Fortinet Community

Hello, I'm getting the "Failed to connect to the update server" error when trying to install FortiClient VPN. I tried to install it on multiple networks but still the same.I saw about an offline installer but I can't acces it as I am a free user. Is there any solution?...Thank you for your help !

Hi all,I was thinking about upgrading to 7.4.9 but I’m seeing a few threads and posts about issues with IPsec tunnels. Is there a particular configuration type which are mainly impacted? We have many tunnels with third party vendors. Will 7.4.9 cause issues with them? Is there a patch or fix for it?I checked 7.4.8 but it’s got a lot of vulnerabilities which are patched in 7.4.9, so I’m stuck on my decision.Thoughts?Thanks.

Hi Community,We received a new FG1801F firewall for activation and encountered issues with the MGMT1 & MGMT2 Port down. - We tried to add admin & trusted host IP address but still not working - Only access to configure is via Putty - When we plug in on the RJ45 Ports got traffic. Please advise as only the MGMT1/MGMT2 Ports are down. We cannot connect HTTPS & ping the default MGMT1 /MGMT2 IP 192.168.1.99 & 192.168.2.99 from our laptop 

I purchased a used 570i and whomever the prior owner was, changed the admin password from ADMIN or 25646 to something unknown. I obviously can’t hard reset it to get it to provision to my system. Is there a way to hard reset the phone and erase everything without knowing what that admin password is? Thanks.

Set up Forticloud MFA through Yubico app in the usual way by scanning the QR code and thought that it worked but when I tried to sign in today the actual code in the authenticator app is grayed out. Is anyone else using this method and how did you get it to work?

Hi, Sorry if the following question is a stupid one. I recently took over the management of our FortiGate's, so all of this is pretty new to me.  We currently have a hub and spoke architecture with our HQ handling the connections between all of our remote sites. We have site-to-site IPSec VPN connections with each of our branch offices. Our HQ has two individual ISP links. We use OSFP as our primary routing protocol. We've recently been experiencing an issue with one of the ISP links in our HQ and that is impacting some of these site-to-site connections. I wanted to introduce redundancy, establishing IPSec connections on both the HQ's WAN interfaces for each branch and I know our previous administrator was looking into implementing IPSec VPN with SDWAN to achieve this. Each branch would have connections back to the HQ on both WAN1 and WAN2 interfaces, so if either is disrupted, the branch site would not lose access. It should be noted that some sites

Having an issue I can't figure out and want to see if anyone else has experienced this same issue. I am trying to create an ldap profile in FortiManager to test using OU groups or specific users in firewall policies. Current version of FMG and FGT are 7.4.8. In FMG, Under policy and objects/user & authentication, I am creating the ldap profile and saving (no where to test query or creds). I then go to create an ldap user under user definition and as soon as I select the ldap server I get an operation error message. Doing debugs, it comes back as invalid creds. I have verified the creds were correct many times but still the same. I am also able to create the ldap server on FMG under system settings / remote authentication and the settings work everytime. I also can replicate the same configuration directly on the firewall successfully. Anyone else run into similar issues and find a work around? The only workaround I can think of is to create the ldap server on the FGT and then

HiI continue to try to configure my first FortiGate. After admin login, the GUI hang on register  I think it's beacause it has no internet access.So I tried to configure on CLI.First WAN : edit "port1" set vdom "root" set ip 192.168.99.191 255.255.255.0 set type physical set alias "WAN" set role wan set snmp-index 3 next Then routeconfig router static edit 1 set gateway 192.168.99.254 set device "port1" next endThen DNSconfig system dns set primary X.X.X.X set secondary X.X.X.X endThen firewall policyconfig firewall policy edit 1 set name "LAN_to_WAN" set srcintf "any" set dstintf "port1" set action accept set srcaddr "all" set dstaddr "all" set schedule "always" set service "ALL" set nat enable next end What have I missed :) ?RegardsMarc

We're currently using a FortiGate 201E (v7.2.12), and encountering an issue with FortiClient VPN-only version 7.4.10.0196 on iPad. When connecting:Repeated "Insufficient credential" error, even with valid 2FA tokenEventually shows "Unable to connect", VPN session endsAfter multiple retries, VPN connects successfully Issue only occurs on iPad, not Windows or Android.Looking for any insight or similar experience — would appreciate any help!

