Fortinet Community

Hi there Is it possible to setup the Fortianalyzer for multiple tenants ? Any information/advice on how to do this ? thanks ggntt

I recently work for an organization and I saw some network with policy 4294967295 which does not exist in the list of policies. I am confused why some networks work with this policy if they do not exist in the list of policies!Does anyone have experience in this matter?    

I need to set up failover on a Fortinet 40F at my branch office. The branch is connected via two VPN tunnels: DSL VPN and VSat. My goal is to prioritize the DSL VPN link and switch to VSat in case of DSL VPN outage. I'm new to Fortinet and need guidance, noting that I'm not using SD-WAN but rather static routes.

delete post

HI , I recently got into firewalls,  I have Fortigate 200F, I want to do SSL-offloading with  it if possible ?my question is , is it possible to do it with Fortigate and if yes , then what makes it different from Fortiweb ? when i can offload traffic on my Fortigate and inspect it ? 

We are fighting an issue with Forti Client 7.2.5  We got a Malware/Virus detection on following files (multiple clients):  Malware: FSA/RISK_HIGH found in C:\Windows\WinSxS\wow64_microsoft-windows-recover_31bf3856ad364e35_10.0.19041.1_none_465905a4885947e8\recover.exe by realtime scan. The file was quarantined.  Malware: FSA/RISK_HIGH C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_10.0.19041.1_none_6db5d09458d426f5\wmpnscfg.exe by realtime scan. The file was quarantined C:\Windows\SysWOW64\recover.exe by realtime scan. The file was quarantined.  Malware: FSA/RISK_HIGH found in C:\Program Files\Windows Media Player\wmpnscfg.exe by realtime scan. The file was quarantined. After runningSFC /scannowDISM /online /Cleanup-image /ScanHealthDISM /Online /Cleanup-Image /CheckhealthDISM /Online /Cleanup-Image /RestoreHealth the problem disappeared on one client, but is persistent on another one. I have opened a ticket (TAC) and t

Hi,I hope everyone is doing well. we are trying to configure the voice VLAN for the whole network in cisco switches everything is simple I finished the configuration but am having a hard time trying to research about ForitSwitch command or GUI to set up the voice VLAN can I get any documentation or some brief explanation on how to configure it via GUI or CLI would really appreciate it .

First my environment is on Huawei cloud, I have fortigate FW connected to VPC1, and VPC2 connected VPC1.VPC's subnets:VPC1: 10.0.0.0/16VPV2: 10.1.0.0/16I have created VLANs on firewall that matches each subnet on VPC2, for example I have a server connected to VPC2 with IP address 10.1.1.100, so in firewall under my LAN interface I created VLAN interface with subnet 10.1.1.0/24static routes have been created on Huawei from VPC1 to VPC2, and vise versa.static routes have been created on Firewall to communicate with VPC2 through VPC1.With my current configuration:I have access to server connected to VPC1 through VPN, but not to VPC2 server (note that I only have access to VPC2 servers using VPC1 server).I don't have ping to servers on VPC2 from firewall.I can access FW from VPC1 and VPC2.Both VPCs have access to internet (traffic is passing through firewall)What do I need to let the VLANs communicate with the subnets on the switch?

Good day, I am trying to set up Outbound firewall authentication with Microsoft Entra ID with SAML following the process in the link below but it's not working, when I open a browser I am not requested to log on. I have double-checked and my setup looks good I thought the guide may be wrong, my first question is do you need to enable Capture Portal on the Lan interface as the guide does not say to do this? Also, I am setting this up because I want to authenticate Entra Only Windows computers so not sure what the "User Attributes & Claims" should be? users log in with their email and password so assuming I should add the email as an option? Can anyone help or is there a better guide to setting this up for Entra Only joined Computers? https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/33053/outbound-firewall-authentication-with-microsoft-entra-id-as-a-saml-idp ThanksJulian

i need to create named address for IPSec tunnel so that i can have 2 subnets 172.25.0.0/16 and 172.26.0.0/16 to go through the tunnel. but i cannot seems to be able to add them.is there any limitations ? 

