Solved

Hi, guys, I am using Fortigate 400E with FortiOS v7.0.3;  A SDWAN configuration of 3 internet lines; lines information are the following:1.  line1 = 100.100.100.0/24 ; ( a VIP mapping - 100.100.100.10-NATed-10.16.6.35 )2. line2 = 111.111.111.0/24 ;  ( a VIP mapping - 111.111.111.11-NATed-10.16.6.35 )3. line3 = 222.222.222.0/24 ( a VIP mapping - 222.222.222.22-NATed-10.16.6.35 ) the SDWAN service for these 3 lines:  mode (load-balance, hash-mode=round-robin) A customer IP : 134.96.54.129  "session clashed" is found as the below: 1: date=2022-10-25 time=12:22:50 eventtime=1666671770025306040 tz="+0800" logid="0100020085" type="event" subtype="system" level="information" vd="root" logdesc="Session clashed" status="clash" proto=6 msg="session clash"new_status="state=00010200 tuple-num=2 policyid=85 dir=0 act=2 hook=0 134.96.54.129:29656->111.111.111.11:18889(10.16.6.35:18889) dir=1 act=1 hook=4 10.16.6.35:18889->134.96.54.12

Dear all I have some trouble when need to integrated Fortigate with Windows NPS based on this article : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-Radius-Single-Sign-On-using-NPS-2019/ta-p/200187 When I configure the accounting server and appear the error like this : FG200E-LDAP-MASTER (NPS) # config accounting-serverFG200E-LDAP-MASTER (accounting-server) # edit 1FG200E-LDAP-MASTER (1) # set status enableFG200E-LDAP-MASTER (1) # set server "192.168.100.250"FG200E-LDAP-MASTER (1) # set source-ip "192.168.100.252"FG200E-LDAP-MASTER (1) # set secret ENC Mhp123&Jaya321Failed to decode passwd.value parse error before 'Mhp123&Jaya321'Command fail. Return code -204 How we can use secret ENC, do we need decyrpt before use this command, if so. how to decrypted the password. Please let me know, if someone can help me. Best Regards,Heri #fortigate #RSSO 

Hi,We just replaced all our Meraki Firewalls with FortiGate 100F and we are very happy with the performance.Now we are planning to replace our on  prem Cisco phone system (CCM and UCS).I have contacted our sales person and was hoping to get some information about Forti Voice but he told me they don't do voice. I am just using google to gather some information.Can i get some information so that I can compare it with Cisco,Teams , Avaya and others.Can someone share experience of Forti Voice please.How complex is it to implement and integrate? ThanksTazio 

I have a cert for an SSL VPN in one VDOM and would like to copy it to another VDOM for a different SSL VPN. I need to keep both VPNs running for about a month. Is there a way to do this or do I just have to purchase a new cert?  Thanks!

Hi,Forticliente EMS 7.0.7 license ZTNA. Since yesterday I have this message in the dashboard but if I click on it no host appears.Another question: I have had ForticlientEMS for months but in the "FortiGuard Outbreak Detection" section I always see only these four signatures:SignaturesLOG: 2022-10-21 07:37:13 - Info -Update Service - No updates available -1 time since 2022-10-21 07:37:13

Hello , anyone help me. I have 2 internet line for using ISP1 speed 10Mbps & ISP2 10Mbps. So I want to combine ISP1+ISP2=20Mbps on fortinet 60F. Please kindly give me ideas & how to do?Thanks.Best regard, 

I have an issue with FortiClient VPN saying: "forticlient vpn unable to establish vpn connection. The vpn server may be unreachable(-6005)". I need to have this issue fixed as it is very urgent and I spent a week and a half trying to resolve it. Users who already have fortclient vpn installed as a licensed version, it is working for them but when they uninstalled and reinstalled it's not working for them.

