Fortinet Community

I have configured a Public IP to access a server in my Lan (VIP mapping to internal server), it's working fine: from my home I can access the server, through the internet, by the Public IP. Now I want to access that same Public IP by a hostname (DNS), how do I achieve that? In the LAN there are DNS servers (BIND in split-horizon internal_IPS/public_IPS) which, when used by the previous firewalls, did that resolutions ok, but when used with Fortigate FG100F, v7.2.8, in "Network" -> "DNS" -> "DNS servers" -> "Specify" they just do internal resolution, including to the internet(!), what I mean: From the internet the hostnames are resolved to the internal_IPS zones from BIND servers. I know this must be a super simple question but I only find information about setting internal DNS for internal queries in a Lan. I followed the "technical tip" https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-FQDN-based-VIPs-from-GUI/ta-p/193165 but to no a

I have several FAP233G's (running a mix of 7.4.2 & 7.2.5) managed buy a Fortigate (running 7.2.8). I have configured a new SSID to run on Radio3. I configured the SSID to use WPA3 Enterprise and added it to my AP Profiles. However, the new SSID is not broadcasting.  What am I missing?

I have a very basic setupRemote LDAP server defined, perfectly accessible fine.Local group (Firewall) with members being specified as AD security groups System / Administrator defined as Remote User, Remote User Group the one above (LDAP) But what actually seems to be used is RADIUS (I can see that in debug log) and not LDAPI had to make changes to NPS RADIUS setup to be able to login That is on v7.4.4 build2662 (Feature)  Anybody else noticed? Seb

Hi, i am trying to set up a Web Filter Profile on my FortiEMS and am struggling with the "warn" Action.Everything works fine when using the the action "block", no issues at all, but once i change it to "warn" nothing happens anymore.It doesn't matter if it's what line i change, the problem always occurs.I'm using FortiClient 7.2.4.0972.Does anyone have an idea what might be causing it or how i can solve my problem? Thanks!

Hi, Was wondering if it's possible to use Radius authentication on the Fortigate ports, and send back Dynamic VLANs from the Radius server?I wan't to use the Fortigate ports as switched dot1x ports to authenticate different types of devices.

Hello guys,Please excuse me if I am in wrong place.I am using forticlient for my university VPN to connect to the intranet. However, it is very slow for the other websites. Is there anyway I can exclude other websites/applications from the VPN?

Hi, I need to access a website, but even though I have listed it as "Exempt" in the web filter profile, the stations still time out. How can I fix this? I have an outbound policy that allows all traffic with specific countries permitted. The website I need to reach is "scopus.com." How can I ensure access without creating a dedicated policy?Kind Regards,Sisma

The rapid growth of electric vehicles (EVs) and the corresponding need for extreme fast charging (XFC) infrastructure have highlighted the importance of robust cybersecurity measures. The NIST Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure (NIST IR 8473) offers a detailed, risk-based approach to managing cybersecurity in this complex ecosystem. FortiSOAR, with its advanced capabilities, is ideally positioned to help organizations comply with this profile. Here's how FortiSOAR can enhance compliance across the various phases of the NIST framework:    Introduction to NIST IR 8473    Electric vehicle (EV) charging stations are critical to the growth of the EV industry, much like gas stations are for traditional vehicles. Countries worldwide are setting ambitious targets to ensure widespread availability of these charging points. For instance, the EU aims for 3 million public charging points by 2030, and the US targets at least

I have a working (99%) Captive portal, User gets a captive portal registration page, fills in a few details and then it is set for admin approval, the problem is, the user never gets sent the random password?  I have left the admin email address out on this screenshot, but, my understanding is, the admin gets an email to say "approve" and then the details get emailed to the guest? when I hover over the "Account Delivery options available to the user" it says "Account information can not be displayed when admin approval is required" does this mean, as soon as the admin approves, they have access?  how would they know what the random password is? very confusing!Thanks   

Hi All, We've seen some issues with the Android Forticlient version 7.2.3.0136 that was release on the google play store recently, where users are unable to sign in where saved credentials are not working (specifically the username) and the fortigate telling me invalid credentials. Tests seems to indicate that it looks to be directly linked with the saved username, as older versions of the client don't seems to have this issue and if we specify the username users can log in with this version. Anyone else seen any issues with the new forticlient version available from the play store? I suspect a bug, but Fortinet TAC don't support the free version of forticlient. Thanks!

