Solved

Hello guys! I already implemented a solution with FortiGate and LDAP (via LDAPS) in which it's possible for users to change the password with the SSL VPN Client if it is expired so I hope there is an FortiAuthenticator solution.config user ldap   edit <server_name>   set password-expiry-warning {disable | enable}   set password-renewal {disable | enable}   ...end I'm searching for a solution in which the same is possible but the FortiGate isn't connected to an LDAP server but instead to an FortiAuthenticator via RADIUS (dynamic FortiToken Mobile assigning) which gets the User Information from the LDAP server (via LDAPS). I only found the Self Service Portal which provides this feature but this doesn't meet the customer expectations. Do you have any experience with this? Thank you.

Hello Team, Is that possible to include a link aggregate interface as a member of hardware switch? I did this test with the Fortigate VM, but using the software switch instead, and I can insert the aggregate interface into it. My scenario is this: We'll need to implement two switches (from other vendor) doing an uplink with Fortigate. This two switches needs to connect to fortigate by PortChannel and we need to share the same vlans with all of it.So, by the test I have did, I know that by soft-switch it is possible, but my concern is about the CPU usage, so I need to know if is that possible using the hardware switch. Tks!

set up SSL deep inspection and now am able to find the viruses in https links too, but, while testing this with TekDefense.com (http://www.tekdefense.com/downloads/malware-samples/)some files are recognized nut some not. For instance: This one is recognized and blockedhttp://www.tekdefense.com/downloads/malware-samples/malz4.zip but these are downloaded and not blockedhttp://www.tekdefense.com/downloads/malware-samples/malz5.ziphttp://www.tekdefense.com/downloads/malware-samples/yitaly.exe.zip I'm using the firewall in proxy mode (provides Internet to users via web proxy) and the mail policy rule to provide internet is proxy based. Would you please give me hints what is the root cause? size of file? types of viruses? type of files or? Regards,Mohammad

We are using FAC for 2FA and we have configured our SMS gateway and also SMTP server to receive token codes on Email and SMS. Its working fine but the end user is receiving the token code along with username details. Our query is there any way to remove username details from token received on Email and SMS?We don't want username only token code is sufficient.We have checked admin guide of FAC but not found any such settings to remove username details. If anyone have any suggestions kindly assists!!! 

Hi all, We have a FortiGate 81f running FortiOS 7.0.5. We have Application Control running that blocks proxy and vpn, which we want. We do however have one internal device (static IP) that we need to connect via vpn to an external ip.  We also have another internal device that requires connection to an external proxy. What is the best way to allow an internal ip to use vpn or proxy to contact an external ip? Custom IPS signature? thanks jc

Hello,Fortiweb offers the option to change password before logging in. If this option is used and the password change fails, where do I see the details?The login and therefore also a possible password change is done against a MS-AD.The user gets as error message "Failed to change password", but in the logs no reason can be seen.Unfortunately, the details under Log&Report / Traffic do not provide any clues for error analysis. Many thanksTBC

Hello everyoneI have the following problemOn page A I have a Foritgate with incoming traffic.Now the problem is the SRV's are on Fortigate side B.There is another IPSEC tunnel between the two Fortigates.How exactly do I have to configure the VIP there.Many thanks for your help

Can someone please help me get IPv6 configured?I'm on Xfinity and previously had OpenWRT configured with ::/60 prefix but having difficult time with 80F running 7.2.0 getting IPv6 addressNo matter what I do, the GUI does not record DHCPv6 prefix hint.What am I missing? config system interface edit "wan1" set vdom "root" set mode dhcp set allowaccess https set ident-accept enable set type physical set role wan set snmp-index 1 config ipv6 set ip6-mode dhcp set dhcp6-prefix-delegation enable set ip6-dns-server-override disable config dhcp6-iapd-list edit 5 set prefix-hint ::/56 next end end set dns-server-override disable next end(ipv6) # get ip6-mode : dhcp nd-mode : basic ip6-address : 2001:558:6030:7a:ccb4:xxxx:xxxx:xxxx/128 ip6-allowaccess : icm

Hi, I need to use someone to update signatures on Fortigate firewalls and not willing to give him super admin admin account. Is there any way to create an account with the minimum permissions just to be able to use execute restore ... command and update the firewall? Regards,  

Can somebody share a real scenario of load balancer configuration with couple of servers attached to it and spcify the traffic that comes from WAN to LAN with all the IP addresses. Thanking in advance !Nabi

Hi Community, can someone explain the meaning of "ret-no-match" in a debug flow on a FGT?As an example debug line see the following:"2022-07-01 09:04:45 id=20085 trace_id=32985 func=__iprope_check_one_policy line=1951 msg="checked gnum-4e20 policy-6, ret-no-match, act-accept"" I understand the line itself but not the meaning of "ret-no-match". Thanks a lot. Kind regardsDominik

Hi, Does the FortiGate and FortiManager support sending SNMPv3 INFORMs? If so does anyone have a guide please. Many thanks. Paul.

Does anyone have any suggestions on how to use Ansible to get around the admin initial password change of a brand new FortiGate? We stage dozens of FortiGates a quarter in an isolated manner.  Having to manually enter in the admin password first doesn't truly make this approach "zero-touch".  We've been searching and trying with Ansible, but I'm missing something? Thanks in advance for any help you can provide!  

