Solved

I am using the SSL-VPN tunnel interface (ssl.root) in a zone. But in the vpn ssl configuration it does not detect the policy created using the zone instead of the interface.There is a document that indicates that this configuration is possible.https://docs.fortinet.com/document/fortigate/7.0.0/new-features/538358/use-ssl-vpn-interfaces-in-zones-7-0-1But I am trying version 7.0.5 and it does not work.Here is the zone:This is the policy:But in the ssl settings apper the missing policy error:Has anyone had this problem? 

Hi Everybody,some time ago I have done a network segmentation in the headquarters based on zones (client, voip, server) and numerous policies. Now I have to do the same in a remote seat (IPSEC VPN). The remote seat  have the same logic as the main office, although not all VLANs are necessary (only client, VOIP). All routing between the VLANs is done at headquarters. I would like to avoid the following solutionUsing multiple interfaces in the policies because i lose the "Interface Pair View".Duplicate policies (this makes administration more complex)my ideaMultiple IPSec VPNs (with diffrent public IPs in the main site - parameter "set local-gw") - one VPN per VLAN, whereby its interface can then be added to the corresponding zone and the existing rules are then used automatically. Since I don't have a test environment, I wanted to ask beforehand whether this is even possible (routing..) or whether I've overlooked something here? Graphic for better understanding.Thank

HiI'm running FortiOS v7.2.0,build1157,220331 on FortiGate-200EI enabled DNS Database in Feature Visibility and configured it like this: config system dns set primary 1.1.1.1 set secondary 1.0.0.1 set protocol cleartext dot doh set server-hostname "one.one.one.one" set domain "test.local" end config system dns-server edit "port3" set mode forward-only next end config system dns-database edit "Test" set domain "test.local" set view public set authoritative enable config dns-entry edit 1 set hostname "@" set ip 192.168.5.15 next edit 2 set hostname "asd" set ip 192.168.5.15 next end set primary-name "dns1" set contact "host@test.local" next end (The IP Address of port3 is 192.168.5.1) The firewall doesn't respond to DNS for this domain and for

Hello @All, I have reed this Post: Technical-Tip-SSLVPN-Idle-timeout-not-working Is there any chance to solve the problem without changing anything on Client Side? Many thanksTBC

Hello everyone, Where i work we have a Fortigate 400E unit and I have some doubts on how to manage internet access for some of the users, we are using the profile based mode: Heres the scenario:Sales department have a firewall rule "Sales department internet access"Marketing department have a firewall rule "Marketing department internet access"General managers have another firewall rule for them aswell. Those internet access rules have different levels of access. For instance, general managers can access more websites than sales or marketing departments.  So far this is working, not issues at all. But sometimes a user from marketing or sales department gets assigned a task that in order to get it done he/she must have access to certain websites that are not allowed in the original policy. So, i need to give that user (and only that user) the permission to access the new websites he needs to access, but i dont want to give that access to the whole sales or

Not sure if this thread belongs here.My client has a fortigate firewall and may want to activate forticloud.What is the procedure and is payment necessary?

Is there any way to properly shutdown a FortiGate-manged FortiSwitch without having to ssh into it from the FortiGate CLI? Also, how about doing so remotely with FortiCloud? (There's a way to reboot FortiSwitches from the FortiGate GUI and CLI, but not easily from FortiGate Cloud and not at all from FortiExplorer iOS) The best thing I have been able to come up with is not very convient for remote use and it only sort of works: 1.) On the FortiGate define a custom-command to send to each of my 2 FortiSwitches:  config switch-controller custom-command edit "shutdown-sw-custom" set description "shutdown now script" set command "execute shutdown" next end   2.) Invoke the commands from the ForiGate CLI, or from FortiGate Cloud define and deploy a script containing the commands:  execute switch-controller custom-command shutdown-sw-custom <FortiSwitchF124SerialNumber> execute switch-controller custom-comman

Hello, I'm using FortiLAN to manage a number of FAPs.Now it looks like we're going over 30 managed FAPs. In the datasheet I see that up to 30 FAPs is free (and 3 switches and 3 sites), if you go over you need a Advanced Management License, does that mean we need to purchase 1 licenses if we have 31 FAPs, or do we have to purchase 31 licenses?Thanks.

