Fortinet Community

Hi,I was wondering if FortiToken Mobile APP had a roadmap to support the HarmonyNext OS.My understanding is that the existing mobile app support HarmonyOS or Andriod 12 below by IKEv1.Anyone knows about it?     

WAN1 - Spectrum COAX internetWAN2 - Spectrum eLAN to HQ. We have a problem with this location where the internet goes down more than it should. When it goes down, we're able to route internet traffic over WAN2 which is usually just for internal traffic. I'd like for this to happen automatically. I set the administrative costs on the static route to 0.0.0.0/0: 10 for WAN1 and 110 for WAN2. This works just fine if I manually disable WAN1 for testing. I think the problems lies with the Spectrum router we're forced to use in order to have a static IP address. WAN1 is connected to the Spectrum router and gets an IP address from DHCP. 192.168.0.2 or whatever. If the internet goes down, the link for WAN1 stays up, so the Fortigate doesn't realize there is a problem. Any ideas?

Hi, Our users work via Remotedesktop on Windows Server 2016 (VM-Ware ESXi VM-Version 19) with FortiClient VPN 7.2.4 (free).Their SSL-VPN with one predefined Gateway to an external Partner works fine. Some of the users now have to connect at the same time to another SSL-VPN. Can I realize this kind of "multiuserconfiguration" on this single Windows Server ?What would be the recommended Best Practice ? Thanks, Roland

I haveA 200 E Firewall. It is configured with two WAN members in SDWAN Zone 1 for all devices in my network. Is it possible to add 3rd wan to another SDWAN ZONE and make it accessible to only one particular device. I tried to create two sdwan zones. Some of the lan devices are connecting to wan3 eventhough no policy created for zone 2. My aim is that to only my video conferencing system can use wan 3(zone 2) and rest of the lan device can use wan 1& 2. (Zone1)

Hi, I am hoping someone can help me out in setting up a custom report. I want to get a report via FortiAnalyzer that includes source user source interface or vlan and destination user destination interface or vlan bandwidth information. How can I do this? Thanks in advance,

Hello, I need a version of forticlient for 32 bit, debian, I've been searching but can't find any.Where can I download this.Best regards 

I am trying to learn how to setup a webportal so that users can connect via the web to our Fortigate and get proxied over to a specific internal website.   What documentation should I be looking at to learn how to make this happen?  I am running Fortigate VM in AWS version 7.4.4

FortiClient is not connecting to Windows 11 Pro.  I already updated the network card driver and nothing, I already disabled IPV6 and nothing connects.  

I am having a problem with a virtualized firewall in EVE-NG. One box does not bring up the static route 0.0.0.0/0 to the internet.Below is an example of a box with an error. When it is in this state, I cannot communicate with the external IPs I have in the lab.  Here is an example of a box that has the 0.0.0.0/0 route to the internet and is functioning properly. how is possible enable this option ?    

Has anyone looked at possibly adding memory to the 60F that seems to be experiencing all of the conserve mode issues? We have quite a few recently purchased and I'm regretting the 60-month contract. However, I'd gladly swap a chipset, even if I lose some warranty protection.

I have a similar problem. I cannot ping from the router. I want to ping from OPPA to MTAVARI_FILIALI at 192.168.0.136, but I cannot. OPPA can see the route. this is photos this is OPPA router routes this is MTAVARI router routesHow can I connect from the OPPA router to the host at 192.168.0.136? In the FortiGate interfaces, I have allowed ICMP (PING), and OSPF is configured to redistribute static routes. The connection between OPPA and FortiGate uses OSPF, while the connection between FortiGate and the MTAVARI router uses static routing. Please let me know if you identify any issues.FortiGate 

Forticlient VPN 7.2.3 works just fine, but 7.4 just gets stuck on 'connecting' no matter what I change in the settings.  Is there a fix for this beyond just going with an older version? It doesn't seem to matter whether I upgrade an existing 7.2.3 install or if I install fresh. Update with Fix: Per this post Fix for FortiClient VPN app being stuck at "Connec... - Fortinet Community the fix is to install the Visual Studio Redistributables from this link https://answers.microsoft.com/en-us/windows/forum/all/dll-files-missing-after-windows-11-update/d9b03703-4c1b-48b1-9707-22eddfc2c637 After installing this the issue is resolved.

Hi Team, We are currently using FortiOS version 7.2.8 for our network security needs. Recently, we have encountered an issue with our SSL VPN users. Despite specifying particular policies for these users, they are able to access other policies as well, which is not the intended behavior.Our SSL VPN users authenticate through FortiAuthenticator for Multi-Factor Authentication (MFA). The expected outcome is that they should only have access to the resources defined in their specific policies.  If you have any idea about this case please share it.I need help on this @nithish.k@snsin.com #fortigate#fortiauthenticator 

Hello,I'm configuring FSSO for SSL VPN via syslog. I configured the environment and I can see the logged user on the Fortigate. I have a strange behavior with the IP address showed by the firewall under User and Devices. It is the IP of the domain controller instead of the ip address of the VPN client. I'm on 7.2.8 version.The collector is installed on one of my domain controller and it is configure in DC agent mode.The agent is installed in all domain controllers. How I can investigate about this problem? I think there is a misconfiguration. Thank you.

