Solved

 I am using a Fortigate 40F with FortiOS 7.4.0 build 2360, and I'm looking to create a certificate for my webgui and another certificate for my web VPN via the Let's Encrypt service the firewall provides, and I'd like to configure ACME auto renewal. I purchased a domain through CloudFlare to use for the firewall, let's call it "mydomain.com". I created an A record in the CloudFlare that points mydomain.com to the public IP address of my network, which is my Fortigate unit, as it's the router. However, when I try to create a certificate for mydomain.com in the GUI, under System > Certificates > Create/Import > Certificate > Use Let's Encrypt, it errors out, stating "no valid A records found for mydomain.com; no valid AAAA records found for mydomain.com".Edit: I read the following posts prior to posting this:1.) https://community.fortinet.com/t5/Support-Forum/fcm-models-acme-acme-Acme-Error-A-C-M-E-Certificate-request-has/td-p/2644552.) https://docs.fortin

hI,I am running a FortiGate with Fortios 6.4 version. I have the firewall synced with my AD, this is working so I can see username and stats from my AD users in the Fortiview pages.I want to configure a policy (is for browsing navigation allowed) only for a group of my AD users, but when I try to configure 'Source' in the policy, and select the group in the list, I get this error.I ge this error: 'One address, address group, external resource or Internet service is required' As far as I understand, this means I can't create a policy that only is applied to a single group of users? There is no way to for example allow browsing to one group members and to forbide browsing to all other users?Thanks a lot.

Hi, I am using ForgiGate with Fortios 6.4 and I need to close all my Interenet outgoing connections but allow the ones that Anaconda (python development environement) uses. Anaconda connects via port 80 and 443 to internet, but the destination domains are not fixed, as the app asks for existant repositories and this destinations url are constantly changing and they count for dozens every connection. The question is, if there is some way to allow Anaconda traffic, as I don't see how can I parametrize it for to be identified and allowed by the FortiGate. I have checked in FortiGuard for in case this app is categorized, but the results are empty:https://www.fortiguard.com/search?q=Anaconda&engine=1Thanks a lot

Dear all,I can't log to fortianalyzer 200F after upgrading from v5.6.3 to v7.0.8 (authentication failed. Please try again...)Noted that the same issue appear using the console cable (or a directly connected network cable). Thank you in advance for your cooperation.

Hi Iam trying to use a Device Profillin Rules, to match our doamin computers to a group.We are using the base license.So I have installed  persistent agent on all clients. And the look at if there are in the correct domain name.But when doring a test on the host, connected with peristent agent i now get:No fingerprint data found for rule. Grace period has not expired. Putting back on queueWhat does this mean?If i remove the Windows Profile, it works, but then i do not match if it our domain name. :) 

Hello Team, I have a fortigate to which I want to connect a fortiswitch and to this fortiswitch another fortiswitch in cascade.My question is: in order to connect fortiswitch to fortiswitch, do I have to configure a particular port on the first fortiswitch and put it in fortilink or can I use the one I want? How should the port connecting the first fortiswitch to the second one in cascade be configured? thank you for your support

Dear friends, Regarding the KBs below:I understand that to use an IP address not other than the primary IP address configured on the exit interface of the tunnel, the IP address should be configured as a secondary IP address on that interface. Technical Tip: How to configure IPsec VPN settings... - Fortinet Communityhttps://docs.fortinet.com/document/fortigate/6.4.9/fortios-release-notes/230510/changes-in-default-behavior.https://community.fortinet.com/t5/FortiGate/Technical-Tip-Fix-issues-with-IPsec-tunnels-configured-with-an/ta-p/213133 Why the option "specify" is still existing as an option to configure the local gateway IP address of the IPSEC tunnel. I tested the "specify" option and the tunnel did not come up until I configured my IP as a secondary IP. So what cases I should use the specify option? shall it be an IP address that is configured on another interface? 

I want to completely turn off a port including power on a FortiSwitch port connect to FortiAP all managed by Fortigate. What is the correct way of doing this? I tried change the port Status to Disabled, PoE Disabled, Reset PoE. I can still see some FortiAP LED light up! The only way I can somehow make it work is to reboot the switch. I am trying to configure FortiAP with aggregate ports with LACP using two ports. If I don't do it in the right sequence, I lose access to the AP. The only way to get it back is to reboot the switch. Reset the ports doesn't seem to help.

