Fortinet Community

Hi, I find the OBM feature on FortiExtender very very useful.https://docs.fortinet.com/document/fortiextender/7.4.4/admin-guide-standalone/957071/obm-management Is similar functionality in FortiOS on Fortigate available as well ? How to use it ?If not:  Any chance to get this implemented in upcoming releases ? Thanks & BRFrank

HiI tried several times reading about how NAT works in Fortigate, but it doesnt work.FortiGate 60F, firmware 7.2.8 build 1693.I found many guides using "IPv4 policy", but this is not present in my "Policy & Objects" menu, I think maybe different firmware.So I create Virtual IPs I need, then I create firewall policies from wan to virtual ip.But it doesn'n works, i presume i made something wrong o I didn't do at all something that is necessary.I am new in FortiGate, coming from other manifacturer products, any help is welcome. Edit: I add some informations may help:System is in NAT mode.Gateway is a modem/router Fritz, and Fortigate is in DMZ on it.Activating https admin on wan interface, it is reachable from internet.   

Hello everyone,is it a solution to manage ldap servers integrated to a fortigate, but with an account in protected users group.It seems that once the account i use to connect my fortigate and my AD servers is put in the protected users group, the fortigate cannot contact ldap servers anymore, so all the SSL VPN authentication requests fail. Thanks for your help, if you have any solution.

Hello  Please can you let me know if it is possible to create multiple remote access SSL VPN Tunnels (vrf aware). I have two LAN interfaces (subnet overlap) in separate VRFs. I want 2 ssl.root interfaces so that I can add VRF information.  Is this supported ? Thanks

Dear Experts,  I don't understant load-balacing mode and tie break option on service configuration of SDWAN Fortigate. I think if traffic match sdwan rule and have >= 2 paths match SLA, traffic will be load balanced base on hash mode ? And so what is purpose of tie break option ? If set it to enable, the option will override load balancing option? Or tie break just only run when all paths don't meet SLA ? Thank you in advance !

Hi Team, We would like to use SSL VPN in tunnel mode only. We have disabled the web mode on portal, but some users using Forticlient are connected in ssl-web mode. After numerous session resets clients finally connect in tunnel mode. Any ideas and help finding the reason is appreciated.

Hi All, There is an office that uses FortiGate as a router.There is a site-to-site VPN tunnel between Azure and that office.The office has a modem connected to the FortiGate router with 4G connection and when their primary connection is down the router fails over to the modem. Because Site-to-Site VPN between resources in Azure and the on-prem network is vital for business apps when the FortiGate fails over to the 4G modem there should be also a VPN tunnel over that modem. When the FortiGate fails over to 4G modem it is assigned a non-routable IP address 1.XXX.XXX.XXX and for this reason DynDNS service is used to associate 1.XXX.XXX.XXX with a DNS name. Below are the screenshot of Azure side and on-prem side VPN configuration.        Both Azure and FortiGate configuration for VPN over 4G were copied from working VPN configuration over primary WAN connection. If someone has experience with Azure Site-to-Site VPN over 4G pl

Good morning!I've been told that 221B units won't work with fortigate 301E. Is this true?. Is there a compatibility chart anywhere?

Dear Expert, I am searching Fortigate SD-WAN load Balancing, and I found 2 commands:1.set load-balance-mode [source-ip-based|weight-based|...]This command is under : config system sdwanAnd: 2. set load-balance [enable|disable]This command under: config service (SD-WAN rule)I don't understand what is purpose of them , and why do FortiGate SD-WAN has  these 2 commands look like same ?Because, if traffic match sdw-wan rule, the command 2 will execute, right ?, and when command 1 is executed ?Thanks !

Spoiler (Highlight to read)I am having issues with latency on internal traffic from My Fortigate 100F internal lan (hardware switch) to Fortiswitch VLAN. When I put both machines on separate Fortiswitch(148F) vlans they work fine. I have an Arube 10gb switch attached to the 100F Internal lan port.I did notice that the speed of the internal lan port is set to 1000full while the vlan interface is set to 10000full. Would this affect traffic performance?I am having issues with latency on internal traffic from My Fortigate 100F internal lan (hardware switch) to Fortiswitch VLAN. When I put both machines on separate Fortiswitch(148F) vlans they work fine. I have an Arube 10gb switch attached to the 100F Internal lan port.I did notice that the speed of the internal lan port is set to 1000full while the vlan interface is set to 10000full. Would this affect traffic performance?

I am setting up an iOS IPSec VPN and followed everything in this guidehttps://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/311726/ios-device-as-dialup-clientSo far I can access the local network but only via IPs. Hostnames does not work. Clients can ping the dns server but the client can't seem to get any resolution.Is there a problem in this guide or lacking any steps? I tried to search other KB but seem to not work either.

 Hello,I recently installed FortiClient on my Debian 12 system. I tried both installing the `.deb` package directly and using the repository method. While the installation process completes successfully in both cases, I'm encountering a couple of issues:1. Keytar Error with Root Access: When I try to open FortiClient VPN with root access, I receive a "keytar error" message. However, this error does not appear when I open the application with a regular user account.2. VPN Disconnects Immediately: Regardless of the user account used to open FortiClient, the VPN connects but then immediately disconnects.Has anyone else experienced these issues? Are there any known fixes or workarounds? Any guidance would be greatly appreciated.Thank you!FortiClient#

Hi Team, We are implementing proxy policy with fsso but the issue is why we need to enable lan to wan in Firewall policy when we are defining lan to wan in Explicit proxy. Will not end system which are authenticated via fsso will reach to internet if we just mention policy in explicit only. Also when we disable traffic to Wan in normal policy internet does not work.Please suggest!

