Fortinet Community

I've noticed an extremely strange thing upon upgrading some test FortiGates to the new version 7.6.7: the upgrade goes fine, and the FortiGate is happily online and is routing/firewalling-just fine. However, when trying to load the GUI it is just a blank page.I can see the little favicon loading for the FortiGate login page, but its just blank otherwise. I can SSH in just fine, so that is good. I do not see any settings reset in global settings, and strangely going to the http login instead of https sometimes works (I have https redirect turned on).As the FortiGate seems to be perfectly fine otherwise, I thought I'd see if anyone else has experienced this?Also I have tried multiple browsers with privacy/incognito mode on, so I don't think it is a cache issue.

How can we prevent a single workstation from causing an organization-wide DNS outage through FortiGate IPS quarantine?We recently experienced an incident where FortiGate IPS detected DNS.Pointer.Loop traffic originating from workstation. The automated quarantine action affected both of our DNS/Domain Controller servers, resulting in a DNS connectivity outage across the organization.We manually unbanned the servers, which restored services, and traced the related DNS activity back to the originating workstation.Our concern is that a single endpoint, whether due to malware, misconfiguration, or a user changing network settings, could trigger an automated security response that impacts critical infrastructure.What would be the recommended FortiGate configuration or best practice to prevent this from happening again?

Hi,i had an working PPPoE IPv6 internet connection but now i noticed that this isn’t working. I don’t getting an IP address.I can’t say sice when and after what change this happen, perhaps it can also be an probem on the providers side.This is the WAN Interface config:config system interface edit "FTTH" set vdom "root" set mode pppoe set allowaccess ping set type redundant set member "port15" set lldp-reception disable set estimated-upstream-bandwidth 1000000 set estimated-downstream-bandwidth 1000000 set monitor-bandwidth enable set role wan set snmp-index 22 config ipv6 set ip6-mode pppoe set ip6-allowaccess ping set dhcp6-prefix-delegation enable set autoconf enable config dhcp6-iapd-list edit 53 set prefix-hint xxxx:xxxx:0:200::/56 next end end set username user

Hello, I apologize in advance if this sounds like a stupid question. I passed the NSE4 Certification Exam on June 18, 2024. I very recently heard that my certification would run out of validity if it’s 2 years old. I have to take the NSE5 Certification Exam, as I was unable to take it before, but I am unsure if my NSE4 Certification is still valid. Please let me know and thanks for your help!

Hey, currently learning for my certification and got really stuck on this question: So why would Change Inspection mode to Flow-Based - as the Training Portal says - be the right answer here? As i understood from the Study Guide the Application Control relys on the IPS Engine and will always work in Flow-based even if the Firewall Policy has Proxy-based Inspection configured. So it should not matter which Inspection-Mode is configured from my understanding. As the phrase from the study guide says:  Also, i tried to reproduce it on my lab. Looked for some Google Application which falls under Excessive Bandwith, in this scenario I choosed Google.Maps. Put this object into Application and Filter Overrides with Prio 2 and Action Monitor and above the Excessive-Bandwith Filter with Prio 1 and Action Block. Google Maps got blocked. When moving Google-Maps to Prio 1 the connection worked. So is this maybe wrong in the Training Portal? Or where am I thinking wrong? Rea

Hello Everyone, I would like to test my knowledge in NSE 4 - 7 via the use of past exam papers. Is there a repository I can connect to? 

How to configure an event handlers that alert when config change happened after working hours in fortianalyzer 7.6.7

Hi,I have a SonicWall NSA (site A) connected to Fortigate (site B) with IPSec Tunnel. Site A sends ping probes over the tunnel interface to site B's WAN IP. The Sonicwall configures implicit probes when configurating the IPSec tunnels in virtual SD-WAN configuration. Debug flow revealed "reverse path check fail, drop" due to strict RPF, so I configured a DNAT policy with Virtual IP as below. This got me passed the RPF check but when enabling below policy the CLI command does not responds normally for some reasons so I must be doing something wrong. Any suggestions? config firewall vipedit "vpn-hub-probe-vip"set uuid 3e958d92-4f6b-51f0-67e8-xxxset extip 217.91.x.x                         (local WAN Interface IP)set mappedip "192.168.10.1"           (LAN interface IP)set extintf "any"nextend Firewall Policyedit 24set status disableset name "TEST"set uuid 20025a9c-4f6e-51f0-1a3d-x

