Fortinet Community

Hello everyone, We are managing the infrastructure of several environments where a FortiGate firewall is in place. Currently, we are using SSL VPN to provide remote user access to internal networks.As Fortinet is gradually deprecating SSL VPN, the time has come (perhaps later than ideal) to migrate this service to IPsec Dial-Up VPN. However, after multiple tests, I have not yet been able to clearly identify the best-practice approach for implementing this migration, especially in terms of access control logic. I would like to explain our current setup and the challenges we are facing.Current SSL VPN ImplementationWith SSL VPN, we are used to (and quite comfortable with) the following model:A single SSL VPN tunnel (split-tunnel)All users connect to this tunnelAccess to internal resources is controlled purely through firewall policiesPolicies are based on user groups / users, allowing granular access per destination, service, or portThis model is clean, scalable, and easy to manage.

How to turn raw fortigate alert to beautiful html format Tired of messy, hard-to-read FortiGate log alerts in your inbox? In this video, we’ll show you how to convert raw Fortinet email logs into clean, professional HTML email alerts that are easy to read and instantly actionable. What You'll Learn:How to extract and parse raw FortiGate log emailsFormat the log data into HTML with stylingAutomate alerts using Automation StitchesImprove visibility for your IT or security team https://youtu.be/wKc4iXqxqq8

I am running into an issue re-adding a FortiGate (running v7.4.8) to my FortiManager Cloud. The device was previously managed by this FMG but was removed temporarily for maintenance.Now, when I try to re-link them from the FortiGate side (Security Fabric > Fabric Connectors > FortiManager), I receive the following error:"The FortiManager's access to the FortiGate will be authenticated by the FortiManager certificate. The serial number from the certificate must match the serial number observed on the FortiManager. Could not connect to the FortiManager to retrieve its serial number."

have implemented ztna with onpremise fortiems 7.2.12 . and its working fine apart  from  few users who when they come to office, they are unable to access some resources till i disconnect their forticlient and connect back. there seems to be leftover configs of ztna which don't clear when they come to office. any suggestion to resolve this?. the pc are correctly tagged as onnet thus all ztna configs are supposed to clear. From the affected endusers forticlient, the ztna destination are cleared but still they cannot access resources till i disconnect them from ems. all pcs are windows 11 laptops nslookup of a resource resolves to a  ztna temp IP  > webservwe1.contoso.comServer: dc1.contoso.comAddress: 10.0.1.1Non-authoritative answer:Name: webservwe1.contoso.comAddress: 10.235.0.2after disconnecting fortclient from ems, the pc resolves to correct IP > webservwe1.contoso.comServer: dc1.contoso.comAddress: 10.0.1.1Name: webservwe1.contoso.comAddres

good night, i have a fortinet 100din which I have a vpn with fixed public ipmy production network is the following 192.168.0.XThis network is configured with another office that handles 172.18.1.xon my wired network 192.168.0.x I don't handle dhcp, all my machines handle it with fixed ip and they have access to the remote subnet 172.18.1.xI have configured a port in the fortinet for wifi, with the subnet of 192.168.100.XIt gives me access to the local network, but I can not access the VPN wirelessly, I do not know that I need to configure it. i drive an ap unifi pro

Morning guru's.I have a small customer with a Zxyel USG-200.  We are replacing with Fortigate 101F.Transparency:  I am not a FW guy - dabble I can do! Anyone moved or copied configs from a Zyxel device to Fortigate successfully?   Looking for advice, best practices.Thanks in advanceTerry

Hello,I have posted before regarding our FortiExtenders not working but that didn't go anywhere so will try again (If this doesn't work they are going in the bin !!!).So we have a Fortigate pair (100F in HA) running 7.4.7 and 3 x FortiExtenders (311F) running 7.6.2.The FortiExtenders are "authorised" and in LAN Extension mode.The IPSEC tunnel is up.(according to VPN -IPSEC Tunnels on the Fortigate)I have security policies allowing the FEX's to our "trust" network as well as Central SNAT configured allowing the FEX's to out trust network.I have remote admin access to the FEX's.The FEX's are being "powered" from Port4 (no network just POE)  - they are connecting over LTE.Any device connected to Port 1,2 or 3 on the FEX never gets a DHCP address and therefore cannot communicate with our "trust" network.So the FEXs are connected to the 100F but a device attached to the FEX cannot communicate with anything upstream as it is not getting a dhcp address.Would really appreciate some help f

