Solved

Hi, Users connect to M365 services using a redirection authentication to the FAC (version 6.6.2).The config is working fine on Microsoft and iOS but not on Android devices.For example, if i add an account to the teams application on the phone, i insert the username and after that i receive got a blank page and not the fac page. All suggesition will be appreciated :) Regards,Simon  

Trying to set-up Agentless Portal access as per  https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-Agentless-ZTNA-with-FortiGate-v7/ta-p/373718#M11651 I have it all configured but when I try to access the web portal I get the following error. Any suggestions?

I just ran into this: I have an Adom in FMG. In this is a FGT100F I want to use for lab purposes. It was reseted to factory default before adding it to FMG. It added successfully and I can configure it in FMG. I was able to deploy device configuration to it successfully.I then created a provisioning system template that assigns system dns, ntp etc. The template also does the interface config (creating vlan interfaces and afterwards configuring them). For the interface configuration one variable out of the policy package is used.Once I assign that FGT100F to that template and try to deploy device config only it fails. There is no installation log available and the progress log only says "[fw-teststandort1[copy] root] Copy global shared objects failed (adom:my_Adom, dev:fw-teststandort1) (reason:none)". It does not provide any further information. Also dia deb app securityconsole 255 does not provide any more information. Does anyone have a hint on how to further debug this to

Hi, I have new deployment project for ZNTA. We have a Local CA. we have generated a CSR from FortiGate and signed it by a local CA to be imported in FortiGate. and for EMS I would like to know what should do for the certificate, as there is no CSR option. Should I only import local CA Root Certificate to EMS server? Kindly need help to understand the certificate required for EMS within local CA and FortiGate.

We have two pairs of 91G's running 7.4.6 at two different locations. Each has a DMZ with subnet 192.168.100.0/29, and each location has a route map that allows redistribution of connected routes into OSPF. Site A is preferred and has route redistribution with a better metric. This works fine, but the problem is if the server at Site A goes down, but default the associated FortiGate doesn't know that server is down (the switch port is still up) and continues to advertise the connected route. Is there a way to configure SLA to query the server at 192.168.100.2, and if that server is not reachable, then the FortiGate removes 192.168.100.2/29 from the OSPF process until the server is once again available?

Hi Everyone,I wanted to know what i need to specify for getting all records from splunk. normally the variable is "max_count" i tried to remove but its not worked

Hello, I need your help.I have a Fortigate 100F running firmware 7.4.7, and I have configured GRE over IPsec tunnels.My networks are routed using static routes.The problem is that when one tunnel goes down, the traffic still continues to flow through the main tunnel, so failover to the second tunnel does not occur.Is there a way to configure something like a link monitor or any other mechanism so that when Tunnel1 goes down, it automatically switches to Tunnel2

We have forti cloud EMS version 7.4.3 , invitation code (no expiration set) set to single user does not work, when user is entering invitation code in forticlient-7.4.3 version ( tried both manually and copy paste), it does not give any error it's just show processing tab and nothing moves further. Tried to entered invitation code via CMD also but no luck. Please help here

Dear team, Has anyone else observed this issue? When we create a contractor user with a corporate email address and no one logs in with that user, after a while, it causes the existing user VLAN to change to isolation. When I check that user and click Show Hosts, I can see another host belonging to the same user with the contractor email address. The strange thing is that when I check that host, I can see that the logged-on user is the contractor user, even though we did not log in. Somehow, I guess the passive agent finds that device user, checks the email address, and matches it with the contractor user. Is this normal behavior? It's not happening instantly; it takes some time to detect the other host and link it with the contractor user. My goal is to create a contractor user, assign them to the onboarding VLAN, and install new computers. That's why the help desk team creates users with corporate email addresses and keeps them for a month. Do you have any suggest

