Fortinet Community

I have FortiEMS which integrated with AD to retrieve users and groupFortiEMS integrated with FortiGate through fabricissue : it's possible that FortiGate can retrieve groups from AD through EMS to use it in security policies on FortiGate? note : I can't integrate FortiGate with AD due to my company security rules .anyone have a solution for this issue   

Hi people.  Im a little confuse for this configuration.Actually, we're using Entra ID (Azure AD) SSO for ssl vpn and works great. In my fortinet, the saml config are on port 10043. Here are the settings:config user samledit "ssl-azure-saml"set cert "Fortinet_Factory"set entity-id "mypublicURL:10443/remote/saml/metadata"set single-sign-on-url "mypublicURL:10443/remote/saml/login"set single-logout-url "mypublicURL:10443/remote/saml/logout"set idp-entity-id "https://windows.net/4b7xx12e-xxxxxxx7f9ef4xxx9a/"set idp-single-sign-on-url https://login.microsoftonline.com/4b70212xxxxxxxa-a901-97xxxxxx9a/saml2"set idp-single-logout-url "https://login.microsoftonline.com/4b7xxxcc32-4xxxxf4bda9a/saml2"set idp-cert "REMOTE_Cert_2"set user-name "username"set group-name "group" Now, we're setting up Entra SSO for outbound traffic, but using port 1003, according to thi document:https://docs.fortinet.com/document/fortigate/6.4.14/administration-guide/33053 I´m lost..  Fort

Hello, I'm trying to exclude YouTube from the full tunnel using the application-based split tunnel.I didn't find a category for YouTube as Teams and Zoom I tried to exclude using domain but I observed that the YouTube uses many different domains. How can I exclude it ?FortiClient Thanks,Alaa Elrayes

I installed FortiClient VPN version 7.4.0.1636 on Ubuntu 22.04.4 LTS with the GNOME 42.9 desktop environment using the Wayland windowing system. After creating a new VPN connection and attempting to log in via SAML, the application became unresponsive. Upon exiting and reopening the app, I noticed that the VPN connection configuration I had previously set up was not saved, it had disappeared. sudo dpkg -i forticlient_vpn_7.4.0.1636_amd64.deb 

Good day, I am planning to move away from using an Address Range to allocate DHCP addresses to my SSL VPN full tunnel clients to using a Windows 2016 DHCP server, I have a FortiGate FGT200F running firmware 7.x.The current Windows DHCP server is already set up with multiple scopes and uses VLANs to determine which to allocate based on this.I have done some research, and it looks like all I need to do is:Create a new add Address Range on the FortiGate with the new DHCP range.Create a new DHCP scope on the Windows server with the new DHCP range.Enable the DHCP proxy on the FortiGateConfig -> System -> Settingsset dhcp-proxy enableset dhcp-server-ip <dhcp-server-ip>endconfig vpn ssl web-portaledit “Portal-Tunnel”set ip-mode dhcpset dhcp-ra-giaddr <any-ip-in-dhcp-range>endUpdate the FortiGate Firewall SSL VPN policies to use the new Address Rage for the Incoming and Outgoing SSL VPN connections.For the DHCP server to know which range to allocate to the SSL VPN users

Can i enable netflow on my fortigate firewall to send data to Opmanager? 

When adding an authentication server in EMS I only ever get 1 domain even when the tenant has multiple domains registered and synced. These aren't subdomains but two different unique domains.example1.comexample2.comThe only information I provide is the tenant ID, client ID, and secret. And then I only get 1 domain available for doing user to OU matching to assign policies.How do I get all of the available domains that are synced in azure so I can can assign policies? Currently I have to create workgroups and assign the users to that either manually or with group assignment rules. 

I have some users that when using web content are appearing as unauthenticated users in the log, even thought hey are valid staff with AD accounts.  The issue is it is inconsistent where one day is fine, the next they are not.   The problem we are having is their are web resources they are being blocked on as unauthenticated users do not get access to them. I am unsure why this user I am testing continually appears incorrectly.LDAP tests fine with other users and even with testing account using the credentials 

I have successfully configured a Windows Native L2TP connection, but the user account I have setup is supposed to provide a Fortitoken MFA when connecting. For some reason, the prompt isn't asked for so the user can connect and then access both internal and external resources. I know I have seen guides on here for SAML configurations with AzureAD/EntraID, but I'm having a hard time finding ones with FortiToken MFA requirements. Anyone got a link? Edit to Add: No, I cannot use FortiClient because it isn't supported on ARM64 devices (CoPilot+ PC for this user), so it needs to be with the Windows Native L2TP connection... forgot that in the original post.

Let's say I have a switch/AP that is being managed by a platform like FortiManager or Mist (Juniper). If changes are made with these tools, I'm assuming that:- NAC will poll the switch/AP as usual and get the new parameters like VLAN ID, etc. - Run policies as usual and make changes to switchports accordingly.  Is this correct ?  Any best practices for NAC when using such management tools ?Don 

Hello Expert, I understand this might seem like a kid's question, but what is the underlining operating system of FortiGate?  is it Linux or BSD or something else.

