Fortinet Community

In our internal LAN we have the DNS server set to be the same as the Interface IP of that subnet. This DNS server is set in recursive mode and exists only to translate some domain names to IP address for internal uses. I would like to have this same functionality over the SSL VPN for some of our remote users but am unsure how to go about setting it up. 

Hello, I've got a problem with my DKIM on associated domains. When people receive mail from us, for parent domain no problem, i've :dkim=pass (signature was verified) but for associated domains dkim can't be verify, i've :dkim=fail (signature did not verify) i've the same key on all my parent and associated domain, In Domain "DKIM signing for outgoing email" is enable, an in session "Enable DKIM signing for outgoing messages" is also enable. Could you tell me what is wrong in my settings ?  Thanks

 We use sslvpn web portal to reach http/https server. We are not able to proceed after browser hits the url https://hostname-fortigate/proxy/xxxxxxx/https/login.microsoftonline.com/common/GetCredentialType?mkt=en-USI did debug for sslvpn and following is the error:[313:root:5dd]SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384[313:root:5dd]do_http_validate:442 method (POST) on uri (/proxy/xxxxxx/https/login.microsoftonline.com/common/GetCredentialType) not allowed.[313:root:5dd]sslConnGotoNextState:309 error (last state: 1, closeOp: 0)[313:root:5dd]Destroy sconn 0x7f0f70cae000, connSize=0. (root)[313:root:5dd]SSL state:warning close notify ()

Hello EMS adminsFCT EMS 7.4.0 and FCT agent 7.4.0 on Windows 10 client.For off-fabric clients we configured multiple ZTNA destinations, including one destination to access EMS WebUI.All destinations are accessible and working fine except the one for EMS WebUI (browser just shows connection closed).When inspecting ZTNA traffic on FG we see all ZTNA traffic except the traffic for EMS WebUI (there is no related log).Any idea on what's going on?

We were having trouble accessing a specific website and the issue ended up being our Geo Blocker policy was preventing access to the website. We have temporarily resolved the issue by disabling the Geo Blocker policy but would like to reenable this policy while still allowing access to the website we were previously experiencing issues with. I called the company that owns the website/server, and they gave me the public ip address for their webserver I created both a subnet allow policy and an ip range allow policy to hopefully allow access to this server while the Geo blocker policy is on. Neither allow policies seemed to work and when I looked up the company's server ip address it is located in a country that is not blocked by out firewall. I am assuming they either gave me the wrong ip address, somehow the webserver is associated with a country that is blocked by our policy, or I configured the allow policies wrong. Would anyone be able to assist in listing out the steps required to

When i inserting HTML into the templateThe recipient receives the plain text, i.e.!DOCTYPE html><html><div><strong>Ihr ASWO WLAN Zugang</strong></div><div></div><div></div><div></div><div> <p>Lieber Gast, wir freuen uns auf Ihren Besuch bei uns in Eime!</p> </div><div></div><div>DamiThe document is not converted to html by the recipient. The offered Format isMessage Format: text/html Also the question, is it possible to change the description of the template also?Is there a solution to this?Templates are not supported by the Forti Support.Thank you

I’ve been working on integrating LDAP with FortiClient EMS server v7.4.0 build1793 running on Ubuntu 22.04 but am getting "Auth Method Not Supported" when trying to add LDAP authentication server.In the EMS web console, when I go to Administration > Authentication Servers, I select "ADDS" from the dropdown, enter localhost and the admin creds, but when I hit "Test", I get an "Auth Method Not Supported" error.slapd is running and listening:# netstat -aptn |grep LIST |grep 389tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 326786/slapdtcp6 0 0 :::389 :::* LISTEN 326786/slapdAnd doing a tcpdump, I can see the traffic (although not the username and passwd being passed):17:30:52.956097 lo In IP (tos 0x0, ttl 64, id 42008, offset 0, flags [DF], proto TCP (6), length 115)127.0.0.1.41008 > 127.0.0.1.389: Flags [P.], cksum 0xfe67 (incorrect -> 0x25f2), seq 1:64, ack 1, win 512, options [nop,nop,TS val 3342323866 ecr 3342323866], length 63E..s..@.@..j.........0.......d[......g......7...7..0=...`8.

