Fortinet Community

Hello.I have a question.There are some traffic in Fortigate Forward traffic where the result is blank, is there a reason why that part is happening? 

Hi, i want to hide my local FortiGate IP with remote PF_Sense located in Germany. i already created the tunnel between them and the tunnel is up, moreover i also configured Central NAT for IPsec tunnel policy and allowed NAT. I need my local site users to use public IP of remote firewall, what is the possible solution.

Hello TeamI am new to this forum but have a big issue.We have FG200E running on Firmwarev7.2.8 build1639 (Mature)The ISP provides 30Mbps, and when we test with a laptop connected directly to the ODU, we get over 25Mbps; however, on Wi-Fi and LAN through the FortiGate, we get less than 5Mbps. There are not many configurations on the firewall, it is only working as a router and 1 site-to-site VPN which is not active.Kindly guide me on how to solve this.

I’m a brand new Fortinet partner MSP and I’m trying to understand the best method for handling FG Cloud. From what I understand, the MSP needs to purchase the multi-device license instead of the individual SKUs, then purchase the multi-tenancy license and create a sub account for the client, then register the device to that clients sub account.Am I understanding this correctly?

when configured captive portal some sites didn't work  with error :err1 - ERR_QUIC_PROTOCOL_ERRORerr2 - ERR_SSL_VERSION_OR_CIPHER_MISMATCH like : YouTube , google , LinkedIn  and google search else some sites works normally and redirect to captive portal AUTH page . when I remove or authenticate all sites works normally  I try it with (chrome , brave and IE browsers) (version 7.0.9 VM) FortiGate 

I'm looking for a solution to restrict actions that can be done by a user who has an access to a secret through web RDP, for example on a web SSH session we can use SSH Filters but i didn't find something similar while using web RDP 

Good day, I am getting a lot of Microsoft URLs being re-signed as untrusted see below, I have a FGT200F running firmware 7. I have noticed that the Destination is not the same as the hostname, any thoughts as to what is happing? Server certificate is re-signed as untrusted, certificate-status: untrusted.Destination                                                                                    hostnamev10.events.data.microsoft.com                                                      uk-v20.events.data.microsoft.comteams.events.data.microsoft.com                        &n

hey guys.I have passed in january fortigate administrator 7.2I want to complete now the fcp and I studied faz.which exam can I pass to complete the fcp.there is on pearson vue two exams :Fortinet Analyazer 7.4 or Fortinet Analyazer 7.2is that matter which one I will pass ? thanks for the help :) 

These models will not complete the firmware upgrades successfully. We have several 248,224,148, etc. models that worked just fine. I've attempted to do the upgrade via the GUI and CLI.Wondering if it's a lack of usable memory?

Hello, I am trying to understand how the "VLAN assignment by FortiAP group" works. I can understand that this function allows using one SSID in multiple locations, and each location can be configured with a different VLAN with this SSID.I would like to understand how this configuration is working when the SSID is in tunnel mode and has an IP address configured in it.The plan is to have 5 locations with 1 SSID for corporate users. Each location will have it's own VLAN for corporate users and the DHCP scope will be individual per each location.How FortiGate will be able to use one SSID and switch between VLANs, route the traffic and forward requests to the DHCP server based on the VLAN configured to the specific AP group? Will be grateful for any hint.

Hi, I downloaded and installed latest version of FortiClient VPN from https://www.fortinet.com/support/product-downloads#vpn. The shown installed version is 7.2.2.I entered the server's SSL VPN settings, but when I click the button "SAML Login", nothing happens.The window shows the label: "Status: Connecting" and keeps waiting forever.Any idea about something I'm missing?

Hi. I'm new to this so please bare with me... So, I have a small lab-setup at home with a FortiGate 70F and a FortiSwitch 108F-POE. The FW is located in the livingroom where my incomming internet is, and the SW is located in my home office. Between the FW and the SW is a small office-SW (located on the 2nd floor) with no support for vLAN. If I connect the fortilink interface on the FW to the fortilink interface on the fortiSW, everything works as expected even over the officeSW. However, the other devices connected to the office-SW then doesn't work since they don't get a vLAN (obviously). My question is if it's possible to send BOTH the vLAN AND the fortilink traffic, with the vLAN as "primary" (or "untagged") over the same FW-interface so that I can use a single TP-cable. Is this at all possible?

Security Rating it appears you need to buy subscriptions to upgrade your grade. Is there any other way?

