Fortinet Community

Hello,I am looking for FortiClient VPN version 7.0.8.0427.Can someone please help me with the information about where I can get the software.Thanks in advance  

Hi community, I am trying to figure out what is causing these weird symbols showing here. Any way to fix this?

 We are currently experiencing an “Invalid LDAP Server” error while trying to browse LDAP users on our FortiGate.Fortinet Support has confirmed that this is a known bug and the case has been escalated to the Development Team. However, there is no confirmed timeline or ETA for the fix, and no hotfix is currently available. Before waiting for the official fix, I would like to check:Has anyone else faced this issue?Were you able to find any temporary workaround?Did upgrading/downgrading firmware resolve it?Any CLI workaround or configuration adjustment that helped? Environment details:FortiGate model: 601FFirmware version: 7.4.9LDAP type: Active DirectoryError occurs while browsing users from GUIAny suggestions or shared experience would be greatly appreciated.Thanks in advance.

We have a FortiGate FGT60E 7.4.11 build2878 controlling three FortiAP’s FP221E 7.2-build 0337. Two of the three AP’s appear to be working fine. One of the AP’s seems to always have 0 Clients. This AP's Last Failure Reason is: 80211 WLAN ADD error. This AP also has other errors including:oper-txpowerconfig-txpowerPhysical AP joinPhysical AP radio operation countryI ran the following but the name is blank and no country is listed:get wireless-controller globalname :location :acd-process-count : 0wpad-process-count : 0image-download : enablerolling-wtp-upgrade : disablerolling-wtp-upgrade-threshold: -80max-retransmit : 3control-message-offload: ebp-frame aeroscout-tag ap-list sta-list sta-cap-list stats aeroscout-mu sta-health spectral-analysisdata-ethernet-II : enablelink-aggregation : disablemesh-eth-type : 8755fiapp-eth-type : 5252discovery-mc-addr : 224.0.1.140max-clients : 0rogue-scan-mac-adjacency: 7ipsec-base-ip : 169.254.0.1wtp-share : disabletunnel-mode : compatiblenac-interval :

I'm working on merging Root from my 100F firewall into a third VDOM on my 3400E firewall. That new VDOM will maintain its own peering connection that it had on the 100F. When I log into the 3400 Global, I see that the "System WAN" is X.X.X.X/31. I don't want the new VDOM routing through that due to necessary network segmentation because of contract requirements and such, so I would like some guidance on how to proceed with the configurations. 

Two to three months ago, we migrated to the EMS FortiClient VMware appliance 7.4.4.We are a Windows store, so Linux knowledge is minimal.Now we want to upgrade to EMS 7.4.5 because of some bug fixes and the database backup feature.Is the recommended upgrade method to download a new VM image and perform the necessary actions as described in the article below?https://community.fortinet.com/t5/FortiClient/Technical-Tip-Recommended-method-for-upgrading-to-FortiClient/ta-p/423615Do I have to ignore the upgrade option/alert below via the GUI?Automatically upgrading EMS to latest patch release | FortiClient 7.4.5 | Fortinet Document LibraryThanks

Hi everyone,I’m trying to configure FortiAnalyzer so that I receive instant email alerts whenever any Intrusion Prevention (IPS) log is generated from my FortiGate devices. Kindly advice how to configure   

Hi everyone,while creating a profile for a FEX device, i'm unable to add a new meber of type VAP in the Switch Interface. the VAP list is empty, even if the SSID i've created isn't in bridge mode. Accessing the web interface of the FEX it allows me to add a VAP port with the SSID, but i need a massive/remote deploy without accessing every single FEX.Someone know ho to solve this? 

Hello everyone,  I was creating MCLAG peer group with 2x FGT120G (which are in active passive HA) and 2x FSW424E. I was doing this for two different clusters. In first one everything seems to be in order but on the other one port is missing when I check the topology in Switch Controller menu on FGT. The config is identical for both. I have fortilink interface with x1 and x2 as members. FGT1 - x1 -> port25 on SW1 and x2 -> port25 on SW2FGT2 - x1 -> port26 on SW2 and x2 -> port26 on SW1As I was creating the stack i only connected ports from FGT1 which was active to switches (first SW1 then SW2), after authorization I followed the guide and made the mclag peer group between the switches with ports23 and 24. After this was established I connected ports from the passive member (x1 to port26 on SW2 and x2 to port26 on SW1) but it did not appear in the topology? Is there way I can force some sort of LACP renegotiation or something? Restart of the switches did n

Is there a way to restrict LDAP authentication to FreeIPA based on ldap user group membership? Currently configured, as suggested in forum, with set cnid uidset dn "cn=accounts,dc=<suffix>,dc=<suffix> However this setup allows ANY ldap user to be successfully authenticated. I can't figure out a way to restrict it to only a specific ldap group in FreeIPA. Suspecting it has to do with one of setting either of the config option group-member-check, group-search-base and group-filter. Any help will be greatly appreciated!

Hello everyone, While reading this article "FortiSwitch FortiLink Integration" and to be more specific, the RADIUS/syslog/L2 MAC traps config, there is always a note saying to skip the step if you configured one of the three. I do understand that L2 MAC traps is the most recommended, but I wanna know why can't we use two together, is it to optimise performances ? Thanks in advance.BR,

Hi everyone. I'm a network engineering trainee. I previously worked with Fortigate devices for about a year, but I took a break. Now I'm starting a new project and will begin working on it. I'd like to hear about your experiences. Are there any YouTube channels or resources you can recommend? My goal is to refresh my knowledge and obtain the NSE4 certification within 3-6 months.

