Fortinet Community

Hello everyone, We are using a Fortigate 120g. However, we can't open any website. Ping and DNS works on the client and on the fortigate and the packets are forwarded on the fortigate without dropping any packets. When we connect directly to the Fortigate 120g, we can access the Internet and open web pages without any delay. When we disconnect the Fortigate 120g and connect our old firewall, everything works fine right away. What we tried:Configuring port speed 1000Full on our Cisco CL9200 switch and on the Fortigate 120g.Do you have any idea how we can fix the problem? Thank you in advance! Best regards

Hello,I have a problem with a suspected hacking attack because someone created a user bobby tables in our webapp.We have IPS+WAF+DPI however WAF is lightly configured and only blocks exploits and trojans but everything else is monitor because otherwise we cannot create news on our webpage because WAF would block it.Can you recommend changes for fortigate in my config? I have enabled this 2 Security Profiles together with Full DPI: config ips sensor edit "IPS-LinuxServer" set comment "Test" set scan-botnet-connections block config entries edit 1 set location server set severity medium high critical set os Linux set status enable set action block next end next end  And this WAF Profile: config waf profile edit "linux-waf" config signature config main-class 100000000 set action bl

Unable to add my active ISP WAN interface as SD_WAN Member to a SD_ZONE , the interface does not show up when adding it to a SD-WAN zone. This is for my home lab, I am  running forti os 6.4.5. my  ISP WAN 2 is down. cable is connected, because i only have 1 ISP connection, but i still assigned IP to it.  

Hello,I followed this KB: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Local-user-authentication/ta-p/190084My goal was to authenticate "website-admin" users for our backend webservers so that they can do more then a normal guest visitor could do. The difference I wanted were 2 firewall policies one for guests and one for authenticated-users where for example IPS+WAF rules were more strict for guests then for authenticated users.My problem is when enabling Captive Portal I could authenticate with my backend user and traffic hit the right policy but guests who MUST NOT authenticate did also had to authenticate which is not possible for them because they should not have any credentials. How can I hide the auth page and only auth users which wanted to be authenticated? All other should be able to access all the webservers regularly.

Hello, - I opened all these ports on endpoint device 135, 139, 137, 445 TCP.  - When I click "Test Workstation" button, this massage appears "failed to do workstation check through WMI" + "Unkown workstation state". - But if I open all TCP ports on endpoint, the test works normally.  - What are the TCP ports should I open on endpoint device?

Good Afternoon, Some clients showed up problems to connect to the vpn(SSL-VPN), the computer is windows 10 pro 22h2 build 19045. and always stay connecting and don't show the connectiong percent before connection estabelish. I test in android and its work with client credential. i already Repair the application and also uninstalled it, and re-installed. but no success, not even with my Credentials. Any suggestion?

All, Did you experience intermittent connection when enabling IPSec FG-FG as a backup route when MPLS is also up? Remote Site:MPLS connection is the primary using static route w/ 10 AD and priority of 0While the IPSec is the secondary connection w/ 10 AD and priority of 100 when I enable the IPSec connection we always encountered slow response/intermittent traffic going to HQ.Seem the traffic flow is confuse on where to send(should be on MPLS or IPSEC). Supposedly the traffic should always go thru MPLS, since this circuit is not down.  Hope to find solution on this. Thank you

hi hello there, i have questing about NAT, i have public ip x.x.x.x/28 and y.y.y.y/29. and i want some of the public ip is NAT to my private ip. for example i want to x.x.x.5 NAT to 192.168.100.50 or y.y.y.5 NAT to 192.168.100.51. and maybe add some port forwarding so service in that server can expose to internet, let say port 2222 from public ip forward to port 22 private ip. currently i have configure my fortigate with this, but still no luck   and i realise that, i have /28 public ip. but only 1 ip that i can ping from internet, the one that i can ping is my public ip in interface wan1, why the rest of 13 public ip cannot ping from internet ?cus i have experience with mikrotik and i can do ping to all my 14 ip subnet /28. anyone can help me? 

Dear all,i have a problem with the tunnel ipsec i create an sdwan via tunnels between two fortigate (for each interface one tunnel but both tunnels in the some sdwan zone)i can't ping from the fortigate to device that exicte after the other fortigatei can ping to the ip of tunnel from each deviceip Tunnels: 10.11.11.11 and 10.21.21.21under the port 1 i have an tunnel T1S1under the port 2 i have an tunnel T2S1 please anyone can help !!confige bellow (i am worked just with Site1 ( T1S1 and T2S):  edit "T1S1" set vdom "root" set ip 10.11.11.11 255.255.255.255 set allowaccess ping set type tunnel set remote-ip 10.254.151.100 255.255.255.128 set role wan set snmp-index 10 set interface "port1" next edit "T2S1" set vdom "root" set ip 10.21.21.21 255.255.255.255 set allowaccess ping set type tunnel set remote-ip 10.254.21.100 255.255.255.0 set snmp-index 11 set interface "port2" next           

I just installed FortiClient EMS 7.4.0 on Ubuntu 22.0.4 according to the installation doc. All the running services check out like they're supposed to. The doc says to double-click the FortiClient Endpoint Management Server icon to fire up the gui so I can configure https access, but there is no icon to click, nor does the system have anything for forticlient in the applications menu. Anyone have a workaround for this or tell me the bin the icon is supposed to point to?

FortiGate, Firewall cannot pull users while doing SSL-VPN. It is taken in the group from all other user/groups. The user portal is actually the current users of the portal, Users/group is mapped to the port.

