Fortinet Community

 Hi all,I’m looking for best practice advice.Topology:20 hubs2 branchesEach hub has:2x MPLS links (already in SD-WAN)1x FortiExtender (Internet link)My idea is to use Overlay Orchestration only over the Internet (FEX) link, since it will be used for Internet access and backup.Would it be better to:Use Overlay only on the Internet link and keep MPLS as regular SD-WAN transportorInclude MPLS + Internet in the Overlay?What would be the recommended design at this scale?Thanks.

Good Morning Community,I'm comparing solutions that can work as a mail server for an organization (previously had exchange server)so I would like to ask does anyone has a use-case of running FortiMail in server mode, and feed me back on his experience concerning the below points:Effectiveness of server mode, and does it provide a real dependable mail server solution for organization levelCons of the this solution, especially concerning user experience and administrator experienceApps (like outlook or others) that can be used on desktop and mobile devices to access this mail server, and support calendar and address book synchronization, and the user experience concerning those featuresAdministrator experience with LDAP authentication (if applicable)I would be glad to find a successful use-case using this solutionFortiMail

For these past two firmware releases, it looks like emails won't be sent out for 2FA and for Automation Stitching? I've tried our postfix relay and fortinet's email server and neither work. Sending a test email via diagnose log alertmail test shows nothing incoming on our postfix relay and no relevant logs. I know the release notes list 2FA emails not working for both versions but is it affecting all emails in general?Is there anyway to remediate this, or will I just need to wait for 7.6.7?

Voicemail audio is very low. When playing voicemail you have to turn volume control all the way up to hear audio

Does anyone here know what causes this error and how to fix it.I check the certificate for SSL VPN, and it still shows as valid. So, I'm sure where the error is from.Also note a few weeks ago I upgraded from 7.2.11 to 7.4.11

I can successfully connect to forticlient using all three but when i use the hotspot and wifi dongle the forticlient connects but there is no packet receive, which means I can not access my resources. I tried upgrading my forticlient, disabled ipv6 on dongle adaptor still doesn't work. the hotspot is for every one of the staffs, but the dongle is different from each pc. varying win 10 and 11. It's not specific to windows. There are critical remote users who are having trouble. How can I fix it.FortiClient 

Hi all, We are building an automated pipeline to continuously collect SSL-VPN and IPSec debug logs from our FortiGate 90G devices, using:diagnose debug application sslvpn -1diagnose debug application fnbamd 8diagnose debug enable We specifically need the raw debug output (e.g. "SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384") which is not present in structured logs and therefore not available via FortiAnalyzer or syslog. We have already gone through the following KB articles:• Continuous debug monitoring with Bash and Crontab:https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Continuous-debug-monitoring-with-Bash-and-Crontab/ta-p/305973 • FortiGate remote monitoring and logging CLI command output into a file:https://community.fortinet.com/t5/FortiGate/Configuration-Example-FortiGate-remote-monitoring-and-logging/ta-p/189892 Based on our research, it appears that the debug subsystem and the structured logging pipeline are architecturally separate, th

Can two FortiGate clusters (each configured in Active-Passive HA with 2 units) be interconnected through a Core switch?

I have a number of domain joined PCs that are either deleted or disabled that are still showing up in EMS.  I have one in particular that keeps trying to push out a FortiClient upgrade but fails because it can't contact the computer.  Shouldn't EMS automatically be updating against AD and removing computers that are either disabled or no longer exist?  

I've got a strange issue with upstream HSRP Routers from the ISP. I've got a single /29 virtual IP configured on my Fortigate with HA set up.When I have Fortigate A connected to ISP router A, and Fortigate B connected to ISP router B the Internet dies.If I connect both Fortigate to ISP Router A everything works as normal including HA failover. The same is true for ISP Router B. Only when the Fortugates are connected to seaparte Routers does the Internet die.The ISP says they configured e0/1 and e0/2 on both Routers to be in the same L2 VLAN so in my mind this should work correctly.If I add a dumb switch into the mix with both fortigate then the Internet works fine.To me, the logical conclusion is that the ISP hasn't correctly configured their L2 VLAN but am I overlooking something in my config? The monitored interfaces don't trigger a failover so I know at least one thing is wrong somewhere.