Hello everyone,  I'm trying to integrate FortiNAC with FortiMail. I managed to get it working after making some tweaks in FortiMail policilies, but I want to confirm something. In the Authentication section, which mailbox should be used? Should I create a dedicated mailbox in FortiMail for FortiNAC and use it for authentication there?  Thanks in advance.BR,

The customer stores .sqlaudit logs on the C:\ drive of a Windows machine where the Windows Agent is installed. Multiple log files are continuously updated, and once a file reaches its size threshold, a new .sqlaudit file is created.The customer wants to collect logs from all generated files, including their contents. They attempted to use Windows Agent Template → User Log, but the logs are not being fetched.Could someone please assist with this issue?

I ran into an issue here: I have a zone with several members.Now I need multicast forwarding for airprint between two members of that zone.intra-zone-traffic is blocked (per default) which is wanted that way.So any traffic has to be explicitely allowed by a policy. Now I cannot create a multicast policy for that because of the zone. In multicast policy only the zone is available  not its members. So even mlticast policies from interfaces that are not member of the zone can only have the zone as source or destination interface. I consider this a security risk. Does anyone have some tip how one can do intra-zone multicast forwarding then?I additionaly have openend a ticket with TAC on this too

I would like to independent IP addresses on my  "mgmt" interfaces in my cluster Active-Passive. Every time I configure an IP on one cluster "mgmt" interface, then the Passive unit inherits this IP addresses which is what I do not want. My aim is to have dedicated IP addresses for "mgmt" on each cluster and use port2 (mgmt) as the mgmt interfaces with the same IP address. How can I remove/unset a vdom from "mgmt" (unset vdom root)I have  been looking for dependencies to delete and have run out of ideas! Removed dedicated mgmt cmd, under config sys global removed unset mgmt-vdom which I don't think was going to help.Deleted config firewall address dependency as well. Thanks!

Hello All!On my FG 90 strange issue - after restart on some interfaces traffic partially dropped.For example - from my computer (VLAN 10) I am trying to ping server located in VLAN 22: C:\Windows\System32>ping 192.168.22.1Pinging 192.168.22.1 with 32 bytes of data:Reply from 192.168.22.1: bytes=32 time<1ms TTL=63Reply from 192.168.22.1: bytes=32 time=1ms TTL=63Request timed out.Request timed out.Ping statistics for 192.168.22.1:Packets: Sent = 4, Received = 2, Lost = 2 (50% loss),Approximate round trip times in milli-seconds:Minimum = 0ms, Maximum = 1ms, Average = 0ms In previous firmware one more restart was solve it. But after upgrade to 7.4.11 even after restart the issue stil exists on few interfaces. Here is an output of sniffer:diag sniffer packet any 'host 192.168.22.1 and host 192.168.10.51' 1 100interfaces=[any]filters=[host 192.168.22.1 and host 192.168.10.51]6.892452 192.168.10.51 -> 192.168.22.1: icmp: echo request6.892478 192.168.10.51 -> 192.168

In Load-balancer mode deployment, what happens if primary fac goes down? for an example , I have cluster(A-P) as a primary at HQ and load-balancer at two different geo location.what happens if my primary HQ is down? can load-balancer take over authentication function.if so which will be active.  

Hi What I mean is that I configured the lockout setting to lock the account after five failed attempts, but when my user enters the wrong password just once, FAC disables the account user, and it has to be manually enabled. FAC version 6.6.4 Thanks.   

Does anybody know the reason why it skipped 7.x.x and jumped from 6.6.x to 8.0.0?And, most importantly what is the major change with this new version in the software structure compared to any 6.6.xs? What's new section in the release notes doesn't indicate anything about it but just feature enhancements.Toshi 

I'm trying to design topology for a 2 FortiAuthenticator system (in geographically separate areas) with Active-Passive HA. Can multiple interfaces be configured for the heartbeat in case one pair of interfaces goes down (e.g. a cut cable)?Can an interface that is configured for authentication also be used for heartbeat? What happens if the heartbeat(s) go down but both FAC are still online? Will there be split brain? How is a split brain resolved?

Hi Fortinet teamIs it planed to add credential stuffing defense to FortiAuthenticator?I see it is already in FWB and FAD, but I think it should be definitely a natural feature in FortiAuthenticator.

Hello everyone,I'm experiencing an issue with MSCHAPv2 authentication on FortiAuthenticator (FAC) when using Windows AD domain authentication.My FAC is joined to Active Directory, shows as fully connected to the domain controllers, and I have a RADIUS policy configured with “Windows AD domain authentication” enabled.Problem DescriptionWhen domain-joined Windows PCs attempt 802.1X authentication, they automatically send the logged-in user’s credentials.However, FAC rejects these attempts with the following log message: "Windows AD user authentication from (null) (mschap) with no token failed: AD auth error: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)" interestingly, this issue does not occur on non-domain (workgroup) PCs.When a user manually enters the same domain username and password, authentication succeeds without any problem.I have also tested different username formats, including: realm\username and username

Is it possible to create an address object on a FGT using logs from a FAC via an event handler on a FAZ? We  setup several automation stitches on the FAZ and FGT to add address objects based on failed VPN attempts.  What I'm also looking to do, if possible, is create an object from a failed login attempt.  Basically, there are hosts out there throwing names and passwords at us.  Since the accounts don't exist any more and don't have an MFA token, they fail.  So, I setup an event handler on the FAZ to get the source IP when a user without a token tries to login.  However, it won't let me configure this as an automation stitch so I can use it on the FGT. And yes...I'm already in the process of moving away from SSL VPN to IPSEC, but need SSL for a while yet during the migration.