Fortinet Community

Hi there,I am using Forticlient v7.0.10 in MacOS (Sonoma) to connect to an VPN, but everytime I try to connect, It just stays forever and no connection is stablished. According to the documentation Forticlient v7.0.10 has support for MacOS Sonoma.This same VPN configuration works without problem in an Android using Forticlient.I already tried some of the solutions the community has provided with no luck at all. fctservctl2 and fmon2 have both full access to the disk.I am using Applivery as MDM so I'm not sure if that could be causing the problem. Any tips?Thanks in advance.

Hi everyone ! I am currently setting up SAML SSO with Azure AD to connect to the SSL VPN (I am using fortios 7.0.11). So I followed these steps :  I created an application on Azure AD, and I specified it the fortigate information (as specified by the fortigate) :  The redacted text is an FQDN pointing to my VPN (a realm with a virtual-host is of course created) Then I added the following claims to Azure :  From here I added the information provided by Azure to the Fortigate : I've shorten the url so the end is visible. Then I created a group containing my SSO connector : And linked it to my VPN portal :  Finally, I added a user to the Azure AD application. From here I have two different result  :  From Azure ADWhen I click the "Test connection" button I am automatically redirected to this page :          And from the fortigate going on the FQDN or on th

Hello .I have a project to migrate from Palo Alto firewall to Fortigate. Unfortunately, we don’t have the FortiConverter tool, so I proceeded to migrate the configuration manually. I have a problem with some NAT rules and need your help.

I'm curious to how far this breach stretches.  Can't find any info on the newsroom page yet.   https://www.bleepingcomputer.com/news/security/fortinet-confirms-data-breach-after-hacker-claims-to-steal-440gb-of-files/ 

Hi,So there’s a limit on file scan size whereby a file beyond a certain size will be rejected, and from what I understand, the original file gets deleted and a record is created to say the file was too large to scan.Is there a solution whereby the Sandbox identities these files it cannot scan and move this file to an “unscanned” directory for manual intervention?

Hello everybody, I am making a list of the "recommended/important" fortigate log types for our customers. however i do not have access to a fortigate firewall and i cant seem to find any "good" documentation. so far what i have found has been contradicting itself by other searches. so now i have taken to the community:) would anyone share what log types are available from the fortigate firewall and what those logs contain

Hello all,I am new user of Fortinet VPN(version 7.4.0.1645)，but i fond some issue on install and open the software.Specifically, the software will Crashed when i open the software.my M1 mac information:Apple M1/macOS Sonoma 14.6.1 (23G93). I checked the report message when the software Crashed:     

Hello Experts, In site-to-site VXLAN under SDWAN IPsec over NAT,does Fortigate at NAT outside need to specify WAN IP address of the other Fortigate?Here is my network environment.    Inside    Outside  |---| -- NAT1 -- |--------| --- |---||FG1|            |Internet|     |FG2||---| -- NAT2 -- |--------| --- |---|   Inside    Outside   Both network I/F of FG2 are configured as "Dialup User".FG2 does not know WAN IP address of FG1 before FG1 connects to FG2.In order to establish VXLAN between FG1 and FG2, after getting FG1 network I/F IP addresses I needed to specify static route to the IP addresses at FG1. Are there any other solutions? Any comments are appreciated.

Need to amend slightly how guests register, and I don't think its possible, with a Meraki solution, you get a webpage and it asks for the email address of an approved person, you click submit. The approver gets an email, and authorises it. That's it.. you then get an email on your phone or whatever, and you can now access the network Fortiauthenticator needs either a group of approvers, or a freeform user typed in on the admin settings, Cant the guest user in the captive portal freeform type the person he wants to approve?

Hi everyone,We are facing an issue with virtual IP, it works normally, but all at a sudden stops responding to any request, there are no indications of high CPU or memory usage, neither sessions.One solution we have with this is, manually change the IP address of VIP to some random IP and vice versa.Any permanent solution will be highly appreciated 

Hi everyone,  I hope you're well.  I am exploring possible solutions to seamlessly authenticate and allow our corporate laptops to connect to wired/wireless LAN VLAN and am currently looking into what is possible with either FortiSwitch NAC and/or WPA3 SAE-PK.  Currently, we have AVD/App servers in Azure with Entra ID and Fortinet Secure Branch consisting of FortiGate, FortiSwitch, FortiAP and FortiAnalyzer. Currently there is VLAN segmentation and all VLAN's terminate on the FGT.  I am looking at FortiClient ZTNA to support our laptop web-filtering when off site but this is a future project and would like to deploy a solution which meets the above scope preferably without incurring additional license costs etc. Has anyone done something similar and would be able to provide some guidance for design or implementation of, to further secure our environment. Many thanks, Dan.  

Hello everyone,I don't remember since when but already for several releases I have an anomaly in the list of users authenticated in wifi through WAP2 Enterprise protocol. User authentication is provided by a Radius server that authenticates users in an AD Domain ( NPS ) .After their authentication I also see in the user list a set of IPV6 addresses linked to the authenticated usernames . Where do these addresses come from ? from the fact that their laptops and smartphones also have ipv6 link enabled ? because the DHCP configured on the Fortigate does not have a lease enabled in IPV6..Has this happened to anyone?I attach a few screens to better understand the issue Regards Fabio   

Question... Is there anything which will alert me when a FortiExtender is "offline" or unable to be connected to? We have had a couple of instances lately where our FortiExtenders were needed, but weren't connecting to either the Fortigate or the cellular provider. Unfortunately, we weren't aware of this as there are no notifications when the Extender cannot connect to either. Is it possible to set something up that will let me know if the Extender can't connect to the cellular providers, or if the Fortigate cannot connect to the Extender?

