Solved

Hi, all. I'm new to Fortinet, having worked with other brands up til now. I'm trying to get a new FortiGate 101F up and running, and I am now configuring IPSec tunneling using the FortiClient. Is there a way to set access lists (network interface/subnets) based on user or user group? Can't seem to find any documentation on this, and unclear how this would be supported based on what I see when I configure the policy. Thanks,Chocolate Eater

I installed and configured EMS on Windows Server 2022, then on the same device I also installed Forti clientI connected Forti client to EMS, it received the security profile, but after 1 minute the status shows the message: Not reachableIf I disconnect Forti client from EMS, and try to reconnect, it works, but after 1 minute the message appears again: Not reachableI mention that I use EMS 7.0.1 build 0103 and Forti Client 7.0.1.0083

Hello Team, We have an environment with a FortiWiFi 40F. In this environment, we will install more than 15 FortiSwitches. As FGT 40F's datasheet, it only supports up to 8 Fortiswitches. Is there a way to manage that FortiSwitch by a remote FortiGate with Fortilink Layer 3? Basically, the 40F is in a branch office. This Branch Office is connected to the headquarters by a dedicated link, but, the dedicated link is terminated at a 3rd party firewall upstream the FGT. So, the topology looks like this: Branch FGT >> (Dedicated Link) >> 3rd Party FW >> HQ FGT If I configure the Fortilink Layer 3 in Fortiswitches, it can be work? In this case, how can I handle with VLANs? Can I create the vlans only in FGT 40F and passing it to the switches by a link aggregate interface, and just use the HQ FGT to manage the fswitches ports (assign vlans, configure trunks, etc)?

hello dears, kindly i need for your kind support if forticlient support or there is a feature work when forticlient for the user in the office automatically disabled and only working when the user will be out of the office to apply filtering security.

I have configured SAML SSO for management on the root Fortigate (200F, 7.2.1) with fortigate as SP and Azure as IdP and it works fine.  However, when I join downstream Fortigates (40F, 7.2.1) and leave the SSO as "Auto", it is stuck in "Pending" forever.  I am assuming that this is because the root is not acting as an IdP.  Wondering if it is possible for the root Fortigate to act as both SP (for azure) and IdP for downstream nodes.  Any help is appreciated.ThanksSV 

I use VMWare Dashboard to check availability for the ESXi and VMs. What affects the color of the displayed graph? As an example of ESXi uptime? Is it related to CPU and memory utilization or some other factors? In the settings for each widget display, some elements are not clear. Does "Result Limit" means the number of elements or lines? What is Nested Time and how does it affect?How I rearrange the place of the displayed parameters on the dashboard?How to restore the dashboard default settings??

Friends,is it possible to use VRRP on two firewalls  (600D) with two redundant ports of the first firewall and two redundant port of the second (same group) ? or is there some constraints that the port should be single for different firewalls (same group) firewall A  port 1 and 2 redundantfirewall B port 1 and 2 redundant same VRID for both txt

Hello TogetherI am running a FortiWEB and Fortigate.Can it be a problem if I run the FortiWEB in the HA cluster and the Fortigate in the HA cluster with the same default group number?The FortiWEB is a VM.

Hi All,Forticlient EMS server detect Security Vulnerability CVE-2018-1285 for log4net on client's PC .How can i mitigate and solve this issue . Best regards

Hi,I have to Source NAT two  voip phones connected by a LAN (A_LAN) with a Fortinet 600D firewall port to speak with a Call Manager and viceversa. I have create a VIP definition and a policy for it. After NAT process the packets sent by phones will address some GRE tunnels. I would like to know if the syntax is ok or in the VIP definition I have to add "set nat-source-vip enable" in the VIP definition or further policies in the firewall policy or use IP pools ---------------VIP definition---------------    edit "A_VOIP_PHONE_1"        set uuid 329a7a02-a3db-51ea-a515-68fab7d1ce5f        set extip 10.1.180.171        set mappedip "10.18.1.171"        set extintf "any"    next    edit "A_VOIP_PHONE_2"        set uuid 329ad952-a3db-51ea-dea5-7de08db5ef41 &nb

In fortigate firewall, commands are pushed down automatically. (at least in GUI) Q1 Is there a way to "undo" changes you have done?Q2 Is there a way to see "changes" and then choose to "commit" them like cisco and palo alto? With regards to syncing HA,Q3 How do I check using cli why 2 members cannot sync?Q4 what are the command lines to break down as well as to force 2 members to sync?

Hello, I am configuring the SSL VPN on a FortiGate 100D running firmware 6.0.5. I have setup RADIUS auth because we are using Duo MFA. When I use the "Test User Credentials" option it's successful. Although, when I try to connect to the VPN, it fails. The logs on the FortiGate say "ssl-login-fail Reason: sslvpn_login_unknown_user". Up until recently, users were using local accounts on the firewall to connect to the VPN. I'm suspecting the FortiGate thinks my user is a local user and isn't finding it. The VPN setup has my new group using RADIUS listed and mapped to a portal, so I'm not sure what I'm doing wrong. Any suggestions?

