Solved

Why would an IPsec tunnel not come up?I have configured such a tunnel copying a production setup I know to be working.The symptom I am troubleshooting is why the new tunnel interface remains inactive.I can ping from the 40F CLI over the internet to the underlay tunnel endpoint (.172)This is confirmed with traceroute showing path to the internet (192.168.1.1 is the Starlink next hop)Starlink obviously implements NAT on the way out to the net.The new tunnel interface remains inactive.Sniffer tracediagnose sniffer packet wan 'host 203.57.169.172'Show no packets IKE or otherwise being sent (or received)It will show the pings out and back if I ping the .172 tunnel destination as mentioend above.What am I doing wrong?Please let me know if you want other CLI/GUI outputs.Much much appreciate any help.....

I'm currently in the process of migrating from our data centre to the cloud, at the moment we have two public facing DNS servers lets use 1.1.1.1 and 2.2.2.2 for there external IP addresses which are currently NAT'd to 10.1.1.1 and 10.1.1.2 this works fine. What I need to do for testing is to keep the traffic flowing to 1.1.1.1 and 2.2.2.2 but instead of NAT'ing to the internal IP addresses I want to forward to two external DNS servers in the cloud say 10.10.10.10 and 20.20.20.20. I'm sure in the past when I did this test I merely changed the two NATS from 1.1.1.1 -> 10.1.1.1 to 1.1.1.1 -> 10.10.10.10 and the other 2.2.2.2 -> 10.1.1.2 to 2.2.2.2 -> 20.20.20.20 This isn't working now for some reason, when I try and resolve a name I get a time out, but if I change the VIP back to the internal address it works again. Does anyone know what I'm missing (eventually the firewall will be cut out from this and the DNS servers will be referenced by their external

Dear good afternoon.Currently, a vulnerability has been released that affects fortigate computers CVE-2023-37935In the official Fortinet documentation it indicates that it must be updated to 7.0.13, however it is not yet available to download the firmware image from Fortinet support, so for security reasons we must update to version 7.2.6Likewise in the case of version 7.2.6. We need to know the compatibility with your fortiAP but in the release notes we do not locate the matrix where version 7.2.6 is includedWhen will the compatibility matrix of 7.2.6 with the fortiap be released?    

Hello, we have fortigate, deployed in Azure. We have configured SAML for authentication/authorizations for FortiVPN. Now we are also planning delpoy another fortigates on ESXi infrastructure, where we also need to configure FortiVPN with SAML. Qsuestion is Can I have one SAML application on azure which will be mapped with both fortigates? AD groups, and policies will be the same. 

We have this topology and we are having connectivity problems to get from the LANs (below) to the WANS (above). The L3 Nexus Switches are using HSRP, so each one has its own IP and the virtual one floats between them. In the case of the catalysts, they are in a stack and have a single IP.The problem is that we have connectivity for about 5 minutes but after that time the services drop. We perform a clear arp on the catalysts, and we recover connectivity for another 5 minutes and then it drops again.We eliminate the firewall cluster and connect the Nexus to the Catalyst directly and everything works ok.We suspect that firewalls are not letting HSRP's gratuitus ARPs through.  We foun this article  Technical-Tip-Transparent-mode-with-VRRP-HSRP-or-Network-Load  But we have some differences: The connection with the HSRP in the Nexus is through a vlan in port1, the same vlan in the port2 to the catalyst (both are in the same forward domain) Wich is rig

I marked a post solved in error.OMG what an error that was!Is there a way to unsolve that post?Alternatively, would one of you moderators mind doing the honours for me?Why does my new tunnel interface not come up or at least try and negotiate?  Thanks!!!!

We have a web application firewall (WAF) profile applied to incoming traffic to our web application server.  This server hosts several different applications all using the same FQDN (and IP) but they are accessed by different sub directories as shown below: https://example.com/Application1/https://example.com/Application2/https://example.com/Application3/ In the example above, there are 3 different web applications.  Is there a way to make the WAF profile exclude inspecting traffic to Application 2?  Looking through the FortiOS CLI options for the WAF profile, there doesn’t appear to be, but wanted to double check.  I was hoping there would be a way to exempt WAF inspection based on a specific URL or URL pattern (in this case https://example.com/Application2/*). We do not have FortiWeb, but rather are relying on the WAF features baked into FortiOS 7.2.X. Thanks in advance.