Hello Fortinet Community, I'm seeking advice on the best approach to secure our network. Our goal is to allow access only to domain-joined PCs and implement compliance checks.We currently have FortiClient installed on all user devices, and I’m trying to determine if we also need the FortiNAC Persistent Agent, or if integrating FortiNAC with EMS would be sufficient.Is there a comparison matrix available that highlights the features of the Persistent Agent and FortiClient specifically related to FortiNAC?Any insights or best practices would be greatly appreciated. Thank you!FortiNAC FortiClient 

I'm looking at some firewalls and their security ratings , trying to clean some things up and I'm seeing several firewalls with what seems to be out of date IPS Definitions . Are they not supposed to be updating Automatically or is this something I need to do Manually? Thanks,   

HelloIn FortiMail, we can configure for each domain only 2 SMTP servers (primary & failback).I need to configure a third one (another failback server) but I couldn't find a way to do from GUI or CLI.Any help would be appreciated. Otherwise why this limitation?

Hello,I use fortigate and fortiauthenticator and my configurations are correct,but some users can establish a connection after a few tries while vpn,When I look at the fortiauthenticator logs, it says that the user was previously authorized and remains in the cache, remove itlogs as below how can I solve this problem ) facauth: Sending email token code (timeout 180) to firat.gazel@cnbce.com 2024-06-13T13:56:29.921757+03:00 FortiAuthenticator radiusd[24056]: (34) facauth: Updated auth log 'firat.gazel' for attempt from 10.100.100.1~176.236.73.154: Remote LDAP user authentication partially done, expecting email token 2024-06-13T13:59:18.771835+03:00 FortiAuthenticator radiusd[24056]: (35) User-Name = "firat.gazel"2024-06-13T13:59:18.772239+03:00 FortiAuthenticator radiusd[24056]: User-Name = "firat.gazel" 2024-06-13T13:59:18.772331+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: ===>Username:firat.gazel 2024-06-13T13:59:18.773880+03:00 FortiAuthenticator radiusd[24056]: (3

Hi, I need a way to receive an email alert when the FortiGate itself goes offline. I have FortiManager & SMTP Email server is configured on the FortiManager. Is it possible to create an alert to trigger a notification when FortiGate devices go down and an email is sent via Fortimanager to a recipient?

Hello everybody, i would highly need your assistance in preparing for FCP Network Security Exam, i can see that there's a core exam which is NSE4 and one elective exam my question is how to prepare to the exam ?there're alot of topics in FCP network security, may i know which topics is mandatory for the exam and what should i start to study as i must take the exam in a month from now ??where the NSE-4 topics?! how can i get it ?please assist!    

Dear team, could you help me with the following scenario. We have a PC that is used by two users (each has their own VPN account). However, when user X wants to log in to the VPN with his account, he cannot because the other user's account is saved. In this case, the first time they logged in, the access to the person who logged in to the VPN was saved. The problem is that now that another user wants to use the same computer with his account, he automatically logs in with the other account that he logged in the first time at the Forticlient level and the login interface does not appear. Could you tell me where I can configure Forticlient EMS so that it can request credentials from the user who is going to connect each time he logs in?

Long time lurker, first time poster. Hi everyone.We’re upgrading some FortiAP 221C access points with FortiAP 223E access points. Straight swap I thought and plugged the 223E into the same PoE injector which was powering the 221C, a Ubiquiti branded PoE-AF injector - UniFi PoE Adapter (15W) - Tech Specs (ui.com). The document that came with the 223E AP says to use a PoE AF injector.This worked fine on my test bench. The 223E powered up and I was able to add it to the controller, then took it to its permanent location where is failed to power up at all. Now it won’t power up on my test bench either.I contacted my reseller who said I needed to use the GPI-130 PoE injector which is a PoE AT specification? I purchased one which has worked with a second 223E on the same cable that the first one failed on using the AF injector but I can’t understand why?