Technical Tip: Fragment IP packet before IPsec enc... - Fortinet Community It seems the NP6 does not support pre-encapsulation and we need to turn off the NP by disable the auto-asic-offload in firewall policy. May I know if NP7 support pre-encapsulation or not?

On my FG100G I have created a local-in-policy with the command:config firewall local-in-policyedit 1Then I have entered just 'set' and hit enter to see a list of all commands but it did not show any command list.I entered 'show' and it shows the uuid.I configured the local-in-policy and when I enter show it shows the policy settings and the uuid.Do I have to remove the uuid or is this something I don't have to worry about? May thanks in advance  

Hi guys, i've a strange problem: when i'm connected through forticlient and try to login to my fortigate via the mgmt  address, i'm promped with an "authentication failure" error although the credentials are correct.When trying to access the same ip via the site2site tunnel it works, and even if i try to connect directly through the pubblic ip of the Fw i can access, the problem is only via the Forticlient (user and password i'm sure are correct).Do you have any tips or do you know is this happening?it only only happens with fortigate devices... Thanks in advance

Hi, guys,   Just would like to know, this snmp "HA Cluster Member 1 - Network Bandwidth Usage" or "HA Cluster Member 2 - Network Bandwidth Usage" for which part of the Fortigate HA cluster; as the attached ? 1. It should not be device interface traffic utilization2. It should not be device HA heartbeat interface traffic utilization So what does it mean "HA Cluster Member 1 - Network Bandwidth Usage" or "HA Cluster Member 2 - Network Bandwidth Usage" ? Thanks a lot 

I am moving the DHCP from the windows server to the Fortigate, and the existing DHCP exclusions are more that three subnets like 6 In the GUI configuration i can add only three exclusions, can i add more using the command like when i configure the DHCP or still limited to three ? Thanks

Good afternoon. I'm in need of ordering more tokens for our internal Fortiauthenticator environment and I was looking to order Mobile tokens since they are perpetual. I'm trying to determine, if I purchase and import mobile tokens into my internal fortiauthenticator environment, if I ever choose to move to "FortiCloud", will those mobile tokens be able to transfer to that? Also, is the FortiCloud option usable for the internal FAC agents I have installed on all my servers, workstations and network equipment? The reason I ask is because of remote workers. Right now, my remote workers are exempt users on their devices because offline tokens aren't suitable for long-term at home users. I could certainly expose my Fortiauthenticator to the internet, just not sure if I want to do that. Would I be able to specify and internal fortiauthenticator device and the cloud url to my clients so they could use either one depending on where their token is stored? Or is this solution just not that

is there any use case wherein I can integrate 2FA with ZTNA?Current setup we are using SSL VPN to access our internal resources such as RDP. SSL VPN users tied up to FToken.Now we want to explore how the ZTNA works. Cant figure out how to maintain 2FA without SSL VPN and through ZTNA my staff could access our internal resources.

Hello Guys,I deployed two SSID in  WPA2 Enterprise architecture with authentication on Windows Radius ( NPS ) as the link below and everything works ( https://docs.fortinet.com/document/fortiap/6.4.0/fortiwifi-and-fortiap-cookbook/414919/wifi-with-wsso-using-windows-nps-and-user-groups )To differentiate groups on Windows AD I followed this guide ( https://docs.fortinet.com/document/fortigate/7.2.0/administration-guide/710485/restricting-radius-user-groups-to-match-selective-users-on-the-radius-server )The FW sees the connected users as Wifi Single-Sign On  is it possible to group some account in different firewall policies ?I have tried creating Radius type users on the FGT but it does not work.Do you know if there is a way?  Thank you very much 

Hi together,is there any possibility (for example a parameter) to open FortiClient with another part of the user interface?At the moment it always open the "Zero Trust Telemetry", but for our employees I'd like to have the "Remote Access" active when opening FortiClient.

Hi, I need a simple way or at least the easiest way :) to find the details of configuration changes. Just knowing John changed this rule is not enough. I need details: John added this object to source, removed that destination, changed the protocol and so on. Any help would be appreciated. BTW, desired is to see this on memory and system events log not on syslog messages forwarded to a log server. Regards,

Hi All, i know enabling assymetric routing is a bad (bad) thing  :) but we are using an "old" fortinet to migrate between two firewalls. The only job it has to do is routing packet using policy routing to avoid assymmetric routing on the others two firewalls. Then we enabled assymmetric routing, but it applies only on TCP packets, not UDP. This his a problem with telephony.https://community.fortinet.com/t5/FortiGate/Technical-Note-How-the-FortiGate-behaves-when-asymmetric-routing/ta-p/198575 On this link they say we have to do a policy for UDP, but not which one. We are unable to find how to do. Any help is appreciated Thnaks a lot

Good afternoon everyone, I have a general question about FortiGate firewalls. Is there any latency difference on them in L3 and L2 modes? 

The remote office has Pfsence which is behind the router and has no public ip(wan interface) it's on local subnet of the router, FortiGate is direct with wan interface stati so how we can have IPSec in this scenario  kindly explain