Fortinet Community

Hi Team, I am unable to use FGT 7.6.6 in my EVE-NG it is asking me to update license but it is not taking that. can someone please help me on this. RegardsSantosh

Hello,I have a Site-to-Site IPsec VPN between a Fortinet FortiGate 80F and a MikroTik router.Phase1 and Phase2 parameters match on both sides. The tunnel shows status = up, but no traffic passes until I manually restart the tunnel on the FortiGate.After restart:Traffic works normallySA counters increaseBoth directions pass trafficAfter some time, traffic stops again while:Phase1 remains upDPD status is OKNo config changes are madeIn diagnose vpn tunnel list, sometimes I see:proxyid_num=0 / child_num=0orasymmetric counters (only enc or only dec increasing)Is it possible for Phase1 to stay up while Phase2 becomes unusable?Could this be related to NPU offloading or replay protection?FortiOS version: 7.4.11Any guidance would be appreciated.#FortiGate

FortiGate / FortiOS: Fortigate 81F / v7.6.2VPN: IPsec IKEv2 dial-up Client: FortiClient VPN-onlyAuth: Local users + EAP-MSCHAPv2 + FortiToken (2FA) Whats working so far : FortiClient connects successfullyFortiToken OTP is requested and validatedClient receives an IP from the IPsec poolTunnel is UP Issue : No access to LAN resources (can't ping my DCs from ipsec vpn but can from ssl vpn)All traffic is dropped by firewall with policy 0 Debug :  Flow debug shows:received packet from VPN_IPSEC_0 route found via LAN Denied by forward policy check (policy 0) Policies I tried so far : srcintf = VPN_IPSEC (not accepted)srcintf = VPN_IPSEC_0 (not a valid interface)srcintf = zone containing VPN_IPSECsrcintf = anyWith / without user groupsWith very permissive rules (ALL / ALL)Still always policy 0. Observations Interface VPN_IPSEC exists (169.254.x.x, type tunnel, UP)Traffic arrives as VPN_IPSEC_0, which cannot be referenced in policies

Hi, New to the forum and seeking assistance.  Since EOL has been set for the FortiGate 30E I am considering updating to the FortiGate 30G. The replacement product. The question is 'Can I download configuration for the FortiGate 30E and upload it to FortiGate 30G. Will uploading transfer the Policy and Object section? Any help appreciated.

Hi, I'm trying to install Forticlient VPN on my system (Fedora 43) but  I'm getting this error:package forticlient-7.4.3.1736-1.el7.x86_64 does not verify: no digestI've tried adding the forntinet repo and installing with yum, and using the .rpm file, but I always get the same result. Is there any solution to this problem? Thanks in advance.

Hi  Is there a way to implement session based authentication for users instead of IP Based Authentication ,as I have  The below scenario:1. FortiGate Firewall running version 7.4.3, is the Gateway & DHCP Server configured with a Captive Portal ,it authenticates users against LDAP .2. The wireless network has 1 SSID, with different Access point vendors, when users move-in between the different access points ,they obtain different  IP address`s ,they are prompted to re-authenticate on the portal.3. The previous gateway was a Meraki firewall ,it was able to authenticate users based on sessions, whereby you only logged in once on the portal and re-AUTH happened when the account duration had ended .It was not based on IP address`s hence users didn`t get the portal to re-authentication as they moved around. Edit 1 : Most of the users use tablets /laptops not joined to the domain Is there a way to do this ? Thanks 

I login to the fortigate web admin using my LDAP User and here my config. Everything is working fine, i able to log on to the Firewall. But when i upgrade the firmware on primary firewall then when secondary firewall take over then i can't login using LDAP users. If i remove set source-ip then both firewall able to login. Anyone know why?IP 10.202.151.1 is interface on Fortigate which connected to the LAN (Core Switch) FW01 (AD) # showconfig user ldapedit "AD"set server "10.203.248.31"set source-ip "10.202.151.1"set cnid "sAMAccountName"set dn "dc=mydomain,dc=id"set type regularset username "mydomain\\admin.forti"set password ENC xxxxxxxxxxxxxnextend

Hello, we would like to set up LAN authentication via Windows Radius. This would allow sales employees, for example, to log in anywhere and access the sales VLAN with their registered AD account. We have already set up a lot, but the failed VLAN always pops up on the Fortiswitch port. And on the Windows 11 PC, the login does not work in the Ethernet settings. Has anyone set this up before and can help? FortiGate #Radius 

Hi All,I am facing an issue in getting the NFR for my VM fortinet firewall. This NFR is used only by me for the LAB purposes.

Hello everyone, I would like to know, can the isolation interface port2 and isolation scope be in the same network, example : Isolation interface :192.168.10.2Gateway : 192.168.10.1Isolation scope : Gateway : 192.168.10.1lease pool : 192.168.10.3 - 192.168.10.100 I've seen the majority of articles use seperate subnets and some articles use them in the same subnet. Can anyone explain pls ? Thanks in advance.BR,

I have a requirement to use ZTNA (Zero Trust Network Access) on Android devices. The devices need to communicate with some printers on the corporate network. We have already set up the ZTNA Destinations, policies, and groups, but communication doesn't work on Android devices. However, when we test it on Windows, the communication functions properly. Could you let me know if ZTNA has any compatibility issues with the Android system?

