Solved

Hello everyone! I will soon be doing a deployment around 20 firewalls for a customer and they are wanting a hub and spoke configuration. They will have dual ISP connections at each of the locations for SDWAN. I also plan to implement ADVPN so the spokes can have shortcuts to talk to each other. I would like to us iBGP to advertise the local routes as well. My question is when I configure SDWAN for the ISP connections, do I put the ADVPN interfaces in the same zone? Or would I create a separate zone for the ADVPN interfaces? Also, I'm finding tons of documentation on configuration guides for 7.0 but not too many guides on 7.2. If anyone could link some my way that would be very much appreciated! **NOTE: I will not be using FortiManager for this deployment. Configurations will happen locally on the FortiGate's themselves. **

Is there a multi-tenancy option for FortiEMS Cloud? I know there is for the on-premises version, but i'm not seeing the option for it in the cloud version. 

I would like to do some upgrades on the server. I need to know which components I should shut down first and which should be shut down last, as well as the order for booting them up. This includes the supervisor, worker, collectors, and NFS.Thanks.

Hi guys, Windows 11, I connect to vpn FortiClient 7.0.7.0345 but the route print output is apipa.  

Hi, I have noticed that the "conf_file_ver=xxxxxxxxxxxxxxxx" in configuration has changed to a different number without doing anything recently. Is there any reason for that?

Hey all, Fortigate 81f with 7.0.14 Attempting to get SSLVPN SSO working with Microsoft Entra ID.  The process is failing before getting any type of login prompt. Testing from the FortiClient I get "The response from https://vpn.domain.com was invalid."Testing from the Test option within Entra ID I get - Access Denied (from https://vpn.domain.com page) I've double checked all the URL's between the Entra ID application and the saml config.  The SSO group on the Fortigate is in the firewall policy. Sanitised config:config user saml edit "Entra ID VPN" set entity-id "http://vpn.domain.com/remote/saml/metadata/" set single-sign-on-url "https://vpn.domain.com/remote/saml/?acs" set single-logout-url "https://vpn.domain.com/remote/saml/?sls" set idp-entity-id "https://sts.windows.net/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxx/" set idp-single-sign-on-url "https://login.microsoftonline.com/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxx/saml2" set idp-single-logout-url

Hi all,Wondering if anyone has any suggestions for dealing with 429 Rate Limit exceeded messages when using the Crowdstrike connector. I run multiple enrichment automations using different Crowdstrike actions and they often trigger the rate limiting error below:{"Error message": "HTTP Status Code 429: Too Many Requests Details:API rate limit exceeded. Connector :: crowd-strike-falconV2.3.1","failed_step_id": 530078,"failed_workflow_id": 68102,"status": "failed","execution_time": "42 seconds 480 ms"}I'm wondering how to approach this, perhaps using a "do until" loop to check to make sure status is not failed?Any help would be greatly appreciated, thanks!

Hi All.I have a 100F device (6.2.8) setup for SSL VPN for remote connections using the VPN-only forticlient.  Windows works perfectly.  MacOS does not!  The VPN shows "Connecting" and then simply goes back to no message.  There are no errors.  The VPN does not connect.  Mac = Big Sur 11.4Forticlient = 7.0.1.0060 Facts:- the VPN actually connects and authenticates.  Logs show this.  Also, putting in fake login details generates an client error for the wrong user/pass.  The correct user/pass generates no messages.  It connects but then for reasons unknown gets disconnected. Fortigate Logs:[263:root:42]got SNI server name: vpn.ourdomain.systems realm (null) [263:root:42]client cert requirement: no [263:root:42]SSL state:SSLv3/TLS read client hello (49.178.7.112) [263:root:42]SSL state:SSLv3/TLS write server hello (49.178.7.112) [263:root:42]SSL state:TLSv1.3 write encrypted extensions (49.178.7.112) [263:root:42]SSL state:S

Hi Support, Got a question regarding the Android ForticlientEMS 7.2.2. On 12 march we saw a message regarding ForticlientEMS 7.2.2 having a vulnerability. (See link under)All of our EMS client have been updated to the latest version 7.2.4. Now is my question, when will the Android app be updated to the latest version because from what i can see is that this version on the App store is 7.2.2.0127.And second question, does this vulnerability also apply to the Android FortiEMS? Link:PSIRT | FortiGuard LabsFortiClient - Apps on Google Play Kind regards, Dennis Zaan

Dear Team  Im having issues with RDP Firewall Policies and accessing the Web Gui of Fortigate. This is my WAN to LAN network from the Host Machine to Guest. Im accessing the Firewall from the Host Machine (DMZ network).I have created a Firewall policy for my Windows RDP Server as follows :          From: WAN(192.168.2.47) To: LAN(10.10.10.1) Source: All Destination: RDP Server Virtual IP External Network: 0.0.0.0 mapped to 10.10.10.22 (Windows Server) External Port: 3389 MappedtoPort: 3389 SERVICE: RDP NAT : ENABLED AV: default SSL: deep-inspection            The Issue with it is once i enable the policy and Remote access to the Server, I loose access to the Firewall

Hello ,my fortiADC does not schow any traffic log in Log & Report -> Traffic Log., I already selected all the different filter but no log appears. I selected also all options in Log & Report -> Log Setting -> Local Log, but it also did not help. For now i can only see the Event Log. is that normal?

