Fortinet Community

Hello community,   we would like to configure our fortigate 100F SSLVPN Access with SAML and MS Entra. Unfortunately, we get the following prompt    We use the following MS Node: https://learn.microsoft.com/en-us/entra/identity/saas-apps/fortigate-ssl-vpn-tutorial Is it important, that we use a entra Plan or is the free Version okay? We use M365 business St. 

Hi, Is there any configuration to activate the "Log Search Task" or "Advaced Search..." in Fortimail 6.4.7 firmware version?We need obtain history logs from more than 1 month last, but these firmware version only permit obtain logs from 1 month last.Could you help me with this, please? Thanks for all.Best regards.

This isn't a production environment.  Just playing around at home, but I can't seem to get it to work. I have a 30E with the two built in mobile Fortitokens.  I assigned a mobile token to a local user.  Loaded the App onto my Android phone and linked it via the QR code.  Configured a basic SSL VPN portal. When I login it asks me for a user/pass, then I enter the token from my app.  It gives me an error "Invalid HTTP request". If I disable two-factor for that local user I can login to the portal no problem and access resources. I can't seem to find any logs indicating any issue. What should I check?  FortiOS 6.2.2 on a FortiGate 30E.

Hello FortiGate Community,I have a question regarding my High Availability (HA) setup with two FortiGate Firewalls configured in Active-Standby mode, along with multiple Virtual Domains (VDOMs).In my configuration, I have established an NPU VDOM link and created a policy to enable internet access, which works correctly. However, I encountered an issue when I reboot the active unit. The active unit goes down, the standby becomes active, and I receive an alarm indicating a loss of connectivity to central management for approximately 10 minutes before it stabilizes.To ensure proper functionality, I would like to confirm if the IP address configured on the NPU VDOM link of the active firewall should be the same as that of the standby unit. Should both firewalls use the same IP address for the NPU VDOM link, or should they have different IP addresses?Thank you for your assistance!

I currently have a campus network with a standalone Fortigate 200E. It uses fortilink to manage 25 FortiSwitches and 35 FortiAPs.  I just purchased 2 Fortigate 200Fs that I plan on configuring in HA.  What is the best way to replace the 200E with the new fortigate pair?  I will need the new Fortigate pair to start managing all of the FortiSwitches and FortiAPs. Another option is to leave the existing Fortigate 200E in place temporarily, and add the new Fortigate 200F pair to the network as well.  Then, move the management of the FortiSwitches and FortiAPs to the new FGT pair.  

I work on a Mac (Apple M1 Max, macOS Sonoma 14.6.1) and use FortiClient.app for VPN  (version 7.4.0.1645) access to my work network. When I enter my credentials, a window (see screenshot) pops up very quickly. Previously, it used to wait for me to enter the requested token or approve it on my mobile device. However, now I cannot connect to the VPN service. I followed the instructions in this video, but they seem quite outdated. I tested it on my older Mac, and everything appears to be working fine. I've tried reinstallation several times.Here's my fortitray.log:   20240924 01:03:34 TZ=+0100 [FortiTray:DEBG] VPNMessageBridge.m:491 Request VPN statistics 20240924 01:03:42 TZ=+0100 [FortiTray:INFO] VPNMessageBridge.m:434 Request VPN connect 20240924 01:03:42 TZ=+0100 [FortiTray:DEBG] VPNMessageBridge.m:465 VPN profile: MEH 20240924 01:03:42 TZ=+0100 [FortiTray:DEBG] VpnManager.swift:228 Ignore Secure compliance Check as FCT is not connected to

Hello Fortinet Community, I've been reading https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Configure-FortiNAC-Tags-with-FortiOS-7-2-4-GA/ta-p/255138 on configuring FSSO tags with FortiOS 7.2.4 and https://community.fortinet.com/t5/FortiNAC-F/Technical-Tip-Connector-based-FSSO-vs-Fabric-Based-with-FortiNAC/ta-p/31610on Connector-based FSSO vs Fabric-based SSO.Is it correct to understand that Connector-based FSSO will be deprecated soon, possibly even removed from CLI configurations? Should we be configuring Fabric-based SSO for new deployments instead? With FortiGate and FortiNAC using a persistent agent setup, how can we propagate AD User/Group information to FortiGate without Connector-based FSSO? Currently, with Fabric-based SSO I only receive Dynamic-FortiNAC Tag. Looking forward to your insights!Thank you! 

