Fortinet Community

I have a Fortigate 200F and I can't load some websites. These are specific web pages and the number keeps increasing as I find new web pages.I have turned everything off and I still cannot load these web pages.Can you help me with this?

I've noticed that the 1048E doesnt support any speed or autonegotiate commands for port speeds. I had been troubleshooting an issue with a link between a Cisco 9300 and a  fortiswitch 1048e, using 1000base-LX,  and found that I had to disable autonegotiate on the cisco for the link to come up (speed nonegotiate).I haven't been able to find in fortinets documentation that autoneogotiate must be disabled when connecting to 3rd party switch hardware. Is this intentional or a bug?

Sorry if this is a repeat topic, but I haven't seen an answer that works for me.I can't uninstall FortiClient-VPN-only from Mac OS X Monterey.  Both the application and uninstaller are locked, and I can't unlock them (I've worked with Apple for hours, updating disk permissions, safe boot, command line inputs, etc.). The uninstaller also won't load, saying "You can’t open the application “FortiClientUninstaller.app” because it may be damaged or incomplete." This happens even following a clean reinstall.   As this product isn't tech-supported, I went into the knowledgebase which simply says "The EMS administrator may deploy uninstall to managed FortiClient (macOS) endpoints."  I didn't install EMS, as this is not a managed system. So what now? Any suggestions would be much appreciated.

Hey. Exist a Solution where we can build a Digital Twin of our Network?We have some critical Services running in our Network, therefore we can't rollout changes without a proper testing of it. For this we want a Digital Twin, so we can safely test and evaluate different packages of rules.I have read that some companys offer a digital Twin of their Products, so it would be good, if Fortinet is one of them.We use Fortinet Firewalls, HP and Ubiquiti Switches. 

what should I type in the folder on the import file if the folder I want to import secret to is this:"Public > team > FirstName Lastname" how am I supposed to translate this into the import secret excel file. I tried "Public > team > FirstName Lastname""Public/team/FirstName Lastname""Public\team\FirstName Lastname"each try return the generic "invalid folder" error but doesn't tell me how to type the folder path into the colum of the import file. some examples would be appreciated on the KB that even list the generic error message in the screenshot without providing any suggestion on how to fix that error...Uploading secrets using the secret upload template | FortiPAM 1.3.0 | Fortinet Document Library 

Hi,We have ZTNA environment in which EMS is installed. There is AD integration with EMS server so currently we are authenticating administrators with AD. We have OKTA setup as MFA for VPNs and etc.We want to implement OKTA as IDP (SAML) for EMS administrators. Is it possible? if so please share the docs or steps of configuration for the same.Thanks in advance.

I am having troubles installing forticlient VPN in my ubuntu 23.10. I have followed https://www.fortinet.com/support/product-downloads/linux but whatever the choice of version of forticlient I use, I always get the error that libgconf-2-4 (> 0) is needed but not available.Any hint on how to solve this problem?Jordi

I have a pair of fortiswitches configured with mc-lag icl. im running into an issue when i attempt to create a trunk. I want to use port 21 on switch 1 and port 21 on switch 2 but i am not able to select them . they do not show in the list? what is preventing this? i dont see any configuration on the ports... just seems weird. i should be able to use any ports I want.  they are 24 port switches model 1024D. can anyone fortiswitch guru's chime in here? Thanks,  

Hello, I have devices in LAN (APs) that creates two connections to the same Public IP (CAPWAP Control Channel: UDP/5246 + CAPWAP Data Channel UDP/5247) Both connections have the same port as Source Port: 5270, this is the behavior I get with FortiOS 7.2: --> The Gate is assigning the same SRC port (5270) to two different flows intended for the same IP target (where, however, the destination-port differs) I realized that surely this comportment is the child of how FortiOS selects unused NAT ports,but do you think there is a configuration that would allow me to have SOURCE PORT was Always changed for an SPECIFIC DESTINATION? The Host on the on the other hand side is not able to distinguish the traffic if it comes from Capwap-DATA or Capwap-CTRL if it comes from the same src-port (and obviously same src-ip)But now that we know the Host Target limitation, my question is how can I change the port assignment logic in SNAT on my FortiGate Thanks!