FortiGate - 7.6.3FortiClient - 7.2.9 (Windows and Mac) I have been working with Support for weeks now with no success so hoping I can get help here.Fortigate config:config vpn ipsec phase1-interfaceedit "OpsIPSecVPN"set type dynamicset interface "port1"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset proposal des-sha512 aes256-sha512set comments "VPN: OpsIPSecVPN -- Created by VPN wizard"set dhgrp 14set wizard-type dialup-forticlientset nattraversal disableset network-overlay enableset network-id 0set transport tcpset fortinet-esp enableset assign-ip-from nameset dns-mode autoset ipv4-split-include "OpsIPSecVPN_split"set ipv4-name "VPN_PCI_Operations_us2"set save-password enableset client-auto-negotiate enableset client-keep-alive enableset psksecret ENC *** FortiClient config:<connection><name>us2-LOACAL2</name><type>manual</type><ike_settings><keep_fqdn_resolution_consistency>0</keep_fqdn_resolution_c

Intruder Movement   Cyber intruders gain access to cloud environments in a variety of ways, ranging from the exploitation of vulnerable software to the use of leaked or harvested access keys. In many cases, these intruders do not stay put; they move through the environment to expand their opportunities for exploitation and persistence. Evidence of this movement is essential for differentiating benign versus malicious behavior and for successfully remediating genuine intrusions.   Composite Alerts   FortiCNAPP presents suspected intrusions in the form of Composite Alerts. The aim with Composite Alerts is to assemble a complete narrative of suspicious activity, so that it may be triaged without your security team having to look elsewhere for more context. We have designed Composite Alerts to track within a single alert all entities and activity that may be associated with one another. Examples of what we look for include entities associated by suspected lateral movement, p

Je viens de créer un tunnel VPN IPsec grâce à l'option VPN Wizard qui a automatiquement créé les politiques et les objets. Quand je lance mon FortiClient, je n'arrive pas à me connecter : un message d'erreur apparaît. J'ai récupéré les logs mais je ne trouve toujours pas ce qui bloque. C'est un Fortinet 101F avec la version v7.6.6 build3652voici quelque partie des logs ike 0:VPN:64: out B264FC333EFD2592341205A9F51C32110110020000000000000000C80D00003C000000010000000100000030010100010000002801010000800B0001000C00040001518080010007800E008080030001800200048004000E0D0000144A131C8107035845 5C5728F20E95452F0D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF000000148299031757A36082C6A621DE00000000 ike V=root:0:VPN:64 : envoi d'un message IKE (ident_r1send) : , longueur=200, vrf=0, id=b264fc333efd2592/341205a9f51c3211 ike : réduction de la mémoire de 159 744 octets ike V=root:0 : réception de, ifin

I'm trying to set up a dial-up IKEv2 IPsec VPN using the Windows Native VPN client for a "user-based" certificate authentication setup. Specifically, there is no RADIUS or third-party client involved in this setup. The authentication should be handled locally on the FortiGate using the certificate handshake between the client and the firewall. Are there any official or community-validated docs that show this specific configuration? I am specifically interested in the requirements for: The FortiGate Server Certificate: Are there specific SAN or EKU requirements for Windows Native to trust the gateway?The User Certificate: What is the correct way to present these to the FortiGate when using the Windows Native client?Local Authentication: How to properly map the user certificate to a PKI User or User Peer on the FortiGate side to avoid needing an external authentication server.Any CLI snippets or pointers to specific technical tips for the "Mutual Trust" between these two d

Hi,Anyone have any news around arm64 windows collector support?Best Regards,/R.FortiEDR 

Azure Virtual FortiGate dropped SR-IOV Accelerated Networking interfaces Port1, Port2, Port3, Port4.More than 50 IPsec tunnels down & came up after restart.  System Events logs device port1 loses a SR-IOV slave device sriovslv2.Hyper-V SR-IOV VF secondary is hot unpluggedI raised a ticket with Microsoft & Fortinet for RCA.  Can someone helps me to understand root cause & prevent this issue for future.

In my test environment, I migrated from FortiEMS client 7.2.2 to 7.4.4.We deployed EMS on a Hyper-V VM.I didn't encounter any issues during the migration.I want to start the console now, but I'm getting the error below.I think it has something to do with the certificate, among other things.How can I remove it and/or configure/import a new certificate?

