Fortinet Community

Hello team, This is a stack with 2 Fortigates 100F (A-P)We found in "FortiView - Sources", a machine with "30" in the column "Threat score", all the others had 0When I drill down, I found the followingThis was: biserka.xyz (phishing).I have tried to find any log with more information about this but without luck.¿Do you know where can I find more information? Thanks in advance.Regards,Damián

Hi all, I am adding an SDWan overlay onto remote sites, and so I had hoped to build a secondary VPN ipsec tunnel and add to the SDWan zone, and then shut the original tunnel and bring up the new. Both tunnels are therefore using the same ISP, to the same destination core site.  Both have different passwords and different ike versions My problem is that, the new tunnel will not connect to the core at all.  I see no port 500 connections even being initiated. I cannot understand why the new one won't even attempt to reach the core, even if I disable to original VPN interface 

Whilst working on some VPNs, I noticed something odd, I have my FortiGate acting as a Hub for some branch sites, using BGP over the tunnels. I added a new site to site VPN for some other traffic and I noticed it got added as a spoke on the Hub and Spoke config? I deleted it from there but it then deleted the BGP config as well! its nothing to do with the hub and spoke set up, so why is the site to site VPN peer going in there?

I have a fortigate 100f and a fortigate 201F , Fortigate 100F has a 2 vdoms root,QA1 . Under QA1 there is a loopback interface Test created and I want to perform IPsec tunnel between these 2 firewalls using test interface as source , Please help me to achieve this

Hi,I'm new with Fortigate and migrating from ASA world.  I'm a little surprised that the fairly basic configuration causes difficulties even for vendor.The question is: Does version 7.x support setup where traffic should travel from policy-based tunnel to policy-based tunnel and where the NAT should be used for source address. If so, is there any document to follow so that the implementation would be done correctly?  Already found some articles but still wondering do I need VPN Concentrator config to enable traffic flow between tunnels?  

Hi,I would like to manage my switches from the FMG but many options are lacking, especially the "Block Intra-VLAN traffic". Same for SSIDs and "Block Intra-SSID traffic". How to enable these from the FMG ?Thank you.

Hello Fortinet Community, I’ve deployed the FortiNAC Persistent Agent and implemented compliance scans to ensure our systems are secure. Our policy is to delay operating system updates by one month, but we want antivirus signatures to always be up-to-date. I understand it's possible to delay OS definitions downloads, but this also delays AV updates.Is there a way to configure compliance scans to check that the OS has all critical updates with a one-month delay while ensuring AV signatures are always the latest? Any guidance or best practices would be appreciated!Thank you!FortiNAC 

I want to do wireless mirroring from laptop to TV in the organization. but the connection is constantly dropping. Or there is a lot of loss. This does not happen when I try on a different device. What settings should I look for in the firewall for broadcasting?

Hi, we use this HA FG81 cluster in one office with 30-40 people (no VPN, normal usage, % 2000 sessions, etc.). We experienced now that with every new 7.4.X update we increase memory usage so that now we have like 75% memory usage.We did already some changes with some CLI commands but only disabling IPS would affect the memory and now we are at 68% with no IPS in all polices. We kind of can live with that, but can we expect now with every update more memory usage? Thanks,  

Hi I'm setting up a new fortigate and fortiswitch.  Actually upgrading from 100e 100f.  we are able to convert fine and 100f is working fine. the network is on hardware switch and contains the dhcp.  we have about 40 users connected to the fortiswitch and are actively getting internet and dhcp from fortigate is working.  The issue is fortiswitch is showing offline although all ports are on.  We tried everything from ntp ect....but nohing is working.Also when I do troubleshoot on fortiswitch i get the following  "Failed to fetch registration information"Any idea? Thanks

Windows 11 (intune enrolled), FortiClient 7.4.0.1658.If I setup a VPN that doesn't have a certificate associated with it, I have no issues.But if I associate a certificate with a connection, about 2 seconds later the console crashes. If I open it up again, it will crash a couple of seconds later.It doesn't log an error at the time it crashes.I have to uninstall and reinstall again to get it stable again but can't associate the connection with a certificate.Anyone got any thoughts? 

