Fortinet Community

Hi All, I need to configure my firewall to identify users using Kerberos for single sign on without an use of an explicit proxy. I was only able to find articles with Kerberos authentication with explicit proxy. My Device : FG-401FOS Version : 7.0.15 Thank you !... 

Hello Expert,I have a design question regarding our current network setup, and I’m hoping you can help clarify a few points. While this design may seem a bit unconventional, we are limited to using the switches already implemented in our design. I would like to know if what I’m proposing is feasible, and if so, how we can achieve it.Current Setup Overview:Site 1:Two FortiGate hardware devices configured in High Availability.The setup is functioning correctly.Site 2 (DMZ):Two virtual FortiGate devices configured in HA.This setup is also functioning correctly.Site 3 (LAN):Two virtual FortiGate devices configured in HA.Their HA synchronization is working fine.Connection Between Sites:Site 1’s primary and backup firewalls are directly connected to Site 2’s primary and backup devices.Site 2’s primary and backup devices are connected to Site 3’s primary and backup devices.Key Question:If the primary firewall at Site 1 goes down, I can configure link monitoring to trigger a failover to Site 2

I have a Fortiswitch 148E on FortiOS version 7.4.3 configured to accept public key authentication over SSH. I've found that I need to add "-o PubkeyAcceptedKeyTypes=+ssh-rsa" to my ssh command in order to successfully authenticate via public key as ssh-rsa is disabled by default in OpenSSH in favor of more secure algorithms. This seems like a bit of a security oversight on Fortinet's behalf. Is there any way to enable other public key algorithms in 7.4.3? Any chance this is resolved in 7.6?

Hello,I am currently encountering an issue with an application, which I suspect is caused by the hop count being set too low in the TTL header. There is a FortiGate firewall in the routing path, so I am wondering whether it is possible to modify the hop count field in packets as they pass through the firewall. I noticed there is an option to change the TTL of the session in seconds; however, I have not found any articles on how to change the IP TTL header. Does anyone know if this is possible?Thanks.

 Hello everyone: We are new Fortinet costumer and need help with the default domain configuration in a multirealm SSL VPN scenario. For example, we have the following realms configured:- https://vpn.domain.com (default realm)- https://vpn.domain.com/realm1 (realm 1)- https://vpn.domain.com/realm2 (realm 2) Our idea is that users can connect only to these 3 realms. But when testing, we noticed that if a user mistypes one of the realms (by example: https://vpn.domain.com/realm200), the user is redirected to the default realm. This is not desired. We expect that if this happens, the connection will be discarded by the firewall because there is no realm to match. Is that possible?. Thanks in advance 

Hi all,    After upgraded FortiOS v6.2.16 build1392 (GA) cannot access to SD-WAN GUI and it's showing "failed to load data". Anyone have s

Hi, Since we upgraded our Fortigate 200B cluster to version 5 patch 4 from version 4 MR3 patch 12, after about a week of uptime the cpu goes to 100%. The diag sys top command shows that the cw_acd process is using all the cpu. Doing a exec wireless-controller restart-acd command has no effect. We have to restart the whole machine. This has happened twice now with a week in between.

Hello, I would like to take port01 to configure my DHCP, but when I take it off Vlan Switch I can no longer access the fortigate, how do I do it?    

Hello, I have just installed on-premise exchange server and configured hybrid with office365. However, I noticed that I am not able to establish a StartTLS connection with office365 on port 25 and this causes email from on-premise user to a cloud user to fail. I have allowed all services on the firewall policy just to be sure that I am not blocking it but it still fails. I have attached a screenshot of failed connection test form behind fortigate and successful test from outside of Fortigate. I am a self taught administrator on Fortigate FW and appreciate all the support I can get. Cheers,~Richard

Hi all,We are facing the Forti-Client authentication login page issue by our all the users.We are using 800D UTM having v7.4.3 build2573 version. Error is ERR_CERT_AUTHOURITY_INVALID and we checked on event Viewer log & found error : The Certificate received from the remote server was issued by an untrusted certificate authority. Because of this, none of the data contained in the certificate can be validated. The TLS Connection request has failed. Attached URL action also not worked:https://community.fortinet.com/t5/FortiGate/Technical-Tip-GUI-Untrusted-HTTPS-server-certificate/ta-p/224780 

Hello Experts,in Cisco SD-WAN we have components (vBond, vManage, vSmart, vEdge) what are the device's names do the same rules in Cisco SD-WAN?in Cisco:vBond: OrchasrtaionvManage: ManagingvSmart: Control PlanvEdge: the edge router Thanks