Hello everyone,We are experiencing a minor but frustrating issue with our FortiAuthenticator, and I would appreciate some guidance.Our FortiAuthenticator is configured to synchronize users from Active Directory (AD/LDAP). Under Synchronization Attributes, we have selected Local User for the Sync as option.As a result, whenever a new user is created in AD and synchronized with FortiAuthenticator, the system automatically generates a unique random password and sends it to the user via email.Our goal is to disable this automatic password notification email without affecting the existing AD synchronization or user authentication process.I have searched through the documentation and configuration settings but haven't found a way to disable this specific email notification.The only workaround I have identified so far is modifying the following Replacement Message:Admin Set Random Password for User Email MessageHowever, this would only change the email content rather than prevent the email fr

How to fix analytic and archive( actual days)if i set the fortiananlyzer system time after 2 weeks from the time the logs sent to fortianalyzer

firewall Remote-IPsecVPN not able to get ping WAN ip,rest of the all services is okay including router IP.which is same series. 

Hi everyone,Is anyone managing FortiExtender devices through FortiGate?I currently have a FortiExtender managed by a FortiGate, and I'm trying to monitor it using Zabbix via SNMP, with the FortiGate acting as the monitoring point.Has anyone successfully implemented this setup? Is it possible to retrieve FortiExtender metrics through the FortiGate using SNMP?Any advice or experience would be greatly appreciated!Thanks in advance!

I’m on a FortiGate 61F version 7.4.11 and FortiClient Windows version 7.4.3.I am trying to set up IPSec VPN for my remote users so that I can upgrade the FortiGate (knowing that SSL is no longer supported).  I’m running into trouble with Authentication when it comes to PSK vs Peer ID from dialup group.  What I want is for the tunnel to accept users from a specific local user group on the FortiGate.  My problem is that if I change the Peer Options to Peer ID from dialup group, the Pre-shared Key box goes away.  That’s then a problem on FortiClient since I can't leave the PSK box blank.  Any help on how to solve this?  Thank you! Side Note: I have an IPSec VPN for remote users set up on a different box running 7.6.6 doing exactly what I want.  There are more options for Authentication on that version and I can have a PSK and the tell it to use user group I want.

I configured Multi-Connect in the endpoint profile so that users could automatically connect to two tunnels (SASE and On-Premise). I entered the required information, but the tunnel isn't establishing. Has anyone else experienced this?What I found curious is that in FortiSASE, there's no option to enter the Phase 1 and Phase 2 tunnel information.

Hello Team,Our FortiClient EMS uses a manually uploaded Let’s Encrypt server certificate containing two DNS SANs.Certificate renewal is already automated through our Salt master. After each renewal, we currently download the certificate and manually upload and apply it in EMS.We want to automate only the certificate deployment and activation steps while keeping certificate renewal managed by Salt. Or happy explore option auto renwal in EMS with two DNS SANs.Please provide the supported API or CLI procedure for importing the renewed certificate, matching private key, and intermediate chain, and assigning it to the applicable Web server and Endpoint control services.Please also confirm the required authentication and permissions, any service restart requirements, and whether this operation can run unattended on our EMS version. Thanks,

FortiGate-VM64-HV Trial Issue on Hyper-VPlatform:- Hyper-V (Server 2019) Gen 1 virtual machine- FortiGate-VM64-HV v8.0.1 build0245 (GA.F)- Trial LicenseIssue:The trial license activation completed successfully and the CLI shows "License Status: Valid". However, after logging into the web GUI, I logged out immediately.CLI access works normally.Network Connectivity:- Can ping 8.8.8.8 successfully- Default route configured via 192.168.1.254 on port1Relevant Output:FGT-VM64-HV-NZVQOU # get system statusVersion: FortiGate-VM64-HV v8.0.1 build0245 (GA.F)First GA patch build date: 260421Current Security Level: HighFirmware Signature: certifiedLicense Status: ValidVM Resources: 1 CPU/1 allowed, 1694 MB RAM/2048 MB allowedHostname: FGT-VM64-HV-NZVQOUOperation Mode: NATCurrent virtual domain: rootMax number of virtual domains: 10Virtual domains status: 1 in NAT mode, 0 in TP modeCurrent HA mode: standaloneBranch point: 0245Release Version Information: GAFortiOS x86-64: YesRouting Table:S* 0.0.0.

