Fortinet Community

Hi guys! Like in the subject we have a Forti 40f with a static public ip over dhcp client from ISP.From the ISP we also get another public IP block/pool which is routed to our fixed IP. The goal would be that I can use my new public IP's on my 2nd Mikrotik router. Many posts about this say that VIP's should be used but as I'm not a Forti native guy can I find some GUI tutorial for that? Thanks!

Hi everyone,  I'd like to modify the password history in Fortigate so that the admin cannot reuse any of  X amount of passwords previously used by the admin. I have read a previous post (see link below) in the forum from 2022 where it was stated that the user could not resuse the last 3 passwords and this amount could not be modified. Since it has been 2 years now, has Fortinet changed this in later FortiOS versions?   https://community.fortinet.com/t5/FortiGate/Technical-Tip-Number-of-last-password-recorded-in-FortiOS/ta-p/205780#:~:text=Technical%20Tip%3A%20Number%20of%20last%20password%20recorded%20in%20FortiOS&text=When%20this%20setting%20is%20configured,number%20of%20last%20passwords%20stored.

Hi everyone, Is it possible to disable USB mass storage in a Fortigate? Or as an extrememeasure disable the USB port completely? 

Hello Fortinet Folks! Is there a CLI Command that shows how many address objects are currently a member of an existing address group?   I know I can view this from the GUI, but I'm just looking for a faster way of verifying if I've already reached my maximum address object members on a given address group, so I can either use a different group or create a new one. TIA!  

Hi,I have multiple VLANs that are working just fine. The last one I created cannot acces some Microsoft website and the username field on iCloud.com won't show up for example. I tried to redo the VLAN multiple times the see where I f*d-up. I cloned the rules from another VLAN that is working fine. I created a rule allowing Microsoft365 Internet services and portal.office.com finaly loads but there is other glitches and you can see a lag when the page load.Any help will be appreciated.Thank you Edit: even with web filtering disabled, iCloud won't workEdit2: FortiGate 601E v7.2.8Edit3: The problem is with the interface, not the VLAN

Hi Team,  I am replacing Cisco ISE with FortiNAC. The Cisco ISE is currently configured to profile the Access Points and send a Cisco Neat attribute. This Neat attribute helps the Cisco switch assign a truck role to the port.  In FortiNAC, Network Access > "Configuration" - It does not provide any option to send radius attribute only and VLAN ID is mandatory. https://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/116681-config-neat-cise-00.html cisco-avpair = device-traffic-class = Switch I want to check if FortiNAC has a way to sort this situation.  Regards, Barry Ghuman 

Hi everyone,  By default Fortigate is set to have a maximum of 3 password attempts and a 60 second lockout. But I want to set the bad logon counter to 15 seconds so that after a user has typed in for the first or second time the wrong credentials (before reaching the password attempt threshold) and waits for 15 seconds, the number of wrongly typed passwords is reset back to 0 and he can retry again. What commands should I run to make this happen?

Hi folks,I have a small but annoying problem with FortiClient.Every day when I connect to the VPN for the first time I get kicked after a few minutes. At first I thought it was a problem with the internet connection, but I ran a ping and WireShark, WireShark shows no errors and the ping has 0% packet loss.  I then reset my network under Windows and finally reinstalled the entire OS - unfortunately without success.The strange thing is that this only happens the first time I connect, if I get kicked off and then connect, the connection lasts the whole day without any problems!The FortiClient log file shows the following message: error sslvpn FortiSslvpn: 1540: error: WSAEnumNetworkEvents FD_CLOSE (10053)info sslvpn FortiSslvpn: 3132: Ras: connection to fortissl terminated I'm using FortiClient v7.0.5.0238. I'm curious if anyone here has ever had the same problem.Thanks in advance! 

Hi everyone, all Fortinet services are down: DNS, security filter, everything is dead. Does anyone know what happened? 

