Fortinet Community

  Hello FortiPAM admins, I'm looking for a way to hide secrets sensitive credentials ( Username and Password ) from users with View or Edit roles  

Hello,we just solved a problem we had for weeks with our Fortigate / Azure SSO implementation and i thought maybe i can help someone save some time. We are running multiple fortigates for different companys. Since all those companys do use Office 365 we decided to let Microsoft handle the MFA for the SSLVPN login. We set it up and everything was running good besides one single user in one of our companys that wasnt able to login. He always received a error code -7200. We tried everything we could think of. Ressetting passwords, MFAs and even delete the hole SSL and SSO configuration on this fortigate. Alwasys the same error. No mater on which client this user tries to login the error stays the same.Debugging and the logs in our analyzer showed the error message sslvpn_login_saml_group_mismatch so we double checked for errors in the configuration but we could not find some. Tonight my last thought was that maybe 117 Groups are to mutch for a saml response. Microsft states

Hello Fortinet Community,I am currently working on configuring a FortiGate firewall setup and need some confirmation with VDOM failover configuration. Here’s the scenario I am working with:  - Firewall 1 (Fw1): VDOM A and VDOM B are configured as active.  - Firewall 2 (Fw2): VDOM A and VDOM B are configured as passive.  - Conversely, VDOM C is active on Fw2 and passive on Fw1.Is it possible to set up the VDOMs in this way, with Fw1 having active VDOM A and B while Fw2 is passive, and the opposite configuration for VDOM C?

when im trying to access this course -> FCF - Getting Started in Cybersecurity 2.0 Self-Pacedspecifically the first module or any module within the course, im not able to see anything inside, nothing is displayed, please provide me with a solution as to why is this happening, im attaching the screenshot 

Hi, have an issue with a newly configured EMS and Forticlient solution. On the Forticlient we are missing the "ZTNA Connection Rules" tab and when we configure a ZTNA Destination in EMS it doesn´t work or shows up in the hosts file. The ZTNA Destination profile also includes to allow personal  We have also configured the ZTNA Server in the Fortigate, connected it to the fabric and verified licensing ("Zero Trust Access: Included"). The endpoint have a ZTNA Serial Number, endpoint  and the ZTNA features is installed.  Have anyone experienced this issue before? Image of the Forticlient Thanks!  

Hi guys We recently deployed some fortigate NVAs in our Azure environment. We have used the templates in the Fortigate GitHub repository, The configuration we went with was Active-Active, using an internal and external Azure load balancer, so being in an LB sandwich. We’ve been struggling to figure out how to perform NAT and PAT whilst being in this configuration. Can someone with the same configuration please share detail around how to achieve this? It’s been driving me mad!

Dear Team, 1) Head Office --- FortiGate firewall2) Branch office --- FortiGate firewall  Requirement below:-  Only few URL's  traffic burst out  in branch office ISP and remaining all application or internet access and internal server all traffic burst out from Head Office This is possible, then please share the KB-Article. 

I have a FortiGate FGT200F device running firmware 7.* and want to swap from using the internal allocation of VPN IPs via Address List to an internal Windows DHCP server. What I am having issues understanding is if I set up the DHCP helper/relay on the FortiGate and point to my current DHCP server how does the DHCP server know which IP to allocate? The DHCP server currently issues IPs for internal devices but if I need it to issue IPs for VPN clients then it will need to issue a different IP. This may be a Windows question but thought someone may have done this before and have some guidance. Julian    

Disadvantage of using a internal CA issued certificate? Why is it not common?

 Hello Fortinet Community,I’m seeking advice on configuring the network setup shown in the attached image.  Here’s the scenario: Two large sites (HQ1 and HQ2) and several small sites, all with FortiGate firewalls, connected in a Security Fabric. HQ1’s FortiGate is the fabric root.FortiNAC Setup: A FortiNAC Manager with two control units located in HQ1 and HQ2. No HA.HQ1 hosts the primary domain controller, and HQ2 hosts the secondary.Given this setup, I have several questions:Should only the FortiNAC Manager integrate with Active Directory, or should the control units also be integrated?For the Security Fabric, is integrating the FortiNAC Manager with the Fabric Root sufficient, or should the control units also be integrated?How should the Email server, EMS, and FortiAnalyzer be integrated? Is it sufficient to connect only the FortiNAC Manager, or should all control units be included?Unfortunately, I haven’t found clear documentation on these integrations. I’d appre

Hi All, I have setup FAC as a RADIUS server and connecting AD using LDAP. The FAC has joined the AD domain and FAC able to retrieve the user from AD domain. When I try to authenticate user using 802.1x, it shows the authentication failed due to the machine you are logging onto is protected by an authentication firewall. May I know if anyone encounter this issue before and what could be the possibility that causing this issue?   

At my job, I have "inherented" Fortianalyzer VM running 7.0 with 5GB/day perpetual license. The support contract ended on 2020 and I would like to request three years forticare support license inorder to update it and have support because tbh, I am not familiar with FAZ.My question is that will the license start from the day that the license was purchased or will the license start from the day that the old one ended.