Hello Fortinet Community,I have installed FortiGate-VM64 FortiOS 8.0.0 in my EVE-NG lab environment.The FortiGate VM boots normally, and I am able to access the GUI login page.Current IssueI can successfully enter my credentials and the GUI appears to authenticate successfully. However, immediately after login, I am logged out and redirected back to the login page.In other words:Open FortiGate GUI. Enter username and password. Authentication appears successful. GUI starts to load. Immediately after that, the session is terminated and I am returned to the login screen.EnvironmentPlatform: EVE-NG Device: FortiGate-VM64 FortiOS: 8.0.0 Build: 0167 Image: FGT_VM64_KVM-v8.0.0.F-build0167-FORTINET.out.kvm.zip Deployment: KVM/EVE-NGLicense StatusThe FortiGate license is showing Up to Date / Active, so there does not appear to be an obvious licensing issue.What I have checkedFortiGate VM is booting normally. GUI is reachable. Username/password are accepted. License status shows up to date. The

Ladies and Gents,I have 2 FortiSwitch 224D and would like to connect it to a FGT 40F, what is the recommended configuration for this setup?Thanks in advanced!Alfred

Fortigate firewall didn’t connect by remote users when using remote ipsec vpn 7.6.6 OS. But client getting all other services after created policy remote user interface to wan. Please help me if any other solution for it. I follow the below link remote access vpn for AD users through LDAP server  

Can anyone provide any guidelines for remote ipsec VPN with fortigate 7.6.6 os & its integrate with LDAP local user many more members ? 

Hi guys,I have FortiGate VM 7.6.6 on windows 10 with Hyper V &  FortiSwitch 124F 7.6.6I configured Software switch with Fortilink and following this KBi have enabled MAC spoofing on the Hyper V VM networkso when I connect the Fortiswitch to my computer its receiving DHCP, then I authorize  it on the FortiGateat first it seems that Fortilink is up and after a few seconds its down and I also no longer have ping to the Fortiswitch this is my interface settings config system switch-interface    edit "FortiLink2"        set vdom "root"        set member "port2"    nextendconfig system interface    edit "FortiLink2"        set vdom "root"        set fortilink enable        set ip 10.200.0.1 255.255.255.0        set allowaccess ping fabric        set type switch        set lldp-reception enable        set lldp-transmission enable        set snmp-index 15        set switch-controller-nac "FortiLink2"        set switch-controller-dynamic "FortiLink2"    nextendI would appreciate it if someo

Hi everyone,we using a Fortigate G900 with v7.6.7 as explicit proxy.Since a couple of weeks, we have the problem that, when using Firefox, we can’t use the Google Search.After we type anything in the search bar, we get the following error:502 unknown content-encodingThe webserver reported that an error occurred while trying to access the website. Please return to the previous page.URL     https://www.google.com/search?client=firefox-b-d&q=fortigate Other Websites / Search-Engines with Firefox are working fine. With Edge or Chrome Browser Google works as well.Have somebody an idea? Regards, Michel

Is it possible to Gre over Dynamic IPsec between Fortigate & mikrotik.Can any one give me configuration sample for gre over dynamic ipsec for fortigate firewall?

I integrated my Cisco C1300 to NAC and all is working fine except for CoA. When i manually execute send CoA then in the switch i got message ‘13-Oct-2026 13:37:21 %RADIUS-I-CoAREJECT: CoA Request from 10.10.10.9 rejected. Reason: Missing NAS identification attribute’I try add NAS-Identifier in Radius Attribut with value %AUTH%, %ACCESS_VALUE”, %SYSTEM% and %ACCT% with no success. Anyone know why?Same radius attribute is working fine for Cisco Catalyst switch even in the radius attribute no NAS-Identifier. 

Hello,I have a new setup with one Fortigate 70g and 2 FortiAP FAP-243K.The Fortigate is configured in Transparent mode and evreything with a fixed ip in the same subnet/vlan. Everything is on the latest firmware.When connected on 2 ports of the Fortigate, the 2 AP are working perfectly (Bridge mode SSID) but when I try to chain the second AP on the lan port 2 of the first AP it appears in the LDDP but never come online under the Managed FortiAP.Time is ok and synchronized. Une the AP profile the LAN port is set as Uplink and Bridge, Bridge to LAN. Does anybody have an idea please? ThanksFred