We have a vendor who has 2 servers with 2 NICs configured with teaming. Port 1 of each server is directly plugged into port 2 of each FortiGate (also belongs to vendors, and these are 60E's running 7.0.x). We've been testing failover, and it's been problematic. At least one server, sometimes both, will be unreachable when we test failover. We can disconnect the cables to the standby FortiGate, and the servers are instantly reachable. Even after the server is reachable, as soon as we plug the cable back into the FortiGate, the server is sometimes unreachable. We've not had any experience with this before, but then all FortiGates we manage have ports plugged into switches. Are there any ideas as to what we can try? Thanks

Hi Guys. I have starved my own knowledge and googlefu so i hope someone in here can help me.We are transitioning from SSLVPN to IPSEC VPN and want to keep using our SAML setup. When trying to connect to the IPSEC VPN tunnel i get prompted with my SAML prompt, enter my credentials, log in and the client then hangs in "Connecting".In my debug i see the SAML request being processed and completes as it should but i see no IKE debug prompts.Nothing appears in my VPN log either. The only thing i can see is in my Forticlient, where i get an error regarding power which i reckon is not related to this. When connecting to the SSLVPN (same public IP, different ports ofc.) i go straight through and connect with no issues. Does anyone have any idea why i am stuck in "Connected" when my SAML request is processed?Kind RegardsEDIT:We have tested with Forticlient versions 7.2.4, 7.2.5 and 7.4.0 and with different vendors of net adapters and from different locations.

Hi everyone,I am searching for a way to use MFA with TOTP without paying for FortiToken.  Our internal users get authenticated via SAML and MFA from Microsoft Cloud. But we do have some external accounts which can't be linked to SAML but need VPN.  Is there any other way to set up MFA with a TOTP App without using FortiToken?

Hello Team, I have two FortiGate 2600F FGCP clusters (active/standby) with FGSP enabled between them for a specific VDOM. I would like to verify whether FGSP sessions are synchronized and see which ones are. The following CLI commands appear to report FGCP session information only:diagnose sys session syncdiagnose sys session list  How can I retrieve session information for FGSP specifically? Thanks in advance for the supportBest Regards 

HiI have two questions. 1. Is there a way to set admin-lockout-duration to 100000 and let another administrator unlock it when the account is locked? 2. Is the criteria by which the account is locked not the account name but IP based? Thank you

BodyHi everyone,GoalI want my FortiGate 60F to continuously ping a specific host, for example 172.16.23.254. If it stops replying, I need FortiGate to trigger a webhook that will notify a Telegram group. The Telegram webhook side is already working, so I only need help with the FortiGate trigger.EnvironmentModel: FortiGate 60FFortiOS: 7.4.8Target to monitor: 172.16.23.254The target is on LAN, reachable via interface: internal4What I have workingA webhook action that successfully sends a message to my Telegram bot when manually tested.What I am trying to achieve on FortiGateSet up a reliable ICMP probe to 172.16.23.254Generate a log event when the host is considered down, and again when it recoversUse an Automation Stitch to catch that event and call the webhookQuestionsWhat is the best practice approach for my case?Desired outcomeWhen 172.16.23.254 fails ICMP for N consecutive probes, FortiGate sends a webhook to Telegram with a short message that includes the host, status, and time.Wh

Hello All, Have issue on both Fortigate's (v 7.4.8 and 7.6.4). I'm import endpoint certificate via PFX (wildcard). Import two certificates - root and intermediate to "Remote Certificate". If I open info of endpoint certificate and view Serial Numbers of intermediate and ca certificates - its identical for Serial Numbers of imported certificates. But in test via openssl s_client -connect mysite:443 -servername mysite -showcerts I'll see error "Verify return code: 21 (unable to verify the first certificate)"What's wrong, what I missed?

Hi FGT adminsToday I saw 2 FortiGate physical appliances, with FortiOS 7.2.10, having a strange admin that I've never seen before on any other FGT.On first FGT:On other FGT: What is this account user for? Or should this be removed?

Hi all,  I hope you're well.  I am installing 4 x 120G FortiGates into a DC, but these firewalls will not be on the edge therefore no direct internet access. Another layer of firewalls is in front, I need to create an explicit list of IPs, domains, services etc to provide to the individuals who currently manage them to ensure the FortiGates has access to required services for NGFW features.    I am currently building a policy on a lab firewall with what I know and can see is required but is there an explicit list available so I can ensure everything is covered? Thanks, Dan. 

