Solved

We have a number of FGT devices running on 7.0.14 and all part of FortiManager, with the basic configurations being pretty much the same. One of those configurations is to setup AD users as admins based on LDAP. This process works great for all but 1 of our devices that's out in the field. I tested my "useradmin" account via the LDAP configuration page and got a return of successful. I am in our fw_admins group, which is assigned in the Administrators list for the FGT. However, when I try to login via the GUI with that same username and password, it tells me that my user cannot be found. I can test it all day via the LDAP settings or via CLI, and it consistently tells me that it's successful in hitting the LDAP server and authenticating me. It's just trying to login as an admin where it fails. I can log into any of the other 90 devices we have with that same username/password to admin them with zero issues, it's just the one. We are connected to that site via MPLS and/or VPN

I have the Fortigate VM in AWS and I am trying to setup Single Sign On connected to ADFS for my VPN users.  I am very new to ADFS.  The setup requires you to put in the SP info and then the IdP info.  I am very new to the whole ADFS thing but still in other places on the fortigate I have only had to setup the IdP pointing at my ADFS server and things worked fine.  Why is it asking for the SP too and who is the SP in this case?

Hello,I am trying to implement unsuccessful login attempts policy for local users.So if the user puts 5 times wrong password then he will be locked for some time.There are two local admin accounts.I have setup this, but the problem is that it will lockout whole firewall for login and not only userconfig system global    set admin-lockout-duration 300    set admin-lockout-threshold 10endSo I have tried this setting, but it seems that it is not triggered. Is this setting even relevant for local administrators ?config user setting    set auth-lockout-threshold 5    set auth-lockout-duration 900endThank youBR.D

Hello, I have a question with setting up an IPSec tunnel using IKEv2. In the FortiGate only one PSK needs to be specified. But in the Cisco ASA wizard I need to specify two PSK's. One from the local Cisco ASA and from the remote (FortiGate). How do I need to configure this, do I need to only add one PSK to the Cisco ASA, or is there an other solution?kind regards, Geert

Hello there, I need to make new connection with 4 FortiSwitches 448E FPoE and FortiGate 100F in HA cluster.Because distance between FortiGates and FortiSwitches is over 400 meters (different buildings) and I got 8 optic fibers for this connection.My question is what is best recommendation for connecting FortiSwitches with FortiGate to make it redundant and maximize speed of given ports.In FortiGate I was thinking of use X1 and X2.Also want to use FortiLink for management.Nice if both links will be used.In attachment network connection plan I was thinking off.Any suggestion or good practice will be nice to read.

i am trying to enable snmp to management engine opmanager.but it does not seems to work.what are the proper steps to configure the fortigate

I want to manage multiple fortigate devices.So i try to enable "Show Add Multiple Button".But i can't see the "Add Multiple Devices" button on  Device & Groups.I watch the video on youtube, it could be like this My FortiManager version is 7.2.4Has anyone else had this problem? Thanks.  

Friends, a question, I have a fortianalyzer VM. I have several Fortigate devices synchronized with the FAZ for reporting purposes.Previously, Total records for analysis were displayed: 60 days. Little by little it has been reducing and now I see Total logs for analytics: 20 days.Could you help me by indicating what this is due to?"Daily Log Limit Exceeded" alerts are also displayed.Will this be related to the reduction of Total logs for analytics: 20 day?I have 9 fortigates teams synchronized with the FAZ. 

Hi!I am trying to upgrade FortiClient 7.2.2.0864 to FortiClient 7.2.3.0929. I have never encountered any problems upgrading FortiClient before, but in this case I am unable to do this on Windows Server 2019. It works fine on Windows Server 2022. I am able to upgrade if I run the installation as an admin, but not as system. And I must admit, I would prefer to not upgrade FortiClient manually on 50+ servers. The error I get is the msi 1723 error.Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action CA_InstallFCTServices, entry: MSI_InstallFCService, library: C:\Windows\Installer\MSIFAAA.tmp Do you guys have any idea? I am puzzled as to why this is only a problem when upgrading as system, and on a Windows Server 2019.

Community Following issue showed a wrong connection to Fortiguard-log server, password is correct and worked properly with another Fortigate device, diagnose log is activate:  FORTI-40F # execute fortiguard-log login xxxMAILxxx xxxPWDxxx2024-03-13 12:52:46 [643] fds_https_stop_server: 173.243.143.6:4432024-03-13 12:52:46 [205] __ssl_data_ctx_free: Done2024-03-13 12:52:46 [1047] ssl_free: Done2024-03-13 12:52:46 [197] __ssl_cert_ctx_free: Done2024-03-13 12:52:46 [1057] ssl_ctx_free: Done2024-03-13 12:52:46 [1038] ssl_disconnect: Shutdown2024-03-13 12:52:46 [554] fds_https_timeout: Connection timed out, svr=Forticlient-svr2024-03-13 12:52:46 [246] fds_svr_default_on_error: Forticlient-svr: ip=173.243.143.6:443, reason=42024-03-13 12:52:46 [263] fds_svr_default_on_error: Forticlient-svr: Conn failes 1/22024-03-13 12:52:46 [145] fds_svr_default_pickup_server: Forticlient-svr: [2620:101:9000:143:173:243:143:6]:443Failed: FGT internal error(-1)Command fail. Return code 5FORTI-

I have a fortigate vm in aws.  I have setup a ssl vpn to a host on the local subnet of the inside interface and that works.  Now I want to expand it to a host in a different VPC in AWS.  For this it will need to route over a transit gateway to the other VPC.  The transit gateway routing works and can be verified.  I can ping and even telnet to port 22 from the fortigate to the endpoint in the other VPC. I am using browser based ssl vpn for testing. I tried to setup the following policy based routing:Incoming interface = ssl.rootOutgoing interface = port2 (private lan)Source = ALL and SSLVPNDestination = 10.0.0.0/8   (this CIDR will be routed over the transit gateway because of the attached tgw route)Schedule = alwaysService = ALLAction = Accept However, when I test this policy has no hits.  What am I doing wrong???