I go here and download a 60F datasheet:I do a get system status:How do I relate the 2 together?What hardware model do I in fact have?Is the System Part number something I can look up anywhere?Are there models other then that specified on the datasheet?I have reason o believe that there is an LTE interface on this unit (I don't see a FortiExtender configured)

Greetings Forti PeopleWhy does my Rugged 60F-3G4G have more options available in theSystem > Feature Visibility section?See below.Both are running 7.0.11 as you can see. 

Hi, I am trying to add multiple WAN interfaces under SD-WAN Zone to distribute internet traffic but one of the two WAN interfaces is not available. Is there a problem with 7.0.12? How to use multiple WAN Interfaces to distribute internet traffic in this case? I need to use WAN1 for 192.168.1.0/24 and WAN2 for 192.168.2.0/24 and if WAN1 goes down, the traffic of 192.168.1.0/24 should automatically shift to WAN2 Interface. Thanks.

Hello, Please take a look at the diagram. The requirement is for Server-1 to connect to Server-2. I need some suggestions for the issue. The 'Local Gateway" for the tunnel is a public IP defined inside the LAN. So the ISP doesn't matter for the "local gateway". But when creating a tunnel, Fotigate needs me to select an interface. So the only option for me is to create 2 tunnels on FGT-1 corresponding to each interface/ISP. I have to select the same "remote gateway" with the same "local gateway" over 2 different local interfaces (one corresponding to ISP1 and the other corresponding to ISP-2. The remote end has only one ISP, meaning it won't be able to accept 2 tunnels with the same encryption domains. How do I solve this issue?

Hi,One of my Windows virtual servers suddenly lost network connectivity and started showing "Duplicate after its ipv4 address". When I checked the ARP, it was showing the Fortigate LAN Interface Mac address. The Server IP Address is not added to any of the Fortigate Interfaces. Any Suggestions? Thanks.

HelloWe have 2 pairs of FortiGates, FGCP over FGSPWhat can be the side effects of having HA1 & HA2 ports for synchronizing both FGSP and FGCP at the same time?

Hello,We have virtual FortiGate, deployed in Azure. We activated Remote Access VPN (FortiVPN) and integrated it with SAML Azure. Authentication don based Group. And I have question regarding these groups. For example:If i Have group_1 which have access to server_1 and server_2, also i have user_A which is member of group_1.Also I have group_2 which has access to Server_3, and user_B.  And User_A can access to servers which is provided be group_1And User_B can access to servers which is provided be group_2But If I then need to provide for User_A access to the Server_3 what do I need to do? Do I need to add this user also to Group_2? or I need to create Group_3, provide for this group accesss to server_1, server_2, server_3 and then add to this group User_A?  

Dear community, We are using FortiAuthenticator as External Authentication source for our FortiSIEM-users, providing us MFA. At the moment, we followed the guide for External Authentication Settings and set up this integration via RADIUS.It works fine, but of course entering the 6 digits of FortiToken is not very appealing to users ;) So, we'd like to move to SAML. I am not deep into the information that needs to be exchanged between both tools. The FSM docs focus on Okta and Azure AD which work a little different to FAC. Has anyone here experience in connecting these two components and likes to share the general config steps? If not, we will figure out and I will share our experience in a few weeks... Best,Christian

 Hi Community, I'm running into a problem while testing a customer setup. Customer is using a 3rd party device between FG and FortiSwitches, so I'm testing that setup. FortiLink mode over a layer-3 network is working fine with 2 FS224D-FPOE, but the FS108F is making some trouble. Fortigate is running version 7.2.5, all FortiSwitches are running 7.2.3. As you can see in the screenshot, CAPWAP is coming up, but after some time there are some error messages and the CAPWAP is down again. Anyone an idear what's wrong here? When connecting the FS108F direct to another fortiswitch, it's working fine. Thanks RegardsNico

Good day!I have non-critical but pretty annoying issue which is connected with Fortimanager, which displays application IDs instead of application titles in Fortigate Security policies. So for example if I want to provide RDP access and create a policy using Application (not service), Fortimanager shows id 15511, not RDP (you can see it on the screenshot). This bug appeared after Fortimanager upgrade to version 7.2.3, but I can't find any information how to fix it.Maybe someone has already faced such problem and know how to solve it? Any help is appreciated.Thanks! 

