Solved

Hi all, I am able to connect to a Fortinet VPN server from Windows 10 using Fortinet Client v6.0.9.0277. My configuration is displayed in the following 2 pictures: But, from linux mint, using strongswan I am unable to connect. Here is my configuration: # ipsec.conf - strongSwan IPsec configuration file conn FortinetVPN keyexchange=ikev1 aggressive=yes authby=secret left=%defaultroute leftauth=psk leftid=My_User_name right=VPN_IP_HERE rightauth=psk rightid=%any rightsubnet=0.0.0.0/0 ike=aes256-sha256-modp1536,aes128-sha1-modp1536! esp=aes256-sha1-modp1536,aes128-sha1-modp1536! dpdaction=clear dpddelay=30s dpdtimeout=150s ikelifetime=86400s lifetime=43200s keylife=43200s rekeymargin=3m keyingtries=1 auto=add type=tunnel replay_window=32 mobike=no forceencaps=yes   #ipsec.secrets My_User_name : PSK "My_Preshared_key" My_User_name : XAUTH "My_Password" &nb

Hello family! I am asked to enhance a Fortimail VM with recommended features located in the dashboard for Fortimail 7.4( and believe me, I do not understand MOST of the features in Fortimail - as someone said in a  video, features are TOO vast/plenty):1. Policy (Access control, ip policy, recipient policy etc)2. Profile (session, antispam, antivirus, content, replacement message, resource, auth, ldap, dictionary, security, ip pool, group, notification)3. Security(url filter, quarantine, greylist etc)4. Encryption ( IBE etc)5. Log & Report Could I kindly get a set template/industry standard for a good Fortimail Deployment( a step by step guide) so that i can use on my fortimail? I know many admins have their options tweaked to their environment, but I will use anyone's recommended options, take time tweak mine accordingly.I already know my LAN/WAN net configs. The only thing i would do is just use my IP details, replacing what e

Hi Guys,   Is it possible to directly integrate the on-premise FortiGate with SSL VPN use case to my Microsoft Authenticator to be my 2FA mechanism? Or, should I use a RADIUS server like FortiAuthenticator where the FortiAuthenticator will be the integration point of my FGT, AD, and Microsoft Authenticator? Thank you.   Thanks

Hello, there are two versions of the FortiClient available. User based and device based where the first one is cloud based. what are the main differences between the two and to which use cases are the two types more suitable) Is there a comparison sheet available? Please point me in the right direction. BR Andreas

Hi Team.I have configured site to site vpn with fortigate firewall and sonicwall firewall. with this help of this link https://www.gns3network.com/how-to-configure-ipsec-tunnel-between-fortigate-and-sonicwall-firewall/   i configure site to site vpn . after configuring vpn. both the phase1 and phase 2 tunnel are up in forigate and sonicwall. but i cant able to access the sonicwall network lan or even i cant able to ping sonicwall lan network. from sonicwall lan i can able to access the fortigate lan interface.but from fortigate i cant not access sonicwall lan. can anyone guide me to solve this.

Good day,I am new to Fortinet, I am use to the Cisco product line and wish to expand my knowledge further, using Fortinet products way forward.Mode chosen: Gateway modeDeployment type: Forti mail in the DMZ or Behind the FortiGateCould someone kindly assist me step by step(probably u did for your environment/similar if possible) how to carefully deploy a Forti mail VM to manage and monitor my email traffic in Gateway mode. I have read via the 7.4.1 admin guide, other admin guides, watched a few YouTube videos and NO real guidance, step by step solution, not even a workable template based setup for Forti mail, just a bunch of webinars, chatting and simple setups(telling/referring you to go read this entire document(admin guide), no real lab scenarios at all. I have configured/setup and deployed many devices, network solutions in infrastructure environments/datacenters, some all by myself, others with help of comrades, video guides and straightforward - coherent reading material. But I a

Hello, I have a 1101f series firewall. I want to connect 6 fortiswitches. When I connect the switches over fortilink by jumping from each other, there is no problem and all of them get ip and the connection status is actively monitored. However, when I need to connect with different 6 ports of the firewall (due to the wiring structure of the building), I enter 6 ports into fortilink. When I connect the switches, they get ip first, but the connections go immediately. DHCP does not work and they cannot get ip. What is the reason for this?In addition, I created a fortilink port as a Hardware Switch. When I put the ports into it, all switches get ip but only 2 of them seem to be active. I can reach the others but they do not seem active. What could be the reason for this?

I know I setup some VLANs on my FG60F a while back, but when I look at the interfaces in the GUI, they don't show up. How can I view my VLANs either in the GUI or even command line?

