Fortinet Community

I am attempting to create a second VPN tunnel on our Fortigate. I have followed the wizard, but I cannot finish creating the tunnel: all I receive is a pop up stating "invalid length of value -1". This occurs when I use a template from the VPN wizard, or when I do a custom tunnel, filling out all the information. I have also tried creating a tunnel using a different interface than the one the first tunnel is on, but I still get the same error. This is on 7.0.14, but I have also tried on another Fortigate (7.4.3), and I receive the same error. The error seems to indicate to me I have not filled something out, but I am positive I have selected every possible value. What am I doing wrong? 

Hi there, I am currently trying to configure BGP for my SD-WAN IPv4 over IPv6 ADVPN environment, following the guide from Fortinet’s documentation on Active Dynamic BGP Neighbor Triggered by ADVPN Shortcut→Active dynamic BGP neighbor triggered by ADVPN shortcut 7.4.1 | FortiGate / FortiOS 7.4.0 | Fortinet Document LibraryAfter configuring BGP, I tried to check the BGP routing table using the command:get router info routing-table bgpHowever, I am receiving the message "No route available."What could be the possible reasons for not seeing any routes in the routing table..?Below is the current BGP configuration on my hub router.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~FortiGate-60F (bgp) # showconfig router bgpset as 65100set router-id 10.200.1.1set ibgp-multipath enableconfig neighbor-groupedit "EDGEv6"set remote-as 65100set update-source "advpn-hub"nextendconfig neighbor-range6edit 2set prefix6 2001:db7::/64set neighbor-group "EDGEv6"nextendconfig networkedit 1set prefix 192.168.0.0 255.255.

fortigate 40G we can save user name but we can not save the password.

Hi, I have a question about upgrade my fortigate 101E.Right now I have two fortigate 101E, one's firmware is v5.6.9 build1673, the other is v6.0.6 build0272.And I plan to upgrade both of them to v7.2, I already download all the necessary firmware files according to the upgrade path tool.But my problem is, one of my colleague said he had once upgrade another device from 5.X to 6.X, and the device's license will be expired after upgrading, no matter the expinonesensered date is in the next year.I am curious is it possible?? Cause my devices' licenses will be expired in 2024, if they expired after upgrading, that means I will lost two years license and need to purchase new license?!Does anyone have the same problem? Or It's just nonesense and I should just upgrade  firmware?Thanks for any reply.

This post is tied to another one  (see link to post below) I made regarding using the ISP DNS servers for DNS resolution rather than FortiGuard DNS servers or having to specify the DNS ISP  servers IP addresses manually in the Fortigate DNS settings. To see if I could disable DNS resolution with FortiGuard DNS servers, I have tried to set in the Fortigate settings the primary DNS as 1.1.1.1 and the secondary dns server as 8.8.8.8 and then making a policy which blocks all communication for all services between my host and the FortiGuard DNS servers (i.e. 96.45.45.45 and 96.46.46.46). However, after doing all of this, if I run nslookup youtuber.com 96.45.45.45, my query is resolved. How is this possible? How may I disable all communication to the Fortiguard DNS servers? Post link: https://community.fortinet.com/t5/Support-Forum/How-to-configure-a-LAN-interface-with-DHCP-disabled-to-use-the/td-p/350392

I have installed Forticlient on Debian 12 But it shows the error. Then i installed it on ubuntu 22.04 but it also shows same error. On windows and android vpn client works fine but does working on linux any one knows the solutionFailed to connect to vpn tunnel please try againDetails Error Error invoking remote method keytar.deletePassword error unknown or unsupported transport for address disabled  FortiClient @support 

We have Active/Passive with Virtual Clusters setup. With default HA configuration, the "link-failed-signal" is disabled. From some doc, it says the option is to enable/disable signaling to internal hosts when failover happens for fast switchover. So it sounds good but why it is disabled by default? Should I manually enable it? Please advise. 

Hi, The situation where we have the error is using the shared connection of an iPhone and connecting with FortiClient from a Windows 11. The iPhone is only used to provide Internet access to Windows laptops, the FortiClient is installed on those Windows laptops and from here the error sequence is the one I mentioned in the first message - We connect and it asks for username and password- We enter the data and it asks us for the FortiToken.- Enter the code provided by FortiToken.- After about 12 seconds the client does not connect and in the firewall logs appears the message “delete IPsec phase 1 SA”. This is the progress of the connection in phase 1 of IPsec: 2024/09/26 11:40:55 -> negotiate IPsec phase 1 -> XAuth authentication successful2024/09/26 11:40:55 -> progress IPsec phase 1 -> OK2024/09/26 11:40:55 -> progress IPsec phase 1 -> DONE And 12 seconds later the message “delete IPsec phase 1 SA” is displayed. Thanks.

