Solved

Hi all,    Can i disable ipv6 on interface ? I have some log on the wan(PPPoE) interface. it's show descriptoin "RADVD Local AdvLinkMTU disagrees with remote site" Event message " our AdvlinkMTU on port xx doesn't agree with fe80::1".  i verify configure on the interface it's show - config ipv6 , -set ipv6-send-adv enable, - ip6-other-flage Information [FG1100E, 7.0.3] 

Good morning! Samething very strange. When I make an SSL VPN connection from my smartphone, with SSO enabled, the username changes to pinocchio, but all the logs in the fac and fortigate shows the correct user. I have tried with differents users. I think that is a forticlient issue. The linux forticlient version works ok.forticlient 7.0.6.0049 android app.Thank you!

I have configured DHCP scope in Fortinet firewall of range 10.108.120.100-10.108.122.254 /22 which can give nearly 1024 IP address.But.After DHCP scope leased 665 IP addresses,Scope is showing 100% and clients are not getting IP address. Could anyone help me out how to fix the issue.Need to get more IP addresses.Thanks

I was surprised when I noticed that there is no country connection source in the Authentication Error line! Having to wait extra time and inconvenience to connect. The Top Authentication Failure line is supposed to be the country connection column. Make it more useful to people. We are using the latest version of Fortigate 7.2.1, the Top Failed Authentication column No column Elementary, why no column?

Hi,I have a scenario and I'm looking for advice. I have 2 FortiGate configured Active-Passive FGCP.Each FortiGate has 3 active ports (e.g. port1, port2, port3). Those interfaces are monitored by HA.Let say, FortiGate-1 (priority 150) is the primary and FortiGate-2 (default priority) is the secondary. The override is enable. When port1 is disconnected in FortiGate-1, the FortiGate will failover to FortiGate-2. Now, the FortiGate-2 becomes the Primary.And then, suddenly the port2 in FortiGate-2 is also disconnected (while the port1 in FortiGate-1 still disconnected). In this situation, the FortiGate-2 doesn't failover to FortiGate-1, right?The port1 and port3 can be serving the traffic, but port2 can't because port2 is connected to FortiGate-1 (Secondary) only. Is there any suggestion for this scenario? ThanksArie

We have a problem with our LDAP connection from Fortigate to Microsoft AD.The connection was successfull, authentication against AD is still working.But on our DC's we have many Log Entries ( Microsoft Security Auditing ) that the connection from Forti were rejected.Did anyone have the same problem?

I would like to find the firmware upgrade logs of FG V6.4.10. Can anyone help me? FortiGate

Hi everybody,i tried a trial of #ForticlientEMS on premis to evaluate the product and then bought a license, but now that I really have to use it i have encountered several problems. I try to expose my questions, anyone who can help me even for just one of these I would be very grateful! :)1) Is there a way to understand from the telemetry if the Forticlient (7.0.7) is connected in VPN (IPSec or SSL) to the Fortigate? I currently use the server in standalone mode, so it doesn't interact with the Fortigate.2) I have set up a telemetry connection key on the server. I would like to create Forticlient installations that do not contain the key so that it is always to be entered manually after the first installation on the PC. When I create the installations I see the "Auto Registration" field enabled, but during the creation I am not asked if you want to enable this option or not.3) I have the server which is under NAT, so the ethernet interface has a private IP. This setting

Hi, We are currently in progress of enrolling several thousand of users to use FortiToken. Is there a way to extract a list of users with the token assigned and the status of the token? We need to be able to see user name, and if the assigned token was already activated. This is the bare minimum.  Is there a way to do this? Such built-in feature would be very useful when migrating large number of users. It would help to monitor the progress of the migration and remind the users with not activated tokens to perform actions. Thank you in advance.

