Solved

We are doing FSSO on a gate. I have DC agents on the AD servers.  In the external connector FSSO Agent, the user group source is set to Local LDAP with proactive retrieval enabled. The gate sees all the users, no problem there. In my FW policy we want to allow ALL authenticated users. What is the most scalable way to accomplish this without having to manually add new individual users to a defined group or directly to the policy? Would changing the config from Local LDAP to Collector Agent work ? Thanks for any help here.    

 Is it normal for a private virtual machine not to access the internet in edit mode?The license wants to verify but cannot verify because there is no access?Also how can I connect the virtual machine to my local license server?

HelloI have some questions regarding FortiNAC-F.I see the main difference is in the new FortiOS like shell, but what are the most important added values in FortiNAC-F?How do I choose between FortiNAC and FortiNAC-F? Is FortiNAC suitable for some customers and -F suitable for others?As Fortinet has now 2 NAC products, I guess the legacy FortiNAC will be discontinued, right?If FortiNAC will be discontinued, when and what will be its last version?Since FortiNAC-F is relatively new, is the latest 7.2.5 version considered as mature? Does Fortinet recommends it more than FortiNAC 9.2.8?

Hello,   Can a FortiGate use a proxy server to activate a FortiToken mobile code? In the documentation (https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/492260/configuring-a-proxy-server-for-fortiguard-updates) I read that: "Proxy tunneling is supported only for registration, AV, and IPS updates. For FortiGate virtual machines, proxy tunneling can also be used for license validation." and I'm not sure if FortiToken activation is supported in proxy tunneling or not.   Thanks

HelloIs it possible to change my forum nickname to "stasy" ?Thank you

Hello forum,I would like to know how many of you are dealing with upgrades of firmware from Fortinet Devices.We have a range of Fortinet equipment, FortiGates, FortiAZ, FortiSwitches, FortiAPs.We have them on multiple locations.How you guys are dealing with upgrades, where to look if the upgrade is suitable for us, what type of automation you use, etc..It's really hard to catch up with everything since I'm not just a Fortinet guy. I'm System Admin so I have a lot of other task's and its getting overwhelmed..  

Hello, how can I use an FQDN for NTP?

hi,i would like to constantly monitor our WAN utilization in a certain VDOM.i already added a widget under dashboard > network > interface (added WAN subif).my question are:1.is this widget permanent? or is it auto removed after my login session?2.can other admin see/view the widget i created? or is this view only exclusive to my profile?3.i can only see 1 hour, 24 hour and 1 week view option? is this fix or can i adjust this view to 12 hours or 30 days/1 month, 12 months?

Hi Team, We are facing issue after enabling Geo blocking for other country except India. Policy which I have configured - Incoming interface - SDWAN interfaceOutgoing Interface - Vlan Interface.Source country - IndiaDestination - VIPNAT - Natted IP (1.1.1.1-100.100.100.1) For examplePolicy - Accept Issue  that has been observed - Internal servers are not able to access site - for example - www.xxx.comwhich VIP is mapped with this policy When I enabled source - ALL that time is everything is going on smoothly. thank you.     

Hi all, Previously I have implemented Fortigate integrate with Okta authen. but now we still having some issues which is I am not really sure about it. Here is the config that I implemented in Fortigate  config user saml edit "okta-idp" set cert "Fortinet_Factory" set entity-id "https://xxx.xxxx.xxx.xx:10443/remote/saml/metadata/" set single-sign-on-url "https://xxx.xxxx.xxx.xx:10443/remote/saml/login/" set single-logout-url "https://xxx.xxxx.xxx.xx:10443/remote/saml/logout/" set idp-entity-id "http://www.okta.com/exxxxxxxxxxxxxxxxxxxxx" set idp-single-sign-on-url "https://xxxxx-url.apac.xxxx.com/app/apac-xxxxx/xxxxxxxxxxxxxxxxx/sso/saml" set idp-cert "REMOTE_Cert_1" set user-name "username" set digest-method sha256 next end xxxxxfw01 (corporate-saml) # show config user group edit "corporate-saml" set member "okta-idp" config match edit 1

I'm trying to understand some Fortinet firewall logs but I'm not sure I fully understand what is being logged by the firewall when it comes to direction (Incoming vs Outgoing)For example:srcip=7.7.7.7 dstip=192.168.10.50 srcport=45845 dstport=80 srcintf="port5" srcintfrole="wan" dstintf="port10" dstintfrole="lan" proto=6 direction="outgoing"I'm not sure why that would be categorized as outgoing instead of incoming. Since the traffic appears to be initiated from an external source. Would it not be incoming traffic? Or is it because the last interface is it hits is the LAN interface and it's "outgoing" from there?The idea is i want to alert on SIEM level for IPS detections initiated by internal devices not comming from the external wan !! Please anyone can help in that!!

Good Morning! I am new to Fortinet, having just moved our company from Cisco ASAs with Firepower to approximately 30 Fortigates, mostly models 40F, but a few of our bigger sites are using 60F and 81F. Currently running firmware version 7.2.6, build 1575. We are now using FortiManager Cloud Central Management & Orchestration, v7.4.1-build4261 230914 (GA) and need to learn how to re-create the global policies that we used to apply using Cisco Firepower, now using FortiManager. Policy-wise, the 40F's are configured almost all the same, except for an extra interface or Virtual IP or two.The other sites have a bit more going on, hosting many more virtual IPs, using policy routes, etc. There are some policies we would like to apply globally, where we can make the change in one place and it would apply to all of the devices in a group. The main example would be to have a policy rule to completely block a constantly changing list of countries from ever accessing our sys

Let me explain.Users SSL VPN into firewall A.Firewall A send the traffic to firewall B via a site to site vpn.So I have to configure an SSL VPN interface on firewall B to accept the traffic from A.How do I do it?

