Solved

I have a site to site VPN between an on-prem FortiGate 500E and a vFortiGate in Azure.Due to the distance between the FortiGates geographically, I’m trying out Forward Error Correction (FEC) ingress and egress on both FortiGates to see if it can improve on lost UDP traffic (main issue, missing RADIUS packages). To use FEC on VPN, Fortinets dokumentation note that NPU acceleration has to be disabled on the Phase1.This has been done on the FGT500E as it can use NPU. The vFGT in Azure does not.  I’m seeing ESP errors in my VPN event log.As FEC re-transmit some packeges, this makes sence to me, as an ESP packet with a sequence number could be re-transmitted.  Ofcause, I could deaktivere anti-replay on phase2 and the events would go away.The official documentation that I have looket at, at docs.fortinet.com does not say anything about that ESP errors is a side-effect of enabling the feature.  I guess my question is, am I missing something? I find it a bit

Just wondering, as I did not want to just assume things, but had 2 questions as it relates to new threats/vulnerabilities and using IPS to mitigate against.1. If an IPS profile is created via filter, will any new signature, updated from the subscription, that matches to said filter, automatically also apply? eg... if I have a filter based on macOS, is a new signature that is macOS applicable, dynamically applied as well since it is a dynamic filter (again, sounds logical, but don't want to assume)?2. What is the normal turn-around for new vulnerabilities to then be turned around into IPS signatures from FortiGuard for the database to be updated? eg... Apple has some new vulnerabilities (CVE-2023-41064, CVE-2023-41061) that was disclosed yesterday (but CVE was created back on the 22nd of last month). FortiGuard has nothing about those on their website as of yet.

in a typical network with 500 workstations. I configured my FG 401F to work with my LDAP for authentication and at the same time explored the FSSO functionality while LDAP is still present. Now, if the workstation will authenticate which method it will use LDAP or FSSO? Which method will take precedence first?    

Good Evening,I was hoping to get some advice on how to best complete a project. Being pointed to KBAs and resources would be incredibly helpful as well. This is what I have outlined so far. Summary of RequirementsI have a website hosted on Amazon Web Services (AWS), and would like to protect its admin panel by placing it behind a Fortinet FortiGate firewall. I want to restrict access to the admin panel so that it is only accessible via a FortiClient VPN. I specifically want the full feature set that a FortiGate firewall can offer.I was thinking of spinning up a Fortigate EC2 instance that will let me use all the features of a normal fortigate, specifically so I can set up VPN access from machines to be able to access the site's admin panel. High-level Steps:Deploy FortiGate VM on AWSConfigure FortiGate Firewall RulesSet up FortiClient VPNRoute Admin Panel Traffic through FortiGate VM This was my plan:1. Deploy FortiGate VM on AWS(For this is there a Fortigate Product alr

What would be the best way to connect a fortigate behind another fortigate? I have the ISP coming into the wan port on fortigate 1. I need to setup a sub tenant in that space with their own fortiagate that is going to share the isp connection. DMZ port? or proxy a public IP though the first fortigate? Or just do a switch on the ISP side and do IP block a to fortigate 1 WAN and IP block 2 to fortigate 2 WAN? Firewall 1 needs to be completely isolated form firewall 2 but share the ISP connection coming into Firewall 1

Forticlient 7.2.1Windows 10JetBrains/DataGrip SSH clientPutty 0.76When setting up a ZTNA destination I can connect to devices using putty/ssh and everything works. When using JetBrains/DataGrip database IDE that uses the openSSH library, the application never connects.I was under the impression that ZTNA would intercept and proxy traffic based on destination address/port but the forticlient seems to not try to proxy the openSSH client at all. Traffic from the IDE application is still trying to use regular routing for the ZTNA Destination.https://www.jetbrains.com/help/datagrip/configuring-ssh-and-ssl.html#ssl 

Hi,I'm currently testing HA switching.Please tell me, are HA uptime and system uptime two different things?Also, is there a command to check HA uptime?

