Fortinet Community

Hey yall, I have a firewall that I’m trying to connect to ssh via the forticloud interface in order to fix the syslog. The firewall itself is not down, but when I attempt to connect via ssh it just says “connected” until it eventually says “disconnected”I believe I need to update the firmware so that the firewall can connect to fortimanager, but other than that I cannot find any other relevant solutionsAny help or suggestions?

Hello,  We are using FortiAuthentiticator to configure 802.1x EAP-TLS with computer authentication, we have to create two realms "host" as we have two domaines but FortiAuthenticator does not accept to create two realm with the same name.  is there any workaround? 

Hi I have a Fortigate 40F running v7.2.2 and I am trying to configure a DLP profile to block downloads of files 100MB or larger.  This profile is applied to a proxy policy. I've been testing the profile with various sizes of downloads and it doesn't appear to be blocking the download correctly.  I got some downloads blocked but the size-file value doesn't seem to be right, it's set in kB but doesn't seem to relate to the actual file size.  Below is the profile config config dlp profileedit "Block100"set feature-set proxyconfig ruleedit 1set name "Block100MB"set proto smtp pop3 http-get http-post ftp nntp cifsset file-size 102400set action block I've been testing different file-size values and it doesn't seem to work correctly.  The value is kB, so 102400 should block anything above 100Mb, however it isn't. Is there any config I've missed?  Alternatively is there any other way of blocking downloads of files of a certain size in v7.2.2?&n

Hello, What default bandwidth reference for OSPF in fortigate?

Hi all.I recently had a problem with publishing web services to users in my local network which i resolved with the help of comuinity.https://community.fortinet.com/t5/Support-Forum/Internal-users-can-t-reach-web-service-on-WAN2-interface/m-p/331839#M248297Solution was hair-pin featurehttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-Hairpin-NAT-VIP/ta-p/195448Once again thank you @xshkurti @GauravPandya  Following up on that topic, I now have several users who are connecting via SSL VPN. When they establish the VPN connection, they can no longer access the web services published on the WAN2 interface.All traffic from the VPN tunnel needs to go through FortiGate, so split DNS for the VPN portal is not an option, and public DNS records are held by a third-party registrar.I tried creating another firewall policy with the hairpin feature, but when I select the incoming interface to be the "SSL-VPN tunnel interface (ssl.root)", I can't select the virtual serve

Hi!There seems to be a severe limitation with 'firewall local-in-policy' as scalable substitute for 'system admin' limit of 10 trusthosts. Since (a) 'firewall local-in-policy' cannot reference 'system admin user' as allowed source; nor (b) 'system admin user' can specify a 'firewall local-in-policy' that may enforce access we seem to be stuck with trusthosts. For example, a simplest security requirement is: two ('system admin' with 'wildcard' and 'remote-group') administrator users A & B, where A are only allowed from login from host X, and B are only allowed to login from host Y, how can this implemented using local-in-policy (or any other way except 'system admin' trusthosts)? Feren 

LAN ports became very slow, the browser return "unresponsive page" error. the GUI can be accessed through WAN port and console normally. LAN ports throughput is not exceeding 2Mbps!

I just download a VM machine of Fortigate 7.0.2 (I tried with 7.0.1 also) and i cant access with https to the forti GUI. I checked the interface and is perfectly configured: with "allowaccess ping https ssh fgfm"I also tried to to access with ssh and works perfectly fine.Even i tried to configure the interface and add "http" and worked too!(but i want https not http) The Chrome error that appears to me is the typical: [ This site cant be reached ---- "ERR_CONNECTION_REFUSED" ] (i also tried to disable the windows firewall, but nothing works) Its a new and default Fortigate VM System, so i dont know why doesn't work.Anyone knows what is happening? Thanks!

Hello, we are facing a number of issues using Forticlient version 7.2.4 , i undersand they may be fixed in future versions. Is there a plan and date to release a version 7.2.5 of Forticlient anytime soon? Thank you Martin

Hi all,  I hope you're well.  I currently have 4 x FortiSwitch and 4 x FortiAP devices being managed via FortiLAN but am in the process of deploying HA cluster 90G's. Because we will now have FortiGate's in place, I would like to move our FortiSwitches and FortiAP devices from FortiLAN to FG managed but rather than manually import configuration I would like to use the fortilinkify.py script.  I have downloaded the script and have reviewed documentation available on the FNDN site however, it isn't very detailed and doesn't explain how to carry out the entire process. Can anyone with experience of using the migration tool be of assistance or provide me with a better way to automate this instead of manually pasting configuration? Thanks, Dan. 

Hi, I have a hybrid network setup with a FortiGate firewall (60 F) and Ubiquiti UniFi access points. I've configured two VLANs in FortiGate: one for guests and one for the main network. The Apple TV is connected to the main VLAN, but users on the guest VLAN are unable to see or mirror content to it. How can I enable communication between the guest VLAN and the Apple TV on the main VLAN so that users on the guest network can connect to the Apple TV? Thanks!