Hello!We have a problem with Fortiweb 7.0.6: when logging in over the https and AD-authentication to manage the device, the browser shows only blank page. I've tried to log in from another server and using in-private mode, also using another browser, nothing helps. My user account was recently added. Older users can log in and see the admin page successfully. The secondary Fortiweb acts the same way. I can log in via ssh. I even disabled http and https access methods on the management port temporarily but that didn't help: when I put them back and connect with https, log in, still blank page. I wanted to kill the admin httpsd process but how to identify that one? Since this is a web server serving many webpages, I don't want to kill all the httpsd processes, only the one that serves the admin log in.

This Tech-Tip desribes how FortiSwitch OS up till 7.4.0, can have issues with TLS 1.3. This is still an issue with 7.4.2! How come, this is a problem with latest browser versions, like Chrome & Firefox?   Are FortiSwitches telling it supports TLS 1.3, but in reality, it dosen't?

I have user that can successfully VPN into firewall A.There is site to site vpn established successfully between firewall A and firewall B.User is trying to reach a subnet on firewall B.The traffic was sent from firewall A with a certain number of bytes but received with 0 bytes.Firewall B did not receive the traffic.Static route was also configured correctly.What is the possible issue? 

I tried to reach out to another #FortiGate through the SSL-VPN client connection but it's not established.I ran a debug command on the SSL-VPN server to figure out the issue.I received these logs:2024-01-16 18:07:19 [260:root:19]allocSSLConn:310 sconn 0x7fab546000 (0:root)2024-01-16 18:07:21 [260:root:19]SSL state:before SSL initialization (X.X.X.X)2024-01-16 18:07:21 [260:root:19]SSL state:fatal decode error (X.X.X.X)2024-01-16 18:07:21 [260:root:19]SSL state:error:(null)(X.X.X.X)2024-01-16 18:07:21 [260:root:19]SSL_accept failed, 1:unexpected eof while reading2024-01-16 18:07:21 [260:root:19]Destroy sconn 0x7fab546000, connSize=0. (root)I used easy-rsa to create a server-client self-signed cert bundle to use for this purpose.Another thing that I should mention is that whenever I am using "openfortivpn" package in Ubuntu or FortiClient VPN and addressing those self-signed certificate locations for the CA, server cert, and user key, the connection is established without any problem.I w

I'm able to connect to the ssl vpn, after connected I can access to my f drive but when I ping my server name I can't find my host server. Also, I cant access to http://servername:5050/Login.aspx , it shows me DNS resolve failed, but I can access to http://192.168.X.XX:5050/Login.aspx Policy 1Incoming Interface: lanOutgoing Interface: virtual-wan-linkSource: allDestination: allAction: AcceptService: all Policy 2Incoming Interface: SSL-VPN tunnel interface (ssl.root)Outgoing Interface: lanSource: SSL-VPN Address, Employees user groupDestination: Local-LANAction: AcceptService: allHow to solve this problem? Please help T.TFortiClient 

HelloWe have FOS 6.2.x and want to upgrade to 7.0.13.In the meantime we have some old FAP 220B that we want to keep but without breaking the compatibility.The following command on another FOS 7.0.13 shows that FAP 220B is compatible with FOS 7.0.13.config wireless-controller wtp-profileNow I need to check which FAP firmware version is required/recommended on my FAP 220B so it can be compatible with my FOS 7.0.13.Tried to check on document "FortiAP and FortiOS Compatibility Matrix" but couldn't find anything on FAP 220B, I guess because it is EoL/EoSL.Any idea where I can find this info?

Hello everyone! I have tried a Fortigate 501E to an Active Passive Cluster. But after I configured the high availability settings the firewall crashed and paralysed the connection in the company. There are already some VDOMs and some policies configured on the firewall. How can I prevent the firewall from crashing again at the next attempt? This an urgent Question. 

Hi,after updating a Fortigate 60E from version 7.0.7 to version 7.0.8 the RDP via SSL WEB VPN no longer works with any PC, the error "Connection closed!" always appears. If I perform a NAT of the port 3389 from the WAN to the LAN I enter the PC correctly.I have changed all the possible parameters but I cannot log in, whether I enter my credentials in the bookmark or enter them by hand.I have already tried to follow this KB but nothing, error: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Unable-to-take-RDP-of-machines-via-SSL-VPN-web/ta- p / 192454Has anyone had the same problem?

I have a physical interface "internal1" with 3 subinterfaces.I have another physical interface "internal2".If i want to create firewall rule to allow traffic from "internal1" to "internal2",do i have to create 1 firewall rule only or i have to do 3 firewall rules?

Can i connect new fortigate firewall with version 7.2.5 to my Analyzer running 6.4.11 firmware ? 

Hi I want to disable and enable fortigate port3 every friday on 09:00 AM. I configured the below snitch, trigger and action but it does not run. what is the problem? config system automation-trigger edit "Disable_LTE" set trigger-type scheduled set trigger-frequency weekly set trigger-weekday friday set trigger-hour 9 next end config system automation-stitch edit "Up_Down_LTE" set trigger "Disable_LTE" config actions edit 1 set action "Disable_LTE_Interface" set required enable next edit 2 set action "Enable_LTE_Interface" set delay 10 set required enable next end next endconfig system automation-action edit "Disable_LTE_Interface" set action-type cli-script set script "config system interface edit port3 set status down" set accprofile "super_admi

I need to do next configuration for two 802.1x devices per single fortiswitch port: - ipphone with EAP-MD5 802.1x authentification; - PC behind the phone with EAP-TLS certificate based authentification.As I understand I need configure 802.1X-mac-based authentification on port for this scheme. Shoud it works without keeping all devices mac-address database on RADIUS server?  Thanks.