HiCan fortigate firewall add a feature?A map of Specify MAC Network access actions and analyze the status of  workfor example 【MAC XXXXX】7:00  XXXX7:15  XXXX 【analyze the status】HTTPS     3HGame online  2HShopping online   2H  From China JiangsuThanks   

Dear Team, we are facing issue to access viber application from client and we have configured sdwan and applied polcy for this . but it not working . please suggest how we can bypass the traffic . thanks Umesh

I'm trying to deploy a Fortiextender 311F (7.4.6) on LAN managed mode with an Fortigate 100F(7.0.14). I follow this kb with a few differences and works perfect at the begining but i found a problem. The difference was on the configuration of the extender interface on Fortigate side, I turned on the DHCP Server, to make the devices connected on remote side takes an spcifict scope. This work fine if the remote device is connected once the connection between the extender and fortigate was established. If the remote devices is connected before the connection is established (FEX<->FG), the externder assing an IP of the default DHCP Server configured on de lan switch (192.168.200.0/24) and when finaly the FEX will connect with de gate, the device not renew his IP with de properly IP configured on the Gate becase the local link never lose. This problem detected by rebooting the extender (simulating a power off), since the connection with the gate takes a little (2 -

We have FortiClient EMS on version v7.2.4 with 750 FortiClient EPP licenses. The product is tightly integrated into our Fortinet Security Fabric and connected to AD. Everything works relatively well and serve the purpose. FortiClilent EMS v7.4.0 is the whole new beast; migration process from Windows-based EMS to Linux-based seems to be overly complicated. I am wondering, is it worth an effort migrating to v7.4.0? Or, perhaps, better wait, and upgrade it to v7.2.5 for now? Did anyone went through EMS migration to v7.4.0?VA Thank you for any feedback,

Hi All,Please can anyone provide assist whereby im unable to block Monkey.app on mobile devices. im unable to pick it up on app control. any alternations. i did block on web filter which works perfect. just need to block on devices?

Hi i would like to know if fortiXDR can protect against apc or is some device in fortigate than can protect agains apc ? 

I have a Fortigate 231f access point device. I have 500 mbps internet. When I test with 2.4 ghz near the access point device, I can't get over 80 mbps. What could be the reason for this?

Hi folks,I am sure this is a very simple to solve problem, but we are unable to find, where to set the correct timzone of our 360 Degree Activities Report on our FGT80F. The FGT80F itself is correctly configured (timezone), but we are getting our reports with US/Arzizona timezone, which is not the timezone we have (Europe/Berlin would be the right one). What are we doing wrong? Perhaps you can tell me, what we have to do, to set it up with the correct timezone. Thank you very much.. Atm its looking like that (wrong timezone) 

Hi,This is a question of using Fortigate in the context of allowing in SIP traffic.But then getting the firewall to dynamically open and close pinhole ports for RTP under AWSTo try and explain our setup first we have an AWS EC2 instance that ether receives phone calls or makes outgoing phone calls to a VoIP provider on the internet.As part of this we want to make the setup PCI compliant and with PCI compliance ideally you don't want to just leave a bunch of ports open for outbound RTP all the time.There is one problem though in that any traffic coming into an elastic / external IP under AWS is automatically statically 1:1 NAT'd to the internal IP after it arrives.This creates something of a mismatch between the destination IP inside the Sip packet and the UDP destination IP address.The end result of what we've tried so far:SIP traffic on port 5060 arrives at AWS on ElasticIP1AWS then automatically translates the destination IP for the packet from ElasticIP1 to InternalIP1Traffic is rou

I have disabled my Fortinet Firewall's public IP to be accessed from outside the network. I want to allow the public firewall IP to be accessed from the internal network.

We are doing some phone changes with our ISP. We need to know if PVC-100DB supports both POTS and SIP simultaneously? Or will we need to toggle between the 2 modes?