Hi We currently use FortiClient with FW firmware version 6.0 and are able to manage compliance profiles.I know that firmware above 6.0 does not support FortiClient and EMS server is required to manage them.Is this still the case with FortiOS 7.0? Thanks in advanceDawid

Hello team, I noticed form the log & Report -> Application Control screen that one of the machines is being used for Cryptocurrency mining. See attached screenshot. How do I block this traffic? I have P2P enabled because of the HikVision CCTV service that they provide to be able to view the cameras from outside the network. Need your help please.  

Hello, I have a client running Forticlient SSL VPN over Verizon Jetpacks.  We have seen intermittent connection issues with multiple users, multiple laptops and Jetpacks in different locations.  The problem is the initial connection of the VPN.  Sometimes it works, and then literally 2 minutes later it will fail (and vice versa).  Out of 20 connection attempts, it failed on 12 and was successful on 8.  Over the hour that I was investigating the issues, I was connected to the laptop via splashtop remote desktop and never once lost a connection.  A continuous ping to 8.8.8.8 never dropped a packet.  That being the case, I do not believe that the Cellular hotspot was in any way responsible.  I verifies that VPN passthrough was enabled on the jetpack.  Additionally, from a wired internet connection from the same machine, the connection attempts were 100 % successful. I am using the Static IP of the Fortigate 50E firewall in the connection s

Hi, Is there a way to map static IP for each VPN user. And can we restrict VPN users to have a single VPN session per user.  This, https://kb.fortinet.com/kb/documentLink.do?externalID=FD37351, does not seem to work on version 6.0. 

 Does anyone ever get a popup that just counts down and to nothing and you cannot connect to any ztna destinations. I normally get the popup once, do my SAML authentication, along with MFA against the fortiauthenticator. Then everything works and I am good. Occasionally i get this timer that just counts down until 0.

Hello team!!! I hope you are fine!!We have here, 2 kind of VPN users trying to access different resources on different VLANs (Behind the same Fortigate), we need, for example, the following:* User Group 1: Can access LAN but not DMZ* User Group 2: Can access DMZ but not LAN We have 3 WANs, the idea is create one VPN for each WAN. We choose L2TP/IPsec VPN, because this dont require to install FortiClient in each Client.  All the test were done with L2TP/IPsec VPN (Using the option "Windows Native" in the wizard)What we tried in first place, is to create 2 VPNs for each WAN, one for each user group (6 VPNs), but this seems that the Fortigate, only is listenning for one VPN in each WAN.I deleted all the VPNs and references (Including addresses)I created again the VPNs for each WAN, just for "User Group 1"I could connect and access the network through the VPN, everything was fineI added the 3 VPNs for "User Group 2" (1 for each WAN)I coud NOT connect, wrong credentialsI

Using FAC for Radius/EAP-TLS, backend is Active Directory. My LDAP remote user synch rule seems to be working, except for the fact that my a user's certificate binding is not coming through. The user does have a cert issued. Any ideas - misconfiguration on FAC or my domain controller ?

I'm trying to test authentication by using Machine certs instead of User certs. When I configure the windows supplicant to use "User or Computer" OR "User" I can authenticate. If I force the setting to "Computer" it fails. Both the computer and user certs are valid and signed by same CA. I must be missing something in the Radius server config. Any ideas ?

Now that I have all my users using SSL VPN similar to how our old Cisco AnyConnect was working I would like to start learning and then implementing ZTNA to better control the users. My EMS Cloud, FortiClients and FortiGate all use ADFS for SAML.  Is there anyway to setup ZTNA such that the groups the user is in controls their access to devices?  For example.  If I have a user in Dev group I want that user to be able to SSH to a CIDR address list.  I also want them to be able to connect to HTTPS to another CIDR address list.  Then I have a group like AppSupport that should only HTTPs to 2 different CIDR address groups.  Then I might have a third user which has both AD groups (Dev and AppSupport) so they should be able to access the combined CIDRs. Is this at all possible???What 

Hi, I want to configure a SSL VPN with a Smartcard authentication.Is this possible? Fortigate Version:     6.4.8 build1914 FortiClient version:   6.4.6.1658 RegardsChris  

Hi, We have currently 20 FGT40F branches connecting via VPN IPSEC with the FGT1100E HQ.Users on the branches connect to a Cluster-RDS via RDP and uses the services/servers from the HQ network. The issue we have is that the RDP sessions are dropping randomly during the day (sometime just once or twice a day) on any branch and sometimes on random hosts. Users on HQ that connects also to the Cluster-RDS never had any complain about connection being dropped, so we assumed that the servers are OK. We performed several troubleshooting steps to try and solve this issue but the problem persists. We took 2 branches to test configurations and if they worked we'd replicate to all the others. So far we tried:- set auto-asic-offload disable- set npu-offload disable- VPN IPSEC: AES-128 and SHA-1 Lifetime:28800s (on both phases)- system session-ttl for RDP: 28800s Any help would be appreciated.Thanks

FortiGate Cluster in A-P.I noticed that there is a mismatch in vpn.ipsec.phase1-interfaces on FW02. I tried to delete the tunnel in CLI FW02  but encountered an error.FG60FFW02 (phase1-interface)# delete fg-ipsec-101Can not delete a static table entryCommand fail. Return code -61 Tried also re-calculated checksums but issue persists. Any recommendations to make this works is highly appreciated. TIA :)  

Hello Team, So i have a query regarding IPSec VPN Tunnel over BGP. There is BGP on the both side i.e, Remote and Local Site. whereas, the remote site has requested to establish IPSec VPN over BGP. But the problem arise when in the Local site BGP is announced in the Cisco Router. Do we need to configure the VPN in the VPN Firewall or Cisco Router???? Please share us the solution.Thank you

Cluster Synchronization: FortiGate HA clusters rely on synchronization to ensure that all units have the same configuration, firmware version, and operational state.Out-of-Sync Symptoms: This issue may manifest as inconsistent configurations, failing failovers, or operational discrepancies between cluster members.