Hello,We'd like to set up Windows ThinClients as multi-app kiosks with Assigned Access. (https://learn.microsoft.com/en-us/windows/configuration/assigned-access/configure-multi-app-kiosk?tabs=intune)We want to allow the use of FortiClient VPN and Remote Desktop. The FortiClient needs the Visual C++ runtimes installed to run, but a regular user without admin rights can't open the FortiClient within the kiosk mode. We get the error "Uncaught Exception in Main Process - Error: spawn UNKNOWN." We narrowed it down to the runtimes not being able to run with the FortiClient in that kiosk mode without admin rights. An admin account can open the FortiClient in kiosk mode with no issues. We tried setting the FortiClient to auto launch, but then we get the usual JavaScript Error because of the Visual C++ runtimes not being able to load. We allowed FortiClient to run like this in our XML for the Assigned Access:<App DesktopAppPath="C:\Program Files\Fortinet\FortiClient\FortiClient.exe"/>Is i

Okay so long story short. We have a WAN interface with multiple VLANs running to different ISP. I figured it would be simple to just convert the VLAN interface to SD-WAN but no.When labbing the change I found that if the interface type is physical I can not integrate the interface to SD-WAN and also I am not able to do it via the SD-WAN GUI by adding members and also not via CLI. The VLAN interface doesn’t show up.When the interface is set to type aggregate then I am able to change the VLAN interface to SD-WAN interface.Running 7.2.11 - is there something I am missing here? This feels so stupid.

Hello,We are preparing to upgrade our FortiGate firewall fleet. However, when checking the upgrade path on Fortinet’s website, we noticed that different upgrade paths are suggested for the same firewall model.When using the following tool: https://docs.fortinet.com/upgrade-tool/fortigate The suggested upgrade path is: 7.0.14 M (Current version)7.2.10 M7.4.8 M7.4.9 M (Target version) However, when using the upgrade path tool available at: https://support.fortinet.com/support/#/downloads/firmware The suggested upgrade path is:7.0.14 M (Current version)7.2.9 M7.4.7 M7.4.9 M (Target version)Could you please clarify which upgrade path should be followed and the reason for this discrepancy?

Hi all We configured a DialUp IPSec tunnel (udp) on Fortigate 7.4.9. The users are authenticated via RADIUS on a Fortiauthenticator and MFA (Fortitoken on same FAC). The user in question is my own - which works for SSL VPN on the same Fortigate and as login on the Fortigate itself as well - using the same FAC (just a different user group). When using (free) FortiClient 7.4.3 with my user can connect to the Fortigate, but doesn't get the Token-Challenge due to a EAP failure. The ike debug says it fails due to a EAP failure (see below), the correct username is being used/seen in the logs.The fnbam log says code 3, after two code 11 (see below).The FAC tells me that my user failed to login via EAP-GTC (see below).The timestamps are off as I had to pull data from different tests, the logs are current and valid. Unfortunately, there is not muc I can test - the password is in a password-tool and the same password is being successfuly used to login into FMG, FAZ, FAC

Hello,I would like to know just now what is the recommended version or mature version to FortiNAC. In our case, we have a pair 500F in HA mode (Version 7.4.0)Thanks in advance

Hello, I need your help.Briefly, I have the following problem. I have two WAN links, WAN1 and WAN2. Both of them are added as SD-WAN members. They do not have costs configured, but they do have priorities set: WAN1 has priority 1, and WAN2 has priority 3.Today, the following issue occurred: when WAN1 was unable to resolve various websites and DNS, the traffic did not switch to the required provider. The main problem is that the system must switch to the secondary provider when the primary provider is not working, and when the primary provider becomes healthy again, it should automatically switch back.How can this be configured?Please help me resolve this issue.FortiGate 

Dear, May I know the default OpenSSH version of FortiNAC?My current FortiNAC version is 7.2.9.0166. May I know the OpenSSH version is following FortiNAC version?Since the auditor said we need to upgrade the OpenSSH version to higher. Thank you.#NAC #FortiNAC #SSH #OpenSSH

I currently have one Fortigate 60F, which is about 5 years old. In the future, I want to implement a HA cluster.Is it a good idea to go with the 60F again? Performance wise, it’s been fine so far, but I can’t find any information about when it will go EOS, and I’m worried about how well it will work with future version releases. At the same time, I don’t want to go for the G-series yet, as I’ve heard some negatives about that.Also, I like the new “Single FortiGuard license for FortiGate A-P HA cluster”-model, where you only need to purchase one license for the HA cluster. And as far as I understand, this is not supported for the G-series models yet.

