Solved

Hi everyone, I have a FortiGate 60F with Fortios 6.4 for to protect my Windows with Active Directory network.I have setup the FSSO Agent into my server, and is linked to my FortiGate. I can obtain usergroups list from my AD and the device shows 'up' in the External Connector section into admin web.Here I my case: I use wifi router for to provide access to several users, this was my previous device to provide internet before current FortiGate. And when I check users activity, all the sessions and web visits and almost all the log registries of any activity are not user-related, but IP related. This IP is always the router one, because users are 'behind' the router and share this IP. Is there a way that my FortiGate 'recognizes' the individual user that is performing the actions and stores it?In essence, maybe having all my users sharing same internal IP makes FortiGate unable to individualize then, even if I have the FSSO Agent working with my Active Directory?Thanks a lot and

A couple of questions regarding VLANs and the necessary policies to reach other VLANs and the internet. Scenario: I have a couple of ports on our FortiGate set up as a hardware switch (LAN). I have a single static route set up (0.0.0.0/0 to ISP) and I have policies that allow the LAN to communicate with the WAN port and vice versa. We have internet / no issues. I have just added a couple of VLAN interfaces under the hardware switch. Devices on new VLANs (set with DHCP Relay) are pulling DHCP addresses from appropriate pools/appropriate server. 1. What policies do I need to reach the internet from a VLAN? Do I need policies for the VLAN and WAN to communicate, or do I just create policies for the VLAN and LAN to communicate? 2. Same question for VLAN-to-VLAN communication. Let's say that I have a VLAN for printers and a VLAN for a subset of users. Do I create policies between those 2 VLANs, or do I just create policies that allow those individual VLANs to communicate

Hello, How many FNAC nodes supported by a single ha cluster does it support more than 2? i could not find this info in documentation. Thanks and Regards!

I have the issue that some FortiClients are not licensed, although there is an active connection to the Fortiems server.

hello, My company uses Fortigate 200E equipment and the version is 6.4.11.Forticare support is the only license that is active, and IPS, Antivirus, and Web filtering are not licensed.I want to control the VPN connect that accesses based on the Mac address.Can I make a policy based on Mac address without a separate license? I think the Mac address-based access control policy does not require any license from various sources, but I asked because it is an environment where testing is not possible. Please give us a lot of help. thank you.

Hello Bro,             I have currently deployed the Fortigate appliance with fortios 7.0.12.I have purchased the bundle license. "AV,IPS, video and URL fiter".My question is that, I want to enable the IPAM feature on the box, does this has any additional license other than the mentioned above?do you recommend enabling it for more assets visibility? especially that I have DHCP enabled on the Box?. TIA.MR.

Hi, I am not able to get throught tcp port 444 despite I allowed this port on my fortigate 100F. Do you know why ?  Thank you for your help.

Hello Fortigate Community,We are currently in the process of onboarding a new client who has a Fortigate 60D running FortiOS 5.2. Please note, this firewall will be replaced soon. The setup consists of two Internet uplinks configured once over PPP1 and once as a LAN interface.As part of the onboarding process, we have established a VPN tunnel to a Sophos firewall. The VPN tunnel is up and operational. From the Sophos side, the remote network can be accessed correctly, and the devices in the remote network can be reached without issue.However, we are experiencing problems in the opposite direction. Despite setting up a static route, the Fortigate firewall sends all the traffic to the default gateway over PPP1/Internet instead of routing it through the VPN tunnel interface.This behavior is causing us a fair amount of difficulty as it's inhibiting communication in the direction from the Fortigate firewall towards the Sophos one. It's worth noting that we haven't had any similar issues wit

