Solved

Hello everyone,I'm trying to set up FSSO on AzureVDI. We have a FortiVM in Azure, a Win2019 DC, currently one VDI Server running Windows 10. I have installed the Collector and DC Agent on the DC and the TSAgent on the VDI Server. The connector on the FortiGate is working and I can select LDAP Users/Groups. My issue is that users connecting on the VDI server are not being pushed to the collector; instead, my logins on Azure seen by the DC Agent and because of that, if an admin logs onto the VDI Server, all other users then have internet access.  Sessions on the TSAgent are being logged and assigned port ranges but they simply don't appear to be visible under "Show Logon Users" on the collector. I've specified the VDI server in the "Citrix/Terminal Server" in the collector and on the TSagent, I don't see any connection failure to the collector. Any help would be greatly appreciated. Kind regards,Renato

Hello, we did setup a port forward from wan to a internal server. This works. Now we want to only allow access for iPad and iPhones over the external wan to the internal ip. Is ist possible to set this up? Regards Jens

Hello, for remote backup reasons I need to get a Seagte ReadyNAS 516 with Firmware 6.9.4 running. On the NAS I created users, shares and the needed applications (rsync, smb, http/webdav, ftp). On our FortiGate 100D (WAN DOWN 100MB/s UP 100MB/s) with Firmware 5.6.3 build 1547 I connected the NAS to a separate interface (role LAN) and set up a VIP with the required ports.   MTU is set to 1500 on both sides. File copy from my laptop over LAN works with 95MB/s (1GB/s connection). Copy files from remote locations via smb or ftp does not go higher than 512/600k (10MB/s or 5MB/s upload connection possible). Any idea what configuration mistake I made on the FG100D? Kind regardsJay

Hi all, when an ssl client is connected it can ping a host on the lan, but not vice versa. The same problem is between two connected SSL clients. The strange thing is that, on the contrary, the VNC (like access to remote desktop) works correctly. I made all the correct policies. You can help me? Firmware 6.4.8 and SD-WAN configured.I have some doubts about the Portal, you know that activating the spli-tunnel even if you do not declare the lan to reach, you can do it in the policy, and so I did. Thank you

Hello bro,I have hundreds of Fortigates to version 6.4.8, in recent weeks I have always waited to bring them to 7.x (in particular to the latest 7.0.5). What do you advise me not having, at the moment, particular problems?I only brought the Fortianalyzer to 7.x and I must say that it works very well and has solved some "reports" problems that were sometimes completely empty, without any data. Thank you all.

Hi, We have a FortiAnalyzer VM deployed on ESXi last year at our customer's place. Everything was working fine but since a week we were not able to see any logs on "Log View". When we checked the dashboard, we can see that the FortiAnalyzer is receiving logs from the FortiGate but it is not Inserting them into the database. The logs are still present in Log Browse (Compressed). FortiAnalyzer is in Analyzer mode and not Collector mode. How do we fix this ?   Thank you. FortiAnalyzer FortiGate 

Hello, I have an incoming route-map applying a MED metric of 10 to a received default route.I can see this metric of 10 showing in the route table so confirms it works. However, I am also receiving another default route from another BGP peer with a MED metric of 1.I can see this route coming in, however it is not replacing the existing default route with metric 10. I thought lowest metric wins. How come the new, lower metric default route is not taking over from the existing one ? Thanks for any help.

I am having trouble when try to reach a server which is used as a NAT with virtual IP address from the VLAN20. Please could you give me some idea what's holding vlan20 to reach that server? Debug flow : id=20085 trace_id=885 func=print_pkt_detail line=5665 msg="vd-root:0 received a packet(proto=6, 192.168.2.3:61108->10.10.10.2:443) from ENKA SITE. flag [S], seq 3245614174, ack 0, win 64240"id=20085 trace_id=885 func=init_ip_session_common line=5836 msg="allocate a new session-00c7d9b0"id=20085 trace_id=885 func=_pre_route_auth line=106 msg="pre_route_auth check fail(id=0), drop"   My topology is here: Vlan10 - 192.168.1.0/24Vlan20 - 192.168.2.0/24 WAN1 : 10.10.10.2/24WAN2 : 20.20.20.2/24 STATIC ROUTE : WAN1 - 10.10.10.1 - Priority 0STATIC ROUTE : WAN2 - 20.20.20.1 - Priority 5 Policy Route : Incoming interface: VLAN20 - Source: 192.168.2.0/24 - Destination : 0.0.0.0/0.0.0.0 - Action: Forward Traffic - Outgoing interface: WAN2 - Gateway: 2

hello we switched from the version 5.6old to v6.4 ,now using fortigate 1000d v6.4 cannot find source devices/devices for SSid so i can add the devices in the source like we can add in the old version 5.6..in order to restrict devices by mac-id. Thank you

