Fortinet Community

I am new to Fortinet MC-LAG designs, so please help me. With regards above topology, I have come across configuration examples for the following situation:1. Spine switches CS1 and CS2 are MC-LAG peers and present themselves as a single host to both switches AS1 and AS2.2. Switches AS1 and AS2 are also MC-LAG peers and present themselves as a single host to Server 1.My question is, is it possible to do MC-LAG in the opposite direction i.e. using AS1 and AS2 as MC-LAG peers and presenting themselves as a single host to either (or both) CS1 and CS2?Is it necessary in the first place or the Spine-to-Leaf MC-LAG covers traffic balancing and eliminates loops in both directions spine-to-leaf and leaf-to-spine?Design

Hi All, The VPN getting stuck at 98% and below is the errors i see in the client logs.  we tried to re-install the forticlient software but no luck.   5/16/2024 11:49:57 AM warning sslvpn CSslvpnAgent::InitPipeHandle() 137 CreateFile() failed.. LastError=2315/16/2024 11:49:57 AM error sslvpn Failed to connect to SslvpnDaemon, LastError=05/16/2024 11:49:57 AM error sslvpn CSslvpnAgent::Initialize() 178 InitPipeHandle() failed.5/16/2024 11:50:15 AM error sslvpn failed to create tunnel_thread thread5/16/2024 11:50:15 AM error sslvpn error: ras_loop(), waitResult=1.5/16/2024 11:50:15 AM error sslvpn failed to create ras_thread thread5/16/2024 11:50:15 AM error sslvpn failed to create monitor_thread thread

Hello, is it possible to get a mail notification from fortinet, whenever a new Firmware release of Fortigate is available? GreetingsAndreas

Hello. Is it always the case then when a license renewal is purchased, the new (or existing) license code is applied to the firewall, or do I have to manually apply the license? Thank you.

Hello, We have just started to install 2 Fortigate 620B and 1 FortiAnalyzer 100C to our existing system. Right now our network details are as follows; - 3 WAN Connection, - 3 Interrnal Lan VLAN and - Juniper ex4200 switches (virtual chassis) in the system room. We want to operate our 620B' s as A-A HA cluster and we are trying to figure out how to do ... We made the related configurations and settings for our master device. Right now we want to figure out correct cabling. Currently our master device is up and running. Cables from WAN devices and VLAN ports of juniper' s connected to our master. But we want to add the orher device and configure them as intended. Let me ask if my assumption is correct; - Connect two port of the both 620B devices with each other (and setup), - Connect two cable from let' s say ADSL modem to both of the 620B' s, -- Can we use ADSL modem' s ports for this cabling ? -- Or do we have to use a seperate hub/switch for cabling ? -- Ca

Hi everyone,I am writing to ask for advice regarding a configuration I am facing for a customer. The current situation is as follows:The client has 13 stores and one headquarters. Each store is connected via IPsec VPN to the headquarters via a Mikrotik device. My proposal is to replace the current firewall on site with a Fortinet 91G, and configure the IPsec tunnels between the site and the various stores, keeping the Mikrotik devices in the stores (each with its own network class).What I'm wondering is:WAN failover: Is it possible to configure the Fortinet so that if the primary WAN goes down, the IPsec VPN tunnel automatically switches to the second (backup) WAN?Simplifying IPsec Configuration: Is there a way to avoid creating individual IPsec VPN configurations for each store? I would like to know if there is a more efficient solution, such as using Dialup VPN mode.Thanks in advance for the support! I hope I have been clear

