Solved

Hello guys!I'm deploying FortiNAC and facing a problem that I want to know if this proceed or not. The Registration Interface are providing IP by DHCP to new PCs correctly, but I'm trying to do simple ping from new PC with Registration IP to the Management IP of FortiNAC and this do not reply. But if I do ping from the FortiNAC to the same PC with Registration IP it gets replies. Is this normal behavior natively on FortiNAC? Or do I need to setup something to permit this ping replies?

On the Fortigate under SSL-VPN Settings you need to specify an Address Range.  But you also need to do the same thing under SSL-VPN Portals Source IP Pools.  Presumably if you have multiple portals each one would have their own IP pool.  So why are you forced to enter in the range twice?

Good Day Guys, I am having a problem accessing the SDWAN rules on my Fortigate 200F. This happened before, restarted the device but this time round after restarting it, still not working. Any suggestions?Spinning Wheel. Nothing happens.

This is my first time using Fortimail and I have to admit, this system has a lot of bugs/issues, a bit unstable. The VM/webadmin tends to freeze at times. I once lost an entire configuration, where the vm was reset thus losing its 1 yr license/expired, I had to turn on udp to reapply 1yr license to get the VM up. Now the VM upon starting in Hyper-V is broken. I need to replicate this Fortimail VM for redundancy, but I will not replicate a broken VM. Additionally, there are other VMs on the same host comprising Fortimail and they are working fine i.e. checkpoint creation/removals, replication etc can be done.Can i get some assistance?

When I visit https://219.148.36.28, due to anti-ddos device protection, the website always responds with an incorrect syn+ack for the first time. If the client can respond with rst, it is considered normal. When I was in the company, the fortigate version was 4.0. When foritgate received the wrong syn+ack packet, fortigate would discard the packet. Now I set up an environment to test the“ anti-relay” function，Refer to the cli manual description. When anti-replay is set to strict, syn+ack packets with incorrect sequence numbers should be drop. However, when I tested, fortigate did not drop the wrong syn+ack packets，but forward this packet . Why don not drop the wrong seq packet? I debugged and saw that there was a debug saying This can be a challenge ack packet. What does this mean?1. My topology is as follows2. debug info3. fortigate sniff4. config system global ,set anti-replay strict5. firewall policy ,set anti-relay enable 6. only how one firewall policy 

I am testing out client based ssl-vpn using SAML Auth.  When I debug saml on the fortigate I see that group that comes back from SAML is correct but I am getting added to the wrong portal.  I have users group configured as per https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/azure-administration-guide/584456/configuring-saml-sso-login-for-ssl-vpn-with-entra-id-acting-as-saml-idp with:config user groupedit FortiGateAccessset member azureconfig matchedit 1set server-name azureset group-name <object ID>nextendnextend How does the fortigate relate the group name to the portal name?

Hello community,I need help hiding the WAN IP of my FortiGate, using proxy services like Cloudflare. I have currently set up my FortiGate with a subdomain (mifirewall.mypage.com) and an SSL certificate from Let's Encrypt, which works perfectly in DNS mode with Cloudflare. However, when I switch to proxy mode to enhance security and hide the IP, the system stops functioning as expected.Additionally, this configuration with Cloudflare is used not only for managing the device but also as the address for SSL VPN clients. This makes it crucial to maintain constant functionality and accessibility through Cloudflare.Has anyone faced a similar problem when activating proxy mode in Cloudflare? How did you resolve it? I am particularly interested in knowing if there are specific configurations or adjustments I could apply to solve this issue.Thank you for your time and assistance.

Hi FortiGate adminsAny one used the "none" interface as SD-WAN member?I wonder if we can use it like a black hole, like when we don't want to route some traffic through any SD-WAN members when some SD-WAN members are down (not to fall in the implicit SD-WAN rule). I know we can do that with firewall policies but I wonder if we can do it at SD-WAN rules level.

Hi,Can anyone confirm me the SKU below support 1GB/Day of Log ? or more ?and how much Capacity ?SKU : FC-10-0081F-585-02-DDDesignation : FortiAnalyzer Cloud: cloud-Based central logging & analytics. Include All FortiGate log types, IOC Service, Security Automation Service and FortiGuard Outbreak Detection Service. Thanks

