Fortinet Community

Hello,We've got a problem in our network. When devices are connected to two different access points (Local-WiFi-radio and FortiAP-221E), they can't seem to find each other even though they're on the same SSID. But, if they're connected to the same access point, everything works fine. Devices operate in Tunnel mode.We made sure that the setting which stops devices from talking to each other (client isolation) is turned off on both the access points. Also, we checked that both are set up to work in the same subnet. Still, we're stuck with this issue.We're using a FortiWiFi 40F and a FortiAP 221-E.Problem:ClientA -> FortiAP1 -> FortiGate (FortiWiFI)-> FortiAP2(FortiWiFi) -> ClientB - Ping FailClientA -> FortiAP1 -> FortiGate (FortiWiFI)-> FortiAP1 -> ClientB - Ping SuccessClientA -> FortiAP2(FortiWiFi) -> FortiGate (FortiWiFI) -> FortiAP2(FortiWiFi) -> ClientB - Ping Success

When using VDOMs, SDN connectors are not available to be created at the VDOM level, only the global level.  Can a connector configured at global can be scoped down to a specific VDOM?  As I see it, any tenant on the Fortigate can create dynamic addresses by sourcing the global connector which means that IP address info is leaked to VDOMS that are not authorized to read that information.  Thoughts?

Why doesn't the alarm button on the device blink red when one of the firewall psu's fails or when I pull its power?

Hi all, I've blocked YouTube using web filtering, and it works well on Google Chrome. However, for some reason, my client's device using Safari can still access it. By the way, I'm not sure if I can use a wildcard block because my workplace wants to force users to use Edpuzzle instead of YouTube.Here is the filter configuration according to the Edpuzzle cookbook:Block www.youtube.com.Allow www.youtubeeducation.com and www.youtube-nocookie.com.So what I've done is create web filtering profile follow the cookbook and apply to policy that we want to blockBut unfortunately It won't work for me.

I have a 200F fortigate firewall with fortios 7.6 . Its antivirus did not get update since 2024/08/16. All other modules update without any problem.

Hello everybody, we did the backups of our Fortigate Firewalls with scp (pscp.exe -scp - batch -pw password user@0.0.0.0:fgt-config /target/folder) and a scheduled task on a Windows server.This was working like a charm.We upgraded one Firewall (60F) from FortiOS version 7.2.8 to version 7.4.4 and we recognized that the backup script is no longer working.There is no error or anything like that - also if we execute it manually it looks like it is working but no file is stored in the target folder.Were there any changes in 7.4.4 that scp is no longer working or is it a bug?I can't find anything in the release notes. Connecting to the firewall via SSH is working as usual.Any information on that or any hint to get it running again?Thank you.Best regardsRené 

We recently converted to a new cloud hosted phone solution with Sinch in our office and sense doing so I have had reports of intermittent issues with garbled voice on calls between extensions in the office. All our phones are fed PoE individually from the same Fortiswitch 448F. There are no issues at all with incoming or outgoing external calls which I've dealt with relating to SIP ALG on the Fortigates. With this issue the RTP traffic handling the voice doesn't route through the firewall and I'm at a loss as to what could be causing the issue. We resell and support this product with numerous other business customers and I have yet to hear about an issue like this so I was hoping someone might have some suggestions or feedback on this problem.

anyone experience with a virtual (VM) standalone FortiTester on ESXi with 2 ports and trying to run a DUT Working Mode Network Address Translation (NAT) test with a DUT role Network Gateway? with an TP (transparent) DUT working mode setting or an application server DUT role im seeing traffic in the port1 / port2 network. An arp who has for the provided gateway or server IP, the test then works if the rest is setup correctly.but with a client / server test I dont see these arp who has or anything in the networks suggesting a test is attempted. it looks like for some reason the test doesnt continue, it stops pretty much after starting saying it was aborted, but no hint as to why. might be something in the configuration I fail to understand. tried multiple variations. went through the admin guide, but it doesnt mention actual cases mainly config options. anyone got this working?

I was given four FortiSwitch 148Fs, but don't have enough ports on my L3 Cisco switch to plug them into.My LAN routes are known to the FortiGate via OSPFIf I plug my FortiSwitches directly into the FortiGate, will they learn the subnets from the core? Or would this be considered a bad topology?

