Fortinet Community

Hi, I'm currently investigating if we could use fortisandbox on premise to be use as a on-demand file scanner to prevent bad actor to upload malware/virus. I read that fortisandbox can do file on demand, but could it be trigger by a webapi (like my backend would send the file to fortisandbox to be scan) ?And if so, will fortisandbox give me a detailed report on the file, like if i upload a file.docx and it's in fact a PDF, would fortisandbox give me that information ? 

Hi everyone. I am trying to set up Forticlient VPN users to be able to authenticate and get VPN access using their Google accounts. We have a Fortigate FGT60E with FortiOS 7.4.9 running.Right now we have a SSL-VPN set up and working fine but with separate account credentials + FortiTokens. I had tried following different guides I found online + trying to use the logic of my own but I am stuck, based on logs fortigate does not really understand how to map a user to a group.  I had created a custom SAML app with : ACS : https://MyFQDN:10443/remote/saml/login/ Entity ID: http://MyFQDN:10443/remote/saml/metadata/Start URL: https://MyFQDN:10443/remote/loginSigned response checkedCertificate valid until 2031.Basic information > Primary email Attribute mapping : Primary email -> usernameOn Fortigate side, under User & Authentication SSO I created Google_SAML, with this config :Entity ID : http://MyFQDN:10443/remote/saml/metadata/Assertion consumer service URL: ht

Hi Friends,We currently have a solution implemented with FortiNAC integrated with Fortigate and FortiSwitch through FortiLink. Change of Authorization (CoA) events are correctly configured in compliance with RFC 5176, and dynamic VLAN changes are working as expected. However, a specific behavior is observed when a host is deleted from the FortiNAC inventory: in this scenario, FortiNAC sends a Disconnect-Request, but this message is never acknowledged by the switch, even though CoA operations function correctly in other scenarios such as host state changes or VLAN reassignment. Fortinac Version 7.6.3.0779 Fortigate Version v7.4.9 FortiSwitch Version 7.4.7 This is a capture when the client change from vlan register to vlan employeeThis is a capture when I delete the host from FortiNAC GUI   Regards 

Hi,We have a Fortigate 60F and go through a reseller who look after it for us. We had a Forticare licence renewal reminder 3 months ago but didn't act on it at the time (because it was 3 months away and we weren't sure if we would lose time by renewing early). No reminder was set internally (my fault) and no further reminders were received from the reseller. It expired last week and we have had to scramble to renew. The reseller put the renewal in last Thursday and it still hasn't renewed on the device, so we continue to have issues.Is this normal 5 days later, and is there anything we (or they) can do to speed it up?I have access to the dashboard and the CLI.Thanks

Actually in the VPN why function of Local Gateway? What pro and cons if we enable/disable this?

We are using Cisco routers for all our sites' BGP (MPLS via Lumen), and we're in the process of using the 80F to handle the BGP routing. We've never had any significant issues with the current network setup, but we need to decomm the Cisco due to EOL, and we don't want to spend more $$ if the 80F can handle the BGP routing. Has anyone had experience with FortiGate's BGP option? I have questions, and I would greatly appreciate any feedback. Also, we plan to replace our Cisco switches with FortiSwitch 248E-FPOE to centralize management. What is the router ID in Network > BGP? Is this just an arbitrary, unique ID I assign to the 80F?Some tutorials advertise the BGP IP subnet, and others only advertise the internal subnet. Which subnets do I advertise? For voice traffic, ours is currently configured to route directly to the RingCentral data centers, with failovers also configured. But in the event of a complete outage (which happened 2x), how do I route the voice traffic to th

I have an environment with mixed models of FortiGates being managed by FortiManager. I want to start using FortiManager to handle firmware upgrades rather than manually. With the templates I can see there seems to be a few options to achieve this and I am looking for best practices in terms of ease of use/reporting etc. Option 1 - Create a model-firmware template specifically for a specific model and target firmware then with a recurring schedule and assign devices to it as I need to. Option 2 - Create a firmware template for just a target firmware with a recurring schedule and assign devices as I need to. Whichever I choose from above, (I am leaning towards Option 1), when a new firmware release is available should I... Edit the initially created template and add in the new firmware version (And remove the older?) Create a new firmware template and assign devices to this?

Hi, Is it possible to disable this feature?https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/43068 Thank you!

Hello all.i used to have the following - file/print serversonicwall firewalllayer 3 switch - it handled all the routing for the 'local' subnet. now, i have the following (same) file/print server and driversfortigate 91gfortigate 148fpoe switches since switching over to fortigate as the 'backbone' i've started having strange issues with printing - anything.  whenever i print something (small or large) using the same print server  - i'm getting lots of pages of 'computer code' and bad data.  the print jobs also reflect/show the print as 'guest' instead of the user that initiated the print job. i have to cancel, and try again to print.  it doesn't matter if the file is a .txt/.pdf/.xls/etc - i get the same thing. the print server is on a different vlan than the printers but don't think that's the issue as access to those servers works, and whenever i do a pcap on the file server - i don't even see the file or process going out since it's layer-

Hi community, how can I block the download of a specific program (for example, PuTTY) from any website using FortiGate?

Hi,in our company we use browser as an external user-agent for SAML authentication in an SSL VPN connection. When authenticating, Forticlient launches the default browser, but I would like to define which application it opens, as I have a specific browser - not the default one - with my work profile. 

