Solved

Hi, FortiGate - 7.4.9Fortimanager Cloud - v7.4.8 I am configuring a FortiGate to use SD-WAN for connectivity to FortiManager Cloud and FortiGuard (plus more services once I have a confirmed config), and am hoping to get some feedback on the best way to configure this. I have set the configured central-management to use sdwan (following this page) config system central-management set interface-select-method sdwan All seems ok, however the Fortigate doesn't want to connect using the best connection. The firewall is connected to an FTTC and a 4G router. The FTTC connection has lower latency and jitter, but the firewall always seems to want to connect to FortiManager Cloud using the 4G. Note the 4G interface is DHCP and the FTTC is using a fixed IP.The default route on the Fortigate is pointing to the sdwan-zone as the interface.Other SDWAN rules seem to work fine. Whether I just leave the SDWAN rules blank and use the default 'sd-wan' rule or use a

 Hi all, In the process of setting up FAC Cloud with radsec and a fortigate firewall - we are seeing the traffic coming to the FAC from a different IP to what is our FWs public IP address - when setting our radius client, this took me a little while to find.  Can anyone advise what should be set under the client IP for radius, or how the traffic is handled please? 

hi all !i've a question :i've 2 FGT 200F cluster on different location connectet by several link that share the my own BGP pubblic IP access in VRRP.so every cluster have different phisical IP on WAN interface and a COMON VRRP Address that i use to terminate IPSEC VPN declaring the Local Gateway ip address.In case of Failiure of the Primary location the Ipsec VPN tunnel will be closed on the same VRRP address on other location.Is it possible to use same configuration for SSLVPN?In gui i have not found the possibility to specify the IP where the sslvpn listen to,but only The INTERFACE where the services in Listen on - there are some other workarround?I'm in 7.0.12 Nat modeThanks Alberto

Hello everyone, after updating the license for fortimanager in my testing environment, I found that fortigate couldn't connect to fortimanager. Despite entering the following command, I still couldn't connect. I hope to get your help. Thank you!fortimanager version: 7.2.8Fortigate version: 7.0.15config system central-managementset type fortimanagerset serial-number " FMG-VMTM25015787"set fmg "113.31.127.109"endexecute central-mgmt register-device FMG-VMTM25015787 123The following is the firewall debug informationfortigate_test_1 # diagnose debug application fgfmd<Integer> Debug level.fortigate_test_1 # diagnose debug application fgfmd -1Debug messages will be on for 30 minutes.fortigate_test_1 # diagnose debug enablefortigate_test_1 # FGFMs: set device as in_progressFGFMs: client:send:get authserialno=FGT40FTK2109BQ01mgmtid=1581151727platform=FortiGate-40Ffos_ver=700minor=0patch=15build=632branch=632maxvdom=10fg_ip=192.168.1.4hostname=fortigate_test_1harddisk=nobiover=05000021mgm

Hello, I installed FortiClient on MacOS 26.1 and after following the instruction from our IT, I am apparently connected to the VPN. Everything seems fine in the FortiClient window, showing it is "connected", but I have two problems: first in the Mac system setting, VPN & Filters, it shows VPN is "disconnected", second I lose the internet after connecting to the VPN. In the same system setting, under Filters & Proxies, I cannot add FortiClient to the list, while I can still see Cisco Secure. I checked some posts regarding  internet disconnection, but all are confusing to me and have not been helpful. I would be thankful if anyone would help to solve this issue.Thank you.    

Hi, is anyone else having a problem doing deep inspection using Google Chrome? Google Chrome version:  119.0.6045.160 (Versão oficial) 64 bits Fortigate 200F, 7.4.1.config sys globalset admin-https-ssl-versions tlsv1-2 tlsv1-3google same policy/ssl profile from prints below. same policy ID from above - EGDE    same policy ID from abobe - firefox   SSL Profile:   Do you guys have some advices?TY  

We are trying to authenticate a wireless client using EAP-TLS on a Meraki AP against a FortiAuthenticator (with RADIUS).The EAP-TLS is successful but the wireless client doesn´t receive a DHCP IP address, nor does it have network access. However, a wired EAP-TLS (computer authentication) request from the same client works flawlessly. Parts of the debug log show: (2794) facauth: ===>NAS IP:192.168.100.96 (2794) facauth: ===>Username:host/W10CLIENT.company.local (2794) facauth: ===>Timestamp:1707907999.157486, age:1ms (2794) facauth: Comparing client IP 192.168.100.96 with authclient Meraki-AP1 (192.168.100.96, 1 IPs) (2794) facauth: ------> matched! (2794) facauth: Found authclient from preloaded authclients list for 192.168.100.96: Meraki-AP1 (192.168.100.96) (2794) facauth: authclient_id:2 auth_type:'eap-tls' (2794) facauth: Found authpolicy 'EAPTLS' for client '192.168.100.96'<SNIP>(2794) facauth: Updated auth log 'host/W10CLIENT.company.local' for attempt

