Fortinet Community

Hi ZTNA admins We were accessing ZTNA destinations with FQDNs from our Windows Clients, but since few days we are not able anymore, without any apparent reason or change.For now the ZTNA destinations can still be accessed by IP addresses.Following some tests I found that FortiGate and EMS can resolve the related FQDNs properly (back-end servers).However when trying to resolve the related FQDNs from client side I noticed that they dont resolve to the right IP addresses, but to strange addresses like 10.235.0.2, 10.235.0.3 and so, which are not part of our network! Anyone had the same issue?Anyone knows what is this range (10.235.0.x)? Is it internal to FCT as part of the proxy system?

I have an environment with 3 Azure datacenters (US, EU and APAC) and over 60 branch offices spread among the US, EU and APAC.  I have been trying, futilely, to get a definitive answer on the best way to deploy the security fabric in this environment.  The key hangup in the 35 maximum downstream devices statement in the FortiOS and Best Practices doc.  In my mind I envision a single fabric with our Azure US Fortigate as the root, but this doesn't square with the doc, unless I'm reading it wrong.  Does anyone have experience with deploying the fabric in larger distributed environments?

Hello,I have a problem with FortiClient (7.0.5.0238). I lost internet connection when connecting SSL VPN via FortiClient. I found this article: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Lost-internet-connection-when-connecting-SSL/ta-p/286345 but this solution is not working because: "After connecting to the VPN, do another 'route print' command. Note that, in the results displayed, the 'gateway' IP for the '0.0.0.0' entry has changed." - NOT, the gateway is still the same for both adresses and deleting route 0.0.0.0 is useless. Do you have any other ideas how to solve this problem?

My user is unbale to access FTP server from ssl vpn which protocol need to add in firewall policy when I add all services to the firewall policy, the SSL VPN user able to access FTP server but when  i  add FTP services in firewall policies the user unable to access FTP Serveris there any other services need add in firewall policy to access FTP server 

I am trying to achieve granular access control for each user, with strong definite unspoofable identity with IPsec user identity. IPsec login uses user account, and by allowing each user to only access the network through IPsec, I thought I should able to let Fortigate know which traffic is from which user, and create firewall policies on each user. (ChatGPT told me it's doable on Fortigate that's the reason I bought it :loudly_crying_face::loudly_crying_face::loudly_crying_face:) I have a Fortigate 60F on 7.2.8 After setting up a Remote IPsec connection, I found out IPsec identity is only good for IPsec login, but NOT for user traffic identification. If Fortigate can associate the IPsec VPN traffic with the user identity used for IPsec login, so firewall rules can be applied, then it would be so powerful. But... it's not working. In the FortiView Sources, after connecting, it just appears as a source with NO user identification, or MAC address, just a IP addre

Goal: Set up VxLAN over IPSEC to stretch LAN over Internet to another location Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-setup-a-VXLAN-over-IPsec-deployment/ta-p/297665 Device: FG-60F v7.2.6 Configuration: factory default, wan1 set as Internet interface, internal VLAN Switch as LAN interface with members internal1-5 Problem: adding existing LAN interface internal1 to soft switch interface causes an error:entry not found in datasource Steps taken: IPSEC tunnel is already configured Set up the VXLAN peer based on the IPsec tunnel interfaceconfig system vxlanedit "VxLAN-Interface"set interface "VPN-DR-IPSEC-VxLAN"set vni 11set remote-ip "10.10.11.2" Create a switch interface to bridge the local LAN interface with the newly created VXLAN interfaceconfig system switch-interfaceedit "VxLAN-Switch"set vdom "root"set member "internal1" "VxLAN-Interface"---> entry not found in datasource 

Dear all, I just read this KB https://docs.fortinet.com/document/fortigate/7.6.0/new-features/634909/socks-proxy-supports-utm-scanning-authentication-and-forward-server , and it looks good to my operation.So I tried to set up one Evaluation Fortigate and see if Form-based Auth is also supported. But seems no luck here. The Form-based auth only appeared when I selected HTTP protocol. If I selected Socks. No luck then.  Is there any way to achieve Captive portal + Local User DB + Socks-based proxy Auth on Fortigate?  