Good morning friends, I need your help. I am having problems accessing different web pages that I used to access normally and today I have had those problems. When I try to access a web page, the following message is generated (see image), the strange thing is that after several minutes it is possible to enter the page, however after another minutes or hours. the same message from the image returns. In short, the problem is intermittent. The connection is not privateAttackers may be trying to steal your xxxxxx.com information (for example, passwords, messages, or credit cards).NET::ERR_CERT_AUTHORITY_INVALID  The policy I am in has all security profiles enabled including the ssl certificate inspection. Checking the firewall, I noticed that the fortiguard servers were down and the following red message "Unable to connect to FortiGuard servers" was displayed. Additionally, the firewall used fortiguard DNS. Could you tell me if my problem accessing the w

This is not a critical issue and do not need a solution for it right now so much as I want the community/devs to know.  It should be known that I just finished a firmware update to v7.0.15 build0632 (Mature). It works just fine when I exclude other countries like United States or Canada, and I was using both with and without a policy filter. It freezes even when I only add Cote d'Ivoire (source country: ! Cote d'Ivoire). 

Hello Everyone, I changed the fortinet device interface settings unintentionally.I have changed the subnet from LAN to WAN and lost access to interface.I got a console cable and can connect to fortigate via Putty terminal.How can I reverse this?Below is my system info; your help is much appreciated.# show system interfaceconfig system interfaceedit "wan"set vdom "root"set ip 192.168.1.99 255.255.255.0set allowaccess ping https ssh http telnetset type physicalset role wanset snmp-index 1config ipv6set ra-send-mtu disableendnextedit "lan1"set vdom "root"set type physicalset snmp-index 2nextedit "lan2"set vdom "root"set type physicalset snmp-index 3nextedit "lan3"set vdom "root"set type physicalRemet # show system interfaceconfig system interfaceedit "wan"set vdom "root"set ip 192.168.1.99 255.255.255.0set allowaccess ping https ssh http telnetset type physicalset role wanset snmp-index 1config ipv6set ra-send-mtu disableendnextedit "lan1"set vdom "root"set type physicalset snmp-inde

With forticlient 7.4.0.1636 on a laptop running a new install of Debian 12, the VPN connection process seems to complete normally but there is no traffic (bytes received remain at zero). Inspection of the logs shows no apparent problems, but I cannot connect to the remote systems ("no route to host"). But if I do "nmcli device status" I see that a fctvpn tunnel has been created. I can manually connect this by doing something like: sudo ip route add 10.100.123.123 dev fctvpnf01234567 After this I can access the specified host as normal, and the traffic counts update. Any ideas why the normal connection process is not completing?

Dear all, do you guys know what is the username and password for " fortimanager.com" ? I have tried username " demo" password " fortimanager" but not success.....

Hi, Does anyone know how to control uninstallation of FortiClient for android devices on FortiClient EMS?Is it doable? Thanks

I have purchased an Asus Vivo Book with the Snapdragon X Elite processor, so i am unable to install the the app through the installer, I've installed the Microsoft store version but am struggling to configure it correctly. The information i have been provided about my jobs VPN is that its using SSL-VPN with a work domain for the remote gateway, with the port 443 and the need to enable SSO for VPN Tunnel, which is supposed to direct me to a login page using my work email and password. Can someone please help me with the configuration of this I need it sorted ASAP. Thank you. 

can we disable a license notification (red icon), we have an ATP license and it is valid, but we don't need the WebFilter license, so it is expired but the alarm still exists, how can we remove the related alarm, note that it is not used in a policy or anywherethanks

Hi, I created a small program that helps firewall admins to create Wireshark comaptible pcap files on diskless Fortigate models. You can find the "fgsniffer" here on Github.It works for me on Windows and Linux, now I need some testers!Feedback is welcome.Cheers, Dirk

Hello, I tried to search forum, but I didnt get resolution for my problem. Looks like when I want to backup config from CLI it takes first IP from interfaces as source ip address which is not 0.0.0.0. Is there any option how to set correct source ip address for backup config command?There are options fot NTP, LDAP, DNS, PING, etc., but not for backup. Is there some possibility how to set correct IP/interface which should send backup config to TFTP/FTP? Thank you.Boris

