Solved

I'm spinning up a new pair of FortiGate 901G's to replace some Cisco FTD's (yuck!). I'm very used to and appreciative of Palo's way of doing security policy, centralized NAT, and a separate decryption policy. I like being able to make security policy directly based on app or URL category, rather than making profiles for everything. I don't see how profile mode is as flexible as policy mode. If I want to make a policy for a single app to be let through, I can't do that with profile mode, as an app control profile allows and denies all apps. For example, say I want to allow the "Quickbooks" app. I can't make a policy that has an app control profile of just allowing Quickbooks.. The app control policy would either end up blocking or allowing all apps. This is where i see the biggest downside to profile mode.I've spoken to a few people I respect in the Fortinet world, and they recommended staying with Profile mode for varying reasons...- I heard there is less support for Policy-based mode-

Hello,I have two FortiGates (Site 1 & Site 3) connected via two GRE overlays:GRE_DC1_S3_AS20 – latency: 0.39ms, packet loss: 0%, jitter: 0.05msGRE_DC1_S3_SP5 – latency: 35.15ms, packet loss: 0%, jitter: 2.79msI configured SD-WAN between the two sites.Test scenario:Site 1: 172.16.213.2Site 3: 172.16.233.31. Best-effort / untagged trafficSD-WAN rule: Best Quality, latency criterionTraffic correctly uses AS20When AS20 degrades, traffic fails over to SP5 → works as expectedAfter this test, I modified the SD-WAN rule for untagged traffic:Strategy: ManualPreferred interface: SP5Observed behavior:Untagged traffic correctly goes via SP5 (as intended)2. Classified traffic (CS6) SD-WAN ruleNetwork Control for CS6 class trafficStrategy: Best QualityCriteria: LatencyProtocol specification:Protocol number: 0Type of Service (TOS): 0xc0Bit mask: 0xffTest ping from 172.16.233.2 :ping -s 600 -c 100 -D -Q 0xc0 172.16.213.2Expected behavior:Traffic should use AS20 because latency (0.39ms) is well bel

My security team has this compliance requirement."Attempts to access websites through their IP addresses instead of their domain names are blocked by web content filters." How would this be configured in FortiGate? 

what can I do? I'm just on the LAN that is connected to the Fortigate 40F. 

In a custom dial-up VPN configurationWith ike v2 and mschap2 enabledI need to match users who connect to the VPN with their respective groups via radius attributes passed by Forti Authenticator.Currently, if I configure the IPSec tunnel with ike v1Xauth within the policies, it works.However, if I enable IKE v2, I connect to the VPN, and authentication works even with 2FA.Nevertheless, the user is not matched on Fortigate because I do not see them in the list:diagnose firewall auth listTherefore, the user is not associated with the remote radius group membership in Forti Authenticator.Is it possible to emulate the behavior of xauth while maintaining the relevant remote groups of Forti Authenticator within the policies, even with IKE v2?I would like to avoid creating x pahse1 interfaces for x groups on my Fauth that belong to two different LDAP servers.

HelloIs it normal that FAC 6.6.9 has more known issues that 6.6.8, which in turn has more known issues thank 6.6.7, which in turn has more known issues than 6.6.6?From what I understand, normally each new patch should fix known issued from the previous version, right?

Hello. I am trying to figure out how fortinet stuff works, and it seems like it's tied up to the cloud. It looks like I have to get my fortigate unclaimed before I can use it. Is that correct? I haven't found anywhere to put the serial number into, to check warranty status and if it's claimed. When I enter the SN into the forticloud I get this:Invalid input data:Please double-check the Fortinet appliance registration number you typed in. If your input is correct and the problem persists, please submit a customer service ticket. It is the 100% correct SN I am using. Could this mean my 101F has been claimed and is unusable? Thanks!

Hi Community, I would clearify, when enable "UEBA" feature, does it require install other FortiSIEM agent? as we already installed "FortiSIEM Log Agent" on servers (Window), our current version 7.4.x.x.Thanks for your respoonds. 