Hi all. We have one very interesting case. We using Fortigate HA routers on HQ and Branch.Branch is connected to HQ via 2 providers over IPSEC-SD-WAN tunnels.But now we have often problems with these 2 providers availibility and decided to try Starlink.We have connected Starlink router to Fortigate, switched Starlink router to bypas mode. Now Branch's Fortigate behind Starlink's CGNAT with IP 100.122.N.N 255.192.0.0 and we can't connect classic peer-to-peer IPSEC as before with those 2 providers with public ip on both sides. So the question is how to make connection between HQ and branches?We tried configure IPSEC with dilaup user on HQ side as listener and remote side connect to HQ public ip.The tunnel become UP but there is no traffic between routers. I sugges that there is some configuration mistakes, but need more experience to debug it.

 Hi guys!  My 80F is getting loads of warning messages of temp is too high after upgrading to fortiOs 7.4, externally I can't fell it hotter than usual, the data center is climate controlled and the fw is not placed in encloused space. It is a probably bug?

I'm VERY new to Fortinet and am attempting to migrate from an ASA that's managed by a 3rd party to our own FG 201F.  I've got most of it configured, but struggling with how to setup my DMZ.  Current ASA has 3 DMZ's, each setup with their own public IP ranges on their own VLANs.  The DMZ's are then assigned to 1 physical port on the ASA. Now...I want to setup my DMZ and assign private IP's to the hosts and then map/NAT/virtual ip/whatever to the public IP's.  My question is...how do I setup the interfaces so I have multiple public IP's?  Do I create multiple DMZ interfaces?  Do I assign multiple IP's to the WAN interface? For example...current DMZA has public IP range of 10.10.0.0/29.  ASA has an interface in that range and it's assigned to a VLAN.  All hosts on that VLAN are also assigned public IPs in that range. DMZB has public IP range of 10.20.0.0/29.  ASA and hosts assigned to that range and VLAN.  

Hi, I have upgraded my FortiClient VPN from 7.0.6 to 7.0.8 and now the FortiClient VPN doesnt show the machine certificate. I had to give myself local admin privileges for the VPN client to display the machine certificate. Anyone else have the same issue ? Thanks Rakesh

Is the above scenario possible? Site A === site to site vpn === Site BSite B === site to site vpn === Site CSite C === site to site vpn === Site A It is like a network triangle but will it work?

to perform some tests safely on a FortiGate (FortiOS 6.4) doing BGP i was trying to setup a prefix-list that denies all prefixes and apply that the BGP neighbour section via set prefix-list-in / set prefix-list-out. as a prefix-list contains a implicit deny at the end i was expecting an "empty" one would be enough. config router prefix-list  edit "deny-all"    set comments "deny all prefixes"  nextend but this doesn't deny anything until i add a rule for dummy prefix with the deny action. then it behaves like i wanted to. anyone that knows / can confirm a rule for a dummy prefix with deny action is required here?

We have this odd issue where the memory is spiking to 85% on avg its 80% and causing internet down firmware : v6.2.0 build0866 (GA) Can anybody please tell how to fix this problem??  

I upgraded to test the beta version of Monterey. FortiClient6.0.9.162 The VPN connection terminates unexpectedly! (Error Code: -121)  20210721 10:59:08.513 [sslvpn:INFO] unknown:0 dns suffix: 20210721 10:59:08.513 [sslvpn:INFO] unknown:0 epctrl ping server: 20210721 10:59:08.514 [sslvpn:INFO] unknown:0 xml parsing split tunnel info 20210721 10:59:08.514 [sslvpn:INFO] unknown:0 xml parse split tunnel info success. Buffer length: 94 bytes 20210721 10:59:08.514 [sslvpn:INFO] unknown:0 blocked all ipv6 traffic 20210721 10:59:08.515 [sslvpn:INFO] unknown:0 begin io loop 20210721 10:59:08.515 [sslvpn:INFO] unknown:0 launch ssl read thread 20210721 10:59:08.515 [sslvpn:INFO] unknown:0 launch tty read thread 20210721 10:59:08.515 [sslvpn:INFO] unknown:0 ssl read thread started 20210721 10:59:08.516 [sslvpn:INFO] unknown:0 main thread waiting for threads termination 20210721 10:59:08.516 [sslvpn:INFO] unknown:0 tty read thread started 20210721 10:59:08.516 [sslvpn:INFO] unkn

