Solved

Hello, I faced a problem, that some time ago stopped working CoA DisconnectionIf I do: echo "User-Name=Username, Framed-IP-Address=10.0.0.X" | radclient -x name.fortidyndns.com:3799 disconnect SecretThe router receives packet on wan interface, i see it with packet capture tool on port 3799L4 Length 43 Checksum 0xb86aBut not performs anything. On LocalIn Policy I see that Custom Application UDP any 3799 AcceptOn corresponding wan port Radius accounting is enabled. Plus it was working few days ago. I suppose it could get broken after I put both wan interfaces into SD-WAN, but not sure. On 2nd device FG-61F there is same thing happens. Both have version 7.4.3config user radiusedit "Radius"set server "y.y.y.y"set secret Secretset nas-ip x.x.x.xset acct-interim-interval 60set radius-coa enableset auth-type papset acct-all-servers enableconfig accounting-serveredit 1set status enableset server "y.y.y.y"set secret Secretset

Hi, im using Fortigate 61F with firmware 7.4.3.so i create SSL VPN for some user. i try the user id and password before give to them and all works perfectly.but one user inform me that he cant login with current user id and password that i gave before. the error is permission denied (-455)i try again in my laptop using this credentials and it succssfully login. im checking the fortivpn software uninstall and install the new one but this problems still exist. please advise what should i do for check ? or maybe this user internet connection prohibited using VPN ?

Hello everyone! The following messages appear in the logs in the FortiAuthenticator every minute. That is, the FortiAuthenticator both loses and finds the remote LDAP server again. Please, tell me why this may occur. In the FortiAuthenticator CLI, diagnose netlink arp list, I see that the mac-address of  my ldap server is either in the STALE state or in the REACHEBLE state.  Could there be a problem with arp?Thanks

Our tenable is detecting that our Fortianalyzer VM is using a vulnerable version of openSSH " The version of OpenSSH installed on the remote host is prior to 9.3 " and we should upgrade to a 9.3 or later. is there any patch for that? 

Hi everyone, i hope i can be as clear as possible. I've been trying to copy this setting from an old firewall for the past few hours and i can't make it. One of my customers has a classic home subnet 192.168.1.0/24. (the mother of all broubles)They have a lot of SSLVPN users that must access this network. This creates a lot of overlapping since 192.168.1.0 is a very common subnet.On the old Firewall (Fortinet 40F) there was a setting that allowed a SSLVPN user to reach all addresses in the 192.168.1.0/24 subnet by using another subnet 172.16.0.0/24.All IP addresses would then be automatically forwarded to the corresponding server IP in subnet 192.168.1.0: Example: if I ping 172.16.0.19 i would actually ping 192.168.1.19 but it would also work if i pinged 192.168.1.19. This was made to avoid ip conflicts in case your home subnet is the same as the company, allowing you to still reach the remote servers using a subnet that is usually not present in home connectio

Hi guys  Im having difficulties with my captive portal within my guest interface. The Window shows up as expected, however it shows blank white and nothing shows up.  - I was wondering if i'd need to add an exception in my policy to show the default local login page- if there was a way i could locally test? - Or find the port or url?  Kind regardsAnt FortiGate 600Ev7.4.3 

In Service provider mode when we use Supervisor, Worker and Collector it is expected that windows agent communicate everything through collector.However FortiSEIM windows agent guide expects that agent will send logs to collector however status update communication would be done with supervisor. Is there any way to completely avoid role of supervisor in communication?It is not possible to allow supervisor access to all windows end points, because if we have collector in place which is acting as proxy why do windows agent need to communicate to supervisor?

I am running Ubuntu:Description: Ubuntu Noble Numbat (development branch)Release: 24.04Codename: nobleyes, I know it's a development branch, however it will be the next LTS in April 2024 (~2months left). ii forticlient 7.2.2.0753 amd64 FortiClient, now available on Linux, is an endpoint protection application that runs on Microsoft Windows, Mac OS X, iOS and Android. It is backed by antivirus engine and signatures from the well-known FortiGuard labs - www.fortiguard.com. FortiClient on Windows has won various third-party awards, such as from VB100, AV Comparatives and NSS. to get forticlient 7.2.2.0753 installed I had to installed the following packages dependencies:libdbusmenu-gtk4:amd64 18.10.20180917~bzr492+repack1-3ubuntu1libayatana-appindicator1:amd64 0.5.92-1libayatana-indicator7:amd64 0.9.3-1libnss3-tools:amd64 2:3.96.1-1 some comes from mantic and others from lunar. If I run /opt/forticlient/fortitray I got the following error every time I try to o

We issued reboot command to Worker node in fortiSIEM 7.1.3 ,phFortiInsightAI process still down and does not start on  phtools --restart phFortiInsightAIanyone who has encountered this ?

Good day all. Just some general knowledge. What is the quickest method to find history/logs blocked hyperlinks/urls in emails and who (source lan ip) clicked on them, i.e. the amount of hits on that url link in email body. We are doing a penetration test and the fortimail purchased has not been put online as that would be the perfect place for logs. I have not logged on to the fortigate box enough as yet to peruse. A cli and/or even gui method is fine. This will be very helpful for knowledge base.

HelloI need to know more about IPAM feature.What are the advantages to using IPAM in security fabric? And what are the scenarios the IPAM feature is used? 

Hello! About FortiEDR, my questions are,1) What is/ are the license types?2) Any integration with other Fortinet devices/ service for FortiEDR to work?3) Where can I download a image file of FortiEDR for Hyper-V/ VMware for a demo environment?

