Fortinet Community

Hello all, in the context of migration from SSL-VPN I am facing the following problem.Many of our client deployments include a mix of SAML users (dial up for company users) and locally defined users (contractors for instance)In SSL-VPN it was as simple as enabling or disabling the SSO checkbox in Forticlient. If SSO was enabled, the connection flow would go through SAML authentication, and if disabled it would connect directly using local users.I tried this with IPSEC dial up configuration, and unchecking SSO in Forticlient has no effect, it will always ask for SAML authentication.Anyone tried this and got success? Any workaround?

hi, this is not quite a Fortinet problem since we have lots of users without problems but we get more and more problems with some PCs with Win11 and 25H2. Versions of 23H2 we dont even bother anymore.  So now we have another laptop which cant connect via SSL o IPSec with Forticlient. The same laptop as all remote users and we have it in out office to check out and besides of checking all we could find in community sides, there is no way that the SSL Network adapter becomes active. The user connects with his user credentials, he even puts his token and than it get stuck by 98%. On the firewall I see SSL VPN User error but since we are doing the testing we know 100% that user credentials and token is correct. With the IPsec is the same and I have the same problem on my new laptop with the Forticlient ARM version. Not a chance that IPsec starts rolling. Any new ideas or similar cases that got solved by a miracle? Thank you so much!!!  

’m planning to transfer a device to another FortiCloud account and would like to clarify the impact.What happens to the device licenses (FortiCare / FortiGuard) after the transfer?Do they move with the device, or stay with the original FortiCloud account?What happens to the device configuration?Will the existing configuration remain intact after the transfer, or is a reset required?Any guidance or best practices would be greatly appreciated.Thank you!

Does fortiget provide security updates for non licensed units? I have an 80F that is running 7.6.5, how long am i covered until receiving minor patches for CVE's?

Hello, I doubt there is an answer but I have a virtual server that load balance connections on 2 real servers. On the interface Firewall Objects > Monitor > Load Balance Monitor I can see that I have X sessions for RealServer1 and Y sessions for RealServer2. I would like to retrieve the number of " Active Sessions" by snmp. Did someone have any success doing that ? Thanks

Hello, I am looking for a way, using SNMP, to monitor the mode and status of a real server behind a virtual server.  So for example if someone has left a server disabled, it would show up on our monitoring software (PRTG) Thanks,

HiI have a 600E running FortiOS 7.4.3 in transparent mode.There are 10 VLAN subinterfaces on the server-farm side and one VLAN subinterface on the outside for the servers’ gateway.All interfaces are in the same forwarding domain.Client requests coming from the client side work fine.However, servers located in different VLANs (but in the same forwarding domain) cannot ping each other and also cannot ping the gateway.I have a policy that permits any interface to any interface, all sources to all destinations, and all services.When I replace the 600E with a 70G or 100F, everything works correctly.Does anyone have any idea what could be causing this?

Hello everyone, I would like to know if it's possible to use Fortigate as a DNS server for the Isolation network in the config wizard of FNAC?  Thanks in advance.BR,

Does anyone have information about FortiGate in versions 7.4 or 7.6 regarding enhanced support for 32-bit BGP community values?For example, support for values like 222222:1 or xxxxxx:xxxxx.Or is there any roadmap or future support planned for these scenarios?

Hello everyone,I have a FortiSwitch where all VLANs are configured and working correctly.However, the customer has requested a contingency scenario:If the FortiSwitch goes down, they want to be able to connect another switch directly to the FortiGate, using a trunk port with the same VLANs.The question is: How should the FortiGate port be configured so it can operate as a trunk interface carrying the same VLANs currently defined on the FortiSwitch?

IRCTC Website Not Accessible Over FortiSASE VPN – Akamai WAF Blocking Hosting ASNIssueUsers connected to FortiSASE (VPN mode) are unable to access the IRCTC website. The browser displays:“An error occurred while processing your request”Reference #xxx (errors.edgesuite.net) The website loads successfully when FortiSASE is disconnected.EnvironmentFortiSASE in VPN modeFull SSL inspection enabled (exception configured for IRCTC)Egress node: BangalorePublic ASN classification: HostingDestination: IRCTC CauseIRCTC is protected by Akamai WAF.Akamai applies strict security controls and commonly blocks traffic originating from Hosting/Datacenter ASN IP ranges, including shared SASE/VPN egress IP pools.Even with SSL inspection exemptions in place, traffic exiting through a Hosting ASN may be denied at the CDN/WAF layer.This is an IP reputation classification issue, not a FortiSASE misconfiguration. ResolutionConfigure a Steering Bypass policy in FortiSASE to route IRCTC traffic ou

 I am trying a lot to add fortigate kvm in fortimanager but it shows "Probe Failed". When i tried to connect fortimanager from my fortigate firewall it shows the following error. I want to deploy the proper lab for my certification but couldn't get success. Quick support is required to resolve the issue. I have also observer that firewall serial number is missing in subject field of certificate. How to resolve?

