Solved

Hello, I'm looking for some best practice/guidance on opening our fortiauthenticator to the internet so our remote users can utilize their fortitokens at home more easily as we occasionally have issues with offline tokens.  Is it really as simple as creating a public dns entry and then creating a VIP on the FortiGate firewall followed by a policy that allows that traffic to the fortiauthenticator via port 443? Do I need a certificate from a trusted root CA on the internet to do this setup for those at home users? I see there is a checkbox to "Verify Server Certificate" so that's why I ask. I believe that should add an additional layer of protection by checking that box, correct? I like doing the dns entry as I can then create a new zone in my internal AD environment for my internal users to point to the same DNS entry, so it works both internally and externally seamlessly. Are there any cookbook articles that talk about this to ensure it is completely secure? Just l

One of my customers is complaining they are able to connect to SSL VPN (SAML) from inside their network. Not sure why they're trying to do so but is there an easy way to block this from happening? I've tried running negate from the ssl vpn settings from RFC 1918 addresses but that did not work. config vpn ssl settings set source-address-negate enable set source-address "RFC1918" end Thanks in advance for any input

Hi Team, I read the documentation for Security Fabric and i can see the minimum requirement : 2 fortigate and 1 FAZ. The FAZ is mandatory or it's just better for the aggregate log? Thanks for your reply. Best regards, 

Hello Fortinet community We have FNAC 9.2.7 and want to integrate few Aruba IAPs. (MODEL: 315, ArubaOS 6.5.4.6, and 8.9).Followed FortiNAC Aruba IAP integration guide by Fortinet.After IAPs was added to FNAC via SNMP and SSH, FNAC seems not able to read VLAN & Port information, as nothing is displayed in "Ports" tab. L2 polling doesn't work neither. Consequently, FNAC RADIUS always assigns default wireless access value for all rogue or registered hosts.The issue is the same on all our Aruba IAPs. From the RADIUS server log we can see the below interesting messages.:: Device virtualization not supported:: Policy access config lookup skipped - [ArubaTest eth0] not a member of 'Role Based Access' port group When trying Read VLANs or L2 Poll, the "tail -f output.master" command gives the following interesting message just after "show summary" output.yams INFO :: p: default-threadpool; w: Idle ArubaIAP.updateVlanID exception com.bsc.api.database.NoSuchDatabaseObjectExcept

Hello all Our clients have a phone software installed which needs internet connection.There are several firewall policies in place to allow said phone software to connect to several internet places. The producer of the phone software needs us to allow *.amazonaws.com on a UDP port range. There are other needed wildcard fqdn used by that phone software and those seem to work (fortigate gets IP addresses for those wildcard FQDNs).However, that one FQDN *.amazonaws.com doesn't work - no IP addresses in the fortigate DB.Yet the phone software tries to open a connection to an AWS IP which does not succeed as the wildcard FQDN doesn't get any IP addresses. We suspect that the STUN does "hide"/tunnel the DNS request for the AWS-FQDN requests and therefore Fortigate can't learn its IP. Does someone have experience in this and knows how to circumvent that and make sure we can open the AWS IPs on those particular Ports?(Using AWS as Internet Service opens up every single TCP

Hi, What are the models of Fortigate has internal hardware switch which can be used as one switching layer.. I am not seeing this in the device spec. 

Hi,i'm installing two Fortgate F61 in HA and monitoring two interfaces. They are working as expected and the monitored interfaces in standby unit are up on the switches they are connectaed to. The thing is that i'm interested in having these two interfaces of the Standby unit in down. I know that failover will be a little slow but this is not a problem on this environment. I have been reading CLI reference guide and there is no command to do it (https://docs.fortinet.com/document/fortigate/7.2.3/cli-reference/21620/config-system-ha). Does anyone knows if is it possible? Thanks.

Setup | Brand new pair of 601F's running in HA a-p mode. Running on version 7.0.9 but also saw this issue on 7.0.7. Minimal straightforward configuration - single root VDOM, etc. Issue | Seems to be triggered by HA changes/reboots the secondary. All of the RJ45 ports  on the device are lit up but nothing's plugged in. Or they will all be showing down even though some should be up. Details:We had the pair running in HA utilizing ports port1 and port2 as the ha heartbeat ports (instead of the native HA port). Everything appeared fine until we upgraded the firmware (7.0.7). The upgrade failed due to the secondary losing communication with the primary. The reason for this is because once the secondary was rebooted with the fresh firmware the ports (port1 and port2) never came back online - so HA wouldn't come up.  On a physical level, all RJ45 ports link lights were green on the secondary (even though they were not connected).We entered the following command:#'get

My newly installed FortiGate shows outdated IPS Definitions, IPS Engine and Malicious URLs.The update servers can be reached. Do I miss a service entitlement?Status dashboard looks good:Any suggestions how to troubleshoot this?I already tried a reboot and manual license import.