In this step-by-step tutorial, we'll walk you through the process of configuring FortiAuthenticator to act as a RADIUS server for domain users, enabling secure Wi-Fi authentication. Whether you're setting up a new network or enhancing your current infrastructure, this guide will help you integrate FortiAuthenticator with your domain environment for efficient and secure Wi-Fi access.Configure FortiAuthenticator as RADIUS server for Domain users for Wifi Radius Authentication https://youtu.be/eFwBkPgz_9A

Dear Team, We have Endpoint authenticated via FortiNAC via RADIUS Local. Endpoint has Persistent Agent installed. Our purpose is to give endpoint access when their PC is compliant but we noticed that endpoint shown OFFLINE on FortiNAC after around 30-40 minutes. This offline cause endpoint compliance being failed. During that time, FNAC also mark switchport as Link Down, Not Connected while on Actual Switch , Port is still connected, Authorized by Radius, MAC Address Table shown on the switchport. Note: Endpoint has PA installed, Switch integrated with L2 Polling SNMP, RADIUS.  Thank You FortiNAC

Hey All,I am having an issue with setting up VIPs to redirect incoming traffic on a FortiGate with Central NAT enabled to a remote public IP. A few months back, I had a need to change existing VIPs that mapped from public to private, so that the new mapped IP was another public IP that is not ours. I found this article, and it all worked nice a smooth from testing to deployment in production. This was on a 200F at 7.2.8 without Central NAT. The one strange thing is that I don't get any hits on the Policy Routes. Now, I have to configure the same thing on two more FortiGates, both also at 7.2.8 - one is a 200F without Central NAT and the other is a 100E with Central NAT enabled. I'm having an issue with the 100E. There is a Central NAT policy that says any>internet / src all | dest all / NAT as outgoing interface. There are three other policies that should not be affecting my traffic as they have defined interfaces and addresses that are not involved with this. The 100E has

HelloIs there a way to quickly transfer a FortiMail VM license from an existing VM to a new one without opening a CS ticket? For example is there a way to do it from the support portal?

I am setting up an office network with a FortiGate 80F (FortiOS 7.2) and am having trouble with routing. Can anyone please tell me how to configure multiple wan routing?My scenario includes the following Vlan interfaces (LAG with switch):- wan1: 1.1.1.1- wan2: 2.2.2.2- wan3: 3.3.3.3 - lan1: 192.168.1.0/24- lan2: 192.168.2.0/24- lan3: 192.168.3.0/24- lan4: 192.168.4.0/24 Goals:1. When lans connect to the internet:- lan1 → wan1- lan2 → wan2- lan3 → wan3- lan4 → wan32. Automatically change to the following priority routing if issues occur:- lan1: wan1 → wan2 → wan3- lan2: wan2 → wan3 → wan1- lan3: wan3 → wan1 → wan2- lan4: wan3 → wan1 → wan2 My config: 

Hello Dears I am trying to do internet service database group but i am not seeing anything related to create group on firewall level   any one can help ? Bests

Hey, Perhaps someone can assist me or guide me in the right direction. I've been trying to resolve an issue with one of my S2S VPNs for a week.I have three Fortigates: one 600F and two 400Fs. The 600F has an S2S VPN with both 400Fs, and both ends have the same configuration. All of them are still running on Firmware 6.4.15. My problem:When I ping or SSH between the 600F and one of the 400Fs through the tunnel, I experience 10-15% packet loss. This results in very slow transfer rates and even causes CLI inputs to come through in waves. When I check the packets with a ping, I see that everything is sent, and replies are sent back, but some packets are just missing on the source firewall. With SSH, I observe retransmissions, TCP duplicate acknowledgments, and TCP previous segment not captured errors.The exact same configuration with the other 400F works perfectly fine without any issues.If I ping and SSH over the WAN interfaces instead of the S2S tunnel, it also works without is

Hello guys, in the data sheet from FortiMail there is mention about attachment inspection inside of emailhttps://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiMail.pdf But in the logs from FortiMail forwarded from appliance to our logserver i do not see full smtp headers listed - there are some basic - to,from,mail-id etc. but i specifically looking for Content-type/Content-disposition headers to be able to see if the email contains attachment or not. From what i checked FM only have rules to inspect particullar behaviour based on db signatures but this simple information is slipping somewhere - is FM able to provide this simple metadata?Appreciated your support#FortiMail #FortiGa

In light of recent cybersecurity events, we would like to remind FortiEDR customers and partners about our software and content update release process, as well as our overarching release strategy. The following overview will detail our various release types, our systematic release process, and the measures we take to mitigate associated risks.    Release types: We classify FortiEDR releases into three categories: Major, Minor, and Patch.  Major and Minor releases undergo comprehensive QA cycles, followed by internal deployments where the system is tested in our own production environment for several months.  Patch releases address a limited set of bugs and are considered less risky. These releases go through QA cycles that focus on the impact of the changed modules and include overall sanity checks. Similar to Major and Minor releases, Patch releases are tested internally for at least a few weeks before being deployed in production.  Development and Q

I installed forticlient vpn on Debian 12 but i when try to connect it shows this errorError occurred in handler for 'keytar.setPassword': [Error: The connection is closed]TZ=+0400 [confighandler:EROR] websock:40 Failed to read message: Trying to work with closed connection

Hi, Can we get patch management report from EMS.  Regards,Ganesh