I have a 60F-3G4G in production and a 40G on test.I want to do a diff on the show full-config output but I find the output so different that I do some digging.Why is there such a massive delta in the config system ? output ?Thanks

GreetingsI have a 60F-3G4G unit.I can see the following physical interfaces (green boxes) corresponding to ports on the Front Facia at the top of the image shown below.I can see a wwan physical interface which does not correspond to any physical interface in the Facia. (red box)What is this interface?Much appreciate any reply

I have a site to site VPN setup from Fortigate 200D too AWS VPC. The tunnels are up and active but I cannot seem to get the routing correct.We are wanting all non-local traffic to go through the VPN tunnel to AWS. No matter what change I make traffice goes out the wan!.  I stand corrected if I edit the static default route to use the VPN interface instead of the WAN ports the tunnels go down.     next    edit "AWS VPN"        set vdom "VDOM-A"        set ip 169.254.47.154 255.255.255.255        set allowaccess ping        set type tunnel        set remote-ip 169.254.47.153        set snmp-index 19        set interface "port1"    next &nb

HelloFortiNAC 9.2.8.Anyone has integrated Huawei S7000 WLC in FortiNAC?This device is a switch and a WLC at the same time.When we add it to FortiNAC (SNMP + SSH), all switch ports are seen but we don't find SSIDs anywhere.Also no way to link the managed APs to WLC on FortiNAC. It seems it is just recognized as a switch device.Already read all FortiNAC document about Huawei WLC integration but found nothing useful for my case. 

I am using Fortclient 7.0.8.427 using Azure SAML for sign-in.   All works except for some users, when authenicating, they get the option to click on thier email address from the In Browser window that appears.   For others, the have to always enter in their email address.   Has anyone seen this?   Checked Credential Manager and cleared out the cache in MS Egde the default browser but no success.   Has anyone seen this?  

Hi at all,I create a VPN IPSEC for FortiClient:And this is the client configuration:But the connection fail every time I have enabled the debug log:ike 0: comes ClientIP:1011->FortiGateIPWAN:500,ifindex=8,vrf=0....ike 0: IKEv1 exchange=Aggressive id=2b2bdae897a15850/0000000000000000 len=508 vrf=0ike 0: in 2B2BDAE897A1585000000000000000000110040000000000000001FC04000064000000010000000100000058010100020300002801010000800B0001000C00040001518080010007800E00808003000180020002800400050000002802010000800B0001000C00040001518080010007800E01008003000180020004800400050A0000C49C29F77BADE5D43553C169BA2D54B30BB02C97B23EFFD1A8E6B53C663533F691F737045EBEE9F10483E173BAFFBA1EBED566AA0A81BF0EADB45B86D183F5839598F7B2FD23CAB766B358B537275DEDDE52A0CF4CAC22E0A84039FD27F15ED1D45D97CC0F46296A4C0B3461D509C1E74FC92A427AC11A48DFFAA82F85F7D54B9C64B066B072DE2100BFF3045364E54C57D07F50E0009BF4342A6DFB6EFA3C1A339D201E1D4893C598DB9E6A37BB7BC3E080B2BF16B1A6E0CB7331CCD4E6C3751405000014857E578C3B498EF7A50D38306E30A

Its posible that a Fortimanager act as NTP Server, I didnt found litarature about that only for Fortigates.

Hello EvryOne We are using FortiGate201F v6.4.11We have an internal web based application and I want my users to be able to connect to that application from outside our network.So I wanted to NAT between our public IP and private IPSo am getting the below error: A duplicate entry already exists.The extip is overlapped with the gateway of static route. So I searched the firewall I found that the same Public IP is defined as Gateway Address . am not sure what that’s mean ?Would any one kindly help. Thanks.