Fortinet Community

Hi everyone,I'm seeing multiple denied SSL connections in my FortiGate logs, and I can't figure out exactly why this is happening or whether it's necessary to keep blocking them. 

I have a 61F firewall with 1 Gbps ports.   Comcast raised the download speeds to 1100 Mbps and use a 2.5 Gbps port.  How can I get a 2.5 Gbps switch and put two cat 6 cables from it to two 61F ports and link them for WAN?

I've successful to create ipsec site to site FG-1 to FG-2, with configuration:FG-1source local: intf3, ip 10.0.10.0/24destination local address: 10.0.100.0/24FG-2source local address: intf1, 10.0.100.0/24destination local address: 10.0.10.0/24now I want to create another tunnel (with same ISP/WAN port:FG-1source local: intf4, ip 10.0.20.0/24destination local address: 10.0.100.0/24FG-2source local address: intf1, 10.0.100.0/24destination local address: 10.0.20.0/24---so in summary:FG1 <--> FG210.0.10.0/24 (intf3) <-> 10.0.100.010.0.20.0/24 (intf4) <-> 10.0.100.0FG indicate as fortigate. kindly please help for best practice and configuration. thank you

Is there a way in fortianalyzer to create a report using a device MAC address to see their web usage? In the Fortigates I can filter by Device in the Forwarding Traffic section but in Fortianalyzer I can't seem to filter by one device MAC address. I tried the Web Usage Template, Client Reputation Template and Detailed User Web Browing Log but whatever filter I use it shows me multiple devices instead of just one. How can I filter to just one device based on MAC address? Thanks.

Hello, I have split DNS configured on Fortigate for multiple SSL-VPN portals, and it working for everyone running Windows, MacOS, and Ubuntu.It was also working for me running Fedora with Gnome, and the default NetworkManager and systemd-resolved. But since not long ago it's not working anymore for me (it's still working for non-Fedora users).It might be since I upgraded FortiClient using forticlient_vpn_7.4.3.1736_x86_64.rpm but I'm not 100% sure.The FortiClient before the upgrade has been installed using forticlient_vpn_7.4.0.1636_x86_64.rpm.The FortiGate appliance we connect to is running 7.2.11. I can workaround by using a NetworkManager dispatcher script like this:cat << 'EOF' > /etc/NetworkManager/dispatcher.d/at-fctvpn-connection.conf #!/usr/bin/env bash set -eu # Log when there is an event echo "Receive event from ${DEVICE_IFACE:-dummy} ${NM_DISPATCHER_ACTION:-dummy} " >> /tmp/dispatch.log # Configure split DNS if the event is Firewall VPN g

aemorio.com is an e-commerce brand not some malicious website, we have secure payment gateways and logistics, none other company is reporting us malicious other than your company, need resolution in this matter, kindly check 

Can I add another ADOM on FortiManager Cloud? Does it require to have additional licenses?

Hi, I'm trying to install FortiClient VPN-only on a Microsoft Surface Pro X (ARM64 Windows). I specifically need version 7.4.3 or newer, and the file: FortiClientVPNSetup_7.4.3.1790_ARM64.exe Unfortunately, none of the links from the official product download portal or cdn.fortinet.com are working — the downloads hang or return 404/NXDOMAIN errors. Can someone from the Fortinet team or community share a direct working download link or help me get access to the correct offline installer? This is for the free VPN-only use case. Thank you!

Hello, When migrating from SSL VPN to IPSEC VPN, i can't choose multiple listening interfaces for my IPSEC dial up vpn tunnel. How can i do that correctly ?

Hello, In the case of an IPSEC dial up VPN, can you select a user group in "Destination" in fortigate latest version (7.6.3) firewall policy ? I can't seem to have it for either IPSEC dial up VPN or SSL VPN in my fortigate (7.4.3). I can choose a user group only for the source. Thank you

We have installed FMG vm on Hyber v host ..all is running fine however when reload the FMG looses all config except MGMT IP ,username , password and forticare account . try to restore config and encounter the same issue ,it accept the backup file but when reload lose the config .the vm is fully licensed. 

So,Another day, another forticlient problem. I am starting to hate this software with a passion that burns like 1000 fiery suns.This time, brand new laptop, Windows 11, 64 bit, installed 7.4.3.1790 and created the IPSEC Tunnel. It seems no matter what I do, nothing is leaving this laptop. Packet trace and logs show no attempt to make an outbound connection. Seems like forticlient isn't connected to the forticlient virtual adapters.I have tried reinstalling clean about 5 times, removed the ipsec vpn profile 10 times.This is usually all deployed with a script but I have tried manual and scripted.Different user doesn't work on this device, same login different device works fine.A packet trace and logs indicate there is no attempt to make an outbound connection.I am tearing my hair out.I have tried an earlier version of the Fortclient, still no dice.I'd be super grateful if there is a tip to resolving this that doesn't involve blowing away the OS.

I am having an issue with AntiVirus and Web Filter. I have profiles created but I can't add them in the firewall policies. It has a field to add them but the drop down list doesn't show any of the created profiles.FortiGate-30Gv7.2.8 build6390 (Mature) 

Hi , I meet a pb with my Fortigate F60 with 7.2.11 OS when I try to create a Let's Encrypt cert ...The Local In Policy accepts Port 80 and 443 on the concerned interface and there is no conflict with SSL VPN config (Port xx443) . When I try to generate the certificate with the Let's Encrypt assistant , I've got an error msg saying the server is not able to validate the http-01challenge. 1) Is it necessary to have the file with the challenge string in the /.well-known/acme-challenge/ webserver folder or the Fortigate acme client is able to validate without the file ?2) I am able to access Fortigate Admin Gui from my lan but not from outside as something blocks 80 and 443 ports in the fortigate  Many thanks for your helpLaurent

Hello. When I do Nmap scan to my wan ip address, all ports appear open. There is no port forwarding in the vip section. In the Dos Policy section, threshold values are entered 10 for TCP and udp. Also all services are deny in local in Policy section. What could be the reason why the ports appear open in nmap?

