Fortinet Community

ok trying to have secure VPN connections for two different type of users.   We currently have a Fgate 60F V7.2.1; Windows AD environment; Fclient 7.2.5; EMS on Windows server   We can't use the SSL VPN.   I have two sets of users 1/ home PCs using the fclient free version; IPSEC VPN (IKE V1) then they RDP to their desktops; only RDP allowed in the firewall policy 2/ work supplied laptops using fclient with EMS; to have full normal access; currently using SSL however we have to move away from SSL.    Questions are A: is 1. a silly thing to do.  Should we just bite the bullet and buy bad laptops that are locked down to only allow the VPN and nothing else. Can we have a home PC connect securely, only allow them to RDP to their desktop; is this a massive security risk.   B: can I have two IPSEC dialups set up on the Fgate? Can anyone share a decent doc that actually explains what all the options do or even better says choose these ones.&nbs

Hi, Can anyone share the link where I can see the EOS / EOL products, right now I need the FortiAP EOS. Thanks

HiI am observing an issue as DNS entry stuck / not refreshed to default for local network adaptor while disconnects the FortiClient IPSec VPN. Following URL is found over the internetFortiClient DNS gets stuck : r/fortinet Resulting, if the user connects another network later, it connects but unable to surfing internet due to wrong DNS entries It is being observed with 10% users only with following firmware combination:FortiGate Firmware Version 7.4.5 build 2702 (Mature)FortiClient Firmware Version 6.0.9.0277 Regards,FAhmad 

I'm trying to use two SDWAN zones to browse different services, 1 sdwan - link 1, link 2, link3, link4 2 SDWAN - link5, link6 and link7. However, when I create the default static route for the 2nd sdwan, I start to have navigation problems in the rules that have the 1st sdwan set as the exit link, can you help?

Background on environment.Root vdom contains all the physical interfaces for traffic to the internet and vmware stack.  All traffic coming into or flowing out of the VDOMs has to route through Root.  Vdom-A and Vdom-B share IP schemes, so everything has to route through the Intervdom network 172.17.17.0/28.  Vdom-A has a VPN tunnel to another site.  The traffic to establish the VPN flowsInternet > Root Vdom > VIP in Root VDOM that translates the external traffic to 172.17.17.1 (the vdom-a side intervdom link between Root and Vdom-A) > Vdom-A picks up and establishes the VPN tunnel.In my initial test, the VPN establishes and traffic flows so I know I've got that part set up correctly.  However, Vdom-A will have a server with a "public IP" (let's call it 40.40.40.40 just for ease of conversation) that should be only accessible through the VPN.  I'm having some difficulty in establishing where the private IP (let's call it 10.10.10.40 for ease o

Dear Sirs, please help me with this problem that occurred today. I have 5 users who have not been able to log in to Forticlient on their Windows computers. The VPN reaches 40% and then returns to the credentials stage, without displaying an error message.The same test is performed on another computer within the community and outside the company domain and the user does connect, but doing so from those computers does not succeed.Windows updates have been checked, keeping them up to date, uninstalling the VPN and reinstalling it, connecting to different networks, re-entering passwords in Active Directory and the problem persists on those computers.The laptops are from different brands and are on Windows 11.When validating the logs in the firewall, it shows me user attempts N/A and in the action ssl-exit-error and in Reason N/A.

Hi, I'd like to configure our customer FortiGate running on OS version 7 to get users to our external landing page first, and after they have preformed a task, redirect them back to the local authentication page. How do I do that and is that possible?

How does fortisase spa works and how can we setup

I've come across a strange something I've never seen before in web categorisation. There is a link that Is currently getting blocked on of my FG's. Looking at the logs on the FAZ it was Categorised as Advertising but when looking on FortiGuard's web filter lookup It has the category of business. Creating a simple exemption would get me access to the link but was just wondering why there would be this difference. FG is running on 7.0 could it just be the OS version the FG is on? 

Hello, I'm working on a pre-configured Fortigate firewall and seeing too many logs under VPN Events, most of them SSL VPN alerts. I realized these logs are coming from other countries than the intended country. After looking for some solutions to minimize the logs, I came across this "limit access to specific hosts" option. I tried to add my country as the hosts, however, after applying the policy, it doesn't let anyone connect to the VPN. What I'm seeing under VPN logs when a user tries to connect is "Action: tunnel-up - Reason: login successfully", and a few minutes after I'm getting this "Action: tunnel-down - Reason: User requested termination of service". Additionally, on the client side, it app doesn't even ask for a token verification and just drops the connection.I hope someone can let me know the reason for this issue and what I should do next. Secondly, I tried to revert SSL VPN to the way it was and apply the restriction under firewall policies. This time, I was ab

Is it possible to sync the fortigate webfilter with the EMS

Hello,I had the one more unpleasant surprise after upgrading the FortiAnalyzer to 7.4.5: several datasets that worked perfectly in 7.0.x stopped working with strange syntax errors, not being valid anymore. Also other datasets which were ok before, now need SQL code adjustments because hcahe requirements are very strict. Also, apparently only temporary tables are permitted, which is a change that is impossible to understand for me, and I had quite a lot of datasets that prepared tables on disk which were used by subsequent reports refering such persistent tables. No more permitted, but why? This is an example of dataset which is no loger valid. The goal is to drill down into the DNS queries, listing the domains and query counts per each hour interval. DROP table if exists time_intervals;CREATE TEMP TABLE time_intervals ASSELECT generate_series(extract(epoch FROM (now() - interval '7 days'))::bigint,extract(epoch FROM now())::bigint,3600) AS interval_start;select cnt,from_itime

Looking at implementing the process below and we are having a hard time finding specific instructions. 1) Guest user attempts connection to SSID2) User is prompted for email address3) User enters email address4) Email address is sent to system 5) System sends a code to users email6) User is prompted for code7) User enters code to access wifi Any ideas?