Hello!I need some help. I have 3 ADs server, where my FSSO agents are installed in collector mode. Yesterday right around mid day we started to receive reports that the authentication has droped for several users (and by several i mean almost 1000 users). Most have than already athenticated on the login portal Fortigate displays when not using NTLM or FSSO to auto login; a few users with NTLM also did succesfully logged on. On trying to diagnose the problem i noticed that there where only 10 users using FSSO (looked at "Firewall User Monitor on my fortigate). Furter diagnostic directly on the FSSO agent on AD2 have also showed only 10-11 users on " Show logged on users".I have validated and i could see login and logoff events on thge "event Viewer", still can:I took a look at the FSSO log directly and i could see me Fortigate connecting on that agent, but i don't see a disconnect log:My external connector on every Fortigate has all 3 agents configured, some althought the AD 2 where con

Hello everyone I am a network analyst and I have updated a forti 60f from version 7.0.2 to version 7.2.9 and now I can't manage it remotely, how do I reach the equipment without having to go physically ?

I need the firmware to set it as demo for my student

Hello Engineers ,  Does anyone know what kind of encryption FortiGate uses for user passwords and how is it stored in the configuration file? i mean the local users what type pf encrypted that used ?

Hi everyone, I'd appreciate some help over this problem. We use 3 DNS servers : 1 FortiGate DNS Server, and 2 DCs DNS. We can only use 2 IPs on most of our equipment, and we want to have FortiGate IP + Virtual IP (Load balancing to both DCs). This means to stay on our LAN (X.X.0.0/16) only, and the VIP would be on the same network as the real servers.  Here is a scheme to get a better idea: So for now I followed more or less this technical tip I found : https://community.fortinet.com/t5/FortiGate/Technical-Tip-VIP-IP-virtual-server-type-on-the-same-internal/ta-p/221782 I do have a Virtual server, and a corresponding address. Here are my configurations :VIP:Address:Policies: The issue is, whether from vlan10 or vlan213, I can't access at all to my VIP. The thing is, I am getting timed out and I'm not receiving a destination unreachable error. Still, the Hit count of my vip or the traffic trough my policies stays at 0.  Any hints on

If sender alignment is used on Fortimail, it will block emails sent by some third-party applications for example from smartphones even if a domain of the sender (e.g. gmail.com) is legitimate. Would you happen to know how to avoid it?

If we configure an installer on /ems with "Deployment & Installers" -> "FortiClient Installer" to use a specific invitation and profile the installer itself (neither exe nor msi) actually installs a fortiClient which has EMS registration and connection during the first start... Up until an invitation code is entered. Why is the configuration of an invitation and default enabled modules for the installers possible, when it isn't baked into the installer? Do we have to run the FortiESNAC.exe -c REG_REG_TO_CLOUD -r [Invitation Code] process and option in all cases a FortiClient is installed - independent from what had been configured on the EMS to create and download this exact installer?

Hi expert, I’m going through the API document but cannot find any API endpoint to release quarantined email.Does any body have ideas on how we can automate the quarantine release? Best regards!

hi,i'll be doing an OS upgrade on a FG HA pair.if for some reason I need to "downgrade", do I just select the OLD firmware, reboot and then restore the config referenced to the OLD firmware?is the downgrade the same as upgrade process, i.e. i only upload the firmware in the primary/active FG, it will auto push firmware to secondary, auto reboot secondary, then auto reboot primary?

I have a LAN with 2 FGT's.  SSLVPN coming in to FGT1 can not reach FGT2 and server on FGT2.  Not sure where my issue might be.

Hello Engineers,My FortiGate is 601F and Frimware V7.4.4I’m encountering an issue with scheduling backups from FortiGate to our backup server. The backups are being executed successfully, but the filenames do not include the date and time as required.Here is the script I used:execute backup full-config sftp /FortiGate-FW/%%log.date%%.conf 10.220.210.10 admin klJKdfhd#54@dm,fI need the backup files to include both the date and time. Could anyone advise on how to modify the script to incorporate timestamps in the backup filenames?Thanks

Hi guys,  I hope you're well. Wonder if someone can help, I discovered a FortiSwitch on port8 and after the discovery I wanted to create a trunk group to my firewall to connect multiple ports (port1, port2). However, the problem is despite the switch being connected on port1 and port2 the port8 is still displaying as a reserved FortiLink interface and I cannot remove it.   I have tried to reboot the firewall, switch and sync configuration etc but nothing has worked. Port8 is no longer on the trunk and I can see no other configuration on the switch which would cause this to still display. Does anyone have any ideas? Thanks, Dan. 

