Fortinet Community

Hi everyone,I'm just starting my journey with Fortinet and studying for the NSE4, so I'm still learning how some concepts differ from Cisco.I have a quick question:Is there a way to configure a physical interface as an access port, similar to Cisco switches using switchport mode access and switchport access vlan <VLAN_ID>?For example, can a FortiGate interface be configured to carry only a single untagged VLAN without using a trunk or VLAN subinterfaces? Or is the recommended approach always to use 802.1Q VLAN interfaces on top of a physical interface?I'd really appreciate any explanation or best practices. Thanks in advance!

Hello,If we need to deploy a cluster of two FortiGate firewalls as VMs without using the virtual MAC (vMAC), and instead use the hypervisor-assigned MAC address of each firewall interface, I would like to confirm whether this type of cluster configuration is supported.In other words, is it possible to operate a FortiGate HA cluster without using the vMAC mechanism and have each firewall use its own physical/virtual interface MAC address during a failover event?Thank you for your clarification.

Hi,I would like to just ask around (not going to open an official case with fortinet just now) if any of you have noticed something similar recently.I have a very low but increasing number of users that start up their laptops in the morning and the Forticlient ZTNA has lost it's license resp. the affiliation to the EMS cloud. No config left, not connected.The respective laptops do not show up in EMS any longer. When I enter a new invitation code in the Forticlient incl. User verification, it connects again and receives config and all is good.I can rule out that the user hit the "disconnect" button on the ems connection because that is password protected.The only thing common, that I think I identified, is that all affected users don't connect to the vpn daily.

Product: FortiGate-101FFortiOS Version: 7.6.6, build 3652HA Mode: Active-Active (A-A), ha-direct enabledCluster Members:  Primary / SecondaryCluster Status: Healthy, in-sync, uptime 86+ daysSyslog traffic configured under config log syslogd setting is not reaching our syslog collector (10.0.0.151:514/UDP), despite the syslog daemon reporting successful log processing. No syslog packets are observed on any interface via packet sniffer, even though routing to the destination is confirmed correct and other traffic to the same host (ICMP, TCP/5986) is confirmed working.config log syslogd setting    set status enable    set server "10.0.0.151"    set mode udp    set port 514    set facility local7    set format default    set priority default    set interface-select-method auto    set vrf-select 0endconfig router static    edit 2        set dst 10.0.0.0 255.255.255.0        set gateway 10.37.81.2        set device "port4"    next    edit 3        set dst 10.0.0.151 255.255.255.255        se

I have 2 FortiGate 100F firewall setup in HA A-P and dedicated HA-MGMT interface is configured with dedicated OoB interface, I have a internal webproxy server in Layer 2 VLAN with DNS and FGT is also in the same VLAN and is pinging Proxy and I want to setup those firewall to use that proxy server to connect to fortiguard, I am trying to setup but it is not working through OoB interface. Appreciate support here.

I couldn’t find much information on enabling the all events portion of FortiClient EMS (I’m running 7.4.7). After a couple of weeks playing with it I finally got it working.  But just a quick overview I wanted to post in case others have tried and failed at setting this up. So what you need to do is setup a Linux VM (I used Debian 13 Trixie) and install ElasticSearch. Then you have to make sure its reachable on the network by modifying the YML file.  Then install Kibana and do the same for it. Kibana is the GUI management tool that makes working with ElasticSearch easier. Then you create an API Key for FortiEMS. Then you upload the http_ca.crt to FortiEMS. Then you run the emscli command for enabling ElasticSearch. That is pretty much the overall process. 

I am setting up 802.1x with clearpass and most of my switch are running 7.6.1 or lower and are working fine. I upgraded 2 switches this morning to 7.6.6 and now they absolutely refuse to work if I have the 802.1x security policy on the ports. Worked fine on 7.6.1. Not even DHCP is getting passed to the native vlan.I've spend the majority of my day trying to find a way to work around this today and am at the end of my chain.I can't even roll back to 7.6.1 because I don't have switch support to download.I ran a sniffer on the fortigate and the switch doesn't send a single RADIUS packet when a port comes up.Anyone have any suggestions?

now i have situation i want to register ip phones in my company manually and if there is no registered ip phone  as rogue i mean so i need to block its traffic but doesn’t block data traffic behind it how to achieve this using fortinac?