How often does forti-web update its firmware, and when it does would it cause disruption to a live Fortiweb Cloud operation that is protecting web servers. Typically explain how it works and if there would be down times Thanks

I seem to get an awful lot of port scans to port 500, many/most on the same IP block.I'm certain they're doing an overall scan of the network, but I've just implemented a notification alert on the following:[ul]SSL VPN login failureIPsec tunnel errors[/ul]via Log & Report > Email Alert Settings (300E model) so I can keep tabs if any of my users are having problems (or are the target of a brute force attack). ..so I'm most aware of the port 500 hits.  However, because these garbage notifications are bloating my inbox, I've overlooked legitimate login failures for my users, unintentionally. What's the best approach to either stopping these scans from triggering an alert, or blocking the probes?I'm fairly new to Fortinet products, so I'm not completely well-versed in the full capabilities of the firewall. Possible approaches:[ul]Block the CIDR of the most frequent offenders for UDP 500 (may/may not be problematic, as it's on the Hurricane Electric network.. most

A FortiOS 7.4.1 document outlines how to use a kdc proxy server to help get znta access to smb file shares.  Has anyone successfully built this and got it to work?  If so, I'd like to compare notes to see what I might be missing with this setup.

Hi, I have a customer running v4.2 patch2 on a pair of 620B' s. They have a webfiltering identity based policy which uses LDAP authentication. The requirement is for users to only need to explicitly authenticate once each day so the Authentication Timeout has been set to 480 minutes. This seems to be working as expected and users are only asked to authenticate once, however we have just noticed an issue. Users are reporting that their AD accounts are being locked out at least once per day; an example of the DC events relating to this are shown below: Event Type: Failure Audit Event Source: Microsoft-Windows-Security-Auditing Event Category: (14336) Event ID: 4776 Date: 04/11/2010 Time: 13:42:59 User: N/A Computer: xxxxxxxx01S.xxxx.xx.xxxxxx.xxxx.xx Description: The domain controller attempted to validate the credentials for an account. Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon Account: BL

Hello, I would like to use Fortiauthenticator as an IDP for WIFI authentification without using any Fortiauthenticator user licenses. I have Fortigates 7.2.9 and FortiAuthenticator 6..6.2. 

I have a corporate Wi-Fi network with social login, and I would like to make the Gov.BR function available to users who also use it to connect to this network, but I saw that it is done through OPEN ID and OAUTH2.0.Is it possible to perform this integration with Fortiauthenticator? Here is a link to the Brazilian government website explaining how the integration is done on their side https://acesso.gov.br/roteiro-tecnico/iniciarintegracao.html#passo-1

I have a vm network in vshpere with 2 DCs, they route through the fortigate 100e to a remote site with another 100e on older software. The DC1 can ping let’s call it IP 10.0.0.1 but DC2 can’t ping it. DC2 can ping 10.0.0.2 and DC1 can’t ping it. Both DCs in vsphere have exact same configs, on same host, same subnet. For the life of me I’ve been battling for months trying to figure out what it could be…. I need someone to help me deep dive and solve the ping drops that occur from other sites behind the remote fortigate….

After upgrading from FortiClient 7.0.10 to 7.2.3, I've noticed that the exclusion list in the Web Filter no longer works.  No changes were made to the web filter policies, web browser plug-in is enabled in the policy and installed on the client, what gives?  My clients are all configured to use the web fliter plugin only when the endpoints are off-fabric, sync mode ad check user initiated traffic only are both enabled in their profiles.  I've tried every combination of the three and get the same result. For example, If I try to block Facebook, Twitter, or TikTok using a deny entry for each in the Web Filter Exclusion list, the sites do not get blocked on the client.  I've tried all three exclusion types (Simple, Regular Expression, and Wildcard) and none of them block the sites any longer. I've tried in both Edge and Chrome with the same results. Downgrading back to 7.0.10 resolves the issue. Anyone else experiencing this?

How can I change the IPsec tunnel preshared key? It can't be done in the gui. When I edit my tunnel and select the option for preshared key, the field key entry field doesn't appear like it does when creating a new tunnel. Is there a way to do this in the cli? So far I haven't found it.

Hey, in our environment we have a lot of FT VPN clients with different versions (majority is 7.0.7.0345), I want to deploy an update with Intune help, however I am encountering issues with update. I can successfully deploy FT client, however with update it is another story... so Intune manages the updates all good, however when I am trying to open new version of FT client I receive JavaScript error (please see the attachment), I tried installing 2015-2022 VC redist, but it is no luck (please note that I do not have older versions of VC redist). Maybe someone has a workaround / solution and willing to share ?

Hello All, Hope all good!I have a question, if someone already configured SAML before Login.Basically, SAML Forticlient works with Azure at our environment and VPN Before Login with the same Forticlient version works. My issue is now, that I want to have VPN Before Login, but with the SAML. I set up everything basically what is needed on the EMS, the Forti and on the Forticlient, but it stil ldoesn't work.On my Windows Test MAchine it says: Unable to connect to VPN and it leads me back to the login. Thanks for your help!

Hi, I am wondering if FortiGuest is capable of interfacing with a ticket printer and PMS Fidelio suite V8 to build the authentication portal, can you confirm? Thanks.