Fortinet Community

Hello all, with json options, a Google Chrome-based web browser can be easily configured globally on a Linux system. This allows you to enforce settings in all areas for all users of a Linux desktop/terminal server. This has the advantage that you don't have to worry about the user settings of each individual and that company-wide policies can be easily applied. In addition, you can have each extension installed automatically. Since Google and now unfortunately also Firefox are becoming more and more intrusivewhen it comes to advertising and skimming personal data, I thought I would disable some unnecessary (→ unwanted) features and increase privacy. It also annoyed me that sometimes new features were tried out and switches in Chrome/Chromium were activated without asking. Click here for the project: https://github.com/boospy/Privacy-Browser-Project

Hi everyone,I have a FortiNAC VPN management model with FortiGate (IPsec VPN).I referred to the documents below but still do not understand some things:https://docs.fortinet.com/document/fortinac-f/7.6.0/fortigate-vpn-integration/693309/what-it-doeshttps://docs.fortinet.com/document/fortinac-f/7.6.0/fortigate-vpn-integration/693309/configuring-fortigatePlease see the attached links for IP information, model, etc.My questions:Can FortiNAC's Isolation Interface (10.1.3.71/24) be used for both SSL VPN and IPsec VPN?Where does the Isolation IP range 10.5.254.11 - 10.5.254.99 come from? Where is the gateway of that range?When is the IP range 10.5.254.11 - 10.5.254.99 used?

In all the examples I have seen on how to create a tcp-forwarding proxy policy for ZTNA I always see the following config parts:config firewall access-proxyconfig firewall proxy-policy Some times they do include:config firewall policy In my testing I have noticed that a firewall policy config is not required.  I am sure there is a good reason for having a firewall policy regardless.  Can some one tell me what benefits you can get from including the firewall policy?

Morning everyone, I'm experiencing a delay with outgoing emails and would like to know if there are any additional troubleshooting steps I might have missed. Thanks in advancedKind regards,

HiI'm trying to setup IKEv2 tunnels for my remote access users. on IKEv1 i could assign tunnels to a user groups but when i change it to IKEv2, I can't find anywhere to assign the tunnel to a group. I'm using LDAP for user Authentication. how am i supposed to handle this?Regards

Hello Guys,I have two questions about the Ike V2 IPSEC DIalup Connection. I want to configure in my enviroment (two fortigate 100F HA) like 150 dialup external connection. I have setup an IPSEC Tunnel (IkeV2) and set policy correctly. I created the users locally (without any Proxy or RADIUS) and inserted in a group. The VPN works fine but i have two questions:- Is binding set in the IPSEC configuration the authusrgrp? because i haven't set and i won't set because if i set, every time thast the people connect appear when the people search a local ip for example, the Fortigate Auth page, and for us isn't necessary. So if i unset that is an error? -  Ikev2 works fine with the local user (i enabled the EAP)? because i haven't any other type of authentication Thank you so much

I'm using SD WAN and I have 1 wan port which has a public ip (which I use for my mail server) and the other wan port has a private ip (behind cgnat).My inbound mail is port forwarded from the public ip to the mail server. However, I noticed an issue when the mail server sends email out, it tries to send it over the second port (behind cgnat) and this causes the email to fail to send. Is there any way to set up a sd wan rule to force all outbound smtp mail exiting the mail server to go over wan1 (public ip)?Any help would be appreciated.

Hello, We have a interesting Setup. We have the normal starlink setup + we have a managed router which our provider is using to provide us with a static IP address. They have a ipsec tunnel to our Fortigate and then we have a ipsec site to site vpn back to them. The tunnel itself comes up fine but then nothing can resolve cant go to yahoo.com cnn.com but it has internet access you can ping 8.8.8.8 and access most internal sites.  Has anyone seen this issue before and have any recommendations? 

i'm trying to migrate from SSL vpn to IPsec remote access tunnel. Im using IKEv1 but the linux forticlient doesn't support IPsec. so I tried alternatives like Strongswan and Libreswan and i was able to connect to the tunnel. the users should have two step verification (i'm using email code) on but the problem is when the two step verification gets on i'm not able to connect to the tunnel anymore and it won't prompt for code. Is there anything i can do or any alternatives i could use to be able to connect when 2FA is on.

