Fortinet Community

HI ALL,I configured a site to site ipsec tunnel between two fortigates.site A: 192.168.0.0/24 (fortigate is 192.168.0.1, and FortiAnalyzer is 192.168.0.2) and site B 192.168.1.0/24 (fortigate is 192.168.1.1).Configured phase 2 presenting the two networks, created routes and firewall rules. Everything works fine. Clients from site B reach resources from site A and vice versa.problem: the fortigate of site B does not reach the FortiAnalyzer present in site A (192.168.0.2) unless I create a source ip option in the fortigate of site B from cli:FG70F-(setting) # showconfig log fortianalyzer settingset status enableset server "192.168.0.1"set serial "FAZ-VMTXXXXXXX"set source-ip "192.168.1.1"end Same thing for the Fabric ConnectorFG70F (csf) # showconfig system csfset status enableset upstream "192.168.0.1"set source-ip 192.168.1.1set saml-configuration-sync localend Creating these two options the Forticonnecot and Analyzer work.is this normal? did I do something wrong in the creat

I have an existing FGT 200E (Standalone).  I just purchased 2 new FGT 200Fs.  I would like to add the new FGT pair to the existing network, and slowly move each FortiSwitch and FortiAP from being managed by the 200E over to being managed by the new 200F pair.  How do I go about adding the new FGTs to the network, and slowly move each device's mgmt over to the new FGTs?  Here is my topology.  Everything in the diagram is existing EXCEPT for the new FGT pair and 1024E switches they connect to.  Those are still in a box waiting to be deployed based on the direction I get here in this post.    

I'm running a free trial with Okta, and I'm trying to configure Okta as an LDAP server to authenticate Fortigate VPN users. I have the LDAP Interface set up in Okta already. When I go to set up the LDAP server in the Fortigate, I'm getting an error each time I test connectivity:Can't contact LDAP serverAny suggestions? 

Hi all, We are using FAC for Windows MFA login, which is all good. Now, we have some users using Apple Mac OS and we are seeking a solution for Login MFA like Windows.  Is there any solution from Fortinet for Apple MAC OS to perform MFA login like the Windows agent? Thanks! Potato

Add another hair pulling situation to this fiasco of 1-on-1We're running close to 300 Windows 10/11 acer spin B3's using Fortinet for our Wifi solution on 2 physical campuses.I've updated firmware, adjusted radio signal, etc. and not really seeing any improvement. I've gotten with my ISP to check on their end, and we're getting close to 900mbps down at the modem.The "contractor" that is in charge of managing this part of the network suggested we do only a 5g band on the student network SSID, which has helped, but I feel like it's not a complete solution.This morning I got notice that the Faculty network is slow and sluggish...sure enough, running speed test on that SSID i'm getting 31 down and 28 up (huge difference).Have any of you just set your whole network to 5g and dropped the 2.4 band?

Hello everyone,I’m facing an issue with updating my FortiAnalyzer VM, which is currently running version 7.2.3. I am trying to upgrade either to the next major release or to version 7.2.4, but I keep encountering problems. The VM is hosted on XenCenter.Here’s what happens: when I initiate the upgrade, the VM reboots as expected, but then it powers off instead of completing the update. After this, I see an error message. I’m attaching a screenshot of the message for reference.Has anyone experienced this issue or have any suggestions on how to resolve it? Any advice would be greatly appreciated!Thank you in advance!

So I have some questions about BGP community-listsIs a route-map required to use with a BGP community-list? I have a single Data Center with two 10G AWS Direct Connect Circuits and the subnets on both ends are exactly the same, just a redundant path. What would the community-list on a Fortiswitch look like in this scenario taking into account AWS says to use: "Local preference BGP communities"Anyone can share the Fortiswitch commands of a working community-list? BTW Fortinet Documentation on this matter gives few details of how it is supposed to work or be configured. Where are the examples????https://docs.fortinet.com/document/fortiswitch/7.6.0/fortiswitchos-cli-reference/912449/config-router#config12AWS docs sent by AWS Engineer:https://docs.aws.amazon.com/directconnect/latest/UserGuide/routing-and-bgp.html#bgp-communities-private-transitYou can use local preference BGP community tags to achieve load balancing and route preference for incoming traffic to your network. For e

Dear Team, I am testing FortiPAM 1.3.0 version to integrate with Checkpoint Smart console. When i tried to launch the checkpoint smart console from PAM console it just popups loading and not opening.  Could you please help.    