Hi all,I have an interesting question. I'm messing around with FortiManager's VPN Manager tool and seeing a weird issue (TAC is working on it, but thought I'd ask the community as well).FMG 7.0.12, FGTHub 7.0.15, Spoke1 7.0.15, Spoke2 7.0.15, both Spoke1 and 2 have FortiExtenders with either Verizon or AT&T (not that it should matter the provider, just being thorough). All 3 sites are connected via MPLS and have site to site VPNs configured, as well. BGP is used for routing between the sites with MPLS being primary, StS VPN being secondary.I am creating a dynamic VPN tunnel configuration where if both MPLS and primary DIA are disconnected, the FortiExtender will build a tunnel and BGP will flow over that connection until one of the other two come up. While I can appreciate that SD-WAN and ADVPN should be used, they currently are not (they will be in the future, but for the moment it isn't something that can be fully configured at this time).Dynamic VPN is configured so that the hub

Hello everybody, ZTNA is not clear at all for me.I'm working from remote and in my Forticlient I've been assigned a tag: ZTNA_DEVI'm not connected to any VPN.On fortigate, there is a ZTNA Rule:  192.168.1.4 is a ZTNA server that manages a Virtual Machine.I've also a Firewall policy:This policy says that all users that whose destination is ZTNA_DEV (192.168.1.4) and have the tags ZTNA_DEV are allowed.But there is one thing I don't understand. I'm working from remote, so I'm not in the enterprise network. How can reach that server?The firewall policy is saying that the incoming interface is wan1, but how can I reach it?I know I have the tags, but how is possible that with these tags I should reach the internal network?Where am I wrong?Thank you so much! 

Hi everybody.I have the problem of receiving a privacy error when trying to access the 60F (firmware 7.6.0)  from lan.The real problem is that blocked pages don't display the Fortigate correct blocking page.I have done the Let's Encrypt ACME certificate and it works for connections out the lan. The privacy error is given because I use https://192.168.1.1 and the expected certificate is for xxxx.fortiddns.com (used for let's encrypt).I have, clearly, imported Fortinet_CA_SSL certificate in user's endpoint.I also tried to regenerate certificate and re-import it, without any change.I have an identical device working on another site, with exactly same configuration that doesn't have this issue, I really can't undersand the reason and how solve it.Thanks for helping.  

Hello,We have an FAZ Hyper-V VM running the latest 7.4.3 code. I can ping it and I can SSH into the FAZ but I cannot access it via the web GUI.  Edge returns ERR_CONNECTION_REFUSED.  Firefox just says Unable to connect.  Interface has  "set allowaccess ping https ssh snmp" Platform Type : FAZVM64-HVPlatform Full Name : FortiAnalyzer-VM64-HVVersion : v7.4.3-build2487 240514 (GA)

hi,i got new FG 401F and i don't see any forticloud key/registration code on the chassis (checked all sides) and no document inside the box. there's also no key on any sides of the box. the 40f i got has forticloud key on top of the chassis. can someone advise if this is a e-document/PDF i need to ask from the FG vendor/reseller?

Hi There,I tried to create a aggregate VPN between two fortigate node. FOS 7.0.14.https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/779544/ipsec-aggregate-for-redundancy-and-traffic-load-balancingthere are two VPN tunnel established already. and I added one tunnel to the aggregate vpn successfully. But I cannot add another member into the group.according to the guidance, I have to set aggregate-member enable. But I cannot do it, check the error message below. # nextPlease enable phase2 auto-negotiate if ipsec-aggregate uses redundant algorithm.This interface is currently in use.object set operator error, -23, roll back the settingCommand fail. Return code 1I tried to enable the phase 2 autonegotiation and delete the vpn tunnel and create a new one. the result is same.I tried to disable the virtual interface but the result is same. Since there is traffic on the physical interface already. I cannot disable it. I don't want to break the service.Appreciate your advice on ho

Hello,- We´re running FortiOS 7.4 on FortiGate 601E (with hard drive)- After upgrading to FortiOS 7.4, there were no more entries within the GUI @ Log & Report => Forward Traffic- For "Log location" "Disk" is set in GUI Of course Disk logging is still enabled, i.e.config vdomedit vdom two show full-configuration log disk filterconfig log disk filterset severity informationset forward-traffic enableset local-traffic enableset multicast-traffic enableset sniffer-traffic enableset ztna-traffic enableset anomaly enableset voip enableset dlp-archive enableset forti-switch enableend config log settingset fwpolicy-implicit-log enableset fwpolicy6-implicit-log enableset extended-log enableset local-in-allow enableset local-in-deny-unicast enableset local-in-deny-broadcast enableendconfig firewall policyedit 2set logtraffic allset logtraffic-start enable Am I missing any additional parameter?    