Hi,I have configured a partially redundant IPsec VPN with two local links going to a single link, static IP server.The two links are seen as dial-up on the remote FG.I used the wizard to do all configs.SDWAN is used to team the two WAN links.I added via the CLI an interface monitor for the primary VPN tunnel so failover can happen. Everything works as expected except for... on the dial-up side the wizard creates a remote address group for VPN subnets.Try as I might, I cannot add another subnet as an address object into said group. The newly created address object is not shown in available addresses.On the remote end I can add a subnet into the local address group for the VPN. Why does it work this side? Because it's the server and not dial-up or possibly the interface monitor has got something to do with it? The only way for this to work on the dial-up side was to delete the config and use the wizard again and add all required subnets at config time so the group is created ac

Hi Fortigate'rs I have a (two actually in a HA config) FG101ETK Firewalls which I am very happy with. However, it constantly sends me e-mails when people are trying to "hack" our VPN. I'd like to avoid getting those errors as they clutter my inbox and may hide important messages, and there's really nothing I can about it anyway. Message meets Alert conditiondate=2023-06-19 time=04:58:21 devname=FG101ETK00000000 devid=FG101ETK00000000 eventtime=1687143501487137862 tz="+0200" logid="0106037121" type="event" subtype="vpn" level="error" vd="root" logdesc="Progress IPsec phase 1" msg="progress IPsec phase 1" action="negotiate" remip=61.66.190.98 locip=1.2.3.4 remport=8512 locport=500 outintf="wan" cookies="3e35cd0719dfedef/0000000000000000" user="N/A" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="N/A" status="failure" init="remote" mode="main" dir="inbound" stage=1 role="responder" result="ERROR" How do I stop the firewall from sendin

Hi,Would like to ask is there any guide to setup SMS / Whatsapp / Line incident push notification.I would like to setup push notification to my phone via SMS or Whatsapp for some serious incident. I saw a FortiSIEM Taiwan Webinars video, fortiSIEM able to send alert to SMS and Line app.Thank,John.

Hi Guru's, I'm capturing traffic using 'diagnose sniffer packet' on an Enhanced MAC VLAN-Interface. The capture contains the proper mac-address from the VDOM. However, when I capture on the client side, it seems that mac address has changed to a different address. I think it's the 'di hardware deviceinfo nic emac-vlan' -> Current_HWaddr address, probably inserted by the EMacvlan Ethernet driver. Is this correct behaviour and is it possible to retain the original VDOM mac-address? Because this breaks our source based mac forwarding on the loadbalancer. Regards!  

Hi, I'm trying to install the Fortinet VPN client on Linux but it doesn't work. The .deb package has a dependency on libappindicator1, which seems to have been deprecated quite a while ago and is thus impossible to install. Are people actually using FortiClient VPN on Linux? How do you do it?  

Hi,I am quite new to fortigate and ZTNA. But anyway I got a fortigate and a FortiEMS set up, they are connected through fabric.I have set up a ZTNA Server and have TCP forwarding to some RDP servers. It works even though only running TCP is killing the Terminal Server performance.So to the problem, I am trying to set up a reverse web proxy against an internal server where I need to pass authentication. So I tried to make create a authentication schema and I get the prompt and I am authenticated but it is never passed to the backend server. So my question is, is this at all possible?The backend server is a common IIS with Negotiate and NTLM  as authentication.my goal is to expose this server to the internet and in best case have a transparent authentication of the logged in user in the windows client all the way trough the reverse proxy into the internal server.I have done it with TCP forwarding of port 443 but a reverse web proxy is probably a better choice if possible.Any input i

Hi, I'm trying to redistribute OSPF over BGP. The Neighbors are getting the routes but the routes are using wrong recursive next hop IP on one of the sides...  When you look at the routing table on the right side it is using the WAN IP instead of the tunnel IPDEFLE-FW01 $ get router info routing-table bgpRouting table for VRF=0B 10.1.2.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38B 10.1.3.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38B 10.1.4.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38B 10.1.5.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38B 10.1.6.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38B 10.1.90.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38B 10.1.91.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38B 10.1.91.100/32 [200/0] via 172.30.0.254 (recursive via AD