Hi,I am facing a strange issue regarding Tacacs setup:it works well without any problem with a specific server (which is a Cisco ISE PSN), and my login attemps seen in Cisco ISE Live logs.but when I configure another PSN , I can login to the device, but my attempts is not seen in Cisco ISE Live logs. It's also strange, when I test it by 'diagnose test authserver tacacs+...' then my login test/attempt is seen in ISE Live logs.I have captured traffic on this firewall to see what happens on packet level and found that when login attempt is not seen in Cisco ISE Live logs then firewall simply resets connection during TCP handshake right after syn+ack packet coming from PSN. So connection is not established at all.Thanks,

Hi, Here are using two FSW 1024E , now It is working in active-passive setup with MCLAG and VVRP config.now we need it as active-active setup can anyone send the doc to do with A-A setup configuration. Regards,Prakash.k

Hello,My company has FortiClient installed on windows laptops, managed by EMS. We currently use always-on IPSec.We now want our laptop to communicate throught VPN only, no LAN or off-VPN internet communication whatsoever.How can we achieve this ? Network Lockdown only works with SSL VPNI tried making exceptions in the Windows Defender Firewall for Forticlient.exe (and others) without any success.Any hint would be greatly appreciated ! Thank you

Using the native client from iOS-branded Cisco, you can create an IPSec VPN that works for iOS. This works because you can connect to the VPN and do what you need, including entering your shared key. The issue is that you cannot use the Forti token in the native VPN client. Fortclient does not support IPSec for iOS on the iPhone application. Is there a workable solution for this?

 We have a multi-location FortiGate firewall, and we have a HQ location two ISP and a branch location single ISP, both firewalls configured IPsec to primary WAN. Sometime HQ location Primary WAN goes down and IPsec VPN is disconnected, so our work is affected. We need a HQ location firewall. Both WANs configure the IPsec to branch location.

Version: 7.4.0.0427OS: CentOSI have created a CLI Configuration and would like to apply it to a network access policy, but I am not seeing any option in the Network Access view to actually apply the cli config to a specific policy.  I was able to apply the CLI within Model Configuration on a specific logical network from that view, but is there not a way to just apply it to a Network Access Policy?  I have reviewed the below documentation but not actually reading where/how to apply it to a policy. https://docs.fortinet.com/document/fortinac-f/7.4.0/administration-guide/926300/network-access https://docs.fortinet.com/document/fortinac-f/7.4.0/administration-guide/856626/apply-a-cli-configuration-using-a-network-access-policy Any help on this will be greatly appreciated. Thanks

I have added an automation feature to automatically back up my FortiGate firewalls every night. I would like to include a time stamp in the file name but so far I have not been able to get that to work. This is the filename I am assigning through the execute backup script: daily-backup_%%log.devname%%_%%log.date%%_%%log.time%%.conf The variable %%log.time%% does not work. If that variable is included in the script my filename looks something like this, 1WSIAF~2, with no file extension or any of the other file name elements. I have tried to use %%time%% but that does not work either. Is adding a time stamp through this script impossible?

Hi everyone, From what the manual says about the BIOS, it seems interaction with the BIOS is very limited. However is it possible to set a password to it?

Hi everyone,  I have been reading the manual for the Fortigate 100F and, as far as I know, this is not mentioned but I wanted to ask you just in case I missed how it can be done.

I have the following issue and need your help, please. I have a FortiGate device and a router with an internal network of 192.168.0.0/24. I've set up multiple branches in OSPF area 0, excluding the internal network 192.168.0.0/24 because the second branch needs to act as the main distributor. Additionally, I have two tunnels with another company, set in OSPF area 10. To ensure they see a specific IP address (e.g., 192.168.0.136) from our network, I used "redistribute static". However, enabling this causes the second branch to not see the 192.168.0.0/24 network. When I disable it, the issue reverses, and the other company cannot see the second branch. Is it possible to resolve this by creating access lists for both OSPF areas? Here's   the configuration snippet for "redistribute static":           FortiGate    

hi all,trying to create site to site ipsec vpn with the other site on Azure virtual gateway, the tunnel is down and i follow the article https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-VPNs-tunnels/ta-p/195955 to troubleshoot, I got the log as below screenshot when doing step Confirm that IKE traffic for port 500 or 4500 is not blocked somewhere along the path. does it mean that it is so good so far to the step? what is UDP 384 there?