Hello, i have an error with connecting to IPSEC vpn IKEV2 using Azure AD email whats happening is after i get the pop up to enter the credenials after i enter and get the 2FA popup it says VPN connection is down and when i check the logs i get this error: i tried turning off the firewall on the device im trying to connect from, i restarted the services, removed and redownloaded the vpn and still nothing is changing 

Hey, we have VXLAN between DC and DR sites. We can access through the same subnet, so we can ping or access to the GUI. On the different subnets we can't access to the DR site FW with the HTTPs,PING or something but we can access to the DC site FW GUI or can ping it.For example; We have 10.10.10.0/24 and 10.10.20.0/24 subnets. .1 is the VRIPs, .2 is the DC site FW, .3 is the DR site FW IPs. I can't access 10.10.20.3 from the 10.10.10.0/24 subnet but can access to the 10.10.20.2. When I try to ping and sniff from DR site FW it only gets icmp-requests but doesn't send reply packets. MTU sizes the same on both site. How could we solve that?

Hi everyone,I want to evaluate an internet availability connection from ISP for a period of time, but I have already checked in my FortiGate, I don't see where I can check the uptime of an uplink, it means since the system is up, how many hours the internet has been available, taking into account the time of interruptions and times out.I have only seen where I can see the system uptime, which shows the time my device has been up since it was turned on.

Hi, I'm getting an SSL certificate warning when using FortiClient VPN on 1 of my Linux machines but not on 2 other Linux machines. Why does this only happen on 1 machine and not on the others? I've tested this on 3 machines, and only 1 of them has this problem (openSUSE). Context: - There are no certificate warnings at all if we visit the SSL endpoint in the browser, or when we run 'sslscan' or 'testssl.sh' on the SSL endpoint: vpn.ourdomain.tld:10443All good here. - All 3 machines are running the same FortiClient version: 7.2.2 (build 7.2.2.0753) - libssl versions on the 3 machines:Debian: 3.0.11Fedora: 3.0.8openSUSE: 3.1.4 - All 3 machines are using the same DNS server, same DHCP, same internet connection. - The cryptographic policies are set to DEFAULT. - To make FortiClient usable at all on openSUSE, I temporarily(!) disabled AppArmor. That allows me to establish a successful VPN connection, although I see the certificate warning shown in the

Client laptop has a cert issued by Microsoft AD (via Intune) the Trusted CA has been imported to the FAC 6.6.0 as per this video:EAP-TLS Authentication with FortiAuthenticator | Identity and Access ManagementThe fortigate is set to use the FAC / WPA2 Enterprise as per the instructions, everything is configured as per the fortinet website, but nothing gets sent to the FAC (other traffic using SSL VPN is fine, so its not a connection issue) Running debugs and logs on both the FAC and the Gate, the EAP-TLS request is not even reaching the FAC,  Fortigate logs show:2024-11-06 15:09:28 05768.944 70:32:17:11:01:7a <eh> IEEE 802.1X (EAPOL 14B) ==> 70:32:17:11:01:7a ws (0-10.16.152.100:5246) rId 0 wId 1 38:c0:ea:a0:d0:81 2024-11-06 15:09:28 05768.974 70:32:17:11:01:7a <eh> IEEE 802.1X (EAPOL 5B) <== 70:32:17:11:01:7a ws (0-10.16.152.100:5246) rId 0 wId 1 38:c0:ea:a0:d0:81 2024-11-06 15:09:28 05768.974 70:32:17:11:01:7a <eh> recv IEEE 802.1X ver=1 type=1 (

I'm facing issue while using 2fa fac agent for wins loginthe fac agent login portal itself is not getting trigger and getting bypass with admin login

How to add existing Azure Virtual networks to the firewall? I about ten vnets and i want to add into the firewall, but I am not seeing how to do this.   

Hi,We have noticed that our domain, highstreetpharma.org, is blacklisted by fortinet as reported on securityscan.getastra.com. After conducting a thorough review of our files and database, we did not find any malicious content on our website.

Hi,on CLI console I want check interfaces configuration without success.admin@fortinac:~> show system interface-bash: show: command not foundadmin@fortinac:~> execute show system interface-bash: execute: command not foundI try also with root user without success.With command get the result is the same.Fortinac appliance is a virtual machine.Could you help me?  Thanks  

We have Fortinet firewall 200FCan we increase socket connection timeout for specific clients OR for specific firewall rule ?

Hello everyone,I recently discovered that the FortiAuthenticator supports a proxy authentication mode for remote RADIUS servers:FortiAuthenticator DocumentationHowever, the FortiGate does not seem to offer a similar option:FortiGate 7.4.5 Documentation (our current version)FortiGate 7.6.1 Documentation (latest version)If you want to set up remote Dial-Up IPsec VPN tunnels using EAP-TLS authentication via Microsoft NPS (RADIUS), it seems you would need to purchase a FortiAuthenticator solely to forward the requests to the remote RADIUS server.Will FortiGate ever introduce a proxy mode for authentication via remote RADIUS servers?

Hi Team, I have output as DestIP = ['1.1.1.','1.1.1.2'] and I want to update this in a text file of server which i have integrated using SSH connector, while trying to update it is getting updated as it is ['1.1.1.','1.1.1.2'] but I want to update these mutiple IPs in text file of server in a vertical format without any brackets and commas. For example, refer below: Is there any utility to change the format like this ?  1.1.1.11.1.1.2 Regards,Shashank