Fortinet Community

Good day, I am working on a project to move from Domain Joined Windows 11 computers to Microsoft Entra Only Joined computers, I have a FortiGate FGT200F with Firmware 7.X which currently authenticates users via FSSO in the local Windows Domain via LDAP to determine which Web Filter Policies to apply based on their Active Directory group membership. My test Entra Only joined Windows 11 computers are having issues getting the correct Web Filter Policies from the FortiGate and are ending up going to the Catch-All policies, does anyone have any experience with how to do authentication with Entra Only Joined computers on a FortiGate? I have Microsoft Entra Connect Sync Pass-through authentication setup and it is working to authenticate Entra Only computers to the local Active Directory so users can gain access to network resources. Would I need to create groups in Entra the same as the local Domain groups and authenticate to them? And if so, how is this done? Thanks

This is a fix for your FortiClient VPN being stuck at "Connecting".I was having this issue with multiple users and final found a fix. Cause:FortiClient is trying to start the FortiTray.exe in your c:\program files\Fortinet\ folder, but  it is missing a .dll file (mfc140u.dll). This is part of Visual Studio. Fix:Download and isntall this Visual Studio Redistributable: https://aka.ms/vs/17/release/vc_redist.x64.exe After this your FortiClient VPN app should be working as normal (might require a restart) . 

Hi, Is there a way of getting a free limited version FortiAuthenticator VM so I do a proof of concept before purchasing? ThanksJulian 

Hi Team, Is anybody can assist me if I can block cross site scripting signature  in IPS signature filed in fortigate firewall. If I block cross site scripting, would be any impact as default action is pass in the IPS signature field..  Thank you

Hi,              I would like to know. FortiGate can use HA Management Interface Reservation for updating FortiGuard(IPS, AV, App, Webfiltering) or Registration device to fortinet support portal?            Thank you.

Hi i want to make configuration SDWAN in fortinet 1800F in configuration active passive but i dont know whats is the CLI commands in order to use

Dear Suppport Team,I would like to setup forti training account with my personal mail. When i try to sign up at forti training website, it could not do.  Thanks for your support.BRGDssoemoe

I have 10 different models of computers at the institution. none of them have problems with fortinac windows pop-ups opening. New HP Elite tower 800 G9 computers have been purchased. When I install the same operating system on these machines in the same way, fortinac windows agent pop-up does not open in any way. There is a connection to the server. access is open from all ports. same operating system. but no popup. what could be the reason? 

Hi experts,I just got a new MacBook and try to install FortiClient, but when I open FortiClient app, it continuing crash (with quick flash and close with unexpected close message).I already allow the network extension settings, add allow full disk access, but it didn't work.I also try to uninstall, reboot and reinstall but still not work. Anyone can help me solve this issue?Thanks!! (sorry for Chinese scree shot)Network extension:Full disk access: Error message:   

Hi there, I have around 100 Fortigate 60E units around the place (administered through Fortimanager) running FortiOS 7.0.11 and I am looking for a script that will go through and convert all policies and profiles to flow-based. I am aware that FortiOS 7.4.4 will do this automatically when upgrading, but I am tied to version 7.0.11 for now, so a script for this would be really handy. Cheers

Hello, there is a problem with Google Remote Desktop on the back of a Fortigate 100F. Enable the filtered applications and permit Google Play and Google Remote Desktop. Inside the LAN, you can connect to the devices without any problem. Sin embargo, the problem arises when you try to connect the LAN network, for example, from my home. At the extreme end, because the connection is stable, but when the computer initiates the connection, it will get a connection error after a while. Because this is blocked from using Google Remote Desktop when you try to connect to the LAN, you can access an external device or vice-versa. He says that it may be necessary to enable some UDP entry ports, but I am concerned about safety risks. Do you have any idea of ​​how to solve this problem? 

Hello,I have an issue with my IPsec tunnel, when connected to VPN I have access to my firewall through LAN(Port2) interface.But I don't have access to VLANs created under LAN(Port2) interface.Note that I have created firewall policies to allow access from VPN to internal network, and vise versa.  Port1 is my WANLAN(Port2) Address: 10.0.0.100VLAN Snet: 10.1.1.0/24VPN Client Snet: 172.16.10.0/24Server machine: 10.0.0.138 Note that I working on a virtual fortigate firewall on a cloud. VPN configuration                   VPN status Ping to server from client side                    Ping to server from firewall  

Hello,I have a BGP flapping issue between two Fortigate ISPs in standalone mode and my Fortigate firewall in HA mode. I need your help, and could you please provide the recommended configuration?Thank you. 

    Does the VLAN switch work in software or hardware?I do not seem to have the hardware switch option when attempting to create interfaces.

