Fortinet Community

Hi All, After waiting (im)patiently for the ARM64 client to use on Win11 Surface Pro laptops, I'm finding that after a reboot, the 2 virtual adaptors get removed.The outcome of this is that the vpn connection stalls at 98% and, obviously, doesn't connect.If I uninstall Forticlient, reboot, reinstall, then it all works again, until another shutdown-startup/reboot.(Bear in mind, I also have to extract the MSI to be able to install the client. This is after manually installing the VC++ packages too).The adaptors get removed after FortiClient goes through a process of "updating drivers", which it displays on screen, then tells me to reboot.I've also tried backup/exporting the config, editing the .xml to stop the auto update check, restoring the config, but it still happens.The virtual adaptors are not in a disabled state.I've also tried installing them again from the folder "C:\Program Files\Common Files\Fortinet\FortiClient\7.4.3.1790", but they don't appear again. Anyone got an

I have an unusual issue that I have to get resolved.I have a vendor that connects to our Internal IP - call it 10.1.1.1 via policy based vpn tunnel strongswan. That tunnel needs to reach 10.2.2.2 which is on a different VPN tunnel. routes are in place to get that traffic, but the vendor side can't make routes.Incessance, they want to be able to connect to 10.1.1.50 on their end, and have our end pass that traffic being sent to that IP to 10.2.2.50 on our end. The vendors end has no idea 10.2.2.50 exists. all traffic will need to be translated. I am trying to figure out if a NAT will do that, or if there is a different way?It will be internal to basically internal forwarding. Or is this not possible?

 Will there be any impact and future problems if I use a different transceiver?

Hello everybody, I'm working on a Fortigate 70G v7.2.11I defined an interface:   and a policy to allow the traffic:  With this policy, I want to say: wherever I call you, you have to allow the traffic.If I connect to any 70G interface (wifi, wired lan etc.), it works. I can ping 10.0.0.2.There is only one interface for which this policy does not work: It's the admin_tunnel (or the ipsec interface), an ipsec interface. I've already tested this ipsec tunnel for other scopes and it works fine. In fact, I already defined one policy:  The problem is that if I'm connected to this tunnel I can't ping 10.0.0.2 anymore.Why is that? shouldn't the traffic I send out the tunnel just fall under any -> 70Gto60F (port5) the policy?   

Hello,We are using the Forticlient VPN app on our company IPhones. We created an Intune Configuration profile for our users but the SSO button is switched off.How can we switch on the SSO button in this configuration? Our users can't change it by themselves because it is an MDM VPN.

FortiClient 7.4.1 is automatically prompting to connect to the VPN. After installing FortiClient Zero Trust Fabric Agent 7.4.1, I noticed that it frequently prompts to connect to the VPN without any user action. The connection appears to initiate automatically, and the username and password are saved in the Remote Access tab. Has anyone else experienced or is currently experiencing this issue? Thank You  FortiClient 

Hello Fortinet Community , I would like to clarify a scenario regarding the integration between FortiMail and FortiAuthenticator. In our enterprise environment, users are authenticated via FortiAuthenticator, and their email traffic is filtered by FortiMail. Specifically, in cases where certain users receive a high volume of phishing, spam, or other malicious emails, is it possible to automatically quarantine all incoming emails for those users?

Hi everyone, I'm currently trying to set up a new FG-120G, and I'm currently stuck with enabling the proxy mode inspection. I tried following these two instructions for activating proxy mode inspection:- https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-the-visibility-of-Proxy-Mode-in/ta-p/270448 - https://community.fortinet.com/t5/FortiGate/Technical-Tip-Inspection-mode-option-is-not-visible-under-Policy/ta-p/250797  I activated "Policy Advanced Options" under Feature visibility. Then I tried the commands in the CLI, but there is no "gui-proxy-inspection" under "config system settings". Even under "config system global" there is no "proxy-and-explicit-proxy".I also tried restarting the FortiGate after activating the Feature "Policy Advanced Options", but the commands still don't work. (since the command "fnsysctl killall httpsd" did nothing) Are there any requirements or settings that I'm missing to activate proxy mode?View of creating a

HelloWe integrated Huawei AC6508 WLC with FortiNAC, using local RADIUS, but we facing some issue.When we set Default Attribute Group to RFC_VLAN we notice in RADIUS logs that FortiNAC sends the right response to the WLC, however the WLC still asks the user to authenticate, like it the WLC didn't recognize the RADIUS responseWhen we set Default Attribute Group to None we notice that the WLC put the authenticated user in the default service VLAN, so it worksSo I guess the that the predefined RFC_VLAN Attribute Group is not the good one to use with our WLC.In the FortiNAC document "Huawei Controller Wireless Integration" guide they mentioned to leave the value "None" optionally, but in our case we need to include the target VLAN in the RADIUS response. Any idea on what should be the attributes of the right Attribute Group to use?

Currently i have a Fortinet FortiAnalyzer 7.2 Analyst exam that i earned on December 14, 2023. So my concern is can i use it to as elective take Fortinet Certified Professional Network Security? And i just need to sit an exam for core exam FCP - FortiGate Administrator? Please advise. Thank you.