Hi!I have a public IPV4 pool. I use 3 independent vdoms with 1-1 public IP on their WAN interface. I just noticed that the fortigate regulary sending UDP 8014 packets from each WAN interface to the broadcast adress of the IP pool. On the WAN interfaces only ping is enabled for admin access.      If it is not enabled, why is it sending these packets? Is this a bug or a "hidden" feature? Device: FortiGate201FFirmware: v7.4.3 build2573 Thank you.

Hi Team, I have installed persistence agent on a client computer, and edited the windows registry to specify the server IP 10.0.200.247 (port1 interface of FortiNAC)Noted from capturing packets along the path, that the agent tries to imitate the tcp connection to 10.0.200.247 but no reply is coming back to any syn packet.attached also the TCP dump from the FortiNAC (attached testfile.pcap) showing syn packets from 172.16.14.27 to 10.0.200.247 but no syn-ack seen, also trying to telnet port 4568 fails from the client machine.The default route on FortNAC on port 1 is 10.0.200.1 (Fortigate) and from the same client machine I can access FortiNAC on its port1 ip for management on port 8443 and SSH . (but not port 4568) Tried to restart the service many times on both the client machine and the FortiNAC. Note, it is layer 3 deployement and the host is not in an isolation network.Also note that it is not an SSL or certificate related issue, because the TCP connection is failing

Hello everyone.Can you please explicate me what is it.In config-firewall-policy-edit:fixedport - Enable to prevent source NAT from changing a session's source port. If I understand correctly dport means destination port but explication says source port??? Is it right? Thank you.

GoodQuestion, if I have a FortiSiem FSM-2000F, is the external collector necessary? Supposed mind is all in one?If so, do I have to purchase an extra license? I have licenses for 500 devices and 5000 EPS. Thanks

HiI've recently started a new job. They have Fortinet firewalls and access points, although I don't have much experience with Fortinet. We have a Fortimanager and Fortianalyzer which manages some firewalls but we have a couple of sites where the Fortigate only connect to FortiAnalyzer but are not managed through Fortimanager. I have seen to the process to add a device to Fortimanager, which seems fairly straight forward. These sites have Fortigate HA pairs.  I have a couple of questions though:- If we add an existing standalone Fortigate cluster to Fortimanager, is there any outage for the users on those sites?- If the config is imported, what happens if there any duplicate objects? Appreciate any help provided. Many thanksRoy

I have an issue with VIPs on my FortiGate.I have a single public IP address. I need to configure two different VIPs with this one public IP address, each using different services and pointing to different internal IPs. I created the two VIPs and used them in two different firewall policies. However, the problem I'm facing is that all traffic is going through just one firewall policy (the one with the first VIP created), even though the client-initiated traffic does not match that firewall policy. Example:196.209.90.89:80 -> 172.16.0.1:80196.209.90.89:443 -> 172.16.0.1:443196.209.90.89:22 -> 192.168.1.1:22196.209.90.89:25 -> 192.168.1.1:25Can you help me resolve this issue?"

I have an FGT 60F at home and a friend has one at his home (total of 2). I want to play around and mess with SD-WAN, ADVPN, etc. between the two devices. Unfortunately, a license for FortiManager is way outside of my budget for something I'll just be using to learn with. Is there an option for someone who wants to learn the tools without having to shell out over $1k for 1 year of FMG? Are there easy eval licenses that don't require going through a major sales pitch? We both have valid support licenses, so are already paying each year to keep those updated. We just want to do some of the stuff via FMG that we would otherwise need to do manually as a way to learn (and probably start signing up for training classes, which again are a little high priced for just some home users looking to learn more).

I am setting up a firewall FG-60F in transparent mode and this is my config : Internet <-> LTE Router <-> Firewall <->  Local Switch1Upstream the firewall there is an LTE router, dowstream the firewall there is a network switch 1. I have the firewall configured in transparent mode with management IP 10.10.10.1 and the LTE router is 10.10.10.250. When I connect locally to the network, I can ping all the devices on my network and also I have internet. The problem is when I connect via the VPN. The VPN setup is as follows, the router has an OpenVPN tunnel to an external server, and I connect to this VPN server via an OpenVPN client. When I am on the VPN, I get assigned IP on the network 11.36.255.13, and at this point I can ping the firewall on 11.36.3.1 and the router on 11.36.3.250, but I cannot ping anything downstream the firewall (switch1 and other devices). If I remove the firewall from my network and I connect to via VPN, I can ping the switch1 on Ip 11.36.3.

Good day all,Does anyone know how to add like over 200 banned words to an existing antispam profile for a local protected domain and not the Fortimail system domain. I tried cli which works, but it only creates a NEW System antispam profile with the bulk banned words but not into my existing AS profile with same name. How can I edit an existing AS profile for a protected domain via CLI 

I bought a new fortiswitch 124E and now want to upgrade to the latest firmware. Seems that I don't have a license to do this. do I actually need to buy a license even to get the very first upgrade. AND does not seem to have a button to register the switch to my fortigate account.  Please advisethanksLes

I need some help with importing bulk Mac Addresses to either the Addresses under Policy&Objects/Addresses using a csv file. I have created a group where I would like the address to be imported to. It's a Fortigate 200F

Hi. I want ask about IP address policy. The situation is, there is 3 networks. Is it possible in FortiGate Firewall to be deactivate or restrict all policies for a certain time for a specific network/ IP range?

i can't  login to the device 201 F with iso 7.2.5 with Forti Hardtoken because of the time/NTP issue. and i don't have backup admin user but i have a backup configuration file before i make the 2FA . and i don't want to reset the firewall , any advice please