Hello, I would like to configure SSLVPN in split tunneling mode in order to reach local resources, but also some objects in GCP that have an ACL allowing the primary public IP of the Fortigate as source.I thought of using Internet Services to allow whole GCP from the tunnel, and I was expecting the forticlient to install those routes, but it didn't.    config firewall policy edit <rulenumber> set uuid xxx set srcintf "ssl.root" set dstintf "<wanport>" set action accept set srcaddr "<vpnaddresspool>" set internet-service enable set internet-service-name "Google-Google.Cloud" set schedule "always" set nat enable set groups "<groupname>" next end   In SSLVPN Portals -> Routing Address override: I don't have access to Internet Policies.The device is a F3501F, running latest mature version available. (7.2.10) What would be the less time consuming of doing what I want?Is there

Hello, we have a Fortigate v7.0.7 and we dial into the company via vpn from Windows, Mac, Android, iPad, iPhone.An internal dns server is specified in the ssl vpn settings. There are different zones/domains in our internal DNS.For example:myfirma.lo (that's the name from our internal AD)somethingother.detest.blubber...If we make an vpn-connection (with FortiClient) from Windows, Mac or Android, all these zones/domains can be resolved to ip addresses. I test that with ping or nslookup.For example:ping hosta.myfirma.loping hostb.somethingother.deping testhost.test.blubber...No matter what I take, I get an ip address back everywhere. From iPad and iPhone (also with FortiClient) just the zone myfirma.lo works. All other zones/domains cannot be resolved.If I ping, for exampleping testhost.test.blubber I get "Can't resolve host" So I think, that's a problem with IOS. What can I do? Thank youGreetingsAlbertMin

I am trying to use a fortigate 60F to segregate my OT network, so SCADA from ICS.  I already have switches in place, so trying to use what is there.  Currently testing on the bench, with 2 managed switches connected to the FGT, each switch represents one VLAN, as below: VLAN 10 - 10.1.0.0/24VLAN 11 - 10.1.1.0/24 I have assigned physical interfaces (left at 0.0.0.0/0) to VLAN switches (as above). Alternatively assigned VLAN interfaces to the physical interfaces (0.0.0.0/0 again).Both with bidirectional firewall policies. Using VLAN switches, which was the best result, I can link to one switch, and get to the FGT but not to a device or other switch in the other VLAN; the FGT can ping devices on either VLAN.  What am I missing?  Thanks. 

Hello,I bought the F60 firewall where can I create a registration to register this firewall to upload the license and everything , where can I also register to open a call at forigate ?

Is it possible to connect to 2 separate FG60F firewalls simultaneously  with FortiCLient VPN SSL 7.4 ? RegardsNIkolay

Hello, I've deployed FMG 7.2.7  (evaluation) in AWS (BYOL) and configured AWS SDN connector using IAM roles. I've tried to create a dynamic firewall object. Step 1 - enter a name, Step 2 - Filter - click on + , type SecurityGroudIP and then I click on a sg group and Apply. Filter is not applied! I've tried with both Edge and Mozilla. Anyone having the same issue?  FortiManager #aws 

We have 2 fortiswitches for wireless AP's 1 switch is installedWhen i come to installing the second switch, I just want the same VLAN's available for the WIFI.Is this achievable?Do I just create the same VLANs? I have a feeling it will tell me they are already in use. I read about Subnet overlap....is this something I need to enable? Thanks

HelloWe have FAC version 6.4.9, with Windows agent version 4.3, 2FA with FortiToken mobile.While online authentication works just fine, sometimes some users fail to login when they open a Windows session in offline mode (disconnected from the Corp network). The error shown on Windows login screen is user and password incorrect with "Offline Tokens: None Available".As this behavior appears from time to time it becomes a real issue, especially when the user is offsite as we can't assist him.Any hint to fix or troubleshoot the issue would be appreciated.

Anyone know how to make schedule backup to SCP in fortigate?

Hi, I am trying to authenticate the passive firewall via Radius for management purposes. I have setup as per "Active-passive with external and internal Azure load balancer (LB)". Active and passive firewall has dedicated HA management interface configured with dedicated ip  active firewall and passive firewall have the same radius server configured .   On my radius server I have two clients.  One is the active firewall and the other for the passive. I can authenticate the active firewall without any issues on its ha management ip.  However, the passive firewall was not authenticating with its its ha management ip. But strangely it started to authenticate with its HA management ip. Is this possible? The RADIUS server  does not ping from passive ha management  interface. Routing table is blank on Passive firewall that means no reverse route to RADIUS server, also in GUI the RADIUS server connection status is " Error checkin

We have been using Fortinet technology since the beginning of last year. However, I recently encountered an issue with my FortiSwitch. The switch is receiving power, but none of the ports are functioning, and only the power LED is blinking. The switch is connected to a Schneider APC UPS rated at 3000VA/2400W. I have performed a hard reset, but the issue persists, and the switch has not recovered.Could you provide any insights on what might have gone wrong with the FortiSwitch? power outage??