Hello Fortinet Community,I’m facing an issue with transferring large photo files over a FortiGate VPN connection, and I’m hoping someone can help me troubleshoot.I’m a photographer and regularly transfer large, high-resolution image files (RAW and JPEG) from my home office to my team’s server through a FortiGate VPN. Lately, I’ve noticed that some of the files, especially RAW images, seem to lose quality after the transfer, or sometimes the images appear slightly corrupted or compressed.Here’s my setup:- FortiGate Model: FG-60E- Firmware: FortiOS v7.0.4- Connection: FortiClient VPN (IPsec)- File Sizes: RAW files around 25MB - 50MB eachThe original files are perfectly fine before transfer, but once they’re on the server, some seem slightly pixelated or show signs of compression. I’m not sure if it’s a VPN issue, a bandwidth problem, or something with the file transfer protocols. I use FTP for the file transfers. Could this be a data integrity issue with the VPN encryption?I’ve tried:- R

Hello, When I register smartphones via dot1x auto registration, devices appear in the host view as "registered hosts." This is OK; it gets the job done. However, I couldn't find a way to modify the device type other than manually editing the host and setting it manually.  When a user has multiple devices (phones, tablets, PC, etc..) This creates a bit of complexity in the host view.IT admins have to sort things out manually for multiple devices with the same registered user. I tried to find a way around by using device profiling rules for iPhones and Androids by vendor name and DHCP fingerprint and confirming the device rule on connect. But it didn't work. (I know this profiling is for rogue devices; an already registered device would not hit this rule, but I tried anyway.)  Here is the question,  Is there a way to change the device type automatically after dot1x registration?It would be great to have Androids and iPhones sorted out with their icons a

Good day, I am trying to move away from using the FortiGate for DHCP for SSL VPN to using an external Microsoft server but need some advice on doing this.  My current internal network uses 10.0.0.0/21 for DHCP and currently the FortiGate uses an address list to allocate IPs to the SSL VPN from 10.0.3.0/21 which is within the 10.0.0.0/21 subnet. I recently tried to implement external DHCP using the random subnet 10.1.10.0/24 which I setup on the external DHCP server and when I connected to the SSL VPN, I got an IP from the SSL VPN server but could not route to the 10.0.0./21 subnet. Did I use the wrong subnet? I investigated the 10.0.0.0/21 subnet, and it looks like 10.0.16.0/21 may be what I should have used but not sure, when moving to an external DHCP are there any routes I need to setup or does the FortiGate handle this? Maybe I need a static route from 10.0.16.0/21 to 10.0.0.0/21? Thanks in advance I am just learning about subnets and routing. Jul

Hello, Im trying to add the user: "user" to the group: "group1" using the api v2 of a fortigate v6.4.15Below is my request with the return (200:OK) but no revision_change, so its doing nothingAlso below the GET requests on the user and group1 to show the configs What am I missing ? Thanks for reading !   curl -k -X PUT -H "Content-Type: application/json" -H "Authorization: Bearer abcdefg" -d '{"member": "test"}' https://FORTI-URL/api/v2/cmdb/user/group/group1{"http_method":"PUT","revision":"5d01f6d0438463b2da7bd48c54508be3","revision_changed":false,"mkey":"group1","status":"success","http_status":200,"vdom":"root","path":"user","name":"group","serial":"FGT6xx","version":"v6.4.15","build":2095}    curl -k -X GET -H "Content-Type: application/json" -H "Authorization: Bearer abcdefg" https://FORTI-URL/api/v2/cmdb/user/local/test{"http_method":"GET","revision":"5380e9e62a96d94149368f7c05789ab7","results":[{"name":"test","q_origin_key":

Hello,I have some doubts about FortiAuthenticator Agent and 2FA with Windows logon: the documentation says that the agent (installed on the endpoint) needs to contact the domain controller using LDAP (i infer this from TCP/389).So... what happens if the user is away and it's endpoint can't contact the domain controller? The documentation is not very clear about this.Thanks

We had recently been informed that we need to update our VPN clients.  Our user goes to this link https://links.fortinet.com/forticlient/mac/vpnagent to get the latest update.  But when we tested it this week, both fresh install / update comes up with the same error "Failed to connect to the update server." We had tried on two devices.   We also went to the website itself - Product Downloads | Fortinet Product Downloads | Support.  And we see the same error.The link for the windows update/fresh install works fine. https://links.fortinet.com/forticlient/win/vpnagent Any suggestion?

