Fortinet Community

Dear Hi,Fortimanager 7.4.4 VPN manager Portal settings changes are not shown in the install wizard the changes are not shown in the install wizard unless I remove the SSL VPN portal from the device in the SSL VPN settings edit the portal then add it again to the firewall. 

Good morning, We have an issue that showed up this week (Tuesday) with two users VPN'ing from home.  They are getting a "The server want to connect to requests identification, please choose a certificate and try again. [-5]" error.  Interesting thing is that I don't require nor have we set up client certs for SSL VPN and it's only 2 users out of about 15 right now that are getting the error.  We are running a mix of Forticlient versions (6.0.9, 6.0.10 and some 7.2 versions) and don't have a support contract on the clients.  Another interesting thing is if we uninstall and remove it completely from their PCs  (Windows 10 and 11 are the two OS's) and install a new version as a test, it gets the same error.  Also...using a different Windows profile fails as well.I found this article and followed the instructions and it's still not working: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-solve-The-server-you-want-to-connect-to/ta-p/1

This is lab work. I'm clustering 2 VM to simulate a customer environment. I have some 60day licenses of FGWhen I bring them together, they do not sync due to some config differences on the new unit ( dns and a few interfaces ).1) is the a way to force the established unit just to overwrite the new one ?2) In accordance with FortiGate's guidelines, I factory defaulted the new unit, but at this point, the serial number changed and the licence was lost. Any attempt to restore the licence now fails ( probably as a result of the new serial number ).  Any guidance on how I can progress is much appreciated. FortiGate-VM64-KVM # execute ping service.fortiguard.netPING guard.fortinet.net (208.184.237.61): 56 data bytes64 bytes from 208.184.237.61: icmp_seq=0 ttl=45 time=146.8 msRequesting FortiCare license token:xxxxxxxxxxxxxxxxxx proxy:(null)Forticare response error 58.Failed to download VM license.

I can not get this figured out.  I’ve got a FortiGate running v7.2.9 (also tried with v7.2.8) and I’m trying to configure our SSL VPN to use an external DHCP Server to assign our clients IP addresses.  I followed the instructions outlined here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-with-external-DHCP-Server/ta-p/215644 The SSL VPN Clients are able to connect to the VPN and do successfully obtain an IP address from our DHCP server, along with the correct DNS servers, however, the clients are not able to access anything at all once connected.  The clients get assigned the proper routes to get to our internal LAN and WAN (confirmed by checking print route on the clients), so no problem there.  I have firewall policies in place to allow traffic from the SSL root to the LAN and WAN.  Nothing is showing up in the firewall logs as being blocked and the hit count/bytes are increasing (indicating the policies are being hit).  If I d

I have a Fortigate F2K60FTK21900432 Fortigate proxy.We have explisit-web-proxy policies that we normally use and its logs are sent to FortiAnalyzer . example : But we also have the Implicit Deny policy found in Firewall Policy. My problem is that the logs of the latter (Implicit Deny - Firewall Policy) appear in FortiAnalyzer and I do not want to have them because they generate confusion when analyzing the traffic in Fortinalizer.Question: how can I prevent these logs from not being sent to Fortianalyzer.Thanks for your help team   

Hello,How can I block only FaceBook Games and not entirely FaceBook? It is running latest FortiOS v6.2.3 build1066 (GA)Thank you!

HelloI see in admin guide that ZTNA tags can be with with SSL VPN to filter the traffic based on tags, but I don't find the same with dialup IPsec VPN.Is it officially supported?

Hello community. We are implementing fortigate in the OCI cloud. We have seen several tutorials that indicate that for each network I want traffic to be sent over the fortigate I need a VCN.My question is, can I create 1 single VCN Spoke and there have all the subnets I need making the traffic go through the FW. I have tested with the above configuration and sending traffic between subnets in the same spoke VCN but the FW does not do policy validation, it sends the traffic directly.

Hi! we migrate our PaloAlto firewall to Fortigate this summer (VM64 in a VMware environnement with OVH)We have some tickets already open with the fortinet support. One of the biggest problem is corrupted files over VPN.We have programmers that make backup of SQL BD, then download it to the workstation to work on it.Sometimes, the file can get really big, 20GB - 30GB or even 50GB. When we try to download over VPN there's a 50% chance that the file is corrupt. The download is completed but the checksum give an error.We try different version, 7.2.3, 7.2.4, 7.2.5, 7.4 , with or without EMS, even the free version. The policy on the firewall dont have any security activated or shaper. We have a site with a IPSEC-VPN tunnel to the same server, and there's not corruption with the same files and the same computer. Fortinet says that they never seen this! We think there's a problem between the VM and the VMware setup but not sure. Does someone had this kind of

I am facing an issue with the captive portal after updating Google Chrome. I am attaching a screenshot for reference.Help please for solving the issue.Regards,Ashik

Hello all,Our Fortigate 101E is running FortiOS 6.4.15. I understand that 6.4 is end-of-support soon, if not now. I'm wondering which version of 7.x to go with. Any recommendations? Which one is the most stable? Thanks for any input. Rod

Hi Community,I am trying to set up HA for my two FortiGate VMs running on VMware environment on OVH cloud dedicated servers. The FortiGate VMs are running on diffrenet datacenters in OVH.Problem I am running is automatic move of the WAN/failover IP from one dedicated server to another. OVH recommends use of:Custom script to detect downtime on one firewall and move the IP  via API (API failover IP move takes about 50-55 seconds to finish which means i will have up to 1minute downtime)Common Address Redundancy Protocol or CARP. (They don't seem to know if this works with FortiGate or how to set it up)My goal is to achieve active-passive failover between the two FortiGate while maintaining the same public IP.There is no issue is configuring the VMs from the VMware side to accept promiscuous mode, issue is on the cloud provider on how they handle the WAN/failover IP.Question: Has anyone encountered such a design? Is CARP feasible? Any

Hello,How we can enable automatic backup for fortinet firewall?