Hi everybody, we have a FortiGate acting as a VPN gateway for a client VPN for home office users. Authentication is done using Azure AD with SAML and the FortiClients are managed by an EMS though we only use the remote access profile. Whenever I try to connect to the VPN, FortiClient asks for the Azure credentials and then fails with error "FortiClient VPN unable to establish VPN connection. The VPN server may be unreachable(-6005)". Connecting through web mode however, works, so the problem's not with the VPN or SAML config. I created a custom VPN connection using the exact same settings that are configured by the EMS profile. Yields the exact same result. If I disconnect the FortiClient from the EMS however, the connection established without any issues. The problem is independent from FortiClient version (tested with 7.2.3, 7.2.4 and 7.4.0), so my guess is that some setting on the EMS is interfering with the VPN but I haven't managed to find a solution yet.Thanks in advanc

Hello community,I have installed the FortiPAM 1.4.0, and I also have the FAC 6.5.1, I configured the FAC as IDP SAML (proxy to LDAP server), and the PAM as SP. So, when I login in PAM I will use the credentials of LDAP server with MFA configured in NAC. But, after the correct flow login, I obtain in FortiPAM the  "authentication failed.SAML authentication failed.If you wish to use a different SAML account to login, please use incognito mode with your browser or manually clear your browser cookie of SAML IDP site." But in the logs FortiPAM's logs I see:ActionauthenticationStatussuccessReasonAuthentication succeededAuthentication ProtocolHTTP(10.50.200.176)Authentication IDfortipam_saml_auth_rule  Someone that is in the same situation?  Thanks in advance!

Hi,my customer is running a FG-100F v7.2.9 with FAP-221C on the latest firmware. It wokred pefectly fine until from one day to another it didn't. Clients try to connect to  SSIDs, it takes very long and often fails. When it works the conenction is very slow with high packet loss (~85%). I checked the logs and saw high numbers of log entires for "wireless ip assigned" and "wireless client authenticated". I checked the details of these entries and saw the same mac-addresses doing this in short intervals as if they frequently re-connect. Has anyone else experienced this? What could be the issue? I checked config wireless-controller settings -> fapc-compability enable, config wireless-controller wtp-profile - 221c-profile -> dtls enable but nothing helped. I saw high CPU usage for cw_acd process and a matching BUG ID for resolved issues on fortiOS 7.2.9 so i upgraded from 7.2.8 to 7.2.9 and it made no difference. I have no ideas anymore.

hi,i have an upcoming change window and just would like to confirm the 'revision' function in FG.1) if i click on configuration > revisions > save, this will create a backup config that is local in the device?2) i use VDOMs, so does the config include the all VDOM? i.e. 'global', 'root' and others?3) how can i view the full content on the revision config? is there a CLI command I could use?4) if i need to revert the config using the CLI, the 'latest' config would be the most bottom revision id? would this be revision 27? (global) # exec revision list configLast Firmware Version: V0.0.0-build000-REL0 ID  TIME                   ADMIN             FIRMWARE VERSION           COMMENT<SNIP>26 2024-02-19 21:54:37 Admin-Full V7.2.x-build1xx-REL0 Automatic backup (session

I installed FortiClient on my own macbook. But when I click the app, the attached error report pops up. I checked that my macbook firewall isn't blocking it. I uninstalled it once and reinstalled it. Restarted the macbook. Still the same error.  The error report is too long so i just captured the first pagemacOS version: Sonoma 14.6.1  

Hi all, we have recently update FGT to FortiOS 7.2.8.We found out a problem during the Re-Install policy.The process returns an error and we must "Retrieve" the configuration to complete the install. We use FortiManager 7.2.5.Can you help us?Regards.

Foritgate FW version : 7.4.4I have created two proxy policy with different schedule, office hour and non office hour.and i notice that the traffic is matched with non office hour schedule and policy when I access internet in office hour. anyone have experience this issue ?  Observed Update on 8/July/2024:Traffic between 4PM to 3 AM will go to office hour policy with schedule 8AM-7PMTraffic between 3AM to 4 PM will go to non office hour policy  with schedule 7PM-8AM      

I want to send data to a SOC. The SOC is using LimaCharlie and they can receive alerts with webhook. On my Fortigate I want to create a trigger for all threats that have the weight "High" or "Critical. I am here:Security Fabric > Automation > Create new * Name: LC High/Critical Threat* Description: Send threats to LimaCharlie over webhook Now when I click "Select Entries" + "Create" I get the following:  Where should I continue in order to find the threats? The webhook URL is b76093c3662d5b4f.hook.limacharlie.io/ORGID/ADAPTER_NAME/PASSWORD    

hello everyone, I have a forti 50e and I have problems with speed and packet loss on the lanIt is very very slow, it should have 499mb download and I have 4mbI have tried everything and nothing, the firmware is the latest and with that neither.thanks

We have 50 E, the Internet is too slow through FG 50E, from the ISP  we are getting the same speed that they are suggesting. Does anybody help to resolve this issue?

Hi All,I have a strange problem with our Fortigate 50E. The router works with a fiber connection, wan interface configured as a VLAN,  PPPoE.Router worked properly about 4 years, including one year with fiber. The max speed was 300Mbps / 70 Mbps (DL/UL)Two months ago I noticed that DL speed decreased to 30Mbps, now its only about 4MbpsI've checked cables, I also connected router of ISP (when ISP's router was connected the speed returned to 300/70)Is there something that shoud I check with my FG50?regards,  

Hi,Il can't use new function for "Integrate interface" in Fortigate 501E (v. 7.2.7)I create a vlan in a physical interface for the test but it isn't possible to user function.View screen :Thank and sorry for my bad english.

Hi, Laptop using Forticlient 7.x VPN on Windows 11Home for a year, so far is OK, recently, I have been unable to access the IPSec VPN from my laptop. Each time I attempt to log in, FortiClient displays the error message 'IPsec VPN connection is down.' When I check the FortiClient log, the last entry reads 'Phase1 retransmit reaches maximum count.'I also tried accessing the IPSec VPN on other branch office FortiGate firewall (model 61F) using FortiClient, but the same error message appeared. LaptopWin11Home, Forticlient 7.x FirewallFortiGate 30E, firmware v5.4xFortiGate 61F, firmware v7.2x Can someone help? Thanks in advance.  Clement  

I don't see the mgmt port in the Management Interface Reservation configuration