Solved

FG 100D fw:6.2.15MS AD domain usersThere are two domain controllers and FG agent is installed on them. Ver: 5.0.0312The user gets Internet access via AD groupProblem:From time to time, the user loses access to the Internet and is blocked by the default rule.The logs show that the user field is not filled in.The user accesses any domain resource and Internet access appears.There are no new records about the user's logons on the domain controllers.How can I fix the problem of periodic Internet loss?

Hello,   We have a Fortigate (100F) and multiple FortiAP (231F) access points. We recently ran into a problem. Almost all of our access points are working normally, but there is one that had slow Wi-Fi speeds. We tested the cable and the switch port, but it seemed they were not a problem. We tested another brand AP, and it had high speeds. With a reset, the FortiAP felt a bit different, but still has unstable speeds.   We wanted to upgrade the firmware of that particular FortiAP, but it seems it's hard to get the file. Can someone guide me for how to get the actual file as many tutorials just show me where I can upload the file on Fortigate without telling me where to get it.   Note: Its current version is 7.0Thank you!#FortiAP #Fortigate #Firmware-Upgrade

Hi, is there a way or command I can check who make the changes under Schedule Updates?My FW perform auto updates and I need to find out who have amended the schedule updates to auto, Thanks 

Hello,When external users have to logon, I give them https://firewall.mydomain.com:1003 (I've load a 3rd party certificate).but they are redirect to https://IP-ADRESS:1003 with a certificate error Is there a way to fix the name used by FG to match my FQDN ? Thanks !

I understand that (almost?) everything should be configured and deployed via FortiManager for any devices that are managed. Are there any configuration elements that cannot be done through FortiManager and must be done independently at the device level? Specifically ... I have a device that cannot connect to FortiAuthenticator, so I have to log in using local credentials.  I'm pretty sure the problem is that I need to set a source-ip for the RADIUS connection via CLI: config user radiusedit "<authentication string>"set source-ip 192.168.100.1 Of course when I log into the remote device locally and open the CLI, I get the message that "changes will cause this device to be out of sync with FortiManager." I guess I have four questions:1. Can this setting for an individual device (that is part of an ADOM with other devices) be set via FortiManager?2. If so, how?3. If it cannot be set via FortiManager and I set it on the device itself, will it cause any "

Hi all,We were forced to re-import the configuration of a firewall into the manager. As a result, many address objects have now received a per-device mapping. Is there a way to remove these per-device mappings in the address objects, e.g. using a script?

Hello guys, I have a multitenant structure and I have defined a JDBC with MSSQL in my organisation. I got success in Credential, Discovery. When I test it in the monitoring I have created, it gives successful results, but I cannot see it in pull events and events do not come. What do you think I should do?

After SSL-VPN Webmode authentication, https bookmark login fails.After a failure, the login screen will be displayed again.I can log in correctly on the http bookmark login site.I will add debugging, so if you have knowledge please help. Equipment used: FG60EVersion: 7.0.10   FortiGate-60E #FortiGate-60E # diag debug enable FortiGate-60E # [210:root:d1]req: /remote/logincheck <----------------SSL-VPN Login[210:root:d1]rmt_web_auth_info_parser_common:492 no session id in auth info[210:root:d1]rmt_web_access_check:760 access failed, uri=[/remote/logincheck],ret=4103,[210:root:d1]User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67[210:root:d1]rmt_logincheck_cb_handler:1283 user 'user01' has a matched local entry.[210:root:d1]sslvpn_auth_check_usrgroup:2967 forming user/group list from policy.[210:root:d1]sslvpn_auth_check_usrgroup:3013 got user (0) group (1:0).[210:root:d1]sslvpn_validate_u

Hi Community,   I would like to setup two different Phase1 IPSEC Interfaces which divides the peers via identifiers based on certificate matching. Suppose we have two companies and the structure of the CN is basically a String formatted like a FQDN of the Computer. Is there a chance to divide peers from company A and company B based on two peer-groups with a CN-Match Substring?   The CN has the classic form of computername.companyA.com or computername.companyB.com. In my test it was perfectly fine to use the full CN but a match based on substring matching does not do the job. Off Course the config vpn certificate setting Entry cn-match and subject-match is set to substring.   So what syntax, wildcard-Characters or even maybe regex can be used for the CN-Matching? Is there a way to go on the substring  "companyA.com" or can the cn Value in config user peer only be a whole string separated by whitespaces? Is there a knowledgebase Article or a more descriptive Article

Hello, allAs I am preparing for the new FCP exam and going through the material about IPSEC VPN and found the option of the FEC. This is on the version 7.2.x.Can anybody explain the purpose of this, where to use and what does the noisy links means at the expense of using more bandwidth and the use case for the ingress and egress.The screenshot is also attached for the reference. 

Hi all,Actually I'm testing my new fortigate 60f and for test I have this configurations:modem -> oldFirewall (wan ip 10.0.0.10; lan 20.0.0.1) -> fortigate (wan ip 20.0.0.10; lan 192.168.10.1)I can can connect to forticlient but actually I cannot ping any device in the same subnet of wan connection. for example I cannot ping 20.0.0.20-254 devices)  can some one help me which setting let clients to reach all devices also that devices connected to the old firewall?many thanks in advance

Dear   We have Fortigate FG200E firewall, we need to access the Firewall through FQDN for that we have added the A records in our local and public DNS.   But now we need to stop the access direct from public IP, and the administrators must use the FQDN to access the Firewall management page.   Can anyone please help that how can I achieve this?

