Solved

I am looking for a best-practice and supported configuration for setting up two FortiGate 901G devices in an HA cluster and connecting them to a Cisco switch stack/cluster using LACP.Environment Details:FortiGate model: 901G (2 units)HA mode: Not decided yet (Active-Passive or Active-Active)Switching environment: Cisco switch stack / clustered switchesLink aggregation: LACP (802.3ad)Objective:High availability at the firewall levelRedundant and aggregated uplinks to the Cisco switch stackStable and supported HA + LACP designAvoid split-brain, MAC flapping, or failover issuesQuestions:What is the recommended Fortinet-supported topology for FortiGate 901G HA when using LACP to Cisco switch stacks?Should LACP be configured using a FortiGate aggregate interface, and should it be created before or after HA is enabled?Is Active-Passive HA preferred over Active-Active when using LACP with Cisco switch stacks?How should the Cisco side be configured (single port-channel across stack members, tr

Hello.I'm moving away from a HP switch (no cli access) and a Sonicwall firewall to the Fortigate side. I have a 91G and 2x148fpoe switches connected.  They are currently configured in Fortiilink and managed so all ports are being managed from the 91G. I have 2 Proxmox servers that I will be moving over to the new environment and am trying to understand how LACP/LAG works on the Fortigate.  It seems similar with Active/passive mode and 'bonding' 2/or more interfaces into the same LAG group so traffic can travel across both if/when needed. I'm trying to understand, and it seems like I would do the following:1. Open the fortiswitch ports tab2. Choose Trunk ports3. Give it a name and add ports either from the same switch, or specific ports on different switches.4. Set the mode to 'active' and hit 'ok'. If I'm thinking correctly then this would set up, say port 1 on sw1 with port2 on sw2, in a LAG/LACP group as active.  Correct? Is that all there is t

Hello team!! We have 2 Fortigates in 2 different sites: FGT80F in site1, and FGT40F in site2I had created a P2P IPsec VPN between both Fortigates some time ago (Connected through Internet)This VPN was working fine for more than 2 years until now.Recently I realliced that although the VPN was up, I couldnt access to anything in the other site through the VPN.  Both Fortigates have Firmware 7.6.4In "Dashboard -> Network -> IPsec", I used the "Bring down -> Entire tunnel" option to "restart" the VPN.After few seconds, the VPN was up again, and started to work (I started to reach anything in the other site through the VPN)After some time (less than 2 hours, IDK how much time exactly), happened the same issue and I "solved" this again by "restarting" again the IPsec VPN, using the "Bring down -> Entire tunnel" option. I cant see any related log.Do you have any suggestion to try to diagnose why did this happen?We didnt change anything recently. Thanks in

Dear Fortinet Support Team,We kindly request your assistance in reviewing the current “Phishing” classification applied to our domain horecathanglong.com .This domain belongs to Horeca Thang Long, a legitimate business operating in the commercial kitchen equipment sector in Vietnam. Our website contains no Phishing, or deceptive content, and we believe this classification is a false positive.We respectfully ask your team to re-evaluate the domain and update its status accordingly.Please let us know if any additional information is required from our side.Thank you for your attention and support.Best regards,Pham Van DoanhHoreca Thang Long CompanyAdd: B1.1-BT101-08, Thanh Ha B, Phu Lương Ward, Hanoi, Vietnam

Hello, I am trying to configure 802.1x authentication on FortiSwitch 148F (firmware 7.6.4) connected to a Fortigate-80F (firmware 7.4.9) using FortiLink but it looks like the FortiSwitch doesn't send any authentication requests to a FreeRADIUS server. I created a firewall policy using CLI as fortilink is not available in GUI, selected "fortilink" interface as source and enabled NAT, policy is also set to allow traffic.I configured RADIUS server on FortiGate, created User Group with RADIUS as a mameber and FortiGate is able to connect to a RADIUS server. Unfortunately when I assign security policy to a FortiSwitch port, the client is not authenticated because FortiSwitch does not send any packets.I thought maybe there is a problem with 802.1x supplicant, so I enabled MAB and still no packets going to RADIUS. I tried to run sniffer in CLI and it doesn't capture any packets.Diagnosed NTP and Fortigate and FortiSwitch say NTP is reachable.  I tested sync status and

Hi EMS adminsStarting from 7.4.4, in addition to the EMS binary installation method on Linux VM, Fortinet introduced a new installation mode which is VM image: a customized/hardened Linux with pre-installed EMS software, where we can't access the Linux shell, and only the new EMS shell is available.My questions are:As there are now 2 installation modes, is there one specific mode that is recommended?As this is the first release with the VM image install mode, is it recommended to install it in production? I mean is it enough stable? Will I find all the commands I need for all kinds of configuration and troubleshooting that I may need? E.g.: Can I check OS and DB log files? Can run tcpdump or similar sniffer command for traffic troubleshooting?I guess the standalone installation mode (with binary file) will be discontinued and the VM image install will be the unique available mode, right? So if I have now a standalone installation in my current prod and want to anticipate by moving to V

Hello everyone,I’m currently working with FortiGate and FortiWeb, I'm new to Fortinet, and I’m looking for a step-by-step PDF or guide that shows how to configure and set them up properly.If anyone has a detailed guide, tutorial, or official documentation in PDF format, I would really appreciate it if you could share it.Thank you very much for your help!