Hello,Not sure if this is the right place to put this, but I've noticed major issues with FortiClient SSL-VPN connections from MacOS on FortiGates running 7.2.8.Right after the upgrade, users started getting disconnected every 5-10 minutes with no disconnections or errors showing in the FortiGate logs. I tested with various FortiClient VPN versions (as low as 7.0 versions and as high as 7.4 versions), but had the same behavior for all.Eventually I've had to downgrade to FortiOS 7.2.7, and SSL-VPN works without a problem for the same users, with no changes on the endpoint side.Is this issue on Fortinet's radar? If so, any fixes in the works?

I am trying to make authentication using free radius server with fortigate , I can send ping between fortigate and ubuntu machine which freeradius run on it , but when I trying to add radius server from USER,Devices section the server can not be reach , and there  is no any request coming to free radius from fortigate ,I don;t know why is that , I can send ping but can not reach radius server

 I am trying to get SSO for my WIFI with Azure AD. I created an Azure Enterprise Application and assigned Users. I set up SSO in Fortigate.I created a usergroup in Fortigate.I created Policies to use that group for Wifi accessI added that group to the SSIDI set the Captive Portal to Disclaimer (for debug reasons) and when I accept the disclaimer, I am forwarded to login.microsoft.com - but there I get a certificate error because for some reason, Fortigate seems to replace the IDP certificate (that I of course added to the appliance) with the Fortigate Factory Certificate. I am at a loss here as I do not understand, where and why the certificate gets replaced... Can't find anything in the forums or anywhere online, I have been searching for 3 days now... 

It appears to be the session that is cleared, so it disrupts everything that device is currently doing for several seconds until the sessions are recreated. I can see these logs under system events:User: from cw_acd clean active IPv4 sessions,( filter:vd:0;source ip:172.30.100.10-172.30.100.10;) And then these logs under WiFi Events:Client 1c:1a:df:82:7b:74 de-authenticated.Action client-deauthenticationReason Previous authentication no longer valid For all devices connected to WiFi and at exactly 00:00 every day. FortiGate is a 61E running 7.0.3 and the FortiAP is a 221E also running 7.0.3, but it has happened on all versions of 7.0.x that I can remember. Anyone have any suggestions how to diagnose or where to look next since I am stumped? Regards, Thomas. 

We have existing Fortiswitch that is connected to a Cisco ASR. The Cisco has the layer 3 interfaces and IP's assigned for WAN and vlan subnets. We want to now install a second FortiSwitch, use the layer3 capabilities and use vrrp to make the link redundant (will convert existing Fortiswitch after configuration for new Fortiswitch is working). We have installed a 2nd circuit and will configure it to this second Fortiswitch that will now handle layer 3.In essence, we want the Fortiswitches to be redundant on the LAN side to handle Vlan's (is that MCLAG?) but also be redundant  but have a unique path out layer 3 to AWS. Each Fortiswitch has a separate layer 3 Circuit to AWS and I want to know if this can be Active/Active to use both circuits or only active/passive. The internet side is 10G for both circuits.Please let me know if this makes sense. Can anyone share a similar config?Redundant

Hello,I want to implement FortiAuthenticator saml authentication for OWA Exchange login. Can I implement OWA MFA using FortiAuthenticator SAML? FortiAuthenticator 

