Solved

Hi All We have successfully integrated with RADIUS, and all user authentications are working fine. However, we need to import user groups from Active Directory into FortiSASE users and groups.The RADIUS Group ID value is required for this. Could you please let us know where we can find this value?   Thankz 

Hi everyone,I am finalizing a network deployment and looking for validation on my topology design to ensure I amfollowing Fortinet Best Practices for High Availability. My Environment:Management: FortiGate (FortiLink mode).Core Layer: 2x FortiSwitch 1024E configured as MCLAG Peers (ICL link is up and healthy).Access Layer: 2x FortiSwitch 100 series (Standalone access switches).Current Physical Topology: I have connected two separate access switches to the Core pair in a "triangle"(dual-homed) topology. Here is the exact cabling map: Access Switch 1:Port 23 -> connects to Core Switch A (1024E) Port 10Port 24 -> connects to Core Switch B (1024E) Port 10Access Switch 2:Port 23 -> connects to Core Switch A (1024E) Port 11Port 24 -> connects to Core Switch B (1024E) Port 11(Note: The 100-series switches are not stacked/ringed together).The Goal & The Question: My primary objective is redundancy: if one of the Core switches (1024E) fails, the Access switches must ma

Hello everyone, I would like to know if it's possible to use Fortigate as a DNS server for the Isolation network in the config wizard of FNAC?  Thanks in advance.BR,

Hi FSM adminsI have 3 collectors all healthy and working fine as syslog collectors.However when I try select the collector for Windows/Linux collector agent, only 2 are shown in the list.What can be the cause?

Hello community! I know variations of this question have been asked in the past, but it's been a little while so I was wondering if there was anything new on this topic. You can see below the network devices and that's what I need to work with. The network architects designed it this way, even if I read here that the best configuration would be with switches in between both clusters. Now it's too late, project funds are exhausted so we can't order extra hardware. A bit more context, first cluster will be used for SDWAN and IPSEC VPN and to take care of BYOD and other unsecured devices. First cluster will also have two VDOMs, one for guest network and the other for reaching the second cluster. Second cluster will be used to protect a process network. In some specific cases, process network might reach one VDOM or the other. In some specific cases, guest VDOM might reach the other VDOM to get to process network. How can we configure two directly connected FG81F cluste

Hello AllWe have a new deployment and have created TACACS+ servers and Group  When I try and push, it doesnt say theres a change pending, doesnt even detect a change.  The TACACS are referenced to a group and an account too that Ive created. Is there a way to force these changes to be deployed? 

Two to three months ago, we migrated to the EMS FortiClient VMware appliance 7.4.4.We are a Windows store, so Linux knowledge is minimal.Now we want to upgrade to EMS 7.4.5 because of some bug fixes and the database backup feature.Is the recommended upgrade method to download a new VM image and perform the necessary actions as described in the article below?https://community.fortinet.com/t5/FortiClient/Technical-Tip-Recommended-method-for-upgrading-to-FortiClient/ta-p/423615Do I have to ignore the upgrade option/alert below via the GUI?Automatically upgrading EMS to latest patch release | FortiClient 7.4.5 | Fortinet Document LibraryThanks

Hi everyone,while creating a profile for a FEX device, i'm unable to add a new meber of type VAP in the Switch Interface. the VAP list is empty, even if the SSID i've created isn't in bridge mode. Accessing the web interface of the FEX it allows me to add a VAP port with the SSID, but i need a massive/remote deploy without accessing every single FEX.Someone know ho to solve this? 

Hello everyone, While reading this article "FortiSwitch FortiLink Integration" and to be more specific, the RADIUS/syslog/L2 MAC traps config, there is always a note saying to skip the step if you configured one of the three. I do understand that L2 MAC traps is the most recommended, but I wanna know why can't we use two together, is it to optimise performances ? Thanks in advance.BR,