Hello, we have a requirement to have a backup connectivity via Ipsec in case our MPLS P2P fails. I am trying to figure out how to do this since there are multiple vrf's involved.The easiest way to achieve this would be to haveaBGP over ipsec per vrf and control the routing through BGP policies. But that would mean creating an Ipsec VPN for each vrf ?Is there any easier way to do this ? Looking for some suggestions.Thank you !

I have created the BDI interfaces on the Cisco SD-WAN routers with VRRP. Fortigate firewalls are working in active passive mode. We have connections to both routers from each firewall. Please suggest the config to follow here on FortiGate so that in case the link to SD-WAN router 1 goes down from FortiGate firewall 1, traffic should go out from SD-WAN router 2 from FortiGate firewall 1 link. Please suggest other options also       

We have a fortigate 60E running 5.6.6the last couple of weeks we've noticed that we cannot access the 60E's GUI via the internal LAN (or if we connect via SSL VPN)..the page doesn't even open, and sometimes we can't even ping the 60E from the internal LAN ..We can still access the GUI via WAN though...Any suggestions ?

Greetings,I'm considering using FortiConverter to migrate my configuration from a 600E to a 400F. I currently have firmware 7.4.4.What recommendations, experience, or suggestions do you have https://100001.onl/ ?Saludos,Estoy pensando en adquirir los servicios del FortiConverter para migrar mi configuracion del 600E a un 400F, actualmente tengo el fimware 7.4.4.Que recomendaciones tienen, experiencia o sugerencia que me puedan dar.

Hello,We are running fortigate VM. The problem is that IPsec VPN is not stable for some users and they get disconnects. It affects about 10-15 percent of users. From what I research i found out that the disconnect happens when a duplicate tunnel is created. That causes the tunnel shutdown and user has to reenter his FortiToken code. The main thing I would like to improve is to use IKEv2 with FortiToken(Xauth). Currently we have IkeV1 with aggresive mode which from my understanding is deprecated. The question would be is it posible to use IKEv2 and use FortiToken because GUI does not have that option and if possible how to set it up? We are running Forti OS 7.2.11.

Hello everyone. Our company has two Fortigate 1500D firewalls, and we have configured FSGP, SD-WAN, and Standalone settings. On the core switch, I have set the default routes to point to these two firewalls respectively, and these two firewalls are interconnected to the carrier through their respective lines, then directed to the same carrier via static default routes.The current issue is that when using Standalone configuration synchronization, gateways within the same SD-WAN members get overridden by the main firewall. Since this carrier provides me with two lines corresponding to different next hops, it's impossible to direct them towards the same gateway.My question now is whether it's possible to specify Standalone functionality so that these two firewalls do not synchronize configurations within the SD-WAN module; when needed, I can manually configure features in this SD-WAN module while still enjoying other synchronized configurations under Standalone.

Hi,I’m encountering a reachability issue between our Head Office and Branch Office following changes to our IP Sec VPN setup.Specifically, the public IP of our Branch Office b-b-b-b is no longer reachable from our Head Office IP h-h-h-h. However, b-b-b-b remains accessible from other external sources, indicating that the branch connection is working outside the Head Office route.This issue began after we deleted and reconfigured the IP Sec VPN on the Head Office firewall. Since then, the VPN tunnel fails to establish due to unreachability.Notably1- If I set up policy-based routing from the Head Office, I can reach b-b-b-b2- However, with this routing, the IP Sec VPN tunnel fails to work.3- I’ve verified that there are no deny policies, including local-in-policy, and the IP is only used in the IP Sec configuration.Ping response from Head Office firewall:execute ping b-b-b-bsend msg failed: 22 Invalid argumentsend msg failed: 22 Invalid argumentsend msg failed: 22 Invalid argumentsend ms

Hello, I was not able to make ikev2 work. Ikev1 works ok. Ikev2 but with local authentication(local users in FGT) works ok.But the integration with Fortiauthenticator does not work.The forticlient says:Wrong credentials EAP failed connection to ...Versions:FGT:7.4.7FCT: 7.4.3FAC: 6.6 I have followed this guides:https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Using-IKEv2-for-a-dial-up-IPsec-tunnel-with/ta-p/229663https://community.fortinet.com/t5/FortiGate/Technical-Tip-IKEv2-dialup-IPsec-tunnel-with-Radius-server/ta-p/191040 But this guides show how to enable EAP-MSCHAPv2 in NPS, I did not find info about Fortiauthenticator.In Fortiauthenticator ,in Radius Policy I enabled EAP protocols and does not work. Does anyone have any clue? Any help is appreciate it.thank you!Regards.    

getting error while enabling the eval license - Error occurred during trial license registration

Hello Team,                 We are deploying two FortiGate 100F firewalls in an Active-Passive High Availability (HA) configuration with a Stack of two Cisco Catalyst 9300L switches. One of the LAN interfaces(Port 3 & Port 4) will be configured with LACP for link aggregation in the Firewalls. Below the firewalls, we have a stack of two Cisco Catalyst 9300L switches, in the Firewalls Port1 & Port2, with WAN ISPs(JIO & AIRTEL) links.                 Considering our network topology, we are seeking your best failover guidance on the best practices to connect a Cisco C9300L stack to Active-Passive (High Availability) FortiGate 100F firewalls. We are attaching a proposed network diagrams for reference.                 Your input on the configuration and uplink design would be greatly appreciated.