Fortinet Community

upgraded my forticlient ems from 7.2.14 to 7.4.7 then 7.4.8 . upgrade was fine. have noticed some forticlient  infomation no longer appears on fortigate yet it was therein 7.2.14. e.g version and owner are blank on fortigate yet populated on ems. how do force sync this? this information was very helpful when analyzing ztna logs on fortigate. 

Hi all,does anyone know if the MTBF info is public available? Thanks in advance

Hi all TL;DRDoes anyone know if the Fortigate trial licence limitations on encryption/decryption (which for example prevent the use of HTTPS) also prevent the SSL connections from Fortigate to FortiAnalyzer for the purposes of sending logs (via oftpd)? I was trying to test sending logs from a Fortigate VM (firmware 6.4) to FortiAnalyzer VM (firmware 6.4) but I just get "No connection" and if you hover the cursor over that you get "Error occurred:{0}".  The goal is to test forwarding logs from the FortiAnalyzer to a third device but I can't get this far as the Fortigate won't send the logs to the FortiAnalyzer.  A reddit post (www.reddit.com/r/...er_trial_ssl_error_3/) suggested this is probably a trial licence limitation but it would be good to confirm it here if possible. If anyone has found something similar please let me know. Thanks  Testing steps:I've made sure to check the compatibility matrix and the FGT and FAZ are compatible.  The F

 Environment2x FortiGate-VM64-KVM, v8.0.0, build0167 (GA.F) License Status: Invalid (permanent-trial / unlicensed mode — not a normal 15-day FortiCloud eval) Lab topology: two sites connected via two independent ISP paths, each carrying one IPsec VTI tunnel (VTI-A over path 1, VTI-B over path 2), both VTI interfaces as members of a single SD-WAN zonegw-site-01 (192.168.1.2/24) — fw-site-01 (port4: 192.168.1.1/24) — [ISP1/ISP2] — fw-site-02 (port4: 192.168.2.1/24) — gw-site-02 (192.168.2.2/24)VTI-A: 172.16.1.1 (fw-site-01) ↔ 172.16.1.2 (fw-site-02) VTI-B: 172.16.2.1 (fw-site-01) ↔ 172.16.2.2 (fw-site-02)IKEv2, proposal des-sha512 (forced by the eval-mode low-encryption restriction), dhgrp 29, net-device enable. Both tunnels status=up with active SAs (diagnose vpn tunnel list), real traffic counters climbing.GoalSimple: execute ping 192.168.1.1 from fw-site-02, reaching fw-site-01's LAN-facing interface (port4) through the tunnel. Not even LAN-to-LAN — just firewall-to-firewall, locally-

I've just installed  FortiClient VPN  the .deb package from here https://www.fortinet.com/support/product-downloads .installed with `sudo dpkg -i ...` Setupd the configuration ( as I have on my windows pc and on my android ) when I try to connect I get the following in the journal:    iul 29 14:23:43 station1 kernel: iked[283119]: segfault at 28 ip 000000000045195d sp 00007ffe2a7e6900 error 4 in iked[400000+891000] iul 29 14:23:43 station1 kernel: Code: 4c 89 e5 48 89 44 24 38 48 8d 84 24 88 00 00 00 45 89 d4 45 89 de 48 89 44 24 50 48 8b 45 00 45 89 f5 31 ff 31 db 4a 8b 0c e8 <8b> 51 28 85 d2 74 42 48 8b 71 20 8d 7a ff 31 db 48 8d 46 08 4c 8d iul 29 14:23:43 station1 fctsched[283131]: /opt/forticlient/iked: invalid option -- 'P' iul 29 14:23:43 station1 regolith.desktop[281914]: 14:23:43.573 › VpnHandler UNHANDLED {"isTrusted":true} iul 29 14:23:43 station1 fctsched[283131]: DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus iul 29

