Solved

Hi everyone,   I have a Fortigate 30E and zyxel GS1900 switch in my office. We have two VLANs and the routing is 'Router on a Stick' mode. Recently we found the inter-VLAN is slower than speed inside the same VLAN. Here are our test results using iPerf3 (using NAS as the iPerf server to do speed test)   From PC in VLAN3 to NAS in VLAN3: 950M From PC in VLAN1(wired) to NAS in VLAN3: 550M From PC in VLAN1(WiFi) to NAS in VLAN3: 350M We are wondering it is a routing problem.   Could you please advise what we can do to improve the inter-VLAN connection speed? Thank you.

Dear Team, I would like to know whether there's a report to show me the login status(Success/Failure) of the VPN User via FortiGate. If FortiSIEM has any Default Report Template can meet this. Or I can clone an existing report and then modify it to meet the above description.  Thank you ~ 

As above. The remote site VPN GW has 2 ip addresses. SO how do I configure it? 

Hi,I started having issue recently with FortiClient (Windows) from versions 7.0.7 to v 7.2.1.0779.All my FortiClient are connected to Licensed EMS server (on-prem) and SAML enabled with Azure IdP for VPN login.SSL VPN fails at 70% or sometimes at 98% with the error: Unable to establish the VPN connection. The VPN server may be unreachable. (-6007)I have reinstalled different client versions but still same error. Some community posts suggest internet issues but i don't think it is. On the same network, FortiClient v7.2.0.0101 (Android) SSL VPN works with SAML enabled and Windows Add vpn option with FortiClient as provider works well too (Ofcourse no SAML for this)I have checked logs in Fortinet folder and see following errors under:FortiVPN_1[2023-08-15 13:07:54.7483807] [14204:14208] [FortiVPN 1811 info] fortivpn::StateMachine::HandleTunnelDisconnected disconnection reason: 12, ("Failed Unknown")sslvpndaemon_1[2023-08-15 13:15:06.5364715] [13644:5388] [sslvpndaemon 1186 info]

Hi All,   Anyone have experience or know how to configure LDAP connection with FQDN instead of IP address? The FQDN here are mapping to 5 LDAP servers IP (binded by F5 GTM). When I configured with FQDN the connection to LDAP is unstable because every I ping the FQDN it was resolved to different IP randomly.    I know if it possible to use more than one IP on LDAP setting, but we have to use FQDN to connect LDAP server. Example: ldap FQDN: my.ldapserver.com and this domain contain IP 10.20.30.10, 10.20.30.11, 10.20.30.13, 10.20.30.14 .10.20.30.15 for backup IP. Appreciate for the help.     #Fortigate #fortiproxy

Dear All,           I have 2 x fortigate 201F with HA, port 23 & 24 were connected to each other for HA, may i ask for monitor interfaces which interface i should be added for this ? does it means if i added a interface for example port3, if this port3 were disconnected, the whole devices will be failover to the secondary device ? any help would be appreicated     piaakit  

Hello, I recently upgraded a customers FAZ-200F from version 6.4.9 to version 7.0.10 and now none of the FortiGates will connect. All of the FortiGates are on version 7.0.12 which looks to be supported by FAZ on 7.0.10 per the matrix. The FAZ had support expire on it so I cannot contact support at the moment unfortunately which is why I am coming here. When I run log fortianalyzer test-connectivity on the FortiGate I get 'Failed to get FAZ's status. Invalid error number (0).(0)' which looks like it's pointing to a certificate error. I verified the FGTs and FAZ have matching certificates. I tried importing the local FAZ cert onto a FGT with no luck. When I run 'diagnose debug app oftpd 255' on the FAZ I get the following output:2023-12-19 13:43:57 [OFTP_SSL_CTX_dft:1237 10.112.15.50] dft-idx=0 inited=1.2023-12-19 13:43:57 [__create_ssl_context:1663 10.112.15.50] SSL socket[72] pid[29164] ssl[0x18427b0] SSL_new() success.2023-12-19 13:43:57 [__SSL_info_callback:2