We have a customer who uses a VDOM on a shared Fortigate appliance. The customer is concerned that ports 2000 and 5060 are showing open when he scans his IP for open ports. I believe this is related to SIP ALG. Firewall policies will not close the ports. We only want to close this port for the one VDOM, as we are not sure if other customers are using services related to these ports. I've already done the configuration below on item 1-2. 1. This disables SIP-ALG, and will use SIP session helper:config system settingsset default-voip-alg-mode kernel-helper-basedend2. If having Multi-VDOM, disable SIP-ALG on all respective VDOM :config vdomedit VDOM-Aconfig system settingsset default-voip-alg-mode kernel-helper-basedendnextedit VDOM-Bconfig system settingsset default-voip-alg-mode kernel-helper-basedend 3. config sys session-helperdelete 13end I can see that `config sys session-helper` will work on the global VDOM; however, we need to ensure that this change does

Hi!I created followed filtered IS, based on ISDB entry:  fgt-1 # show firewall internet-service-name is_Microsoft_Azure_China config firewall internet-service-name edit "is_Microsoft_Azure_China" set type location set internet-service-id 327786 set country-id 156 next end   Since I don't know its ISDB entry Id, I cannot use "diagnose internet-service id" to show IP/ports included by IS using CLI. (I can do using GUI). Is there an equivalent CLI command for non-predefined ISDB entries?

Hello,It's true when we use 3DES encryption for ipsec, the throughput is more slower than we use AES-128?

Hi there, I did several tests but it seems - really?? - that the template type "Web Account" acts with completely different permission settings in the background than other launchers. Testing with launcher like PuTTY or WinSCP or RDP ... I could test this with a user that should only be able to see the entry and can launch this - so using the permission type "Viewer" - without beeing aware ot the stored password nor can change this secret. So far, this is running fine with several launcher types. The same scenario using a "Web Account" secret is not possible. It seems as "Launch target" could be possible for the test user (with "View" permission for this target as well as for the underlaying folder) because it is not greyed out in the secret list. But clicking on "Launch Secret" leads to the details of the entry - and there the mouse over message over the (now greyed out "Web Launcher") tells me that this launcher cannot be started because of not enough permissions.&nbsp

Dear Concern, I am visiting a website, but the page is not opening. In the forward logs, I see 'TCP reset from client' under 'action', and sometimes it shows 'accept'. The webpage says 'refused to connect'. How can resolve. I have FortiGate 201F firewall and firmware version is 7.0.10 If I check from another network, the webpage opens properly. can anyone help me to resolve the issue

When using VPN, the user does not receive the local IP assigned by FGT (not the wrong IP). Sometimes it happens like this.

FG-601E and FOS 7.0 GA.To list image dia fdsm fds-update command is not working.(global) # dia fdsm fds-updateTimed out. Appreciate your advise on how I resolved this issue. TIA :) 

We would like to enable MAC based internet allow policy for our office premises devices. For kind of your information, We are using the FortiGate 300E firewall supported by you. Please let me know how many devices or MAC can be allowed on the FortiGate 300E firewall.

Hi everyone, I have a Linux virtual webserver in ESXI that I would like to be accessible over the internet. Currently it's accessible locally but I have tried all the settings on Fortigate to make it accessible over the internet to no avail. I am plugging the 2nd Physical NIC directly to either internal 4 port and bridging the virtual webserver connection in ESXI to that 2nd NIC but not getting any good luck. I also did create VIPs in Fortinet to the Internal 4. I would really appreciate any help I could get.

So quick questionI have upgraded Fortimanager, and a test fortigate to 7.2, the eventual plan is everything upgraded to 7.2.At the moment I cannot import configuration because 'device firmware is different to adom version', should I upgrade the adom version from 7.0 to 7.2 next before upgrading all the gates?

Hi, in my lab I'm exposing FMG WebUI on the public internet behind Cloudflare reverse proxy. I did basic Cloudflare configuration and I do reach FMG WebUI with using FQDN over HTTPS connection without any issue.  However, once I am logged in, after few seconds of activity I am forced logged-out. And I have to log back in. Sometimes before I am forced logged out and I am moving around different sections of WebUI, I get red banner on FMG WebUi saying "Invalid IP address".This behavour is not present if bypass Cloudflare. i.e. I browse WebUI using IP address and not FQDN. What I suspect is that at some point (in the middle of the session) Cloudflare is changing IP address of the reverse proxy. i.e. FMG sees that the session is coming from different IP address and it forces user to log out.  Has anyone manage to expose FMG WebUI behind Cloudflare reverse proxy?

Hi All, Is there a way to check or determine in the Fortigate firewall if the difference in bandwidth of MPLS site (our site has 20Mbps and our client has 2Mbps only) will result in slow in traffic?We and our client have both 2 ISPs for redundancy, but the client's other ISP is much slower, so they prefer to connect using the other. When our main ISP was down, we swung to the other resulting in much slower traffic. But our client checked their current bandwidth and said that they were only using 60% of the traffic and insisted to check where the bottleneck was. I'm trying to figure out how to check and present to the client that the issue is their bandwidth unfortunately, when I check the bandwidth monitor in Dashboard, I can only see the grouped MPLS tunnels of ISP1 (interface 1) and ISP (interface 2) with Hardware Switch as type. There is no option to check the separate interface. Even the VPN Event logs don't help that much. Is there a way to check this? Thank you in

Dear Forti Support I am writing to you because my Fortigate VM02 yesterday presented an unexpected increase in CPU resource of 97 - 98% for almost an hour, this event generated denial of services and intermittency and slowness on the internet. During the event, there was no significant increase in memory, concurrent sessions or sessions per second, no intrusion attempt, nor any adjustments made to the hypervisor. InformationFORTIGATE VM02v7.2.8 build1639 (Mature)Hipervisor: OVITR (based in KVM)  I appreciate your comments and help 

I have two firewalls.At one end a firewall with a dedicated link and at the other a Sophos firewall with dynamic IP.I will have to increase the Dialup Type configuration.Does anyone have any documentation that covers this type of configuration.The biggest problem is at the Sophos end, I've already tried several ways.But without success, I've seen several ways on the web but without success.If anyone can give me some direction, I'd be grateful.