Hello Fortigate team, I have a query, is it possible to perform a direct update of the Fortigate ios version in case the team is new without configuration. FortiGate 

Hi I've updated my Home office User from FortiClient 6.0.9 to 7.0.3 manually.With 6.0.9 We've a tool to modify the installer to VPN only.With 7.0.3 I download FortiClientVPNSetup_7.0.3.0193_x64.exe.But Now I see in the console that the FortiClient try to Update something every dayBut my user has no right to update something so it fails everyday.Is there an option to block the forticlient to call to the cloud?Thanks for any hint  

Hello,  I have a question. FortiGate is communicating with Forti Servers to determine the web category. When that communication is disrupted, the firewall stops accepting traffic. Is there a way to overcome this? Thanks and regards, Konstantinos

Hi, following constellation: We have a FortiGate 100E running here. I created a CSR on it to have that signed by our internal CA. I then imported the certificicate to the fortigate which all worked fine. I selected it for to use it for https and that works fine so far. It does do https with that cert and I do not get any more Browser warning (since all our clients know our CA).However the FGT denies me to select that cert for use with SSL Inspection. I can onyl choose the FortiNet built in one here and none of the others installed.Does anyone have a tip why that is? FGT runs FortiOS 5.4.x and our CA runs on Wind*ws btw.FGT is not part of a HA Cluster, a FortiManager or a Fabric..just standalone. CheersSebastian

Hello all I have recently inherited a network of Fortinet gear.  It was mostly setup reasonably well, but there were a number of issues.  It consists of 2 60F which are setup in HA.  3 FortiSwitch 248E-FPOE, and 6 Forti AP 221E.  I have managed to work out most of what needed to be done.  However one odd thing lingers. I have all my FortiSwitch online and accessible through FortiLink, as well as Forti AP managed.  The FortiLink address is 10.109.92.1, and my FortiSwitch are 10.109.92.2/3/4.  From any Fortiswitch I can ping and access the other (for instance from 10.109.92.2 I can SSH to one of the other FortiSwitch at 10.109.2.3).  However I cannot from any switch ping the FortiLink interface of 10.109.92.1, nor from the GUI can I access any Fortiswitch via CLI.  My only option right now to access the Fortiswitch directly if I wanted to is to use a console cable. One challenge I faced was that when I was given this setup the F

I was gifted this awesome device, but now I need to set it up.Where should I start? I currently have an all-in-one cable/modem+wifi/router.Looks like I need to separate them.. this will be for my home/network/lab. I found the "Quick Start" Guide, but I need more helpHow do I get started?Where do you plug the Cable/Modem?Where do you plug the Wireless router?Do I need a 'compatible' kind of wireless router?

Hi Team,We are seeing a strange issue with our FortiAnalyzer which is related to the radius authentication. We have configured Cisco ISE  as a radius authentication server. ISE IP and all other parameters are configured on the Fortianalyzer however authentication is not working.  We have captured the sniffer traffic but do not see any traffic leaving the device. Please advise what could be the issue? Is there any way to restart auth daemon/radius service? We have already rebooted the Fortianalyzer.           FAZ01 # diagnose sniffer packet any "host x.x.x.x" 4 ainterfaces=[any]filters=[host x.x.x.x]^CPlease find the snap for reference.

Hi, I just upgraded to Catalina on my Mac today and whilst the VPN client connects and notifies me of this I can't connect to anything on my network. No pings, SSH, RDP even HTTP work intranet. I was using the VPN this morning successfully on Mojave (10.14) and other users are connected to the VPN so that end is fine. I am using 2FA with Fortitokens and I do get challenged for the token and this appears to be accepted successfully.Forticlient VPN version is 6.2.1.654, I can't find anything newer. Any ideas?

Hello!I have FortiGate-60E Low-Encryptionhttps://kb.fortinet.com/kb/documentLink.do?externalID=FD37333 I have error:This site can’t provide a secure connectionfortigate.local uses an unsupported protocol.ERR_SSL_VERSION_OR_CIPHER_MISMATCH Hide details Unsupported protocol The client and server don't support a common SSL protocol version or cipher suite.       I saw https://forum.fortinet.com/tm.aspx?m=104586 Is FortiGate-60E Low-Encryption support https WebGUI?

In my FortiGate cloud account when choose to manage my Fortigate in Security Fabric tab I get notification: "Current Firmware Version: v6.4.9, build 1966Device config version v6.2.5, build 1142 (6.2.0 - 6.2.10 compatible) does not match device firmware version v6.4.9, build 1966.You can sync by clicking the Import button if changing device firmware version is not preferred." I make update couple of days ago from 6.4.8 to 6.4.9 but we are not on v6.2.5 for ages, so why it showing this device config version 6.2.5?Should I press IMPORT?It will update FortiGate cloud?It will not have any impact on my working production FortiGate? 

ToIP traffic that is already marked with a DSCP (EF) value will pass through my firewall. I need the firewall to keep that value and not modify it. That keep the same input value as output. On the other hand, I also need you to prioritize it internally. If I don't do any configuration and just let traffic through, I'm not sure if the firewall keeps the value or resets it to zero. Can you help me? "If the differentiated services feature is not enabled, the FortiGate unit treats traffic as if the DSCP value is set to the default (00), and will not change IP packets’ DSCP field."Thank you very much

Hi,in the config router multicast-flow source address field is mandatory? I wish to create static IGMP groups only based on destination multicast addresses and not on source addresses.