Fortinet Community

Hi community, I am unable to add a new interface as an SD-WAN member on fortigate running fortiOS 7.6.4.  * Are there any know limitations or buds in fortiOS 7.6.4 related to SD-WAN members ?* Fortigate Model is 400F FortiGate #SD-WAN 

Hello everyone,we are currently implementing multi-factor authentication (MFA) on FortiClient VPN for our users.From FortiClient EMS, I have correctly configured the domain, Zero Trust settings, and the related policies.The issue occurs during the VPN connection phase: when MFA is enabled, the connection fails and is dropped, whereas disabling MFA allows the VPN connection to be established successfully without any issues.At the moment, I am unable to identify the root cause of this problem.Has anyone experienced a similar behavior or can suggest which checks should be performed?

I have a multi-tenant FortiClient EMS system and I am trying to create a local user within a specific site, but the system does not allow this. It only permits creating local users at the Global level.Is there a supported way to create a local user at the site level, or is user creation limited to Global only?

We use FortiAPs 231G ( v7.4 build0734) on a Fortigate 200F ( V7.2.10)The Wifi on 2.4Ghz and 5Ghz works without any problems. However with WIFI6 on 6Ghz the clients reconnect every few seconds, even on strong signal. Different clients with different WLAN adapters are affected. Anyone having a suggestion or similar problems? Error:msg="AP sent disassociate frame to client c8:94:02:ff:f9:cd" msg="Client c8:94:02:ff:f9:cd had an IP address detected (by DHCP packets)." msg="Client c8:94:02:ff:f9:cd disconnected by WTP." msg="Client c8:94:02:ff:f9:cd no OKC match for PMKID" msg="Client c8:94:02:ff:f9:cd no OKC match for PMKID" msg="Client c8:94:02:ff:f9:cd no OKC match for PMKID" msg="DHCP ACK for IP 192.168.115.52 from server 10.1.1.20 with MAC 00:09:0f:09:01:1a for client c8:94:02:ff:f9:cd from router 192.168.115.254 on subnet 255.255.255.0 with dns 10.1.1.6, 10.1.1.20" msg="DHCP REQUEST for IP 192.168.115.52 from client c8:94:02:ff:f9:cd" msg="Client c8:94:02:ff:f9:cd authentica

Hey.We have 2 FG100 Firewalls with a Firmware higher than 7.2 in a HA cluster, and we did discover the feature "preserve-session-route" in our FortiManager documentation.We're using SD-WAN with different RuleSets, like Microsoft365 Rules and VoIP Rules.We also using Site2Site VPN to connect multiple sites together.What type of issue could we face, if we enable "preserve-session-route" in our WAN Interfaces?I did only discover the knowledge base article, about that feature, but not the downsides or possible problems.I hope you could provide me with some answers? :)Best Regards, Lars

Hi, We owe a Fortinet Fortigate 50G in a domestic environment. In the section "IPS Signatures", we can see more than 5864 entries. 84% is blocked but 16% shows "pass": Here you have a few examples:   Does this mean a risk for our installation? Would it be better to have them all marked as "Block"? If positive, how can I change the action? Thank you 

Hello, i have a problem with dataset in Fortianalyzer. When i search traffic logs in Fortianalyzer under "LOG-VIEW" and "Traffic" i get different result than using Dataset Query in Report Definitions.Are these queries based on different databases / data sources?I run the following SQL in Dataset definition: SELECT policyid, dstport, protoFROM$log-traffic as lWHERE$filterAND policyid = '681'group by policyid, dstport, protoorder by dstportbut this does not return the same ports like searching in Analyzer Log Traffic view when searching with policyid="681" I selected the device name in both search scenarios, in the drop down fields.My question, from where does the difference result and should both query types return the same result? 

Does anyone know how to do the equivalent of a " terminal length 0" on a Fortigate firewall? Our Fortigate has roughly 65k lines of config in the configuration file - hitting space bar all the way to the bottom is painful.