Platform : Win11 23H2 - Intune Managed corporate device.Hello Everybody, hope somebody can help as I'm stuck, I work as a sysadmin and i've been tasked to disable forticlient from starting up on windows login.We have our network fully managed by a third party company from whom we also got Forticlient from which they also manage.They've told us that the startup config has already been configured via EMS and the software forticlient starting up is now down to us and to reconfigure the startup apps on through windows settings. I've been sent instructions, the generic one from microsoft.This is where I'm having issues with as Forticlient itself is not showing up from teh startup list through 'settings > apps > startup', its not on 'task manager > startup' either. I found FA_Scheduler under services.msc which is set to run automatically, im trying to change it to Manual, but it kept on coming back to me with 'incorrect parameters'. Hope somebody can help, thanks.  &n

HiI get the below error when I go to traffic on the fortiview tab and select policy hits. If I select top sources this works fine. Issue occurred after DB rebuild and firmware update. has anyone has this?   

I am currently setting up a 124F switch. My laptop is direct connected to the switch port1, and I disabled all my Windows firewalls. However, the ping test to my laptop is failed:I tried to do the same thing on another 124F, the ping was succeeded. Fortiswitch OS is 7.2.4.Any ideas? 

I manage 25 FortiGates. Assessing moving to FortiManager. But for now I have to manage each individually. Drives me nuts that every time I log in I have to reconfigure the views to show Description. I've tried a few ways to save the default views (Also adding things like Policy ID to Policy & Objects. Yet every time I log back in the custom views are back to defaults. V7.4.0 on 60E and 60F Models. Any help truly appreciated.

Dear All, I've been testing the image analysis feature in FortiProxy 7.2.6 Version,I already config and test the deep inspection, and all went well. When i try in duckduckgo.com and search bad content the image change to the fortinet Logo,but when i try in Google, the image still show as bad content. Been thinking does the Google change port like QUIC or other else ?Because i also already block QUIC Protocol to ensure the image is using HTTPS / HTTP Is there anyway to do the image analysis block in the Google Search Engine ? Thank You,Best Regards

Log in to the control panel of your web filtering or network security system. This could be a firewall, DNS filter, or any content filtering tool you use.Locate URL Filtering Settings: Find the section where URL filtering or content categories are managed. This might be under headings like "Web Filtering," "Content Filtering," or "Access Control."

When I add FGT v7.2.8 build1639 (Mature) in FGTM v7.2.6-build1632 240809 (GA) a Detect Failed message appears. Can anyone help me? Fortimanager does not ping Fortigate. Fortimanager does not ping Fortigate. They are on the same network. I configured allowed ping. 

Hi, Team!Do you have any suggestions on the recommended version of FG-401FI noticed that the firmware marked as mature has been updated to 7.2.9, while the recommended version in Recommended Release for FortiOS is 7.2.5.Considering that Recommended Release for FortiOS has not been updated for 5 months, I am hesitant about which version to use. (According to the update frequency, Recommended Release for FortiOS should have been updated.)Thanks for your suggestions.

I am under Security Fabric > Automation > New > Add Trigger > +Create > FortiOS Event Log. Here is a looooooooong list of events that I can send to my SOC, but I do not know what is smart to send to them. Any suggestions? List of events:802.1x authentication failed802.1x authentication succeededA device upgrade failedA device upgrade was completedA federated upgrade could not be completed by the root FortiGateA federated upgrade failedA federated upgrade was cancelled due to the CSF tree not being readyA federated upgrade was completedA federated upgrade was completed by the root FortiGateA step in a multi-step federated upgrade was completedAction performedAdd new entry to IPAMAddress allocated by FortiIPAM and applied to an interfaceAddress received from FortiIPAM could not be applied to the interfaceAdmin disconnectedAdmin login disabledAdmin login failedAdmin login successfulAdmin logout successfulAdmin overrode VDOMAdmin password expiredAdmin performed an

greetings,here is the scenario:1. there are 2 interfaces on Fortigate at A site as the SD-WAN member interface to Azure, they are link 1(port 17) and 2(OL_INET) in the following picture.2. normally, FortiGate uses link 1 as the outgoing interface for traffic from site to Azure (so as for the responding traffic from Azure to site), when link 1 fails its performance SLA (let's say, packet loss reached its high threshold), sd-wan will use link 2 for the traffic from site to Azure, but the responding traffic from Azure to site will persists with link 1, as of now, there is only one link (MPLS) from Azure to each site. question: if there is an existing session established between site and Azure based on link 1, and then link 1 fails its SLA (let's say, packet loss reached its high threshold), which results in a link failover to link 2, what happened to the session? Is the session bundled with the interface which is used by the initial (SYN) packet of the session? why I ask th

Hi guys. So I’m new to firewall management and had a question. I’ve put some deny rules the firewall and have added some source ips and some destination ips. The thing is, if the rules are not being hit even after the policy has been pushed. The destination ips are NATed, so I need to know, do I put the IPs the real IPs are mapped to ( from the NAT pool)? Or the real IPs in the rule?