Hello team!! I need to know compatibility between FortiOS (Fortigate) and FortiClient, and between FortiClient and Client OS versions.For example, I need to know for an specific OS version (Windows, Linux, and Mac OS), which is the last FortiClient that supports this OS.  And also, I need to know, for this FortiClient Version, which is the last FortiOS supporting this.I found some old compatibility matrix, but this didnt help me.Which is the correct way to find out this?Do I need to read the release notes?  FortiOS or FortiClient release notes?In which section do I find the compatibility? Thanks in advance.Regards,Damián

Hello. We want to change our EMS-Server to be reachable from Public and not only from internal network. At the moment users connect to an internal FQDN-Name while on internal network or connected via VPN.  When changing the FQDN name of EMS-Server to a public reachable name, is this affecting the current connected users?  The current users are connected through an invitation code and registered via LDAP to EMS-Server. Do they need a new invitation code after changing the FQDN Name? Thank you. 

Hi everyone, How do I limit bandwidth on a policy in FortiGate 600E using a method that restricts bandwidth for specific IP addresses only?

Hi We are tying to setup the following: Autoconnect to IPsec VPN using Entra ID logon session information https://docs.fortinet.com/document/forticlient/7.2.3/ems-administration-guide/396545/autoconnect-to-ipsec-vpn-using-entra-id-logon-session-information We have the Client configured in EMS and able to connected to the IPSEC VPN, but how can you then control which logged in users have access via firewalls policies?  I was thinking about using usergroups on firewall policies but this just doesnt seem to work, does any one have any experience of restricting the FW policies based on which users are in which groups in Entra?? Many Thanks

I want to know how to block info.php or any other page through fortiweb. I created access rule and applied to web protection policy but does not seem to be working. Please see the screenshot below. Am I missing missing anything?  

FortiGate 7.4.3 using both VM and 60F platforms.I set up two tunnels in a zone with duplication=force outbound and de-duplication enable inbound. On the origination side, outbound packets are duplicated on both tunnels and are de-duplicated on receiving end. This works both ways. However, if I ping or try a TCP connection, the response packets sent from the other end are not duplicated.I ran the Debug Flow and it clearly states in the log if it is duplicating or not, and for established sessions for "return" traffic it always picks the input interface of the session to send the data to, and does not take the extra step to duplicate to the other zone member.Is this by design, a bug, or a configuration error? I scoured config flags to see what is related to duplication and found nothing there.

Hello team!!! My boss asked me to block Internet access for Firefox and Opera browsers in a Fortigate 60F :( with version 7.6.4In an application control, which is like the "default" (All categories as "Monitor"), I added an application override, to block the following apps:* HTTP.BROWSER_Opera* HTTP.BROWSER_Opera.Mini* Opera.Turbo* Opera.Update* Opera.VPN* Firefox.Update* HTTP.BROWSER_Firefox (All applications found with the words "Opera" and "Firefox")I applied the application control to a policy for the test machine, and when I tested, I still could use any browser.The policy has applied the default "certificate-inspection" profile as "SSL Inspection"Does this needs to use full inspection?Do you know why both browser are still working?Is there another way to block these browsers from the Fortigate? I know this is better to block the application from the computer or from a centralized solution, but I need to know if is this possible to accomplish this with the Fortigate

I set up a fairly simple guest network with one FG80F and two FAPs. Per company standards, I have to implement a Captive Portal. When I initially configured the SSID, it was "open" security mode with a "Disclaimer Only" CP, and it would redirect to the facilities website when you accepted the terms and conditions. I tested it myself when I was on site and it worked perfectly.  A week goes by and the site rep contacts me explaining that users can't connect to the internet. They get the splash page, click accept, and then nothing. He tested it himself and sent a pic of the result (see attached). I found that disabling the CP lets users connect just fine, which leads me to believe there's some issue with the redirect. I don't know why it would be working one day and stop the next. I've gone over my configs several times and nothing jumps out at me as a possible cause, but I'm still fairly new to Fortinet, so I must be missing something. Thoughts?     

Hi all,I'm currently updating my fortimanager configuration.The problem I'm struggling with is about dynamic addresses used in interfaces with a captive portal. I have many fortigates with a specific interface that handles guests access (through the captive portal) and I need to tell Fortimanager to insert in the exempt list different addresses. Using dynamic addresses mapped to single devices does not seem to work. When I'll try to install policy packages fortimanager ignores the mapped dynamic address (for different fortigate). Rizio

Hi Everyone, I'm trying to integrate fortinet firewalls v7.0.x, v7.2.x and 7.4.x with Fortimanager v7.4.8 and v7.4.7 but unfortunately unable to integrate to all in my gns3 lab however I was tried to do low encryption algo and ca cert and local cert according to fortimanager but no luck. Hence please help me out on it and share the steps to do the success lab. Thanks in advance 

Hi team, After upgrading our FortiGate to FortiOS 7.2.12, SSL VPN connections via FortiClient were consistently disconnecting at 40% during tunnel setup.This issue did not occur on 7.2.11. After downgrading to FortiOS 7.2.11, SSL VPN connections are now stable and working as expected.Could you help me troubleshoot this issue further to confirm root cause and ensure safe upgrade paths in the future?