Hi all, I have a Fortigate doing an IPSEC to an offsite server, and SNAT is required. Policies from dial-in IPSEC and LAN work OK (sending HTTPS traffic to the server over the IPSEC with SNAT translating the source to an IP pool) but when I try to provide external access to this via a VIP, traffic matches the policy and passes but connectivity fails.LAN to IPSEC policy (working)config firewall policyedit 52set name "LAN to IPSec SNAT"set srcintf "lan"set dstintf "IPSEC-P1"set action acceptset srcaddr "10.0.10.0/24" "192.168.1.0/24"set dstaddr "10.200.201.1/32"set schedule "always"set service "ALL"set logtraffic allset nat enableset ippool enableset poolname "IPSEC_SNAT"set comments "LAN to IPSec SNAT"nextendWAN to IPSEC policy (not working) config firewall policyedit 23set name "ipsec-tk-test"set uuid 46350196-0707-51f1-1c80-8146215ecbefset srcintf "wan1"set dstintf "IPSEC-P1"set action acceptset srcaddr "Australia"set dstaddr "IPSEC-VIP"set schedule "always"set service "ALL"

Hello to everybody, Two days ago, the following system events appeared:  I haven't activated this and I do not know how this could happen. My FortiGate does not support WiFi (or this is what I thought...). Please, what do I have to do to turn off the Wireless Controller? Thank you for your help. 

Hey everyone,In some FortiSwitch models, certain ports are indicated as FortiLink ports. My question is: if, for some reason, I want to connect port 1 to a FortiGate firewall, is that label just for indication purposes, or is there some configuration that needs to be done with console cable on the switch to make FortiLink work through port 1?Also, some models, like the FortiSwitch 424E-FIBER, don’t have any FortiLink port indication at all. Does that mean that every port on these models can be used as a FortiLink port?

Hello, My FortiMail VM 7.4.6 was working perfectly until a 403 Forbidden error appeared for the administration GUI.Some additional network interfaces and routings have been added but none of the administrator users have setup trusted hosts. The Webmail interface is hosted on the same network interface and it is still working.The only admin access is on CLI mode via the ESXI console.   Have you some ideas ?  Thanks

Hi, I have two single VM FortiGates in Azure.Each FortiGate is in a different region. They were both configured with the default three subnets within a vNetI have peering between the local vNets and each local FortiGates vNet So traffic between each regions vNets and the local FortiGate routes correctly.The FortiGates also have a IPsec P2P to on-premise FortiGates and traffic also routes correctly. What I'm trying to achieve is routing from either Azure FortiGates SSL-VPN to the other regions FortiGate and local vNets. I have the SSL-VPN configured with its own subnet and all the required policies to allow the traffic. I have setup peering between the two Azure FortiGates vNets and even set a UDR routing it to the remote FortiGates internal ip x.x.x.68 I've set these two options on the peering.Allow 'Region1_FTG' to access 'Region2_FTG"Allow 'Region1_FTG' to receive forwarded traffic from 'Region2_FTG'Allow 'Region2_FTG' to access 'Region1_FTG"Allow 'Regio

FortiGate appears offline in Forti Manager. Both Internet connections are online, but if I disconnect and reconnect the LAN cable between the FortiGate and Forti Switch, it shows as online in Forti Manager. However, after a few hours, it goes offline again.

Hello! I just got this firewall used.I am wondering if it is possible to get the WAN1 port to give internet to the internal LAN ports.Is this possible? I haven’t been able to get it after hours of trying. Thanks!

Hello, I had Virtual Fortigate in Azure VM02, Version was 7.2.5Then I did upgrade up to 7.4.0 and now see this message: And I can't disable. Even if I'm trying to click "Begin" I can't do any migration, but If I click "Later" Fortigate is working as normal.  Very annoying message, how I can disable it?

Hallo, last week I updated the Fortigate to the new firmware. We use Fortinet and 2FA with Tokens. After the update no VPN-Token worked anymore. Noone could start a VPN anymore. I had to create new Tokens for everyone. Then it came into my mind, what if the Tokens for the Admin-Logons would not work anymore either. Would we be screwed or is there a possibility to logon without 2FA?

We have recently been provided with the free version of FortiClient 7.4.4.  After installing the software and importing our VPN config, we noticed that the VPN list was still empty.   We have uninstalled 7.4.4, manually removed any FortiClient folders and registry entries left behind. After a restart and reinstalling the software, the same issue occurs, and it's the same if we manually create a VPN.   Registry locations show that the VPN config has been successfully imported, and when we export the config from 7.4.4, it shows the same VPNs.  Right-clicking on the software in the system tray also does not show any VPNs to connect to. Is this a bug? Screenshot after the config import or a new VPN is manually created.

I've installed forticlient VPN client and opened the app and got white blank screen FortiClient 7.4.0macOS Sonoma 14.5

Hello! I wanted to ask for people who are using fortinac for authentication with radius and mac traps alongside persistent agent. How long does it take for a user to go from isolation vlan to production?

For C9300-48T-E with NM-8X connected to the Fortinet 401FSFP-10G-SR-S is compatible on both the sides?Both firewall and switch side....

Hello, I have a Zabbix Monitoring Server, and various Fortinet Products. All I can find is a FortiGate template. I can't find templates for the below: FortAuthenticationFortiMailFortiManagerFortiAnlyzerFortiWeb Does anyone have the relative templates or have successfully monitored the devices using Zabbix?