Fortinet Community

Dear Community Members, we are facing the internet slowness issue with SDWAN-VPN users. we have created the IPsec tunnel with remote PF sense but to load balance and achieve the failover scenario, we made VPN part of SDWAN. However after making the part to SDWAN internet browsing is to slow. i have changed the Weights in SDWAN rules but nothing works.  

Hello, do you have a video I can follow to close a VPN between two fortigate? What would be the best practice?

 Hello everyone, I want to set up the "Push Notification" option for FortiToken mobile. I followed the technical tip here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiToken-mobile-push-notification/ta-p/195578It works very well, but I would like to know if I can configure it for my two WAN lines?FTMThank you, 

Anyone experiencing similar issue since yesterday  ?  It happened suddenly, with no modification on web filtering rules from our side, nor any updates done on Zoom app nor Forticlient.  Forticlient 7.0.9Zoom 6.2.2 and 6.2.3MacOSX Sequoia 15.0.1  

If our EMS server still is a Windows server, therefore using 7.2.4Am I right to assume we can't use FortiAuthenticator 6.6.0 with EMS 7.2.4?https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/afec3249-ed3f-11ea-96b9-00505692583a/FortiClient_ems-compatibility-matrix.pdf

 Hello everyone,I recently upgraded from FortiClient VPN 7.2 to FortiClient VPN 7.4 on macOS Sonoma. However, I'm encountering a persistent issue where the application crashes immediately after briefly displaying the console screen. I've attempted reinstalling and deleting the /Library/Application Support/Fortinet/ directory, but the problem persists.Below is an excerpt from the crash report:     Process: FortiClient [1711] Path: /Applications/FortiClient.app/Contents/MacOS/FortiClient Identifier: com.fortinet.FortiClient Version: 7.4.0.1645 (???) Code Type: ARM-64 (Native) Parent Process: launchd [1] User ID: 501 Date/Time: 2024-06-21 17:08:15.2847 +0900 OS Version: macOS 14.5 (23F79) Report Version: 12 Anonymous UUID: 211D612A-2605-BAE2-689D-2447A5CCDB76 ... Termination Reason: Namespace SIGNAL, Code 5 Trace/BPT trap: 5 Term

Hi, I've just implemented the automated stitch on Fortigate to auto block the attacker's IP that are trying to connect IP Sec VPN and it is working perfectly fine. The problem is that, since we are using FortiManager Cloud where all the policies and objects are synced and we are managing the configuration from it, at every new creation of IP object in Fortigate the Fortimanager becomes out of sync and need to re import the policy. Is it possible to automate it? OR Can we exclude some address objects, groups and policies from sync?

Hello everyone,I am encountering issues with setting up multicast traffic in a Layer 2 environment. Although the PCs can ping each other and are correctly connected to the Wi-Fi network, the VLC client is unable to receive the multicast stream sent by OBS Studio.ScenarioThe network Lab consists of the following devices:1 FortiGate2 FortiSwitch2 FortiAP2 PCs on Wi-Fi (IPs: 172.16.0.2 and 172.16.0.3), one running OBS Studio and the other running VLC.TopologyFortiGatePort 1 connected to Port 24 on FortiSwitch 1.Port 2 connected to Port 24 on FortiSwitch 2.FortiSwitch 1 and 2Connected to each other through Port 23.FortiAP connected to Port 21 on each FortiSwitch.ConfigurationVLAN 200 for Wi-Fi Network:Subnet: 172.16.0.0/22FortiGate Gateway: 172.16.0.1DHCP managed by FortiGate: Range 172.16.0.100 - 172.16.0.254IGMP Snooping Enabled on FortiSwitches and FortiAP:IGMP snooping is enabled globally on both FortiSwitches and FortiAP.IGMP Querier is disabled since multicast traffic is expected to

Hi team, I am currently testing Traffic Shaping Profile in v7.2.8 FortiGate 601F with NP7 (default-qos-type: policing, as shaping is not recommended).NP7 traffic shaping | FortiGate / FortiOS 7.2.8 | Fortinet Document Library I find the netlink interface shows "Qdisc=noqueue" and the guaranteed bandwidth in profile is not working. I set one to 99% and other 1%, but iperf test has no difference, they share 50-50% traffic.But the maximum bandwidth in profile is working, if I set 5%, the iperf result shows down to 5Mbps immediately. From the admin guide, I see the log is Qdisc=pfifo_fast.Traffic shaping profiles | FortiGate / FortiOS 7.2.8 | Fortinet Document Library Any idea to config FortiGate to use Qdisc=pfifo_fast, so that to further test the Traffic shaping profiles? Netlink:FortiGate-601F # diagnose netlink interface list <VPN interface>if=<VPN interface> family=00 type=768 index=289 mtu=1420 link=0 master=0flags=up p2p run n

Setting up 2 FAC's in a Cluster.  L3 HA configuration.  When connecting to the security fabric on the Fortigate, do we create a new fabric connector for each FAC or do we add the 2nd FAC with their IP's as if we are connecting 2 DC Agents to the external FSSO connector. Thanks!

