Fortinet Community

Hi guys, I am trying to push LDAP settings to two firewalls that are using same LDAP server but with different service account. I use per-device mapping to add two FortiGate with different username and password for LDAP binding account but when I push it to firewall, although it get the right username but password is not being pushed right and as a result account get locked in AD. Anyone can guide how can i do this? Do i need to have same password for both account? My understanding is that FMG should push the settings in per-device mapping.  

Hi all, Do Fortigate Firewalls support "BGP peer groups" by sharing the same outbound policies and setting instead of configuring each BGP neighbor individually and updates replicated to all peer group members. I can't seem to find any docs or commands that support BGP peer group config on a Fortigate like a Cisco or Arista Switch.  

I am attempting to call the /api/v1/vulnerabilities/index endpoint in FortiClient EMS to retrieve vulnerability details. However, I do not see this endpoint listed in the official API documentation(https://fndn.fortinet.net/index.php?/fortiapi/48-forticlient-ems/5282/48/Endpoints/).Is there a specific reason why this endpoint is not exposed in the API documentation? Additionally, could you please confirm whether it is safe to use this endpoint, and whether there are any risks or compatibility concerns with future releases?

Despite VLAN switching being active for some reason FortiNAC is not sending 3799 CoA requests on any of my wired switches (I have no issues with access points, 3799 requests are being sent there). If I connect the same device wirelessly, it will do this. For example, when a host connects to switch X, it assigns to the registered VLAN and 5-10 seconds later recognizes by the DPR. However unless I manually disable and enable the port, the host doesn't switch to the appropriate VLAN. Even when I manually change the role of host X, it doesn't detect this as a new activity and doesn't send a 3799 request. As I mentioned, this issue only occurs with the switches, specifically Aruba switches (both old and new generation). When I check the logs, I can see that FortiNAC isn’t even sending the 3799 CoA request. What could be the issue?   

The customer currently has approximately 50k concurrent explicit proxy users, and we are trying to identify a suitable FortiGate/FortiProxy model or scalable architecture to support this requirement.Unfortunately, we haven’t been able to find publicly available documentation that clearly states the maximum supported value for “Concurrent Explicit Proxy Users” on most FortiGate models.So far, we have confirmed the following:FortiProxy 4000G – 60k users (from published specifications)FortiGate 901G – 32k users (observed from device login)FortiGate 1001F – 32k users (observed from device login)Could anyone please confirm the supported values for the following models?FortiGate 1800FFortiGate 2600FFortiGate 3000FIf you have access to the device, the value can be found under:System → Global Resources → User & Device → Default Maximum Any insights or confirmations would be greatly appreciated. Thank you.

Hello , My NSE7 enterprise firewall is scheduled for tomorrow, any advices or ideas that could help meThanks in advance

Friends, I have a question. I have a FortiGate 7.4.9. I need to enable two-factor authentication for a new SSL VPN user. This user is from Active Directory. However, when I go to the Authentication Type settings, the "email-based two-factor authentication" option isn't displayed. This is strange because I have several existing Active Directory users with this option enabled. I've searched online and it seems I can only enable it for local users, but I can't find a way to enable it for Active Directory users. Could you please help me? 

 Hello Team, as per my admin team, I needed to install VPN only package, which I installed. Below is my output, in first you can see beginig of output, where is saying some file is missing.At my current company, we are using Forti vpn-only client, I don't have any experience with Forti, as I am working as DevOps engineer, in past I used local created user in forti device, but now they are removed and I need to use SSO, which is NOT working for me. I am using xUbuntu 24.04.Please assist. forticlient gui ERROR: Failed to add module "FortiClient ZTNA". Probable cause : "/opt/forticlient/libcertd.so: cannot open shared object file: No such file or directory". 15:25:23.076 › Failed to add libcertd.so: Error: Command failed: /usr/bin/modutil -add "FortiClient ZTNA" -dbdir sql:/home/nedeljko-scepanovic/.pki/nssdb -libfile /opt/forticlient/libcertd.so -force ERROR: Failed to add module "FortiClient ZTNA". Probable cause : "/opt/forticlient/libcertd.so: cannot open shared object file:

Hello , My NSE7 enterprise firewall is scheduled for tomorrow, any advices or ideas that could help meThanks in advance

Hi Fortinet community, I was reading the Delayed remediation | FortiNAC-F 7.6.0 | Fortinet Document LibraryBut in my testing, the dissolvable agent keeps dissolved after scanning even though the host status is Pending At Risk. Am I doing correctly? I am expecting the agent will stay in the host until user has resolved the issues.FortiNAC

Hi Team, I have two ISP at branch and a single ISP at Hub. I have configured dialup tunnel on hub and static tunnel on branch side.  The issue here which i am facing is that only one tunnel is coming up at a time only, the second tunnel phase1 only showing up at branch side. Is it the expected behavior or not and if, it is expected then is there any way to make both the tunnels up.  Kindly help here, below is the snapshot of the tunnels.                

Hi team, is there any fortigate API exist to get predefined application list and their default ports.for example for thishttps://fortiguard.fortinet.com/appcontrol/59759application name is Spacely.AI_Post and default port is TCP/80, TCP/443 and UDP/443.I want an api that provides either application name or id and their respective default ports.

