Fortinet Community

I upgarde fnac to v7.6.7 and found issue with teh MDM integration.When i try to poll then i the poll alsways loading, but test connection is working fine. Also every second there are event ‘destroyed’ like below pic. Anyone know why? 

When we use DHCP fingerprint for device profiling then we need to add ip helper on L3 interface. How if the L3 using fortigate, there is no ip helper command?

in the radius log i can see mac address 9C:57:AD:B5:E3:2A got vlan 37But on host detail the endpoint got vlan 38And the client is not geeting ip, anyone know why? 

What are these highlighted labels??? All testing passed???Seen after upgrading from 7.6.6 to 7.6.7 (Azure) 

Hello,I need to grant a specific USER/IP access to a specific path, which is as follows:https://dl.k8s.io/release/v1.36.1/bin/windows/amd64/kubectl.exeI usually use STATIC URL entries, where I typically set the FQDN to “SIMPLE” and “MONITOR” modes—meaning I just use dl.k8s.io—but in this case, I’m required to ensure that only the specified source has access to the URL I’ve provided.Is there anything specific I need to do to achieve this?What are the correct “Type” and “Action” to use in this scenario?Do I need to take the “SSL/SSH Inspection” configuration into account?Thanks for your feedback.

Hi, When trying to renew the server certificate (or create a new one) using the automated option.  I get this error: "EMS Invalid certificate and private key: argument 'data' Cannot convert "<class 'str'>" instance to a buffer. Did you mean to pass a bytestring instead?"  EMS 7.4.5 build2111 (Mature) Any ideas on what could be causing this? thanks

Hi everyone,I wanted to know if it's possible to manually edit these parameters on the unlicenced FortiClient (VPN Only) version for MacOS ?See the image below:  In particular, I need to be sure whether the <eap_method>2</eap_method> parameter (which corresponds to EAP-TTLS/PAP) can actually be configured.I'd like to know if anyone on MacOS has managed to apply these settings, or if I'm forced to purchase the FortiClient Standalone Edition (the client doesn't have the option to buy an EMS server).For additional context regarding my question: currently, we have an IPsec Remote Access VPN setup using IKEv2 + LDAP + MFA (via SMS).Thank you all in advance.

Hello,I have migrate company to the new FortiGate, but without FortiConverter (mine reasoning it that the config is really old, and has some really weird issues that I don't see on other devices). My main issue is that old FortiGate has connection to FortiExtender, and I'm wondering how to properly migrate that config snippet without loosing remote site MGMT/connection to it.What should be transfer to new device? Also is this even valid approach, should I expect any bugs or connection issues after migration?

We're using Fortigate 7.0.12 and most of our FortiAPs are at version 7.0.0. Our main models are 421E and 221E. Our building has two floors. With two AP, on each floor located at the front corners. We've set specific channels and power levels. Everything was fine until this week.Our Guest Wi-Fi (SSID) uses WPA2-Personal PSK.Lately, we've noticed a problem. Some clients, like Windows, Android, and IOS devices, are having trouble finishing the 4-way handshake randomly. Looking at the logs, it seems like the AP and client start talking, but when the AP sends the first message in the 4-way handshake, the client doesn't respond. The AP tries three more times, but the client stays quiet. In the end, the client's device shows an authentication error, and our Fortigate log says there's a client-deauthentication error.The weird part is, if we take the same device to another part of the building and connect to a different AP of the same model and firmware, it works fine.This situation has us scra

This week's updates deliver a focused set of changes across FortiSOAR™, centered on the FortiAI solution pack, Fortinet Fabric integration, and a small group of third-party connector updates.The FortiAI solution pack moves to v5.0.0 for FortiSOAR™ deployments earlier than v8.0.0. On the Fabric side, Fortinet FortiRecon EASM v1.2.2 brings continued refinement to external attack surface monitoring workflows.Updates across email security, network infrastructure, and secrets management, covering Abnormal Security, Cisco Meraki MX L7 Firewall, HashiCorp Vault, and SolarWinds. A new remedial solution pack, Outbreak Response - Joomla SP Page Builder RCE v1.0.0, extends the Outbreak Response framework to help teams counter this vulnerability. Together, these updates keep FortiSOAR™ deployments aligned with current threat activity while maintaining reliable integration coverage across the security stack.The following table summarizes the changes since the last announcement. # Type

