Fortinet Community

Hello, Today I updated Windows 11 to the new version (22H2) on 2 PCs. FortiClient VPN worked seamlessly on the previous version (21H2) but after the update it doesn't connect and gives the following message:  Is it a known issue with FortiClient VPN? Is there a solution? Thank you in advance,Costas

Dear Team, We have upgraded FAZ from v7.0.12 to v7.2.7 and post that getting error message "Please register this device" while trying to login to the FAZ gui.Please find attached snap and guide. Regards,Ganesh 

Hi,I have a Windows11 PC with FortiVPN client on board, it works like a charm.I would also have to get a second network device (Voip phone) out on the Internet on whose configuration I cannot access.This phone only works if it goes through my company's VPN (the same one that runs the client).How could I make this connection phone <> PC?Thank you

Hi All,So have a strange problem. We recently started testing Entra Only computers (we use hybrid AD computers currently)In our old setupComputers connected to LAN - IP address updated in DNSComputers connected via SSL VPN (Forigate) - IP address updated in DNSIn Our new setupComputers connected to LAN - IP address updated in DNSComputers connected via SSL VPN (Forigate) - IP address NOT updated in DNSI cannot work out why. I have checked the following.DNS will accept dynamic updatesThe fortigate SSL network adapter is set to register with DNS and the correct servers.Any ideas what else could be causing this? As we move forward with the roll out of Entra / Azure AD computers this will become more of a problem.Thanks

Internal Interface of Fortigate: 10.10.10.10Dial-Up Clients network: 10.20.20.20 - 100 Gateway: 10.20.20.5DHCP Server: 10.10.1.7 I've got three different IPSEC VPN's published off of a single 500 series gate but because our AD DNS isn't registering the machines properly, I want to move this to so that the dial-up clients are getting their addy's from a member dhcp server... I've even got the 2FA working on these but when the dhcp request hits the server, it's using the LAN interface of the gate so dhcp is trying to assign addresses based off of the internal interface on the gate and not the network that the dial-up clients will be using. In the dhcp request I can see this happening: corp500gw: diag app dhcp-relaydhcprelay: checking if we need to reconfiguredhcprelay: no changes detectedProccessing RTM_NEWLINK event.Relay client interface: vpn.segra2_0netlink message!Proccessing RTM_NEWLINK event.Proccessing RTM_NEWLINK event.dhcprelay: checking if we need to reconfigured

Hi, would like to seek for your advise for the current setup attached, basically we have another firewall on the right side of the diagram that connect to L2 switch, and on the FW side the port is configured as LAG while on the switch is under port-channel, but take note the switches are two separate standalone (not on stack). every time we connect the cable c3 and c4 the network is disrupted, is it because the aggregated ID is different from the firewall perspective? I always see this setup as common, but they always use stack switches.

I want to disable SSH Key logging completely. Also I have an ssh key configured in my Fortigate but I am unable to delete it. I have tried using delete, unset and setting the SSH key as an empty key but the key does not get deleted. How may I delete my key and disable SSH key logging completely?

Hi folks, I have a setup at home with a FG40F firewall and a 124F fortiswitch.I have 3 vlans in my network, and my switch is connected to my FG with fortilink. Since the new subnets (and vlans ofc) my connectio to the SMB server dropped down to 500Mbit/s. Is there any option to skip the traffic to FG while i want to reach another subnets devices? eg.: I have an SMB server in vlan 10And my workstations in vlan 20 I have no clue how could i achive this, i used mikrotik devices before fortinet. 

Kinldy let us know when the updated FortiOS 7.4.5 is getting relased. On 7.4.4 there is a known bug for SDWAN SLA performnace issue without any packet loss. The same seems solved on 7.4.5. 

I have the problem that when I use my personal PKI certificate of our domain under a Windows FortiClient VPN I have no problems, but when I want to use this or another certificate created for the Mac, I get a “Permission denied”.If I use a certificate created with Open SSL, the connection works. Does anyone here have any idea what needs to be changed in the certificate template in the PKI so that the certificates also work with the FortiClient for Mac, or where the problem lies? With best regardsMichael

Hi, maybe it can be already done, and I am blind, and maybe ;-), someone has an idea.It is possible to limit access for example using ZTNA to destinations.What I am looking for is a possibility, to restrict access requesting 2FA on a virtual server, virtual IP, based inside the policy itself.To limit outgoing access, it is possible to secure the network port or VLAN using a captive portal, but I want to achieve it INGOING to force 2FA for special services.If this would be possible, including groups from Radius-Server for example, it would make me smile. What I want to reach: limit access to, for example, Radius based users, in and outside the VPN while accessing a virtual server, to achieve a 2 nd layer of authentication out of the box without modifying the application itself. ThanksRonny

Hi All, I am little bit confused, why do we have to assign secondary IP address on the interface and what is the use of secondary IP address. Regards,Umesh

Hello Friends,                    I have DNS filter profile and applied on the internet accessing security roles.I need "if possible" to configure what like a dynamic object group that contains all hosts that are trying to connect to any malicious domain.is this applicable in fortios? and how please.Fortios ver. 7.xTIA,

Dear Teams, I think is not related Fortigate product. But the server need to connect as external malware hash with Fortigate.I just want to know how to create the kind of the server(services). Anyone can help or give the link how to create server or what services in server need to install. Thanks

hi, can anyone please advise how to check fortigate interface current transmit and receive speed via cli? the command "diagnose hardware deviceinfo nic port 2" only shows the overall packets sent or received on that interface. Thanks in advance!

