Solved

I've had 2FA working again Authenticator for some time but recently was tasked with turning on the push notifications but my FortiClient does not have a "Push" button and I really never knew it was supposed to. I thought when you made the authentication request (logged in when prompted by the VPN config) that it would go ahead and ask you to input the token AND still accept the push, but from the 6.4.8 Release Notes it would appear that I should have the option to select "push" OR to enter my code:   To connect VPN with FortiToken Mobile using push notifications:1. On the Remote Access tab, select the VPN connection from the dropdown list.2. Enter your username and password and click the Connect button. The Click on 'FTM Push' or enter token code box displays.3. Click FTM Push. Your device with FortiToken Mobile installed receives a notification.4. On your device with FortiToken Mobile installed, tap the notification and follow the instructions to allow the authentication request

Hello,I'm trying to get FSSO working through Fortimanager. In FortiManager I have set up the FSSO external connector, I have also set up Device Mapping, in policies I can assign users to a rule, however the connector itself does not appear in FortiGate. I have Fortimanager installed on my server, firewalls at customers, so I would need the connector to be migrated to the firewall as well. According to this link, the connector set in FortiManager should be transferred to FortiGate, unfortunately in practice this is not happening.https://community.fortinet.com/t5/FortiManager/Technical-Tip-Configuring-FSSO-from-FortiManager/ta-p/268745If I understood the message at the end of this article, it says that the connector should be transferred to the firewall, right?https://docs.fortinet.com/document/fortimanager/7.4.2/administration-guide/303084/creating-fsso-connectorsCould someone please advise me?

Hello colleagues,I use FortiToken to log in to computers and servers, and in this case, when trying both by push and by code, the first time works correctly, but for example, if I try to log in to another device during the same period when the token has not changed, I cannot log in, only when the token changes.According to the FAC log, the following appears: User does not verify the login on FortiToken Mobile: Received invalid token code from user. Authentication aborted.Given that the code is correct, is there any way to change this configuration?Thank you all in advance. FortiToken 

The problem is in the work of the authentication agent. There is Exchange 2019 in the DAG cluster. After installing the agent and working for some time, there are problems with user authorization with the error reason=2, while all users cannot log in through the web.At the same time, user authentication is successful on the server itself. FortiAuntificator: 6.4.1ForiISSOWAAgent: 2.3 Agent Microsoft OWA errors: [(null)|22|DEBUG] Login: Session luqtww2dgd32l4t5j0unvd2f: Verification of user (ismagilova_olga) OTP successful: VerifyOTP for user first-name_last-name was successful: 200 OK [(null)|22|DEBUG] Login: Session luqtww2dgd32l4t5j0unvd2f: Submitting user credentials to: https://exchnage/owa/auth.owa2023-07-04 10:49:30,400 [(null)|22|INFO ] Login: Session luqtww2dgd32l4t5j0unvd2f: Server (ip address) rejected logon with reason: reason=2

Hello Guys. I'm facing issue with the Hub and Spoke topology showed in the picture, I added Spoke1 to newly to the topology and I can ping from any device behind the spokes subnets to the subnet behind the spoke1 but not the reverse!I can ping from (172.16.11.2) behind Spoke1 to (10.11.22.14) behind the Hub.But, I can not ping from (172.16.11.2) behind Spoke1 to (172.16.6.28) behind Spoke3 (the reverse ping working!).the funniest thing is that another IP from the same subnet is pingable! when I try to ping (172.16.6.233) it just works fine. Any idea?  

The Fortinet chosen naming convention for objects created in the global ADOM uses a single letter 'g' prefix. Fortinet documentation says that you should not create objects in ADOMs that begin with letter 'g' or else conflicts can occur with the global ADOM objects. This would preclude the use of address objects named 'google', 'gmail', 'greatscot', and on and on. So it would seem that the choice of using a prefix 'g' is very limiting. Why did Fortinet choose this naming method?Are there any ways to relax this rule to allow other prefix characters or strings?Would it be better to provide an option to use a different prefix, such as an underscore, or even a user configurable character?Would it be even better if a user configurable string could be used? Such as, 'global_', '_glbl_', 'g_', or some other user chosen string?

Hello,I am trying to join Fortiauthenticator as a machine in windows AD.I am following this document :https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-Joining-FortiAuthenticator-in-the-active-directory/ta-p/195891 I do not want to use adminsitrator account for this operation for security reasons. Is there any other way how to do it?

Hello,I am facing an issue with the disk size of Fortiauthenticator VM. I have increased disk size to 250GB on the VM machine but it shows only 60GB on the Fortiauthenticator. Is it possible to increase it? 

Hi, I would like to understand the FortiSIEM rule "No logs from a device" which I think is when a device stops sending logs for 10 minutes, I have many alerts and I want to increase the time from 10 minutes to 1 hour, How i can do it?