Hi,I have created on Fortigate SSID with WPA3 Enterprise Only, on the client (Windows 11) is created manually wifi profile with security type 'WPA3 - Enterprise' and encryption type 'AES'.The client wifi card Intel AX201 support such authentications:netsh wlan show drivers Interface name: Wi-Fi Driver : Intel(R) Wi-Fi 6 AX201 160MHz Vendor : Intel Corporation Provider : Intel Date : 2025-01-02 Version : 23.110.0.5 INF file : oem163.inf Type : Native Wi-Fi Driver Radio types supported : 802.11b 802.11g 802.11n 802.11a 802.11ac 802.11ax FIPS 140-2 mode supported : Yes 802.11w Management Frame Protection supported : Yes Hosted network supported : No Authentication and cipher supported in infrastructure mode: Open None Open

Our connectivity provider gives us a VPN using Forticlient VPN, which has been fine until the 7.4.3 release. We've had users having issues all over the place, from the connection dropping soon as it connects, to users being prompted for admin rights to connect. I'm on 7.4.3 Hotfix and have none of these issues but a number of the aforementioned reports are on that version as well........All on Windows 11 managed by Intune.Anyone experiencing this ? Any quick fix ? Have raised an issue with our provider but not expecting a fix in a hurry and they'll probably need to go back to Fortinet.

I am trying to install a FortiClient (VPN only) FortiClient I have downloaded the instalation file after filling the form https://www.fortinet.com/support/product-downloads#download-vpn-only I have selected the Windows version.When I launch the instalation file, it downloads image, unpack it, but then nothing happens.  

After upgrading Fortinet, all SSL requests are being blocked. I would like to know if there are any adjustments that need to be made to my firewall.   FortiGuard

Hello,I have the following setup and would like your clarification.We have a virtual FortiGate firewall deployed, with multiple services running behind it. In case this virtual machine experiences an issue or goes down, we would like to have a backup / failover–like solution, similar to what we normally implement with hardware FortiGate HA.Is it possible to implement such a setup using two virtual FortiGate instances?Additionally, I have a licensing-related question. We currently have only one license purchased for a single virtual FortiGate instance.In a hypothetical scenario where:the primary FortiGate has an issue, anda secondary FortiGate VM exists but is powered off,would it be possible to use the same license on the secondary VM?More specifically:If the primary FortiGate fails, can traffic automatically fail over to the secondary VM?Or is it mandatory to configure HA, which would require purchasing an additional license?As far as I understand, FortiGate licenses are tied to the s

In my environment, a FortiGate currently manages both distribution and access FortiSwitches via FortiLink. I need to replace the distribution switches with a different model. If I create a new FortiLink interface for the new distribution switches and then connect the existing access switches to this new FortiLink, will the FortiGate preserve their configuration and policies?

  Dear, There are some difficulties in importing YouTube access data for the model of the video that you claim to use. Please note that the set of children currently in use is deleted from the complete URL. This is how you compare the set of kids and capture the result. No account of the analysis (Registro Detalhado de Navegação do Usuário), it is possible to view correctly the details of the site and of the application for the same day and local. Can you check the group of children to determine whether you have the correct motivation to confirm the access details and the correct category? This group of children has been transferred to the initial implementation of the product and has not been modified. Two years passed, and we noticed this issue. Credit that this is also possible if it affects other access records without any relation.   Reference: Relatório do Analisador Padrão (Registro Detalhado de Navegação do Usuário) The FortiGate also contains various access registra

Hello, I'm getting the "Failed to connect to the update server" error when trying to install FortiClient VPN. I tried to install it on multiple networks but still the same.I saw about an offline installer but I can't acces it as I am a free user. Is there any solution?...Thank you for your help !

Hi all,I was thinking about upgrading to 7.4.9 but I’m seeing a few threads and posts about issues with IPsec tunnels. Is there a particular configuration type which are mainly impacted? We have many tunnels with third party vendors. Will 7.4.9 cause issues with them? Is there a patch or fix for it?I checked 7.4.8 but it’s got a lot of vulnerabilities which are patched in 7.4.9, so I’m stuck on my decision.Thoughts?Thanks.

Hi Community,We received a new FG1801F firewall for activation and encountered issues with the MGMT1 & MGMT2 Port down. - We tried to add admin & trusted host IP address but still not working - Only access to configure is via Putty - When we plug in on the RJ45 Ports got traffic. Please advise as only the MGMT1/MGMT2 Ports are down. We cannot connect HTTPS & ping the default MGMT1 /MGMT2 IP 192.168.1.99 & 192.168.2.99 from our laptop 

I purchased a used 570i and whomever the prior owner was, changed the admin password from ADMIN or 25646 to something unknown. I obviously can’t hard reset it to get it to provision to my system. Is there a way to hard reset the phone and erase everything without knowing what that admin password is? Thanks.

Set up Forticloud MFA through Yubico app in the usual way by scanning the QR code and thought that it worked but when I tried to sign in today the actual code in the authenticator app is grayed out. Is anyone else using this method and how did you get it to work?