Dear Colleagues, I'm currently implementing ZTNA as a VPN replacement. I added some ZTNA Servers and Policies for them and from the outside its working quite well. But if I'm in the office, I'm facing some issues, especially with resources connected via vpn-tunnels. I'm using a nat-pool (set pool-name) to translate to an internal IP which is routed over the tunnel (BGP). But while it is working from outside, it is not from internal network. I did a "debug sniffer packet ..." and it looks like the forti is sending the packets to the wan interface and not through the vpn tunnel. What am I missing? thanks in advance best stephan

Hello Community, Ive attempted to POST a new policy to a FortiWiFi 80F appliance. I am getting a 400 response due to bad syntax. I can do a GET to this same URL and it works without issue. What could be my issue? POSThttps://{{IP}}/api/v2/cmdb/firewall/policy/?access_token=7dpdqjH3bHjqfghw0Gkx9Ngxht8b8p BODY{ "name": "TEST5", "srcintf": [ { "name": "lan" } ], "dstintf": [ { "name": "lan" } ], "action": "accept", "srcaddr": [ { "name": "all" } ], "dstaddr": [ { "name": "all" } ], "schedule": { "q_origin_key": "always" }, "service": [ { "name": "FTP" } ], "nat": "enable" } }

I'd like to set up an executed playbook within an unhandled (not mitigated by FGT) incident.It's job is to send back the malicious event to fortigate (FGT) and have it mitigated automatically.Which playbook's template does fit this need ? and which associated "Action" ? It's about a malware hasn't been blocked by FGT and it shows "passthrough" in FAZ.  

Dear All,           May i ask if i can switch from  Security Fabric role standalone to Security Fabric root directly ? any different between these 2 role ? if i directly change from standalone to Security Fabric root , any impact ? thanks   piaakit    

Hi All, I configured FortiAuthenticator with integration to Azure, created the Enterprise Application and App Registration on Azure. I require to import / sync only specific group members into FortiAuthenticator as remote users and add them to identified remote SAML Group for specific authentication and autheorization managed by FAC. Unfortunately I do not get a list of groups from Azure and sync imports all users from Azure. We have approximately 9000 groups and around 11000 users in Azure and I do not require all in the FAC group.Currently open TAC with Microsoft and Fortinet. MS propose SCIM to manage provisioning of users and group but FAC do not have SCIM.Anyone have a similar issue and how did you resolve?Kind RegardsAndre F

Dear All,            I have a question would like to ask, we have recently setup ssl vpn with LDAP, but after we input all the things and created firewall policy etc, and we found we wont be able to connect successfully and i did the use "test user credential" the result is failure, but the password is sure correct, any help would be appreicated, Thanks   Keith

Dears, I have fortigate ddns is working fine in my country, but I tried to open fortigate from another country using my ddns link (xxxx.fortiddns.com) and it doesn't want to open and give me the following message This page is not working right nowxxxx.fortiddns.com didn't send any dataERR_EMPTY_RESPONSE althoug I can ping on it without any problem. Do you have ideas?

Hi,   There is a mention in documentation since v. 6.4:"Two new tables are added to the FortiOS Enterprise MIB: FgSwDeviceEntry: Details about connected FortiSwitch devices.FgSwPortEntry: Switch port related information."   What MIB is in question and where to download it ? 

Hello Support Team..Any idea how to deploy Auto-Registration for IP Phones with Extensions range ? ..for example a phone ( which we don't know its type or MAC ) , and it is connected to the network , with proper DHCP / Option 66 or TFTP 150 ( cisco ) .. can this phone get a dummy extension 601 ? .. the next phone would get 602 .. etc   As i tested , Cisco Phones ( Enterprise Firmware ) would register , but without Extension .. Another inquiry .. how to show live Debug from the CLI ? .. i don't mean open trace and download .. i am asking about enabling debug on CLI and seeing the output on it ..  for example :  debugging TFTP events or packets .. or SIP messages .. etc 