Hello,I am trying to deploy the FortiFirewall-VM64-KVM v7.6.7 (build 3704) permanent evaluation on Proxmox VE (KVM).After the initial boot, the GUI always redirects to:/prompt/fortigate-setup?viewOnly=1&startup=1but the page remains completely white and the setup wizard never loads.The CLI shows:License Status: InvalidRunning:exec vm-licensereturns:This VM is using the evaluation license.Failed to download VM license.Output of:diagnose hardware sysinfo vm fullshows:valid: 0status: 3code: 0Things I have already tried: Deployed multiple fresh VMs. Factory reset. Tested with multiple browsers. Verified Internet connectivity and DNS. Successfully pinged update.fortiguard.net and support.fortinet.com. Followed the suggestions from this Community post:https://community.fortinet.com/support-forum-92/issue-installing-a-vm-fortigate-223043?postid=223128#post223128 The behavior remains exactly the same.I also found posts mentioning activation via TFTP using a .lic file, but since I

 What am i missing with the configuration:I get the dialup VPN to connect(i.e i am connecting from the PC at port 5 and using 10.10.0.1 as my gateway in forticlient, and i can see that it assigns the correct VPN according to my mode cfg, but when i inspect the vpn logs for the vpn_user_site, there is no traffic traversing the vpn. And even if i do a packet capture of the s2s tunnel interface, or port 5 interface, or both port 1 interfaces on the firewalls, i get no instance of 10.101.101.254 as the destination address. I am new to this and don’t understand the tunnel within a tunnel concept really that well, hence the lab setup i have.To my understanding the only thin i need is a policy that allows the traffic from the remote access vpn to the LO0 interface? I am missing something (since it is not currently working haha, so if anyone has insights or can explain to me how this would be setup correctly. It would be much appreciated.

A couple days ago, I helped one of my clients with installing the FortiClient v7.4.5 on his computer using the FortiClientSetup_7.4.5_x64.exe file. But after the setup process was completed, we noticed that the domain name was not correct; it was showing the domain name of his current company that he works for instead of the domain name of his contractor’s company. So I tried to uninstall the program from Windows Control Panel → Programs and Features → Select FortiClient, but it did not let me uninstall the program. I tried clicking the Repair button, too, but it also did not work.I tried browsing to https://support.fortinet.com -> Support -> Firmware Downloads -> Products, but I got the following message: Sorry, you don't have any product covered by Fortinet support contract.Please contact Fortinet partners to purchase Fortinet support contract or Fortinet customer service team at cs@fortinet.com.And I asked my client if he knew who to contact to download the FortiClientTools

Hello to Everyone,  I am playing with the trial VM and I am wondering except doing tcpdump packetsniffer what are the options to debug ssl hanshake issues like unsuppored ciphers ? I am interested for proxy mode rules and flow mode rules and if there is an option when you enable debug flow simillar to fortiweb  (Diagnosing SSL/TLS handshake failures | FortiWeb 7.6.0 | Fortinet Document Library) to see such information? Maybe also a "debug application" option as mentioned in Solved: debug SSL inspection for flow based vs proxy based... - Fortinet Community as for proxy mode "wad" process is used. I am wondering for the ips and wad what debug to enable to see the ssl handshake.  I enabled the options in Extended logging for SSL traffic - Fortinet Community and I see unsupported ciphers error for 7.2 that is the last trial VM version having flow and proxy mode and I see the issue with SSL failing for proxy mode. Maybe this is why it i

Hi everyone,I'm just starting my journey with Fortinet and studying for the NSE4, so I'm still learning how some concepts differ from Cisco.I have a quick question:Is there a way to configure a physical interface as an access port, similar to Cisco switches using switchport mode access and switchport access vlan <VLAN_ID>?For example, can a FortiGate interface be configured to carry only a single untagged VLAN without using a trunk or VLAN subinterfaces? Or is the recommended approach always to use 802.1Q VLAN interfaces on top of a physical interface?I'd really appreciate any explanation or best practices. Thanks in advance!

Hello,If we need to deploy a cluster of two FortiGate firewalls as VMs without using the virtual MAC (vMAC), and instead use the hypervisor-assigned MAC address of each firewall interface, I would like to confirm whether this type of cluster configuration is supported.In other words, is it possible to operate a FortiGate HA cluster without using the vMAC mechanism and have each firewall use its own physical/virtual interface MAC address during a failover event?Thank you for your clarification.