Hello friends, I have the two following questions. Perhaps you can help me :-). 1. Is it possivle to configure a specific dns-server for a specific internal domain? I need it to resolve internal FQDNs like abcde.internal-domain.comby a dns-server I would like to speficy. The FortiGate-firewall should then pass the dns-requestsfor this domain (for example abcde.internal-domain.com) to the dns-server which is resposiblefor this domain. For external FQDNs (for example www.google.de) the dns-servers under "Network" --> "DNS Servers" should be used (for example 8.8.8.8 or 1.1.1.1). 2. Is it possible to configure one side of an ipsec-site2site-tunnel (Fortigate-firewall on bith sides)as "passive" and the other side as "active"? The goal is to establish an ipsec-tunnel where one side is connected to an lte-connection (mobile network) and the other side is connected to a dsl-connection (static ip address on wan-interface). The Fortigate-firewall on the lte-side shou

hi fortinet community, i almost done setup fortimanager 7.0 in my internal network. rules to connecting the internet using a proxy. My problem is I wanna login fortimanager with forticloud account to activate trial license, but got error "timeout". I already done setup "config fmupdate av-ips web-proxy & config fmupdate web-spam web-proxy" but still same got error "timeout". do you have a suggestion bro ? Thanks FortiManager FortiCloud Products

Brand new FortiGate 60F. For some reason, instead of a Hardware Switch it has a VLAN Switch (Network >> Interfaces). I'd much rather have it have a Hardware Switch, like the other FortiGate Firewalls we administer, but how do I change it/delete it? I've tried factoryreset and factoryreset2, but it has survived :( So how do I delete the VLAN Switch, change it to a Hardware Switch? I'm ready to wipe the configuration and start from scratch. The FortiGate is running FortiOS 6.4.8. Thanks!

Helloi try to setup automatic backup over automation.I use the cli command:execute backup full-config ftp /Netdevice-BCK/BU-FWZ/BU-FWZ-test.cfg server user passwordExecuted in cli, it works fine. When i try to start the command as automation stitch, the backup is not uploaded to the ftp server.What am i missing?RegardsMario-> Debug output when testing automation stitch: 0: config global0: config system auto-script0: edit "autod.858"0: set script "execute backup full-config ftp /Netdevice-BCK/BU-FWZ/BU-FWZ-test.cfg server user password"0: end0: end-1: execute backup full-config ftp /Netdevice-BCK/BU-FWZ/BU-FWZ-test.cfg server user password

Hello Guys I have this Fortinet configuration with HA active-passive mode, and an aggregate was configured with port3 and port4 on the fortinet side and in each Mellanox Switch that is in mlag mode (VPC in Cisco), an 802.3ad LACP with two ports was created (swp41,swp42) with a clag id. The LACP on the Switch side always shows up, but on the fortinet side, it always shows us down the lacp in the Passive Firewall when I run a diag net aggr name Lacp_Spine the status is down, but the active one is always up. I would like to ask you for help if this behavior is normal, where the passive always looks down. Thanks 

I already connect SNMP with PRTG and shown the data on their dashboard such as bandwith and port status (UP / Down).But in System Event still have message "SNMP failed to match community" The question is, how can delete that message cause every hour always shown that. Thank you for your attention 

Hello... I have a FortiGate 600E device... In the current design there is one internal interface that connects all internal vlans to the firewall:(10 users vlans, 1 guests WIFI vlan, 1 Servers Farm vlan)... This connection comes directly from a Cisco Nexus 9396 switch which is the default gateway for all of the vlans. Now I want to separate these vlans from each others in order to set policies between the users' vlans, WIFI vlan and server farm vlan...  What I know is that I have to setup the vlans in the internal connection of FortiGate device and make it the default gateway for them instead of the Nexus switch.. Is this the right way??And can the FortiGate 600E handle the routing instead of the Cisco Nexus device?? Any advice will be appreciated 

Hello Expert, Yesterday  i  factory reset my 524D switch.I connect the cable from laptop to the management port on the switch but was not able to login in.Upon troubleshoot I realize I  cannot  ping the interface.  The only access I have to the switch is via command line. I humbly request some guidance to enable access via the management port using the default ip (192.168.1.99) Thank youRegards