Hi,I'm trying to setup a vpn s2s between a fortigate 101f and a fortigate vm on azure, the tunnel don't want to connect, everything is ok same paramteres, but doen't work, on the on prem i receive phase 1 error but on a tunnel that is N/A, and succes on the only tunnel i have and the one i want to function. What is the phase 1 error on the N/A tunnel?  2024/10/12 16:06:53negotiateErrorprogress IPsec phase 1failureN/A2024/10/12 16:06:53negotiateNoticeprogress IPsec phase 1successAzureFGT2024/10/12 16:06:48negotiateAzure FGT is the only tunnel I have

What is CVE-2023-34434?   CVE-2023-34434 is a critical security vulnerability identified in Apache InLong, an open-source data collection and processing platform. This vulnerability affects versions 1.4.0 through 1.7.0 of Apache InLong. It is classified as a deserialization flaw, which can be exploited to bypass security mechanisms and gain unauthorized access to arbitrary files. The issue was resolved in Apache InLong version 1.8.0.    The Significance of CVE-2023-34434   Deserialization of untrusted data is a critical security concern that can lead to unauthorized access and system compromise. This vulnerability within Apache InLong could enable attackers to manipulate or steal data by bypassing existing logic controls, making it a priority to address.  The vulnerability is rooted in the deserialization process, which is the method of converting data from a serialized format back into an object or data structure. Deserialization is a common practice

What is CVE-2024-4577?   CVE-2024-4577 is a severe security vulnerability found in PHP installations running in CGI mode. This flaw arises from inadequate input data handling, which can lead to attackers injecting and executing arbitrary PHP code on the server. The issue affects PHP versions prior to 8.1.29, 8.2.20, and 8.3.8. Due to its nature, the vulnerability poses a significant risk to many web applications, potentially allowing unauthorized users to compromise the server and execute malicious code. This can lead to various security breaches, including data theft, server control, or disruption of services. Users of affected PHP versions should prioritize upgrading to patched versions to mitigate this critical risk.    The Significance of CVE-2024-4577  The exploitation of CVE-2024-4577 can lead to remote code execution (RCE), enabling attackers to perform a variety of malicious activities such as deploying malware and launching denial-of-service attacks. I

We're noticing this problem across multiple clients this morning.  Any users using Internet access policies with a DNS Filter profile enabled are blocked from accessing the Internet.  The DNS Query logs show constant failures with:[ul]Error: no available Fortiguard SDNS serversMessage: A rating error occurs[/ul]The FortiGuard page shows two green "check" status indicators and "diag debug rating" doesn't show any obvious errors. This is not a config problem.  This has happened simultaneously across multiple FortiGates with known good working configs and no recent config changes.  Changing the FortiGuard protocol and port between UDP and HTTPS, 53, 443 and 8888 doesn't seem to make a difference.  The only solution is to either remove the DNS Filter profile from the policies or set "Allow DNS requests when a rating error occurs" to enabled in the DNS Filter profiles - then traffic starts flowing again. This seems pretty clearly to be a back-end Fort

Hello,we are migrating from cisco AnyConnect VPN to FortiClient VPN. we are using FortiClient 7.2.5 and FortiGate 7.2.7 . we are seeing a significant difference in file transfer rate when the end user is trying to download a big file from a shared drive. I am pretty sure its not the internet circuit issue because I ran the test while I was working remotely. I have a 1Gb up/down and the download rate is similar to what our end-users are reporting. any help is greatly appreciated. AnyConnectFortiClient

i have configure the SSL vpn users with MFA using email so when i put the same domain i am integrated it is working fine but when using other domains or gmail it is not working  below for none-working logs -i have changed some details-2024-10-13 16:53:13 Arrived msg(type 6, 83 bytes):user1@domain.net.saAuthCode: 176743Your authentication token code is 176743.2024-10-13 16:53:13 mail_info:from:192.168.100.108 user:MFA@MFA.com.sa2024-10-13 16:53:13 mail_info:reverse path:MFA@MFA.com.sauser name:mfa2024-10-13 16:53:13 to[0]:use1@domain.net.sa2024-10-13 16:53:13 <==_init_mail_info2024-10-13 16:53:13 create session2024-10-13 16:53:13 resolve 192.168.100.100 to 1 IP2024-10-13 16:53:13 ==> send mail2024-10-13 16:53:13 connecting to 192.168.100.100 port 252024-10-13 16:53:13 send mail 0x917c640 session 0x919dd002024-10-13 16:53:13 session: 0x919dd00, rsp_state: greeting, code: 2202024-10-13 16:53:13 session: 0x919dd00, rsp_state: ehlo, code: 2502024-10-13 16:53:13 session: 0x91