Hi, What is the correct way to create IPSec tunnels when the head office has multiple WAN interfaces, while the branch office has only one? Should I create two tunnels in the Head Office? Thanks.

 Hi all, I have some question regarding the routing in FortiGate here. I have attached the topology here for better understanding. I only have a control of ID FortiGate and cannot see the configuration on Azure WAN and other Head Office. Current condition is in the green box, all Head Office FortiGate has IPSec tunnel to Azure WAN, and I think the Azure WAN is responsible for the BGP routing to all other Head Office. From ID Head Office, I can connect to TH Head Office and JP Head Office. Everything is working well. So, I have a new Branch office in ID. I can create the site-to-site VPN between ID Head Office and ID Branch, but the problem here is to connect the ID Branch to TH Head Office or JP Head Office via ID Head Office. Does anyone ever have this kind of configuration and can give me suggestions about how to configure it? Thank you.

Hi this is what I see when I try to login to non-licensed version: 6.2.0-6.2.3. Any idea what is it? When I click "close" nothing happens   Hubert

MY fortigate ssl vpn setting for saml  use port number 443 ,current   iphone fortinet vpn upgrade   to 7.4 happen issueerror message  => " VPN Erroe : unable to get sso portIs there any solution? 

Hello,I want to access the web mode SSL VPN both from the LAN and WAN, but I get the same error on Safari. It is updated to the latest version, Sequoia 15.0.1, as well as on iOS and iPadOS. It works perfectly on Firefox or Chrome. In the Fortigate logs, the following error appears.What can I do to fix it? 

Hi all, we have recent connectiosn issues the last days at our customers with Apple iOS devices . I found out, that iOS Clients with updated Forticient 7.4.10145 has the issue. After some test with try and error i found out, that you have to specify the Port even in the Server Address to get it working again (Even in VPN Realms). This was not necessary in erlier versions of the forticlient. i could reproduce on a device with an older Version where the VPN is working. After upgrade the client it is not working, till i set the POrt also in the Server Address. Has anybody else the problem? If you use the server address https://"ssl-vpn-address.com":443/realm it ist working, even if you specify the Port in the "Port" settings        

Hi, I am currently working on a new deployment and needs to configure SSL VPN, with SAML Authentication and Certificate. However, I am getting this issue: "Credential or SSLVPN configuration is wrong. (-7200)", and bumped into this link: Failure to connect via SSL VPN with '... - Fortinet Community It mentions that I need to disable Require Client Certificate. Does this mean that SSL VPN, with SAML Authentication will not work if with Certificate? Thank you  

Hi All, My Customer recently moved to a FortiGate from a Palo Alto firewall. Customer is using workspace one. It acts like a proxy (tunnels the traffic to the Workspace One server). All customer internet traffic comes to Workspace One server from a DNAT in FortiGate. Then those traffic go out by making the source IP of the workspace one server. I need to implement user based rules for users who are using workspace one when reaching internet. Also user identification need to be SSO. When I enable network detection in interfaces. Some users were detected like in the below image. Customer don't want to go with captive portals. what can I do for this. (For Citrix VDI environment We are using FSSO and TS Agent. it is working fine)  

Hello everybody, I've been working with a ZTNA for about a year without problems.Since Forticlient EMS upgraded to 7.2.5 version, something strange is happenening. This user, who has always worked with ZTNA, can't access network resources anymore (he was Off-Fabric during the connection attempts).This is one the logs: date=2024-10-09 time=16:14:43 id=7423779172176101376 itime="2024-10-09 16:14:43" euid=3 epid=101 dsteuid=3 dstepid=1053 logflag=3 logver=702101706 type="traffic" subtype="ztna" level="notice" action="deny" policyid=15 sessionid=10994158 srcip=xxxx dstip=10.1.0.214 srcport=52177 dstport=3389 duration=19603 proto=6 sentbyte=10454368 rcvdbyte=31622617 logid=0005000024 service="RDP" app="RDP" appcat="unscanned" srcintfrole="wan" dstintfrole="lan" policytype="proxy-policy" eventtime=1728483282890140384 wanin=31622617 wanout=7184424 lanin=10454368 lanout=32300828 crscore=30 craction=131072 crlevel="high" poluuid="7f1a8a84-dfd7-51ee-4200-2edb944b93d3" srccountry="Italy