We recently upgraded from a standalone FortiGate 1500D running FortiOS 7.2.8 to a pair of Fortigate 601Fs running the save version of FortiOS as an Active-Passive HA pair. Our deployment consists of 10 total VDOMs and 8 10G physical interfaces. There are also 2 copper HA links and 1 copper management link per FortiGate. For this deployment's configuration, we pulled a config from the current FortiGate 1500D, passed it through FortiConverter, and loaded the resulting configuration onto the new FortiGate 601F's without issue. All references and settings were identical to the previous FortiGate. Each physical interface contains either the inside, dmz, or public vlans for multiple clients that we service. The physical interfaces themselves have no IP assigned to them. Rather, each physical interface holds multiple disjoint subnets corresponding to a client's network.  Although the physical interfaces are grouped by inside, dmz, public, the VDOMs are grouped according to

Hello Everyone,  I'm trying to set up Radius for Fortigate logins and I'm having an issue. When I run the authentication tests from the GUI, it says its successful, but then when trying to login to the device, I get the message "Authentication failure." Its really quick too as if its looking for a local account. Any help would be appreciated.  Thanks!

Hello, I installed fortinac agent on mac computer by applying the document I gave below. Although the device reaches Fortinac, the popup does not open. why can it be? https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/cf9ed9ff-de2f-11ea-96b9-00505692583a/FortiNAC_Persistent_Agent_Deployment_and_Configuration.pdf

Hi, Is it possible to use a GPON OLT SFP module in a 100F?Sould this work?I would like to connect my fiber wan connection directly to the firewall.I don't find any information about this. Someone that has this setup?Specs of the module below.  GPON OLT SFP 1490nm-TX/1310nm-RX 2.5G-TX/1.25G-RX Class B+ 20km DDM SC SMF Transceiver Modules thx

Hi Fortinet Community v6.4.9 -  #fortigatev6.4.8 -  FortiManager  We have had a FortiClient set up in the past which we have lost the PSK to as it appears to have been manually changed and not recorded. We have a backup conf of the VPN to re-apply so it can still be used (1 connection), but this does not work for clients with multiple VPN connections. Is there a way to recover this key or will we need to resort to resetting it? Thanks #forticlient     

Hi Team, I am on the process of deploying SDWAN in existing network, and wanting to add a loopback interface while trying to create an sdwan member.  Is my understanding correct that the loopback interface type is not supported before FortiOS 7.4.0?I am only seeing a link related to SDWAN and Loopback as below:Defining a preferred source IP for local-out egress interfaces on SD-WAN members NEW | FortiGate / FortiOS 7.4.0 | Fortinet Document Library We are currently using MPLS network in our WAN, so we prefer to use loopback interface.Also, please let me know if you have any other suggestions for this to work. Thanks!  

Hi, i have download FFW_VM64-v7.6.0.F-build3401-FORTINET.out.ovf for VMWare from https://support.fortinet.com/Download/VMImages.aspx, and after install, the application not show trial license option, only FULL. I already try factoryreset, set via shell account and nothing works. Someone can solve this ?  

Hi everyone,I am relatively new to Forti and networking in generaly and I have one problem i can`t wrap my head around.On Fortigate 100F I have two WAN interfaces enabled with diferent public subnets.WAN1 is my primar interface with default route for my internal users to go to internet.WAN2 is interface i inted to use for publishing web services.I creaed virtual server with WAF for that purpose and pointed it to WAN2.When i tray to access web servise from outside my local network ti works like a charm, but users in internal network can`t access those web services.Domain on which this web service is published is public and DNS records are held by 3rd party registrar.I don`t have split DNS in local network to be able to sent internal trafic directly to local IP of my web server.So far I tryed to add second default route for WAN2 with higher administrative distance and I tryed to configre PBR but with no luck (maybe i`m not doing it right)Is the PBR solution at all for my problem?BR 

Hi.I created web filter and application filter and blocked social media and **bleep**ography catagories.later created the policy and assigned this security fiters to this policy .Problem is that,after assign this security profiles ,i cannot use anydesk app.i d'not any block to remote access catagories.how can i solve this problem? please help me