Need FortiGate-side workaround: RDP disconnects when client FortiClient VPN connects on internal PCI have a FortiGate 40F running FortiOS 7.4.12.I need to RDP from outside the office to an internal Windows PC at 192.168.1.89. RDP works normally while the PC is not connected to a VPN.The issue is that the user must connect FortiClient VPN provided/configured by our client on the same Windows PC (192.168.1.89). As soon as the client FortiClient VPN connects, my existing RDP session disconnects.I have no control over the client's FortiClient configuration and cannot ask the client to change any settings on their side Basically, the IP is getting change after VPN is connected, what is the work around for this SSL VPN  Already verified192.168.1.89 is reachable from the FortiGate. TCP 3389 is listening on 192.168.1.89. RDP works correctly before the client FortiClient VPN is connected. Once the client FortiClient VPN connects on 192.168.1.89, the RDP session disconnects. I also tested FortiG

Can anybody help me get FortiClient version 6.2.6.0 for linux (debian), please? 

I'm developing a custom IPS signature for FortiOS 7.4 and want to understand the Lua scripting support in custom IPS rules. Specifically:(1) Can custom IPS rules written in Lua access the os and io modules?(2) Are there any sandboxing restrictions on what Lua code can do in a custom IPS rule handler?(3) Is the Lua state for IPS rules a shared state or per-session isolated state?

We keep losing the sync between the active and standby yesterday we get working just this morning its out of sync again  

I am having an issue with the FortiClient IPsec IKEv2 VPN connection on Android. I entered all the required information correctly and tried many configuration changes, but the issue still persists. When I attempt to connect, I receive a “Null” error message.At the same time, I tested the same VPN configuration on my iPhone, and the connection works perfectly without any issues.  Iphone Settings  Android Phase2 Settings    Andorid VPN Settings 

dear im going to deployed FortiAuthenticator as external captive portal , guest user will connect to Aruba WLC please guide me  to achieve this  

This isn't as dumb as it sounds at first glance, I promise! No, I'm not trying to print to a printer that is wirelessly connected to the same SSID, which would obviously be blocked by this setting.I'm trying to set up a wireless network for guests to be able to print to one of our printers, which is wired to a "printers" VLAN. I've set up a tunnel-mode SSID with the relevant multicast firewall policies for mDNS and WSD/SSDP, unicast policies for IPP and RAW, and a Bonjour profile for printers.So far, so good. iOS, Android, and Windows devices can all discover the printer and print. Until I enable the setting to block intra-SSID traffic, at which point none of them can see the printer anymore.Is that setting simply incompatible with multicast forwarding, or what might be going on here? I really want it enabled since I don't want guest devices to be able to communicate with each other. Would an L3 firewall profile potentially work instead?

Hello,  I run this VM New deployment of FortiAnalyzer for VMware FAZ_VM64-v7.6.4.F-build3579-FORTINET.out.ovf.zip (477.27 MB) on VMware but I'm getting this error not sure what might be the reason.Any help would be appreciated.     

Hello,I'm deploying a trusted CA certificate to a number of Fortigates devices that are in sync with FortiManager.This is not for full SSL inspection, but for trusting SSL connections to internal servers (the ones that go into Remote CA Certificates).Right now I'm using a script since I didn't find such functionality in 7.4.11. Dynamic Local Certificate seems to be only for full SSL inspection.bDid I miss anything or scripting is the way to go?Thanks

hi,  we have recently upgraded our foritmanager, this fortimanager is already present as our asset in forticloud. When we upgraded our fortimanager, we checked it was not registered. when we enter the credentials to register it, it said the serial number is already present which means communication does not have any issue, but it is not being registered, can someone please help me to check would could be the possible reason or what to check ? 

Has the problem with FortiClient VPN for Android been fixed?   v7.6.5 causes Error: Could not establish session on the IPsec daemon'. This was reported months ago and now we are being told we have to go to 7.6.7 to remain compliant. 