Hi everyone,could you help me for this issue ? When I want to two interfaces on fortiswitches for trunk group.I see that warnings and it can not  allowed  for adding these interfaces.However same switch I use trunk group for different interfaces.I live that issue for 49 and 50 interfaces.Additionaly,I use managed switch with fortilinkInput value is invalid.Read-only reference to trunk interface when port is a member of a trunk.This port/trunk MAC value is not configurable.Read-only refereUser not allowed to configure this command.User not allowed to configure this command.User not alnce to trunk interface when port is a member of a trunk.Lowed to configure this command.Error: Static/Sticky MAC entry (id=5) exists in the trunk member port port5 !!!.Attribute set operator error, -651, discard the setting.

Dear Fortinet Community,We are deploying a WAF (FortiWeb) in an Environment and Migrating a Web Application behind FortiWeb. We have a dual gateway seanerio in our environment for FortiWeb, for traffic to route its proper destination we used PBR here to route return or response traffic towards it destination.After all configurations of virtual server, server pool, virtual IPs, server policy, adding certificates of servers in FortiWeb, Migrarted Web Application working properly and doesn't pop-up SSL Certificate error in the browser but on the same Hostname we have an android application of the client , it shows SSL Certificate error on Android Application we open our application. For clarification we called a certificate in Server Policy of FortiWeb for this Service and that certificate is Wild-Card Certificate.Please suggest is there any configurations missing at our FortiWeb end or something else.

If you haven't used the open source iperf tool before, there is a lot of info on it (see https://iperf.fr), and I will only say it allows us to generate UDP/TCP traffic between 2 hosts of any  bandwidth we desire. Load testing is a sure way to pinpoint "weak links" in the network, be it equipment or cabling.  So iperf is a software (Linux & Windows) you install on 2 hosts and it works as client and server - one host sends TCP or UDP traffic, and the second one (well, iperf on it) receives it measuring jitter, packet loss, bandwidth. We use iperf to indicate network problems but also to prove (to client or ourselves) capacity of a line - is the claimed throughput indeed as expected?  It becomes a challenge when you don't have Windows/Linux on remote site to install iperf or you cannot allow network downtime to disconnect your Fortigate  from the line and connect instead laptop/server. Luckily, starting with FortiOS 5.2.x version, all Fortigate firewalls come with

Hi all. I am trying to configure a new Fortigate setup, with 2x WANs. I did search before asking you, but I could not figure out how to achieve an Active-Passive scenario. WAN-2 is very unstable, it should be passive and not take any traffic as long as the other WAN-1 is up. A youtube video instructedConfiguring 2 SD-WAN members (WAN-1 and WAN-2) under a virtual WAN link.Then he created a Performance SLA that sends ping to 8.8.8.8 for All SD-WAN members, enabled Update static route option.Then he edited the SD-WAN rule, configured load-balancing algorithm by volume (he did it 80% 20%)Finally he added 0.0.0.0 route using interface virtual WAN link, and added a firewall policy.This is not what I want, since traffic is distributed. I want traffic to flow through WAN-1. When WAN-1 goes down, should be detected, and WAN-2 should take over. But when WAN-1 comes back online, it should take over the traffic again. I am sorry if this has been asked before. Could you please t

Hi guys. Is there any way to run a blanket script in FMG with "show" or "get" commands for Fortigates having multiple VDOMs without needing to enter every VDOM, and then output the results? If yes, any example would be helpful.If no, what are other alternatives that could be used on multiple Fortigates with different set of VDOMs?

We have bogons, geolocation, tor, a few dictionary policies that are built in to fortinet, etc. about 10 rules in all above an any/any policy. But as my role is beginning to blur with others I want to make sure I have the “go to” policies in place. Talking firewall policies. Of course I have AV/Filter/ETC turned on and configured for the interface as well. But is there a go to policies list for small business?

