Fortinet Community

Hi , i have Question about Using Multiple IKEV2 Dial-up VPN with PeerID is that possible ? i note in the FortiGate_7.6_Administrator_Study_Guide-Online page 363 saying:“When you configure multiple dial-up IPsec VPNs, IKEv2 makes it simpler to match the intended gateway bypeer ID. With IKEv2, you can either use the standard peer ID attribute or the Fortinet proprietary network IDattribute to indicate the phase 1 gateway to match on the dial-up server, regardless of the authentication modein use.”while the technical tips i saw saying you can only use network id   

Hello,We're currently migrating users from EMS to FortiSASE and have run into an issue with pre-logon VPN connectivity.The customer requires a pre-logon tunnel using machine certificate authentication (PKI), allowing the endpoint to connect before the user signs in.What we observe:The endpoint initiates the pre-logon connection. FortiSASE indicates that the connection is successfully established. Shortly afterwards, the session is terminated. The FortiClient on the endpoint never shows the pre-logon tunnel as connected.We have tested multiple certificate configurations, including certificate chains with and without an intermediate CA, but the results are identical.A Fortinet PS engineer is involved and a support case has already been opened, but so far we have not found the root cause.Has anyone experienced this before or successfully deployed pre-logon PKI-based tunnels with FortiSASE?

Fortigate firewall didn’t connect by remote users when using remote ipsec vpn 7.6.6 OS. But client getting all other services after created policy remote user interface to wan. Please help me if any other solution for it. I follow the below link remote access vpn for AD users through LDAP server  

FortiClient VPN is failing to connect and gives "Timed out" when trying to connect. Connecting via mobile hotspot works fine which rules out config issue. On the Smart Hub I have disabled IPv6 and confirmed the LAN range does NOT clash with the target VPN site. "Port Clamping" is set to on. The VPN is using IKEv2 IPSec. 

Hi everyone,we using a Fortigate G900 with v7.6.7 as explicit proxy.Since a couple of weeks, we have the problem that, when using Firefox, we can’t use the Google Search.After we type anything in the search bar, we get the following error:502 unknown content-encodingThe webserver reported that an error occurred while trying to access the website. Please return to the previous page.URL     https://www.google.com/search?client=firefox-b-d&q=fortigate Other Websites / Search-Engines with Firefox are working fine. With Edge or Chrome Browser Google works as well.Have somebody an idea? Regards, Michel

I integrated my Cisco C1300 to NAC and all is working fine except for CoA. When i manually execute send CoA then in the switch i got message ‘13-Oct-2026 13:37:21 %RADIUS-I-CoAREJECT: CoA Request from 10.10.10.9 rejected. Reason: Missing NAS identification attribute’I try add NAS-Identifier in Radius Attribut with value %AUTH%, %ACCESS_VALUE”, %SYSTEM% and %ACCT% with no success. Anyone know why?Same radius attribute is working fine for Cisco Catalyst switch even in the radius attribute no NAS-Identifier. 

itle: FortiGate 100F – EMAC-VLAN across multiple VDOMs with a routed /28 subnet over /30Hello Fortinet Community, We are testing a FortiGate 100F running FortiOS 7.6.6 with two VDOMs (root and Production), using EMAC-VLAN interfaces. Our configuration: - Physical "wan1" interface belongs to the root VDOM.- "wan1" has an IP address in the ISP's "/30" transit network.- Two EMAC-VLAN interfaces ("outside_Root" and "outside_Prod") share "wan1" as their parent interface.- Each EMAC-VLAN belongs to a separate VDOM and has its own public IP address from the same "/28" subnet.- Both VDOMs have independent IPsec VPN tunnels. What works: We have successfully tested EMAC-VLAN when the upstream router or Layer 3 switch has an IP address in the same public subnet as the EMAC-VLAN interfaces. In this setup, the router can resolve each EMAC-VLAN interface's unique MAC address using ARP, and traffic reaches the correct VDOM. Our problem: Our ISP provides two separate IPv4 networks: - A "/30" transit n