Hi everyone, I would like some clarification regarding FortiMail HA in active–passive mode, specifically around IP addressing and routing/firewall configuration. I already know how to configure HA itself, but my main question is about IP addresses:In an active–passive HA setup, do both FortiMail units use the same IP address, or does each unit keep a different IP address?I currently have a Virtual IP configured on my firewall (192.168.1.1) to forward SMTP traffic.At the moment, the primary FortiMail has IP 192.168.1.1(which is the VIP), and the secondary FortiMail has IP 192.168.1.2.SMTP traffic is currently being forwarded correctly to the primary unit.My concern is failover behavior:What should be configured so that when the primary FortiMail goes down, the secondary automatically takes over?Once HA is configured and synchronized, does the secondary automatically take over the primary’s IP address (192.168.1.1), or do I need to modify something on the firewall side (VI

I have this app that I got from forinet, called forticlient for Mac, to connect remotely to my network.  I have my IP and I need the site name.  I have a few ideas of what the site name is but I didn't even think I needed it as it only asks for it when I click the little sync arrows button to revel the field.  This is very frustrating as I need to access my forinet network remotely from locations outside of my network.  How can I establish a connect with the app?

I am getting the below error message when connecting to the FortiClient VPN, which it used to work. Your PC does not meet the host checking requirements set by the firewall. Please check that your OS version or antivirus and firewall applications are installed and running properly or you have the right network interface. (-7006) I've checked with Microsoft and they confirmed the WMI SecurityCenter2 namespace works correctly. Thanks for help.

Hi! I have a strange issue with the SDWAN and BGP.We have a Hub and spokes setup, the VPN at Hub is dynamic. There is 2 WANs on the HUB and 2 on the Spokes, so we have 4 IPSEC tunnels between the Hub and a Spoke. Both use a Loopback for the BGP connexion. In fact, on both we see 4 path to each other. The SLA, that checks the path between the Loopback of the spoke to the loopback of the Hub. It seems like only 2 checks works at a time.  If I shut 2 tunnels, the 2 other SLA checks, works again.  How can we fix this.   config system sdwanset status enableconfig zoneedit "virtual-wan-link"nextendconfig membersedit 5set interface "SpokeW1-2-HubW1"set source 10.128.0.8nextedit 6set interface "SpokeW1-2-HubW2"set source 10.128.0.8nextedit 9set interface "SpokeW2-2-HubW1"set source 10.128.0.8nextedit 10set interface "SpokeW2-2-HubW2"set source 10.128.0.8nextend config health-checkedit "SLAHub"set server "10.128.0.1"set update-static-route disableset members 5

I’m preparing for the Fortinet FCSS_EFW_AD-7.6 exam and wondering if practice questions are really necessary. I’ve studied the main topics, but I’m unsure if hands-on practice alone is enough. Would love to hear your thoughts or experiences!

I know Palo altos have this ability but let's say a fortigate loses connection to the fortimanager and I need to quickly either change an IP of an interface or quickly add a static route to the fortigate. would I be able to do this on the fortigate locally without touching the fortimanager?

Hi allI have upgraded our FortiManager to v.7.6.5. When I am trying to install policy on one of our Fortigates, the installation fails with the following message: Commit failed: error -999 - Database Error - database disk image is malformed Our Fortimanager is a VM on VMware, so I extended the disk space but I still get the message above. If I now run "Diagnose pm2 check-integrity all" I get the following:--- pragma integrity_check adom db ------ total: 19 ok.--- pragma integrity_check device db ---pragma integrity_check fails: /var/pm2/devdb213 -- Tree 18 page 2866 cell 204: Rowid 11301 out of order>>> total: 4 failed: 1--- pragma integrity_check global db ------ total: 2 ok.--- pragma integrity_check ips db ------ total: 3 ok.--- pragma integrity_check task db ------ total: 1 ok.--- pragma integrity_check ncmdb db ------ total: 22 ok. I ran the other commands in FortiManager database checking tools - Fortinet Community but they don't seem to have don

Hello,We’re experiencing an issue where firewall policies that use LDAP-based user groups are not functioning as expected. Our goal is to restrict access to certain websites for specific LDAP users.Here’s what we’ve done so far:Configured an LDAP server.Created a user group, fetched users from LDAP, and applied the group to the firewall policy.Additionally, we set up an external connector for the Active Directory Server, fetched the required users through it, and used the same FSSO user group in the firewall policy.Unfortunately, the configuration isn’t working as intended.Could someone please assist us in troubleshooting this issue and provide guidance on how to resolve it?