I have spare equipment that is not licensed, but I need to exchange it for one that is in production and licensed.  I saw that the rehost is normally done through RMA, but my production equipment is not having a problem, this exchange needs to be carried out due to the client's particular needs.  Is there possible to perform this rehost via the customer's Admin Portal? Or through some Portal that the customer has control over and is not dependent on having to open a case with Fortinet Support? Thanks. Best Regards.

HiWe want to allow allow anydesk for it department but in ssl logs i see that anydesk ssl is resign and untrusted. I exempted anydesk domain in deep ssl inspection but did not solve the problem. What can i do to solve this problem?

Hello guys, I'm a newbie in IT field.I'm currently trying to setup policy on a FortiGate100E to block the use of Line PC client.>>FortiOS v7.2.4 build1396(Feature)Now I successfully block Line usage, but regarding the subject, I want to know if it's possiable to block file transmission on Line PC client without affecting text and voice messages.I've tried to dissecting packets and setting app signatures, but can't made any progress. Thanks for any reply and possible assistance.

Hi What is the best practise to create a policy from wan to lan?

I would like to connect directly from the SSL-VPN segment to the spokes segment.This is network layout.[PC]--<Internet SSLVPN>----[FGT60E@HUB]----<IPsecVPN>----[FGT60E@SPOKE1]----[LAN@SPOKE1]                                                                  |                                                                  |                                                                  |                            &nb

I've made a change in our LDAP configuration by moving all users with current tokens to a new group CN=FW_VPN_Client_Users. I plan to manage VPN access by adding users to this group as needed. Before I proceed further, I have a question regarding the 'Set Group Filter' option in our Fortinet setup: If I adjust the group filter settings now, will it impact users who are currently logged into the VPN with valid tokens? In other words, will changing the filter settings disconnect or otherwise affect these active users? I'm looking to understand whether these changes will apply only to new authentication requests or also to users who are already authenticated and actively using the VPN. Any insights or experiences you can share would be greatly appreciated!

Hi all, I have a new FAC and I have changed the admin local user password. Now, I can connect in CLI but when I want to connect in GUI with the admin local user, I have an error. The error is:  please enter correct credentials. note that password is case-sensitive.   I have changed the password with the admin-maintainer and change the password: I can connect in CLI with the new password but in GUI it's the same error. I have tried to restart the webserver with this command: Diagnose web restart, but it's also the same.   How can I resolve that?

Dear everyone.I have configured my network to use Ipv6 as detail below, it work ok, this configure allow client pc connected to LAN interface can connect to internet using ipv6 OK with ipv6 from DHCP6 server.But the problem is if the pppoe is reconnect, IPv6 Address/Prefix on LAN interface will changed because it is delegated to WAN1 and the ISP provide dynamic IPThe DHCPv6 will assign a new ipv6 to computer network, now the computer may contain multiple ip address, the previous IP and the new ip. But after this, the PC cannot connected to internet using ipv6, i have to disable the network interface and enable again or reconnect to wifi network to make the PC work with new Ipv6I think that there are sth wrong or miss in my configuration, so pls kindly helpThanksconfig system interfaceedit "wan1"set vdom "root"set mode pppoeset allowaccess ping https http fgfmset type physicalset explicit-web-proxy enableset role wanset snmp-index 1config ipv6set ip6-mode pppoeset ip6-allowaccess ping h

I am looking for Fortigate firewall buyers guide, most specifically UTM, Enterprise, Advanced Threat Protection vs  manual selection of services. Is there URL / PDF for buyers guide?

What happens if it is a "normal" firewall rule without any filtering applied?

Hi All, I have issue with web filter, I blocked shopping category and I tried to add an exception for a specific web site, so I added this link to URL filter to allow this traffic, the site already opened but unable to load any content in this site like photos, to solve this issue I must allow entire category which is not what I need to do. .  

Hi   I encountered a wired situation. When I enable web filter and dns filter in a policy, the dns servers on fortigate become unreachable or with high ping times and fortigate won't update at specified time. when i disable those security profiles the dns will have normal ping time. How can i solve this issue? I have tested with so many dns servers.

Hi I am really confused about flow based and proxy based on firewall policy. When should i use either of these? Fkr example i have 7 servet facing on internet and i configured antivirus,ips and i want to config WAF too but it requires to use proxy based but all other security profiles configured in flow based mode. What should i do?

HiI want to enable ddns in fortigate but i can not select any servers in server list. How can i config ddns?

Hi, As a part of PoC work for one of our projects, we are evaluating FGCP HA. Currently, we are trying to setup HA on ESXi servers with evaluation licenses for FortiGate servers. But the setup for FGSP HA did not work, even though we have two different serial numbers for both FG and FW. I also enabled promiscuous mode on Vswitch, but it didn't work. Could anyone please confirm if HA will work on the VM evaluation version? Regards,Thoubik Ahamed P.

Hello everyone,I have a question about Fortigate IPS.Could you please provide information on the potential actions that can be implemented upon a signature match?It would be helpful if you could include explanations for each action (what thatb mean success / failure).Any documentation or explanations you can share would be greatly appreciated.Best rtegards,