Hey everyone,We use FortiClient for VPN and web filtering, managed by EMS across a few hundred endpoints. On one workstation, the FortiClient Web Filter extension shows in Edge as "Managed by your organization" and can't be removed. No other endpoint has it — our own devices don't show it at all.Same FortiClient version, same EMS group and profile as the others, and there's no GPO pushing it.What causes FortiClient to force-install that extension on its own, and where would I look to find what triggered it on just that one machine?Thank you.

I’m trying to set up a full-tunnel SSL VPN on my Fortigate 60E running 7.4.6 and for what ever reason, when connected to Forticlient if I go to a website that shows your public IP (ie- www.whatismyipaddress.com), it is showing my laptop’s local internet connection’s public IP instead of the fortigate’s WAN IP. I have tried using the ‘full-tunnel’ portal, disabling the ‘tunnel-access’ portal, changing both to ‘full tunnel’ in the SSL VPN settings and disabling both and creating a new portal which is full tunnel, but whatever I do it keeps showing up with my laptop’s local internet connection. I did some packet traces and it *seems* to be egressing the Fortigate’s WAN interface but for whatever reason it keeps showing my laptop’s internet’s public IP. I can ping devices inside the network (behind the fortigate) just fine, so I know the VPN is working. It’s a real head-scratcher. Can anyone take a look at the config (attached to this post) and tell me what is going on? Of note, I did try

I was looking through the IPAM settings and saved a change accidentally.  I lost network access to my 60F as a result.  Windows Terminal isn’t working on my pc.  I’m looking for a software recommendation to access the 60F from the console port and any advice on how to turn off IPAM from the command line.  I’ve only used the GUI so far. Thank you in advance !!

I have 2 WAN links provided by 2 different ISPs with load balancing in HA, and as it happened one of them have been down for a couple of days and the other one is working but occasionally going down.As an emergency solution I plugged in a cellular 5G router to a free port and added the port to the SD-WAN zone.Would it affect the load balancing between the original links if I raised the cost of the cellular link and given it a lower priority? I don't want to keep the traffic going through it if either of the main links is working fine. 

Hi all, I tried installing forticlient VPN onto my new computer - Surface Laptop 7. However, it shows the following error. Anyone able to support to rectify this issue? 

Hi, I'm having a problem installing the VPN with Forticlient. The installation stops prematurely and displays this message. Have you experienced something similar?    

Hi all, have an HA pair of 120G devices running 7.2.13 that use SDWAN to load balance internet traffic between two different fiber circuits.  I recently added a cellular backup circuit, but because the cellular bandwidth is relatively low and it’s a metered connection I don’t want to add this to the same SDWAN group/rule as the 2 load-balanced fiber circuits (OutboundWAN_loadbalance).  I ended up creating a new SDWAN group (5G_Failover) and all/all rule for the cellular circuit and placed it in the lowest priority position - my objective being that if both fiber circuits go down, traffic will be routed through the cellular backup automatically.  Will this work the way I think it will?  Hoping to get some insight from someone who has set up something similar before I test this.  See screenshot for clarity.  

i Download VM Forti 8 and istall it but license invalid

Hi guys, I’m writing here after few weeks of working with Fortigate support. We went into dead end. I have full admin right on Google Workspace and Fortigate 30G running 7.6.7 build 3704, I’ve configured the LDAP as follows:FortiGate-30G (G_Workspace) # showconfig user ldap edit "G_Workspace" set server "ldap.google.com" set cnid "uid" set dn "ou=users,dc=spxxxxxxx,dc=pl" set secure ldaps set port 636 set client-cert-auth enable set client-cert "G_LDAP2" nextendTest Connectivity always works (this is misleading), Test User Credentials work fine - on any user which exist on my Workspace.Problem is when I want to press Browse button, I’m getting error “Invalid LDAP server” while from Workspace logs related to LDAP I can see:Event:Search failedDescription: LDAP search with (objectClass=*) failed with INSUFFICIENT_ACCESS_RIGHTS.Similar error I’m getting when I try to configure User Group based on G_Workspace profile - “Invalid LDAP ser