Fortinet Community

FortiGate Cluster in A-P.I noticed that there is a mismatch in vpn.ipsec.phase1-interfaces on FW02. I tried to delete the tunnel in CLI FW02  but encountered an error.FG60FFW02 (phase1-interface)# delete fg-ipsec-101Can not delete a static table entryCommand fail. Return code -61 Tried also re-calculated checksums but issue persists. Any recommendations to make this works is highly appreciated. TIA :)  

Hello Team, So i have a query regarding IPSec VPN Tunnel over BGP. There is BGP on the both side i.e, Remote and Local Site. whereas, the remote site has requested to establish IPSec VPN over BGP. But the problem arise when in the Local site BGP is announced in the Cisco Router. Do we need to configure the VPN in the VPN Firewall or Cisco Router???? Please share us the solution.Thank you

Cluster Synchronization: FortiGate HA clusters rely on synchronization to ensure that all units have the same configuration, firmware version, and operational state.Out-of-Sync Symptoms: This issue may manifest as inconsistent configurations, failing failovers, or operational discrepancies between cluster members.

A while back I found a really good Technical Tip article on setting up Fortimanager for SSO with ADFS SAML with the FortiManger in SP mode.  I am totally unable to find it anymore.  Does anyone know of any good Tech Tip articles for this or other docs besides the standard Fortinet junk manual?

We have a production Forti100F ver 7.4.4, we bought another Forti100F, and try to set up HA in configuration mode only.The secondary  Fortigate has only management ip interface set up.We issue the basic commands for setting the HA as in the admin guide, but never synched.Are there some prerequisites we are missing, or thiw mode does not work ?Thanks in advanced

Hi Guys, I hope can help me find a solution for the issue that I am having while using Fortigate email two-factor authentication in a IPSEC VPN. The problem is when a user clicks on connect in Forticlient the PC loses internet connectivity and FortClient stays waiting for the email code that was sent to the user email address, but the user can access their email because they are without internet connectivity on the PC.I am using slipt tunnelling, this does not make sense, because they need the token to connect to VPN but they don't have internet connectivity until they log into the VPN.Testing the access getting the token using my mobile phone, the VPN connection works how it should, and it does not redirect the default gateway to the VPN, only the slipt tunnelling routes are added to the PC.I hope someone can help with this inconvenient problem.Thanks for your help.

Hi,I am currently testing SSL VPN multi-factor authentication. Since we already have PKI and smart cards running in the Microsoft AD environment, I followed the steps in the guide:https://docs.fortinet.com/document/fortigate/7.0.1/administration-guide/266506/ssl-vpn-with-certificate-authenticationEverything executed smoothly, but I noticed a peculiar authentication mechanism. Fortigate's certificate multi-factor authentication matches if the account subject string on Fortigate matches part of the information in the certificate subject. I believe this is not a secure and rigorous matching method. The PKI user's subject should fully match the certificate subject. It can be observed that test3-jason was initially matched by jason's subject, leading to subsequent authentication failure.How can I avoid the following situation?Additionally, can Fortigate's certificate authentication authenticate the subject alternative name in the certificate?FortiGate  The following is the ve

Hi FortiClient EMS adminsFCT EMS 7.0.13.When deploying client from EMS I get error 150 on the EMS logs.Windows events on client show 30000 ms timeout waiting for FortiClient Install Service.I checked all below prerequisites are ok.https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-FortiClient-Deployment-Error-150-for/ta-p/260271Any idea?

I need to find a way to on mass or via policy enable the Forticlient Browser extension in Incognito mode. It is deployed by the EMS intaller, but not for Incognito mode. The user has to manually enable or can manually disable that currently. There does not seem to be a way in the EMS server or Intune to do that. 

FG is the DHCP server. FG DHCP is issuing IP correctly and we can see the IP. The problem is we cant see the IP address in wiindows DNS so we cant do an nslookup or resolve the PC name to IP.I want to know if there is a config so that FG relay the DHCP info to windows DNS. This is the article I'm looking right now. https://community.fortinet.com/t5/FortiGate/Technical-TIP-Different-options-of-configuring-DNS-server-on/ta-p/278967 TIA :) 

Hi All,I am new to Fortigate, when I logged in to the GUI recently, and I saw that Forticare period is about to expirebut it also shows in Hardware version: return to factory and I did not understand what that meansif I did not renew before expiration, will I be able to keep using the device?my device is 40FFortiGuard 

Site to Site IPSec VPN Gateway using two Fortigates. Branch has an 80E Firmware v6.0.2, Headquarters has a 300D Firmware v5.6.6. Problem: End users reporting very slow file access from the fileservers located at headquarters.File transfer speeds between the two sites averages 425 Kbps for Data only.Should I expect better file transfer speeds between the two sites? Note: VoIP works great. Speeds out to the Internet are great.VoIP and Data are configured to use the same port on the Fortigate 80E. I'm using Windows Explorer and copying a file from the (Windows 2016 Server) fileserver to the desktop (combo of Win7 and Win10 pro) to test the file transfer speeds.  Iperf between the two sites using the default settings for TCP.  I didn't change the Window size. Average speed was between 2 to 3 Mbps. Ftp'ed between the two sites average speed was 1.5 to 2.0Mbps.Distance between Branch and HQ 34 miles. Branch has 30 pc's and 30 VoIP phones. 30 Employees, rarely ha

Not an issue, but had a major decrease in firewall CPU utilization after upgrading from 7.0.14 to 7.2.8 on a Fortigate 200E Firewall. It was averaging 50 - 60% during peak hours (9AM - 8PM EST) and typically has 30,000 sessions during this time (majority short lived). After upgrading, the CPU utilization is down to 2-4% with the same number of sessions. Memory usage has stayed steady, around 40% throughout the day. I guess it's a good thing, but the dramatic decrease is a little weird. Has anyone experienced something similar? I had to double check if after the upgrade our Network Provider made the previous passive firewall the active, but that is not the case. It just seeps like a very dramatic drop, to the point where I'm concerned there may have been a misconfiguration before or misconfiguration now....