Hi,I would like to just ask around (not going to open an official case with fortinet just now) if any of you have noticed something similar recently.I have a very low but increasing number of users that start up their laptops in the morning and the Forticlient ZTNA has lost it's license resp. the affiliation to the EMS cloud. No config left, not connected.The respective laptops do not show up in EMS any longer. When I enter a new invitation code in the Forticlient incl. User verification, it connects again and receives config and all is good.I can rule out that the user hit the "disconnect" button on the ems connection because that is password protected.The only thing common, that I think I identified, is that all affected users don't connect to the vpn daily.

Product: FortiGate-101FFortiOS Version: 7.6.6, build 3652HA Mode: Active-Active (A-A), ha-direct enabledCluster Members:  Primary / SecondaryCluster Status: Healthy, in-sync, uptime 86+ daysSyslog traffic configured under config log syslogd setting is not reaching our syslog collector (10.0.0.151:514/UDP), despite the syslog daemon reporting successful log processing. No syslog packets are observed on any interface via packet sniffer, even though routing to the destination is confirmed correct and other traffic to the same host (ICMP, TCP/5986) is confirmed working.config log syslogd setting    set status enable    set server "10.0.0.151"    set mode udp    set port 514    set facility local7    set format default    set priority default    set interface-select-method auto    set vrf-select 0endconfig router static    edit 2        set dst 10.0.0.0 255.255.255.0        set gateway 10.37.81.2        set device "port4"    next    edit 3        set dst 10.0.0.151 255.255.255.255        se

I have 2 FortiGate 100F firewall setup in HA A-P and dedicated HA-MGMT interface is configured with dedicated OoB interface, I have a internal webproxy server in Layer 2 VLAN with DNS and FGT is also in the same VLAN and is pinging Proxy and I want to setup those firewall to use that proxy server to connect to fortiguard, I am trying to setup but it is not working through OoB interface. Appreciate support here.

Is anyone able to provide me with the firmware for a Fortinet 60F firewall?

I couldn’t find much information on enabling the all events portion of FortiClient EMS (I’m running 7.4.7). After a couple of weeks playing with it I finally got it working.  But just a quick overview I wanted to post in case others have tried and failed at setting this up. So what you need to do is setup a Linux VM (I used Debian 13 Trixie) and install ElasticSearch. Then you have to make sure its reachable on the network by modifying the YML file.  Then install Kibana and do the same for it. Kibana is the GUI management tool that makes working with ElasticSearch easier. Then you create an API Key for FortiEMS. Then you upload the http_ca.crt to FortiEMS. Then you run the emscli command for enabling ElasticSearch. That is pretty much the overall process. 

Hello,I currently have SSL VPN active and I want to switch to IPsec VPN (IKEv2 Remote Access).Environment:FortiGate model: FG-101FFortiOS version: 7.4.11VPN type: IKEv2 IPsec Remote AccessAuthentication: FortiAuthenticator 6.5.6 build 1391 (GA) with OTPDirectory: LDAP users and groups from Active DirectoryClient: FortiClient 7.4.3 Hotfix 1 (7.4.3.8758)I am configuring an IKEv2 IPsec remote access VPN that authenticates users via FortiAuthenticator using LDAP credentials and OTP.The VPN connection is not successfully established from FortiClient.Phase 1 (SA_INIT) completes successfully, but the connection fails during user authentication (EAP phase).FortiClient shows the following error:Wrong EAP credentialsHas anyone encountered this issue when using IKEv2 with EAP authentication and FortiAuthenticator OTP?Any suggestions or troubleshooting steps would be appreciated.Thank you.

I am setting up 802.1x with clearpass and most of my switch are running 7.6.1 or lower and are working fine. I upgraded 2 switches this morning to 7.6.6 and now they absolutely refuse to work if I have the 802.1x security policy on the ports. Worked fine on 7.6.1. Not even DHCP is getting passed to the native vlan.I've spend the majority of my day trying to find a way to work around this today and am at the end of my chain.I can't even roll back to 7.6.1 because I don't have switch support to download.I ran a sniffer on the fortigate and the switch doesn't send a single RADIUS packet when a port comes up.Anyone have any suggestions?

now i have situation i want to register ip phones in my company manually and if there is no registered ip phone  as rogue i mean so i need to block its traffic but doesn’t block data traffic behind it how to achieve this using fortinac?

Dear Experts,I’m working with FortiWeb, which deployed 6-8 months ago and security policy in monitor mode. Now, customer decided to change security policy to Blocking Mode from Monitor mode.I have checked for Fortinet official document, but didn’t see any recommendation or workaround for such transition from Monitor mode to Blocking mode. Appreciate, if experts can advise on this.  Regards, Faridul