HIWe've just had our MC4200 RMA'd The new one is up and running but out of 68 APs it can only talk to two.None of the others can be pinged from the controller. They can ALL be pinged from my computer. My computer can also ping the controller and the controller can ping my computer.All the APs are on the same subnet as the controller. I can't think of any reason why the controller cannot talk to them when a computer on a different subnet can.We also have a box called an SA250 sitting under the MC4200. I have no idea what it is or what it does and I have never connected to it. I tried to get to it's web interface today (assuming it has one) and that does not work. It is also on the same subnet as the APs and the controller but the controller CAN ping this box.Since the replacement MC4200 was installed all the POE switches onsite have been rebooted which should have rebooted all the APs. I have also turned off and on one of the switch ports connected to one of the APs and watched the ping

we just bought a fortiweb and in my network, most of our servers dont use http and https ports but instead they use ports like udp and tcp 3500  , 3501 and so on. My question is the following: is fortiweb used to protect servers that don't use HTTP or HTTPS? like how described in my environment? or it is exclusively used for http and https access? because the idea to place all my services that use tcp and udp ports behind a fortiweb? because when im checking config guides on fortiweb it shows the policy configuration is always showing a http and https profiles, while many of my servers don't use http and https and use other ports for other applications like GPS and so on

Hi,I have a FortiGate 100F with a LAN interface (10.1.10.1) that uses the local Captive Portal to authenticate users to Azure AD using SAML 2.0 SSO.I also have a Wi-Fi Interface (10.1.40.1) that uses the local Captive Portal to authenticate guest users with temporary accounts created in ‘User & Authentication -> Guest Management’.The Captive Portal FQDN is -  captive.local.acme.co.ukI have setup the FortiGate DNS Server database, created a local.acme.co.uk zone and created two DNS A records for the Captive Portal for this FQDN.Captive -> 10.1.10.1Captive -> 10.1.40.1All appeared to work OK for a few days, but now the DNS resolution is selecting the wrong A record, e.g. 10.1.40.1 is being resolved when trying to connect to the Captive Portal from the LAN interface.Is there any way to force the correct FQDN to IP Address resolution? Or an alternative way of achieving Azure AD firewall authentication and Guest Wi-Fi on the same FortiGate?Thanks!

Has anyone been able to get a phone like this registered to a Fortivoice 40?  Also, same with a Grandstream gxp1630.  I am not able to register either.  Any help is appreciated..

i have made a vlan(192.168.2.1/24) for may APs under my lan switch(192.168.1.1/24)...my problem is im not able to allow or gave the vlan internet access even do i have made policy wifi vlan -> sdwani am able to ping lan address via the ap with a policy wifi vlan -> lan and lan -> wifi lanmy ap config is that all user connected to ap will be in the vlan. the AP im using is tplink eap320 and engenius ews300ap am i missing something in my configuration fg201ev7.0.5 

I'm in the process of converting a Linux firewall at the office which had evolved over many years to a Fortigate setup. I've used Fortigate for our hosting environment for a couple of years, so I'd not quite the newbie... One thing we currently have set up is that incoming SSH connections get forwarded to an internal jump host, with the exception of incoming SSH connections from one particular IP address. I had expected that I could create a VIP address with a source IP filter for that address and have that go to a special internal host, and create another VIP address without a source IP filter that forwards the SSH connection to the jumphost. However it seems that the source IP filter is not considered when deciding whether the entry is a duplicate or not. This is basically how it's done in the linux firewall with iptables: iptables -t nat -A PREROUTING -s $special_ip -d $my_ip -p tcp --dport ssh -j DNAT --to-destination $specialhostiptables -t nat -A PREROUTING&nb

Hello, So I have a question I cannot find if there is an answer to. We have a Fortigate 201E that contains a dedicated management interface.  We do NOT have that interface connected normally to any network.  We use it as a "Something has gone wrong, and I need direct access to the firewall"...The problem we had (literally this morning), was that we locked ourselves out, because most of our accounts are LDAP based, and suddenly the firewall couldn't connect to the internal network. We have a local admin account, but for some reason, we had 5 different passwords saved for that account.  This locked us out, and delayed us getting services back online because of this simple problem. I would like to have the max login attempts either disabled, or at least changed for that single interface only.  Can this be done?

Q1 How do you configure a switch virtual interface anddo vlan tagging on the firewall ports using GUI? Q2 If it is possible, pls do guide me and advice if I am supposedto use a software switch or a hardware switch? Q3 How come there can be 3 ip addresses for the physicaland virtual interfaces? Ip addresses should only be on the physicalor virtual interface, not both. (there are one physical and 2 virtual interfaces) Q4 How do you configure an interface and assign sub-interfaces to itusing GUI?