Hi Community we currently use an LDAP server and import groups from there into fortigate user groups (create new user group -> add remote group from the LDAP server) that we use in SSL-VPN policies to grant access to the different ressources, that the users need to access. The users are also imported from the same LDAP Server in the same manner and we apply the 2FA settings afterwards.  As soon as we rename the object in AD, then things start breaking, which makes sense, as the import is set to the string that is used to the value of the LDAP group when it is imported.  I've seen that I can use the FSSO Collector Agent that allows me to directly use the LDAP Objects in my policies, without creating them localy. See this admin guide: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/795593 Now I wanted to know if this method would solve my problem with renaming groups. Would the firewall update the values of the used groups if

Hi,In a VDOM used to proxy clients request (acts as a proxy server on 8080), although DNS filter is enabled in feature visibility, but is not displayed (everything is there, WAF, IPS, Web, ...) but DNS filter is not present In the other VDOMs, such as a VDOM linked to the one mentioned above which has direct Internet access, DNS filter is present but as I said in Proxy polices in our Proxy VDOM serving clients request it is not present. Thanks in advance for your help Regards

Hello guys,  I have  two fortigates whit a vpn site to site stablished ( 192.168.88.0/24 local address in site 1  and 192.168.115.0/24 in site 2 ) this is up.  Ok, now in site 2 I have permited only specific ips  192.168.88.13-14-15 to connect to 192.168.115.0,  no more. This is ok, ping and other services, for example  192.168.88.13 ----->  192.168.115.163  ping up in site to site. Also I have a vpn client to site  IPSEC whit forticlient to some  remote users in the ip range ( dhcp vpn ) 192.168.88.201-250  over site 1. I wish that a remote user for example  whit ip 192.168.88.210 to reach the ip 192.168.115.163 in the site 2 but only with the ips mentioned above 192.168.88.13-14-15SQUEMATICRemote user ( 192.168.88.210 client to site)------>FG1----------Mapped(192.168.88.13)>(site to site IPSEC) -------> FG2 ------ >Server (192.168.115.163) What is the step by step?    Thanks&

Hi, got the following situation: Our FortiGate is connected to our AD. The users have corresponding groups on the AD and can sign in to the corresponding FortiClient connections. The users are NOT defined on the FortiGate, not as local and not as LDAP. Now we would like to make them use 2FA in the FortiClient via e-mail, so without using FortiTokens, FortiAuthenticator or similar.  Is there any way to do this without having to create users on the FortiGate?We are talking of at least 300 users, I'd say. Possibly even more. Thanks for the help in advance!

Right now we are testing the Web Filter in EMS, we had a few users click on a bad URL. The users are not in our test group and we would like to know if the users had been if the test group would the URL they clicked on have been flagged? Is there a spot we can test URLs? 

Hi, only on my computer, the static route is not created when I connect with the FortiClientVPN .on other PCs no problem.Do you have any advice on why it doesn't work?S.O. win 11 thanks in advanceFabrizio 

Hi Team,I have installed windows agent in test server and that is working fine after doing all the troubleshooting. like we have to configure event forwarding from collector to supervisor. I am getting logs for the same.But issue is that when I installed the agent in production server, all agents are showing disconnected.I have researched a lot about this issue but not getting help. Request you to please help in this situation. Thanks in advance.FortiSIEM 

Hi, just upgraded from FortiManager 6.4.10 to 7.2.3 and I'm wondering where the SD-WAN templates for Interface Members, Health Check Servers and BGP Neighbors are now located. Formally in version 6.4.10, SD-WAN templates - Interface Members, Health Check Servers and BGP Neighbors is where we entered the Per-Device Mapping information.  Clearly, it's radically different in 7.2.3 and I've not been able to find an apples to oranges comparison. I have a case open with support but 2 days later they are still researching.FortiManager 6.4.10FortiManager 7.2.3 

We have hub-spoke setup on Azure. Fortigate FW(H/A) is in Hub vnet-A , it peer to two spokes vnet-B and vnet-C . It need route traffic between vnet-B, vnet-C .Current setup is Vnet-A peering with Vnet-B and peering with Vnet-CIn spoke Vnet-B , have user define route table say - going to vnet-C subnet , next hop is primary FG-A internal ip address. this route table associated to vnet-b subnetsIn spoke vnet-c , have user defind  route table say  - going to vnet-B subnet , next hop is primary FG-A internal IP adddress. this route table associated to vnet-c subnetsIn Hub vnet-A , have use define route table say - going to Vnet-B subnet, Vnet-C subnet ,next hop is primary FG-A internal IP adddress. this route table associated to vnet-a internal subnetsNow VM in Vnet-B can talk to Vnet-C .But when FG do failover, , sdn connector change Vnet-A internal route table , say -going to Vnet-B subnet, Vnet-C subnet ,next hop is new primary FG-B internal IP adddress.But sdn connector can no