HiI've just recieved my FortiGate 200G.I am following the quickstart guide. It says to connect WAN port. But there is no WAN port So I have connected a PC to the MGMT. I manage to acces the GUI.But It wants to connect to FortiCloud. But no wan port plugged = no internet access. So I tried console CLIhttps://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-initial-configuration/ta-p/283529 config system interface edit port1 set ip 192.168.99.99 255.255.255.0 command parse error before 'ip' Command fail. Return code -61 So I am a little lost.Can you help ? Where can I find a Quickstart guide updated ?RegardsMarc 

We've been having issues getting a SiriusXM player to stream audio when connected to our network and Fortigate 100F and 200F firewalls running 7.2.12 build 1761 firmware. We have created a Firewall Policy for the device that Allows all traffic, with security profiles removed and no SSL inspection. DNS Helper has also been disabled for diagnostic purposes, and we are using external DNS (8.8.4.4 and 1.1.1.1). When checking Forward Traffic logs, we see no traffic being Denied, but the player will not stream audio. We verified the traffic for the device is using the Policy that has been created for it. When connecting the device to a wireless hotspot, the audio streams properly. Below is a sample flow debug:id=65308 trace_id=1 func=print_pkt_detail line=5813 msg="vd-root:0 received a packet(proto=6, x.x.x.x:35366->34.215.0.215:443) tun_id=0.0.0.0 from VLANx. flag [.], seq 288633703, ack 3087288262, win 1503"id=65308 trace_id=1 func=resolve_ip_tuple_fast line=5901 msg="Find an exist

Hello everyone,We are currently running 7.4.7 on all our Fortigates (around 35 of them). The recommended version Fortinet has listed is 7.4.8 but we are considering jumping to 7.6.Are there anyone here running v7.6 and especially v7.6.5 in their production network? What’s your experience with the version? Any issues you have faced? I see it being a mature version as well. Some have mentioned that it is ”still too early” for 7.6 in a production environment but the 7.6 has now been out there for over a year now.

I have an on prem AD synced to Entra - my EMS cloud is connected and the Entra domain is imported over. I have configured SAML so when the client is pushed to my contractors who are non-domain joined devices, they will be prompted for credentials before connecting to EMS. The SAML redirect is occurring, but I am receiving an invalid response error after attempted log in. Any Ideas? EMS client packager version 7.4 patch 7.4.5   

Hi community, I have bought a used Fortigate 60E to work with SD-WAN. The port WAN2 not working (no sign of life) but my problem is the port WAN1 because it's working only Fast. My service provider router is Giga and my link is 500Mb. What is the problem? I count with your support Addtionals Informations:- The two WAN ports are 10/100/1000;- My firewall is up to date - version 7.0.12;- Memory and CPU used is OK;- When i tested the same cable on another port, it's works Giga (Today, it's my workaround);- When i forced the speed port to 1000, it's stop work; FortiGate#Fortigate60E

Maybe I'm missing something, but with the conversion from the old Fortinet forums to this new community software, is there no longer any categorization so you can simply read through threads on a topic of interest to see if any apply to you?  I used to regularly skim the product-specific sub forums for the Fortinet hardware/software we use to see if there were posts that would be of interest for either security or performance/optimization concerns.  I can't see any way to do that now, it's just an endless news feed style interface that takes up so much screen real estate you have to page forward every few posts, making it impossible to ever read through it.  There are literally 14,000 pages of content with four or six posts per page. I see where I can switch to threaded, and if I click into the right post from a random person first, I can then try to backtrack to a category that seems to exist, but still get this inflated post listing where I have to see the first p

Anyone using FortiTester and can confirm / deny if test case configuration is not shared among users? If I create test case configuration and another user logs in they don't see my created configuration, and neither do I see theirs. These are remote (RADIUS) users.

Hi to all,I noticed that on a L7 Radius Application profile one can switch on "Dynamic Auth" option a configure a destination port for COA.I am wondering if such a configuration option  could be useful to handle COA "back requests " from a node of the radius pool towards a radius client. Suppose that a on the network switch or a wireless controller the ip address of the Radius VIP is both configured as AAA server and COA authorized ip address. I was wondering whether the "Dynamic Auth" switch purpose was to apply source nat to COA requests coming from any of the radius servers in the pool .   On our current F5 bigip LTM I use a forwarding virtual ip address listening on the COA port to source nat COA requests from the radius servers so that  Radius Clinet receives COA packests having the radius VIP as source address.BRMM

“Is it possible to run FortiLink between a FortiGate and a switch over a Wi‑Fi bridge using two antennas, such as Ubiquiti Loco M5? Are there any known limitations or issues with stability? Thank you in advance for any advice.