Hello, How we can enable the Remote Access VPN to be always ON without use Forti paid version?

We were trying to configure a Fort-Extender to our Fortigate for a project and could never get things working. So now we just want to use it in Standalone mode.  Despite doing multiple factory resets, the LAN switch settings cannot be changed from the default and one of the ports we used to connect it originally to the Fortigate cannot be changed in the web config. For references, I am seeing for example "system/management/fortigate" which it looks like I cannot remove.  Should not a factory reset remove all of this?

Hi Team, I want to setup the server for FSR Agent on Rocky Linux 9.3 version and there it has three ISO image options  1. Minimal ISO2. Boot ISO3. DVD ISO Which one will be preferable to use for FSR Agent machine spin up.   Shashank

How to access Gui Fortigate using FMG IP, just change the port on URL according to FortiManager IP

how to configure fortilink nac quarantine vlan?Configuration with fortilink nac works fine wireless and wired. onboarding vlan does the job well. But here is the point I can't understand. we are broadcasting single ssid. The device I define nac policy with the device mac address gets ip from the relevant vlan and accesses it. But how do I ensure that the device that I have never defined automatically receives ip from the quarantine vlan. because the device that we do not define cannot receive ip when connected to the relevant ssid. 

Hi there I've set a new setup up and created the SSID, and allowed access with the checkboxes.Also in the Fortigate Settings allowed listening to the services and SSID. Somehow i can't access the fortigate when i'm over FortiSwitch and FortiAP. Do i have to allow something else? my goal is, that from the internal SSID we should have access to the fortigate. And the SSID Guest don't. Kind regards

Hi, I just like to seek a help regarding on my ongoing troubleshoot about using the FortiNAC Captive Portal Login using azure AD athentication. I already follow up this steps but its seems is not working on my end Overview | FortiNAC-F 7.2.0 | Fortinet Document Library . The scenario was if the user wants to connect on Wireless connection user must have their AD account to join on the network. BTW our all product are Fortinet, Fortigate Firewall FortiAP,Fortiswitch, and FortiNAC. @ebilcari Thank you!@.>

to IT gurus.   What must be done on the Aruba switch port in order for Fortiswitch to initiate?As of right now, the Aruba switch serves as our lone connection to FortiGate while we work to manage a new Fortiswitch. See the following quick topology. Fortigate connected to Aruba ( Trunk port  Native Vlan1 ,)Aruba  ( Trunk port  Native Vlan1 ,) connected to Fortiswitch (Port 49 trunk, Native vlan1)Fortigate sees the Fortiswitch and Athorises it however its status : "offline",  "port disconnected" Logs from Fortigate:  Switch-Controller authorizedCAPUTP session status notificationSwitch-Controller Tunnel UpSwitch-Controller Switch Sync Error    - Message global-lldp-settings failed:-13Switch-Controller Switch Sync Error - Message global-lldp-profile failed:1Switch-Controller Switch Sync Error -Message qos.dscp-map failed:-7621NAC MAC cache sync - NAC MAC cache cleared on switch S14xxxxxxxxx port (null

Hi, having issues with this scenario.  I'm wondering what the best practice is... FMGR release = 7.4.3 build 2487 ADOM is created for FGT release 7.2  In this ADOM we use a Device Blueprint to import a batch of Fortigates and push the config to them (using templates).  On the Fortigates we run a CLI script to register them in FortiManager, so minimal touch is required (we plan to use DHCP option for the FortiManager settings)  However, we have a batch of Fortigates - 60F model - (unpacked - so "new") which come in release 6.4.6. When we run the CLI to register them in FortiManager, the device does not link to FMGR. I assume this is due to the fact that the ADOM is in R7.2 and the FGT is in R6.4.6 (incompatible).  Are there any best practices to get these Fortigates in FMG with minimal touch config?  I tried: - booting the Fortigates with an USB stick with 7.2 firmware, but this results in a crash of the Fortigate (fails to boot. A TFTP file

Hai my client uses a separate interface for mgmt Syslog, radius servers are behind another port on the firewall.the  source ip and interface ip mentioned is the mgmt interface and ip and its required for them,But no syslog is being send. also radius connectivity fails.There is a policy that allows traffic from management interface to the server port allowing syslog and radius. 

Hello, this morning we decided to update a FG80F cluster from 7.4.4 to 7.4.5. Stupid from my side, I did not check if the HA was synced and I did not notice anything wrong. I uploaded 7.4.5 and I lost access to the FG so that the Slave did not enter in the game. After restart of the master we still had no sign of the slave. Since this is a remote side I asked a person to remove all cables from the slave unit and try to connect via port 1 LAN but there is no ping. Than we restarted the slave thinking that it might start as master but still no access. This unit for sure did not update to 7.4.5 and being with another OS it will not work in the HA anymore. Any ideas to solve this? At the end there is just the option to access via console? Only change to reset and start HA over? Thanks!

Our customer would like to using policy by user. but don't want to use FSSO agent.So I had configuration External AD polling in connector tab.the issue is sometime user in firewall is flapping.I had create policy for user IT for remote to server. but the traffic is hit policy randomly.how can I troubleshoot user with External AD polling