HiWe are getting the below error while login home page for authentication. Your connection is not privateAttackers might be trying to steal your information from www.example.com (for example, passwords, messages, or credit cards). Learn more about this warningnet::ERR_CERT_AUTHORITY_INVALID Please help me how to address the issue. 

Hello All Can I Upload AutoCAD file using the heatmap file

Hello community,   we would like to configure our fortigate 100F SSLVPN Access with SAML and MS Entra. Unfortunately, we get the following prompt    We use the following MS Node: https://learn.microsoft.com/en-us/entra/identity/saas-apps/fortigate-ssl-vpn-tutorial Is it important, that we use a entra Plan or is the free Version okay? We use M365 business St. 

Hi, Is there any configuration to activate the "Log Search Task" or "Advaced Search..." in Fortimail 6.4.7 firmware version?We need obtain history logs from more than 1 month last, but these firmware version only permit obtain logs from 1 month last.Could you help me with this, please? Thanks for all.Best regards.

This isn't a production environment.  Just playing around at home, but I can't seem to get it to work. I have a 30E with the two built in mobile Fortitokens.  I assigned a mobile token to a local user.  Loaded the App onto my Android phone and linked it via the QR code.  Configured a basic SSL VPN portal. When I login it asks me for a user/pass, then I enter the token from my app.  It gives me an error "Invalid HTTP request". If I disable two-factor for that local user I can login to the portal no problem and access resources. I can't seem to find any logs indicating any issue. What should I check?  FortiOS 6.2.2 on a FortiGate 30E.

Hello FortiGate Community,I have a question regarding my High Availability (HA) setup with two FortiGate Firewalls configured in Active-Standby mode, along with multiple Virtual Domains (VDOMs).In my configuration, I have established an NPU VDOM link and created a policy to enable internet access, which works correctly. However, I encountered an issue when I reboot the active unit. The active unit goes down, the standby becomes active, and I receive an alarm indicating a loss of connectivity to central management for approximately 10 minutes before it stabilizes.To ensure proper functionality, I would like to confirm if the IP address configured on the NPU VDOM link of the active firewall should be the same as that of the standby unit. Should both firewalls use the same IP address for the NPU VDOM link, or should they have different IP addresses?Thank you for your assistance!

I currently have a campus network with a standalone Fortigate 200E. It uses fortilink to manage 25 FortiSwitches and 35 FortiAPs.  I just purchased 2 Fortigate 200Fs that I plan on configuring in HA.  What is the best way to replace the 200E with the new fortigate pair?  I will need the new Fortigate pair to start managing all of the FortiSwitches and FortiAPs. Another option is to leave the existing Fortigate 200E in place temporarily, and add the new Fortigate 200F pair to the network as well.  Then, move the management of the FortiSwitches and FortiAPs to the new FGT pair.  

I work on a Mac (Apple M1 Max, macOS Sonoma 14.6.1) and use FortiClient.app for VPN  (version 7.4.0.1645) access to my work network. When I enter my credentials, a window (see screenshot) pops up very quickly. Previously, it used to wait for me to enter the requested token or approve it on my mobile device. However, now I cannot connect to the VPN service. I followed the instructions in this video, but they seem quite outdated. I tested it on my older Mac, and everything appears to be working fine. I've tried reinstallation several times.Here's my fortitray.log:   20240924 01:03:34 TZ=+0100 [FortiTray:DEBG] VPNMessageBridge.m:491 Request VPN statistics 20240924 01:03:42 TZ=+0100 [FortiTray:INFO] VPNMessageBridge.m:434 Request VPN connect 20240924 01:03:42 TZ=+0100 [FortiTray:DEBG] VPNMessageBridge.m:465 VPN profile: MEH 20240924 01:03:42 TZ=+0100 [FortiTray:DEBG] VpnManager.swift:228 Ignore Secure compliance Check as FCT is not connected to