Hello,  I have a problem with disabling usernames that register on the Captive Portal create on my FortiAuthenticator.After the registration but before approval by an Administrator, if the user tries to authenticate with the credentials they registered with, the FortiAuth disables the user and the link that comes (with email) to Administrator or sponsor generates an error and cannot be approved.I have to go into management and reenable the user manualy.Any ideas to avoid this? Thank's

Hi allI am scratching my head for past days and would appreciate fellow community if anyone of you had similar experience.  I am trying to test multicast over Fortigate IPSec.Fortigate version 7.4.3 using EVE-NG VM Cisco IOL using EVE-NG   Diagram and configuration file is like this:https://drive.google.com/drive/folders/1vKQwaPGqhGTgDzZmf8rGQZHmeRi9vST5?usp=drive_link  R6 join IGMP 224.5.5.5 using Lo0 (192.168.11.1)R7 try to send ping 224.5.5.5 from Lo1 (192.168.22.1) Fortigate configuration follow this:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Multicast-traffic-over-site-to-site-IPsec-VPN-with/ta-p/194209#:~:text=set%20multicast-forward%20disable%20set%20multicast-ttl-notchange%20enable%20set%20gui-multicast-policy,mode%3A%20%23%20config%20router%20multicast%20set%20multicast-routing%20enable with addition that I found out that I need to enable PIM at port 3 (connecting to cisco router). By doing this, the router and t

Hi all. Odd issue. When connecting on one of my laptops, the VPN won't connect. Password is accepted and token is requested. When token is entered, the login screen resets as if nothing happened. No error message and the connection fails. Intel MacBook air running latest version of Foritclient on Monterey.  Thanks!

I'm working with a FortiGate 100F and attempting to migrate 10 VLANs from port5 to a newly created virtual switch. My goal is to preserve all existing configurations, including policies and routing tied to these VLANs, during the migration. I've tried editing the backup configuration file to replace port5 with the virtual switch's name and re-upload it, but after doing so, all my VLANs vanished from the configuration. I ensured that syntax and references were correctly maintained in the edit.Has anyone successfully completed a similar migration, or can provide insights on how to retain VLAN configurations when moving to a virtual switch? Are there specific steps or considerations in the FortiGate setup to prevent the loss of VLAN configurations during such a process?

Dear teamIm having an issue with Fotigate Firewall VM64, im creating a LAN-to-all policy for internet access but cant set addresses at Source:10.10.10.0/32 for my VM computers(windows 10). i have to set it as 0.0.0.0 0.0.0.0 for it to work. any insight on the same? Regards....

Good day family, Could someone assist in telling me the actual port numbers to open on my fwl to allow management/communication between a dmz server (in front of the fwl) and forticlient ems(behind fwl). Been researching, but a bit overwhelmed.

Hi I have upgraded a cluster (which isn't in production yet) to 7.2.8. Both firewalls are now on 7.2.8 but sync is failing due to a mismatch in certificate.ca running diagnose sys ha checksum show global certificate.ca on both reveals a few differences in the hashes for example Atos_TrustedRoot_Root_CA_ECC_TLS_2021CommScope_Public_Trust_ECC_Root-01 Most are the same there's about 10 that are not was wondering the best way to resolve this  thanks 

Please guide me to block an IP 10.84.161.2 in the same vlan. I have created the rule as above but machines in the same vlan can still see each other. Please help me 

Hi youI'm using FG v7.4.3, I created a file filter to block downloading of .exe files, but users can still download the .exe file, specifically the Chrome installation file, specifically its file is ChromeSetup.exe 

We just placed an order for 10 of the FS-148E-POE switches.  We want to connect the switches together using SFP connectors and fiber patch cables.  My problem is selecting the correct SFP transceiver and the correct MM fiber patch cable.  I AM waiting for Fortigate pre-sales support to reply, but I thought I'd post here in the even that someone may have some expertise on that. So, ten FS-148E-POE and I need to know the right SFP transceiver and MM fiber patch cables to connect all of these switches together. Thank you

Hello Everybody, I have a big problem on my hands. I currently use the fortigates network with version #7.0.14M and the objective is to migrate to version 7.2.8M. However, I have a problem, because we use Hardware Switch and also software swit   My problem is when I upgrade to the desired version, the hardware switch stops working, if the sub interfaces are members of the software switch. If you remove it from the software switch, the vlan interfaces are UP. In the switch software, they are DOWNAny tips?

Hi,I'm using FotiOS 7.0.14Behind my Fortigate cluster i have running multimple web services with separate public IPs.When DOS threshlds are triggered Fortigate starts blocking source IPs including those that belongs to our Pingdom monitoring.Since quarantine is global it also influence other applications.Is there a way to configure quarantines per project or public IP? 

Hi, Assistance with a network configuration. We have two internet modems in our current setup: 1. A fiber connection linked to the Forti WAN port.2. A DIA with a static IP connected to Forti port number 4. The internet is functioning correctly from the WAN port, now we need the user login to specified sites accessed exclusively through port number 4. Modem: FortiWiFi 30EFirmware: v6.2.15 build1378 (GA)

When the Fortimanager was loaded, it was done after loading the Network, so they were left in a single address group, several mappings per device, they asked to add a new address, I wanted to know what would happen if per-mapping was disabled.