Solved

Hi all, We are building an automated pipeline to continuously collect SSL-VPN and IPSec debug logs from our FortiGate 90G devices, using:diagnose debug application sslvpn -1diagnose debug application fnbamd 8diagnose debug enable We specifically need the raw debug output (e.g. "SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384") which is not present in structured logs and therefore not available via FortiAnalyzer or syslog. We have already gone through the following KB articles:• Continuous debug monitoring with Bash and Crontab:https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Continuous-debug-monitoring-with-Bash-and-Crontab/ta-p/305973 • FortiGate remote monitoring and logging CLI command output into a file:https://community.fortinet.com/t5/FortiGate/Configuration-Example-FortiGate-remote-monitoring-and-logging/ta-p/189892 Based on our research, it appears that the debug subsystem and the structured logging pipeline are architecturally separate, th

Can two FortiGate clusters (each configured in Active-Passive HA with 2 units) be interconnected through a Core switch?

FortiGate - 7.6.3FortiClient - 7.2.9 (Windows and Mac) I have been working with Support for weeks now with no success so hoping I can get help here.Fortigate config:config vpn ipsec phase1-interfaceedit "OpsIPSecVPN"set type dynamicset interface "port1"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset proposal des-sha512 aes256-sha512set comments "VPN: OpsIPSecVPN -- Created by VPN wizard"set dhgrp 14set wizard-type dialup-forticlientset nattraversal disableset network-overlay enableset network-id 0set transport tcpset fortinet-esp enableset assign-ip-from nameset dns-mode autoset ipv4-split-include "OpsIPSecVPN_split"set ipv4-name "VPN_PCI_Operations_us2"set save-password enableset client-auto-negotiate enableset client-keep-alive enableset psksecret ENC *** FortiClient config:<connection><name>us2-LOACAL2</name><type>manual</type><ike_settings><keep_fqdn_resolution_consistency>0</keep_fqdn_resolution_c

Je viens de créer un tunnel VPN IPsec grâce à l'option VPN Wizard qui a automatiquement créé les politiques et les objets. Quand je lance mon FortiClient, je n'arrive pas à me connecter : un message d'erreur apparaît. J'ai récupéré les logs mais je ne trouve toujours pas ce qui bloque. C'est un Fortinet 101F avec la version v7.6.6 build3652voici quelque partie des logs ike 0:VPN:64: out B264FC333EFD2592341205A9F51C32110110020000000000000000C80D00003C000000010000000100000030010100010000002801010000800B0001000C00040001518080010007800E008080030001800200048004000E0D0000144A131C8107035845 5C5728F20E95452F0D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF000000148299031757A36082C6A621DE00000000 ike V=root:0:VPN:64 : envoi d'un message IKE (ident_r1send) : , longueur=200, vrf=0, id=b264fc333efd2592/341205a9f51c3211 ike : réduction de la mémoire de 159 744 octets ike V=root:0 : réception de, ifin

Hello everyone, In a Fortinet FortiAnalyzer VM environment, we are frequently seeing the alert:[Your daily logs GB/day limit is exceeded within the last 7 days]I would like to hear from the community about real-world impacts when the daily log ingestion limit is exceeded.Have you experienced log loss, delayed indexing, or incomplete reports?Any noticeable performance impact or issues with analytics and event correlation?  Note: I am fully aware that the daily gigabyte allowance is quite low and I am willing to upgrade the license, I just wanted to know what I might be compromising on my analyzer. 

I'm spinning up a new pair of FortiGate 901G's to replace some Cisco FTD's (yuck!). I'm very used to and appreciative of Palo's way of doing security policy, centralized NAT, and a separate decryption policy. I like being able to make security policy directly based on app or URL category, rather than making profiles for everything. I don't see how profile mode is as flexible as policy mode. If I want to make a policy for a single app to be let through, I can't do that with profile mode, as an app control profile allows and denies all apps. For example, say I want to allow the "Quickbooks" app. I can't make a policy that has an app control profile of just allowing Quickbooks.. The app control policy would either end up blocking or allowing all apps. This is where i see the biggest downside to profile mode.I've spoken to a few people I respect in the Fortinet world, and they recommended staying with Profile mode for varying reasons...- I heard there is less support for Policy-based mode-

