Fortinet Community

Hi,I am testing FortiClient EMS and was thinking about if I even need connection to AD or Entra.My goal is deploying on our 50 company devices. I did create an installer which is accessable from LAN only and deploy it via a third party tool.So I do not really see any benefits / needs for adding a connection to Entra... Later on we want to switch to ZTNA - do I need a Entra connection for user authentication for this?

Hello Guys,  A quick question, i wish to archive all files (quarantine and verified by DLP) on fortigate or other platform. Can you suggest me to use Fortigate with SSD or fortimanager/FortiAnalyzer ? Thank you

Hello, I downloaded Forticlient VPN for Linux (rpm package) but the interface (GUI) is still in English. Is there a way that the whole interface (GUI) is set in French ? Thanks. Alan. 

Hi, I'm running FortiClient EMS v7.2.4 and I've deployed FortiClient v7.2.4 to a device, let's call it DeviceA. In EMS I have our Microsoft Entra ID added under Endpoints -> Manage Domains. Within this configuration I am sync'ing in selective groups, for ease, let's call them Device Group and User Group. DeviceA is a member of Device Group and UserA is a member of User Group. I then have various policies (VPN, FW etc) assigned to User Group, with no policies assign to Device Group. This is working nicely in that UserA is getting the correct policies when logging into DeviceA. Also, in EMS under Endpoints I can see DeviceA in Domains -> Entra ID -> Device Group, which again is to be expected. Now to my issue... I have created an installer (for v7.0.13 as a test) and a deployment within Deployment & Installers -> Manage Deployment and assigned this to my Device Group. The assignment appears as domain.onmicrosoft.com/Device Group, so it a

Hello all,I'm having problem with AnyDesk and activated SSL Deep inspection.As soon as this is activated, the AnyDesk client can no longer connect to the AnyDesk server.I've already tried to exclude *.anydesk.com but no luck.I have already created a outgoing policy specialy for service "AnyDesk-AnyDesk" and set it to the top. But even this does not work.

Hello, I set up an explicit proxy a proxy on a fortigate 80F version 7.4.4. My configuration: Interface 4: 10.0.100.1/24, Explicit Web Proxy EnabledExplicit Proxy: Internal4 listener, HTTP port 8080Authentication scheme: Basic, localAuthentication rule: src all, Int4 inbound interface, HTTP protocol, auth scheme "test_proxy_schema"Proxy policy: wan1 egress interface, src all, dst all, webproxy service The IP of the proxy interface has been configured on a pc directly connected to the firewall port.My colleague who has control over this pc runs a continuous ping to 8.8.8.8.I don't see any traffic that matches with my proxy Policy. Can you help me, please?  

Hi All,I would like to get a list of all the BSSID's on a FortiGate, with the name of the AP it's assosiated with, so in essens a list like:AP1,BSSID1AP1,BSSID2AP1,BSSIDnAP2,BSSID1AP2,BSSID2AP2,BSSIDnetc.. Is there a way to do that, seems like CLI is needed, or do I look in the wrong place in GUI?

Hello team what is the course for the BGP not form neighbor between HQ and branch

I have two FortiGate 200D in HA mode currently and need to transfer one of them to the DR location. DR Site IP range and HO IP ranges are the same. Core Switch with different VLAN is having a gateway set to firewall LAN IP. Is it Possible to have an HA configured using Datalink connectivity between 2 different geographic locations?Do any other Changes are required on the Core switch?

Hi Team, I have a question about using DNAT and SNAT simultaneously. For example, my global IP is 100.100.100.100/32. I want to enable RDP (port 3389) access to a local host with the IP address 192.168.10.10/32 from the Internet.When a user connects to 100.100.100.100:42424, it should be forwarded to 192.168.10.10:3389 and also be SNATed to 192.168.20.10/32. Is the configuration below workable?------------------config firewall vip edit "vip_192.168.10.10_Office-RDP"  set service "TCP_42424"  set extip 100.100.100.100  set mappedip "192.168.10.10"  set extintf "WAN_v2000"  set portforward enable  set mappedport 3389 nextend config firewall ippool edit "192.168.20.10/32_LAN-Office"  set startip 192.168.20.10  set endip 192.168.20.10 nextend config firewall policy edit 10  set name "Internet->Office-RDP_allow"  set srcintf "WAN_v2000"  set dstintf "LAN_v2002"  set action accept

I have acquired a 60 day trial license for a fortigate VM with 1 vcpu.Can someone tell me what happens if the 60 day trial license is over? Will everything stopp working?With everything I mean VIPs and Virtual Servers with Full Deep Packet Inspection + IPS + WAF and some basic outbound firewall rules without UTM.

