Solved

Hi Team, We are facing issue after enabling Geo blocking for other country except India. Policy which I have configured - Incoming interface - SDWAN interfaceOutgoing Interface - Vlan Interface.Source country - IndiaDestination - VIPNAT - Natted IP (1.1.1.1-100.100.100.1) For examplePolicy - Accept Issue  that has been observed - Internal servers are not able to access site - for example - www.xxx.comwhich VIP is mapped with this policy When I enabled source - ALL that time is everything is going on smoothly. thank you.     

Hi all, Previously I have implemented Fortigate integrate with Okta authen. but now we still having some issues which is I am not really sure about it. Here is the config that I implemented in Fortigate  config user saml edit "okta-idp" set cert "Fortinet_Factory" set entity-id "https://xxx.xxxx.xxx.xx:10443/remote/saml/metadata/" set single-sign-on-url "https://xxx.xxxx.xxx.xx:10443/remote/saml/login/" set single-logout-url "https://xxx.xxxx.xxx.xx:10443/remote/saml/logout/" set idp-entity-id "http://www.okta.com/exxxxxxxxxxxxxxxxxxxxx" set idp-single-sign-on-url "https://xxxxx-url.apac.xxxx.com/app/apac-xxxxx/xxxxxxxxxxxxxxxxx/sso/saml" set idp-cert "REMOTE_Cert_1" set user-name "username" set digest-method sha256 next end xxxxxfw01 (corporate-saml) # show config user group edit "corporate-saml" set member "okta-idp" config match edit 1

I'm trying to understand some Fortinet firewall logs but I'm not sure I fully understand what is being logged by the firewall when it comes to direction (Incoming vs Outgoing)For example:srcip=7.7.7.7 dstip=192.168.10.50 srcport=45845 dstport=80 srcintf="port5" srcintfrole="wan" dstintf="port10" dstintfrole="lan" proto=6 direction="outgoing"I'm not sure why that would be categorized as outgoing instead of incoming. Since the traffic appears to be initiated from an external source. Would it not be incoming traffic? Or is it because the last interface is it hits is the LAN interface and it's "outgoing" from there?The idea is i want to alert on SIEM level for IPS detections initiated by internal devices not comming from the external wan !! Please anyone can help in that!!

Good Morning! I am new to Fortinet, having just moved our company from Cisco ASAs with Firepower to approximately 30 Fortigates, mostly models 40F, but a few of our bigger sites are using 60F and 81F. Currently running firmware version 7.2.6, build 1575. We are now using FortiManager Cloud Central Management & Orchestration, v7.4.1-build4261 230914 (GA) and need to learn how to re-create the global policies that we used to apply using Cisco Firepower, now using FortiManager. Policy-wise, the 40F's are configured almost all the same, except for an extra interface or Virtual IP or two.The other sites have a bit more going on, hosting many more virtual IPs, using policy routes, etc. There are some policies we would like to apply globally, where we can make the change in one place and it would apply to all of the devices in a group. The main example would be to have a policy rule to completely block a constantly changing list of countries from ever accessing our sys

Let me explain.Users SSL VPN into firewall A.Firewall A send the traffic to firewall B via a site to site vpn.So I have to configure an SSL VPN interface on firewall B to accept the traffic from A.How do I do it?

Hello!We have a problem with Fortiweb 7.0.6: when logging in over the https and AD-authentication to manage the device, the browser shows only blank page. I've tried to log in from another server and using in-private mode, also using another browser, nothing helps. My user account was recently added. Older users can log in and see the admin page successfully. The secondary Fortiweb acts the same way. I can log in via ssh. I even disabled http and https access methods on the management port temporarily but that didn't help: when I put them back and connect with https, log in, still blank page. I wanted to kill the admin httpsd process but how to identify that one? Since this is a web server serving many webpages, I don't want to kill all the httpsd processes, only the one that serves the admin log in.

This Tech-Tip desribes how FortiSwitch OS up till 7.4.0, can have issues with TLS 1.3. This is still an issue with 7.4.2! How come, this is a problem with latest browser versions, like Chrome & Firefox?   Are FortiSwitches telling it supports TLS 1.3, but in reality, it dosen't?

I have user that can successfully VPN into firewall A.There is site to site vpn established successfully between firewall A and firewall B.User is trying to reach a subnet on firewall B.The traffic was sent from firewall A with a certain number of bytes but received with 0 bytes.Firewall B did not receive the traffic.Static route was also configured correctly.What is the possible issue? 