I have 200E in my environment running on Forti OS version 7.0.2I also have Forti Analyzer running on 7.0.4.According to https://www.fortiguard.com/psirt/FG-IR-22-377 this KB. Forti OS 7.0.1 to 7.0.6 and 7.2.0-7.2.1 are affected versions.Does this vulnerability also affect Forti Analyzer? Please suggest

Hello,I am dealing with a issue when under "Forward logs" the user column shows out-of-date information about the current user. When looking at the forward log record there is a record showing "userA" but "userA" has not logged into the workstation. Also when looking at the security event then the user has not taken any action with the workstation. On the Fortigate unit there is configured an LDAP connection in order to get AD groups but no external connector for FSSO. Can someone please explain the behaviour behind this action and possible fixes to see up-to-date information about users, in the forward logs. Cheers!    

Fortigate 80F 6.4.10 single domain / 3 subnets / one DC per subnet.We have Security Fabric / External Connectors / AD Connector set up with 3 AD connectors, one for each DC.I see that there are Connector Objects for each AD Connector - we have made the all the same.  So, that's a lot of connector objects it might seem.  We want to have redundancy, thus 3 DCs.  So, it seems consistent for each AD connector to have all the Connector Objects.  Is that good practice?  Or should only one AD Connector be populated with Connector Objects? Also, we have added each and every AD User and we have added an AD Group with all the same users.  This seems appropriate.  Is it?In one AD Connector, we are unable to add those AD Groups - get an error that there are too many.....Thus this question.

I am a volunteer at a local tennis club that has a rather complicated rack system with a fortigate 60e. The system has several VLANS for the security cameras, guest wifi, etc. I have been tasked with switching everything from Verizon fiber to Spectrum fiber. The spectrum fiber has already been installed and I tested it with a laptop by manually entering the ip range, gateway etc and it works. Now I want to plug it into the fortigate 60e and unplug the Verizon.. To make things more complex, there is also a secondary backup ISP from Spectrum cable. That we also want to get rid of. I have experience with home routers but the fortigate 60e settings are rather complex. Is there a paid support we can buy that can walk me through everything I need to change? We tried contacting the original company who set it all up but they said they are too busy. Or should I just post screenshots of what I think I should do and go from there?

Hello Together, i would like to ask if the support for RPM packages has been suspended for the FortiVPN Client. I get an error if i try to download the RPM Client. Is this still possible to get it? Or are there any legacy clients for version 6.4.x ? I have attached the screenshots with the error. Thanks and best regards Egor  

Hi, I'm using DAC SFP+ 10G cables from fs.com, programmed as Fortinet.They are FINISAR modules, considered valid by the FortiGate 501E and FortiSwitch1048E.Both FGT and FSW are running 7.2.2 However, every 3 minutes, sharp, modules are reset 'to recover from error state'.Between reset, data flows correctly. Is there anything to be done to avoid these module reset ? Thanks,IG

I route all Internet traffic through an IPsec tunnel except the connection to the remote tunnel peer. I have been able to get SSL VPN connections, FTM acknowledgements, SNMP, etc. working in this way however since upgrading from 6.0.14 to 6.0.15 I have not been able to get FTM acknowledgements and SNMP working, although the SSL VPN connection itself does, and I cannot identify why. I do not see anything that has changed other than upgrading. I have validated the local traffic is hitting the implicit deny. fg90d $ di de flow filter addr 172.16.0.100 fg90d $ di de flow filter dport 161 fg90d $ di de flow trace start 1000 fg90d $ di de en fg90d $ id=20085 trace_id=103 func=print_pkt_detail line=5529 msg="vd-root received a packet(proto=17, 1.2.3.4:56936->172.16.0.100:161) from Reverse-Proxy. " id=20085 trace_id=103 func=init_ip_session_common line=5693 msg="allocate a new session-00000612" id=20085 trace_id=103 func=vf_ip4_route_input line=1604 msg="find a route