I'm a network guy, familiar with Juniper SRX and Palo a bit. I've installed FortiGate in Eve-NG  but the licences have now expired. What's the best root here for licencing? Ideally, I would like something permanent Performance is obviously not important. But it is really great to be able to simulate scenarios similar to the live ones we are deploying. I have asked our SE for temporary licences, but now, at the 3rd request, I've been politely asked to find a different solution. What is my best bet here for a permanent solution ? or is there a easy route to just keep renewing temp licences. Most vender seem to make trial licences freely available. Thanks in advance,  

Hi all! Still learning the FortiOS and have run into a issue and its time critical i get it fixed ( Sites need to print Paychecks tomorrow )  So 2 of my 3 tunnels when down and i started with trying to ping the Public IPs and sure enough from CLI Fortinet/windows i can not ping those public IPs but if i log into the comcast modem can ping the public IP addresses and if i go to the other 3 sites and ping the Main sites IP that come back as responding from Fortinet/Windows and the Modems. Any ideas on what may have gone down or broke? Any help is appreciated! 

Hi all,Fortinet 200f running 7.2.7Cisco CBS350Set up a LACP LAG on both the 200F AND THE 350. Refuses to come up. Anyone have any insight on this?Are there non compatible settings set by default on the Forti that need to be changed in order for the lag to come up? The lag on the Cisco side is a plain jane LACP LAG. Nothing special https://vlc.onl/ .Thanks

Hi everyone, I want to prevent anyone from being able to shutdown the Fortigate from GUI or CLI. Is there a command which can allow me to implement this on the Fortigate 100F?

I have ems server version 7.0.6 build 0358.my vpn client running version 7-0-7need to now if i can upgrad the server without the need to upgrades  all the  my vpn clients?thank youShahar 

hi I need to implement HIGH Qos for Microsoft services. I understand I need to use shaper.i need help how to configure it.1.should i give maximum band for shard or per ip?2.the Microsoft services need to be as source or destination?3.do i need reverse shaper? thank you for  helping

I have an internship and am currently learning Fortinet. Do you have any project ideas for starting from scratch and eventually working on a larger project? I am beginning with VLAN and inter-VLAN configurations. How should I proceed from here in the security field https://routerlogin.uno/ ?

Hi guys. I have a consult about How i understand each option in Forward Traffic.for example i have consume in app zoom, in the option  "result" Accept(84.64 MB / 260.05 MB).   Understand total consume is 260, but 84.62??Put doble clic for more details in the option DATA, received Bytes: 260.05 MB , Receeived Packets: 392.072 , Sent Bytes: 84.62 MB y Sent Packets 158.634.  btw i have a shapper for this , maximum 3 Mb.  sooo   how this 84Mb app zoom entrance in this 3 Mb. for me is confuse. any help is good received.Regards   

Good morning experts. Maybe you want to help me with a problem that is killing me..?I’m trying to configure a solution for a remote office using CISCO switches and a Fortigate 60E. Difficult to explain but that is almost fixed, no problem with that.The problem is a behavior about how Fortigate manage VLANs in its Internal ports hard-switch:When all infrastructure is connected, the testing host is able to ping all VLANs. But when a physical trunk link is down between two of the Cisco Switches, the testing host loses connection to its default gateway (which is the Fortigate...!) I mean that the testing host can ping 5/6 time more from the moment the link goes down and after that it loses connection and pings are not more answered until the link is reestablished. I drew my infrastructure so that it is understood, I hope you can help me. Technical data:* Interfaces used: ports 1 to 5 of the Internal hardware-switch* Five VLANs configured on it: IDs 15, 30, 35, 50, and 101.* VLAN

Hi All,Good day! I have a very specific environment. Diagram attached.I have two Internet circuits from two providers trying to achieve diversityPlanning to connect these two circuits to two FG devices - not decided if I have to do a Active/passive or Active activeI have an existing environment where my Cisco based DMVPN is running. which I need to run for a few more months and eventually move them to Fortinet SD-WAN For now my plan is to connect these two FG devices and run them as a CPE to pass the DMVPN setupCan I configure the FG's as layer 2 ( switch mode) configure the HA which might pass all the DMVPN?Any specific observations here?After the FG's Do I need two switches to connect to the DMVPN router?

How can i block youtube on mobile phones 

Hi everyone, I want to allocate X, Y, etc. amounts of memory to storing certain log categories. Is it possible to do this in a Fortigate 100F?

HelloWe use the Forticarrier license in VM08 to inspect GTP traffic and to place necessary restrictions. We want to block protocols such as Ping, SSH in GTP. Can you help us with this?  I also want to filter SCTP messages in GTP and block some of them. I can write sctp message filter and give the ppid value and block it, but this is not what I want. I want to catch the payload in SCTP and block it if it exceeds the hit count. How can I do this? Thanks in advance

I would like to have the fortigate update its webportal URLS dynamically using some kind of script or tool or pull method.  As an example the Fortigate periodically pulls in a file from some linux server internally to create the webportal URL list that is then presented to the usergroup assigned to that portal. Any one know how to do something like that?