2 of our sites few users are not getting IP address from one of the SSID however they can connect to another SSID.we have 3 SSIDs in our fortigate with seperate VLAN in bridge mode and DHCP is also on Fortigate VLAN. it happens randomly with random users they can connect to guest SSID however 1 or 2 users when they connect corporate SSID they #don't get IP from Fortigateand shows no internet. We did Forget SSID and try, we did laptop level troubleshooting as well. DHCP lease IPs are availabe more than 100 free. 

I have a requirement where i need to allow access from a specific internal source to a no of  internet URLs.. the destination here not be any IP addresses..they will be a couple of URLs.. how can i achieve this in fortigate ?  any help is appreciated  thanks

Hi, due to the transition of software 7.4 to mature status, we decided to update the 401F from version 7.2.9 to 7.4.5.Unfortunately, after the update, the SFP ports x5-x8 (ULL) have no link.Downgrading to version 7.2.10 solved the problem.

Hi,We were hoping to create an API Admin user to enable us to perform automated certificate updates with our FortiWEB platform, however we do not have any option at all to create an api user  - there are no options for this.We are using 7.4.11 .All the documentation I have read suggests that we can , we do not have FIPS mode enabled and have logged on with a local Admin account.Does anybody have any idea why this option is missing/not available ? Regards  

Hello, I want to install FortiClient VPN on an Android device without using the PlayStore (I'm using StageNow for installing apk).But I'm not able to download the lastest apk, the "Firmware images" web page shows "Sorry, you don't have any product covered by a Fortinet support contract.". Can you provide me the lastest APK of FortiClient VPN please ? Thanks. Regards

Hello everyone,I currently have an SSL VPN tunnel where authentication is performed via RADIUS using FreeRADIUS and privacyIDEA with 2FA. This setup works perfectly. It is deployed on a FortiGate 100F running FortiOS 7.6.2. I cannot upgrade to newer versions because SSL VPN support would be removed. Clients connect using the FortiClient VPN-only client.I am trying to migrate to an IPsec VPN with a similar configuration. However, despite extensive research, I have not found a reasonable way to replicate the SSL VPN setup with IPsec.According to the documentation, in order for IKEv2 to work with a RADIUS server such as FreeRADIUS, the EAP method on the FortiClient must be configured as EAP-TTLS/PAP instead of the default EAP-MSCHAPv2.The problem is that configuring this in the FortiClient VPN-only requires editing the XML configuration file. This is a very advanced configuration step that I can perform myself, but I cannot reasonably require my end users to do so. Even with this workarou

How do you guys deal with random VPN Disconnections? They are driving me crazy for some of the users!!!!Same thing with SSL and IPSec

Hi, we have a HA FGT90G 7.4.7 and using SSL VPN with > 70 remote Users. We already have set up the IPSec and are testing for 2 months now. The results sofar are dissapointing. Users comment there are many disconnections and they have to reconnect many times a day. Now we should upgrade to 7.4.10 becaude of the vulnerabilty so we are not sure what to do? Is there any chance that Fortinet changes his mind for eliminating SSL VPN for this FG90G model...we dont think so. Should we just keep on with 7.4.7 (we deleted SSO). Other option would be moving SSL VPN to another FG100F model we are using. This might be the best option, though I am not sure if I can move all FortiTokens to another FG without problems. Thanks!

Hi, I wanted to test 7.2.4 VM on ESXI.For my current and wanted setup, i wanted to add a NIC using PCIE passthrough of ESXI to the VM i downloaded, because i wanted to use a VLAN on my Nic so that i can get PPPOE. I Have my SFP in that NIC. I Got my PPPOE config to work using the CLI, so i currently can ping fortiguard servers or any other outside destinations using the execute ping command. When i go execute vm-licensesI get : 60 - Failed to request forticare license. Failed to download VM license.But when i am using Diagnose hardware sysinfo vm fulli getValid : 0Code : 202,Status : 3If i do it from the GUI i get a message bottom right which says : "Licence invalid product model"My guess is because i kind of tempered with the VM adding a passed through nic but i hoped i was wrong, confirmed, or that it would be made possible.My current number of physical interfaces is 2, i do respect the CPU and ram limitation (even tried lowering the ram to 1536 in case pcie did something).