Admin I need help to generate report on the demo link, I've been searching for some time now on how to generate report in FortiMail, but none of the documentation helps. I haven't configured any single thing, because I saw there's already a data on the demo, please guide me on how to generate a report in this FortiMail Demo, thanks.

SSL VPN was replaced to IPSEC on FGT version 7.6. I already configure IPSEC IKEv2 with EAP enabled.But why in forticlient android when select IKEv2 there is no field to enter the credentials?

Hey guys, so I did a "small" mistake.We bought two new FortiGate clusters (120G and 100F, both active-passive) to replace our old Palo Altos. One cluster is already running and the other is in the lab to set up.While starting to configure the second cluster, I realized that I mixed them up. The running cluster should be the 100F, but those firewalls are currently on my table. What is the best way to replace the running cluster with the other hardware?The issue I have is that I don't have much time. The second cluster has to be installed next tuesday and the already running cluster is already full productive. How can I exchange them with the least interruption? Thank you so much for your answers!

Good morning, I am struggling with an issue with FortiClient SSL VPN (Standalone VPN) on a Windows 11 computer. I have installed the FortiClientVPNOnlineInstaller.exe from the FortiClient downloads page. The install finishes correctly. I am able to set up the VPN. I've used the exact same VPN configuration on other computers with no problems. On this computer, when I click "Connect" it seems that nothing happens.The expected response would be for FortiClient SSL VPN to open a web page for me to log into my SSO to authenticate. I've performed the following troubleshooting steps:1. Restarted the computer.2. Uninstalled FortiClient VPN/reinstalled FortiClient VPN.3. Checked, double-checked, and triple-checked the configuration. Even tried multiple remote gateways that should work.4. Ran SFC scan on the computer.5. Performed a Network Reset via Windows Network Settings on the computer.6. Ran DISM /RestoreHealth on the computer.7. Flushed the DNS cache.8. Tested the FortiClient VP

 We recently upgrade our EMS server to 7.4.5 from our Windows 7.2.12 version. All went well and the FortiClients are being upgraded from 7.2.13 to 7.4.5...But we now have a swarm of complaints for the following issue with 7.4.5 and this specific routine makes it happen everytime.PC connected to the VPNPC going to sleepPC coming back from sleep with the VPN down (normal) but no internet browsing possible on the machine.all browsers display "Your Internet Access is Blocked" with ERR_NETWORK_ACCESS_DENIED. We can ping any internet IP and use DNS but browsing is completely blocked and not even visible in a Wireshark capture of our wifi connection.  If we close FortiClient browsing resumes and we can then launch it again and all works fine. A reboot also works obviously.  So there's an issue with Windows 11 going to Sleep with a FortiClient 7.4.5 connected (important) upon coming out of sleep.  We have more than 1000 PCs upgrade right now and the issues are pouring

Hi, I'm trying to install Forticlient VPN on my system (Fedora 43) but  I'm getting this error:package forticlient-7.4.3.1736-1.el7.x86_64 does not verify: no digestI've tried adding the forntinet repo and installing with yum, and using the .rpm file, but I always get the same result. Is there any solution to this problem? Thanks in advance.

Hi  Is there a way to implement session based authentication for users instead of IP Based Authentication ,as I have  The below scenario:1. FortiGate Firewall running version 7.4.3, is the Gateway & DHCP Server configured with a Captive Portal ,it authenticates users against LDAP .2. The wireless network has 1 SSID, with different Access point vendors, when users move-in between the different access points ,they obtain different  IP address`s ,they are prompted to re-authenticate on the portal.3. The previous gateway was a Meraki firewall ,it was able to authenticate users based on sessions, whereby you only logged in once on the portal and re-AUTH happened when the account duration had ended .It was not based on IP address`s hence users didn`t get the portal to re-authentication as they moved around. Edit 1 : Most of the users use tablets /laptops not joined to the domain Is there a way to do this ? Thanks 

I have a requirement to use ZTNA (Zero Trust Network Access) on Android devices. The devices need to communicate with some printers on the corporate network. We have already set up the ZTNA Destinations, policies, and groups, but communication doesn't work on Android devices. However, when we test it on Windows, the communication functions properly. Could you let me know if ZTNA has any compatibility issues with the Android system?