Hi, everyone. I'm trying to set up RADIUS authentication for FortiClient VPN connections towards two windows domain controllers. I have two of them - the BDC is on premise and the PDC is in AWS (connected through a VPN tunnel). The connection towards the BDC is fine. This is the primary authentication server. When trying to test the connection from the Fortigate towards the AWS instance, I see that the connection is made from the tunnel interface IP. The connection fails, because I have not created any routing and security group inbound rules for the interface IPs in AWS. Is there any way to make the Fortigate make the RADIUS request from the LAN interface IP? That would make the rules much simpler. Regards,Chocolate Eater

Hello Team, Please is it possible fortimail accepts and sends mail from a sender with more than 1 SPF Record?   Regards,Firdausi Nababa

Two sites are connected to internet with Fortigate 100E. There is a vpn connection between them and the computer belongs to the same windows domain. There is a domain controller on site A and one on site B and both have FSSO Agent installed. On site A domain controller there are lots of error event related to Collector Agent checks on site B computers  . Instead of investigating the specific problem I'm wondering if I have a configuration issue. According to me collector agent on site A should check only computers on site A, not those in site B which are visible through vpn. I think that if I have 10 sites with lots of computers every agent should check only the computers in its lan, not all the remote ones. Are there some guidelines for the correct configuration in scenarios like this one ? 

Hi.  Please be gentle - just a preacher here.  We are updating our school church wifi and have FAP433s and 431s.  I need to mount one or other on a wall in the church sanctuary about 8 feet high cause it is the only space available.  I know nothing about the antenna'd 433's - how to point them or such.  Am I best going with one of them, though unsightly, to best cover the space rather than a down pointing 431.  Thanks for any guidance anyone can offer.

Hey everyone, First of all, we've search for our problem on the forum but even if there were posts about it, we couldn't find any solution. We're facing a problem right now regarding the VPN of our company. Our devices :- 2 x Fortigate 100F (HA) in HQ with 7.0.1 Firmware.- 1x FortiGate VM64-AZURE on Azure with 6.4.8 Firmware.- Forticlient VPN for remote users. At the moment we have SSL and IPSec remote connections to HQ for remote users and everything works fine.When we've added a platform on Azure Cloud as you can see on the topology below, we created an IPSec site to site VPN.  It's working fine for the users on the LAN and we've modified the firewall configuration for the SSL VPN so the remote users can access the Azure Cloud.The problem is that we don't know how to do the same with the IPSec remote users as when we configure the remote IPSec tunnel, we can't chose the VPN (Azure) interface, only local interfaces can be added.We've kind of replicated th

Hello, my friend.  We did the site to side between FG-100D(6.2.9) and FG-60F(6.2.9).The tunnel is up right now, but found lots of record about IPsec SA negotiate Events on 100D.I have disable the npu-offload on 60F, but the issues still happen, is there any other way we can do on it?Any help and advice would be much appreciated. VPN EVENT: dadate=2022-09-29 time=09:31:40 logid="0101037135" type="event" subtype="vpn" level="notice" vd="VDOM-Colo" eventtime=1664415100710345489 tz="+0800" logdesc="IPsec phase 2 SA deleted" msg="delete IPsec phase 2 SA" action="delete_ipsec_sa" remip=172.31.xx.xx locip=172.31.xx.xx remport=500 locport=500 outintf="port1" cookies="6a8ebfd24352f97c/a789ee80bedabfad" user="N/A" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="to-XXXXXXX" in_spi="14f35b6d" out_spi="ca30663d" date=2022-09-29 time=09:31:37 logid="0101037122" type="event" subtype="vpn" level="notice" vd="VDOM-Colo" eventtime=1664415097318

Could you please provide a document or some information related to the following:How does the HA traffic works when we have deploy the firewall cluster in Active/Standby mode with load balancing using Virtualized clustering in multi VDOM Environment.For Example ::Virtual Cluster 1VDOMA , VDOM B , VDOM C, rootVirtual Cluster 2VDOM D ,VDOM E , VDOM FAs the IP address is going to be the same , on what basis the traffic load balancing would take place.