Hi,Is it possible to use both SamAccountName and DnsHostname authenticated against same LDAP server. I cannot get it worked. If I changed the username attribute to dnshostname as below it authenticates with dnshostname but not with samaccountname, how can I get both working so I can authenticate using both computer name and username ?  Thanks Thilina 

I upgraded from 7.0.15 to 7.4.7 due to a request from Fortinet support to fix an IPSec issue I had.After the upgrade, all was working fine. Then, a couple of days ago, the letsencrypt certificates I use with Virtual Servers were renewed. Successfully.However, since the renewal, the certificates are not applied anymore to the incoming connections. Instead the self-signed certs of the application are shown to the client. After some research, I believe that this is because proxy based fw rules are not supported anymore on a 40F with 2GB RAM. Question: Can I still use the letsencrypt certificates with VIP connections? If yes, what do I need to change on the settings for those connections (FW rule, VIP serttings, etc.)? ThanksDan

Hi there! I have three Fortigates, two physical and one on AWS. Recently (since 05/02/25) I have noticed that Forticloud is not collecting the VPN logs that I usually check daily. The current firmware version on all three devices is 7.4.3. The Forticloud connection is fine on the console. Has anyone experienced this? Thanks for your help.

Hi together, acutally I am dealing on the following issue:We tried to setup a remote IPSec VPN as SSL-VPN wont't be supported in the future.The connection establishes, routes are configured on the client correctly. There are also packets sent from the client to the company network (packet counter is increasing) but no packets are received (packet counter is staying at 0).On the Fortigate (acutally only a 40F for testing) the packets are shown in the capture and (e.g. a ping) also reaching the destination. The destination (e.g. DNS-Server) responds successfully and Fortigate sends the packet back into the tunnel (the packet capture shows this). But the packets are not received by the client.After arount 20 seconds (+/- 5 seconds) the FortiClient ends the connection. But I think it is not really ending it, only killing it, as the connection stays in status "up" on the Forit for a while then. Forti 40F has 7.4.7, Forticlient has Version 7.4.0.1658.Config of Forti:config vpn ipse

I have a Fortigate device with two internet access lines, and one of them is having browsing issues. I've already checked with the provider and the service is working fine. I've run a debug and see this IP-related message. Could someone help me? func=get_new_addr line=1205 msg="find SNAT: IP-204.199.64.3(from IPPOOL), port-51586"

Hi , I'm trying to setup a custom Report to show all users browsing activity in a customers network. so for example user A - consumed maybe 5gb on whatsapp - 2gb office updates etc... just to break down what their doing on the network at a glance.  and filter based on the subnet their in so for guest users see what's going execs etc... based on subnets e.g.: VLAN1 - LAN  (10.214.11.0/24)VLAN2 - CCTV (10.213.11.0/24)VLAN3 - GUEST (10.212.11.0/24)VLAN4 - CORP WIFI (10.211.11.0/24)Essentially i want to be able to just generate a report and specify the subnet when running the report. I have tried doing this with a custom dataset but as soon as i specify the Subnet the report generates blank content. Running - FAZVM64 KVM - v7.4.6 build2588 (Mature)   SELECT user_src, hostname AS website, SUM(minutes) AS total_time_minutes, SUM(bandwidth) AS total_bandwidth FROM ( SELECT count(dtime) AS minutes,

Hello, We have an LDAP connection to our DC setup on our Fortigate 60E (v6.2.2 build1010). We connect to the domain controller over a S2S VPN. Insecure connections on port 389 connect just fine. However, when I attempt to turn on LDAPS, and issue command: diagnose test authserver ldap SDC_LDAP <username> <password> I get authenticate '<username>' against 'SDC_LDAP' failed!I have imported a CA cert into the Fortigate that is in the trusted CA store of the DC (SDC_LDAP) as well. After a bit of troubleshooting, I believe I cannot connect via LDAPS because the Fortigate does not resolve the fqdn of the LDAP server IP, thus causing a cert validation failure. Entering in the fqdn of the DC into the server field does not work because the Fortigate does not resolve the name to an IP address (a DNS resolution failure).  Using the Ldp utility from my desktop I get a similar result, I can connect via LDAPS just fine if and only if I use the DC hostname/f

