Solved

Hello all,I want to use external DHCP on my SSL VPN.I found the following on the internet:config system interface edit ssl.rootset dhcp-relay-service [enable|disable]set dhcp-relay-ip nextend Only with these settings, it's not working.I think there is also a configuration need on VPN SSL web portal or VPN SSL setting or I have to assign an IP on the interface ssl.root Does anyone here know about this? Can someone give me the winning tip?

Hello everyone,i am writing to you because we have a strange problem about the dns of the vpn ssl. In the menu SSL-vpn setting we have specified the following dns to use: 172.1.1.20 - 172.1.1.30, unfortunately we have noticed that all the clients connected through forticlient inherit completely different dns, that is: 172.1.10.50 - 172.1.10.60. is there a way to understand why they take different dns although we are configured explicitly in the portal?dns configuration in attachment, do i need to open a case or do i have do control something more specific? Regards 

Hi,previously I had fortiauthenticator which was used to manage the SSO part, currently instead it has been decommissioned and Azure AD has been implemented to do the same tasks.I have some doubts and issues that I cannot resolve.it seems that it is not possible to census the individual user but it is necessary to put them in a specific group on the azure AD side in order to manage sso?in this case i am wondering if it is possible to have a timeout for SSO disconnection. .For example, if the computer is used by multiple people and therefore the OS has multiple user profiles how does this work?If another user logs in from another profile is a second SSO authentication requested or does the session of another previously logged in user remain active (since the association is IP based only)?Regarding the captive portal for SSO authentication: is it possible to use the same endpoint to log in with SSO from different subnets/interfaces?This is to avoid having to create for each subnet an app

Hello, We configured the VPN SSL authentication  using SAML (Azure AD) successfully for some groups.To distinguish profiles, we mapped different groups with specific realm+portal. Firewall group A = default realm + portal AFirewall group B = realm B + portal BFirewall group C = realm C + portal C Both groups A & B mapping work perfectly, allowing users to connect to multiple realms depending on the device they are using (portal A for workstation, portal B for mobile device, portal C for limited users) The firewall policies work for firewall group A and group B however, users which are in group C are blocked whenever they are correctly connected to the SSL-VPN with their group.The ACL for group C is nearly the same as the groups A & B :- Source IP : Group C pool IP- Source group : Group C The result is packets are dropped because the implicit firewall rule. We found out that there is a difference when we check the group membership on VPN SSL an

Hi My setup:FortiClient VPN -> FortiGate 40F <- Site-2-Site -> Zyxel -> DCFortiClient subnet: 10.45.130.0/24 (DNS: 10.1.8.16)FortiGate subnet: 10.45.134.0/24 (DNS: 10.1.8.16)DC: 10.1.8.0/24 FortiGate firmware: 6.4.6FortiClient: 7.0.8.0427 When I'm with my client on the subnet 10.45.134.0/24, I can ping and resolve all hostnames of my domain. But when I'm connected through my FortiClient VPN, I can still ping all IP's just fine, but I can't resolve and DNS names of my internal network. It's like it's not using the DNS on 10.1.8.16. I have configured dns name for my FortiClient:config vpn ipsec phase1-interface(phase1-interface) edit <VPN TUNNEL NAME>(VPN TUNNEL NAME) set domain abcd.local(VPN TUNNEL NAME) end I have tried to disable split-tunneling on the VPN connection, but still no luck. I then tried to create a DNS Database on the FortigateType: SecondaryView: ShadowDNS Zone: abcd.localDomain Name: abcd.localIP or Primary: 10.1.8.16And

Hi In the FortiOS Release Notes for version 7.2.5 under New features or enhancements, Feature ID 894191 mentions "Improve GUI memory consumption for FortiGates with 2 GB of RAM or less". At what cost was this accomplished? Anyone have such information?Because in fact, my RAM consumption dropped by about 15-20% (FGT 60F).

Does FortiGate-80F have a protecting function against spoofing traffic such as MAC address spoofing, ARP spoofing, DHCP spoofing, and DNS spoofing?If so, how can I check the function by commands?