Hi,we set up an ADVPN Hub and Spoke VPN where:HUB are 2 Fortigate 2600F in Active-Passive HA configurationSpokes are Fortigate 60FFirmware is 7.4.9 version The VPN works fine, anyway we have problems when some bad events occurs. For example if power goes off or the Hub lost some connectivity and HA switch the primary node, all IPSEC tunnels hangs (they are up but not working)The only way to resume them is to restart every tunnel spoke side (waiting at least 10 seconds between down and up) Does exist a way to avoid this situation? Why the HA switch causes the hanging? Thanks

 With below SDWAN rule, will PC in Rule4 use rule1 if internet on port2 is down? 

BonjourJ'active et je désactive des utilisateurs en fonction d'un process interne. Je souhaiterai pouvoir via une commande réinitialiser les autorisations de connexion. Dans l'état actuel si un utilisateur est "enable" et se connecte, sa connexion reste active même si je passe son état à "disable" ...Auriez-vous une solution ?J'ai vu cette commande "diagnose firewall iprope resetauth" mais elle me renvoie une erreur "parse error before 'resetauth' " Merci.

Hi,I’m having an issue with a Yeastar S20 IPPBX behind a FortiGate in a double NAT setup, and I’m looking for help.The FortiGate is behind an ISP modem (not in bridge mode). The Yeastar is behind the FortiGate, and SIP trunks connect it to other Yeastar systems on remote sites.When the Yeastar is connected directly behind the ISP modem (without the FortiGate), the SIP trunks work fine.Once the Yeastar is placed behind the FortiGate, the trunks no longer establish, even though:all required SIP/RTP ports are opened,VIPs and firewall policies are correctly configured,ports are forwarded on both the ISP modem and the FortiGate.I suspect the issue is related to double NAT or SIP/NAT handling on the FortiGate or ISP modem.If anyone has experience with Yeastar + FortiGate + SIP in NAT environments, I would really appreciate any guidance or advice on how to make this work properly.Thanks in advance

Hello everyone, I have a question to which I was not able to find an answer yet.We have a SDWAN/ADVPN setup with one hub (vdom on a 400E) and about 80 spokes. For the hub we want to buy a new 200G, mainly because of the 10GB interfaces. I have found a couple of articles here about migrating a Fortigate to a new model and this article (346859) points out, that i have to add the new 200G to Fortimanager with the help of Forticonverter. Our SDWAN/ADVPN setup is a couple of years old (we started with 6.4) and I wonder if there is way to migrate the hub without breaking all the scripts.  Under VPN Manager -> IPSec VPN communities we have ADVPN-1, ADVPN-2 and ADVPN-3. Every ADVPN has  the same Fortigate with the "Hub"-role - and this is bound to the serial of the device.  I would like to replace this object with the new 200G.... Is there a document around, that shows how to do this?  Or do I need to create all the SDWAN/ADVPN stuff fr

We want to allow the following protocols between two physical ports with two mac addresses:"arp || stp || mdns || pn_rt || pn_io_device || pn_io || pn_dcp" (wireshark notation) With FortiOS 7.6.4 we have set the opmode to transparent and created a firewall policy to allow 'ALL' services, but that only lets the first protocols/services (arp || stp || mdns ) through, but blocks the rest (pn_*). Is it possible to fix this in any way, e.g. by creating an IPS Signature for Profinet (--ethertype 0x8892) and adding that to the policy?The test setup:    config firewall policy        edit 2            set name "Allow all MACs"            set uuid 6e874ff8-eaee-51f0-5cca-7370b58c116a            set srcintf "LAN2 and LAN3"            set dstintf "LAN2 and LAN3"            set action accept  &nbs

Hi everyone, Are there FortiWeb plans for routing protocol support bgp support? Fortigate and FortiWeb have full routing protocol support but not FortiWeb. For example this can be really useful when integrating with kubernetes (k8s) cluster as Calico or Cilium CNI can send PodCIRD through BGP as a way to advertise not the Node-Port service but Cluster-IP without Vxlan tunnels. https://docs.fortinet.com/document/fortiweb/7.6.0/ingress-controller-2-0-0-installation-guide/609720/kubernetes-ingress https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/d19c0748-b069-11f0-b8e9-a6060d4c736b/FortiADC_Kubernetes_Controller_3.0.0.pdf