Fortinet Community

Hi, has anyone been able to (or even tried to) convert a running instance of a FortiNAC appliance running in a VMWare environment to a Hyper-V environment?  We're looking to move away from vmware and I was curious if I could just move it like I did my windows machines.  Any suggestions / tips / words of wisdom are appreciated. --mike

HI,I have problems with the credential cache of the mfa vpn with okta, in the sense that the first login with mfa works correctly but if I disconnect and try to reconnect the forticlient dosentt ask me for the credentials or the mfa and it connects without asking me anything, I I was wondering if on the okta/fortigate side I can configure something that forces forticlient to request the mfa login every time without having to delete the forticlient cache file. I use the free forticlient version. Thanks in advance. Giuseppe

I have configured the SD-WAN, but unable to create the static route it gets this error  "You cannot have duplicated routes on SD-WAN and non-SD-WAN interfaces.object set operator error, -9100 discard the settingCommand fail. Return code -9100" i couldn't see such route either in GUI or in CLI

Hello, we have a FG80 we are using for testing and it has no valid licence. This FG always had 2FA with FortiToken. Now I wanted to change the Token but it will not be sent. I tried with my mail and also with Gmail account and via SMS and I dont get anything. Is this something they removed because of no valid licence? Thanks 

Hi everyone, We just configured our SSL VPN with SSO/SAML and are facing issues. Some users get stuck at 40% after logging in with their Entra account and going through the MFA process while others are able to connect without any problem. When it gets stuck at 40%, we don't see any logs on the Fortigate, but we can see that it went through the Entra App successfully. We are using a custom port, Let's Encrypt Cert and we disabled the web mode for the split-tunnel.The users with issues are in the same group as the one that works successfully. FortiClient is V7.4.0.1658. Fortigate 101F is v7.2.9.  Thanks

Hello, I am looking for older version of FortiClient VPN. Can someone please help me with the information about where I can get the software. It's so important for my jobThanks

Hi All,  I'd like to preface by saying that I'm running FortiOS 7.4.5 and FortiClient EMS 7.4.0 As the Title suggests, I'm attempting to allow users to connect to in office printers over ZTNA proxy. This is the client ask, and I'm not entirely sure if it's feasible yet. The printers are connected to a windows print server. Would I need to open up line of sight to the individual printers, or could I just open ports to the print server itself. Currently, I have 445 open to the print server, so I can see the shared printers, however I'm not able to install them. Any feedback or information would be helpful.Thank you

Hi all, I am using FortiGate 50A with 2.50 MR9. This FortiGate is using PPPoE connection. I found that MTU didn' t change even I set to override default MTU value. If ISP use MTU value 1492 and I set to use 1400, the result MTU is still 1492 after connected. So, how can I enforce FortiGate to use my own MTU setting? Thank you Martin

Current fortinet 61F firmeware version 7.0.11 for wireless using FAP U323EV to 7.0.132 version, I have configured 2x ssid guest for tunnel and another one for brdige mode most of them works during the night time and next day morning it stopped broadcast the SSID.also found out some forward traffic logs where it showing FORTI-AP interface is not able to talk to DNS whil

Dear Team, In FortiPAM i provided the User A to  access secrets to Launch Secret, in  the same time i need to stop view options to secret for User A. Is it possible ?PFA for reference.

Hello everyone, I’m trying to set up VLAN over IPSEC using VXLAN on my FortiGate, but I’m facing issues where the tunnel doesn’t seem to work as expected. The tunnel comes up, but traffic from the VLAN doesn’t seem to pass through. I’ve tried troubleshooting using various methods, but I haven’t been able to resolve the issue.  Here’s the configuration I’m using for VXLAN 506: On site A :config system interface edit "IPSEC_VXLAN" set vdom "VDOM1" set ip 10.5.5.1 255.255.255.255 set allowaccess ping set type tunnel set remote-ip 10.5.5.2 255.255.255.252 set snmp-index 42 set interface "vlnk_HYP0" next end config system interface edit "VLAN_506" set vdom "VDOM1" set role lan set snmp-index 506 set interface "port1" set vlanid 506 next end config system vxlan edit "VXLAN_506" set interface "IPSEC_VXLAN" set vni 506 set remote-i