Hi, Last few days I started to see new activity on my WAN link - many login attempts on HTTPS interfaces of my Fortigates. In majority they come from IP: 185.253.160.140 but not exclusevily. My question is how to automatically block these attempts, i.e. to ban certain IP from viewing login page of Forti after few unsuccessfull login trials. I have few Fortigates with soft not older than 6.2.15. Piotr 

I was following the guide to setup WiFi authentication using Azure and SAML IdP from the Fortinet community here  The authentication does work, but it gives a certificate error when connecting. If you trust the cert the authentication goes through and works. The below error message is seen when using the Fortinet Factory cert.  The following error is observed when using a CA cert from Let's Encrypt. The intended use is for this network to be used for personal cell phones of company employees. So I do not want employees to have download or trust anything on their devices when connecting to the network. If it is not possible to avoid the cert trust error please let me know. Otherwise below is what I have tried to get it to work. The documentation mentions using a CA certificate and redirecting the auth portal page. However, whenever I redirect the portal it breaks the authentication. I have tired adding the redirection in both the GUI and CLI and v

Hi,  I want to change my security fabric from Stand Alone on my Gates to Fabric Root, are there any issues that I should be aware of when changing from one to the other? Only my FAZ is currently showing in my Physical Topology, but I'd like to add my FNAC, Manager, Mail, Sandbox and a few other gates in smaller locations. Cheers,

Hello guys,I am wondering if it is possible to set the default status of this feature (Receive quarantine report) to disabled?So we can enable this just for users which we want? We have deployed Fortimail in Gateway mode.Thank you for any tips :)

I use a ssl-webportal to have access to exchange owa with a predefined bookmark.the bookmark looks like https://10.123.99.28/owaAll firewall rules are correct.The OWA Login screen is indicated, but after entering the login data, I got a login failure withERR_CONNECTION_RESET 

I’ve been working on integrating LDAP with FortiClient EMS server v7.4.0 build1793 running on Ubuntu 22.04 but am getting "Auth Method Not Supported" when trying to add LDAP authentication server.In the EMS web console, when I go to Administration > Authentication Servers, I select "ADDS" from the dropdown, enter localhost and the admin creds, but when I hit "Test", I get an "Auth Method Not Supported" error.slapd is running and listening:# netstat -aptn |grep LIST |grep 389tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 326786/slapdtcp6 0 0 :::389 :::* LISTEN 326786/slapdAnd doing a tcpdump, I can see the traffic (although not the username and passwd being passed):17:30:52.956097 lo In IP (tos 0x0, ttl 64, id 42008, offset 0, flags [DF], proto TCP (6), length 115)127.0.0.1.41008 > 127.0.0.1.389: Flags [P.], cksum 0xfe67 (incorrect -> 0x25f2), seq 1:64, ack 1, win 512, options [nop,nop,TS val 3342323866 ecr 3342323866], length 63E..s..@.@..j.........0.......d[......g......7...7..0=...`8.

Hello people, I have a new projet, to deploy FortiNAC VM. I am a newbie with FortiNAC, any tips for a first deployement ? I will take any advice from people that configured it before. Thank you in advanceKind regards,

Hi folks I hope you're all doing well. I'm writing because I have a little "cosmetic" problem with my Fortigate 60E which is in use by one of my companies clients. Our monitoring tool notifies a lot of drops on interface 5 (more than 500k/hour). So I started troubleshooting. First I run the dia hard deviceinfo nic internal5 command: Description :FortiASIC NP6LITE Adapter Driver Name :FortiASIC NP6LITE Driver Board :60E lif id :7 lif oid :71 netdev oid :71 Current_HWaddr xx Permanent_HWaddr xx ========== Link Status ========== Admin :up netdev status :up autonego_setting:1 link_setting :0 speed_setting :10 duplex_setting :0 Speed :1000 Duplex :Full link_status :Up ============ Counters =========== Rx Pkts :18208097703 Rx Bytes :11024838411269 Tx Pkts :15296225169 Tx Bytes :10319894982632 Host Rx Pkts :3749448284 Host Rx Bytes :9406441080 Host Tx Pkts :582392616 Host Tx Bytes :11678029692 Host Tx dropped :0 Couldn't see any problems. Then I run the

Hi FortiMail integratorsWhat are the "recommended" method(s) to migrate a configuration from FML hardware to FML VM?

  Hello FortiPAM admins, I'm looking for a way to hide secrets sensitive credentials ( Username and Password ) from users with View or Edit roles