Hello. I have a problem with my Forticlient access. I get a java error. Can You help me?

To allow a website from a blocked FortiGuard category on a FortiGate firewall, follow these steps: Log in to FortiGate: Access the FortiGate web interface using your admin credentials. Go to Web Filter: Navigate to Security Profiles > Web Filter. Edit the Web Filter Profile: Find the web filter profile being applied to the policy and click on Edit. Override the Category: Under the "Static URL Filter" section, click on Create New or Override, then enter the URL of the website you want to allow. Set Action to Allow: Change the action from Block to Allow. Apply Changes: Save the profile and ensure it is assigned to the correct firewall policy. Test the Website: Verify that the website is accessible and the policy is working as expected. Make sure to review the organization's security policies before allowing any website. 

Mua nhà trả góp: 5 lưu ý quan trọng, điều thứ 2 không nên xem thường!Mua nhà trả góp hay vay tiền mua nhà là chuyện vẫn thường xảy ra khi người mua chưa đủ vốn để trả cho toàn bộ ngôi nhà, tuy nhiên khi tiến hành vay mua nhà bạn nên cân nhắc thật kỹ lưỡng để không rơi vào tình trạng vỡ nợ. Để đảm bảo an toàn, bạn nên tham khảo thật kỹ 𝟓 𝐥ư𝐮 ý 𝐪𝐮𝐚𝐧 𝐭𝐫ọ𝐧𝐠 khi vay mua nhà cùng Lâm Thành Tiến, hãy chú ý điều thứ 2, chớ nên xem thường!  1. Vay mua Bất Động Sản phải chọn căn phù hợp khả năng thanh toán:Việc chọn ngôi nhà có giá không phù hợp với khả năng chi trả là một trong những sai lầm lớn nhất của người mua nhà lần đầu. Theo chuyên gia địa ốc Barbara Corcoran, bạn nên chọn căn nhà mà chi phí dành cho nó không vượt quá 30% tổng thu nhập hàng tháng.Việc này vô cùng quan trọng, đặc biệt là khi bạn mua nhà trả góp. Bạn cần đảm bảo rằng, tổng chi phí gồm số tiền phải trả ngân hàng mỗi tháng, phí cải tạo, phí bảo trì... không vượt quá 30% thu nhập.Bạn c

I recently installed a forti image V7.0.11 on pnetLab. I set up my lab which contains the forti, the cloud and a computer. I configured everything and I was able to go out on the internet. After some time the ping to the internet no longer works from the pc but the forti pings the internet well. At first I said to myself I may have changed something without realizing it. So I set up another lab, it was the same thing. I set up a third lab and I set the timer to about 1 hour the ping to the internet stopped. Every 1 hour I have to set up a new lab. I need your help.

Hi all,I'm not a Fortigate or Freeradius expert by any means but I usually manage to do things if I get some notes how to do things.I would like to accomplish the following.Part 1Authenticate windows 11 native ipsec vpn users with certificates (EAP-TLS)Firewall is Fortigate with 7.2.7 firmwareRemote user ipsec vpn with certificates, users are stored in LDAP (Not AD) directory, certificates contain e-mail address and cn.Freeradius is used as Radius server, connected to LDAP Backend, want to use that LDPA server to verify certificate and return authenticated/not authenticated. Part 2WPA2 authentication for windows 11 users with certificates (EAP-TLS)Wireless authentication for primary Windows 11 users, Fortinet Access Points connected to Freeradius server via Fortigate Firewall. Part 3802.1X authentication for wired clients, Fortinet Switches connected to Fortigate firewall and Freeradius server.There are lots of playbooks for doing this with Windows AD and Windows NPS server,