Hey all, We have a FortiAuthenticator VM running and would now like to integrate our hardware tokens into it. We were told by our Fortinet sales guy that it would not be a problem to integrate non Fortigate hardware token generators. Unfortunately, I can't find anything about this on the internet. Can you tell me if it is possible to integrate non FortiToken hardware devices?Thank you.Kind regardsMarc

hi, we saw a lot ip connection errors, but firewall rule is "allow", and most of the traffics can pass through. Can anyone please advise why there are so many "ip connection error"? Thanks in advance!

Dear Fortinet Community,We are currently experiencing challenges with a WAF deployment project using FortiWeb version 7.4.3. Our goal is to migrate several web applications behind FortiWeb, but we have encountered a routing issue due to our network configuration.In our setup, we have two different FortiGate physical appliances, each configured for separate ISP connections. One FortiGate is connected to a physical port on FortiWeb with a distinct subnet, while the second FortiGate is connected to another physical port on FortiWeb. We have created two different virtual IPs (vIPs) on both FortiWeb ports where each ISP terminates, and we have linked these vIPs to a single virtual server.Currently, we have configured a default route pointing to one of the ISPs. However, the issue we are facing is that all responses are being routed through the ISP associated with the default route. We have attempted various solutions, including Policy-Based Routing (PBR) and static routes, but none have res

Hello everybody,I have a BIG problem and was start when I decide to upgrade my 200F ( Np6 Xlite cpu )at new release 7.2.8.My scenario is a FGT with multiple a IpSec VPN Dynamic and several SSL VPN Portal .In the initial version 7.2.3 we had no stability and connection problems. After the update we noticed disconnections after a few minutes and constant instability. We were forced to downgrade at the more stable 7.2.5. Even version 7.2.8 that read in the release notes that the problem had been solved was not a solver of the problem.We also have several test FWs that have an NP6 process and also on those we have noticed the same problem. ( 300E , 3000D ).And on these we also put the latest version 7.4.4. with the same result. Below I show you the typical configuration of a VPN connection: config vpn ipsec phase1-interfaceedit "VPN_XXX"set type dynamicset interface "VLAN_7"set mode aggressiveset peertype oneset net-device enableset mode-cfg enableset ipv4-dns-server1 10.12.

Hello everyone,I'm looking for guidance on configuring a network authentication scenario using FortiGate and FortiSwitch devices, along with a FreeRADIUS server. Here's my hardware setup:FortiGate 100F running firmware v7.2.8FortiSwitch 148F running firmware v7.4.2FortiAP 231G running firmware v7.4.0FreeRADIUS server (version 3.0) running in the internal LANAuthentication Requirements:I need to authenticate devices (both on WiFi and LAN) using certificates only, without relying on user credentials or MAC address filtering.Questions:Is it possible to implement certificate-based authentication in this setup for both LAN and WLAN?What would be the recommended approach to configure this scenario using FortiGate and FreeRADIUS?Any guidance, tips, or configuration examples would be greatly appreciated.Thank you in advance for your help!

Hi everyone. I'm new to the community and Fortinet in general. And it's exciting learning about all of the features of the fortigate. This is likely a very simple issue to many of you.I'm facing an predicament where some users are trying to access internal office resources abroad using SSL VPN, but seem to be facing a conflict because their home networks fall into the same subnet (192.168). Rather than re-addressing their entire home, or the office network, I've been following this guide which suggests virtual IP mapping might be an elegant solution: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-with-overlapping-subnets/ta-p/189886 However, when I test it myself, I can connect to the VPN tunnel, but none of the local IP addresses get mapped to the new address ranges that I specify. Admittedly, I get a bit confused by the terminology used in the UI, (such as "External IP address range") I'm not exactly sure which IP range I should put there.