I tried to reach out to another #FortiGate through the SSL-VPN client connection but it's not established.I ran a debug command on the SSL-VPN server to figure out the issue.I received these logs:2024-01-16 18:07:19 [260:root:19]allocSSLConn:310 sconn 0x7fab546000 (0:root)2024-01-16 18:07:21 [260:root:19]SSL state:before SSL initialization (X.X.X.X)2024-01-16 18:07:21 [260:root:19]SSL state:fatal decode error (X.X.X.X)2024-01-16 18:07:21 [260:root:19]SSL state:error:(null)(X.X.X.X)2024-01-16 18:07:21 [260:root:19]SSL_accept failed, 1:unexpected eof while reading2024-01-16 18:07:21 [260:root:19]Destroy sconn 0x7fab546000, connSize=0. (root)I used easy-rsa to create a server-client self-signed cert bundle to use for this purpose.Another thing that I should mention is that whenever I am using "openfortivpn" package in Ubuntu or FortiClient VPN and addressing those self-signed certificate locations for the CA, server cert, and user key, the connection is established without any problem.I w

I'm able to connect to the ssl vpn, after connected I can access to my f drive but when I ping my server name I can't find my host server. Also, I cant access to http://servername:5050/Login.aspx , it shows me DNS resolve failed, but I can access to http://192.168.X.XX:5050/Login.aspx Policy 1Incoming Interface: lanOutgoing Interface: virtual-wan-linkSource: allDestination: allAction: AcceptService: all Policy 2Incoming Interface: SSL-VPN tunnel interface (ssl.root)Outgoing Interface: lanSource: SSL-VPN Address, Employees user groupDestination: Local-LANAction: AcceptService: allHow to solve this problem? Please help T.TFortiClient 

HelloWe have FOS 6.2.x and want to upgrade to 7.0.13.In the meantime we have some old FAP 220B that we want to keep but without breaking the compatibility.The following command on another FOS 7.0.13 shows that FAP 220B is compatible with FOS 7.0.13.config wireless-controller wtp-profileNow I need to check which FAP firmware version is required/recommended on my FAP 220B so it can be compatible with my FOS 7.0.13.Tried to check on document "FortiAP and FortiOS Compatibility Matrix" but couldn't find anything on FAP 220B, I guess because it is EoL/EoSL.Any idea where I can find this info?

Hello everyone! I have tried a Fortigate 501E to an Active Passive Cluster. But after I configured the high availability settings the firewall crashed and paralysed the connection in the company. There are already some VDOMs and some policies configured on the firewall. How can I prevent the firewall from crashing again at the next attempt? This an urgent Question. 

Hi,after updating a Fortigate 60E from version 7.0.7 to version 7.0.8 the RDP via SSL WEB VPN no longer works with any PC, the error "Connection closed!" always appears. If I perform a NAT of the port 3389 from the WAN to the LAN I enter the PC correctly.I have changed all the possible parameters but I cannot log in, whether I enter my credentials in the bookmark or enter them by hand.I have already tried to follow this KB but nothing, error: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Unable-to-take-RDP-of-machines-via-SSL-VPN-web/ta- p / 192454Has anyone had the same problem?

I have a physical interface "internal1" with 3 subinterfaces.I have another physical interface "internal2".If i want to create firewall rule to allow traffic from "internal1" to "internal2",do i have to create 1 firewall rule only or i have to do 3 firewall rules?

Can i connect new fortigate firewall with version 7.2.5 to my Analyzer running 6.4.11 firmware ? 

Hi I want to disable and enable fortigate port3 every friday on 09:00 AM. I configured the below snitch, trigger and action but it does not run. what is the problem? config system automation-trigger edit "Disable_LTE" set trigger-type scheduled set trigger-frequency weekly set trigger-weekday friday set trigger-hour 9 next end config system automation-stitch edit "Up_Down_LTE" set trigger "Disable_LTE" config actions edit 1 set action "Disable_LTE_Interface" set required enable next edit 2 set action "Enable_LTE_Interface" set delay 10 set required enable next end next endconfig system automation-action edit "Disable_LTE_Interface" set action-type cli-script set script "config system interface edit port3 set status down" set accprofile "super_admi

I need to do next configuration for two 802.1x devices per single fortiswitch port: - ipphone with EAP-MD5 802.1x authentification; - PC behind the phone with EAP-TLS certificate based authentification.As I understand I need configure 802.1X-mac-based authentification on port for this scheme. Shoud it works without keeping all devices mac-address database on RADIUS server?  Thanks.