Hello everyone! I am looking into a FortiNAC implementation and the following question came around. Tried to check documentation but there are some differences on it so would appreciate a third opinion to make sure the right setup is being followed. When deploying multiple isolation networks on FortiNAC (Registration, Authentication and Remediation for example) all of them have different IPs on config wizard, yet all belonging to the same interface port2. On a L3 setup, which IP should be indicated as DHCP relay (helper) on each interface? The main IP for port2 or the equivalent to the VLAN that is being configured? Found this and other examples saying the first is correct:https://docs.fortinet.com/document/fortinac-f/7.2.0/high-availability-fortinacos/377092/layer-3 In the image is possible to see that all helpers, no matter the VLAN, point to 10.10.100.2 and 10.50.100.2 which are the registration port2 IPs for each FortiNAC server.It also says the following:&

Dear Team,We have FortiNAC using as local RADIUS for our Cisco Switch. We have Endpoint Access Policy with using RADIUS RFC Vlan for changing User VLAN based on Access Policy. We have Endpoint Compliance to move user to Non-Compliant VLAN and mark at Risk but when user are changed to Host/Profile (Non-Compliant). Policy detail shown that Host Matched VLAN "Non-Compliant VLAN" but FNAC is not change the port VLAN and Also it is not send RADIUS to Reauthentication User to Non-Compliant VLAN.  It is working only when Host reconnect by itself. It should not be correct flow of how NAC's endpoint compliance work.Note: Switchport membership is Role Based and Remediation.I have do PCAP and i don't see any traffic sending out from FNAC with any RADIUS or RADIUS CoA port.Thank You

After updating our machines to the 7.4 update(VPN only), we noticed a few laptops were getting stuck at "Connecting". After browsing this forum and other sites, we had no luck at fixing the issue. Reverting back to 7.0 did resolve the issue. After checking out the services, I noticed the FortiClient Sys Monitor was not running in the taskbar. I went to start it manually in the Forticlient folder and received an error(mfc*.dll not found). I doubled checked the laptops with the issue and one did not have Microsoft Visual C++ installed and the other had the 32bit version installed. After installing the 64bit version on both laptops, Forticlient shows the percentage and connects fine. Hope this helps someone.

Hello, I'm a beginner and I'm doing a lab I need to update a fortigate to version 7.2.7The adom on the fortimanager is version 7.0 1)Should I first update the adom and then the fortigate, or vice versa? 2)If I don't update the adom and leave it at 7.0, will that cause any problems?3) The fortimanager is in version 7.2.1, do I need to update it too?If so, what order should I follow?Update Adom then fortigate then fortimanager? Thank you very much.   Translated with DeepL.com (free version)

Hi everyone.I've been taking a course on Udemy about infrastructure and security with FGTs. I'm almost done with the course but I'd like to know any website where I can find resources like guides and things to do to practice by my myselft so I can get almost a real experience deploying policies and other configurations which are used in a real company.Thanks in advance.

Connecting FortiExtender and Fortigate (FortiWifi)Hello. I am trying to connect the other party's FortiWIFI-40F through FortiExtender 511F and FortiWifi-61E.FortiExtender 511F is equipped with a SIM to enable 5G communication.What I am curious about is the Ethernet connection between FortiExtender-511F and FortiWifi-61EI need to connect AWS's TGW to VPN using the 5G network, and the other party also needs to connect to VPN through FortiWIFI-40F.AWS's TGW has already been created and tested for connection to FortiWIFI-40F and VPN, but the connection between FortiExtender-511F and Fortiwifi-61E is not working well, so I am asking the community.Current situation isMeFortiExtender-511F-> 5G network connectedFortiWifi-61E -> PC connected to the lower level and management access possibleBoth devices are connected to the lower level PC with serial consoleOpposite partyFortiWIFI-40F -> Connected to the ISP and internet network and there is a lower level PCManagement access is set betw

Hello, we are using Fortiweb VM version 7.0.8 and i'm not specialist in the system. Our Exchange server is behind the fortiweb. We have a lot of attempt to connect to the exchange using EWS.  I can see in the Traffic (Log & Report) for attempts and the return code is 401 (forbidden). My question : Is it possible to create a rule/policy to automatically block IP for all attempt getting the Return code 401? Thank you