Fortinet Community

I have a TP Link travel router with a (crappy) VPN client built in. I'm trying to connect to my FGT 80 via IPSec. (all my other VPNs work fine) It looks like Phase 1 completes, but I cannot find any indication or idea why it doesn't complete Phase 2. I am currently using a guest subnet to connect. My log is here: PasteBin  

When I used the FortiConverter to convert my ASA config into FortiGate, I really didn't care about the Phase2 VPN names. Now the migration to the FortiGate is done and I find that I would like to rename the Phase2 interfaces.  Is this possible after the fact?  I know it's not possible in the GUI, but thought it might be via CLI however I wasn't able to figure it out just poking at the CLI.

Hello everyone,I’m currently experiencing some issues with our Site-to-Site VPN (fortiOS 7.0.12) that was previously functioning without any problems. It seems that the NAT IP pool is not properly translating the source address, which is causing issues during the Phase 2 negotiation.As a result, the remote site is unable to establish a proper connection to exit the tunnel. I suspect that this misconfiguration might be affecting the traffic routing and connectivity.If anyone has encountered a similar issue or has suggestions on how to troubleshoot this, I would greatly appreciate your input!_______CONFIG SNIPPET_________edit "H_IPSEC_192.168.110.11"set uuid xxxxxxxxxxset subnet 192.168.110.12 255.255.255.255nextedit "IPSEC-192.168.110.12"set phase1name "VPN-IPSEC"set proposal aes256-md5set dhgrp 5set keylifeseconds 3600set src-subnet 10.0.11.6 255.255.255.255set dst-subnet 192.168.110.12 255.255.255.255nextconfig firewall ippooledit "IP-POOL-NAT"set startip 10.0.11.0set endip 10.0.11.25

We have been running an FG201 HA pair for 2 years, system has been very stable, just upgraded to 7.0.16.We need some of the 7.2 features to support some MSP security stuff, It looks like 7.2.10 is latest.I have done one major (6.4.x to 7.0.x) upgrade and a couple of minor ones so not exactly experienced.Is there anything to watch out for or any words of wisdom ?TIA

Good day, I am trying to migrate my SSL full tunnel VPN from using an Address IP List (10.0.3.0/21) to issue IPs to VPN users to using an external Microsoft DHCP server, I need to do this as the FortiGate can’t add DNS records for VPN users as it does not support this. I have set up a new scope on the Microsoft DHCP server 10.0.16.0/21 as shown in the screenshot, my local subnet is 10.0.0.0/21, I can’t use the existing Subnet as it conflicts with the DHCP server. The issue I am facing is that when I connect to the SSL VPN once I have migrated, I am unable to access any devices on the 10.0.0.0/21 subnet, I updated the Firewall policies to the new Subnet and updated the VPN settings following the Fortigate guide here https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-with-external-DHCP-Server/ta-p/215644. I noticed that when connected to the SSL VPN the client gets two IP’s for example in the screenshot on my test device I got 10.0.16.5 as my IP and 10.0.16.

I know fortiedr is from the ensilo acquisition. Anyone have any recent experiences with FortiEDR ? and maybe some opinions on how it compares to other ones in the market ? We have fortigate routers and switches, but not sure we definitely need to have that "single panel" convenience, though it sounds nice. Obviously nothing catches everything, and we would prefer better lateral spread prevention, than protection of said endpoint (as in we could sacrifice a known corrupted endpoint, which maybe the fortisandbox might help with as well). that and we would only allow VPN connections if the client was running forticlient with protection, rather than letting any endpoint connect. It might be difficult to determine on login, whether the endpoint had EDR running outside of the fortinet security fabric mechanisms..So we are considering Windows Defender ATP (endpoint), s1, fortiedr right now. There just isnt much information on fortiedr out there. S1 kind of requires MSP, and we're looking to k

Does anybody know if there is a way to move a computer to a new group through a script after FortiEDR is installed? We have a main image for deployment that we want to include the collector in and then move it to the group once the OU is determined. We also have a ton of existing installations that we would like to organize into groups the same way.