Hi Community,I am currently using a FortiGate running FortiOS v7.2.12. My FortiGate is configured as the Gateway (L3 mode) for my network segments.Coming from a Palo Alto background, I am used to having visibility into Layer 2 traffic. I would like to achieve similar visibility on the FortiGate for Intra-VLAN traffic (devices communicating within the same subnet).My goals are:Visibility: To see/log traffic between hosts in the same VLAN.Control: Ideally, I want to be able to block this L2 traffic if necessary.Since the FortiGate is the gateway and traffic usually switches locally on the access switch without hitting the firewall:Is there a specific configuration required on the FortiGate side (e.g., specific interface settings, policies) to intercept and log/block this L2 traffic?Would enabling Deep Packet Inspection (DPI) help in this scenario to gain visibility, or is this purely a routing/switching issue?Do I need to implement Private VLANs (PVLAN) on the switch side and enable prox

Hi all, Can someone please explain to me this option in Firmware Templates... From the guide: Applies only to FortiGates.Select to upgrade the inactive partition. Clear to skip the inactive partition during upgrade.Selecting this option causes the device to reboot twice during the upgrade process: first to upgrade the inactive partition, and second to boot back into the active partition. So does this mean that if I had a device running 7.6.5 (active partition) and 7.6.4 (non active partition) and I pushed 7.6.6 and specified this option it would:Reboot and overwrite 7.6.4 in the non-active partition, then reboot back into 7.6.5?I am confused by this as I have recently done an upgrade by FortiManager without this option set which appears to have installed into the non active partition and booted into this (Which was the alternate partition?)...

Hey, Question, I hope someone can assist with a proxy avoidance issue I am having. The proxy avoidance count in my firewall consistently has a high count in the thousands. I have tried remediating it with no avail

I have firewalls FortiGate 1500D, 600E and 120G with the Firmware 7.2.11 and some 50G with 7.0.18. I wanna update to the version 7.4.11Does any one have Issues, upgrading those models in that versions? Especially incompatibilities with FortiSwitch or FortiAP

i have macbook pro running MacOs  Tahoe version 26.2 and install FortinetClient VPN 7.4.3.6667, and when try connect i got message "Unable to connect to VPN because tunnel configuration is unsupported." my company use DH Group 21, if i change to lower group the message does not appers, but off course not connect, are a fix to this issue?

Dear forum, I am struggling  with a migration project from VMware ESXi to Nutanix Prism KVM. I am migrating 2 FortiADC (as a  active/passive) HA cluster, we only have set up virtual servers in  Server Load Balance for some services. Last weekend I have setup the new virtual machines on the Nutanix and restored the old settings from the backup. The machine started up nicely and began to work. I started the second node for HA and this also seemed to work fine. After a short while the License Dashboard went green and I was really happy how smooth the migration went along. Then I checked a few virtual servers and they were working. This was Saturday evening... But on Monday some problems appeared: First one of the health checks did no longer work  - the HC is  a Check Script, it does a curl to  http://$NODE_IP:8080/api/system/check and this did no longer gave us the OK - but the website was working (checked with my browser).

Hello,I have an environment running MSTP on my FortiSwitches. We are adding a new building to this environment, so we want to unify STP across all switches by running RSTP.My FortiSwitches are currently running MSTP and are managed by a FortiGate. I noticed that the FortiSwitches use two instances within MSTP (0 and 15). We use FortiLink between the Fortinet infrastructure.I couldn’t find any guide describing the migration process from MSTP to RSTP.My FortiSwitch models are 124F and 148F, running version 7.4.5.

Hello guys,not sure if someone else has the same issue, but there are times when I'm trying to set up a remote connection tunnel via IPsec and this issue comes up... I'm trying to connect through Forticlient VPN but internet connection stops, the tunnel is (of course) down and the internet access is restored.

Hey All,After the last round of insane pricing from Palo, we've decided to slowly start moving over to Fortigate's for our firewalls. Any good series/tutorials we should know about? We've got a crew of good network engineers but no real experience with forti specifically, just trying to find the gotchas or anything we should watch out for. We're running a self hosted Fortimanager, and have a bunch of 71G's to play with.Thanks!

Where i can get for MacOS Tahoe (Apple, not intel)FortiClient Endpoint Management Server (EMS) I try this, but download a bin file that not open im MacOshttps://www.fortinet.com/br/support/product-downloads?tab=trials#ems

Hi all,I used to install all available host OS (Ubuntu 22.04) patches for my FortiClientEMS server(s). Especially as they have to be reachable via Internet. Last updates seem to have changed the login shell to emscli. How do I keep the OS patched?best regards

Hello everyone, I have three questions: - Switch throughput sizing : If a switch has a maximum achieved throughput of, for example, 4 Gbps, what is the best approach for sizing the firewall? How should this value be interpreted and used correctly during design? 2- Firewall replacement / sizing : When replacing an existing firewall due to new requirements (e.g. higher data volume), how should the current throughput be evaluated? From the HA / system throughput statistics, or By adding the traffic across all interfaces? 3- Throughput comparison with datasheets When comparing real traffic with the throughput values provided in datasheet, which metric should be used as a reference (e.g. firewall throughput, NGFW throughput, IMIX, with or without security services)? Thanks in advance for your help.

Greetings, we're trying to establish a subnet for testing and training purposes, including a dedicated firewall.Also, this is the first time setting this up. Please keep in mind, I might not understand everything right away. The issue:the fgt does not provide ip addresses on port1a test device is directly connected and can be seen via lldpthe config:wan1facing towards our regular networkconnected, reachable via ping/ https/ ssh/ fabricstatic route - 0.0.0.0 / 0.0.0.0gw ip 10.10.10.1port110.7.0.1/16facing towards subnetconnected, reachable via ping (responds)administrative access: ping/ https/ ssh/ fabrictried with dhcp enabled and disabled - same results: no ips givenrange 10.7.0.2 - 10.7.255.254also...the device is on firmware version 7.4.11, registereda firewall policy for those two interfaces has bee created, allowing trafficdefault settings, everything's allowed. I'm missing something, probably.Hope, you can help me out with this one. Kind regards!