Hello, we´re experiencing lower download throughput when putting a wireguard vpn server behind a Fortigate 500E cluster: [Wireguard client]-----[Internet/30ms]--------[Wireguard server]-----[FortiGate]------[SMB server] => ~ 42 MB/s[Internet/30ms]--------[Wireguard client]-----[Wireguard server]-----[FortiGate]------[SMB server] => ~ 42 MB/s[Wireguard client]-----[Internet/30ms]-------[Wireguard server]-----[SMB server]----[FortiGate] => ~ 42 MB/s[Internet/30ms]--------[Wireguard client]-----[Wireguard server]-----[SMB server]----[FortiGate] => ~ 42 MB/s[Wireguard client]-----[Internet/30ms]--------[FortiGate]------[Wireguard server]-----[SMB server] => ~ 10 MB/s[Internet/30ms]--------[Wireguard client]-----[FortiGate]-------[Wireguard server]-----[SMB server] => ~ 10 MB/s - Setup:Fortinet 500E cluster (active/passive)FortiOS 7.4.7Wireguard with UDPclient downloads 20GB file from SMB serverall server with public IP, no NAT - policy flow basedconfig

I'd like to export the port configuration of all my FortiSwitches that are managed through FortiLink from a Fortigate. The export should be in table format, similar to what I see in the "FortiSwitch Ports" view in the FG Switch Controller. This is mostly for documentation. Is there an easy way to achieve this? Thanks Dan

Hi all,I'm trying to move away from the SSL VPNs we have and setup IPSec and if i use the basic wizard this all works but it then defaults to IKEV1 so i set it as a custom tunnel and selected IKEV2 but when i then change the "accept types" to Peer ID from Dialup Group and then select the same group we use in the SSL config i then get "invalid length of value" ? There doesn't seem to be much information on this that i can find apart from a few posts saying the group has to be either setup locally or of the type "firewall" which this is ? If i choose IKEV1 and use XAUTH then it accepts the group without any issue.any help would be great.Thanks

I have the FSSO Collector Agent installed on the AD server, using local polling (no DC Agent).The Collector Agent service is running, and user logons are being fetched correctly.However, in FortiGate, the FSSO connectors status shows as "Down", yet some AD groups are still fetched (e.g 1 and 7 groups).Previously, when using local FSSO user group source, FortiGate fetched 65 groups, even while status showed disconnected.Now, using Collector Agent method, only 7 and 1 groups are fetched from two external connectors pointing to the same AD IP and the policies using User group type FSSO did not get affected on changing the FSSO source group from local to Collector agent.I’m confused about:How group fetching is working when the connection shows -Down.Whether it’s mandatory to create FortiGate User Groups and assign AD groups to them for policy use — or can we directly use AD groups in policy source?What causes this group fetching inconsistency and disconnection status, and how can I resolve

I'm new here, so I hope this is the appropriate place for this post. I wanted to share an issue we experienced this week that may help others using FortiGate firewalls.On Wednesday morning, we discovered that our classroom monitoring software—which allows teachers to view student Chromebook screens—had stopped functioning. I reported the issue to the vendor, and after some investigation, we found a pattern: all affected schools were FortiGate users.Upon reviewing our FortiGate security logs, we identified that the vendor's domain had been flagged as a proxy, and FortiGuard was blocking its SSL certificate. Interestingly, we also noticed that several Apple domains were being flagged as proxies as well, which may explain why our Apple devices have been stalling or having trouble connecting to the internet.After we added exceptions for the monitoring software domain in both the Web Filter and DNS Filter, everything began working properly again.While I’m not sure how or why FortiGuard upda

Hi, on a FortiGate VM, when trying to activate a VM permanent trial license with the command "execute vm-license",  I get the following error message: Forticare response error 57Failed to download VM license any suggestion on how to solve this?Thanks

I am having an issue with FortiClient (IPsec). Even if my internet connection drops for just a second, FortiClient disconnects. How can I fix this? I am using the free version of FortiClient, and I would like to know if there is a way to adjust this behavior, either on FortiGate or within the FortiClient settings. Is there a possibility to adjust this setting, for example, by modifying the configuration file after performing a backup?

Hello everyone, how do you handle Windows security center when using FortiClient EPP? Our users got windows notifications on every boot that FortiClient is not up do date (it seems to take quite a few minutes to update signatures) so I decided to disable windows security notifications overall and also hid the security center symbol on the taskbar... Anyone else found another solution for this?

Hi, Someone with experience updating FortiMail devices, If the release notes of a version provide the following Upgrade Path:   Is it feasible to upgrade directly from version 7.2.5 to version 7.4.3, even if the specific step through version 7.2.5 is not mentioned in that Upgrade Path? I believe it is, because version 7.2.5 is higher than the 7.2.2 version specified there. Could you confirm this for me to be 100% sure, please? Thank you very much! Best regards.