Hello All!On my FG 90 strange issue - after restart on some interfaces traffic partially dropped.For example - from my computer (VLAN 10) I am trying to ping server located in VLAN 22: C:\Windows\System32>ping 192.168.22.1Pinging 192.168.22.1 with 32 bytes of data:Reply from 192.168.22.1: bytes=32 time<1ms TTL=63Reply from 192.168.22.1: bytes=32 time=1ms TTL=63Request timed out.Request timed out.Ping statistics for 192.168.22.1:Packets: Sent = 4, Received = 2, Lost = 2 (50% loss),Approximate round trip times in milli-seconds:Minimum = 0ms, Maximum = 1ms, Average = 0ms In previous firmware one more restart was solve it. But after upgrade to 7.4.11 even after restart the issue stil exists on few interfaces. Here is an output of sniffer:diag sniffer packet any 'host 192.168.22.1 and host 192.168.10.51' 1 100interfaces=[any]filters=[host 192.168.22.1 and host 192.168.10.51]6.892452 192.168.10.51 -> 192.168.22.1: icmp: echo request6.892478 192.168.10.51 -> 192.168

In Load-balancer mode deployment, what happens if primary fac goes down? for an example , I have cluster(A-P) as a primary at HQ and load-balancer at two different geo location.what happens if my primary HQ is down? can load-balancer take over authentication function.if so which will be active.  

Hello everyoneI have a DNS configuration plan and want to evaluate it separately for local and internet access.When the central DNS company.xxxxx performs a DNS query, I want my local users to use the DNS I specify when accessing the internet. I don't want them to go to company.xxxxx DNS when accessing the internet, and at the same timeWhen SD-WAN connects to the internet, I want it to route to whichever xxxxx - xxxxx DNS has the best jitter, packet loss, and ping values.Is there anyone who can help?

I am not getting any audio on new 380B when making or receiving calls (new system).The volume is all the way up, I disable bluetooth for now still no ringing, and no audio when playing voicemail. Thanks

Hi All, I am unable to select Current Version and Target Upgrade Version in Upgrade Path Tool , Did anyone facing this issue..  tried with differnet browser and from diffrent PC .. But no luck#fortigate #upgrade path tool #FotiOS

 I have tried many times to activate the evaluation license but the screen shows the following error.I am able to ping google.com and all other domains. I am using eve ng for learning purpose and after logging in the firewall does not allow me to move forward without subscription. Your quick help is required.  Regards,Aneeq Ahmed

Hello, i create a new poliy directly on fortigate CLI with: config firewall policyDescription: "My Policy"edit 0set name "MyPolicy"set action acceptset dstintf IFACE_01set dstaddr MyDstServerset srcintf IFACE_02set srcaddr MySrcServerset service HTTPset schedule alwaysset schedule-timeout disableset status enableset logtraffic allend The command does not return the newly created policyid, since i want to create some batch operation where i have to place the policy before a specific other policy, is there an easy way to return the created policyid, i only know the command get firewall policy  where i have to use the last ID.

Hello team!!! I need create a tutorial for limited users with no Fortigate knoledge to modifý easily the IP address in many VIPs.  This is for manually redirect traffic to another computer (Different IP)If I guide the users to modify manually all VIPs in "Policy & Objects -> Virtual IPs", there are to much posibilities to the user to make a mistake, so I need for example, to create an script to modify the VIPs and guide to the users to execute this script.These is a Fortigate 100F, which I think that have not hard driveActually could be better to create something to be executed from the gui Automation stitch seems not be working to change the Fortigate settings.I have not knoledge about APIs and I have not enough time to learn. Any idea will be apreciated!!Thanks in advance.Regards,Damián

I can connect without any problem to our FortiGate FG‑60F using FortiClient 7.2.0864 on an Intel / Windows 11 device.However, this older version is not supported on ARM / Windows 11, so I upgraded to FortiClient 7.4.3 hotfix 1.8758 (ARM64) on a Surface Pro with Windows 11 ARM.The installation succeeds, but when starting the IPsec VPN I immediately get:“FortiClient – IPsec connection is down”I also noticed that the FortiClient VPN Service / SSLVPNDaemon services are missing on the ARM device, which suggests that the VPN engine is not being installed correctly.It seems other ARM users resolved this by installing the MSI version of FortiClient (instead of the EXE), but the MSI installer is not available for download in the normal Product Downloads section.Where can I obtain the MSI installer for FortiClient 7.4.x ARM64?Do I need to request it through Fortinet Support, or is it available somewhere in the download portal?Thanks for any guidance.