Hello,I have two FortiGates (Site 1 & Site 3) connected via two GRE overlays:GRE_DC1_S3_AS20 – latency: 0.39ms, packet loss: 0%, jitter: 0.05msGRE_DC1_S3_SP5 – latency: 35.15ms, packet loss: 0%, jitter: 2.79msI configured SD-WAN between the two sites.Test scenario:Site 1: 172.16.213.2Site 3: 172.16.233.31. Best-effort / untagged trafficSD-WAN rule: Best Quality, latency criterionTraffic correctly uses AS20When AS20 degrades, traffic fails over to SP5 → works as expectedAfter this test, I modified the SD-WAN rule for untagged traffic:Strategy: ManualPreferred interface: SP5Observed behavior:Untagged traffic correctly goes via SP5 (as intended)2. Classified traffic (CS6) SD-WAN ruleNetwork Control for CS6 class trafficStrategy: Best QualityCriteria: LatencyProtocol specification:Protocol number: 0Type of Service (TOS): 0xc0Bit mask: 0xffTest ping from 172.16.233.2 :ping -s 600 -c 100 -D -Q 0xc0 172.16.213.2Expected behavior:Traffic should use AS20 because latency (0.39ms) is well bel

My security team has this compliance requirement."Attempts to access websites through their IP addresses instead of their domain names are blocked by web content filters." How would this be configured in FortiGate? 

what can I do? I'm just on the LAN that is connected to the Fortigate 40F. 

In a custom dial-up VPN configurationWith ike v2 and mschap2 enabledI need to match users who connect to the VPN with their respective groups via radius attributes passed by Forti Authenticator.Currently, if I configure the IPSec tunnel with ike v1Xauth within the policies, it works.However, if I enable IKE v2, I connect to the VPN, and authentication works even with 2FA.Nevertheless, the user is not matched on Fortigate because I do not see them in the list:diagnose firewall auth listTherefore, the user is not associated with the remote radius group membership in Forti Authenticator.Is it possible to emulate the behavior of xauth while maintaining the relevant remote groups of Forti Authenticator within the policies, even with IKE v2?I would like to avoid creating x pahse1 interfaces for x groups on my Fauth that belong to two different LDAP servers.

HelloIs it normal that FAC 6.6.9 has more known issues that 6.6.8, which in turn has more known issues thank 6.6.7, which in turn has more known issues than 6.6.6?From what I understand, normally each new patch should fix known issued from the previous version, right?

Hello. I am trying to figure out how fortinet stuff works, and it seems like it's tied up to the cloud. It looks like I have to get my fortigate unclaimed before I can use it. Is that correct? I haven't found anywhere to put the serial number into, to check warranty status and if it's claimed. When I enter the SN into the forticloud I get this:Invalid input data:Please double-check the Fortinet appliance registration number you typed in. If your input is correct and the problem persists, please submit a customer service ticket. It is the 100% correct SN I am using. Could this mean my 101F has been claimed and is unusable? Thanks!

Hi Community, I would clearify, when enable "UEBA" feature, does it require install other FortiSIEM agent? as we already installed "FortiSIEM Log Agent" on servers (Window), our current version 7.4.x.x.Thanks for your respoonds. 

Admin I need help to generate report on the demo link, I've been searching for some time now on how to generate report in FortiMail, but none of the documentation helps. I haven't configured any single thing, because I saw there's already a data on the demo, please guide me on how to generate a report in this FortiMail Demo, thanks.

SSL VPN was replaced to IPSEC on FGT version 7.6. I already configure IPSEC IKEv2 with EAP enabled.But why in forticlient android when select IKEv2 there is no field to enter the credentials?

Hey guys, so I did a "small" mistake.We bought two new FortiGate clusters (120G and 100F, both active-passive) to replace our old Palo Altos. One cluster is already running and the other is in the lab to set up.While starting to configure the second cluster, I realized that I mixed them up. The running cluster should be the 100F, but those firewalls are currently on my table. What is the best way to replace the running cluster with the other hardware?The issue I have is that I don't have much time. The second cluster has to be installed next tuesday and the already running cluster is already full productive. How can I exchange them with the least interruption? Thank you so much for your answers!