Hi all, Trying to implement Citrix rendezvous V2, according to the documentation I should be allowing *.*.nssvc.net, has anyone been able to successfully allow *.*.url as an fqdn firewall object? Or would this need to be part of a static URL filter?Thanks!Y

How do we prevent a scenario when the first email is sent to a particular recipient within the IBE system, being intercepted by a hacker? After this hackers can create accounts in IBE and read emails. 

Hello,  I would like FortiClient to show the end-user a notification when their VPN connection drops/is disconnected. I can't seem to find any info on this in forums or documentation. Is there a way to enable this? Thank You! 

I understand this sounds silly but in my DNS settings I have "Use Fortigate Servers" enabled but both the Primary and Secondary DNS servers are listed as unreachable. However, at the bottom there is a section which says Dynamically Obtained DNS Servers where two DNS server addresses are listed for my WAN1 interface. What happens as soon as my Fortigate is able to reach Fortinet DNS servers? Does it stop using the dynamically obtained DNS servers and is there a way to enforce the Fortigate to use the dynamic ones?

Hello Everyone, I am facing a weird issue where WhatsApp File Transfer (images, voices,...) is being blocked when I enable web filter (the default with allowed unrated category) and application control (attached snapshot for reference).The Firewall policy is very basic with deep-inspection enabled and the ceritificate is added to each users device in the root certificate authority.Everything is working fine but we are unbale to send/receive images or videos on whatsapp windows application (the web and mobile version of whatsapp is working fine). Thank you for your support.

I am trying to add a device on Fortinac, the device is being added but the cli settings are not valid.Fortinac:9.4.4The error I got was as follows,Spoiler (Highlight to read)Unable to negotiate key exchange for server host key algorithms (client: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-rsa,ssh-dss / server: rsa-sha2-512,rsa-sha2-256)Unable to negotiate key exchange for server host key algorithms (client: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-rsa,ssh-dss / server: rsa-sha2-512,rsa-sha2-256)&nbs

HiSo we are testing deep SSL inspection and have a policy setup with our own cert (tried it with default as well).If I go to a site that is outside of the allowed categories on the web filter I get the usual FortiGuard Intrusion prevention blocked, have the page re-evaluated or override.The page shows it's connected by HTTPS and has a valid certificate.If i click on override I'm taking to the same URL but on port 8015,eg : https www.cdn-national-lottery.co.uk:8015/ovrd?fblob=UE-1  but this site returns a "This site can't provide a secure connectoin" and ERR_SSL_PROTOCOL_ERROR, on closer "inspection" (cough) it doesnt seem to have a certificate against the site.   I can't see how the initial page has a valid Certificate but the 8015 port override page doesn't have a cert, any ideas?  If I change the 8015 URL to HTTP it then loads the page,  Login to override gets to to http on port 8015 with ERR_EMPTY_RESPONSE and "This page isnt working

Resolvido     

Hello, I am looking for a solution to the problem, I have 2 fortigates connected via an Ipsec tunnel, I would like the second fortigate to have the same network as the first one but without nating.the first fortigate on which I have the entire network is fortigate 100f, I would like to have several vlans from this fortigate on the second fortigate 60 which is in the second location and they are connected by ipsecis this possible to do?  

Hi everyone.I need to create two phase2  interfaces for IPSec Remote access to allow users to connect to two different subnets. I have created phase 1 and phase 2 interfaces, but the VPN connection failed. config vpn ipsec phase1-interfaceedit "IPsec_Clients"set type dynamicset interface "wan1"set mode aggressiveset peertype anyset net-device enableset mode-cfg enableset proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1set xauthtype autoset authusrgrp "DC-VPN"set ipv4-start-ip 172.16.17.129set ipv4-end-ip 172.16.17.254set ipv4-netmask 255.255.255.128set dns-mode autoset ipv4-split-include "IPsec_Clients_split"set save-password enableset psksecret ENC 2kvF93dFz+5UvJw0S50Bor9tCqr6vYz7pPR2fvGbrWd4W3cblxHIHxhyLTYFOYGM0l+bq65DpcnqU4ij5S3C0jKgglRrnnRbK1gLljGNYeR1C1OgVmJ3xuJMDxPBifR2FjFeZ8I8WzdaEuIg5Zx60CYvbuUCak80vyBcpzauEUyURIq56C7kguCO5AFJN/f4l8lffw==nextendconfig vpn ipsec phase2-interfaceedit "IPsec_Clients"set phase1name "IPsec_Clients"set proposal aes128-sha1 aes25