Hi everyone,Great to be part of this community. I'm looking for technical guidance on a FortiMail mailbox licensing and RAV (Recipient Address Verification) issue.ScenarioWe have a FortiMail deployment licensed for 1200 mailboxes, but the system reports that the mailbox count has been exceeded.Observed behavior:Groups, distribution lists, and aliases are being counted as individual mailboxesRelay-only addresses (non-existent local mailboxes) are also counted due to RCPT TO verification is not rejecting invalid recipients, even though Recipient Address Verification is configured for SMTP Server VerificationNo Access Profiles are applied on policiesI found this community post discussing 'Recipient Address Verification' and 'Automatic Removal of Invalid Quarantine Accounts' for exceeding mailbox count: Link Environment DetailsDownstream mail systems: O365 and Zoho, ( Cloud Tenants ) Inbound mail flow:Internet → FortiMail → O365 → ZohoO365 is configured as an Internal RelayI

Hello,I am facing an error code to a random number of windows hosts (approximately 30/400 windows 11 home & windows 11 pro devices).The mentioned devices has recently appeared in the state " Running (OS settings outdated" and the error code is "OS settings outdated". I have tried to reload & uninstall and re install the collector with no luck. The collector version is 5.2.6.0065.Any ideas will be helpful in order to further troubleshoot the issue.BR

I want to capture the packets of network interface on Fortigate firewall. Still, I found the function packet capture missed(see photo below). How do I solve the problem? 

Hi there, how can I do the following to increase the security in using a PAM solution?Given is a web launcher target that is only accessable via FPA - so far, this is good. But I want to assure that the login at the target is only made possible via FPA proxy connection with specific credentials.Actually I can use the FPA web filler via browser addon on the target in the login mask - but (now that the connection to the target is possible due to the proxied way started from FortiPAM) I couls also enter any other credentials (as the first login attempt as well as after logging off after using the FPA credential way) ...So I think there is a gap because herewith it is not possible to assure that no other credentials will be tried out or any full superadmin / root access can be made via this connection.I searched for any options and tested with template modifications (web filler attributes) but did not get any successfull behaviour for this. Hoping that this is even possible in FortiPA

I've been reading fortigate secure sd-wan admin guide and other contents on overlays and they all or mostly recommend to use BGP as the routing protocol between sites. I only have 3 sites (hub and spokes) in same country communicating via an ipsec tunnel and I feel like BGP is for big companies with multiple sites accross the globe and does not apply to my case. I was inclined to use OSPF, and the tunnels will be in area O. What do you think? 

OS: LinuxKernel: 6.9.3FortiClient VPN Version: 7.4.0.1636I have been connecting to this network for months, this morning when trying to connect I had this on my console output Create VPN network interface failedNow the usual way of connection just does not work. Here are my log outputs:sslvpn.log 20240614 14:13:09.997 TZ=+0100 [sslvpn:INFO] main:1817 Init 20240614 14:13:09.000 TZ=+0100 [sslvpn:INFO] main:622 Load profile: eicon 20240614 14:13:09.002 TZ=+0100 [sslvpn:DEBG] main:631 Inherit local DNS: No 20240614 14:13:09.002 TZ=+0100 [sslvpn:DEBG] main:644 DNS service resetting interval: 0 20240614 14:13:09.002 TZ=+0100 [sslvpn:INFO] main:329 Get DBUS session bus address 20240614 14:13:10.004 TZ=+0100 [sslvpn:DEBG] main:333 Failed to find DBUS session bus address in dbus-daemon, try to find in dbus-broker 20240614 14:13:10.005 TZ=+0100 [sslvpn:DEBG] main:393 get passwd: true, get cert passwd: false, get user input: false 20240614 14:13:10.018 TZ=+0100 [sslvpn:INFO] main:329 Ge

We have multiple users reporting extreme slowness when opening files from a file server. This seems to have started when we upgraded FortiEDR to 5.2.8.41 last Wednesday. We were also upgraded to 7.2 backend this Sunday.  I ran some tests on my machine to rule out the network. With FortiEDR enabled on both my machine and the file server a 13 MB .pdf takes 10 seconds to open. When disabling FortiEDR on my (client) machine the time to open is only a second. We see similar behavior on other machines/file servers.  Anyone having similar issues?