Hi teamI have a problem with get Log Access not getting name in UserID column when I integrate Authen (LDAP) with ADThanks 

Hi all. My college asking to me their FMG 7.4.3 have an issue. when device discover or adding manual serial number, task even said successful without any problem. but when he check on managed device, there is no shown any device that he add before. when trying add again, it said "device with serial number xxx already exist".also, when I check with my college, I notice there is no "unauthorized device" menu on device manager. I already check on release note but there is no mention about this. I notice on 7.4.0 there is an issue with FOS 7.0.12 but solving (i guess) on 7.4.3 (only mention issue with 7.2.9). And I check on compability matrix, 7.4.x still support to 7.0.x version. Is this new bug or something?also when I check on FortiGate fabric connection, it said "connect" and "managed by fortimanager" but the IP/FQDN are blank.there is no issue when testing on fmg 7.2.5. here is the complete detailFGT40F with 7.0.12FGT60F with 7.0.14FMG-VM64 with 7.4.3

I am trying to use two IPoE lines in one fortigate. The configuration is as follows.IPoE①: for InternetIPoE②: for maintenance such as Windows UpdateHow should we configure it?I know how to set up only one line.Should I use VDOM?It is version 7.4.3. Thank you for any answerBest regards

Hi All,I currently have a client who uses the FortiClient VPN (Zero trust Fabric Agent) Version 7.4.0.1658. Using the GUI work fine, no problems. However, when trying using the CLI (from this article) it fails. The process I followed was. Execute FortiSSLVPNclient.exe (version 7.4.1658)Click settings,Create a new connection (eg: MyCo), [Note the Client isn't saving the 'Do not warn about server certificate validation failure' or the 'User Name' and 'Password' in the Connection Settings dialogue box.] I'm running the exe as Admin.Once I've created the connection, the command line I'm using is: FortiSSLVPNclient.exe connect -s MyCo -h [IP]:[Port] -u [userid]:[password] i -m -qAll that happens is the GUI appears, then if I click connect it flashes "connecting", then immediately back to "Disconnected". I've upped the logging of the FortiClient SSLVPN to "everything" but can't find the logs - LOL.Any help would be appreciated.Regards:Tony.

Hi all.  I'm in a pickle.  My network guy just left and I have a situation where I have 2 subnets that I need to comunicate with one another.  I am not a network guy and Fortigate is very hard for me to understand.  I really need someone to explain to me, like I'm 5, how to get these subnets to communicate.  For some unknown reason one of the subnets is a /32 and only contains the IP of a domain controller.  The client devices are all grabbing IP addresses on a totally different subnet, so my client is unable to join their new PC's to the domain. I've tried reading all the documentation and watching videos but it's all Greek to me.  Address groups and interfaces and VLAN's oh my.  If anyone out there is willing to assist me with understanding what I'm doing here I would be forever grateful.  Thanks.

We upgraded our SIEM to version 6.3.1 earlier this year to position ourselves to upgrade further.  Our last upgrade failed twice for different, undocumented issues before getting the support from TAC to complete it successfully.  Because of that, I've lost a lot of faith in future releases.We are partnered with a third party who also manages multiple FortiSIEM installations, and they have found that the only stable version beyond our current version is 6.4.1 and they have reported failed upgrades for many of the other available versions. We are working on getting a lab environment in the next month or so where we can test upgrading to various versions, however, I'd like to hear about success and failure stories from anyone who has upgraded from legacy versions. Thanks, and I hope to hear from everyone!

Hello all, Since yesterday I got a flood of our IPS about the following: date=2024-10-10 time=09:55:22 devid="FG100XXXXXXXXXXXX" devname="100f_serverroom" eventtime=1728546922552439440 tz="+0200" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" severity="low" srcip=xxx.xx.xx.xx srccountry="Reserved" dstip=157.240.247.61 dstcountry="Netherlands" srcintf="VLAN72" srcintfrole="lan" dstintf="wan1" dstintfrole="wan" sessionid=1996577 action="dropped" proto=6 service="HTTP" policyid=6 poluuid="016585d8-cf8c-51ec-1bc2-98b96e341900" policytype="policy" attack="HTTP.Suspicious.Headers.With.Special.Characters" srcport=49694 dstport=5222 direction="outgoing" attackid=48934 profile="high_security" ref="http://www.fortinet.com/ids/VID48934" incidentserialno=168450119 msg="http_decoder: HTTP.Suspicious.Headers.With.Special.Characters" crscore=5 craction=32768 crlevel="low" The destination is a meta-whatsapp service. This seems to happen with ev