Hello everyone, I'm currently using FortiManager 7.4 with two connected FortiGate devices. I had two separate firewall policies for each device, and I am trying to merge them into a single policy package. My goal is to push this policy package to both FortiGates, ensuring that only the necessary rules are applied to each device. However, during the policy installation process, I encounter the following error message: "The following ADOM interfaces have no mapping. All ADOM interfaces should be mapped before continuing with installation." In each block I have framed, the interfaces do not exist locally, but they are present in the remote device. What is wrong? Any ideas? Thanks for your help!

Hello Community. I have been using FortiClient since MacOS Catalina, until then everything was perfect, then from BigSur, everything was wrong. It does not work or simply the solutions that exist in the forums do not work or are incomplete.. I am currently running MacOS Monterey 12.4 and FortiClient 7.0.5.0166. I have this error when establishing the remote connection via VPN "Login failed. Insufficient credential(s). Please check the password, client certificate, etc."  Searching in Internet and this forum itself there are "solutions" of this type: Manually add a number of services from the FortiClient package with full disk access. This is an official note from the provider's documentation. URL:https://docs.fortinet.com/document/forticlient/7.0.5/macos-release-notes/223986/special-noticesApply the accesses from the previous point, uninstall FortiClient and reinstall FortiClient.I have applied both and it doesn't work. The strangest thing about this behav

Hello.I have a question about Ha being out of sync.Added user objects and groups to the portgate.Immediately after that, it was not synchronized.I deleted the object I created after HA was out of sync and it was resynchronized normally.As before, when you create a user object on the master equipment and then use the Run ha Sync Start command to add/delete the user object, the synchronization was not broken.Does anyone know why HA doesn't sync when creating objects?If anyone knows about this issue, I would appreciate it if you could let me know the cause and how to respond.

hi, can someone please advise whether the fortigate will deep analyze the packets if no security profile is applied? or just check based on the source destination IP and service port only? thanks in advance!  what is the standard process when the packets go through the fortigate? 

Hi, we are having fortiwifi 40F and created bridge ssid on local wifi radio platform.Unable to add that bridge ssid into the AP profile. It shows only tunnel ssids.Please guide. 

Hi all, I'm fairly new to the Fortinet suit of security devices. I have set up a scheduled SFTP backup on the FortiAnalyzer and FortiManager which was very simply to do. Locally, the SFTP password is hashed in the config, lovely. However, Fortigate appears to be a different story. To achieve a “Fortinet native” solution of a scheduled/automated backup. I looked at automation stitches, unfortunately the "cli script” option requires the SFTP password to be stored in clear text.  Does anyone know of any other “Fortinet native” solution to schedule automated backups to SFTP servers on Fortigates without having to store the SFTP password in clear text? Just not acceptable to store passwords in clear text in my opinion and against policy in general. My next stop is to move the automated backup process out of the Fortigate environment and move it to a netmiko/paramiko python solution. I would prefer an “in product” solution. Currently using v7.0.7. Thanks,&n

Fortigate  does not re-evaluate the routing table for connection-less protocols unless the session is terminated? . ICMP and UDP are considered connection-less protocols by the Fortigate  . This means that once the initial session is established, Fortigate  continues to use the same egress interface, provided it remains available in the routing table. Fortigate  does not re-evaluate the routing table for connection-less protocols unless the session is terminated ? 