Hello Fortinet Community, I've been reading https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Configure-FortiNAC-Tags-with-FortiOS-7-2-4-GA/ta-p/255138 on configuring FSSO tags with FortiOS 7.2.4 and https://community.fortinet.com/t5/FortiNAC-F/Technical-Tip-Connector-based-FSSO-vs-Fabric-Based-with-FortiNAC/ta-p/31610on Connector-based FSSO vs Fabric-based SSO.Is it correct to understand that Connector-based FSSO will be deprecated soon, possibly even removed from CLI configurations? Should we be configuring Fabric-based SSO for new deployments instead? With FortiGate and FortiNAC using a persistent agent setup, how can we propagate AD User/Group information to FortiGate without Connector-based FSSO? Currently, with Fabric-based SSO I only receive Dynamic-FortiNAC Tag. Looking forward to your insights!Thank you! 

HiCan fortigate firewall add a feature?A map of Specify MAC Network access actions and analyze the status of  workfor example 【MAC XXXXX】7:00  XXXX7:15  XXXX 【analyze the status】HTTPS     3HGame online  2HShopping online   2H  From China JiangsuThanks   

Dear Team, we are facing issue to access viber application from client and we have configured sdwan and applied polcy for this . but it not working . please suggest how we can bypass the traffic . thanks Umesh

I'm trying to deploy a Fortiextender 311F (7.4.6) on LAN managed mode with an Fortigate 100F(7.0.14). I follow this kb with a few differences and works perfect at the begining but i found a problem. The difference was on the configuration of the extender interface on Fortigate side, I turned on the DHCP Server, to make the devices connected on remote side takes an spcifict scope. This work fine if the remote device is connected once the connection between the extender and fortigate was established. If the remote devices is connected before the connection is established (FEX<->FG), the externder assing an IP of the default DHCP Server configured on de lan switch (192.168.200.0/24) and when finaly the FEX will connect with de gate, the device not renew his IP with de properly IP configured on the Gate becase the local link never lose. This problem detected by rebooting the extender (simulating a power off), since the connection with the gate takes a little (2 -

We have FortiClient EMS on version v7.2.4 with 750 FortiClient EPP licenses. The product is tightly integrated into our Fortinet Security Fabric and connected to AD. Everything works relatively well and serve the purpose. FortiClilent EMS v7.4.0 is the whole new beast; migration process from Windows-based EMS to Linux-based seems to be overly complicated. I am wondering, is it worth an effort migrating to v7.4.0? Or, perhaps, better wait, and upgrade it to v7.2.5 for now? Did anyone went through EMS migration to v7.4.0?VA Thank you for any feedback,

Hi All,Please can anyone provide assist whereby im unable to block Monkey.app on mobile devices. im unable to pick it up on app control. any alternations. i did block on web filter which works perfect. just need to block on devices?

Hi i would like to know if fortiXDR can protect against apc or is some device in fortigate than can protect agains apc ? 

I have a Fortigate 231f access point device. I have 500 mbps internet. When I test with 2.4 ghz near the access point device, I can't get over 80 mbps. What could be the reason for this?

Hi folks,I am sure this is a very simple to solve problem, but we are unable to find, where to set the correct timzone of our 360 Degree Activities Report on our FGT80F. The FGT80F itself is correctly configured (timezone), but we are getting our reports with US/Arzizona timezone, which is not the timezone we have (Europe/Berlin would be the right one). What are we doing wrong? Perhaps you can tell me, what we have to do, to set it up with the correct timezone. Thank you very much.. Atm its looking like that (wrong timezone)