I have created 1 Hub with 2 branch office ( No forti manager ) ,  HUB having 2 ISP with static IP , branch having 2 ISP with dialup. created tunnels and created aggrigate tunnel. but fail over not hapening. some time 1 tunnel will work. routing also not working. can anybody help for the best practice / document for the config

Hi everyoneI’ll be taking over a firewall at work soon, even though I haven’t worked with one hands-on before. Right now, I have read-only access to get familiar with the system before officially starting.My course starts next week, and I’m planning to go for NSE5 after that, so I want to make sure I’m on the right track from the beginning. How was your experience with the course and the exam? What should I focus on?Any advice from real experience would be really appreciated!

Okay so long story short. We have a WAN interface with multiple VLANs running to different ISP. I figured it would be simple to just convert the VLAN interface to SD-WAN but no.When labbing the change I found that if the interface type is physical I can not integrate the interface to SD-WAN and also I am not able to do it via the SD-WAN GUI by adding members and also not via CLI. The VLAN interface doesn’t show up.When the interface is set to type aggregate then I am able to change the VLAN interface to SD-WAN interface.Running 7.2.11 - is there something I am missing here? This feels so stupid.

I would like to better understand the FortiNDR logs and all of their metadata because I’m planning to integrate the logs into a SIEM.I’ve reviewed the official Fortinet documentation, but it only includes a few samples. I’m looking for a more comprehensive guide that explains every log field, all possible metadata attributes, all log types, and attack/malware/AV event examples : basically all types of logs that could be sent to a SIEM, along with detailed explanations of each field and what it means.If there is any reference, whitepaper, or guide that thoroughly explains the FortiNDR log structure and samples (including detection logs, malware logs, AV logs, etc.) in detail, it would really help me understand each type and how to parse them properly.Thank you in advance !!!

Hi, I set up a szenario as decribed here:HA-mode FortiGate units managing a stack of several FortiSwitch units | FortiSwitch 7.6.4 | Fortinet Document Library - i have two FortiGates in Active/Passive Mode- 5 FS-124G-FPOE switches in a ring config- Active Fortigate connects X1 to switch 1 und X2 to switch 5- Passive Fortigate connect X1 to Switch 1 and X2 to switch 5- X1 and X2 defined as Fortlink Split interface It's all working fine if on both firewalls X1 is active. However, after a reboot or HA failover, I sometimes encounter the following situation:- Active Fortigate - X1 is active on the Fortlink- passiv Fortigate - X2 is active on the Fortilink In this situation several clients are not reachable until I manual unplugg passive fortigate X2 so that it switches to X1 Fortigates are an 7.4.9 and FortiSwitch 7.6.6

Hello team,What is the benefit of the active probing feature while Fortigae can just wait for the server certificate in response to the original client hello.What is the need of actively probe the certificate in a new connection originating from Fortigate? https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-FortiGate-does-TLS-Active-Probe/ta-p/393239 

Post Content:Hello Fortinet Team,I am using FortiNAC posture assessment to check for Sophos Endpoint on client devices.Expected behavior:If Sophos is installed → posture scan should pass and device should be allowed on the network.Actual behavior:Even though Sophos Endpoint is installed and running on the client, the posture scan fails when using the dissolvable agent. FortiNAC reports Sophos as not detected.Environment details:FortiNAC version: [your version]Endpoint OS: Windows [10/11]Sophos product: [Sophos Endpoint / Intercept X / Central]Posture method: Dissolvable AgentTroubleshooting done:Verified Sophos service is runningConfirmed Sophos is visible in Programs & FeaturesPosture policy configured for Sophos AVIssue persists on multiple devicesQuestions:Is the dissolvable agent fully supported for detecting Sophos Endpoint?Are there known limitations with Sophos Tamper Protection?Is persistent agent required for reliable Sophos detection?Are custom registry checks recommended

I am experiencing an issue while trying to add a FortiGate (v7.0.12) to FortiManager (v7.4.8) in an EVE-NG lab environment using trial VMs.The FortiGate fails during the registration/enrollment process with FortiManager (certificate authentication / connection issue).Thank you for your support.

Does anyone know if the Maximize Bandwidth SLA option is supported in the SD-WAN rules when connecting across tunnels to Zscaler Internet Access (ZIA) Cloud on-ramp? The documentation I've found recommends using Link-Cost for failover between a primary vpn tunnel across ISP1 and a secondary vpn across ISP2. Each to a separate Zscaler Public Edge. I'm trying to build 4 tunnels, 2 from each ISP to each Public Edge, and load balance across all 4. Has anyone attempted this? 

Hi allIm trying to find a way to get connection count to a real machine within the loadbalancer pool.My platform is FortiADC v8.0.1The closest method listed in the guides is /slb/all_vs_status_last_2but this gives 404 page not found Any suggestions?