Hello guys. Quick question about fortiweb: can it interpret any script flavor? I've read somewhere that FortiManager supports TCL scripting, but haven't found anything related with FortiWeb. So, if I need to recreate lots of similar objects (ex.: similar profiles), how can I automate that task? Thanks.  

Hi all, If you can not understand what i'm saying,I apologize for my poor English.   I have a ha cluster using 1500D with version 5.0.14 and without ntp server. When I adjust system time to real time.My slave forti starting appear error log like   date=2016-11-07 time=11:16:55 logid=0100035010 type=event subtype=system level=error vd="root" msg="HA slave sync failed in 3 turns"   Logs like this appear 2-3 times daily. After I config time before change,this log still appear. I've tried re-build HA cluster but looks like didn't work.   Really need help.Thanks   I've show checksum in both of forti,and they are the same

Hello, I'm unable to uninstall FortiClient, the uninstall button is grayed, as far as the only session on the computer is an admin one, I don't understand why I can't uninstall it...

Hello Community, The setup is a FortiWiFi 80F running v7.2.6 firmware. My goal is to know which port the SD-WAN has chosen and get that data from the API. From the GUI, I access Network > SD-WAN > SD-WAN Rules In the 'IPv4' Column and 'Members' Row this cell shows two ports along with a check mark. The check mark tells which adapter the SD-WAN rule is using.   How can I know what the SD-WAN has chosen from the API?   I have tried health check but have not seen what I am looking for         https://192.168.50.1:443/api/v2/monitor/virtual-wan/health-check?access_token=nwm3N6Nfsjp5szxtdG64hqn8g9s8sx             Appreciate it

Hi  I already created an ipsec remote access tunnel and it is working. I want to create second tunnel for a different group but it does not connect. How can i do that?

Good day guys.I have the following setup.200F with dual WAN4 tunnels to AWS (the usual IPSEC with 2 tunnels).Probably, next year, hopefully, I will have AWS Direct Connect.Let´s begin with the IPSEC tunnels first:I´m having issues with the ECMP on the AWS TGW, what I need is just failover between the tunnels, but I want to setup the priority in which they are used under normal conditions, like in the following graph:  I want to influence the traffic (inbound and outbound) so it has the Tunnels in this order of preference: Main_Tunnel01Main_Tunnel02Secondary_Tunnel01Secondary_Tunnel02OrMain IPSECSecondary IPSECRight now, what I´m having (with ECMP disabled) is that I´m loosing traffic partially if I lose a Tunnel. If I enable ECMP, I get traffic through all the tunnels, and I do not want that. I found the Technical Tip : Difference between asymmetric routing and auxiliary sessions., I will testing that also, but right now I´m confussed with this AWS documentatio

Hi,   i was wondering.  Is there a way to put a ha cluster in maintenance mode?  With maintenance mode i mean, there will be no response to heartbeat failures for example.  Primary member remains active.  Secondary remains not active.  This would be handy in a situation where there is maintenance on the networking infrastructure between two sites, impacting the hearbeats between the nodes.  And we want to prevent split brain scenario's...   Ofcourse, we can shutdown the secundary node.  But since the used Fortigates cannot be powered on again remotely without someone going physically onsite to press the power button...

I try to solve a (maybe) edge case for a customer:   The Customer has multiple Website behind a Fortigate which he would like to make public available: web1.domain1.tld web2.domain1.tld web3.domain2.tld There is only 1 public IP Address. All the Website should be available on Port 443 (HTTPS). The Websites should be protected by WAF.   What I have tried: I can make the first two Websites (web1, web2) available with "Virtual Servers" and by using a Wildcard (public signed) certificate. Then I used a Firewall Rule with a Web Application Firewall Profile to secure the Servers. But then web3 cannot be added because it is using a different Domain.   I also tried it with ZTNA, Proxy Policy and by disabling the Client Certificate requirement by setting "set client-cert disable". This way I was able to publish all of the 3 Domains. But that way i cannot use any protection as Web Application Firewall cannot be used together with ZTNA as far as i know. Also, i noticed, that when

how do i enable disk logging in FG100F?i dont see the option in both CLI n GUI for disk, only memory and fortianalyzer.  

i have setup STMP server under Settings -> Email Service, for sending emails alerts for our FG100F.but it does not seems to work.what else must I enabled on the firewall.firmware version is 7.2.5

Hi,         I have a question about hairpin NAT. When doing hairpin between two interfaces of FGT, do I have to create/use public VIP for the source and destination? I found out it works without NAT as well. What type of specific case do I have to use NAT? Thank you.

Might be a simple one for you. Any hint is appreciated.I have a FGT-60F cluster that has an active LDAP server pointing to an AD server that is located on a local "internal1" interface. This connection works fine. If I do "Test Connectivity", I can see in the packet capture (on internal1) some LDAP bindrequests on port 389. LDAP works perfectly. I want now to add another LDAP Server that is located behind an IPSec VPN. However, the packet capture on the VPN interface does not show any LDAP traffic at all when I do "Test Connectivity".  Routing is correct. Traffic beween local interface and remote network via VPN tunnel is working fine. I suspect a policy issue, but I have to admit I am puzzled. Since the fortigate is the originator of the LDAP requests, what do I have to choose for the originating interface in the policy setup?And why do I not have to setup a policy for the LDAP Server on the internal1 interface? In any case, how would I, step by step, troubles

We just ran into this: today our FortiMail states it has no antispam and virus outbreak license.It did have one because it also states the last update of the antispam definitions was on 2024-02-06 and it cannot do that without vallid license. If I look into support portal I can see that our License bundle includes both licenses and they are both valid until 2027.FortiMail also states that FortiGuard services are reachable. I also opened a ticket with TAC on this as this should not at all happen for security reasons! cheersSebastian