Hi,I try to implement site to site vpn between 2 Fortigate in my lab but I got this error on both side : ike Negotiate ISAKMP SA Error: ike 0:ffd4573d1a2ff133/0000000000000000:220: no SA proposal chosen Commands output :Hub # show vpn ipsec phase1-interfaceconfig vpn ipsec phase1-interfaceedit "VPN-to-spoke"set interface "port2"set peertype anyset net-device disableset proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1set comments "VPN: VPN-to-spoke (Created by VPN wizard)"set wizard-type static-fortigateset remote-gw Spoke_IPset psksecret ENC pkX9mSvmif/AZCPktG9xlCHmSNyAmQ2L3IigVETGNrOEVgH1t22s1u6cEl2aLk+V/WMJn7Qnm246 TgPqCL6nchuxAdm0bbBpKQvAODxUp72Vfror9YyanMzw2iwhFEIG2KABhJnUGGgkIWql3lxk0SUmefRrVdRahgC2HLiGJ0+TaqhF3U sjhCTKE5K6zP4ACd1yCQ==nextendHub # show vpn ipsec phase2-interfaceconfig vpn ipsec phase2-interfaceedit "VPN-to-spoke"set phase1name "VPN-to-spoke"set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20p oly1305s

i try to login via a python script, after some struggeling with the certificates i get a return code 200.but when i try to parse the return value it's not a json object (or structure) it's html. login-request and check response: response = requests.post(loginURL, json=login_data)print(f"response status code : {response.status_code}")if response.status_code == 200:print(response.text)try: json_data = response.json() for key in json_data: print(key)except ValueError as e: print("some ERROR raised:") print(e) and the print of the response ist html:<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>FortiSandbox</title><base href="/ng/"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="icon" type="image/x-icon" href="favicon.ico"><style>@charset "UTF-8";body{font-family:Lato,Helvetica,Arial,sans-serif}body{font-weight:var(--nu-theme-dimension-norm

Hello,I am trying to setup a IPSec VPN tunnel between a Fortigate VM and a Cisco ASAv in GNS3. I have multiple subnets behind the Fortigate and one subnet behind the ASA. When I create a IPSec tunnel on the Fortigate, I use a group-object with all the local subnets from the Fortigate as the local-network at the phase 2 selectors.When the tunnel is configured at both ends, the fortigate lists the IPSec tunnel, but the phase 2 tunnel is not up all the way. Only one subnet is listed up and the other subnets are down. I found the following Technical Tip where they say that I need to create multiple phase 2 selectors for each local subnet from the Fortigate.How to configure VPN for multiple subnets - Fortinet CommunityWhen I do this, the VPN works as it should. But is there a way to only need one phase 2 selector for every local subnet? Or do I need to make a selector for every subnet that needs to be allowed over the VPN?Kind regards,Jeffrey

Dear seniors：Does anyone know if FG-90G has ACL policy function?For example, the command of "config firewall acl"Is this function only available for models above 100?Thank you very much if anyone can give a definite answer(It would be better to have screenshots) 

This issue has been discussed in may ways and referred to in post such as this: https://forum.fortinet.com/tm.aspx?m=119883#183227 But I wanted to see if anyone has any remaining ideas. To set the stage, in a proper Windows AD environment, DNS integrated with AD only allows secure updates from an authorized DHCP server that allocates IPs from one or more pools assigned to one or more subnets.  Authenticated clients can also have their NICs configured to register in DNS, but Microsoft suggests this isn't a good option: https://support.microsoft.com/en-us/help/2933537/clearing-the-register-this-connection-s-addresses-in-dns-option-does-n This requires a proper understanding of scope and DNS options such as lease time and scavenging.  I read a lot of posts by folks who don't understand how this works, such as setting the lease or scavenging time too low.  More info here: https://blogs.msmvps.com/acefekay/2016/08/13/dynamic-dns-updates-how-to-ge

i want to config "set anti-replay strict" ,but when i show this configure,But when I checked the configuration, I couldn't find the content of my configuration. Is it due to VM licensing reasons? Or is it a problem with my configuration? If it's a configuration issue, how should I configure it

I am struggling a little here to figure out realms and the best way to have policies, the documentation says the realm name should match the domain? well that isnt true, you can call your Realm anything, as I have, so why does it state this? The realm to me, is just the AUTH mechanism is it not? The reason I ask is, I have a realm called "bob" and that used an LDAP server and chained with an additional RSA server to allow SSLVPN users, this all works fine (hence my question on the name of the realm being irrelevant) I now need to add a Policy for WIFI users, that uses the same LDAP server but not chaining, so I create a new realm called "fred" and just untick the chaining, the policy looks for the Radius Attr of SSID and then looks up LDAP as normal, is this the right way to do it? if not? why not!  