Hi all, I would greatly appreciate help in resolving a problem I have with FG-80F and FAP-433F both on 7.2.0 where I'm trying to bridge WiFi with local interface using VLANS, without software switch.Configuration:System/Settings/VLAN switch mode: onports 1-4 as "internal_LAN", VLAN Switch with VLAN 167. This interface is configured with an IP and DHCP. All hosts connecting to this IF get IP fine.ports 5-6 as "internal_IoT" - VLAN 50, I've tried different configs but for now it's unconfiguredFAP is connected to FG port 4 (which is internal_LAN)"WiFi_LAN" SSID for my LAN is configured as "bridge" and since it is physically connected to VLAN 167, it works fine bridging WiFi with LAN.I'm trying to create a "WiFi_IoT" as bridge specifying "OPTIONAL VLAN ID" 50 and have it bridged with "internal_IoT". Here is what I've tried so far.Software switch: SS requires tunneling mode for SSID but then it's pretty easy, add SSID and unconfigured physical interfaces into it, configure SS with IP a

we are doing some relocation of the FAZ200D, after shutting down, i cannot find the power on button to power up the FAZ.is there any method to power on the FAZ200D ?

Hi,I've got a Fortigate 40F and the source objects you can see on the logs/fortiview they don't match the current user. It's like it's showing maybe the first user that connected with that IP, but it's not updating. I've got it connected with LDAP. How can I make it update the names so they are correct on the logs? Thanks,Albert

Hi, we have a FortiGate v6.4.2 build1723 (GA) where we use SSL-VPN.  Sometime the users enter (many times) the password wrong and the Forti block the public IP of the users and they have to wait for a long time to be automatically unblocked (unbanned). How Can I unblock that IP from the forti console to allow the user try the login again ?

Hi ,  I am wondering if anyone with Fortimail instance can help to confirm if you have same problem as our fortimail. We just found if a incoming email has more than 1 particular urls, it will go nuts. Here are two example urls:https://www.google.com/url?q=https://docs.tenable.com&source=gmail-html&ust=1https://www.google.com/url?q=https://docs.tenable.com&source=gmail-html&ust=2 As soon as I added the two urls in incoming email ( from gmail or from Exchange Online), Fortimail will fail to receive the email. I have opened a support ticket with Fortinet, but the response is very slow. I am wondering if any Fortimail user can reproduce the issue. There are many urls can trigger the UriExpander error, examples:UriExpander: Broken pipe while connecting to https://t.co/bAMtodzfGIUriExpander: Broken pipe while connecting to https://goo.gl/maps/VI3i1    

i am trying to connect to my fortigate firewall using forticlient on my Macbook PRo running Big Sur 11.6.2 but without success.As i have 2FA enabled, after entering the 6 digit code and click Submit button, i am back to the forticlient login page with the password removed. my is account is working fine on Windows 10 laptop and even on my android phone but not on my Macbook PRo

Hi, Is it possible to have SSID's from multiple VDOM's on the same access point and how?

Hello dear Community,i would like to configure 2FA-Authentication via Fortimanager and FortiAuthenticator.  We have a fortigate 200F in use.This Technical Tip was very helpful for us:Technical Tip: Radius authentication with FortiAut... - Fortinet CommunityMy first question is:The SSLVPN should be configured for 80 partners. Is there a possibility that I don't have to create manual groups 80 times so I can assign them a portal? Or do I have to create 80 groups and 80 portals with different bookmarks? Is it possible that I can only configure one portal and still assign different bookmarks to the partner?My second question:I usually create the UserGroups for the LDAP users on the Fortiauthenticator and then I configure them on the Fortigate so that they can authenticate via Radius & 2FA. Is there a possibility that I can only perform the configuration via the FortiManager, so I do not have to configure on two devices? Can I use the Fortimanager to create the ldap

Hi, We got for test hardware token model 300.Working great, but in documentation written that they are "driverless".but if I put USB token into PC which isn't connected to internet we got installation failed. Can somebody suggest, what must we have to  install on endpoint workstation for success authorize already prepared token with valid certificate. We do not like to install _Setup suite since we will prepare certificates and keys in our IT department and provide support to end users.  Thank you in advance,VladimirPrague/Czech Republic. 