Hey, we have 2930F Switches and working well with FortiNAC. On the other hand, we have 6100s working on Aruba Central with these settings (screenshots) on FortiNAC and working well too. So device profiling rules and others are set. We put 4100 to the location but have a problem. If we set none group memberships and set a manually vlan then no problem but when force to register then not getting vlan. This is the FortiNAC settings;   And this is the 4100's configuration for port authentication (ofc radius server added in the config); aaa authentication port-access dot1x authenticator enable aaa authentication port-access mac-auth auth-method pap enable interface 1/1/5 no shutdown vlan access 1 aaa authentication port-access auth-precedence mac-auth dot1x aaa authentication port-access dot1x authenticator cached-reauth quiet-period 10 reauth enable aaa authentication port-access mac-auth cached-rea

Hi ,     We have a Fortigate 90E , when i try to create a new VLAN configuration in any one of the physical interface , i'm not able to get internet while directly connecting the port and laptop with a working ethernet cable. Anyone has faced this issue ?

Hey everyone,So I need some help/guidance in figuring this out. I have deployed plenty of FortiGate's at the physical level but have never done a Cloud Firewall deployment and I am little bit confused. We just finished deploying and setting up some FG200Fs across 7 locations. We have SD-WAN and ADVPNs setup for all the locations.I need to now deploy a FW into an existing Azure environment. Right now one of the resource groups and VNETs is being used as the Hub which only the locations that need access to the apps are connecting to via an IPSEC tunnel.So now we want to install the FW in place of that hub. I can create a new VNET and RG for the firewall, but I am thinking it's just easier to drop it in there. I know I will need a new PIP for the firewall, but my question comes to the rest of the VNETS. The firewall is asking for an External Subnet, Internal Subnet, and Protected Subnet. This is where I get confused.How do I get the existing VNETS to work with this? Any help or guidance w

I newly deployed Fortigate FG40F Firewall with predefined policies. I want to register the device and enable Forti guard subscription services. Do i need to enable the licenses as well?

Hi, i'm experiencing something strange...  Fortigate 1800F clustered running 6.4.12 (planned to be upgraded in October to 7.0.15)I'll narrow it down to it's most simplistic form...Two user vlans A and BOne server vlan CWhen running iperf between user vlans and server vlan C i see a considerable downgrade in download performance from vlan A.  Upload is perfect and saturates the 1 GBit interface.I don't see this issue from vlan B.  Both download and upload saturate the 1 GBit interface.All vlans go into one single trunk which is aggregated.  I ruled out switching.Strangely i see the issue dissapear after working hours.  Both upload and download saturate the 1 GBit interface from vlan A. Did a wireshark today during business hours in vlan A while running iperf.  Saw a lot of fast retransmissions, dup ack, tcp previous segment not captured, tcp out of order...   Reviewed the complete Fortigate vlan config.  Did not see anything wr

Hi, I noticed that in the most recent firmwares of Fortigate (I think from 7.0 or 7.2 onwards) many screens of the FortiExplorer program for Android do not load. The interfaces, for example, load correctly because they are displayed by the software itself: Ok interfaceswhile most of the other screens that are "rendered" by an internal browser of the program, do not load: problemThese screens that do not work are for example all those of Fortiview and Monitor.I tried more smartphones and more Fortigates by connecting to the local network and the problem is the same.

"Hello everyone,Currently, my company is using a Cisco 5525x FMC firewall system. In the near future, I am considering migrating to a Fortigate firewall system. However, I’ve encountered an issue that I haven't been able to resolve: when standing on the Fortigate firewall, I can't see the MAC address, domain users, or the OS of the devices. I know that using the firewall as the gateway could resolve this issue, and since the company’s system is relatively small, I have configured it this way—allowing the firewall to manage and detect all devices it scans. But that setup only works for smaller systems.For larger systems, I’m not sure if the firewall would be more powerful than the core switch. Therefore, I’ve set the core switch to handle IP address assignment, with the gateway being provided by the core. As a result, my internal users don't pass through the firewall when accessing the server for work, making the process faster. However, when users browse the internet or when I want to