Hi All, Sorry, my first post here, and forgive me if this has already been asked earlier.What firewall will do if it receives SYN, ACK (half-open session) packet or subsequent packets for an already established session on a different interface (not the one where the packet was sent out)?  Thanks,Myky

Hello team, I have the following problem when a device connects to an SSID.Basically when a device connects to this specific SSID it fails to get the 'ip address in DHCP. This is the traffic flow:Device --> FortiAP --> FGT200F --> MPLS Circuit --> Fortinet 400F (fortiAP was added here) .The authentication via Radius occurs successfully while the release of an ip address does not. The DHCP server and Radius server are two different virtual machines.I see from the logs that the correct vlan is pushed to the device but the DHCP request goes timed-out. I kindly ask:On the network interface of the SSID should DHCP relay be enabled ?Should policies be created to allow DHCP traffic from this interface to the DHCP server ?Should vlan31 be carried from the interface where the FortiAP is connected to the firewall interface where vlan31 is connected ? Thanks for the supportBR

HelloI have a FortiNet and I would like to connect a FortiAPI have connected the FortiAP to a switch (management vlan) which is connected to the FortiGate.The thing is that from the Fortinet "Managed FortiAps" appears in (Offline). However, the FortiAP responds to ping on the network.Is it necessary to connect the FortiAP directly to the FortiNet for it to detect it?If not, why does it appear Offline?

FGT60F has two WAN lines.WAN1 Fixed IP: NOT WORKWAN2 Dynamic IP: NormalFirmware 7.4.3 Reviewed the configuration with FWF60D to test WAN1 It is the same WAN1 setting. FWF60D is normal:It can ping 8.8.8.8Outsite can ping the Fixed IPConfirm the Fixed IP line normalWhen set FGT60F's WAN1 to be dynamic IP, the WAN1 can ping another device that can ping back FGT60F Not sure why Fixed IP fails but Dynamic IP works on FGT60FWAN1: Dynamicexec ping-option resetexec ping-option interface wan1 exec ping 8.8.8.8PING 8.8.8.8 (8.8.8.8): 56 data bytes64 bytes from 8.8.8.8: icmp_seq=0 ttl=58 time=1.7 ms64 bytes from 8.8.8.8: icmp_seq=1 ttl=58 time=1.4 ms64 bytes from 8.8.8.8: icmp_seq=2 ttl=58 time=1.4 ms64 bytes from 8.8.8.8: icmp_seq=3 ttl=58 time=1.4 ms64 bytes from 8.8.8.8: icmp_seq=4 ttl=58 time=1.4 ms--- 8.8.8.8 ping statistics ---5 packets transmitted, 5 packets received, 0% packet lossround-trip min/avg/max = 1.4/1.4/1.7 msWAN1: Fixedexec ping-option reset exec p

Dear All,I'm using the FortiGate 100D and I am using 802.3ad Aggregate interface. One another device is plugged into another port of the FortiGate (port 3) (IP static is 10.199.139.200). I have created one policy for I can go to that port 3 but I can't ping to the IP 10.199.139.200 when I'm in the 802.3ad Aggregate interface network. I can ping that IP from FortiGate. I don't why? 

GreetingsI navigate here:Fortilyzer > Log View > Traffic.See below.Q1 How do I custimoze the columns?Q2 How can I edit/change the Device ID column to give an hostname of some more friendly host id?I have checked these URLs but I have not made sense of them:7.4.1 Admin Guide Customizing displayed columns Forum Post Sorting the Columns Customizing displayed columns  Thanks

Let's say my environment consists of 1 spoke and two hubs. All sites have at least 1 ISP. There is an MPLS link between each spoke and the hub, no MPLS between spokes.Spokes will route through the Hub via MPLS via OSPF to reach each other.If an MPLS link fails at the spoke, I'd like to IPSec to the Hub and other spokeIf an ISP link fails at a spoke, I want to use the underlying routing protocol to route through the Hub for internet traffic.In this scenario, should both the ISP and MPLS links be in the same SD-WAN zone like "underlay"? Or should they be separate zones like "mpls" and "isp" ?Looking for any best practices on how to create zones based on topology and use case.Don

Hello, does the linux forticlient 7.0.x support two factor authentication with the fortitoken app?If yes, what distributions are supported? GreetingsAndreas

Dear All, Need help for configuring Source IP on FortiAuthenticator to connect with FortiAnalyzer, I can't see any configuration to change source IP on FortiAuthenticator eventhough I am accessing via ssh, there is no available command to configure source IP. FortiAuthenticator using two ports (port1 & port2) default for communication with FortiAnalyzer is with port1. Can I change it to port2?I can see the setting in Fortigate but not with FortiAuthenticator. Please help to advice.FortiAuthenticator FortiAnalyzer 