Hi We have a SSLVPN Web portal on one Fortigate. When using it to get to resources behind a tunnel on another Fortigate, it seems to NAT the traffic despite the policy having NAT turned off.  FG2 sees the source address of traffic to AWS being 192.168.1.1 instead of 10.10.1.1 Can anyone explain what's going on here?

Can i upgrade my fortiAnalyzer 300G from version 6.4.13 to version 7.2.xx? i dont see any upgrade path to 7.2.xx.

Hi All, my Fortigate 900D, After one power outage is not working any more, but power led is bright. When I plugged the console cable into the computer, it sent logs continuously without stopping. Could you please tell me what's wrong with this? handle it.Thank you guys.-> this is a log that the Fortigate sends continuously....Buffer I/O error on device sda3, logical block 2525481Buffer I/O error on device sda3, logical block 2525482Buffer I/O error on device sda3, logical block 2525483Buffer I/O error on device sda3, logical block 2525484Buffer I/O error on device sda3, logical block 2525485Buffer I/O error on device sda3, logical block 2525486Buffer I/O error on device sda3, logical block 2525487ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0ata1.00: irq_stat 0x40000001ata1.00: cmd ca/00:08:01:8b:36/00:00:00:00:00/e0 tag 0 dma 4096 outres 51/40:00:01:8b:36/00:00:00:00:00/e0 Emask 0x9 (media error)end_request: I/O error, dev sda, sector 3574529Buffer I/O error on device sd

hi,i got a FW policy which includes blocking ISDB address group/objects, i.e. botnet, cnc, phishing, spam, etc.the FW policy install from FGM failed after i tried 3x times. FW01 (16) $ set internet-service-name "Blockchain-Crypto.Mining.Pool" "Botnet-C&C.Server" "Malicious-Malicious.Server" "Phishing-Phishing.Server" "Spam-Spamming.Server" "Tor-Relay.Node" "VPN-Anonymous.VPN"entry not found in datasourcevalue parse error before 'VPN-Anonymous.VPN'Command fail. Return code -3FW01 (16) $ nextMust set internet service, internet service group, dynamicnetwork service, custom internet service or custom internet service group for destination.object check operator error, -56, discard the setting per checking forticloud, the fortiguard service/feature entitlement are down/red. my questions are:1.do you need a valid warrantly/entitilment for ISDB to work?2.do you need to have a count under the 'number of entries' for the ISDB IP reputation DB.3.does 1 and 2 above need to be working

Hey guys, I'm facing an issue that I'm not sure if is my mistake or what, I hope you can give me an hand on this.So I'm installing a new FG with version 7.2.6 using fortimanager and I'm getting a error that I didn't saw last time we installed a FG (was in version 7.0.x) also using fortimanager.We use address objects and groups for the RFC1918 and now with it seems that we can't have the 0.0.0.0-9.255.255.255 range anymore since the FG says that "start-ip can not be 0", well sure let's change the address object, but I can't because "Could not change assigned objs"...Well that object is part of a group, and that group is being used, but if I try to remove the group from the address object nothing happens, I mean, the group is still there.I changed the IP on the global ADOM but didn't help.So I'm left with a catch 22.Can someone tell me what I'm doing wrong here? EDIT: I forgot to mention that the address object is a global one, that's why I though updating the global one would

Hello Fortinet Community!I have implemented in the past policys to allow my servers and VMs to reach microsoft and AVs(bitdefender) servers for update only. Recently the Internet Service Policy stopped working. The VMs wont update. Any ideas? Have the Internet Service Database stopped working?Is there a correct order for them to be adjusted?Is there a default internet service required in all policys to be able to reach the required destination?  Thanks in advance

Hi Everyone,Is there any way to limit users to only be able to Login Authentication using the Chrome browser?My device is FortiGate 80F and Firmware v7.4.1 build2463 Many Thanks! 

Hi everyone,   Here is my use case :   I set up a Hub'n Spoke topology with Hub in azure and physical appliance in offices. In one of theses office, we share Internet acces with tenants.   So, I activate multi-vdom on this Fortigate but, I'm stuck on how to configure Internet acces, how to set up this FGW as a spoke.   At this time everything is in the root VDOM. I want to set up a VDOM for my Company and a VDOM for tenants. Tenants only need to access Internet. And Of course My company need to access Internal ressource throgh Hub'n Spoke topology.       So my questions are : - Where should be may hub'n Spoke logic (Tunnels and SDWan rules) in Root or MyCompany VDOM? - How do I share Internet access (VDOM Link, VLAN on NPU Vdom Link assigned to each VDOM)? - What are the best practices for this scenario.   PS.: FortiOS is 7.0.13   Thanks for your help, Frederic.