Fortinet Community

  It's really exhausting dealing with Fortinet on GNS3. I've watched 80,000 YouTube videos, but none of them work; it always asks me for a license. In FortiCloud, in my Asset Management section: Registration Code. Enter your product serial number, service agreement registration code, license certificate number, or asset transfer token to start registration: Where can I get the serial number?

FortiAuthenticator is showing a lots of Fortitokens with pending status. Some users with tokens with this status are reporting problems to authenticate by VPN and some others users with tokens with this status are reporting that it is working well. The same actual today's configuration worked in the past and we don't have new configuration and with no changes in the IT infrastructure. See pictures bellow for a better analisys.Does anyone here have any experience solving a similar problem? 

Hello everyone,I am downloading logs from my FortiAuthenticator device that has version 6.6.2, however when downloading the logs from the download options, it downloads them with a .dbg extension. How can I download the logs in CSV or in readable text to be able to review the user authentication logs?

We are setting up two factor authentication using FortiAuthenticator and enable Push Notification. We need to be able to do this on the internal network, guest network and public WAN. Is the best way to do this is to use a FQDN in the public IP/FQDN setting and use DNS routing for each of those to get it to work? Using a public IP address only works on the Public WAN.

Im trying to find a FAC API endpoint to query what users are in a specific LDAP Group. This is as close as I could get. Unfortunately this only returns groups that are local groups, not LDAP groups. Anyone else figured out how to do this or if its possible with the current API?https://docs.fortinet.com/document/fortiauthenticator/6.6.2/rest-api-solution-guide/583007/local-user-group-memberships-localgroup-memberships

Hi, I am facing a issue when trying to setup a radius policy on Fortiauthenticator cloud for use with our fortigate ssl vpn, where it is not allowing me to set a realm with a saml assignment. The realm is created but is blank and no option to set in the radius policies.  We are importing our users in via Entra.   Thanks 

So I have been struggling for a bit to figure out why my SSL VPN configuration with Azure SAML doesn't work with FortiClient 7.4.2.  Older FortiClient version seem to not have this issue.  The most telling thing I see in the server debug log is: [394:root:5b4b]SSL state:fatal decode error (x)SSL state:fatal decode error (x) then: [394:root:5b4c]saml login [394:23372] SAML_ERROR: Error occurred during remote login 'could not found corresponding saml session (101)' If I use the option in FortiClient "Use external browser as user-agent for saml user authentication", I get no such error and everything works just fine. Any guesses as to what might be causing this issue?  When I searched on this issue, I only found similar issues  but where the opposite was true - using external browser for saml user authentication did not work as expected. I am a little reluctant to upgrade the users to such an unstable situation.

I need help from the #Fortinet community. Our legitimate healthcare business has been incorrectly flagged by #FortiGuard for over 4 weeks, and standard appeals have been completely ignored.The Facts: • Domain: menswellnesscenters.com • Business: Licensed medical clinics in Virginia • VirusTotal: 91 out of 92 vendors say CLEAN • Only Fortinet flags as malwareThe Impact: • Millions of Comcast/Xfinity customers blocked via Akamai ETP • Patients cannot access healthcare services • 4+ weeks of appeals with ZERO responseThe Evidence: We're a LegitScript-certified healthcare provider. Our site runs on WordPress/Hostinger with Cloudflare DNS. Multiple security scans show no malware. Every other major security vendor (ESET, BitDefender, Kaspersky, etc.) rates us as clean.Why This Matters: This isn't just affecting our business - it's blocking patient access to medical care. FortiGuard's reputation depends on accuracy, but we're seeing a clear false positive that's been unresolved for a month.Re

We did implement FortiClient EMS in our company and since we did not have a windows server license to spare we directly went for version 7.4 because it is running on linux. I did not find any informations on recommendations from FortiNet how to update the linux system.Does running "unattended-upgrades" in default configuration may break something?  

Hi,We introduced mandatory TLS (Security -> TLS -> TLS-Profile -> TLS-option = secure) a few months ago, which unfortunately has the disadvantage that connections are not only rejected when TLS is not an option on our connection partner but also get rejected if a TLS certificate on the receiving server has expired. Although encryption is still possible with an expired certificate, we then reject the SMTP connection. As far as I could find out, there is no possibility to configure a gradation in FortiMail. For example, if the server does not offer TLS, then reject the connection. But if it does offer TLS and only the certificate has expired, then connect.Does anyone have any ideas on how we could implement this? It's quite annoying to keep an exception list for all customers who don't pay attention to their certificates... Thank you!

We have a scenario in which we need an ssl vpn to our local network. The topology consists of two FortiGate FG-100F (HA) connected to two FortiSwitch FS-124F on port X1 and X2 of the Fortigates to SFP ports of the fortiSwitches. The fortiswitches are connected to each other on two MCLAG ports as well. We have a VLAN120 (10.60.100.0/24).The ports X1 and X2 are under a fortilink interface. All local VLANs have been created under the FortiLink interface. We also setup SSL VPN (IP range 10.60.101.0/24). We have Policy to allow incoming traffic from ssl.root interface to VLAN 120. The users can successfully connect to the SSL VPN using FortiClient, and they receive ip from 10.60.101.0/24 range, however they can not ping a resource under VLAN120. FortiClient also shows zero Receive but it has sent traffic. I can confirm that traffic hit the firewall policy.