Hi , can someone pls advise whether can translate source port "Any" to a specific tcp port on fortinet central SNAT? thanks in advance ! 

We migrated from Forticlient 7.2.13 to 7.4.4. ESXi VM applianceWe backup our VMs with Veaam.We have the following settings for most backup jobs.But I'm getting the following error with the Forticlient EMS 7.4.4 server.If the "Enable application-aware processing" option is deselected, the backup completes successfully.Regarding Postgres, I thought it wise to check the "Enable application-aware processing" option.Is a VM backup without this option a reliable restore?

using Administration login via SAML, custom keycloak  serverconfig system saml set status enable set default-profile "no-permission" set entity-id "http://xxxxxx:8443/metadata/" set idp-entity-id "https://yyyyy/realms/realm_a" set idp-single-sign-on-url "https://yyyyy/realms/realm_a/protocol/saml" set idp-single-logout-url "https://yyyyy/realms/realm_a/protocol/saml" set idp-cert "keycloak-IDP" set server-address "xxxxxx:8443"endThis always worked, but suddenly fortigate introduced `http_authd` in 7.6.4 and since then SAML admin login is broken.just tested in 7.6.5 but same problem, had to downgrade to 7.6.3 which works fine, though it has a bug where SAML admin sso login session can't open the web terminal.

There is a vulnerability on 7.4.3 and the remediation is to upgrade to 7.4.4, however 7.4.4 does not include the free version.The release notes state that it does not include the free version as no feature updates were made between the versions but i've heard rumours that 7.4.3 will be the last free version ever.Will the 7.4.4 free version be released, or do those client need to be vulnerable until 7.4.5 is released and hope this includes the free version? Does anyone have any idea when this will be released?

Hello Bro,               I have new deployment that include 1801F appliance and my question is that :Does this appliance supports Cisco SFP "TenGig" tranceivers ? which part-IDs ? I have Few Cisco ones such as "Transceiver 10Gbase-SR PID: SFP-10G-SR-S" and I want to use if supported.TIA to you all.

Hi, FortiManager Cloud - v7.4.7 build6767 I am trying to configure DHCP on one of our FortiSwitch VLANs. The VLAN uses a variable. The basic VLAN itself is fine and has been applied to a switch template and pushed to our FortiGates. variable = branch_numberVLAN IP Address =  10.${branch_number}.20.1/255.255.255.0 When trying to enable the DHCP server on the VLAN, I am unable to even close the Edit VLAN Definition page on the GUI. It comes up with the error dhcp-server/ip-range: Invalid IP Range.  If I remove the variable, it does accept the config and let me click the OK button. Its the same if I set the Netmask to 'Same as Interface Netmask' Thanks in advance!

Hi,on Fortigate 1100e (7.4.9) we set up an SDWAN like this  We would OpenNMS pinging a public ip (8.8.8.8) through the line of ROUTER1 and another public IP (8.8.4.4) through the line of ROUTER2. So we set up these policy routes: SOURCE         DESTINATION      GATEWAYOPENNMS      8.8.8.8                  ROUTER1OPENNMS      8.8.4.4                  ROUTER2 In static routes we have:0.0.0.0/0      SDWAN In SDWAN policy we have the default (selected members by source IP) When both interfaces WAN1 and WAN2 are up all works, but:If we disable WAN2 interface both ping worksIf we disable WAN1 interface both ping not workswhen both interface are up, traceroute show that the routes are correct  (the ping towards 8.8.8.8 choose WAN1 , while the pings toward 8.8.4.4 choose WAN2) Any i

Hello, some of our MacOS users are experiencing issues accessing servers within the office network when connecting via VPN. The problem is that the network range in the office is the same as their home network, like 10.0.0.0/24.To ensure access to office servers on these users' MacOS devices, routing must be configured correctly, but the address assigned to the VPN client by FGT is dynamic from the specified range.Another issue is that users are authorized in FGT through their Entra ID accounts (SAML authentication with Entra ID is configured in FGT). It seems this article (https://community.fortinet.com/t5/FortiGate/Technical-Tip-Reserve-SSL-VPN-client-IP-addresses-without-an/ta-p/367799) is not applicable in this case, since the VPN portal only allows you to specify a local FGT user, either RADIUS or LDAP, but not a user authorized via SAML from the external cloud identity.Unfortunately, we are currently unable to change the address range of the office network or connect a third