Hello everyone,I observe strange behavior with ACME client. I use it to generate certificate for firewall's web management running on default HTTP/HTTPS ports (not using any form of SSLVPN). When Let's Encrypt certificate successfully renews, it still remains in staging for some time (maybe day or more) and only then is deployed to the firewall's management webserver. Meanwhile previous certificate is still in use. Why is this happening? Is this by design?   fw # get vpn certificate local details LTSNCR == [ LTSNCR ] Name: LTSNCR Subject: CN = example.com Issuer: C = US, O = Let's Encrypt, CN = R10 Valid from: 2024-06-20 08:02:07 GMT Valid to: 2024-09-18 08:02:06 GMT Fingerprint: 7E:16:DE:13:E0:35:DC:52:F0:A4:DE:B8:CB:56:17:88 Serial Num: 36:00:5a:3e:a6:1d:15:13:6c:e3:14:03:92:06:58:00:ec:9d ACME details: Status: The certificate for the managed domain has been renewed successfully

Getting logs in system event in FortiGate about "Admin login failed" and showing ip of the (Server connected to the internal network) as the source ip what to do? Is disabling SSH will work for it. or SNMP will work. Please suggest what solution we can do?

I have successfully imported my certificate which is signed by my CA. The problem is I cannot choose it as HTTP server certificate. I see only two options, even though I have many more certificates in System -> Settings -> Certificates. I 've tried also via command line but again I only see these two options.Thanks in advance. Edit: I have also imported both Root CA and Sub CA certificates.

Hi everyone, I've been trying to understand if it's possible to assign an IP when using ZTNA.What I mean is when using SSLVPN I reserved a single IP for every user, is there some way to implement something like this using ZTNA?

Hi all,I achieved the NSE4 - FortiOS 7.2 Certification on September 21 2023. I am trying to get FCP certified but because of the certification transition, I am unsure which certificates I still have to achieve in order to get FCP certified.I think there are only two options possible:Option 1: the cert is invalid and I have to do a Core exam + one elective.Option 2: the cert (NSE 4 FortiOS 7.2 cert) is equal to the current Core exam so this means I only have to achieve one elective exam. I only have to make sure that it is before september 21 2025Can someone confirm or explain how I can become FCP certified in this situation.Regards

I understand Fortigate must do this by default but I have not found this stated in the documentation. In my case, the Fortigate-100F seems to have no TPM and even if it had the admin manual does not mention that login credentials are encrypted by the TPM. Therefore, is there any official source which confirms login credentials are encrypted in a Fortigate-100F?

Hello.We'd like to configure our FortiAuthenticator as SAML IdP. The first authentication factor is password from AD. We've tested several OTP options: fortitoken, sms, email, etc. and the work fine but we'd like to use another second factor: client certificate. We've used local CA or remote CA, and we've configure "certificate bindings" under user configuration, but when SAML web page is shown, it only asks for username and password, and it doesn't prompt to chose a certificate.Anyone knows if it's possible to configure 2FA with AD password and user certificate?.Thank you!.

Hi All,Last weekend we replaced a 200E with 120G. The 200E was managed by Fortimanager and was logging to fortianalyzer. After the replacement I was unable to get the 120G to log to FAZ or to be managed by FMG.For the connection to FAZ:When I enable the fabric connector i receive a popup with the serial number of the correct analyzer. For me this means that the source-ip of the FGT is allowed to reach the FAZ device and is able to communicate since it is able to retrieve the correct Serial number, open ports are UDP and TCP 514. When I navigate to FAZ the device is not available in unauthorized devices. For the connection to FMG:I am able to reach TCP-541 on FMG from the source-ip that is configured on the FGT. When opening the CLI and running some Debug and sniffers I notice that a connection between the FGT and FMG is established but for some reason the FMG is not able to list the FGT as an unauthorized device.  This is a part of the output on the FGT, we can find similar o