Hello to everybody, Two days ago, the following system events appeared:  I haven't activated this and I do not know how this could happen. My FortiGate does not support WiFi (or this is what I thought...). Please, what do I have to do to turn off the Wireless Controller? Thank you for your help. 

Hello, My FortiMail VM 7.4.6 was working perfectly until a 403 Forbidden error appeared for the administration GUI.Some additional network interfaces and routings have been added but none of the administrator users have setup trusted hosts. The Webmail interface is hosted on the same network interface and it is still working.The only admin access is on CLI mode via the ESXI console.   Have you some ideas ?  Thanks

Hello, I had Virtual Fortigate in Azure VM02, Version was 7.2.5Then I did upgrade up to 7.4.0 and now see this message: And I can't disable. Even if I'm trying to click "Begin" I can't do any migration, but If I click "Later" Fortigate is working as normal.  Very annoying message, how I can disable it?

Hallo, last week I updated the Fortigate to the new firmware. We use Fortinet and 2FA with Tokens. After the update no VPN-Token worked anymore. Noone could start a VPN anymore. I had to create new Tokens for everyone. Then it came into my mind, what if the Tokens for the Admin-Logons would not work anymore either. Would we be screwed or is there a possibility to logon without 2FA?

Hi All We have successfully integrated with RADIUS, and all user authentications are working fine. However, we need to import user groups from Active Directory into FortiSASE users and groups.The RADIUS Group ID value is required for this. Could you please let us know where we can find this value?   Thankz 

Hi everyone,I am finalizing a network deployment and looking for validation on my topology design to ensure I amfollowing Fortinet Best Practices for High Availability. My Environment:Management: FortiGate (FortiLink mode).Core Layer: 2x FortiSwitch 1024E configured as MCLAG Peers (ICL link is up and healthy).Access Layer: 2x FortiSwitch 100 series (Standalone access switches).Current Physical Topology: I have connected two separate access switches to the Core pair in a "triangle"(dual-homed) topology. Here is the exact cabling map: Access Switch 1:Port 23 -> connects to Core Switch A (1024E) Port 10Port 24 -> connects to Core Switch B (1024E) Port 10Access Switch 2:Port 23 -> connects to Core Switch A (1024E) Port 11Port 24 -> connects to Core Switch B (1024E) Port 11(Note: The 100-series switches are not stacked/ringed together).The Goal & The Question: My primary objective is redundancy: if one of the Core switches (1024E) fails, the Access switches must ma

Hello everyone, I would like to know if it's possible to use Fortigate as a DNS server for the Isolation network in the config wizard of FNAC?  Thanks in advance.BR,

Hi FSM adminsI have 3 collectors all healthy and working fine as syslog collectors.However when I try select the collector for Windows/Linux collector agent, only 2 are shown in the list.What can be the cause?

Hello community! I know variations of this question have been asked in the past, but it's been a little while so I was wondering if there was anything new on this topic. You can see below the network devices and that's what I need to work with. The network architects designed it this way, even if I read here that the best configuration would be with switches in between both clusters. Now it's too late, project funds are exhausted so we can't order extra hardware. A bit more context, first cluster will be used for SDWAN and IPSEC VPN and to take care of BYOD and other unsecured devices. First cluster will also have two VDOMs, one for guest network and the other for reaching the second cluster. Second cluster will be used to protect a process network. In some specific cases, process network might reach one VDOM or the other. In some specific cases, guest VDOM might reach the other VDOM to get to process network. How can we configure two directly connected FG81F cluste