Hi,I have 2 firewall rules, if the computer is in "open group", there is no problem, They are working with rule 94. But a computer that is not in the group cannot use rule 95. If I disable rule 94, everyone is working.I don't have this problem with my other firewalls.Thank you 1)edit 94set srcintf "CLIENT"set dstintf "virtual-wan-link"set action acceptset srcaddr "all"set dstaddr "all"set schedule "always"set service "ALL"set ssl-ssh-profile "no-inspection2"set logtraffic allset nat enableset groups "Open Group"nextend 2)edit 95set srcintf "CLIENT"set dstintf "virtual-wan-link"set action acceptset srcaddr "all"set dstaddr "all"set schedule "always"set service "ALL"set utm-status enableset ssl-ssh-profile "certificate-inspection"set av-profile "default"set webfilter-profile "default"set ips-sensor "default"set application-list "default"set logtraffic allset nat enable

Hi, can someone please let me know what the latest firmware version is for Fortigate60F? I have Version v7.0.13 build0566 (Mature)thank you!

Hello team!!! I have the following issue:We have many Fortigates in many different places, some Fortigates have a L2TP/IPsec VPN, which I can connect ussing the Windows native client, and anothers Fortigates have an IPsec VPN, which I can connect through FortiClient VPN.I have FortiClient VPN 7.4.3 in my Windows.When I restart my computer, I can connect to any VPN, but after connect and disconnect to any IPsec VPN with FortiClient, I cannot connect to any L2TP/IPsec VPN, until I restart the computer again.The same with 7.4.1A co-worker installed also 7.4.3 in his computer (Different computer and user, of course) and get the same issue.I cannot use 7.4.4 because we still have many IKEv1 IPsec VPNsIs there a way to workaround or solve this issue instead of restarting the computer?As this is happening in more than one computer, I think this is a bug in FC 7.4.1-7.4.3 Thanks in advance.Regards,Damián

Hello, Our FortiAuthenticator HTTPS certificate is close to expiring, and I would like to know what the impact would be if we continue using the expired certificate. Our FortiAuthenticator manages WiFi access and VPN MFA tokens. Thank you.

I have a problem when i try to up a IPSec VPN deployed from EMS Forticlient 7.4.4 on PC Core I3.I have 2 PCVPN Type: IPSec IKE V2 Deployed by EMS.i5 13420H 24GB RAM -> VPN get up easy and fast.I3 10110U 12GB RAM -> VPN Never get up.  The two PC have the same configuration de VPN IPSec. I Can't get log information because its empty, not save the IPSec VPN logs. 

Hi, I do have existing FortiGate HQ 7.4 and 7 remote branches 7.6, all configured and running. Recently, I added FortiManager to my environment. I added all Firewalls to the Manager with two ADOMs, one for 7.4 and another for 7.6. Now, I want to achieve centralized management for my Firewall. On each Firewall, I have almost 1,000 objects, 50 policies, SD-WAN, and VPN. I checked with ChatGPT to determine the best option for promoting the configuration from local on each firewall to be shared for all devices within the same ADOM. But I need to understand if that's double or there is anyone has faced the same scenario. thanks:keycap_1: Use “Bulk Move / Promote” in FortiManagerInstead of promoting objects one by one:Go to ADOM 7.6 → Policy & Objects → Addresses / Services / VIPsClick More → Bulk Move / PromoteSelect all objects you want to centralizeFilter by type (Address, Service, VIP)Filter by usage (used in multiple firewall packages)Choose Promote to

Hello, When trying to create in Fortigate an IPAM subnet with a Class C subnet (192.168.0.0/24), I received an error stating that the mask must be within the range 8–16. The document below also states that the IPAM pool subnet can only be a Class A or Class B subnet. I’m trying to understand the reason for this limitation, or whether I might be missing something, since our current subnet is Class C. https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/166728/configure-ipam-locally-on-the-fortigate

Hi Team Is there any way to find full list of FortiSASE POP IPs ? For check the latency before the deployment. Thank you. FortiCloud Products   

Hi, we set up an ADVPN Hub and Spoke network layout like this: Hub is Fortigate 3000F, Spoke is Fortigate 60F.We configured BGP on Hub and Spoke (on the IPSEC Tunnel)We noticed that "connected networks" of spoke are distributed correctly: 10.39.80.0/24 -> IPSEC TUNNEL but the static route (10.172.6.1/32 -> 10.39.80.2) is distributed with the wrong "next hop".  On the Hub we got:10.172.6.1/32 -> 10.39.80.2instead we would10.172.6.1/32 -> IPSEC TUNNEL Any hints? 

Hi,I'm having trouble with this setup with an IPsec setup: I'm trying to replicate what i had with ssl-vpn; multiple local user groups and the possibility to connect via phone.I could make it work with different users by using a tunnel for each group with a unique ID, the problem is when connecting via phone it doesn't work. I've read some documents that say to use IKEv1, other to use IKEv2, the problem is FortiClient mobile doesn't let me configure auth/enc on IKEv1. I also tried using eap settings but i get stuck in the login prompt, asking for the password on repeat, so i still couldn't connect with phone with any of the config i tried. Have anyone encountered this? or do you have any paper with the steps on how to make an IPsec tunnel work for both PC and mobile?Thanks,