Hi I'm using a Teltonika RUT240 in passthrough mode to add 4G to a Fortigate 60E running 7.0.12. It seems to work well enough, and the Forti interface connected to the Teltonika gets its public IP. The idea is to create a second IPsec tunnel on the 4G interface and aggregate it with the main IPsec tunnel on the main WAN interface for  redundancy. I can only get a tunnel up on the 4G interface if I set the 200e at the other end to expect dial-up. If I try it using the dynamic DNS FQDN of the 60E,   I get "no SA proposal chosen" and it fails. It appears you can't add a dial-up IPSec tunnel to an aggregate - set type dynamic and set aggregate enable appear to be mutually exclusive - so I want to get it working using dynamic DNS. Does anyone have any idea why IPSec is failing when I try to use dynamic DNS at the 200E end? Error reads "ike Negotiate ISAKMP SA Error: ike 0:b822f87e5d0c811d/0000000000000000:17474: no SA proposal chosen"

Assume that I configure firewall without any qos policy, what is the qos default policy like? Does qos implement need license? I have a video server on a lan port and I want to give it priority. How can I do it? Can I give it a static IP and prioritize it? If yes, pls guide me for the steps. Can I give a general qos policy to faster video traffic? If yes, please guide me for the steps.

curl -X POST \https://1.2.3.4.5/jsonrpc \-H 'Accept: application/json' \-H 'cache-control: no-cache' \-k \-H 'content-type: application/json' \-H 'postman-token: 593987-1324' \-d '{"method": "exec","params": [{"url": "/sys/login/user/","data": [{"user":"username","passwd":"PASS"}]}],"session":"1111111111111","id": 1,"ver": "2.0"}'if [[ $? -eq 0 ]]; thenecho "API call successful. Response:"elseecho "API call failed."fi I keep receiving an Invalid Request Response "code" 10 in the API response. Does anyone have any suggestions? Some of the other API requests such as the session request work fine so it leads me to believe there is some issue with the given parameters in the request. Any help would be greatly appreciated. Thank you.

Hello, We are planning to manage many FortiClient and the company policy is to use SaaS as much as possible, that's the reason why we'd like to integrate FortiClient Cloud with our AzureAD instance. Integrating with an on premise active directory seems possible (albeit complex and not well documented) : https://www.reddit.com/r/fortinet/comments/l6sgxz/moving_from_ems_to_forticlient_cloud/ However I cannot see any information about a link with AzureAD, do someone know if it is even possible ? Thanks

Dear Fortinet community. I have a question regarding the updatefunction of a FortiSwitch 448.When I open the Firmware upgrade page via GUI it is just blank. It does not look like this: It is just blank.The current firmware is: v7.2.3 build0434 221212 (GA)It is connected to a Fortigate but the mode is standalone.Does anyone of you know why the website stays just blank instead giving me the website like shown in the picture above?Any help and suggestions are highly appreciated :) With kindest regardsFortiLover

We have many logs on FortiAuthenticator as below:Still keep remote LDAP user xxx though it has ceased existing remotelyAndCannot assign an FTM token to…..? Or   Failed to sync remote LDAP userPlease let me know what does this means of these logsThanks

Hi,We are going to deploy FortiAnalyzer VM and not sure how much HDD size we should use.As per the link below we can calculate the estimate HDD size using the formula HDD=LR*(RA/5+3*RR)*1.1. https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-estimate-disk-space-needed-for-Archive-and/ta-p/207552We've purchased 100 gb/day license and if we want to calculate based on Maximum license size the HDD size will be HDD=100*(365/5 + 3*90)*1.1 = 37 TB and it's a very big storage size.We understand we should calculate based on log/day but right now only one pair of FortiGate is sending the log to FortiAnalyzer , so we cannot make estimation.Later there will be more than 20 FortiGate sent to the same FortiAnalyzer.What should we consider estimating the VM HDD sizing in this case? And as per below link, the Storage can be calculated based on log/sec. How many log/sec will need to use up 100Gb per day license each day.How is 100Gb per day license calculated? Is i