Good morning, I am struggling with an issue with FortiClient SSL VPN (Standalone VPN) on a Windows 11 computer. I have installed the FortiClientVPNOnlineInstaller.exe from the FortiClient downloads page. The install finishes correctly. I am able to set up the VPN. I've used the exact same VPN configuration on other computers with no problems. On this computer, when I click "Connect" it seems that nothing happens.The expected response would be for FortiClient SSL VPN to open a web page for me to log into my SSO to authenticate. I've performed the following troubleshooting steps:1. Restarted the computer.2. Uninstalled FortiClient VPN/reinstalled FortiClient VPN.3. Checked, double-checked, and triple-checked the configuration. Even tried multiple remote gateways that should work.4. Ran SFC scan on the computer.5. Performed a Network Reset via Windows Network Settings on the computer.6. Ran DISM /RestoreHealth on the computer.7. Flushed the DNS cache.8. Tested the FortiClient VP

 We recently upgrade our EMS server to 7.4.5 from our Windows 7.2.12 version. All went well and the FortiClients are being upgraded from 7.2.13 to 7.4.5...But we now have a swarm of complaints for the following issue with 7.4.5 and this specific routine makes it happen everytime.PC connected to the VPNPC going to sleepPC coming back from sleep with the VPN down (normal) but no internet browsing possible on the machine.all browsers display "Your Internet Access is Blocked" with ERR_NETWORK_ACCESS_DENIED. We can ping any internet IP and use DNS but browsing is completely blocked and not even visible in a Wireshark capture of our wifi connection.  If we close FortiClient browsing resumes and we can then launch it again and all works fine. A reboot also works obviously.  So there's an issue with Windows 11 going to Sleep with a FortiClient 7.4.5 connected (important) upon coming out of sleep.  We have more than 1000 PCs upgrade right now and the issues are pouring

Hi, I'm trying to install Forticlient VPN on my system (Fedora 43) but  I'm getting this error:package forticlient-7.4.3.1736-1.el7.x86_64 does not verify: no digestI've tried adding the forntinet repo and installing with yum, and using the .rpm file, but I always get the same result. Is there any solution to this problem? Thanks in advance.

Hi  Is there a way to implement session based authentication for users instead of IP Based Authentication ,as I have  The below scenario:1. FortiGate Firewall running version 7.4.3, is the Gateway & DHCP Server configured with a Captive Portal ,it authenticates users against LDAP .2. The wireless network has 1 SSID, with different Access point vendors, when users move-in between the different access points ,they obtain different  IP address`s ,they are prompted to re-authenticate on the portal.3. The previous gateway was a Meraki firewall ,it was able to authenticate users based on sessions, whereby you only logged in once on the portal and re-AUTH happened when the account duration had ended .It was not based on IP address`s hence users didn`t get the portal to re-authentication as they moved around. Edit 1 : Most of the users use tablets /laptops not joined to the domain Is there a way to do this ? Thanks 

I have a requirement to use ZTNA (Zero Trust Network Access) on Android devices. The devices need to communicate with some printers on the corporate network. We have already set up the ZTNA Destinations, policies, and groups, but communication doesn't work on Android devices. However, when we test it on Windows, the communication functions properly. Could you let me know if ZTNA has any compatibility issues with the Android system?

Hello to everybody, Two days ago, the following system events appeared:  I haven't activated this and I do not know how this could happen. My FortiGate does not support WiFi (or this is what I thought...). Please, what do I have to do to turn off the Wireless Controller? Thank you for your help. 

Hello, My FortiMail VM 7.4.6 was working perfectly until a 403 Forbidden error appeared for the administration GUI.Some additional network interfaces and routings have been added but none of the administrator users have setup trusted hosts. The Webmail interface is hosted on the same network interface and it is still working.The only admin access is on CLI mode via the ESXI console.   Have you some ideas ?  Thanks

Hello, I had Virtual Fortigate in Azure VM02, Version was 7.2.5Then I did upgrade up to 7.4.0 and now see this message: And I can't disable. Even if I'm trying to click "Begin" I can't do any migration, but If I click "Later" Fortigate is working as normal.  Very annoying message, how I can disable it?

Hallo, last week I updated the Fortigate to the new firmware. We use Fortinet and 2FA with Tokens. After the update no VPN-Token worked anymore. Noone could start a VPN anymore. I had to create new Tokens for everyone. Then it came into my mind, what if the Tokens for the Admin-Logons would not work anymore either. Would we be screwed or is there a possibility to logon without 2FA?