There have been internal discussions about blocking *all AI websites, so I was asked if that could be done on the FortiGate. I don't see a category for this, but I did find a webpage that had something under General Interest - Business | Aritificial Intelligence Technology. However, I don't see that category in our FortiGate, which is running 7.2.5. Does anyone have suggestions for this? Thanks

Hi guys,  I have configured an endpoint compliance scan for windows 10 and windows 11 hosts in FNAC version 7.4.0. all windows 11 pro scan is passed while windows 10 Pro 6.3 22H2 fails.Any idea about the issue? 

I have referred the below article but this showing only active passive I need active active dual hub architecture implementation guide. https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan-sd-branch-architecture-for-mssps/242513/sd-wan-configuration

Hello, I'm using an FGT60F with firmware v7.2.11 build 1740.Our provider only gave us a fixed IP address.Is it possible, for example, to forward the URL test1.domain.com to one server and test2.domain.com to another?Thanks, Rolf

Hi, I would like to know if there is a way to configure an IPSEC site-to-site tunnel using FortiManager without using the IPSEC template ?

Dear All, This question is little bit strange but I want to know for My KB. If you see the digram there are three interfaces Port1, Port2 and port3 which are in deffirent subnets. I am able to ping from PC1&2 to my gateway 192.168.1.1 which is absolutely is same subnet but not able to ping 1.1.1.2 and 2.2.2.2 from PC1 and PC2. Why ??I have configured same thing on Cisco router with three subnet with same subnet, I was able to ping because these are the subnet which directly connected If see the routing table using #show ip route. I though same thing should be in Fortigate Firewall but it did not work for me. Can anyone tell me why I am not able to ping from PC1&PC2 (192.168.1.0/24)  to 1.1.1.2&2.2.2.2.These subnets are also directly connected to Fortigate Firewall.   Thank you for your reply in advance.  

Currently I have a problem: i installed ipsec vpn successfully. Stand from the vpnclient user position and access to vpn but it shows a web page and asks to enter the user/password again. I want to remove the requirement to enter 1 more user/password, how do I do that. Currently I am using version 5.2

Hello Team,  m facing an issue with my FortiFone-380. When I access the web interface, I only see the Fortinet logo — there's no login prompt or dashboard displayed. 

Hello dear Fortinet Community Since I have an FAP-221C laying arround, is it possible to use it without an Actual FortiGate? I have a FortiGate 40C to configure, but the Firmware is pretty old, since the payed Account has expired and I want to switch over to a OPNsense Appliance. So is it possible, to use (and configure) the FAP-221C independently? To run WiFi Controller sepperately? Firmware FortiGate:FGT40C-4.00-FW-build535-120511 Firmware FortiAP:FP221C-v5.2-build0245 Thanks, any information appreciated.

i setup this hub site with diaup ipsec option with igbp my issue spoke1 to spoke 2 not ping

I set up HA between 2 FortiGate VMs on vSphere. When I do a packet sniff on the heartbeat interface of FW1b I am getting ICMP unreachables for port 730 from FW1a. Both are configured identical. Any idea where to troubleshoot next? FW1a:bb-fortigate-1a # sho system interface port5 config system interface edit "port5" set ip 192.168.255.1 255.255.255.0 set allowaccess ping https ssh snmp http telnet set type physical set snmp-index 5 next end bb-fortigate-1a # sho system ha config system ha set group-id 1 set group-name "site1cluster" set mode a-p set hbdev "port5" 0 set session-pickup enable set ha-mgmt-status enable config ha-mgmt-interfaces edit 1 set interface "port1" set gateway 172.20.137.65 next end set override disable set priority 200 set unicast-hb enable set unicast-hb-peerip 192.168.255.2 end FW1b:bb-fortigate-1b # show system interface p

Hi, I'm new hereI have the SIEM analyst role and I have read-only access to the fortianalyzer.I have to monitor all the events that it detects as incidents.This fortianalyzer manages more than 10 firewalls and I only want to get the events that are most relevant or what fortianalyzer considers as an incident or what most draws attention and contributes to security issues to avoid incidents.According to what I have investigated this is the configuration that I should request to the firewall administrator but I would appreciate if you could share with me your recommendations config system log-forward edit 1 set mode forwarding set fwd-max-delay realtime set server-name "SIEM_Server" set server-addr "192.169.1.1" set fwd-server-type cef set server-port 6515 set fwd-reliable enable set log-filter-status enable config log-filter edit 1 set field "event" set value "sec

Hello Team, I connected an already configured fortigate cluster to a Fortimanager. Now I wanted to try to create a policy from the Fortimanager and push it to the firewall. Can you point me to the correct procedure?To do this I saw that you have to create a policy package but I have the grey button and I can't click it.I am logging into the FortiManager as an admin user (so I am ruling out permissions problems).I point out that on the same adom (root) as Fortimanager there is already another pair of fortigates which already have a policy package assigned. Please feel free to ask for more details.I thank you in advance for the supportBR 

New to Fortinac so very low knowledge of it right now. But we recently upgraded our appliance and went to virtual server from physical. Some names got changed of the actual server and while everything looks good for the most part I see where no client i look up shows it has the persistent agent. I went into the logs and it looks like it is trying to reach out to the old Fortinac server and not the new. It has the most recent agent but not looking for new server, I've changed the DNS records of bradford_tcp and bradford_udp to the new server and still no luck. Is there any other places I need to make changes to point my clients to the new server???

i need to know after ssl vpn not support in future so if we need vpn web mode how we configure this?