x) and FortiAuthenticator (6.6.x) with certs deployed via Intune SCEP. I’ve got it mostly working but need a known-good config to compare against—especially: FortiAuthenticator SCEP & RADIUS settings FortiGate 802.1X interface config Any Intune SCEP profile tips If anyone can share a working example or config snippet, it’d be a huge help.Thanks!

After upgrading our FG200E from v7.2.4 build 1396 to v7.2.5 build1517 our configured SD-WAN zone and both of our WAN interfaces no longer show up in the dropdown selection "Outgoing Interface" when editing or creating new firewall policies.Additional facts I have collected so far:I can see and edit the SD-WAN zone under "Network" > "SD-WAN".When editing the SD-WAN zone, clicking on "References" delivers no results.When editing the SD-WAN members, the dropdown "SD-WAN Zone" shows no selectable entries.I can use the configured SD-WAN zone in firewall policies and edit the zone and the members via CLI, so there is a workaround, it seems to be a web-GUI issueDoes anybody know wether this is a (known) issue with the firmware or are there any possible mistakes we could have made in our configuration which just did not pop up until after the upgrade?

I have two sites broadcasting there available newtorks via bgp over a site to site connection.  When I do a firewall policy test the remote system, it gives my default outbound policy vs the Firewall rules I have already established.  BGP Neighbors BGP Paths So none of my site to site policies match when I do the test policy function. I am sure I am missing something but dont know what. Thanks in advance 

Hello, may I ask an expert from Fortinet to explain in detail how the "Intelligent analysis" feature works? Admin guide is rather vague. I have just created my first WA test profile. I have kept the Intelligent analysis value at default 50. Now it has been 2 hours and already 2 legitimate messages got classified as: Identified by BEC-Weighted Analysis: Intelligent analysis, score: 50 I see no valid issues with messages. So far it looks like it creates false positives, exactly the opposite of what Admin guide states. Thanks,Petr

Fortgate 80E firewall memory usage hanged up at 82% and Firewall Showing (Conserved mode Error). Which stopped firewall mode to 82% usage for safer side.Some services were working and some were disturbed. I deleted all logs of fortigate to resolve this issue.  Needs suggestion from Senior members what was this issue, why this occured , what is best approach to reolve this issue? Either my solution was true or not?

Hello! I have an odd problem with L2TP server over IPSEC on my FG-100F box running 7.4.6 software.My configuration:config vpn ipsec phase1-interface edit "L2TP-VOLZ" set type dynamic set interface "VLAN96-TESTLAB" set ike-version 2 set peertype any set net-device enable set proposal aes256-sha512 set dpd on-idle set psksecret ENC <removed> set dpd-retryinterval 60 next end config vpn ipsec phase2-interface edit "L2TP-VOLZ" set phase1name "L2TP-VOLZ" set proposal aes256gcm set encapsulation transport-mode set l2tp enable next end config vpn l2tp set status enable set eip 10.100.251.254 set sip 10.100.251.1 set enforce-ipsec enable set usrgrp "IPSEC VPN" end config system interface edit "l2t.TESTLAB" set vdom "TESTLAB" set allowaccess ping set type tunnel set snmp-index 99 next end config system interface edit "L2TP-VOLZ" set vdom "TESTLAB" set ip 0.0.0.0 255.255.255.255 set allowaccess ping set type tunnel set snmp-index 129 set interface "VLAN96-TESTLAB" next end confi

Currently running FortiOS 7.2.11 and we're exposing a web server behind a Virtual Server configured for SSL offloading. Our security team is asking us to set the minimum protocol to TLS 1.2, but we've been asked to make sure no legacy clients are still using TLS 1.1. I checked the forwarding logs and am not seeing protocol or ciphers, is there a way to see this in the logs or to pull this from FortiAnalyzer?   Denny

Greetings! I am encountering an issue with playbooks in FortiAnalyzer. A few weeks ago, everything was working correctly, and I could see automatically created incidents. However, this is no longer the case. I created new and they don't work too. Also, I checked their settings and everything must work Could you please advise on how to resolve this?  