Q1 Is it possible to upgrade FW using "execute restore image usb" command because I want to use USB to upgrade my firewall instead of TFTP. which brings me to the next question Q2 Is USB or TFTP upgrade faster? Q3 When I want to see fortigate lldp neighbors, I use the "diagnose lldprx neighbor summary". So what is the difference between a "get" and "diagnose" command? Q4 Why isnt lldp under the "get" command? Like it is show cdp neighbor in cisco.   

I am supposed to connect an equipment to the DMZ region.What am I supposed to configure on the interface going to the DMZ?How does the firewall now what to authorise to go into the LAN and what to reject? 

Dear All, Greetings, Just I want to know in FortiGate is there any feasible solution If I want to block bulk public IPs.For example - 1.1.1.1/32 Note - I have to block around 2500 public IPs in our organization at the FortiGate firewall.. So please anyone can make me understand to block these IPs. Please also share a Road map to block these IPs if you know. Thank you 

Please advise what else I can look in to if you have any ideas:Issue: SSLVPN connection can access internal network, but cannot browse internet while connected via tunnel; web-access works. Details: running 80F on 7.0.2 clients running Forticlient 7.0.1.0083Firewall policies exist both inbound with NAT disabled and no inspection/policies currentlySplit tunnel is purposefully disabledSAML login with Azure works perfectTunnel and web access are enabled on coresponding portal/only web worksSSL Debug log Configurations belowSSL Settings:config vpn ssl settingsset servercert "nameSSLVPN"set idle-timeout 0set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"set source-interface "OUTSIDE"set source-address "all"set source-address6 "all"set default-portal "web-access"config authentication-ruleedit 1set groups "VPN Users"set portal "tunnel-access"nextedit 2set groups "saml-group01"set portal "name SSL-VPN"nextInterface Config: edit "ssl.root"se

The specific model we are working with is a FortiGate 100F. We usually have our Internal Interface configured with the internal network subnet. Then, we’ll have a VLAN sub-interface for Guest Network, and another VLAN sub-interface for the Accounting department network. VLAN 20, and VLAN 30 respectively. So, both of these VLANS show up under Internal Interface when we expand it. Our HPE network switch is connected to LAN1 which is a member of the Internal Interface. The network switch is aware of the VLANS and is passing them accordingly. When we run the ‘Security Rating’ tool on our FortiGate, we get the following warning:ND05.2: Non-FortiLink interfaces should not have multiple VLANS configured on them. Traffic is flowing properly and everything seems to be working as expected. Why is this against Fortinet best practices? Or, are they simply just trying to get me to use their expensive hardware switches? Do I really need to configure 3 ports on the firewall a

i put the source nat as the private interface. I put the destination nat as the public interface.Somehow the ping to the internet works.Q1 Why is this so? Doesnt ping involve the return packet? Q2 Dont I have to put source nat as public interface and destination nat as the private interface too? Q3 Under what circumstances do you put a static route and not an NAT? Q4 Why do some other products only have "nat enabled" but dont specify "ip nat inside" or "ip nat outside"?  

HelloWhen I go to the GUI for my HA Firewall, only the HA:Primary firewall will appear.How do I go to the secondary HA Firewall? In Palo Alto, I can assign an ip address for the primary firewall (e.g 1.1.1.1), another ip adress (e.g. 1.1.1.2)for the secondary firewall and a virtual ip address for the cluster (eg. 1.1.1.3). So if I want to go to the secondary firewall to check I can go to 1.1.1.2. Can I do something similar for fortigate firewall?  

We recently conducted an internal penetration test and the testing machine generated 20 times more messages on our analyzer.  I have already deleted log files, however, is there a way to delete the messages generated by that PEN test machine from the analytic database?  Thanks!