Good morning, I want to create a secondary Data Center out of my office as a backup in case that something bad happens to the main office to continue working and I have some doubts. First of all I configured the Fortigate 100F that I bought for the secondary Data Center with the same configuratión that the main Fortigate 100F, I used the firewall backup archive to configurate the new one. I need to know if the firewall for the secondary Data Center is going to steal the licenses to de main firewall or he needs new licenses for him becouse I want to prove if the new Data Center works OK but I dont want to loose the licenses of the main firewall. Thanks a lot.

hi, can anyone please advise whether fortigate accept gratuitous arp sent from other device (like router, load balancer...)? some network devices will send out gratuitous arp when failover occur. thanks in advance!

I can say I'm pretty inexperienced with routers so please bear with me but I got a VDSL Globalnet subscription which includes a G-antivirus or something but for some reason it blocks a lot of websites giving me an error saying "disable Fortinet web filtering" or "Fortiguard recognizes this element as hazardous" and things like that but I don't have the Fortinet nor Fortiguard antivirus installed so I figured it's got to do with the router or network host

I want to add multiple subnets in my existing IP Sec VPN tunnel.could you please suggest is it possible??

As the title suggests, I have a number of small web applications that I need to refresh the firewalls for. Currently using cisco asa5506-x which was fine until we started doing more layer 3.Externally, we currently have around 25mbps with peaks at around 100mbps and we are looking for the basic security functions, probably just the IPS (ATP license). We have no internal users, little VPN and 10 vlans.Internally, network is 10gb and we are running Vsan/vmotion but these would not go via firewall. At most, the internal traffic will not go over 1gb and that's probably due to backups running directly from servers.Looking at the specs, it suggests it will do well in excess of that. However, in the real world does this sound sufficient?I was looking at the G series for the new hardware.Thanks

Hello,Our newly deployed Fortigate firewalls at our DC, which are managed via FortiManager. At the time of deployment we created a tunnel with one of our offices. Now I want to modify the Local Address on the Fortigate firewall. When search in Policy & Objects tab on FortiManager for the address group used as Local Address in the IPSec tunnel, I cannot find that address group. However when I login to firewalls directly, i can find that address group. I cannot (should not) be making changes directly on Firewall as these changes will be wiped out upon next policy push from FortiManager.  So how do I find the address group in FortiManager which is used as Local Address in IPSec VPN configuration so that i can edit it.  Thanks.

Hello FortiNAC community, Recently i started a new projet where i have to deploy and configure FortiNAC, keep in mind i know nothing abt FortiNAC so bear with me please I encountered an issue when i was trying to add a device(Switch in this case) in the inventory, my client told me that they have unconfigurable Switches Does anyone have a solution on how to add a Switch that you can't configure an IP address in ? Thank you in advanceBest regards,

Need to understand if the FG-70F in my hand can be able to support two IPSEC VPN via WAN interfaces connected to two different ISP in active active mode (with load balancing). This is branch and at central side we have other FG with different model but same motive.  Please let me know how is it possible to implement this. 

Hello good evening dear friends, we have an issue with the nmap command nmap -sV -p 161 but we have a segmentation firewall which the destination is there, currently we only have the ips in the security profiles but as a monitor, but it still appears like this filtered instead of open, do you know the reason? Thanks

hi,i'll be getting a new FG 401 but don't know yet which FortiOS code.i usually get OS 6.4.6 with newer device.my question is, since this is a new/blank FG, can i jump directly to 7.2.9?or do i still follow the "lengthy" upgrade path? 6.4.6 > 6.4.8 > 6.4.10 M > 7.010 M > 7.2.5 F > 7.2.7 M > 7.2.9 Mto my knowledge you follow the upgrade path when the FG is configured/in production so that it will "update" CLI syntax/command with the newer OS.