Hi, I need your opinion/help on how I should proceed on this. Existing Set tup:New Fortigate in v7.0.0 (currently offline)Done registering the FortiGuard License on FortiCloud Issue encountered:unable to upload the license offline due to device is not yet in v7.2.0 Cannot find an article which will guide me on how to proceed on this. Are below steps correct? 1. Connect the Fortigate to the internet for it to capture the FortiGuard license2. Make if offline again3. Manually upgrade the firewall to desired firmware (ex 7.4) I assume that I will not encounter an issue when upgrading the firewall since the license details will still be valid offline. Thank you 

How do you guys handle the logging to fortianalyzer if you are in a zero trust environment? Do you log all traffic, do you log only security events, do you not log internal traffic but log external traffic? Also would logging security events only allow logging for DNS errors?

Hello, could someone help me with this? I need a global solution since there are multiple devices involved and it’s not feasible to fix it device by device. 

Hi, I'm currently investigating if we could use fortisandbox on premise to be use as a on-demand file scanner to prevent bad actor to upload malware/virus. I read that fortisandbox can do file on demand, but could it be trigger by a webapi (like my backend would send the file to fortisandbox to be scan) ?And if so, will fortisandbox give me a detailed report on the file, like if i upload a file.docx and it's in fact a PDF, would fortisandbox give me that information ? 

Hi everyone. I am trying to set up Forticlient VPN users to be able to authenticate and get VPN access using their Google accounts. We have a Fortigate FGT60E with FortiOS 7.4.9 running.Right now we have a SSL-VPN set up and working fine but with separate account credentials + FortiTokens. I had tried following different guides I found online + trying to use the logic of my own but I am stuck, based on logs fortigate does not really understand how to map a user to a group.  I had created a custom SAML app with : ACS : https://MyFQDN:10443/remote/saml/login/ Entity ID: http://MyFQDN:10443/remote/saml/metadata/Start URL: https://MyFQDN:10443/remote/loginSigned response checkedCertificate valid until 2031.Basic information > Primary email Attribute mapping : Primary email -> usernameOn Fortigate side, under User & Authentication SSO I created Google_SAML, with this config :Entity ID : http://MyFQDN:10443/remote/saml/metadata/Assertion consumer service URL: ht

Hi Friends,We currently have a solution implemented with FortiNAC integrated with Fortigate and FortiSwitch through FortiLink. Change of Authorization (CoA) events are correctly configured in compliance with RFC 5176, and dynamic VLAN changes are working as expected. However, a specific behavior is observed when a host is deleted from the FortiNAC inventory: in this scenario, FortiNAC sends a Disconnect-Request, but this message is never acknowledged by the switch, even though CoA operations function correctly in other scenarios such as host state changes or VLAN reassignment. Fortinac Version 7.6.3.0779 Fortigate Version v7.4.9 FortiSwitch Version 7.4.7 This is a capture when the client change from vlan register to vlan employeeThis is a capture when I delete the host from FortiNAC GUI   Regards 

Hi,We have a Fortigate 60F and go through a reseller who look after it for us. We had a Forticare licence renewal reminder 3 months ago but didn't act on it at the time (because it was 3 months away and we weren't sure if we would lose time by renewing early). No reminder was set internally (my fault) and no further reminders were received from the reseller. It expired last week and we have had to scramble to renew. The reseller put the renewal in last Thursday and it still hasn't renewed on the device, so we continue to have issues.Is this normal 5 days later, and is there anything we (or they) can do to speed it up?I have access to the dashboard and the CLI.Thanks

Actually in the VPN why function of Local Gateway? What pro and cons if we enable/disable this?

We are using Cisco routers for all our sites' BGP (MPLS via Lumen), and we're in the process of using the 80F to handle the BGP routing. We've never had any significant issues with the current network setup, but we need to decomm the Cisco due to EOL, and we don't want to spend more $$ if the 80F can handle the BGP routing. Has anyone had experience with FortiGate's BGP option? I have questions, and I would greatly appreciate any feedback. Also, we plan to replace our Cisco switches with FortiSwitch 248E-FPOE to centralize management. What is the router ID in Network > BGP? Is this just an arbitrary, unique ID I assign to the 80F?Some tutorials advertise the BGP IP subnet, and others only advertise the internal subnet. Which subnets do I advertise? For voice traffic, ours is currently configured to route directly to the RingCentral data centers, with failovers also configured. But in the event of a complete outage (which happened 2x), how do I route the voice traffic to th

I have an environment with mixed models of FortiGates being managed by FortiManager. I want to start using FortiManager to handle firmware upgrades rather than manually. With the templates I can see there seems to be a few options to achieve this and I am looking for best practices in terms of ease of use/reporting etc. Option 1 - Create a model-firmware template specifically for a specific model and target firmware then with a recurring schedule and assign devices to it as I need to. Option 2 - Create a firmware template for just a target firmware with a recurring schedule and assign devices as I need to. Whichever I choose from above, (I am leaning towards Option 1), when a new firmware release is available should I... Edit the initially created template and add in the new firmware version (And remove the older?) Create a new firmware template and assign devices to this?

Hi, Is it possible to disable this feature?https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/43068 Thank you!

Hello all.i used to have the following - file/print serversonicwall firewalllayer 3 switch - it handled all the routing for the 'local' subnet. now, i have the following (same) file/print server and driversfortigate 91gfortigate 148fpoe switches since switching over to fortigate as the 'backbone' i've started having strange issues with printing - anything.  whenever i print something (small or large) using the same print server  - i'm getting lots of pages of 'computer code' and bad data.  the print jobs also reflect/show the print as 'guest' instead of the user that initiated the print job. i have to cancel, and try again to print.  it doesn't matter if the file is a .txt/.pdf/.xls/etc - i get the same thing. the print server is on a different vlan than the printers but don't think that's the issue as access to those servers works, and whenever i do a pcap on the file server - i don't even see the file or process going out since it's layer-

Hi community, how can I block the download of a specific program (for example, PuTTY) from any website using FortiGate?