I wonder how others address this, seemingly, simple config using FG-80F with FS-108E-FPOE and FAP-433F. How would you connect/configure this (an overview will suffice):FG and FS on 7.2.3, FAP on 7.2.1All 6 ports of FG belong to a VALAN 10 for wired clientsVLAN 10 also has wireless clients that should be bridged to its wired clientsport 8 of FS is connected to FG port a via fortilinkports 1-6 of SW belong to VLAN 20 for wired clientsVLAN 20 also has wireless clients that should be bridged to its wired clientsSo, for FAP only port 7 available on FS, and port b on FG (POE not necessary for FAP, could be powered by a power supply). In absolute worst case, port 6 of FG could be freed for FAPMy problem is where and how to connect FAP? If a new FAP management VLAN created on SW and FAP connected to FS port 7, then VLAN 20 devices (wired and wireless) are ok but VLAN 10 wireless clients not getting IPs; if FAP management interface is created on FG by removing port b from fortilink, then V

Hello, is it possible to filter the "Fortiview Destinations" by interface? GreetingsAndreas

Based on the latest PSIR, I am upgrading several Fortigates (40F, 60F, 61F, 100F). On the first two, I got the following config errors: fortiabc # diagnose debug config-error-log read>>> "set" "filename" "en" @ global.system.custom-language.en:value parse error (error -651)>>> "set" "filename" "fr" @ global.system.custom-language.fr:value parse error (error -651)>>> "set" "filename" "sp" @ global.system.custom-language.sp:value parse error (error -651)>>> "set" "filename" "pg" @ global.system.custom-language.pg:value parse error (error -651)>>> "set" "filename" "x-sjis" @ global.system.custom-language.x-sjis:value parse error (error -651)>>> "set" "filename" "big5" @ global.system.custom-language.big5:value parse error (error -651)>>> "set" "filename" "GB2312" @ global.system.custom-language.GB2312:value parse error (error -651)>>> "set" "filename" "euc-kr" @ global.system.custom-language.euc-kr:value par

Hi, We have about 3000 endpoints upgraded from the free version to EMS (7.0.5). Since the upgrade, we have a few users (10 at most) that cannot connect to any servers. Upon troubleshooting, it seems like like a combination of EMS version and specific ISPs. I have a case with Rogers here in Canada. Here are my observations, all using the same hotspot router, sometimes different SIM cards 6.4.6 non EMS with Rogers SIM + Inseego Mifi 8000 = ok7.0.5 EMS with Rogers SIM + Inseego Mifi 8000 = no traffic7.0.5 EMS with Bell SIM + Inseego Mifi 8000 = ok I get the same behavior on 6.4.9 EMS and 7.0.7 EMS than on 7.0.5 EMS. Any ideas where I should look?  

Hello everyone Likely a stupid question:I have (at the moment two) VMs in Azure and I would like to re-deploy them - can I re-use the licenses? Of course I am deleting the VMs beforehand, I am not sing the licenses several times - I am just not sure anymore if there is anything bound from said deployment to the license I bought and therefore I would need to do something special in order to use the same license on a newly deployed Azure-Fortigate-VM (which will re-use the license from a former VM) Thanks

Hi team,  Does Fortinet have a reverse proxy solution with two-factor authentication? Maybe Fortiproxy has such a feature? I can't find any documentation on this. Could you please give me a hint. FortiProxy , FortiGate , FortiAuthenticator , FortiToken , FortiWeb 

I am configuring FSSO using the polling method and I am seeing some strange results. The Fortigate is seeing the user logon event and I can see the corresponding Kerberos event IDs 4768 and 4769 on the AD server, however the Fortigate is then logging a logoff event almost instantly for that same user.   As far as I understand, polling mode only reads events 4768 and 4769.  On the server security event log, there is a logoff event (4634), even though the user is still logged onto the machine, not sure why that is being logged by the AD server. Has anyone come across this type of behaviour before?  Not sure if this is expected, however it means that the FSSO groups can't be used.  I'm aware that this is not the recommended method for FSSO, however I have a customer who wants to use this (until I can persuade them to use DC agent mode). Thanks John FortiGate 

Hello CommunityThe FortiOS REST API from Fortinet Developer Network can be found referenced here. Each base URL endpoint has the various response codes (200, 400, 401, ...). Would it be correct to assume that every endpoint has exactly the same response codes and that all those response codes will always mean the same over all endpoints?  Thank you for explaining.   