My company is trying to set up a site-to-site IPsec VPN tunnel with another companies' network. When configuring the VPN tunnel, we ran into an issue where both networks on either end of the tunnel have the same ip range/subnet 10.1.10.0/24. It is the primary and only private Ip/subnet for our company and the other company utilizes the IP range and subnet along with a few others. Rather than changing our private Ip range/subnet I was looking to utilize NAT to translate our private Ip to another range/subnet when accessing the other company via the VPN tunnel. But have been having a difficult time finding information on exactly what steps to take to complete this within the FortiGate GUI. We have a FortiGate 40F any help or even recommendations would be appreciated.

Hello everyone, i have a question about using FortiGate as a DNS server, we are trying to make use of FortiGate for other then just the use of it for vpn only. My question is FortiGate as the DNS server relaible to use? because w have two windows DNS Servers that are running normal but we wanna see if we use FortiGate for DNS and should it be recursive mode and how to implement this idea.

Helo all, I' m having problems to watch movies on netflix while web filter enabled. I added some netflix urls to the url filter but it' s not working When I hit play in netflix I get an error. When I disable web filter in the policy it' s working like charm. Someone any idea how to get this to work? The url filter edit " *netflix.com" set type wildcard next edit " *nflximg.com" set type wildcard next edit " *llnwd.net" set type wildcard next edit " *nflximg.net" set type wildcard next Thanks

Dear Fortinet Community, we are implementing JAMF right now as our MDM solution. With this we also want to create a SSL VPN for our mobile devices. We already use SSL VPN Portals for our notebooks and work there with a certificate and LDAP authentication. For our mobile devices we want a certificate only authentication but it is not clear for me how the Fortigate should know in which Portal the mobile devices get because normally it works with the user groups from LDAP. As a VPN Client for the mobile devices we would like to use FortiClient.  Do you have any best practices for this scenario? Thanks in advance. Kind Regards,Jan

Hello good morning a question, if I have a site to site VPN and my main segment is the 10.20.0.0/16 and my branches that connect is the 10.30.0.0/24, how can I do it so that all the branches can see one in particular the 10.30.14.1I thank you for the helpBEST REGARDS 

Hi, after updating the firmware of FortiAnalyzer to 6.7.0, I have an issue with the 'Log View' in the 'Incidents' tab. When trying to display logs assigned to a specific incident, they do not load. However, if I manually go to the 'Log View' tab, the logs are present there. Does anyone else have this issue as well?  

Hello,Just got a brand-new Fortinet setup.Tried to do EAP-TLS with computer authentication + LDAP + Company PKI.But can't get it to work, so went back to basic, and using FortiAuthenticator as CA and User authenticationI am getting this error: 2022-01-14T20:46:50.517025+01:00 FortiAuthenticator radiusd[19012]: (85) eap_tls: Verify User Kenneth (GUI user type: 0, id: 3) certificate binding2022-01-14T20:46:50.517384+01:00 FortiAuthenticator radiusd[19012]: rlm_eap_tls: Certificate binding check failed. (CN=Kenneth, Issuer=/C=DK/L=Viborg/O=HandbergIT/OU=IT/CN=fac.handberg.pri)2022-01-14T20:46:50.517642+01:00 FortiAuthenticator radiusd[19012]: (85) eap_tls: ERROR: TLS Alert write:fatal:internal error Have imported the user certificate in Local user certificate personal store. Do someone have any idea why?

I have a problem with a fortigate 40F (firmware : 7.2.10) I have a connection (LAN) in hardware switch, a second connection (LAN VOIP) in physical interface,an FTTO link connected to the WAN as backup and an FTTH in PPPoE mode The problem is i don't have internet (ffth and ftto) behind the LAN, i can't ping google, but i have internet in the LAN VOIP, i don't know why this doesn't work, my policy rules are good. If i configure my lan in a physical interface and replace the policy rules with the good interface, it's work. do you have any idea where the problem is coming from ?

Hi,I am trying to connect my Fortiweb Manager to a new Fortiweb installed at a client.The two devices see each other, the local user created on the customer's fwb dedicated to hookup is ok; but on "onborading" I get this error:Failed to connect to FWB device       Is it possible that this error is caused by the fact that the fortiweb in the client home has not yet been licensed ? ThanksFortiWeb #FortiWebManager