Dear team, Is true that regardless of policy type (flow / proxy), when enabling deep inspection, the traffic is handled in a proxy manner because two connections are open (one from client to Fortigate where Fortigate signs a certificate and present it to the client , and the other session is from Fortigate to the destination internet server? I have tried to debug a connection using diagnose debug wad, but no output is presented on the console until I changed the policy type to proxy. So what is the application/process debug that can be turned on in case if troubleshooting ssl deep inspection?

I have having a switching/routing problem where the standalone Fortiswitch thinks the MAC for the VRRP gateway is pointed to the wrong port.  I dont have a sticky turned on but I cant remove the address. MAC Entries is empty.  Copied config from port.  The vlan 2 MAC should be pointed to the same TRK_MPLS as the rest.  edit "MCLAG-ICL"set native-vlan 4094set allowed-vlans 1-4094set dhcp-snooping trustedset igmp-snooping-flood-reports enableset mcast-snooping-flood-traffic enableset snmp-index 76 So my question is how do I remove something that doesn't exist anywhere?  Support ticket opened for a month now with no resolution.    Adding switch model 1048E 

Hello team!!! When I configure a new "Performance SLA", in the "Packet Loss threshold" option I can set the maximum packet loss to consider a link as "Up" but I dont know how many time or cheks are used to get the value.I mean, with a low value, it is more likely to fail if the amount of time or cheks is little, so I need to know this, but I did not find any relative document. Could you help me?Thanks in advance.Regards,Damián  

Hello, I encountering an issue while applying policy on Mac devices.The policy is to block devices that don't have FileVault enabled when connecting whether from VPN or internal network.My issue is that I can connect to the VPN and internal network while the device tag is non compliant.Note that I can apply policies on Windows devices.Please I appreciate your help.Thanks.FortiClient  

This video provides the steps necessary to design and configure interfaces that will be used for enabling enforcement. These are necessary for implementing network control for the wired and wireless network infrastructure (switches and Access Points)https://youtu.be/IWCDKmhP-oE

Hello community, I am attempting to change the wifi region / country code on the FortiWifi 80F. The SKU on the device is Region A. I am following the CLI steps here in KB https://community.fortinet.com/t5/FortiAP/Technical-Note-Changing-country-setting-on-a-wireless-controller/ta-p/192751 When I do 'set country IN' it gives me this error: command parse error before 'IN'Command fail. Return code -61 If I use the GUI to update the Wireless Settings, FortiAP Profile it gives this error: The name is a reserved keyword by the system.Value out of range.Table name 'FWF80F-WIFI0' can't be added or edited because of duplication or reservation.Any idea on when is happening? Appreciate it 

Login To Fortigate Firewall Disconnects In Less Than A MinuteI am using a public internet to login as administrator through the wan interface.Although wan interface is using a dynamic ip, I dont think the ip changes so fast.After I login to the firewall, after less than 1 minute, it will jump back out to the login page.What can be the cause of this issue?

good morning friends.Based on your experience in this fortinet world, do you think that scripts are a good practice to mitigate attacks?Those scripts could be used in automation stitch

wanting to setup two firewalls with same access on two different isp's etc. How can i setup in the forticlient firewall1 then if its down go to firewall2 without using dns? any idea's?Thanks, 

Hello, Is it recommended to setup 802.1x with persistent agent for authentication&registration with dot1x and scan safe/at risk/rogue with persistent agent ? Regards!FortiNAC 

Hello,I monitor my Windows active directory which is also my DNS server through the Fortisiem Windows agent, How can I detect the change made on the DNS side ( record deleting or changing)?What types of Windows events ID should I look for when searching for those kinds of modifications made on the DNS server side? FortiSIEM