Hello, which firmware version is the latest stable ?Running 7.0.13 Best regards

Hello,i have a Fortigate 81F, last week i have entered the banking website as usual (bank austria) and today it is partially not posible to logon to the website and navigate to the business area. From my phone (extern) it works and its not blocked. https://www.bankaustria.at/ (works)https://corporateportal.unicreditgroup.eu (works)https://online.bankaustria.at (works) https://banking.bankaustria.at (doesnt work)  I get a message where Cisco Umbrella opendns.com pops up at says it  is marked as a phishing website. (First time seeing cisco umbrella reddirection). We dont have any Cisco devices or software anywhere. We never used services from Cisco Umbrella Open Dns. I assume that this service is maybe inplemended in the Fortigate 81F. Other Banking website (cardcomplete/easybank/bawag,ect) works as usual but i dont know wheater its filtered just this subdomain or something else it bothering the FG.Does anybody expirience this aswell ? If the service is on the Fortiga

Hello. We have two FAP-432F's setup as a MESH at one of our construction sites. One of the AP's is connected to the FortiSwitch and configured as the ROOT, the other is configured as a LEAF.- Both APs have the same 3 SSIDs assigned; "Corp", "Guest", and the "MESH" SSIDs.- Both APs are configured to use the same channels in the 2.4 GHz (1,6,11) and 5 GHz bands (all).- Both APs show online under Managed FortiAPs. SOMETIMES I will see clients on the LEAF AP, while other times I will see an interference error. I'm assuming this because both APs may be using the same channel at the same time. I've tried to manually set the channels on each, but the configuration does not persist. I've learned the "same channel vs different channel" argument seems to vary by vendor and hardware. What is the best/correct configuration for Fortinet devices? I also have power set to 50% for the 2.4GHz channel, and 100% for the 5GHz channel (it's a big construction site). Should I set these both t

Hello team, I would like to know what is the difference in having the firewall use Fortinet DNS or local internal network DNS, for example Windows Server DNS.Thanks for the supportBR

Hi,I am doing a lab setup where I have hit a problem with ebgp routes disappearing from the routing-database when ibgp routes shows up. I have not done any route manipulation on my BGP session at the moment. I would have thought that even if the route is not active it would appear in the routing-database (get router info routing-table database). I can see the routes being advertised and also received (get router info routing-table bgp neigh received-routes). The BGP sessions are over the tunnel and I am assuming that there would not be any difference.Any help is appreciated.  San

In the Admin > Device > Parsers many (all) are enabled but many are for devices we do not have in our environment. Does having unused parsers enabled affect the SIEM performance? Would it make sense to disable them?

Hi All, I need the official ebook FCA

PROBLEM:  Customer reports FortiClient Console launches at random intervals throughout the day interrupting work flow. BACKGROUND:  I had a customer who complained that FortiClient continued to pop-up at random intervals and was disrupting conference calls, Zoom meetings, YouTube videos, web surfing, etc.  We could reproduce the issue but not trigger the behavior with any repeatability. SOLUTION:  Disable the option in the Endpoint Profiles => System Settings => User Identity Settings for "Notify Users to Submit User Identity"  

I'm referring two KBs below for this issue:https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-alt-primary-alt-secondary-DNS-server/ta-p/275269https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuration-per-VDOM-DNS/ta-p/190815But in reality with 7.0.13, the vdom-dns config accepts only alt-primary/alt-secondary unlike the 2nd KB describes.With this, how is the DNS decided at the vdom (test-vdom)? Always ask global primary/secondary first? Then only when they're unreachable vdom-dns is used? Or only vdom-dns is used? I prefer the latter behavior but not sure. Also, what protocol would be used if alt-primary/alt-secondary was chosen? Same as the primary/secondary?   fg40f-utm (global) # config sys dns   fg40f-utm (dns) # get primary  : 96.45.45.45 secondary  : 96.45.46.46 protocol  : dot ssl-certificate  : Fortinet_Factory server-hostname  : "globalsdns.fortinet.net" domain &nb