Is if possible to Create Multiple SSL VPN Groups that have limited access to different Networks AdminVPN Users able to get to systems and managementStandardVPN Users able to get to what systems they need but limitedand so on Thanks

Hello, everyone!I hope everyone is doing great. Recently, we upgraded our 100F firewall from 6.4.6 all the way up to 7.4.3.Unfortunately, SD-WAN Rules page doesn't load anything at all.Is there a new version to be released soon? How can I access it through GUI using another approach if possible? Best,Sagvan Saleem

I have many corporate Fortinet firewalls in play, but finally just went and bought one for myself (a 60e, great for home internet and labs) so am posting with my personal acct - and am seeing the following weird issue.   I have created an address group blocking a number of countries (Russia and China primarily, seeing attempted connectoin attempts from various IP's). While I do 'allow' SSH on wan1, the administrator super_admin and my acct profile_admin are only allowed from certain IP ranges (my inside subnets and the VPN DHCP range I hand out when I connect to my own network from outside) so that's already fairly locked down.I am seeing logs denying 'admin' by blocked IP because it falls outside trustedhosts range, but if the bots try any other account (that does NOT exist on the Fortinet) it allows the connection to try passwords and then of course fails because there's no such account.  I have created a deny policy referencing the regions and put wan1/

After updating various Fortigate models from version 7.0.13 to 7.0.14 the Kiwi Cattools Backup (Device Backup TFTP) brakes. Errorlog: Connection failed (30011) Invalid data received from remote server. Protocol error.We are using the latest version of Kiwi Cattools (3.12.3.3257).Maybe someone has the same problem and already found out what the problem is and how to fix it.Thanks in advance for any help! 

I want to open a different fortinac portal in front of a user joining a guest wireless network and a user joining a guest wired network. How can I do this?

Hello. There are 2 firewall, FortiGate 60F (firmware 6.4.6 build 6083 GA) and FortiGate 200E (firmware 7.0.12 build 0523 Mature). Will there be any problem configuring IPSec VPN between these two firewall?

I just got finished setting up FortiMail Cloud for Office 365 (setup as gateway for inbound traffic only) and had a question I am having trouble getting definitive answers on. I am sending and receiving email just fine; however, I know I have some tuning and tweaking still to do. Also, I know I am asking this question from a O365 guidance side of things, but as it relates to the new integration with FortiMail, I'm hoping someone can share some guidance on what worked best for them advice. One setting I put into place was defining the IPs of my FortiMail Cloud instance into the Anti-Spam Connection Filter Policy at O365. I did this as it seemed O365 was declaring an inordinate amount of SPAM from FortiMail Cloud. According to Microsoft, the IP Allow List skips spam filtering but still scans for malware and high-confidence phishing. I am getting more email alerts from O365 about "Phish delivered due to an IP allow policy" (I assume due to the Connection Filter Policy and since it's

Hi,I would like to know, where to find the function "SMTPUTF8" in Fortimail Version V6.4.6 ?In Version V7.4 you find it under System -  MailSetting - MailServerSettings.https://community.fortinet.com/t5/FortiMail/Technical-Tip-How-to-avoid-email-with-UTF-8-encoding-being/ta-p/292948This parameter doesn´t exist in the older version at that place.

Hello! In a normal connection (like internet - router - firewall - LAN device) the destination is the default route 0.0.0.0/0.0.0.0.1) what does it mean by named address?2) In which case we do not use the default route? 3) for what purpose we select internet service option?4) for IPSec VPN, is it mandatory to use blackhole as the interface?

Hello, I hope you are well, I want to update my two Fortigate 201F but I don't know which is the most stable version: 7.4.1 or 7.4.2 or 7.4.3 Regards.   

I've upgrade by gui a 40F Fortigate from 07.4.0 to 07.4.2 and readonly view is the only access I have by gui. By cli all permissions are granted, until now according troubleshooting there is no chance to roll back from 07.4.2 to 07.4.0 by gui or cli, cli error output shows: "Firmware update license is expired. Please update to a valid license" similar output showed by GUI. Community, do you have any feedback?

Hello team, this is the scenario:IPSec peers are both public ip so I left NAT-T disabled and enabled DPD Peer detection on demand for both firewalls.As authentication I set PSK, IKEv1 Main (id protection) for both firewalls.For the Phase1 Proposal part I configured AES256-SHA1 and DH 21 and 2 for both firewalls.After that I configured the relevant policies and static route for both firewalls.The problem is that phase1 does not go up. Running some debugging I see this in the logs:I also ran a packet capture and I see traffic on port 500 for both firewalls:   Thanks in advance for the supportBR

Hello! I have a question regarding IPSec VPN. There are 2 firewall, FortiGate 60F (site A) and 200F (Site B). The question is, do I need to configure IPSec VPN for routers in Site A and Site B if the router is either before or after the FortiGate firewall?

Hello AllCan I deploya FortiNAC "Subscription Visibility+Control (PLUS) license for 25 concurrent endpoints. MOQ 500" withFortiNAC "Subscription Visibility (BASE) license for 25 concurrent endpoints. MOQ 500" for the same device or I can't combine two licenses.