Can anyone explain me what can be done under:System > Network > Interface > PhysicalSystem > Network > Interface > VLANSwitch > Port > PhysicalSwitch > Interface > PhysicalSwitch > VLAN I tried to understand it, but couldn't. Thankyou for any help.

Hi, I have a problem with firmware upgrades of a FGT-Cluster.A part of the configuration gets lost after upgrading the firmware of the cluster.I don't even know the steps/update path of the last time.But this time the upgrade was from 7.2.3 to 7.2.4.A restore of the configuration helps.  I guess it has something to do with the save mode - set to manual instead of automatic.Next time I will change the save mode before the cluster gets upgraded?! But I just wanted to ask, if there is anyone else, who faced the same problem?

Q: Which FortiDoc guides do you use for setting up FortiGate VPNs based on digital certificates?

Hello,I have a policy that allows trafic to microsoft related ports (attached image of the policy configured).On the FortiAnalyzer, the logs show that this policy matches with an accept action for ports TCP 49152-65535 that are not allowed on the said policy (attached image of the log on FortiAnalyzer and the Policy Lookup done to verify that the ports are not allowed). Is this a bug on the FortiGate or is this an intended behaviour from the FortiGate?Thanks,Policy LookupFAZ LogFirewall Policy

We have an FG-100F and a 48-port POE switch. We use Fortilink to our 48-port switch, and we create/manage the VLANs through switch under the WiFi & Switch Controller ==> FortiSwitch VLANs on the GUI. Is it possible to group VLANs created on the FortiSwitch into a single Zone in the same way you can group VLANs created on the firewall?

Setup: 2x PAYGO Fortigate in Azure.Front LBA and Back LBA from Azure.Fortianalyzer VM in a VNET Behind the Back LBA.Problem im not able to communicate with the Anayzer. i.E. 192.168.1.100The Fortis have the Adresses 192.168.10.69 and 192.168.10.70The LBA Backend IP 192.168.10.68The VNET of all is 192.168.0.0/16The Route Tables are showing to 192.168.10.69 on the VNet and Subnets.If i do a debug on the forti i can see that SYSLOG Sessions are incomming on the 192.168.10.69 for the Forti 192.168.10.70 and they are not send through the IPSEC Autoscale Tunnel and will be dropped.I have a Fortigate Connected to the FortiAnalyser throught a Azure VPN Gateway. So the Fortianalyzer is basicly working.Any Suggestions?Your help is appriciated

HelloI observe in the GUI version v7.4.0-build2223 (VM FAZ) a problem with the correct handling of CSS. The issue affects browsers with the Chromium engine (Chrome, Edge). I've tried on different computers and the problem persists on all of them. Everything is fine in Firefox.The problem manifests itself in the display of a thick border around the drop-down list controls. It is not possible to expand such a list. Clearing the browser cache doesn't help.I also observed the problem in VM FAZ 7.2.x versionsAnyone have similar? 

want to update my fortigates this evening to latest patch due to the VPN issue we have read about.but my fortimanager only seems to show the previous version of firmware available to push down to the different fortigates, not the most current version with the patch. do we have to manually download the firmware, or is there a way to force fortimanager to updates its firmware list?

Hello everybody,I have trouble configuring the nat46 on the forti 6.4.12I followed the documentation but the problem is not solved.Your help will be very valuable to me.THANKS

Using FortiGate 80F with Fortinet OS 7.4.0. I am configuring dual WAN. I want my primary (WAN1) to be used whenever the health link is alive. My secondary (WAN2) should only be used while WAN1 is down (dead). As soon as WAN1 comes back alive, I want my traffic to be rerouted immediately through WAN1. Again, I always want to use WAN1 when its health is alive. Here is my configuration. Can someone verify it and let me know if something needs to be changed?  config system link-monitor edit "wan1 failover" set addr-mode ipv4 set srcintf "wan1" set server-config default set server-type static set server "8.8.8.8" set protocol ping set gateway-ip 0.0.0.0 set source-ip 0.0.0.0 set interval 3000 set probe-timeout 500 set failtime 3 set recoverytime 3 set probe-count 30 set ha-priority 1 set update-cascade-interface enable se