Hey Guys,I am new to FortiGate and Aroba. I wanted to implement a network segmentation on our network this side but i am seeing problems, I created vlans both on the aroba switch and the FortiGate and trunked the port from the switch to the firewall. I even gave on policies for every vlan to show what directions each vlan should take, but there's no communication between the vlans or the vlans to the internet (for the ones having outgoing interface as wan) End devices are able to acquire addresses as per the addressing table. I even did a trace route on the device which was connected to the CORP and Pent vlans and all of them end at their gateways (the ones specified on the firewalls). I carried on doing a debug on the cli on FortiGate to see if at all packets arrive to their designated policies (by doing pin 8.8.8.8 on CORP since it has The Internet policy enabled) nothing popped up from the cliThings verifiedDHCP of the corresponding vlan issues the correct address as par the ad

Hi guys, New to forum, want to check with the community senior of Fortinet whether FortiSASE is a real cloud solution that managed (Backend) by Fortinet or a cloud solution that require customer to managed? As we being request to call Fortinet when hit FSASE bug (1213936) everytime it occur and need to start the troubleshooting from scratch (Took around at least 45minutes everytime) to validate the issue even though we had told them we do hit the bug (1213936). Seems like become the one to maintain FSASE infra instead of Fortinet themselves. Do any of you encounter such experiences before, how would you suggest to speed up whole troubleshooting? Challenges: 1) FSASE not managed by us and require call in to Fortinet support for manually reboot/restart the service/instance2) The troubleshooting most of the time need start from scratch even being told it hit the known issue (1213936)3) The known issue (1213936) can be happen few times on same day (Updated by Fortinet s

Hi Guys, My firewall did an update recently from 7.4.9 to 7.4.10 and since then my static routes have stopped working.  I have a couple of internal routers that route between different subnets.  They were configured a number of years ago, and since then I haven't had any issue with them until now.  The routes are very straight forward - Destination (192.168.50.0/24**  subnet at other side of router) Gateway (192.168.10.10 router IPt) Interface (LAN)  (enabled).  Clients gateways are set to the Fortigate device and everything was fine until the update.  All clients could reach 192.168.50.x without issue.  That's now stopped working.  If I add a static route on the clients direct it works fine.  So issue is definetly at Fortigate.  Also all monitoring of the subnet stop at exact time of update. Tried removing and re-entering/rebooting, just doesn;t want to work. Anyone got a similar issue/fix? Many thanks  &n

 Hello,  I am testing an IKEv2 IPsec dial-up VPN on a FortiGate 81F (FortiOS 7.6.6) and I would like to confirm if my use case is fully supported.SetupFortiGate 81F – FortiOS 7.6.6IPsec dial-up VPN (IKEv2)Authentication: LDAP (Active Directory)No RADIUS, no FortiAuthenticator, no EMSClient: FortiClient VPN Only (free)IssueThe tunnel establishes correctly (IKE + Child SA).The client receives an IP address and traffic is allowed.A few seconds later, the VPN is disconnected immediately.IKE debug shows repeated EAP challenges:  FNBAM_CHALLENGE until the client sends an IKE DELETE.ObservationsEAP-TTLS fails (expected, since no RADIUS/FAC is present).EAP-MSCHAPv2 seems required for LDAP auth, but on FortiOS 7.6.6 there is no option to force the EAP method on the FortiGate.The EAP method appears to be fully client-driven.QuestionIs IKEv2 IPsec with LDAP authentication (without RADIUS/FAC/EMS) officially supported with FortiClient VPN Only?If yes, is EAP-MSCHAPv2

Hello FNAC admins, I'm trying to add my fortigate to FNAC inventory, I'm getting this error. SNMP is configured on my Fortigate, I'm able to ping Fortigate from FNAC and vice versa. Any ideas ?   BR,

Hello FNAC admins, I'm trying to access the CLI console on my FortiNAC's GUI, but I can't find it... Is there a feature I have to enable to access the CLI ? BR,

Hello Everyone,I have a Fortios 7.6.4 Fortigate60F device. Even though I enabled the policy and IPsec NPU offloading settings for my IPsec connection, it shows npu_flag=00. Could this be related to the policy rules or the IPsec encryption algorithm?If you could help me,