We have been using Forticlient and EMS for the last 16 months. We have had a very mixed experience with Blue Screens, failure to connect, UI issues etc. In general support tell us to update to the latest client version. We have just started updating to 7.2.4 to addres another blue screen issue in Windows 10. Our confidence in this product is low and one of the key factors is the vagueness of the known issues on the release notes. I look at the latest release notes for 7.2.4 here Known issues | FortiClient 7.2.4 | Fortinet Document Library and here Known issues | FortiClient 7.2.4 | Fortinet Document Library I could argue we are being impacted by at least the following but there is no detail into what causes this (spefici conditions or otherwise :(:( 994884: SSL VPN connections get stuck on 40%.909755: SSL VPN split tunnel does not work for Microsoft Teams.961079: New Microsoft Teams application does not work if application-based split tunnel is used.1002294: Fo

We are in the process of doing a basic Forticlient EMS setup. I've been going through all documentation and searching for answers to the last part of the puzzle.  Our setup: Forticlient EMS on Windows ServerFabric is configured on FortiGate and syncing tags correctly (although not currently used)We have setup a VIP to permit the telemetry port 8013 through to the EMS server. We have configured one ZTNA connection for an RDP server. We are currently using default 443 for the ZTNA connection to the inside device on port 3389 just for testing. The client device is connecting to the EMS server and is receiving the ZTNA destination correctly.  We have configured a ZTNA Server to allow the TCP traffic from external ip on port 443 to the internal ip on port 3389.  We have also created a Firewall Policy for ZTNA to allow the traffic to the ZTNA Server. But at this point when we try to connect to the RDP server on our test machine, we never see

Hi. I registered FortiSwitch to my previous account, and now i would like to move registration to desidered company  account. Is it possible? For FortiGate it's quit easy. I cant find any info in documentation and in GUI/CLI. Thanks for any tip.  FSW 124F - 7.2.4. Managed by FortiGate. b/rwkasprz 

Is it just me or are firmware downloads from the Fortinet support website abysmally slow? For weeks I tried to download firmware images but all I get are some 40kb/s on a 500Mbps fiber connection, usually only to time out mid-download with an "Error executing your request. Please try again later.", and the download turning into a "DownloadFirmware.htm" file of 1kb size.  I tried downloading from our business grade internet connection at work, from home ISPs and even via cell phone. I also tried to download from other regions (US, JA; I'm in UK) via VPN. I tried different computers using different operating systems (Mac OS, ChromeOS, Linux) and browsers (Safari, Chrome, Firefox, Edge), no change.  And it seems as it's not just direct downloads, as it took over 60 attempts for a 60F to download its firmware upgrade. From what I know I'm not the only one experiencing horribly slow downloads, and it seems especially European users have been suffering for quite a wh

Hi,I have a brain-damaging situation ;) and maybe someone out there has a good idea.We have a Master/Slave Fortigate setup. On each Fortigate, we have 2 uplinks, which may contain the uplink because of redundant BGP setup behind.I now have the problem:- Do I assign Port 1 for the first BGP uplink to the SSL gateway, it would not work, if Port 1 is down and Port 2 is up- Same here, assigned Port 2, is the same, as with Port 1- I would need to assign an ip-address on both ports. So I could enable both ports for the SSL VPN gateway. VRRP would not work, because both are active and up because the routers behind are, tooWe need it, that are staff can login to the VPN, not using different hosts / IPplease, no DNS Stuff with refresh/TTL, this is not the kind we use to fix the problem ;)Any help would be niceThanksRonny 

Hello everyone, I have two Fortigate 201F firewalls in HA (active-active mode), both firewall are connected to the same Switch core (two stacked switches) which are connected by an aggregate port (two sfp for device). The problem is when I try to disconnect the two sfps from one forti to view if the traffic continues to the other firewall, this results in that traffic won't reach. It is as if the second firewall does not receive any traffic, but on the first firewall if I only disconnect a single SFP the traffic continues to arrive.Why the traffic wont arrive from the second firewall?

Hi.We are going from Zyxel products to Fortinet. I configured first Fortigate 60F whith same NAT of old devices as with the same wan, in testing lab everything is ok. When put in production enviroment nothing works, seeming that firewall is not seen from internet.Configuration (working now with old firewall) is simple: Fortigate 60F connected to lan on port lan1 and connected to router on Wan1. Configured on wan in dhcp ( reserved ip fron dhcp server) and configured ad DMZ on router.In testing enviroment averything works fine. On site since everi lan client can use internet, the device isn't reachable from outside and makes router work very slow first, unraechable neither from lan after some time.Tried to change router (FritzBox) nothing changes.When in test and working fine used same kind of router, same router software version. Different provider, but both with public ip ( fixed in one case, dynamic the other). The old (Zyxel) firewall is still working with the same configuratio