I have replaced the FortiAP 221c from Fortigate 100F to fortigate 80E. I was connected on 100F but when i connect the same AP to 80E it is showing as discovery AC and stuck in connecting mode. I am able to connect reach the device and able to https also but not able to connect to fortigate 80E at new location. 

Hi, I have been having some major difficulties with EAP-TLS Certificate Auth, I originally posted here, as I thought the FAC was set up incorrectly, but having speaking to TAC, its set up correctly it seems, the issue appears to be between client and the AP, it doesnt get any further,.The laptop has a client cert, issues by MSOFT AD, I have the Root CA on the FAC, The client has been set up to connect via EAP-TLS on the SSID , The APs broadcast the SSID and its set to WPA2 Enterprise and pointing to my FAC, the packet capture shows nothing hitting the AP, the client can see the SSID, and when you click connect on the laptop it says "waiting to authenticate" the WIFI Event on the Gate shows:auth-req - AP recieved authentication request frame from client xx.xx.xx.xx.xx.xxauth-resp - AP sent authentication response frame to client xx.xx.xx.xx.xx.xxreassoc-req - AP received reassociation request frame from client xx.xx.xx.xx.xx.xxreassoc-resp - AP sent reassociation response frame to clien

I wanted to reach out an get some opinions. I am relatively new to EDR and I am wondering if there is ever a safe use of "any script" in an exception?

Following constellation: FortiGate with FOS 7.2.10FortiClient 7.2.5 on windows. IPsec tunnel witb psk and xauth against ldap usergroup on Authenticator and mode config. Behavior:- Tunnel connects- does psk auth and proposals- does mode config - gets ip and everything- initates xauth- fgt send xauth request to client Log on FGT reports "Client has not completet xauth challenge" even before the forticlient prompts me for 2nd factor.Looks like FGT sends the xauth request but does not wait for an answer from client. Do you have any suggestions?

Is the Fortigate 30G a direct replacement of the 40F? I recommend the 40F to my small customers, 10-15 devices with an internet bandwidth below 500mbps.  Is the Fortigate 30G a good product for this size of customers? Thanks!

HelloI'm looking for to update/upgrade in our company the FortiClient VPN from 7.0.1 to 7.4.0. I've searched for the parameter but I could found it. Does anyone know if this is possible or not to update/upgrade the client instead of uninstall the old one and install the new client SW? #Produkt-Downloads | Fortinet-Produkt-Downloads | Support Thanks and regards,Daniel

Hi all, i have stubborn customer insisting on Rustdesk as a support tool for desktop support.Advising him of migration to Anydesk or something similar didnt helped.So, question:FG80f configured to allow necessary ports (21114-21119) are configured, nothing is blocked:  On link below is instruction about similar issue, configured for that particular policy without help:ArticleID 274423  All security profiles are disabled, pure NAT internet access without restrictions.So, i can confirm that Rustdesk is not blocked, on diagnose flow also didnt saw anything unusual, but tbh what should i diagnose.Did somebody else had similar issue with Rustdesk? ty,Drazen 

Hi,I've just conducted a HA cluster firmware upgrade via FortiManager. During the upgrade, my VPN to the HA cluster was disconnected for 5 minutes. Was this expected behaviour during uninterrupted cluster upgrade? I would expect an uninterrupted upgrade would cause a brief disruption to existing traffic.FortiOS document mentioned that there might be configuration pending unit reboot which will force both device rebooted at the same time during upgrade. Is there a command that I can check any pending configuration change prior to the firmware upgrade on the units? Thanks,

I use the free forticlient vpn on android phone and saml/sso authentication with azure user works fine.However if the user has MFA, and after I enter the user's MFA code on the screen, the connection drops. Seems to be an issue with the mobile android client ?If I enter the code on a Separate device, the connection succeeds. I have tried to set the app to "always on top" but issue persists. 