Community,I have the below:2 fortigate 200F ( HA cluster active active 1st is primary and 2nd is secondary) connected to a core switch with 2 connection each firewall ( 4 connection in total).the issue is when i try to test the HA active active and I remove the forti primary connection with the core switch, I have no access to the secondary forti ( cannot ping over the ip address that I gave for the both 200F).The configuration in the core switch is with port channel (channel group) mode active and in the forti is 802.3ad aggregate.Please Help.Kind regards 

Anyone had try using this sequence group in the firewall policy via numbering order but the number we rearrange from the initial of 1,2,3,4,5,6 to become 1,2,3,5,4,6.Does it follow the top-down approach or sequence id approach in sequence grouping once we rearrange the ID order? 

I`m trying to get the certificate NSE4, but in the training (CBT Nuggets) have a NGFW option in the last version 7.0.10 I made this change without problemsSystem > Settings > NGFW Mode Now, in version 7.0.11 I didnt find this options in the same section, print attached Version 7.0.11Version 7.0.10 Someone can help me? 

Hi all, We've got a user with a mobile token and their phone is no longer working so we've setup another phone for them and thought we could just re-send the activation email for the QR code to activate it on the new mobile but when we go into the user on the router there is no option ? If we edit his account it just shows the serial number of the existing token in grey. We've tried to delete the user off to re-add it but then we get the error above but i cannot find what "other entry" it's linked to ?There is a DRIFT column next to his name that shows a -1 in there but no sure if that's relevant but how do we either get the QR code re-sent so we can activate it on the new phone or delete him off to re-add him?Thanks in advance

Hello friends, I am facing a problem with FortiWeb Cloud because it blocks my ports at the time of DNS record change, I need to allow ports 80, 8081 and 9090 (the latter with HTTPS certificate)The problem is that in the Endpoints module, the option to add more ports is not shownGreetings

Hello- Yesterday we updated our HA 501E pair from 6.0.5 to 6.0.7.  All seemed to be fine, but today, users connected to our SSL VPN tunnel are having Outlook 2016 Connectivity issues.  We have Outlook on-prem and only clients coming in over the SSL VPN full tunnel are having the issue. Outlook sync log keeps generating errors similar to:14:58:32 Synchronizer Version 16.0.11328 14:58:32 Synchronizing Mailbox 'Joe User' 14:58:32 Synchronizing Hierarchy 14:58:33 Synchronizing server changes in folder 'Inbox' 14:58:33 Downloading from server 'd10db7e0-492a-4521-8c0a-fe49225ad443@company.com' 14:58:34 Downloading from server 'd10db7e0-492a-4521-8c0a-fe49225ad443@company.com' 14:58:34 Error synchronizing folder [size="2"]14:58:34 [80040115-514-80040115-0][/size] 14:58:34 Network problems are preventing connection to Microsoft Exchange. 14:58:34 Microsoft Exchange Information Store 14:58:34 For more information on this failure, click the URL below: 14:58:34 https://www.mic

Hello, SITE A : Mikrotik HAP AX2SITE B: Fortigate 60F I successed to create an IPsec tunnel between a Mikrotik HAP AX2 and a Fortigate 60F.I configured the Site A to be in full remote browsing through the Fortigate. Site A connects to internet through Site B Site A have a 600 Mb/s bandwith and Site B 1Gb/s. My issue is: I cannot reach more than 29 Mb/s of download and 5 of Upload with bandwith test from Site A with the Mikrotik. I tried to change/quit encryption methods to see any improvements, without success.I tried to up another tunnel with another AX2 from my house and my 40Mb/s, and I have the exact same bandwith, who made me think of that there is something limitating the bandwith at some point. Anyone could help me to see what would be the issue here?Many thanks !

NULL