I'm using a Lenovo IdeaPad Slim 3 with Windows 11 Home Single Language (Version 24H2, Build 26100.4061). When I try to connect to a VPN , it doesn't connect—no error shows, it just stays stuck on "connecting."Internet works fine otherwise. Any idea what could be causing this?

Hello,I've come across a number of posts about this topic on both FortiNet and T-Mobile forums but I haven't found a solution. We have one user who has T-Mobile for home internet. She cannot use the FortiClient IPSec VPN consistently. When I was first setting up VPN for our users, I noticed this issue with my own T-Mobile hotspot on my iPhone and we were forced to also offer SSL-VPN. We implemented our new VPN and have been rolling fine for a few weeks now. However... I came to learn this week that she'd actually been able to use the IPSec VPN and it was working fine for her. Then this week after she had a tech help her with an email issue, the IPSec VPN no longer works for her, and the SSL VPN disconnects on her frequently. I worked with her for about an hour this morning. She has a Mitel 5340 phone in Teleworker mode which we used for communication while I did a remote support session with her. I noticed no issue with either the VoIP or the Remote session.I made sure I

Hello everyone, I recently came across information saying that Fortinet has introduced a new feature allowing HA to be configured with only one licensed device, rather than requiring licenses for both units in the HA pair.  From what I’ve gathered, this feature appears to be available only for models ranging from FortiGate-40F to FortiGate-100F. Some models in the FortiGate F series, such as the FortiGate-40F-HA, appear to support this functionality. However I haven’t seen a similar designation for the FortiGate-30G model for example. Could anyone please confirm whether the G series includes this feature by default? And I’d like to know if this HA configuration supports active-active mode or if it is limited to active-passive, which would be the more expected scenario. Thanks in advancedCheers,

Hello!We have an interface on our Fortigate which has multiple secondary IP addresses. Is there a way to stop the traffic between the networks? For example:Interface with IP 10.0.0.254/24Same interface with secondary IP address 172.16.0.254/24Same interface with secondary IP address 192.168.0.254/24 Unfortunately, it is currently possible for devices in the respective subnets to reach each other via the interface. However, I would like to prevent traffic between them and define exceptions. We also do not have enough ports to bring the individual networks into their own interface.Thanks for your help!

Hello,trying to convert a FTD policy to Fortigate using FC 7.2.0.Some ACLs contain multiple source interfaces.The converted policy imho seems to miss source interfaces.This happens with FTD ACLs having multiple source interfaces as well.example: access-list CSM_FW_ACL_ remark rule-id 268444674: ACCESS POLICY: ACLFirePower - Mandatory access-list CSM_FW_ACL_ remark rule-id 268444674: L7 RULE: Inside_kms access-list CSM_FW_ACL_ advanced permit tcp object-group-ifc Verwaltung any object-group-ifc ServerNetz object rz-kms eq 1688 rule-id 268444674 access-list CSM_FW_ACL_ advanced permit tcp object-group-ifc Bibo_Inside any object-group-ifc ServerNetz object rz-kms eq 1688 rule-id 268444674 access-list CSM_FW_ACL_ advanced permit tcp object-group-ifc Inside any object-group-ifc ServerNetz object rz-kms eq 1688 rule-id 268444674 access-list CSM_FW_ACL_ advanced permit tcp object-group-ifc ServerNetz any object-group-ifc ServerNetz object rz-kms eq 1688 rule-id 268444674 access-list

Hi all,Trying to set up FortiClient IPsec VPN (IKEv2) with SAML (Microsoft Entra ID) on FortiOS 7.4.7. When I try set xauthtype saml or set saml-server, I get parse errors (code -61). Also getting psksecret required errors if I skip PSK.Docs don’t mention any prerequisites. Has anyone gotten this working with Entra ID? Seems like the tunnel needs to be created in a specific order.Thanks!

Hello, I would like to clarify some questions for 7121F configuration.I need to provide 420Gb NGFW performance and have 10*100Gb SFPDD ports. I think I need 7121 chassis and 8*FPM-7620F и 1*FIM-7921F? Is it working configuration? Could you provide some advices?