Hi ALL,We have requirement for website, want to allow only specific websites at fortigate firewall. but we don't any web filter license on the firewall. I want to confirm if can we do it or not.

Hello,My board is wanting to buy Firewall via Amazon site , will I have any issue with configuration or support problem ? today I pay for this personal service of putting ready license , do I need to do some kind of registration at fortigate ? As I'm just starting to work with firewalls, I'm afraid I won't be able to configure the equipment.https://www.amazon.com/FORTINET-FortiGate-FortiCare-FortiGuard-Protection/dp/B08126TLGJ/ref=sr_1_1?crid=1GCVFTC60DS9R&dib=eyJ2IjoiMSJ9.NkFXLMZMwVINF-vHID1IVIvS4VAG98wBT9ISu4tag6lKAwEZ9MRlWo5Mo9HI7LzbTOIWZgcw7FcyE1rDCxU00Ae0SCs6bFn9FVDey5XWBgKF7ci2gBL8btbuX1qfhXssSYw8NrMGxrAetBCWMuaHKA.GZY71woOBcUqaQ2hzu19lFsB98ekh-cIm84kPKhRhFc&dib_tag=se&keywords=fortinet%2Bfirewall%2B60f&qid=1724073149&sprefix=firewall%2BForti%2Caps%2C200&sr=8-1&th=1Translated with DeepL.com (free version)

Hello, we are using EMS version 7.0.9 and 7.0.10 in our company. we are using an old program that has no update in our users and we want to hide this application from EMS.  We can whitelist it on Forticlient, but we want to do it on the end users' computers. for example, unregister the application from regedit. but I don't know how to do it in the most correct way, can you help?

Hi All, I'm trying to find out how to configure our FG100D (6.2.14-FW-build1364-230411) to send to our Syslog Server (ELK) just every 5 mins. There is no option in the WebUI or even in the CLI to configure this. Is there any way to do this? All I can see is in the FortiAnalyzer option. Thank you. Oliver

I have FortiEMS which integrated with AD to retrieve users and groupFortiEMS integrated with FortiGate through fabricissue : it's possible that FortiGate can retrieve groups from AD through EMS to use it in security policies on FortiGate? note : I can't integrate FortiGate with AD due to my company security rules .anyone have a solution for this issue   

Hi people.  Im a little confuse for this configuration.Actually, we're using Entra ID (Azure AD) SSO for ssl vpn and works great. In my fortinet, the saml config are on port 10043. Here are the settings:config user samledit "ssl-azure-saml"set cert "Fortinet_Factory"set entity-id "mypublicURL:10443/remote/saml/metadata"set single-sign-on-url "mypublicURL:10443/remote/saml/login"set single-logout-url "mypublicURL:10443/remote/saml/logout"set idp-entity-id "https://windows.net/4b7xx12e-xxxxxxx7f9ef4xxx9a/"set idp-single-sign-on-url https://login.microsoftonline.com/4b70212xxxxxxxa-a901-97xxxxxx9a/saml2"set idp-single-logout-url "https://login.microsoftonline.com/4b7xxxcc32-4xxxxf4bda9a/saml2"set idp-cert "REMOTE_Cert_2"set user-name "username"set group-name "group" Now, we're setting up Entra SSO for outbound traffic, but using port 1003, according to thi document:https://docs.fortinet.com/document/fortigate/6.4.14/administration-guide/33053 I´m lost..  Fort

Hello, I'm trying to exclude YouTube from the full tunnel using the application-based split tunnel.I didn't find a category for YouTube as Teams and Zoom I tried to exclude using domain but I observed that the YouTube uses many different domains. How can I exclude it ?FortiClient Thanks,Alaa Elrayes

I installed FortiClient VPN version 7.4.0.1636 on Ubuntu 22.04.4 LTS with the GNOME 42.9 desktop environment using the Wayland windowing system. After creating a new VPN connection and attempting to log in via SAML, the application became unresponsive. Upon exiting and reopening the app, I noticed that the VPN connection configuration I had previously set up was not saved, it had disappeared. sudo dpkg -i forticlient_vpn_7.4.0.1636_amd64.deb 