Dear Experts,I’m working with FortiWeb, which deployed 6-8 months ago and security policy in monitor mode. Now, customer decided to change security policy to Blocking Mode from Monitor mode.I have checked for Fortinet official document, but didn’t see any recommendation or workaround for such transition from Monitor mode to Blocking mode. Appreciate, if experts can advise on this.  Regards, Faridul

Based on below article, can i know if every group in fnac inventory should have L3 device for L3 polling? 

A FortiMail client, who uses the free tier of FortiSandbox SaaS, was informed about new vulnerabilities and intends to identify the version of FortiSandbox in use in order to assess whether there is any risk of exposure.

Hello everyone,I am running into an issue regarding a duplicate device in EMS , and I am unable to delete the stale record because of the Azure AD sync lock.Environment: FortiClient Version: 7.2.12 OS: Windows 11 Enterprise EMS Integration: Synced with Azure AD (Entra ID) The Current Issue: Telemetry is Connected: The clean reinstall fixed the WMI conflict. Forticlient Telemetry now successfully connects to EMS. Duplicate Device in EMS: Because of the clean reinstall, the endpoint generated a new UID. EMS now shows two records for the exact same Hostname/MAC Address. One is Offline (old UID) and one is Online (new UID). Cannot Delete the Stale Record , but the license was used twice on the same device My Questions:What is the best practice to remove or merge this stale duplicate device in EMS?Any insights or workarounds would be greatly appreciated. Thank you!

I want to test latest Fortigate VM image on Virtualbox. but I get error “Failed to start !”. Is there some way to start the VM locally?

It appears that if a person purchases a used Fortigate product, that they are unable to download firmware without paying for “support”.Is this the way it is?  Or am I missing something?

How to Protect Fortigate from IPv6 Security Risks

Hi everyone,I'm currently testing the FortiNAC Persistent Agent in my lab environment. The agent is unable to establish a connection to the FortiNAC server. Below are the troubleshooting steps that I have already completed.Troubleshooting performedConfigured DNS and verified that the client can successfully resolve the FortiNAC FQDN. Modified the Windows registry on the client so that ServerIP, LastConnectedServer, and HomeServer all point to the FortiNAC FQDN (fnac.vss.com). Downloaded and installed the Persistent Agent certificate from FortiNAC on the client. Verified network connectivity: Client can successfully ping the FortiNAC server. FortiNAC can successfully ping the client. Verified that FortiNAC is listening on TCP port 4568. Tested TCP connectivity to port 4568 from the client. Captured traffic on FortiNAC using tcpdump.During the packet capture, I observed that the client sends TCP SYN packets to fnac.vss.com:4568, however FortiNAC never replies with a SYN-ACK, causing th

Hello traveler, I'm assuming you've stumbled upon this post after using very specific search terms and are perhaps now at the end of your rope. I hope I can maybe be your last stop. There's a lot that's going to depend on your own setup, such as which cipher suites you're using, your local and remote subnets, etc. I'm not posting this as a definitive guide to get your swanctl.conf perfect - I'm assuming you've already got it to a place where it "should be working". My goal is instead to draw attention to the changes that took my tunnel creation getting totally dropped and ignored by the FortiGate after first contact, to it actually trying to authenticate. It was of course, very simple, but took me hours upon hours to finally get right. The lynchpin was this: Set Remote auth to PSK. Set Local auth to EAP. Make sure Local is set to round 2, otherwise it sends your EAP credentials before it's asked and the Fortigate shrugs it off. Note that on my FortiGate side, I'm no

We’ve had several cases of memory exhaustion with different processes (node, wad, ips), and are using the “set failover-memory enable” setting to cause the Clusters to automatically fail-over when going into conserve mode. (as well as cpu-threshold)While this is fine as it no longer causes prolonged service disruptions, it does leave the clusters in a degraded state: the failed node usually does not recovery by itself and needs to be rebooted in order to recover from the cause of the memory consumption and restore the cluster redundancy.Is there a simple way (e.g. with automation stitches targeting only the currently active or passive node) to automatically trigger a reboot on the now passive node after such a failover event?Or do we need a feature request to allow automatic reboot of the failed node after a failover that was triggered by an internal event (memory, processes, RIB/FIB, cpu)? We probably don’t want to auto-reboot after an external event (link failure/ping-probe fail).