Good morning and thanks in advance.I have deployed a FM with v7.2.1 and two FG HA cluster with v7.0.2I added FG to FM with the Add Device wizard. All devices have been discovered and added, policies and objects sync'd ok with FM. When modifying rules on the FM the modifications are pushed OK to FGs.I also activated Fortianalyzer Features on FM and FG are sending logs OK to FM. Everything seems OK, BUT on both FG clusters, within Security Fabric > Fabric Connectors > FM Connection is shown in Red and "Not Managed" and the notification reads as: Unable to Connect to FM But when checking by CLI all the platforms, the FGFM tunnels are established and up:On FM:ES1FMG01BKT2 # diagnose fgfm session-listES1FW03BKT2_FG (260) sn(******************) ip(192.168.177.124)    <-- FG HA Cluster2state(tunnel) tunnel (169.254.0.2) uptime:Mon Oct 24 00:07:56 2022ES1FW03BKT1_FG (233) sn(******************) ip(192.168.177.140)    <-- FG HA Cluster1state(tunnel) tun

Hello Team,Please i need someone to help me resolve this issue as mail is bouncing back to sender and Saved message in /var/spool/dead/dead.letter 

Hello Dears I am trying to block some users to access internet using FSSO policy but it seems not working could anyone advise about that ? Bests

We have problem connecting to FortiAuthenticator (EAP-PEAP) using Active Directory.All setting is done, status connection to AD is joined and we can Syncronization the user from AD.But, when we try to join using Access point using MSCHAP v2, the login success and the certificate can see but after login, the dialog is back to login again. If we tested to login using application 3rd party "ntradping" using the same user and the respons is success / accept Log information is  Remote LDAP user authentication(mschap) with no token failed: invalid password.In the debug the information is :facauth: Remote ldap user 'misniru': NULL password is not allowed When we try to login using user local from FortiAuthenticator is running well. the problem is using Remote user Active Directory. If anybody here have a experience with this issue please help me. For the information, we using Mikrotik and TP-LINK as a Access Point  

Hi @ all,I have an Fortigate 7.2.2 in AWS with two VDOM. On for Management (root) and one for Traffic.The Traffic VDOM has two Interfacesinternal (10.1.1.1)external (10.2.2.2) with an Elastic IP 1.2.3.4Actually I'm trying to reach an Internal Instance via SSH. For this I want to use Port Forwarding on Port 222 on the Elastic IP Interface 1.2.3.4. (VIP 1.2.3.4 -> 10.1.1.100 : TCP 222 -> 22)Else I created an approbiate Firewallrule (any / VIP / 222 / allow)If I try to ssh to 1.2.3.4 then I got the following error: id=65308 trace_id=159 func=print_pkt_detail line=5892 msg="vd-aws-fw:0 received a packet(proto=6, x.x.x.x:52547->10.1.1.100:222) tun_id=0.0.0.0 from port2. flag [S], seq 3936964361, ack 0, win 64240"id=65308 trace_id=159 func=init_ip_session_common line=6073 msg="allocate a new session-000035cb, tun_id=0.0.0.0"id=65308 trace_id=159 func=vf_ip_route_input_common line=2605 msg="find a route: flag=80000000 gw-10.2.2.2 via aws-fw"id=65308 trace_id=159 func=fw_loc

Hi,Switch details as follows:Model: FortiSwitch-108E-POEFirmware version: v7.0.3,build0058Stand alone mode. We have a situation where an admin changed the password and has since left and is not contactable.I have tried pressing <space> during boot (no login prompt came up for me to use the maintainer account as with the Fortigates) and get presented with this menu: [G]: Get firmware image from TFTP server.[F]: Format boot device.[I]: Configuration and Information.[U]: Upgrade BIOS image.[R]: Reboot FortiSwitch.[Q]: Quit menu and continue to boot.[H]: Display this list of options. If I press [I] I get this menu[S]: Set serial port baudrate.[C]: Set DHCP Enabled.[E]: Set restricted mode.[T]: Set menu timeout.[P]: Ping an IP address.[R]: Reset environment to default.[U]: Upgrade component firmware.[I]: Display hardware information.[B]: Display boot information.[Q]: Quit this menu.[H]: Display this list of options Is there a way to change the admin password? 