Scenario:I have a network setup consisting of a FortiGate , FortiSwitch and multiple FortiAP . The connections are as follow:FortiGate:Port1 (FortiLink) is connected to Port 24 on the FortiSwitch.I have created VLAN 400 (named "MGMT") on the FortiLink interface, which is used for managing the FortiAPs.FortiSwitch:Ports 21, 22, and 23 are configured in VLAN 400 for connecting the three FortiAPs. These ports are working correctly, and the FortiAPs are connected.SSID Configuration:I have configured three SSIDs on the FortiGate in Tunnel mode.Each SSID is associated with a different VLAN (configured as optional VLAN IDs within the SSID settings).DHCP is enabled on the FortiGate for these VLANs.Issue:When clients connect to the Wi-Fi SSIDs broadcasted by the FortiAPs, they are not receiving IP addresses from the DHCP server, even though DHCP is enabled and configured correctly on the FortiGate for the SSID VLANs.Upon further investigation, I noticed that the VLANs associated

Good Day To any one that can assist me. In my work environment we are operating the pbx phone system FortiVoiceEnterprise 100E with 12 phone lines attached to two fortivoicegateway switch.  The issue currently is that three of the direct phone lines are being cross referenced meaning when i am dialing an external phone one of the other phone numbers are displayed and therefore that phone being used cannot receive calls from outside of the office.  how do i ressolve that issue. i already reentered the entire configuration to no avail. 

Hi I'm struggling to get the VPN connection to work on my work laptop. I'm using the latest version of FortiClient VPN 7.4.0.1658 and all settings are 100% correct as I've tested the same on another laptop where it is working.My laptop: DELL Latitude 5590Windows 11 64bitAll drivers are up to date. Can anyone help me sort this out or provide me with a link to download the 7.2 version to try and see if older version solves the problem? Here is what I've tried already:Reinstalling many timesTried version 7.0Updated all firmware and biosCleared %appdata% and %localappdata% before every reinstallOpened the necessary ports on my firewallTurned off firewall temporarilyPlease help me.

Hello everyone, Can I update the Fortinet AV clients on the client computers via the EMS server? So we currently have version 7.2.4 on the clients and version 7.2.5 on the EMS. The version has been online for a few days and is not being rolled out to clients. Is there a way to roll out 7.2.5?  Thank you very much for your help.

Hello, I'm doing some cleanup in a fortigate environment that has not been kept very tidy. There are a lot of policy openings that i dislike as they have been allowing all protocols far too often.Now i want to crack down on these and limit some policies to only have access to the ports that are actually frequently used.Now the proper way of doing this would be to contact various parties and get lists of ports required for the respective services and applications but i wonder if there is some tool in FMG/Fortianalyzer that might help me? I imagine a tool to list ports accessed by a certain policy and how many hits they each have in a certain timespan.Is that possible? or is there a better/simpler solution? BrJohan

Hello, IPsec aggregation I/F is not seen when I try to input it as SDWAN member.Here is my environment.       (wan1) --- NAT router1 --- (wan2)FG1                                                     FG2       (wan2) --- NAT router2 --- (wan2) At FG1, as VPN tunnel, vpn1_1 and vpn1_2 are createdAnd AGGnat I/F is created as aggregation of the both.At FG2, the situation is similar.In VPN tunnel, AGGnat I/F is up. However, this I/F is not seen as SDWAN member. How can I solve? Any comments are appreciated.  

Has anyone have any success configuring and implementing the Fortimanager SD-Wan overlay template? I am currently running Fortimanager 7.2.7 running Fortimanager 7.2.9 and keep getting an error -999 Odom copy failed error when trying to install preview. I am beginning to think there may be a bug with 7.2 version.

Hello! I have several WLANs in Tunnel traffic mode (FortiAPs) with their own DHCP configuration, using external DNS.Additionally, I have VLANs that use our internal domain DNS/DHCP. The issue is that devices on these WLANs are attempting to communicate with devices on the VLANs (and vice versa).For example, logs related to Windows Delivery Optimization (TCP/7680) show this activity. Since there are no policies allowing communication between these networks, my logs are getting filled with 'implicit deny' entries:Same thing here: I could be mistaken, but since the tunnel is sending WLAN traffic directly to my Fortigate, and the only policy in place is for outbound to the WAN, devices on different networks shouldn't be able to see each other, correct?Where might the misconfig be? Thanks in advance.