Hi Everyone,unfortunately I have some issues with FortiClient 7.4. It freezes during "connecting" and nothing more happens. For my colleague it works with the version 7.2.4. So could someone please provide me with this Installer?Thanks and kind regardsJan

I have a FortiSwitch 108E-FPOE.  Its bran new.  I have a RJ-45 to USB Console cord.  I've tested the cord and it works great on my FortiGate 60e.  When I connect it to the switch (I use PUTTY, it doesn't error when I connect), I hit enter and nothing happens.  I reboot it while its connected and I get characters like this "$Y▒▒y▒▒Z▒▒[", instead of any boot messages.  I have already updated its firmware and it's running v6.4.1,build0411,200409 (GA).  I (unfortunately) did not check the console connection before the firmware update. After updating the firmware through the IP, I tried to set it up as a Managed FortiSwitch.  Ss soon as I setup the FortiLink Interface, it was never heard from again.  I waited for several hours but it never connected to the forigate, I was never assigned an IP from it, through any of it's ports; I couldn't assign an IP to myself and get in through the default IP or through the subnet created from th

We have a Fortigate FWWe have a Forinet AP which we have setup with domain and guest WIFIThe AP WIFI is on a different IP rangeThe device connects to the staff WIFI and the domain can be seen all network drives etc.I am unable to connect to this device via Ultra VNC from our other devices on the LAN - which we will need to be able to do.I went through looking at creating a VIP and attempting to set a policy and using that as the destination but from what I have read this cannot be done anymore in forti OS I am struggling so if anyone could assist? Thanks

Hi All,I am new to this forum, I am trying to setup VPN connection between Nokia 7750 SR router to FortiClient VPN,below are the config settings. Please note:- This issue happen only Option DHCP is selected, the VPN tunnel comes up correctly when manual IP is selected. Forti VPN Client:-Authentication Method:- Preshared KeyEAP is disabledIKE version - 2Options :- DHCPPHASE-1Encryption:-  DES Authentication :- DESEncryption:-  DES Authentication :- DESDH Group:- 1key Life:- 86400No Local IDNo DPDNo NATNo Enable Local LAN Phase2 :- Encryption:-  DES Authentication :- DESEncryption:-  DES Authentication :- DESKey Life:- 43200No Relay DetectionNo PFS 7750 Router is config as IKEv2 with all the config matching to FortiClient VPN. For DHCP option router is dumping below messages. failed because ipsec-gw has local-address-assignment configuration but IKE_AUTH did not contain a config payload." Please find the attached screen shot of all t

HI,I need help where I can download firmware for the 140D POE model, thanks for the help

I am a BIG supporter of Central NAT.  I believe it is in-line with the present day firewall platforms.  Even if you use Policy NAT (the original way on FortiOS) or Central NAT you normally want bidirectional NAT'ng, that is SNAT and DNAT. DNAT / VIP There is a feature on the CLI of the VIP which makes the VIP bi-directional.  That command is set nat-source-vip enable.  This is NOT enabled by default.  You can get to the VIP settings by right-clicking the VIP and choosing edit in cli Once you are in the cli you can type set ? and it will show you all of the set options available to you.  You can also give the show full to see all the options, default and or custom. The other option you can type is tree which gives you the entire command structure for that section. Once you shell out to the cli FortiOS will show you the basic configuration for that VIP config firewall vip edit "OBSER" set uuid 169ccfa6-a

Hi guys, We have a requirement to have a very minimum traffic loss failover in our environment for an broadcast audio system. We have two Hub sites running ADVPN and multiple spoke sites running ADVPN + iBGP.We have chosen lowest cost SLA as the criteria so that the best link is chosen based on latency.These are the settings for the health check and service rules on the spoke side. config health-checkedit "HUB1_HC"set server "172.30.255.253"set update-cascade-interface disableset update-static-route disableset sla-fail-log-period 10set sla-pass-log-period 10set members 6 4 5 10config slaedit 1set link-cost-factor latency packet-lossset latency-threshold 500set packetloss-threshold 10nextend config serviceedit 3set name "DC_RULE"set mode slaset dst "DC_Network"set src "all"config slaedit "HUB1_HC"set id 1nextendset priority-members 4 5 6 10nextend The latency between the spoke and Hub is between 50ms and 100ms. Default iBGP settings are used. For testi