Hi all,I've installed the last version of Forticlient (7.0.0.0018) on my Ubuntu virtual machine (version 20.04.3) I've setup a SSL VPN, but it's not working, I've receive two errors:[ul][sslvpn:EROR] vpn_connection:706 IO read remote failed: timeout[sslvpn:EROR] vpn_connection:1379 Error: Disconnected because of error: Read packet from tunnel[/ul]With the same credetials and settings I'm able to connect on a Windows machine Anyone have encountered these errors? How can I fix the connection? Thanks in advance,Jack

The "bandwidth-unit" option described in the KB below (also in CLI references) doesn't seem to exist at least on FG60E/60E-POE with 6.4.x while I can see this option on 1000D/1500D we have. Is this limited to some certain models?https://community.fortinet.com/t5/FortiGate/Technical-Tip-Traffic-shaper-and-bandwidth-unit-display/ta-p/195197 6.4.9 on 60E-POE:FortiGate-60E-POE (guarantee-100kbps) # getname : guarantee-100kbpsguaranteed-bandwidth: 100maximum-bandwidth : 1048576priority : highper-policy : enablediffserv : disableoverhead : 0 6.4.9 on 1000D:FGT1KDxxxxxxfg1 (guarantee-100kbps) # getname : guarantee-100kbpsguaranteed-bandwidth: 100maximum-bandwidth : 1048576bandwidth-unit : kbpspriority : highper-policy : enablediffserv : disableoverhead : 0Thanks,  Toshi

Dear all,I've recently imported three FortiGate v7.2.1 on dedicated ADOM on FortiManager v7.2.1.I follow this KB:       Technical Tip: Adding FortiGates to shared Policy ... - Fortinet Community FortiGate 1 is the member I started from to make the policy package.And all works fine, but when I try to deploy new policy there is an error in FortiManager  on FortiGate 2 and 3: FortiGate 2Post vdom failed: error :131 - datasrc invalid. object: user saml.ssl-azure-saml:idp-cert. detail: REMOTE_Cert_3. solution: data not exist FortiGate 3Post vdom failed: error :131 - datasrc invalid. object: user saml.ssl-azure-saml:idp-cert. detail: Remote_Cert_4. solution: data not exist It seems not to exist the Remote Certificate associated on SAML user account, but I see this certificate in FortiGate and in device DB on FortiManager.Unfortunately I noticed that it is not possible to make a dynamic object for this Remote Certificate object. I also noticed

Hi all,My first post here!I am trying to deploy FGT (V7.0.8) on two sites, each FGT with its own dedicated mgmt interface, and have HTTPS access over an IPSEC tunnel, diagram below:From the local site, each admin pc can access the local FGT web interface, the issue starts when the admin at pc A tries to access the FGT-B web interface tunnel and when the admin at pc B tries to access the FGT-A web interface. mgmt interface configuration of each FGT below:FGT-A: config system interface edit "mgmt" set vdom "root" set ip 10.206.250.2 255.255.255.0 set allowaccess ping https ssh fgfm fabric set type physical set dedicated-to management set snmp-index 2 set trust-ip-1 10.21.31.0 255.255.255.0 set trust-ip-2 10.11.32.0 255.255.255.0 next FGT-B: config system interface edit "mgmt" set vdom "root" set ip 10.205.250.2 255.255.255.0 set allowaccess ping https ssh fgfm fabric set type physical set dedicated-to management set snmp-index 2 set trust-ip-1 10.21.31.0 255.255.255.0

We are using a Fortigate 100F with firmware 7.2.2.  Is there a way to reset the hit counts for specific SD-WAN rules?  After some searching in the guides and the forum I found info to reset the hit counts for the policy rules but uptil now no luck in resetting the hit counts for the SD-WAN rules. Can some of the guru's here help me or point me in the right direction?  Thanks in advance