Solved

The remote office has Pfsence which is behind the router and has no public ip(wan interface) it's on local subnet of the router, FortiGate is direct with wan interface stati so how we can have IPSec in this scenario  kindly explain 

Hi all, The FG 1000D is a 32 or 64 bits architecture? Where I can find the information about processor and or FortiOS operational system if is a 64 bits? Thanks

Hey,Thanks!

Hello,I am trying to set up Azure AD as remote authentication facility for Fortigate SSL VPN, im using fortigate v7.2.1 . As I try to configure SSO, I have to select the Azure certificate at "Identity Provider Details". I added the certificate as remote certificate through "System -> Certificates" before, however, it does not show up in the drop down menu.  any explain how to show it up ?thanks @fortigate @Anonymous  

Hello, just trying to understand the benefit of Graceful Restart when you already have BGP Holdtime.For example with BGP Holdtime (default 180 seconds) a BGP peer will not drop the connection until 180 seconds without an update from the other side.Then we have Graceful restart which enables a peer to advise the other peer that it will be down for 120 seconds (default) while it upgrades or fails over.I want to understand what the point of 'graceful restart' is, if the Holdtime will not drop the connection for a longer period anyway ?

HelloI am new to Fortinet and currently stuck on something very simple and would need some help.I am simply trying to enable port forwarding from the WAN interface to the LAN interface so that if a request comes in on a WAN interface on a particular port the request gets forwarded to the local device on the LAN. Have setup as below:The problem is when I try to access on the wan IP (192.168.70.34), I am not able to access the RDP server. Not sure what I am missing here but glad if someone can help on this.I have checked the guide on the below link but sthttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configuration/ta-p/198143 Thanks 

I have edit a configuration file for my fortinet 600D. He load and running correctly but when I visualize the firewall policy on the dashboard only few security policies has been updated . If i try to include manually the system said that the label of policy already exist. If i download the backup of configuration the number of policy are different from the policies visualized on the dashboard . This issue i have only for firewall policy all the other section are corrected interpretated.Any idea? any command to know if the input file has issues? I tried also with different editor but nothing  

Hi, i am currently looking into changing my Layer 3 Core switch and implement Layer 3 routing between vlans on the fortigate. The question is , can the fortigate support and handle the inter vlan routing in addition to internet traffic?we are trying to do accomplish network segmentation to provide extra security measures in our environment . It is much easier to implement policies on the Fortigate rather than ACLs on a layer 3 core switch Can the fortigate handle this ?  Thanks

Hello community, We have a FortiManager cluster on GCP (manual failover) and we have upgraded to 7.2.1.If anyone knows if vrrp automatic failover is supported on GCP? Thank you in advance

We have enabled configuration changes alert in out fortigate under Security Fabric->Automation->Configuration Change.Eg. the timestamp and email was sent out at 14 Sept 8.18am when no users login to the firewall to make changes. 

I am using Parallels RAS with FortiAuthenticator. Right now it shows 2FA for all the users who are imported into FortiAuthenticator but allow login to other users without 2FA. How to enforce 2FA for all users and deny if they are not imported into FortiAuthencator. I can't find any settings of Parallels side to restrict.

I am trialing FortiAuthenticator in our network which is behind Fortigate firewall. I can use FortiToken with 2FA and it works fine. I also tried push notification and it works too, however we have to open public ip:port to FortiAuth server to make the push notification working. Do we really need to open the port for the push notification to work. During test without opening the port the push notification shows up on the mobile but the approval/deny response does not reach to server.

(Using a 300E on FortiOS 7.0.6) When I try to use multiple ports in a FortiLink interface, switches do show up in an unauthorized state, but after authorizing the switches, only one of the switches are able to come online. Each switch is connected to a different port with in the FortiLink interface, and still only one comes online. As you can see below, I have "Split interface disabled" I believe this is correct.The switch that is online is in port 23. Why is this? If I enable "Split Interface" then I know only one of the 2 ports will work (the first one (left to right) listed). Is there a feature I have not enabled somewhere? 

We are using a SSL VPN with users authenticating against AD with LDAPS.  I have enabled the "Require client certificate" option in the VPN SSL Settings.  I have installed the root certificate from our internal CA on the Fortigate and have installed "Workstation Authentication" certificates from our internal CA on all of our client machines and checked the box to "Allow Non-Administrators to Use Machine Certificates" in the EMS deployed SSL VPN Client Profile.  This is all working perfectly and clients are able to connect successfully.  The issue I am having is that if I revoke one of the machine certificates from our internal CA, the machine can still connect successfully.  I would have expected a machine without a valid certificate from our CA to be denied. I have configured the CRL on the Fortigate to auto check the internal CA's CRL.  If I check the CRL on the Fortigate under System -> Certificates -> CRL, it shows that it is connected succes

Hi, I have imported a certificate in FMG, following these steps:  Inside one specific ADOM -> Objects Configuration > Dynamic Objects > Local Certificate > Create New > Enable Per-Device Mapping > Create New (new mapping) > Import Certificate. Now I can se the Dynamic Object created, and I can deleted it, but I cannot find the actual certificate in order to delete it, and I still have it available in the list when creating a new Dynamic Object Local Certificate. How can I find and delete the certificate? Thanks.