WAN1 STOPPED WORKING- I have two FortiGate 60F setups as stack (HA1 and HA2)- I have Juniper router - I have a Rogers modem with 2 public IP 187.x.x.x/30 and 184.x.x.x/30- link 1: Rogers modem port1 > FG60F WAN1- link 2: Rogers modem port2 > Juniper router- I also have a 2nd ISP (TELUS) for failover- WAN1 link shows Green UP in the GUI; WAN1 led light is blinking green/yellowProblem: WAN1 is not pulling the public ip whether in static or DHCPTS:- reboot the modem, connect my laptop with correct IP details used in FG60F (SM, GW and IP) = WORKING- leave Juniper plugged in = WORKING- turned off the modem for 10mins, removed the laptop, reconnected the FG60F = FAILED- Juniper still working- Replaced modem, reprovisioned and performed laptop testing again and still working. - Tried disconnecting Juniper from Rogers modem and leave only FG60F connected = FAILED- Internet works because of WAN2 (TELUS)Question:1. Why WAN1 not pulling the public IP? why there is no internet from WAN1? 2.

Hello Everyone, I would like to test my knowledge in NSE 4 - 7 via the use of past exam papers. Is there a repository I can connect to? 

Currently we have a Microsoft Server 2016 server as our radius server.We intent to upgrade to Server 2025.is there anything for us to take note when we upgrade to Server 2025 ?

Am final year in college I already have CCNA.My next goal is Security fundamental for Network Security, What about NSE4 and Sec+?, What i should focus on and worth for Entry level in Network security ? 

I’m on a FortiGate 61F version 7.4.11 and FortiClient Windows version 7.4.3.I am trying to set up IPSec VPN for my remote users so that I can upgrade the FortiGate (knowing that SSL is no longer supported).  I’m running into trouble with Authentication when it comes to PSK vs Peer ID from dialup group.  What I want is for the tunnel to accept users from a specific local user group on the FortiGate.  My problem is that if I change the Peer Options to Peer ID from dialup group, the Pre-shared Key box goes away.  That’s then a problem on FortiClient since I can't leave the PSK box blank.  Any help on how to solve this?  Thank you! Side Note: I have an IPSec VPN for remote users set up on a different box running 7.6.6 doing exactly what I want.  There are more options for Authentication on that version and I can have a PSK and the tell it to use user group I want.

Hello, the content on the fortigate management interface doesn't load because fortinet's cdn certificate seems to have expired.For example the browser doesn't load the content at https://fos-cdn.fortinet.com/artifacts/fos/7.2.10/b1706/3655.js, if I try to open the url directly in the browser I see  that the domain SSL expired one Oct 30thAnd the cert Is indeed expired

Where we can find supported device by FortiNAC?

I have a fortigate 70G (v7.4.12 build2902) setup as the wireless controller of a mesh network. A fortiap 421E (FP421E-v6.4-build0492) is the root, and then the two leaf ap's are another 421E (v6.4.0 build0492) and a 221E (v7.4.4 build0644). When I first configured this several months ago, everything worked great. Then recently my daughter started mentioning that the internet seemed slow.I looked into it and although I hadn't changed anything, the leaf ap's were no longer connected to the mesh network, so all traffic was routing through the root ap.Through some reboots I was able to get the entire mesh up again. However, no clients will connect to either of the leaf ap's.This configuration was previously working with no changes made and then stopped working. What should I do?I don't believe any of the ap's auto updated nor did the FG. None of the devices are registered for support, but that has been true for quite a while, definitely while the mesh was up and working.Any help and advice

How to fix analytic and archive( actual days)if i set the fortiananlyzer system time after 2 weeks from the time the logs sent to fortianalyzer

How can we prevent a single workstation from causing an organization-wide DNS outage through FortiGate IPS quarantine?We recently experienced an incident where FortiGate IPS detected DNS.Pointer.Loop traffic originating from workstation. The automated quarantine action affected both of our DNS/Domain Controller servers, resulting in a DNS connectivity outage across the organization.We manually unbanned the servers, which restored services, and traced the related DNS activity back to the originating workstation.Our concern is that a single endpoint, whether due to malware, misconfiguration, or a user changing network settings, could trigger an automated security response that impacts critical infrastructure.What would be the recommended FortiGate configuration or best practice to prevent this from happening again?