Hi, I have setup a VPN site to site with a fortigate 40F and a fortiwifi 40C (FortiOS 5.2). The main problem is I have 2 laptops.The first one all the traffic is going to the tunnel but the second one, the traffic is sent to WAN1.The 2 laptops are in the same segment (192.168.11.20x)I don't understand what is happening. The policy is correct from Wifi to tunel (Source: All Destination: All)I have created the static route 0.0.0.0/0 to the tunnel.I have remarked also I have to set the priority tunnel with the same number as the WAN1 interface. If not the VPN is not going up.  

Hi, I have a small problem. I have new switch FortiSwitch 148F as standalone mode.Now i have D-LINK 1510-52 switch and have problem with move my existing configuration to FortiSwitch. Describy my infrastructure:I have room with ISP Router connected to my port (17) in D-LINK. On D-LINK i have setup on this port VLAN 10 Untaged, VLAN 10 Native. Vlan is in Hybrid Mode.On Port 48 on the same switch is connect to second switch (FortiSwitch 148F) in the next room. In the next Switch is my Firewall connect to port 47. Port 48 on DLINK is market as tagged vlan 10 and native vlan 1.On Second FortiSwitch to which is connected Firewall is set Native VLAN 10 and Allewd VLAN 10. This configuration work correct. Now i plan replace old D-LINK switch on FOrtiSwitch 148F. I moved all configuration but i have problem with correct setup port 17 from D-link to port 47 on new FortiSwitch.FortiSwitch not allow traffic from my ISP router.How can i setup this configuration for po

Hi all, apologies if this is not the correct board.It is almost three weeks that one of our accounts does not receive the email with the token. The issue at the start was for both our account, now only one seems to have the problem.Difference is that this one is IAM login. Anyone is having the same issue? Thanks,Riccardo.

We have a number of MacOS clients using the latest FortiClient version (7.2.4.0850)When a user attempts to connect to the configured VPN, we see the SAML popup in the browser and the client tries to connect, connects and seemingly hangs up immediately. If I look at the web UI admin interface, I can see the incoming connection* action: tunnel-up, reason: login successfully* action: ssl-alert, reason: warning                  <---- (usually, I get several of these)* action: tunnel-down, reason: User requested termination of service This generally takes 3-4 seconds to completeCan anyone guide me in debugging this further? Thanks in advance

Is it Possible to use different vendor's vpn client to connect to Fortigate ipsec vpns?

I am running Forticlient 7.4.0.1636 under Ubuntu 22.04 to connect my company's VPN.My problem: In the settings menu, if I unlock it , change some settings below, and then connect to VPN, my changes are not saved, and they return back to original values as below:  I want to change these settings because :1) Logging causes constant pressure on the disk I/O2) I have to click multiple popups to accept invalid server certificate and unnecessary confirmation dialogs everytime I connect.See below for screenshots: How can I modify the settings so that I can reduce number of steps when connecting to VPN ?

I'm in the lookout for a new VPN Client as FortiClient has been a pain in the behinds. Especially as some core features are behind a paywall...I'm currently seeking alternatives that support SSO. Unfortunately i'm not aware of any.Is there any client VPN you guys use that is much better than FortiClient and support SSO?

Invaild port number 255scsi_print_error[1130]scsi errorFORTIGATE 300D

Hello everyone, I'm currently having an issue with the SAML SSO option in FortiClient (V7.2.2 -> V7.4). We use the feature "Enable Single Sign On (SSO) for VPN Tunnel" to authenticate. We also enabled the feature "Use external browser as user-agent for saml user authentication". In the past, when signin in, we had the option to choose a microsoft account. Because we have multiple clients that use this configuration, this feature worked great. Since a few days, the button "SAML Login" signs me in with the account that is already signed in (my personal work account). However, this account is not recognized in the tenant of our customers (of course). Are there any other people having this issue? What did you do to resolve it? It seems that the Sign-On URL withing the SSO Configuration is wrong. We need the option to choose between accounts back :). Thanks in advance!