Hello everybody,Some time ago I created a ZTNA environment on my Forticlient EMS, assigning some tags to some users.For example, look at these two users (this first one uses a macOS device, the second one a Windows device):the first one was Off-Fabric too when the attempts occured. As you can see, both users have the same tags.The ZTNA Firewall policy is unique:  So,  both user should access or not the ZTNA.The strange fact is that the Windows user can access the ZTNA: date=2024-10-10 time=13:23:01 id=7424106010597392384 itime="2024-10-10 13:23:01" euid=1040 epid=1070 dsteuid=3 dstepid=1051 logflag=1 logver=702101706 type="traffic" subtype="ztna" level="notice" action="accept" policyid=15 sessionid=11466583 srcip=….. dstip=10.1.0.207 srcport=7854 dstport=3389 duration=13850 proto=6 sentbyte=1112395 rcvdbyte=6568260 logid=0005000024 service="RDP" app="RDP" appcat="unscanned" fctuid="6C40ACFAC7B043A4851701EB5FDD3B3D" srcintfrole="wan" dstintfrole="lan" policytype

Hello,I have a question about LACP or MCLAG.In FortiSwitch managed via Fortilink, can an MCLAG or LACP connection be made vs. third-party switches?Reviewing the documentation, I only find examples with FSWs in standalone mode.https://community.fortinet.com/t5/FortiSwitch/Technical-Tip-MCLAG-channel-bounding-on-standalone-FortiSwitch/ta-p/281951

Greetings, I have a weird scenario using Forticlient connecting to SSLVPN. Our users connect to our Internal network using SSLVPN when they are working remotely. They are using Forticlient VPN with email token for enhanced authentication.Lately, we encountered issue such that user were not prompted for email token and get direct access to the network but no access to any of the servers or internal network such as file share. We have 2 Active Directory servers and that the email token is set to point to AD1 while AD2 is our primary Active Directory. Both AD are replicated.Has anybody encounter such issue before?

I'm testing FGSP and VRRP using foritgate VMs.  The topology is as follows:  FirewallA (VRRP Master)--------L2VPN--------FirewallB (VRRP Backup) There are 3 servers:Server A connects to Firewall AServer B connects to Firewal BServer C is in the VRRP domain and will reside in either Firewall The issue I've observed is When Server C tries to connect to Server B, it fails and the debug flow shows a reverse check failure.  I am not sure why this is happening with FGSP enabled, as all other traffic syncs across fine.  However, Server B is able to connect to Server C. When I make Firewall B the VRRP master server C can connect to Server B, but then loses access to Server A.  It seems like FGSP isn't synic traffic that's directly conncted to the Fortigates that is acting as VRRP backup.  All other transit traffic thats asymmetric FGSP handles it fine. 

We have FAC version 6.6.2 with FSSO and a FGT ver 7.4.5Sometimes a computer wich is connected to wired network, disconnect the cable and get IP from wireless network, the FAC FSSO does not get the information updated, and the user does not get internet conecction because of this problem.   FortiAuthenticator FortiGate FortiAP 

Hello guys! I am facing serious problems with Google Chrome Kyber. Specifically on 40F series. I have a couple of firewalls on 3 different versions (7.4.3, 7.4.4 and 7.4.5). Each of them has issues but with different behavior: Google Kyber IssuesSlowness to open websites or pages that won´t load. 7.4.3 - Google Kyber problemWhich feature is impacting? Web FilterSolutions:1. Disable Web filter2. disable Google Chrome Kyber3. Adjust tcp-mss-sender and receiver to 1450 in the policy7.4.4 - Google Kyber problemWhich feature is impacting? Application ControlSolution:1. Disable Application Control2. Disable Google Chrome KyberAdjusting tcp-mss-sender/receiver doesn´t work 7.4.5 - Google Kyber problemWhich feature is impacting? Application ControlSolution:1. Disable Application ControlDisabling Google Chrome Kyber doesn´t workAdjusting tcp-mss-sender/receiver doesn´t work I am migrating a lot of customers from other vendor to Fortigate with Fortimanager and trying to