Good day, I am planning to move away from using an Address Range to allocate DHCP addresses to my SSL VPN full tunnel clients to using a Windows 2016 DHCP server, I have a FortiGate FGT200F running firmware 7.x.The current Windows DHCP server is already set up with multiple scopes and uses VLANs to determine which to allocate based on this.I have done some research, and it looks like all I need to do is:Create a new add Address Range on the FortiGate with the new DHCP range.Create a new DHCP scope on the Windows server with the new DHCP range.Enable the DHCP proxy on the FortiGateConfig -> System -> Settingsset dhcp-proxy enableset dhcp-server-ip <dhcp-server-ip>endconfig vpn ssl web-portaledit “Portal-Tunnel”set ip-mode dhcpset dhcp-ra-giaddr <any-ip-in-dhcp-range>endUpdate the FortiGate Firewall SSL VPN policies to use the new Address Rage for the Incoming and Outgoing SSL VPN connections.For the DHCP server to know which range to allocate to the SSL VPN users

Can i enable netflow on my fortigate firewall to send data to Opmanager? 

When adding an authentication server in EMS I only ever get 1 domain even when the tenant has multiple domains registered and synced. These aren't subdomains but two different unique domains.example1.comexample2.comThe only information I provide is the tenant ID, client ID, and secret. And then I only get 1 domain available for doing user to OU matching to assign policies.How do I get all of the available domains that are synced in azure so I can can assign policies? Currently I have to create workgroups and assign the users to that either manually or with group assignment rules. 

I have some users that when using web content are appearing as unauthenticated users in the log, even thought hey are valid staff with AD accounts.  The issue is it is inconsistent where one day is fine, the next they are not.   The problem we are having is their are web resources they are being blocked on as unauthenticated users do not get access to them. I am unsure why this user I am testing continually appears incorrectly.LDAP tests fine with other users and even with testing account using the credentials 

I have successfully configured a Windows Native L2TP connection, but the user account I have setup is supposed to provide a Fortitoken MFA when connecting. For some reason, the prompt isn't asked for so the user can connect and then access both internal and external resources. I know I have seen guides on here for SAML configurations with AzureAD/EntraID, but I'm having a hard time finding ones with FortiToken MFA requirements. Anyone got a link? Edit to Add: No, I cannot use FortiClient because it isn't supported on ARM64 devices (CoPilot+ PC for this user), so it needs to be with the Windows Native L2TP connection... forgot that in the original post.

Let's say I have a switch/AP that is being managed by a platform like FortiManager or Mist (Juniper). If changes are made with these tools, I'm assuming that:- NAC will poll the switch/AP as usual and get the new parameters like VLAN ID, etc. - Run policies as usual and make changes to switchports accordingly.  Is this correct ?  Any best practices for NAC when using such management tools ?Don 

Hello Expert, I understand this might seem like a kid's question, but what is the underlining operating system of FortiGate?  is it Linux or BSD or something else.

We have a customer who uses a VDOM on a shared Fortigate appliance. The customer is concerned that ports 2000 and 5060 are showing open when he scans his IP for open ports. I believe this is related to SIP ALG. Firewall policies will not close the ports. We only want to close this port for the one VDOM, as we are not sure if other customers are using services related to these ports. I've already done the configuration below on item 1-2. 1. This disables SIP-ALG, and will use SIP session helper:config system settingsset default-voip-alg-mode kernel-helper-basedend2. If having Multi-VDOM, disable SIP-ALG on all respective VDOM :config vdomedit VDOM-Aconfig system settingsset default-voip-alg-mode kernel-helper-basedendnextedit VDOM-Bconfig system settingsset default-voip-alg-mode kernel-helper-basedend 3. config sys session-helperdelete 13end I can see that `config sys session-helper` will work on the global VDOM; however, we need to ensure that this change does

Hi!I created followed filtered IS, based on ISDB entry:  fgt-1 # show firewall internet-service-name is_Microsoft_Azure_China config firewall internet-service-name edit "is_Microsoft_Azure_China" set type location set internet-service-id 327786 set country-id 156 next end   Since I don't know its ISDB entry Id, I cannot use "diagnose internet-service id" to show IP/ports included by IS using CLI. (I can do using GUI). Is there an equivalent CLI command for non-predefined ISDB entries?

Hello,It's true when we use 3DES encryption for ipsec, the throughput is more slower than we use AES-128?