 Hello, is it posible to connect Fortimail  to more than one LDAP domain?

Hello Community, I continue my research on advpn and bgp. I would like to enable ibgp multipath so I can add SDWAN rules and split traffic based on link health for branches.Before the multipath modification, the routes were well learned by my branches, when I activate either ISP on my HUB.But after applying multipath configuration in HUB and Branches. Only hub routes are visible in route table database for my branches. The route are received by the bgp protocol from neighbor. I can not use the new feature self-healing because i have 2 branches with 6.4 version. I have the same topology as multipath link, but with two tunnel for my branches.Source multipath : Multipath doc fortinet  Thanks for your help, you can found below config and info bgp. Julien>>>Config HUB bgp config router bgpset as 65505set router-id 1.1.1.1set ibgp-multipath enableset additional-path enableset additional-path-select 2config neighbor-groupedit "advpn"set capability-defaul

Hello everyone¡ I was looking at the FAP-U231F-E model and I have the following doubts: These APs are autonomous and can work without a controller or firewall? Without connection to a controller or the cloud, it can work doing UTM functions, could it continue to support MPSK without connection to the internet or the controller? In short, they are fully autonomous for UTM and MPSK functions? Regards

Hello @All, we have ssl-vpn with schedule active, but the schedule is not working.Our configuration for testing:and the schedule:  edit "tl-vpn-test" set start 06:00 set end 08:00 set day monday tuesday wednesday thursday friday next  For my understanding the login is possible from 06:00 to 08:00 (2 Hour) but the login is possible also at 10:00 o'clock.What I'm doing wrong? many thanks for helpingTBC

Hi, all. I'm new to Fortinet, having worked with other brands up til now. I'm trying to get a new FortiGate 101F up and running, and I am now configuring IPSec tunneling using the FortiClient. Is there a way to set access lists (network interface/subnets) based on user or user group? Can't seem to find any documentation on this, and unclear how this would be supported based on what I see when I configure the policy. Thanks,Chocolate Eater

I installed and configured EMS on Windows Server 2022, then on the same device I also installed Forti clientI connected Forti client to EMS, it received the security profile, but after 1 minute the status shows the message: Not reachableIf I disconnect Forti client from EMS, and try to reconnect, it works, but after 1 minute the message appears again: Not reachableI mention that I use EMS 7.0.1 build 0103 and Forti Client 7.0.1.0083

Hello Team, We have an environment with a FortiWiFi 40F. In this environment, we will install more than 15 FortiSwitches. As FGT 40F's datasheet, it only supports up to 8 Fortiswitches. Is there a way to manage that FortiSwitch by a remote FortiGate with Fortilink Layer 3? Basically, the 40F is in a branch office. This Branch Office is connected to the headquarters by a dedicated link, but, the dedicated link is terminated at a 3rd party firewall upstream the FGT. So, the topology looks like this: Branch FGT >> (Dedicated Link) >> 3rd Party FW >> HQ FGT If I configure the Fortilink Layer 3 in Fortiswitches, it can be work? In this case, how can I handle with VLANs? Can I create the vlans only in FGT 40F and passing it to the switches by a link aggregate interface, and just use the HQ FGT to manage the fswitches ports (assign vlans, configure trunks, etc)?

hello dears, kindly i need for your kind support if forticlient support or there is a feature work when forticlient for the user in the office automatically disabled and only working when the user will be out of the office to apply filtering security.

I have configured SAML SSO for management on the root Fortigate (200F, 7.2.1) with fortigate as SP and Azure as IdP and it works fine.  However, when I join downstream Fortigates (40F, 7.2.1) and leave the SSO as "Auto", it is stuck in "Pending" forever.  I am assuming that this is because the root is not acting as an IdP.  Wondering if it is possible for the root Fortigate to act as both SP (for azure) and IdP for downstream nodes.  Any help is appreciated.ThanksSV