We are having an issue with our FortiClient users not reconnecting after a brief network drop on their home internet.  If they have a quick drop, we measured it at about 10sec, the VPN will reconnect/stay alive.  But if they drop their internet for more than that it prompts them to login again.  This causes issues with open files on the network shares and is inconvenient to the enduser. I believe we have the auto reconnect setup properly in the FortiClient EMS Cloud (needed to modify XML according to Fortinet support) and we have the FortiGate 200E setup to allow the auto reconnect. I've searched and searched for a solution but haven't been able to resolve it.  I should note that we are using DUO for MFA, not sure if that is a factor in it. Asking for any insight.  I've included the current SSL settings on the firewall. Thanks,David FortiOS 7.0.9FortiClient 7.0.7FortiGate 200E# config vpn ssl setting(settings) # getstatus : enablereqcli

Hi, I cannot seem to dismiss the error "archive is using x% of allocate disk space message" in Fortianalyzer. I believe there's still plenty of storage left. 

Hi all, Sorry to bother however I am currently experiencing issues with a HA pair of FortiGate 50E running v6.2.12 build1319 (GA) firmware. For some reason both units work flawlessly when they are in standalone mode with one unit active at each time with no issues with the site to site VPNs to Azure however when the units are installed in Active-Active or Active-Passive HA mode the site to site VPN is dropped and unable to be established again. I have performed some diagnostics and I seem to be getting IKEV2 Phase 1 issues however I can't work out why this would be the case only when in HA as the settings input are the same of those on the Fortinet 6.2 cook book for setting up the Azure VPN. I've made sure all the firewall rules and routes are present for traffic to flow and when in standalone can confirm I am able to access the Azure resources without issue. Has anyone seen this issue before?

Hi, I would like to ask if this simple topology is supported. No redundancy needed, I just want to  manage switches from fg unit and be able to use Security Fabric features Thanks Bednar

Howdy! I am looking for information on installing the FAC Agent via the CLI.  Is this possible? Thanks!

I am having a hard time figuring out how exactly a decision is taken when multiple UTM profiles and multiple rules are in play. But let's have a simple example: I have a HTTP request that goes into category "Information Technology".However it is being allowed by the rule with the following security profile: Webfilter* "Content Servers" -> Allow* All the others (including "Information Technology") -> Monitor 1) What is the actual meaning of "Monitor" anyway? 2) If a rule contains multiple security profiles, where do I see exactly which one was matched, if the rule matched? Is there some detailed documentation on this? ThanksMarki

Hi, I keep receiving emails with this warning (about 300 a day).I checked but there is nothing out of the ordinary.Do you have experience on how to fix?The message satisfies the warning conditionVirus/worm detected: ; Protocol: IMAPS; E-mail address from: ************** ; E-mail address to: ************** t ; VIRUS REFERRAL URL:date=28-12-2022 time=09:55:53 devname=FG ************** devid=FGT *************** eventtime = 1672217753527378557 tz="+0100" logid="0203008200" type="utm" subtype="virus" eventtype="filetype-executable" level="warning" vd="root" policyid=17 poluuid="b6a200f8-826b- 51eb -3027-b96cfdbc33ef" policytype="policy" msg="The file is an executable." action="blocked" service="IMAPS" sessionsid=7101423 srcip=192.168.0.107 dstip=62.149.152.153 srcport=54463 dstport=993 srccountry="Reserved" dstcountry="Italy" srcintf="internal" srcintfrole="lan" dstintf ="wan1" dstintfrole="wan" srcuuid="dd5ff6ee-7d26-51ec-caf0-bb8630bb31c9"************* " a=" *********** ** @ *************

I have 2 internet connections configured in my Fortigate. One is WAN and the other is LAN via a 4G router. I have configured them as port 10 and port 9, and they both function fine. Now, I would like traffic to a specific website to use the 4G router (port 9) instead of the primary port 10. I've read that in order to do this, I need to have 2 static routes and then create a policy route. I've done that, but traffic is still going through port 10. I think it has something to do with my static route for port 9. I can't figure out the gateway address. It doesn't show in the 4G router either. For port 10, I selected "Automatic gateway retrieval" and because it is a PPPoE, the Gateway can be automatically found. But for port 9 since it's a 4G router and connected via a LAN cable, the gateway is still 0.0.0.0. I think that this is the cause. Any idea how else I can get the traffic to use port 9? I'm not looking for load balancing or failover. Just want a specific website to use the