Hi Im looking to do the following, I have 3 wan interfaces (wan1, wan2 and wan3), im looking to make an arrangement of sdwan so some of the users (UsersA) primary output is wan1 with wan2 acting as the fail over, and the rest of the users (UsersB) use wan3 as their primary output with again wan2 acting as a fail over. The issue im coming across is how do i prevent from Users A from using wan3 as their output, I've set up the users A rule for wan1 and wan2 but when both of these are inactive their output then becomes wan3. Same case for usersB, if wan2 and wan3 are inactive their output becomes wan1. UsersA should never use wan3 and UsersB should never use Wan1 How do I prevent this?, the rules only have their respective wans selected but if none of their wans are available it uses another wan not in its rule.

i setup 2 IPsec tunnel with counterpart at AWS. the tunnel is working fine but there are 2 separate links showing that the tunnel is down.how do i remove the unwanted tunnel.phase2 selector route is down.or shall i do i reset to bring up the tunnel.

Hello,I have app control to block video/audio to blocking access to youtube.When i check in the log i found the firewall sometime block access to youtube and sometime is allowing. Anyone know what should i do? 

I have a 100F and the WAN Interface only shows speed settings for auto. No 1000Full, 100Full, ect... Fortigate is on 7.2.8. If I go to a lan port I have more options. My ISP has set their interface to 100Full, but on the fortigate get hardware nic wan2 it's showing half duplex 100. I am not able to force to 100Full. Are 100F's not able to set port speed other than auto?   

Hi community! I have the following network:I have control over FortiGate 1 and 2 but the routers (Cisco) belong to my customer.I have a BGP peering between FG1 and R1 and between FG2 and R2. There is no BGP peering between FG1/2 and the remote sites routers.The customer does have a BGP peering between R1/2 and all remote sites.I'm looking for a way to advertise a default route from each fortigate but have control over what route the remote site will prefer.For example, i want Remote1 to prefer FG1 over FG2 but keep Remote2 and Remote3 to prefer FG2.Since i don't have a peering connection with the remote site i don't believe i can do it directly from FG1/FG2 (?)I found this article explaining how to pre-pend a default route but this would just allow me to do an active passive for all remote sites.I can ask the customer to take actions based on community tags i send to R1/R2 but i cannot set a BGP peering between the FG and the remote sites (There are actually many remote sites and

My goal is to implement FSSO for the purpose of creating firewall policies based on group membership. The caveat is that there is no LDAP server to provide group membership. We have a custom VPN application that is successfully sending username-to-IP info to Fortigates using API method here (https://fndn.fortinet.net/index.php?/fortiapi/1-fortios/3828/1/user/). However, this makes policies cumbersome because they can only be populated by source users and not groups.  Any ideas ? Could Fortiauthenticator solve this problem in some manner ?Don 

Dear all, good morning. We have a Fortigate 60F on version 7.4.0 with an IPSEC VPN Client to Site configured. In firmware version 7.4.0 the VPN works normally, but when we update to version 7.4.1 or 7.4.2 the VPN stops working, it connects but remains as "0bytes received". Does anyone have any idea what is going on?

 If i connect Fortigate firewall and Cisco Switch and then a fortiSwitch  is connected to  the Cisco Switch, in this case will the fortiswitch work?in my case FortiSwitch device is detected in Fortilink interface  but fortiSwitch remains offline?  

Dear community,Does anybody here uses PaperCut?We have a FG-80F, recently segmented our network and use our FG as DHCP/DNS server for our wireless clients.We want to implement the DNS settings requiered for PaperCut wireless printing since clients and server are in different vlans and subnets (https://www.papercut.com/kb/Main/MobilityPrintDNSRecordExamples/)  dnscmd /RecordAdd domain.com b._dns-sd._udp PTR pc-printer-discovery.domain.com dnscmd /RecordAdd domain.com lb._dns-sd._udp PTR pc-printer-discovery.domain.com dnscmd /RecordAdd domain.com pc-mobility-print-host A 10.10.90.65 dnscmd /RecordAdd domain.com pc-printer-discovery NS pc-mobility-print-host.domain.com   However the instructions are only for Windows and I have trouble implementing those to the FG interface.  E.g. when creating a PTR record the FG still wants an IP address.  Thank you for any helpful hints.

Hello, My 2FA to login to this community portal is used email, now how i can change from email to authenticator app?

My plan is to restart my firewall, test the disk, and monitor if issue will still reoccur. Moreover, I wanted to know if there is a way for the firewall to stop monitoring the status of a USB flash disk partition. The USB flash disk partition contains config file and firmware which we would use to restore the firewall. To give you a background, our HA has failed over because of this SSD failure. Thank you!

Hello,Normally when a packet comes to FortiGate, firewall follows the way https://docs.fortinet.com/document/fortigate/6.4.0/parallel-path-processing-life-of-a-packet/86811/packet-flow-ingress-and-egress-fortigates-without-network-processor-offloading What about the answer packet that comes to same session ? Here is the scenario1- I sent a FTP Put Request to a server, that packets goes over the firewall 2- Firewall process the first packet based on the the parallel path processing like in the link that i have shared. Create a session and sent packet out to FTP Server based on routing table3- Then server response with FTP Put Response, paket goes over firewall to FTP client again--> at this third step how does firewall process packet ? I believe it checks the session first and when there is a session how is the next steps ? do we have a link that fortigate shows that? Because i believe that packet will be forwarded out of interface that packet comes to firewall and doe

My company uses forticlient vpn (usually for windows). I use Ubuntu and have installed version 7.4.0.1636. When creating the ipsec connection I can't find the advanced options that are in the windows client (I have to add localid to phase1). So the Linux version is limited? I also tried with network manager, but I have the same problems here too :) Has anyone had something similar happen? Thank you.