I need some help.  I am tying to register my FortiClients using their individual invitation codes to FortiClient EMS Cloud.  In FortiClient EMS Cloud I am using SAML to our ADFS host.  I have provided the config the CERT to the ADFS host.  In the Relaying Party Trust I have Encryption as blank (no cert).  Under Signature I have the ADFS cert again. The error the end user is getting is this:  Error with SAML configuration settings: Signature validation failed. SAML Response rejected, invalid_responsePlease notify your EMS Administrator for assistance. In the Python Debug log I am seeing this:2024-04-01 06:29:04,767 INFO request_handler POST /fct_saml/iwn8nrmm3e/acs ems-1808417.forticlient-emsproxy.forticloud.com Default application/x-www-form-urlencoded manual2024-04-01 06:29:04,788 DEBUG ems_logger 6 6 Error with SAML configuration settings: Signature validation failed. SAML Response rejected, invalid_response2024-04-01 06:29:04,917 INFO req

As the title says, switching between certificate-inspection, deep-inspection and custom-deep-inspection does not help load most common & reputable (both international and Vietnamese) websites on either Microsoft Edge or Google Chrome, such as:office.comvietcombank.com.vnbidv.com.vnvnexpress.netSetting the SSL/SSH inspection profile to no-inspection makes it work with one exclamation on the policy rule.Is there any idea about this?

Hello, I would like to ask you because I am in the process of configuring a Fortigate 40F where I have a port which goes to a switch with TAGs (vlan). But I would like to define another port of the Fortigate with the same TAG (vlan) which goes to another managed switch. How can I define a second port with the same vlans? A big thank you to you. Olivier

Hello dear friends from Fortinet,Sorry for my tone but I have no normal words.I spent several nights trying to understand why my Asterisk PBX can't register on SIP provider. So finally I found in captured packets the makings of a failed intellect.1. PBX sends register packet src:int_IP:5060 to dst:SIP_prov_IP:5060  Message HeaderVia: SIP/2.0/UDP ext_IP:5060;branch=z9hG4bK6a3e42f7 2. Fortigate translats by NAT ........ BUT!!!!!!......it changes packet's contentsrc:ext_IP:5060 to dst:SIP_prov_IP:5060 Message HeaderVia: SIP/2.0/UDP ext_IP:5170;branch=z9hG4bK6a3e42f7 3. Evidently SIP provider response to the fake port presented by Fortigatesrc:SIP_prov_IP:5060 to dst:ext_IP:5170Message HeaderVia: SIP/2.0/UDP ext_IP:5170;branch=z9hG4bK6a3e42f7 And NOTHING MORE !!!! Because this port in not listen and even is blocked as it is not permitted by policy and therefore this packet doesn't returned to PBX. And the same thing happens with RTP packets!!! I don't understa

Hello, I´m setting up a internal DNS server on a fortigate 40F. Where do I set the port for the address the DNS is solving ?  

Hi,I have fortigate 1200D (2x HA), it has only one default root vdom. My plan is to activate the multi vdom function, but I have doubts if it can be done without any interruptions or reboots. In cookbok for v6.2 i found information that states:Multi VDOM mode can be enabled in the GUI or CLI. Enabling it does not require a reboot, but does log you out of the device. The current configuration is assigned to the root VDOM.f I recall correctly, that wasnt the case on earlier versions? My question is if i have only one root vdom now, after activation of multi vdom will I loose any kind of configuration? I have read that by activating split task vdom it retains 'some' config but not all, i just want to make 100% that this operation i safe to make.cheers

Hi there, I am in a test enviroment and set up the options and can access a web server target via FortiPAM with activated explicit web proxy mode. So far this is no problem. But when I try to connect the target with the option "Replace Web Credential" the target system give me the message wrong user / password.It seems as is the replacement of the fake login information cannot take place. Where and how can I go into further troubleshooting for ths scenario? Kind regards,Daniel

Hello guys,i'm using Forticlient vpn only - version 7.0.9.0493 and i already have configured five connection profiles, now i need to add a new profile, but once i create it, it is not shown in the profiles list.This issue appears even with a newer version, so i'm wondering if there is a profile limit.I've also noticed that after some time i'm not even able to modify the existing profiles anymore...Another question if is there is a way to not manually reconfigure all the other profiles in case i should install another more recent version. Thank you

Hello, I am very new to FortiGate and I am studying for the Network Security Certification.  I have the following question, which I am not able to confirm my answer on the internet. FortiGate - version 7.4.3 Say I configure a Firewall rule with:Inspection Mode as: Flow-based In the same Rule I add security profile >> Antivirus >> In the antivirus profile, feature set is configured as Proxy based. Does the above means that now the firewall rule will use Proxy-based mode for all the traffic?  Thanks for your assistance. Aaron Olguin