Hi everyone,I have installed the following FortiGate VM image in EVE-NG:Image: FFW_VM64_KVM-v8.0.0.F-build0167-FORTINET.out.kvmAfter booting the VM, I don't see any option to add or upload an Evolution License during the initial setup.When I click Cancel on the Add License screen, it immediately returns me to the device login window, and I'm unable to proceed any further.Has anyone experienced this issue before?Could you please help me with the following questions:Is this VM image compatible with an Evolution License? How can I upload or activate the Evolution License on this image? Is there any additional configuration required for EVE-NG or the VM before licensing?I have attached a screenshot of the issue for reference.Any suggestions or guidance would be greatly appreciated. 

Is anyone else seeing a large amount of “Domain was blocked by DNS botnet C&C” alerts for valid URLS?the commonality is that its akamai and the common 5 IP addresses are the following.23.223.209.3223.33.44.22823.44.201.23423.57.90.6823.33.40.7 

Hi all, This is my first post on these forums, so hello to everybody :) I'm going to start by asking a question i don't expect many people to be able to answer but i hope somebody who is familiar with BGP and ADVPN can crack this one.  I have labbed up the below scenario and its working great.  Hub/spoke topology with direct spoke to spoke connectivity on demand. http://cookbook.fortinet.com/configuring-advpn-in-fortios-5-4-dynamic-hub-and-spoke-vpns/ I have got abit more adventurous and added a secondary WAN connection to each firewall and added a second round of ADVPN config/VPN's to establish tunnels over the new WAN connection in a bid to achieve ADVPN redundancy should the primary VPN's fail. The interesting bit is that it does work (kind of) - If i shut the VPN's down on the hub it works, both spokes will speak to the hub via the second VPN tunnel and agree new spoke to spoke connectivity over the secondary connection.  However it does not

I am using console server to connect to all my network gears such as Aruba, Cisco, FortiAll Aruba can use micro usb console  and some usb-cAll new Cisco can use mini usb console and some usb-cFew Forti can use mini usb console SerialtoUSB converter already $8 (not including console cable)Good one generic micro usb cable only $2. 4x cheaper SUGGESTIONS:1. could you make all new Forti has microusb or usbc console tq  

Hi!I have to renew or replace a Fortigate 400F cluster, that is working as ISFW.Looking at the specs, the 200G seems to outperform the 400F while being cheaper (more RAM, higher NGFW-throughput.Did I miss anything, or would you prefer to take a pair of 200Gs?Best wishes 

Hello Team I have configured ADVPN 2.0 between two 120G, BGP is up, i can ping both tunnels, but the issues are that i can ping the Hub loopback from the Spoke but unable the Hub loopback from the Spoke   

The port switch connected to the ipphone and if i plug endpoint to the port of the ipphone then the port switch is shutdown even there are no port security in the port switch. Anyone know why?I can see the log from the switch Jul 20 14:30:13: %AUTHMGR-5-SECURITY_VIOLATION: Security violation on the interface GigabitEthernet2/0/1, new MAC address (f4a8.0d3d.5aeb) is seen.AuditSessionID  11C8640A000038317E6EAFB7  switchport access vlan 251 switchport mode access authentication host-mode multi-domain authentication order mab dot1x authentication priority dot1x mab authentication port-control auto authentication periodic authentication timer reauthenticate 180 mab snmp trap mac-notification change added snmp trap mac-notification change removed dot1x pae authenticator dot1x timeout quiet-period 10 dot1x timeout server-timeout 30 dot1x timeout tx-period 10 spanning-tree portfast