Hi My Fortigate device OS version is 7.0.2.When I configure Azure AD SAML authentication with the documenthttps://docs.fortinet.com/document/fortigate/7.0.2/administration-guide/33053/outbound-firewall-authentication-with-azure-ad-as-a-saml-idp333Go to step 4,  The SAML IdP sends the SAML assertion containing the user and group. After the browser log in to azure, it seems that it can't return to FortiGate, Whether my identifier (entity ID) uses public IP or private IP.  it aways say:The connection has timed outAn error occurred during a connection to 192.168.11.1:1003.  Who can help me the possible problems? Thanks a  lot    

Hi Team,I have FSR7.3.x. I have installed and configured the Arbor DDoS connector in FSR. Now I want to block the IPs on Arbor DDoS through SOAR. But when I see the actions available in the connector, the Block IP or Block IoCs kind of action is not available. Kindly let me know if I want to block the IPs on Arbor through SOAR, how can I do this? I shall be extremely grateful. The version of the Arbor DDoS connector is:Arbor DDoSVersion 1.0.0-6388Certified: NoPublisher: Community The available actions are: GET ALERTSRetrieves a list of all DDoS alerts or specific alerts from Arbor DDoS, based on the search criteria you have specified. GET NETWORK SUMMARY REPORTRetrieves network summary reports from Arbor DDoS, using various filters such as the name of the customer associated with the report, the unit associated with the report, etc. you have specified. GET TOPTALKER REPORTRetrieves the top talker external or internal reports from Arbor DDoS, based on the r

I was tasked with leading a POC for the FortiEMS system to help manage our VPN already in place. A senior teammate set up the server months prior before I took this project and passed it off to me. I grabbed a clean install of Windows machine that is not on the domain and used that one to test on. The first install worked great, registered itself, and stayed online. Wanting to become proficient with the EMS server, I unregistered the device, deleted it from the EMS server, and then uninstalled it from the test machine. I recreated a new invite and now it refuses to connect.     I am looking for any FAQ or suggestions on how to troubleshoot this issue. Did I go about this incorrectly?

I have installed forticlient_vpn_7.2.2.0753_amd64.deb on a Debian  system and an unableto connect.  The forticlient gui starts and I configure the connection as instructed by the networkadministrator.  I have tried both Debian 11 and Debian 12 with the same results.  When I click "SAML Login" on the forticlient vpn screen showing the vpn name nothing happens.  No errors, no authentication popup, and no connection is made. main.log:[2024-02-22 10:33:19.561] [info] WindowManager handlePossibleProtocolLauncherArgs argv=["/opt/forticlient/gui/FortiClient-linux-x64/FortiClient"][2024-02-22 10:33:19.577] [info] WindowManager handleCreateMainWindow[2024-02-22 10:33:19.620] [info] MAIN MainWindow - createWindow Platform detected: fedora[2024-02-22 10:33:19.829] [info] web-contents-created contents.id=1[2024-02-22 10:33:19.906] [info] Saml - init[2024-02-22 10:33:19.907] [info] Saml - listenSamlLoginRequest[2024-02-22 10:33:20.486] [info] compliance configDir=/home

Hello team, i have a question about Netflow.Netflow is clear to me that it can be enabled on a network interface to track traffic either in RX or TX or both. I wanted to know if it is possible to enable netflow only for a certain type of traffic and not for all traffic to pass the interface where it is enabled.I looked in the official documentation but could not find anything about it. Thanks for the helpBR

I have SSID verification on fortigate firewall with Fortinac radius. I have a problem like this. Although there is mschapv2 in the radius settings, a user in the domain joins the network without any problems, while the user I created as a guest in the Fortinac interface Credentials Invalid (MSCHAP2) error, what is the reason for this? 

I have recently set up some SSL VPN Portals on a Fortigate, that are mapped to specific groups, the Fortigate is a Radius client from the FAC, The FAC uses LDAP to look up the user in AD, then looks at RSA for a token to authenticate the users.   All of the above is working abolutely fine, except for groups being passed to the Firewall to be used in the Portal mappings and Policies. I have to create a user on the Gate as a remote radius user, using the same name exactly that the FAC uses. this works... but some of the portals have 30-40 users. I had to create 30-40 individial users with the same name as the FAC.   Groups dont work in the same way, The documentation say you just create a Firewall Group with the same name on the Firewall, and make sure the FAC is sending the group-name attribute, which in my case it is., but it doesnt work, I have to switch back to using username. is this a bug?

I have a problem with Fortinac. Quarantine vlan defined in fortinac interfaceFortinac port 2 ip address10.10.24.100Quarantine vlan10.10.22.10-10.10.22-250I turned on vlan quarantine in Fortigate firewallGateway10.10.22.1DHCP relay 10.10.24.100When I do this, a user who enters the quarantine vlan gets ip without any problem.But my main problem is thisI have a domain and users log in with LDAP. However, in the quarantine vlan, the user cannot log in. It gives a domain error. If I manually enter the domain in the DNS section in the network settings, it gets better. But I cannot add DNS because DHCP distributes nac.How can I solve this?