Hello, I am a monitoring analyst, and I have access to FAZ1000F v7.6.3. When I go to “Incidents & Events,” I find a large number of incidents, but when I take the source IP of these events and go to “Log View,” I find that the event was blocked by the firewall. I understand that for FAZ it is an incident even if it has been contained, but it generates noise for me. I am interested in seeing only the incidents that were not blocked. Is this possible? If so, how can I do it? Thank you.  

I have SAML SSO enabled on the FortiGate using Azure as the IdP, and it's working well. I'm now trying to enable the SP certificate. I tested several certificates from the FortiGate certificate list, but each one fails with the error:"Signature algorithm used to sign data is not supported." The IdP metadata shows Azure requires this signature method in SAML metadata:<SignatureMethod Algorithm="...rsa-sha256" /> How can I generate or issue a certificate on the FortiGate that will produce RSA with SHA-256 signatures via CLI? Please help with CLI commands or steps. 

🧱 EnvironmentFortiGate model: FG-101FFortiOS version: (please add, e.g. 7.4.3 or 7.2.6)VPN type: IKEv2 IPsec (remote access)Authentication: LDAP users & groupsClient: FortiClient 7.4.3 (Windows 10 Pro 64-bit)🪪 ScenarioI’m configuring an IKEv2 IPsec remote access VPN that authenticates users via an LDAP server.The connection is established from FortiClient successfully up to Phase-1 (SA_INIT), but it fails during user authentication (EAP phase).EAP failed for user "test"EAP response is emptyconnection expiring due to EAP failure

FortiGate VPN Device Integration to FortiNAC.I am currently working on integrating FortiGate with FortiNAC.I need assistance with the configuration steps and the guide that outlines how to properly integrate FortiGate (FGT) with FortiNAC (NAC) for VPN-based access control.The officel guide I already read.Is there have any guide for this .   

Hi all, I'm having trouble getting 2 fortigate firewalls to connect via VPN, it looks like the phase1 is up but the phase2 never gets triggered. Even if I execute a ping between the two sides it never comes up. I've attached a screenshot of the VPN settings at both ends as well as the static routes and the firewall rules that I've got configured. I've tried running the Fortigate to Fortigate IPSEC wizard and I get the same result. I currently have NAT disabled at both ends but I've tried it with it enabled and enabled/disabled at both ends. I've checked and the preshared keys are the same and they're both using AES256-SHA256 DH14 on both the phase1 and phase2s I'm really confused, can anyone offer any advice?  

On MacOS 15 (FortiClient version 7.2.6), at the MacOS login screen a message appears prompting for credentials.  The message states: FortiClientAgentYou are making changes to your Certificate Trust Settings.Enter the name and password of a user in the "(null)" group to allow this. No matter what credentials are entered, it won't accept them. I've opened a case with support, to no avail so far.They referred me to this article (for an older version of FortiClient), and I added all the services it mentions that need full disk access and checked the other settings:https://docs.fortinet.com/document/forticlient/7.0.9/macos-release-notes/223986 I would investigate downgrading to see if that helps, but we want to be on the latest release so that we are up-to-date on security patches. Does anyone have any suggestions? Thanks in advance for any advice.

Hello,A little surprise today while I was creating my playbook, it seems that the following actions are still using the CrowdStrike API endpoints that were decommissioned on September 30th. - detection_search : use /detects/queries/detects/v1- detection_aggregates : use /detects/aggregates/detects/GET/v1- update_detection : use /detects/entities/detects/v2- get_detection_details : use /detects/entities/summaries/GET/v1 In accordance with the CrowdStrike documentation, it appears that these API endpoints have been merged into the Alerts section. The documentation say "Detections are no longer stored in their legacy format."https://falcon.eu-1.crowdstrike.com/documentation/page/d02475a5/converting-from-detects-api-to-alerts-api# Could we please, in the next update, either remove these actions or update them to use the correct endpoints (for example, the ones already used in the update_alert action) ?