Hi.I would like to build vlan net works.And each goes different WANs.Is it possible to build?My knowledge is so poor... Could someone help me.------------------------------------------------------------------VLAN ID : 10192.168.0.0 /24 VLAN ID : 20192.168.100.0 /24 VLAN ID : 10 ===> WAN1VLAN ID : 20 ===> WAN2------------------------------------------------------------------ 

We have a list of 800 ip addresses in a spreadsheet that need to be added to the Credentials and Discovery tabs under Admin --- Setup. Currently the ip addresses are being added manually one at a time, which is very time consuming. Is there a way to import the bulk list into Fortisiem or script this process? 

friends a query.For which scenarios should the "security fabric connection" be enabled in the interfaces or what is the reason why it should be enabled?   

Can you plz any one help me to understand Fortimail "Server Mode".how its work what are the features? how its work? FortiMail   

Hi, we are trying to pilot Fortimail with only a few mailboxes from our organisation. We have Fortimail cloud setup in gateway mode. We have already done the default configuration guide on it, except changing the MX records on our DNS Zone file. Doing that would cause the whole domain's users to be routed through FortiMail, our concern on that is that we will exceed our license count. We've only bough 100 licenses to test out on a few users before onboarding our whole user base. As per TAC support, with this setup, we cannot selectively activate licenses on select users via FortiMail. So we have to send mails for only certain users to the FML unit for filtering. Currently, we have this proposed mail flow:External mail (from anywhere, e.g. user@foo.com) >> O365 MX >> Mail Flow Rule (checks recipient if part of pilot program) >> FML >> Runs filtering >> user inbox (user@bar.com) We've already setup the protected domains (bar.com) as per the initial

When FortiAuthenticator provides mobile token registration, it connects to FortiGuard to offer users the service of token registration. What data is included in the upload when FortiAuthenticator connects to FortiGuard to provide registration service? Are there any personal or privacy-related concerns?#fortiauthenticato #FAC

Hello I have a Fortigate 60B that needs to have SPI disabled as part of a test.  Are these the right commands in CLI to make that happen: config system settings set asymroute enable end Also, If you enter this command, what kind of impact would it have on current traffic?  Does the FW require a reboot? ThanksJay

I get a super weird issue with a Fortigate 40F ( version 7.2.4 ). Infrastructure:1 FG40F1 local ssh server on Windows 10 Goal: SSH server should be accessed on the Internet ( obviously with some protections ) Issue:When I do a connection via a telnet command from LAN ( with local ip address ) : $ telnet X.X.X.X 11022Trying X.X.X.X...Connected to X.X.X.X.Escape character is '^]'.                     SSH-2.0-OpenSSH_for_Windows_8.1      <---- I get a ssh identification string BUT when I do a connection via a telnet command from Internet ( with a public ip address ) : $ telnet X.X.X.X 11022Trying X.X.X.X...Connected to X.X.X.X.Escape character is '^]'.                         <----- connection to ssh server from outside but no ssh identificat

Hello all,I want to use external DHCP on my SSL VPN.I found the following on the internet:config system interface edit ssl.rootset dhcp-relay-service [enable|disable]set dhcp-relay-ip nextend Only with these settings, it's not working.I think there is also a configuration need on VPN SSL web portal or VPN SSL setting or I have to assign an IP on the interface ssl.root Does anyone here know about this? Can someone give me the winning tip?

Hello everyone,i am writing to you because we have a strange problem about the dns of the vpn ssl. In the menu SSL-vpn setting we have specified the following dns to use: 172.1.1.20 - 172.1.1.30, unfortunately we have noticed that all the clients connected through forticlient inherit completely different dns, that is: 172.1.10.50 - 172.1.10.60. is there a way to understand why they take different dns although we are configured explicitly in the portal?dns configuration in attachment, do i need to open a case or do i have do control something more specific? Regards