Hello can someone / (staff) summarize the key new features that are available with latest release of FortiNAC-F 7.6?   Thanks, 

Hello everybody, I have a firewall policy regarding an IPSEC tunnel. This policy is saying that all the addresses that belong to ipsec_range can reach the internal destinations.This policy, if I connect, is working fine:I can reach on of  my VMs: Everything is all right.What's the problem?The user that has connected to the tunnel, belongs to a group: Let's suppose I  want to say:I want to filter the source not only by ip address, but also by user group. the same user has an address in ipsec_range and also belongs to IPSEC_USER.Everything should be okay, right?No! I can't reach my VM anymore. What am I doing wrong?  

We want to restrict incoming traffic from external to our email archive server.We are currently using M365 email service.currently we have on policy from WAN to LAN, all to archive server, services - https, ssh, ntp, dns, tcp8000.how can we restrict the incoming traffic ?

We created a new IPSec tunnel to AWS.there are 2 destination subnet that we need to connect to.172.26.0.0/16 and 172.25.0.0/16.Can we do multiple subnet to AWS ?Only 172.26.0.0/16 is reachable at AWS but 172.25.0.0/16 is not.is there any restriction for routing multiple subnets to AWS ?

Hi,I have configured Fortigate to send traffic logs to a remote syslog server.The GUI displays the destination IP along with the corresponding domain correctly.But only the 'dstip' is sent to syslog server, while the 'domain' is not included.How can I send the 'domain' along with the 'dstip'?

fortigate is not responding to snmp query after upgrading ..I did the upgrade as my version they say is out of support ...dahhh its not working at all now

Customer has a pfSense that is configured for WAN auto-failover between 2 ISPs (Comcast and something else). I want to replace that pfSense with a FortiGate 60F. Is this feature included or do I need to purchase an additional license to make this work?

Hi,I'm managing 30 branches, all connected via MPLS and running FGTs as firewalls.There's a main site with a DC (10.7.7.80).I wanted to authenticate fortigate administrators via LDAPS and use their AD accounts for login.However, it is working in some of the sites, and not working on the rest. If i check the logs on the main site, I can see the packet is acceptedbut I can also see this session timeout if I click on this line of log:Some of the FGTs are able to contact the DC, when I look on their logs, it looks the same just without this "session timeout". I tried to increase the ldap query timeout on appliances which have this problem: set remoteauthtimeout 15 set ldapconntimeout 8000 but still the same. Will appreciate any help and advices. Thanks!  

Hi, I am trying to set up FortiGate Web Authentication and SAML as idP but I am having issues, I am following this guide https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/33053 I have setup but the authentication portal is not kicking in, I have seen that on the Fortigate in the Interface, you can enable Security Mode "Capture Portal", does this need enabling as not mentioned in the guide? Overview of what I have done.1. Created Enterprise App in Entra ID.2. Created a group in Entra ID added users and assigned to App.3. Created a Single Sign-on on the FortiGate pointing to the Enterprise App.4. Create a group on the FortiGate and set the Remote Server to Fortigate the Single-Sign-on and the Enterprise App group ID.5. Created a Firewall rule to allow traffic out and added the Fortigate group created in step 4.6. Create a Firewall rule to allow traffic in. When I test from a client PC or the Enterprise App I get 2This site can

Hello everybody, I have upgraded my FGT60F today from 7.2.6 to 7.2.9 and then to 7.2.10This has been working fine without any issue.After a while I noticed, that the VPN-Clients were not able to connect anymore.When I inspected the Radius Server Connection (freeradius), it says: Connection status: credentials not valid   I tried a few settings, whether I will get the connection back - but this did not work. After changing back to 7.2.9 the connection with the radius server worked again.Any ideas, what the problem could be?  Thanks,Martin   

Hello, I am seeing constant alerts on my Fortigate under sslvpn events "sslvpn login failed" This is not coming from the authorized users. Is there anything that can be done on it.  Thanks