Configuration detailsMode :Transparent Mode Interface setting: Port x1 (internal), Port x2 (External). All traffic from the inside network passes through port x1 to port x2 to reach the internet. I upgraded the FortiOS version on a FortiGate 401F from 7.4.9 to 7.4.11. After the upgrade, users were unable to access services properly. Specifically: -Internal users were unable to access the Internet.-External users were unable to access the web server located behind the FortiGate. From initial traffic log analysis, I observed that packets were being sent out to the external network, but no return packets were received. Due to limited maintenance time and business impact, I rolled back the FortiOS version to 7.4.9. After the rollback, all services returned to normal operation. Has anyone experienced this issue with FortiOS 7.4.11? Currently, I have opened a ticket with Fortinet Support, but there has been no update yet. Thank you.

Hello everyone, In a Fortinet FortiAnalyzer VM environment, we are frequently seeing the alert:[Your daily logs GB/day limit is exceeded within the last 7 days]I would like to hear from the community about real-world impacts when the daily log ingestion limit is exceeded.Have you experienced log loss, delayed indexing, or incomplete reports?Any noticeable performance impact or issues with analytics and event correlation?  Note: I am fully aware that the daily gigabyte allowance is quite low and I am willing to upgrade the license, I just wanted to know what I might be compromising on my analyzer. 

Hello, I am looking for a solution how to use firewall objects from one ADOM in another one.Is there a possibility to share objects?Or is it possible to export the objects database and import it in the other ADOM? regardsRainer

I love how easy it is to create «advanced» address objects like fqdn, GeoIP and even wildcard fqdn (actually usually works). And I’m a heavy user of either fqdn or GeoIp as source address on all inbound policies.However I wish there was an easy way of creating ASN ad a address object.There is a possibility to create ASN textfiles and host yourself with python script, using them with a fabric connector.But I wish there was an easier way.Do you know of a easy way of getting ASN as a address object? What other address objects do you miss as a daily runner of a FortiOs device?

I'm spinning up a new pair of FortiGate 901G's to replace some Cisco FTD's (yuck!). I'm very used to and appreciative of Palo's way of doing security policy, centralized NAT, and a separate decryption policy. I like being able to make security policy directly based on app or URL category, rather than making profiles for everything. I don't see how profile mode is as flexible as policy mode. If I want to make a policy for a single app to be let through, I can't do that with profile mode, as an app control profile allows and denies all apps. For example, say I want to allow the "Quickbooks" app. I can't make a policy that has an app control profile of just allowing Quickbooks.. The app control policy would either end up blocking or allowing all apps. This is where i see the biggest downside to profile mode.I've spoken to a few people I respect in the Fortinet world, and they recommended staying with Profile mode for varying reasons...- I heard there is less support for Policy-based mode-

Hello all, I have configured Remote IPsec VPN to access internal network, am using FortiClient.For User authentication I am using Radius server which is configured at Windows Server (NPS).Also users are authenticating & getting IP address from Radius Server. (without 2FA Email based) When I use 2FA with email based - What problem I am facing while accessing the VPN--------->---> Getting token twiceRefer to the config:-config user localedit testtype Radiusset two-factor emailset email-to abc@gmail.comAt that time I am getting email token twice. FYI - I am using IKE version 2 ... ( For Fortigate IPsec tunnel)config vpn ipsec phase1-interfaceset type dynamicset interface "port1"set ip-version 4set ike-version 2set authmethod pskset mode-cfg enableset eap enableset eap-identity send-requestset authusrgrp (Test Group)set assign-ip enableset assign-ip-from group ( test)  Anyone has any Idea why I am getting token twice over email. I have put effort a lot bu

I have a few branch offices running FG100s, and I set up DHCP on them since they are small. I point DNS back at the AD servers at the main office. Everything seems to be working, but there are not PTR records in the reverse lookup.Some googling has led me to try a few things that didn't work. So I turn here for guidance. Am I missing something?

Hi all,  What would be the best way to migrate fortiswitch/AP management to Fortilink from FortiEdge/FortiLAN? I was thinking of resetting the configurations on the switch and turning on the security fabric connection on the uplink interface -- when I set up the switches, I changed the LLDP settings and turned off fortilink discovery off.   Thank you! C