Token field no longer shows on my  FortiClient VPN 7.4.3.1790 (Windows 11 25H2 OS Build 26200.7171) Same account works on my other PC using Forticlient 7.0.8.0427 (Windows 11 22H2 OS Build 22621.6060)

I have a Fortinet FortiGate 100E (V7.2.10) running in a production environment.Currently, multi-VDOM mode is NOT enabled.I want to create a new VDOM.Can someone confirm whether enabling multi-VDOM mode and creating a new VDOM will impact the existing production traffic or policies?What precautions or best practices should I follow before enabling multi-VDOM on a live firewall?

Hello,I have to design a network based on sdwan, ibgp and advpn technology by the book, but using three hubs instead of the classical two.It is possible to implement advpn based on three hubs?Thank you all Vincenzo Stolfi 

Hi, I have set up virtual server with full ssl offloading. Everything is working fine but when I check our website by ssl checker for example https://www.digicert.com/help/ it says that the server is not sending the required intermediate certificate. Anybody know how to fix it? The problem is that Bluemedia cannot correct ask our webserver because it gets error "Unable to find valid cerification path to requested target".   I have already tried to upload .pfx with certificate, intermediate certificate, private key etc. and it still does not work.

Hi all, we have more and more problems changing from SSL VPN to IPSec. I tried with 2 PCs Win11 where SSL VPN worked fine for months but IPSec is not doing any connections. Since I see in the Logs I cant connect via UDP500 (changes to 1011) I found out, that not all services of the Forticlient are installed correctly: Get-Service | findstr /i forti >>> Running FA_Sheduler   Forticlient Service Scheduler I tried with different Forticlient versions, from 7.0.X to 7.4.X and always the same. I deactivated in Windows Security everything but I cant get rid of: CodeIntegrityPolicyEnforcementStatus: 1 Any good workaround to solve the problem? I got to the point to install Win11 again and this is something I dont want to do for x remote users. Thanks!   

Hi all, simple question...How do I unlock a user which is blocked due too many failed attempts?As of default the waiting time is 600sec. "diagnose firewall auth clear" seems a bit too much. Or is this the way to go? FortiOS 7.4.9 Thanks, regardsMarc

I have a fortinet v7.0.12 router and it's configured to nat and allow all traffic from the internal network to the internet. There's a firewall rule for internal -> wan with source/destination/Service set to 'all' and the security police is no-inspect. This seems to work for most things, internal users can access web site but some outgoing connections are blocked. Notably ports 8007 and 25 don't work. Where else would these connections be getting blocked if not the firewall?

Hi community,I would like to know if FortiNAC provides a way to label BYOD users. Are there any methods I could try? The BYOD users are expected to go through the captive portal and run the dissolvable agent for posture checking. In admin GUI I can see the registered user labeled BYOD.Thanks.FortiNAC  

Hi community, I am unable to add a new interface as an SD-WAN member on fortigate running fortiOS 7.6.4.  * Are there any know limitations or buds in fortiOS 7.6.4 related to SD-WAN members ?* Fortigate Model is 400F FortiGate #SD-WAN 

Hello everyone,we are currently implementing multi-factor authentication (MFA) on FortiClient VPN for our users.From FortiClient EMS, I have correctly configured the domain, Zero Trust settings, and the related policies.The issue occurs during the VPN connection phase: when MFA is enabled, the connection fails and is dropped, whereas disabling MFA allows the VPN connection to be established successfully without any issues.At the moment, I am unable to identify the root cause of this problem.Has anyone experienced a similar behavior or can suggest which checks should be performed?

I have a multi-tenant FortiClient EMS system and I am trying to create a local user within a specific site, but the system does not allow this. It only permits creating local users at the Global level.Is there a supported way to create a local user at the site level, or is user creation limited to Global only?

We use FortiAPs 231G ( v7.4 build0734) on a Fortigate 200F ( V7.2.10)The Wifi on 2.4Ghz and 5Ghz works without any problems. However with WIFI6 on 6Ghz the clients reconnect every few seconds, even on strong signal. Different clients with different WLAN adapters are affected. Anyone having a suggestion or similar problems? Error:msg="AP sent disassociate frame to client c8:94:02:ff:f9:cd" msg="Client c8:94:02:ff:f9:cd had an IP address detected (by DHCP packets)." msg="Client c8:94:02:ff:f9:cd disconnected by WTP." msg="Client c8:94:02:ff:f9:cd no OKC match for PMKID" msg="Client c8:94:02:ff:f9:cd no OKC match for PMKID" msg="Client c8:94:02:ff:f9:cd no OKC match for PMKID" msg="DHCP ACK for IP 192.168.115.52 from server 10.1.1.20 with MAC 00:09:0f:09:01:1a for client c8:94:02:ff:f9:cd from router 192.168.115.254 on subnet 255.255.255.0 with dns 10.1.1.6, 10.1.1.20" msg="DHCP REQUEST for IP 192.168.115.52 from client c8:94:02:ff:f9:cd" msg="Client c8:94:02:ff:f9:cd authentica

Hey.We have 2 FG100 Firewalls with a Firmware higher than 7.2 in a HA cluster, and we did discover the feature "preserve-session-route" in our FortiManager documentation.We're using SD-WAN with different RuleSets, like Microsoft365 Rules and VoIP Rules.We also using Site2Site VPN to connect multiple sites together.What type of issue could we face, if we enable "preserve-session-route" in our WAN Interfaces?I did only discover the knowledge base article, about that feature, but not the downsides or possible problems.I hope you could provide me with some answers? :)Best Regards, Lars