We use a website that authenticates user access based on our office public IP address.  I have a vpn user that needs access to this website.  How can I force access to this site for vpn users to reflect our public IP rather than their home IP?  We would like to keep using split tunnel for all other internet access.

facing an issue with one of the access switch is going offline again and again.  Fortigate as a controller running a on 6.4.9Core Switch 1048E running v 6.4.11Access Switch 124F running v6.4.11 Ntp is synced. only on switch 124F is having an issue. core switch connected as MCLAG Peers other access swi has below configuration config switch trunkedit "E48T0000000213-0"   ----->>>>> to another Core SW 1048Eset mode lacp-activeset auto-isl 1set mclag-icl enableset members "port45"nextedit "G6H00000000"  ------->>>  TO Fortigateset auto-isl 1set fortilink 1set mclag enableset members "port48"nextedit "4FF00000009417-0"  -------------->>>> Access Sw 124F connectedset mode lacp-activeset auto-isl 1set mclag enableset members "port2"next *************************************************** Troubled switch logs  connectivity        

Hello Everyone, I have installad the FSSO Agent and DC Agent in a Domain Controller following the guide below, except for the Working Mode in the DC Agent, where I have set the "Polling Mode" intead DC Agent Mode. After the configuration, I can see all the AD Groups in the Fortigate. So, I have add the group "Domain Users" in the rule to access the Internet, but when I did that all users have lost internet access. To test, I created a user group with the Firewall Type, mapping it with the Domain Users' group in the External Group option, selecting the configured LDAP Server. With this group in the policy, it works. Anyone knows why the group retrieved directly from the AD (FSSO Agent) didn't work, but the mapped local user group works? The working mode of the DC Agent I have set can be the problem?

Hi,I many users who are using FortiClient since we migrated to FortiGate 100F.One user has not been able to connect and he gets the following error message.I have tried his laptop and used my credentials and it works fine which means there is no problem on FortiClient side.I have done a reset of his password in DC. Still not working.Is there a way i can see what is happening when he is trying to connect like a debug or any lg I can check on my FortiGate 100F?Please see attached file.He has only to put his username and password. Thanks in advanceTazio 

Good morning, I'm trying to monitor my Fortigate 60D (v5.4.1,build5447 (GA)) using a monitoring tool that uses SNMP.I have enabled the LAN interface to allow SNMP Packets config system interface    edit "Transit"        set vdom "root"        set mode static        set dhcp-relay-service disable        set ip 10.0.0.2 255.255.255.252        set allowaccess ping https ssh snmp fgfm        set pptp-client disable        set arpforward enable        set broadcast-forward disable        set bfd global        set l2forward disable       &n

Good morning, My question is probably more of theory nature: Our customer is using Proxy IP telephony provider. For that we had to configure Custom Service to communicate with the provider. Recently our customer started receiving multiple spam calls directly to their softphones. Together with Fortigate support we found a misconfiguration in the Custom service /firewall policy pair and spam calls have stopped.  Before that, I could see a lot of connected sessions to the ports used by telephony service providers from the attacking IP's random ports. Now, I don't see those any more. BUT when I start a sniffer, I still see packets from same IP with SIP INVITES hitting my external interface: the output looks like this:  I am not good in interpreting the sniffer data yet so I am not sure of what I am I looking at. Since the Forti View session does not show any sessions established from these IP's, and there is nothing on the external ports from the sniffer data,

Hi, I have a FortiGate 60E and created a VPN using IPSec Wizard (Remote Access, Windows Native, L2TP/IPSec with Pre-shared Key). The incoming and outgoing policies have NAT enabled (Use Outgoing Interface Address). I am able to connect to VPN from home but when I try to connect a 2nd computer to VPN, it will either fail or kick the 1st computer from VPN. However, if I try to connect the 2 computers to different VPN destinations, there is no problem. So, this only happens when connecting both computers to the same VPN destination. May I know how can I troubleshoot this? Thanks

It started 24 hrs ago - I get this critical warning every 15 minutes... It appears that all customers with 7.2.0 or 7.2.1 firmware are getting the warning. Devices model are FG60F, FG60E and FG80F. Customers with 7.0.0 and 7.0.6 are fine.  

Hello, I am new to Fortinet and setting up a Fortinet firewall VM in EVE-NG. With below setup, I am not able to ping from INSIDE_R1 to OUTSIDE_R2. Topology:INSIDE_R1 --- (port 2)-Fortinet Firewall-(port 3) --- OUTSIDE_R210.0.0.2/24     10.0.0.1/24                    20.0.0.1/24        20.0.0.2/24 Fortinet VM: Version 7.2.0 with eval license Firewall policy is to allow All source coming into Port2 toward All destination and get out of Port3, for all services, all the time. NAT is also enabled to use the outgoing interface address. INSIDE_R1 has a default route pointing to firewall inside interface IP, 10.0.0.1. INSIDE_R1 can ping firewall's inside IP 10.0.0.1 and outside IP 20.0.0.2. Firewall can ping OUTSIDE_R2's IP of 20.0.0.2. However, INSIDE_R1 cannot ping OUTSIDE_R2's IP of 20.0.0.2. OUTSIDE_R2 does not get any packets from INSIDE_R1 based on its debug output

I have a Fortigate 100e, I was looking at the VPN log and saw some odd entries: date=2022-08-24 time=15:31:23 eventtime=1661380284231585110 tz="-0700" logid="0101040019" type="event" subtype="vpn" level="information" vd="root" logdesc="L2TP client disconnected" action="disconnect" status="success" msg="Client 154.89.5.116 control connection (id 1) finished" There's a bunch of entries that show this "disconnect"  but there are no messages saying there is a connection. such as "Action=Connect" or "msg=..Started" has anyone seen this before? does anyone know what this means (in big picture).  am I in danger?