Hi sir, A simple question, after I execute a command "execute shutdown" from RJ console, the FortiGate will go into standby mode, and at this moment, the RJ console and all Ethernet ports are without function, how can I wake the FortiGate up remotely? Can the FortiGate be woken up only by AC off then on it, since it does not have a power button? Thanks,Jacky

hi,i just want to confirm if i'm doing it right when creating a new FW policy section in fortimanager.do i right-click on the specific policy, in this case in want under sequence 10, then choose "add section"?is this the same as click on the policy sequence 10 > section > + add?   

Does FortiGate BGP support the use of both 16 and 32 bit AS numbers? I've been looking at the FortiGate 7.4.2 admin guide and not seeing anything definite there to answer my question. Bill

I'm using FortiAnalyzer 7.4.2 and trying to exclude logs from certain IP addresses from being processed by the Event Handler.  These IP addresses in question are from our unsecure guest network and we don't need to have them reporting anything through the Analyzer. The basic firewall is still sending a ton of logs to the Analyzer, but I want to filter that out.   The Event Handler system does not seem to have a method of doing this.  It seems only capable of turning logs into events and cannot simply ignore the log.  And I'm very hesitant to start messing with the Log Parser.   Is there any method of doing this aside from the Log Parser? And if I did have to go down that route, would I need to edit the FortiAnalyzer Log Parser?  Or is the FortiAnalyzer Log Parser used for forwarding logs to a SIEM after FAZ has finished with them?   A side question, does FAZ use the log forwarding system to send incident details to a SIEM?&nbs

Let's say 1 user ABC has connected wireless (192.168.1.100) and wired (172.16.1.100), at this point no issue for FSSO, but once the user disconnected from wired, and use wireless to continue, then FSSO will not able detect user ABC. (it happens randomly, sometime no issue or sometime happened after 1 or 2 hour) Even i waited for 5 minutes but still nothing happen, anything that i can change to prevent this? The only method now i have to lock my laptop/pc then login again, after FSSO will immediate working...the FSSO agent installed on a joined domain server (not AD server), pull user info from AD server and the FSSO setting all default included the interval time settings.

I've got a strange problem that crops up. I think the issue is that people get a new ip address without re-logging on and the FSSO/fortigate gets confused. Situation:multiple sites, different subnet on each site. Windows laptops, Aruba wireless, Fortigate with FSSO authenticated AD groups, Fortigate policies based on AD groups. Person logs into their windows laptop at site A, successfully connects to internet through Fortigate. Closes the lid, drives to site B, opens the lid (gets a new IP address from DHCP.) After coming out of sleep, the laptop has internal network access (i.e. to local file servers) but nothing through the Fortigate. The Fortigate logs show an unauthenticated person at the new IP address trying to get through. I always have to tell them to reboot the laptop and then all is ok.  I have the "IP address change verify interval (seconds)" set to 60 in the Single Sign On Agent config screen even though I doubt it is needed because the documen

How can we configure ACLs in FGT to block local traffic.

Hi, On our FortiManager (5.4.1 VM) we have an ADOM defined with several VDOM's, each with its own firewall policy package.These policy packages have already hundreds of policies. Right now we are in need to update few parameters of every single policy in all policy packages. There is no way we can do this manually in GUI policy by policy. We could grab the whole configuration of FortiManager or directly the FortiGates in a text form and do a search/replace and then re-apply it. But I don't find this to be the smartest way to change configuration. I believe the ideal approach is to use a script.CLI scripts do not make sense because there is no way to use variables, loops, if/else statements etc. in a CLI script. So I turned my attention to TCL scripts. I have enabled them for FortiManager.I am actually able to write a TCL script which should do exactly what I need the script to do. There are nice examples in the administration guide or here in the forum.  M

Hi there, I recently bought a new PC and am trying to setup a VPN connection to my workplace so I can remote into my office computer. However, upon installing Forticlient as per my workplace's instructions, I am unable to connect to their server and am receiving message "Unable to establish the VPN connection. The VPN server may be unreachable. (-5053)."  I have a ticket open with our IT department but they're taking a while to respond, so I figured I'd post something here to see if there's any troubleshooting I can do on my end to resolve this ahead of their investigation. For reference, I have noticed and tried the following: 1) I have tried installing the version of Forticlient on my workplace website (v. 7.2.3.0929), as well as the latest version off the website directly. My workplace produces the error message and the latest version does not do anything (it resets all the credentials and doesn't attempt to connect at all)2) Reinstalled several times using both

Guys, I need some help.I set my Firewall 60E to update yesterday and it hasn't come back. Until now, it only has the power LED on, but it doesn't start.Any tips?

Hello! I got a FortiWLC-50D running 8.6-1 build-7 with 17 Fortinet AP832 access point. No problem with that. I just jot some Meru AP832 access points that I want to add.They all are running on 6.1-3-5 When I try to update them usingupgrade ap sameThe upgrade process hangs at "Reading File". Then after 2 minutes the access point reboots but stays at 6.1-3-5. What can I do to upgrade those APs? Thank you in advance 

Hi everyone, Is the above question possible? Only command I found on the CLI manual seems to apply only to the ha interface: config system haset gratuitous-arps disable I need to disable gratuitous-arps on all interfaces.