Hi,i had an working PPPoE IPv6 internet connection but now i noticed that this isn’t working. I don’t getting an IP address.I can’t say sice when and after what change this happen, perhaps it can also be an probem on the providers side.This is the WAN Interface config:config system interface edit "FTTH" set vdom "root" set mode pppoe set allowaccess ping set type redundant set member "port15" set lldp-reception disable set estimated-upstream-bandwidth 1000000 set estimated-downstream-bandwidth 1000000 set monitor-bandwidth enable set role wan set snmp-index 22 config ipv6 set ip6-mode pppoe set ip6-allowaccess ping set dhcp6-prefix-delegation enable set autoconf enable config dhcp6-iapd-list edit 53 set prefix-hint xxxx:xxxx:0:200::/56 next end end set username user

Hello,i have a FortiSwitch running at 7.2.9. There we have a trunk with no name.We want to delete this trunk.Because the name is the reference for every command, we don’t have any possibility.config switch trunk       edit ""        set mode lacp-active        set auto-isl 1        set members "port24"    nextIs there another way to delete this trunk?Thanks

Hello, I apologize in advance if this sounds like a stupid question. I passed the NSE4 Certification Exam on June 18, 2024. I very recently heard that my certification would run out of validity if it’s 2 years old. I have to take the NSE5 Certification Exam, as I was unable to take it before, but I am unsure if my NSE4 Certification is still valid. Please let me know and thanks for your help!

Hey, currently learning for my certification and got really stuck on this question: So why would Change Inspection mode to Flow-Based - as the Training Portal says - be the right answer here? As i understood from the Study Guide the Application Control relys on the IPS Engine and will always work in Flow-based even if the Firewall Policy has Proxy-based Inspection configured. So it should not matter which Inspection-Mode is configured from my understanding. As the phrase from the study guide says:  Also, i tried to reproduce it on my lab. Looked for some Google Application which falls under Excessive Bandwith, in this scenario I choosed Google.Maps. Put this object into Application and Filter Overrides with Prio 2 and Action Monitor and above the Excessive-Bandwith Filter with Prio 1 and Action Block. Google Maps got blocked. When moving Google-Maps to Prio 1 the connection worked. So is this maybe wrong in the Training Portal? Or where am I thinking wrong? Rea

How to configure an event handlers that alert when config change happened after working hours in fortianalyzer 7.6.7

Hi,I have a SonicWall NSA (site A) connected to Fortigate (site B) with IPSec Tunnel. Site A sends ping probes over the tunnel interface to site B's WAN IP. The Sonicwall configures implicit probes when configurating the IPSec tunnels in virtual SD-WAN configuration. Debug flow revealed "reverse path check fail, drop" due to strict RPF, so I configured a DNAT policy with Virtual IP as below. This got me passed the RPF check but when enabling below policy the CLI command does not responds normally for some reasons so I must be doing something wrong. Any suggestions? config firewall vipedit "vpn-hub-probe-vip"set uuid 3e958d92-4f6b-51f0-67e8-xxxset extip 217.91.x.x                         (local WAN Interface IP)set mappedip "192.168.10.1"           (LAN interface IP)set extintf "any"nextend Firewall Policyedit 24set status disableset name "TEST"set uuid 20025a9c-4f6e-51f0-1a3d-x

Hello everyone,We are experiencing a minor but frustrating issue with our FortiAuthenticator, and I would appreciate some guidance.Our FortiAuthenticator is configured to synchronize users from Active Directory (AD/LDAP). Under Synchronization Attributes, we have selected Local User for the Sync as option.As a result, whenever a new user is created in AD and synchronized with FortiAuthenticator, the system automatically generates a unique random password and sends it to the user via email.Our goal is to disable this automatic password notification email without affecting the existing AD synchronization or user authentication process.I have searched through the documentation and configuration settings but haven't found a way to disable this specific email notification.The only workaround I have identified so far is modifying the following Replacement Message:Admin Set Random Password for User Email MessageHowever, this would only change the email content rather than prevent the email fr

Hi everyone,Is anyone managing FortiExtender devices through FortiGate?I currently have a FortiExtender managed by a FortiGate, and I'm trying to monitor it using Zabbix via SNMP, with the FortiGate acting as the monitoring point.Has anyone successfully implemented this setup? Is it possible to retrieve FortiExtender metrics through the FortiGate using SNMP?Any advice or experience would be greatly appreciated!Thanks in advance!