Solved

hi all When processing a packet - which will have priority over the routing of that packet ? 1)      Existing session2)      Sd-wan rules3)      Policy routing4)      Static routing ====================== It also seems that if a session already exists, fortigate will always use back the existing session’s ingress interface to egress the return packet without checking the routing configuration e.g. t1) packet ingress to firewall at wan1 and exit lan1-- new session createdt2) return packet ingress at lan1-- existing session foundt3) firewall will always egress at wan1 without checking any routing Is this expected ? Thank you

Hi everyone !  I need your help. I'm a bit confuse how to correctly configure FortiAuthenticator to validate SSL VPN Connections with machine (computers) SSL Certifacte.  I tried a lot of options but nothing work, so I'm sure someone can help me :) The workflow is this one : - Computer is AD join with a valid CA certificate, for example : pc1.mydomain.local- ForitAuth is correctly configured and I can sync my computer.- I configured RADIUS with "Windows AD computer authentication" Now, what are the correct options to tell FortiGate to user computer certificate to validate the connection (if it's possible) ?Thanks

Hi, I have a working SSLVPN solution where I use client validation to check for a computer certificate from our internal PKI on the client. Domain computers get a certificate using autoenrollment policies and the root certificate is stored on the Fortigate. By enabling users to select the computer certificate in FortiClient during login, they can select the right certificate, which can be validated by Fortigate. So far so good... The problem is, any certificate/key pair on the client, with a matching root on the Fortigate passes certificate validation. Since we use Lets Encrypt certificates, I uploaded the root of LE onto the Fortigate. If I install any valid LE certificate on the client, this certificate is also accepted. Fortigate accepts any valid certificate for which it has a root certificate installed. Is there a way to limit validation to specific root certificate(s)? Or perhaps check on specific certificate details?  Using only Fortigate, no other

Hello, A client from us is having problems with connecting via FortiClient to a FortiGate firewall.Unfortunately, Fortinet wouldn't support me on the phone so hopefully you guys can help out. I have an installation of FortiClient on an iMac and when I try to connect with the FortiGate, it will not connect.When trying this from a Windows machine with the same credentials, there is no problem. Can you guys help out with this? Thanks in advance.

Hello, My question is very simple. Is it pssible to change SSL VPN Web login page portal ? As I can see it fits the FortiGate Langugate but how can I customize it without changing the FortiGate Language ? For exemple, my fortigate is in english and I need to have this page translated to another language : Thanks 

Hi!My SSL VPN always disconnects after 6 minutes.What could be the cause?Please help.

Vul of CVE-2022-0778 found at 2022-03-15 (https://www.openssl.org/news/secadv/20220315.txt), The openssl version is affects :1.0.2, 1.1.1 and 3.0 It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. OpenSSL 1.0.2 users should upgrade to 1.0.2zd (premium support customers only)OpenSSL 1.1.1 users should upgrade to 1.1.1nOpenSSL 3.0 users should upgrade to 3.0.2 Does Forti Product is affected by this Vul ?

Hi,On Fortigate FortiOS 6.4, this is I'd like to do: Limit an admin login to a single session, so if another login happened with the same admin user from another system (another PC), the current session goes off. Is that possible? Regards, 

Hello everyone, I'm new on this forum and a rookie in networking/Fortinet :) I have a question regarding my topology with Fortilink :  I have multiple VLANs across the switches and the Fortigate is managing all the switches.At this moment, all the internal traffic is going through the Fortigate and I'd like to change that.I have seen that with the "Advanced license", I could set up the SW1 as L3.My questions are :- If I put the SW1 in standalone mode to perform as L3, can I still have all the other switches managed by the Fortigate as it is right now?- If yes, all the internal traffic would be performed by the SW1 even if the other switches are managed by the Fortigate? I'm all ears if there is/are other solutions. About the config/firmware : All the links are in auto-mode / FG and FSW firmware is 7.0.1 (GA). Thanks in advance, GiGi. 

Hi Community,I have two HA Clusters that I need to connect.DC1 has 2x FG200E running active-acativeDC2 has 2x FG201F running active-passiveHow would you connect those two HA clusters? I want to be able to lose one of the Forigates on each side.Would you put a switch in between and connect to the switch using an aggregate?Or would you directly connect the Fortigates?I want to create a /30 transfer network to route traffic between the two DCs.Thanks for your suggestions. :)

Hi!I'm trying to setup an ssl vpn using LDAP on a Fortigate 40F, but using the server name fails.If I try to ping server ip from CLI it works, the server name fails.In Network / DNS the correct DNS is entered and can also ping external addresses like google.com.What other tests or configs do I need to do?Iv've been following the tutorials on https://docs.fortinet.com/document/fortigate/7.0.5/administration-guide/115783/ssl-vpn-with-ldap-user-authenticationThanks in advanced!

Hi, Please any help i want to know if the FortiSwitch 124E can work with an cisco SFP 1000BaseSX SFP.version 6.2.3 I changed an switch cisco 2960 by a new a FortiSwitch 124E standalone cabling to a switch core cisco 3750 but it didn't work, i don't know exactly the problem any suggestion please !thanks in advance.

Hi ! I have a strange behaviour with FortiAuthenticator and SSL VPN on FortiGate FortiAuthenticator is configured to sync ldap user accountFortiAuthenticator is configured to act as RADIUS with remote usersOn RADIUS policy, I used checked "User Windows AD Domain Authentication"ForiGate SSL VPN is correctly configured with RADIUSWithout 2FA enabled on FortiAuthenticator accountOn SSL VPN web interface I can connectIf I reset the password on my Active Directory (force change), on SSL VPN interface I can set a new password With 2FA enabled on FortiAuthenticator accountOn SSL VPN web interface I can connect with tokeIf I reset the password on my Active Directory (force change), on SSL VPN interface when I enter the token I'm not redirected to change password page but I have an error On Autentication > User Account Polices I haveIf I disabled "Request password reset after OTP verification". The behaviour is a bit different.I can change de password, then I recieved the

Hey, I'm new to Fortinet in general. We just got a fortiweb 400E and Im basically trying to ping through it and cannot.  Im not sure why. Basically what Im trying to do is this.....Laptop(192.168.1.1) >Cisco FW > Fortiweb400E > Cisco FW >laptop (192.168.1.10) The Ciscos are in transparent mode, I can ping through them no problem.  I'm guessing its a policy somewhere?  But I cannot see anything obvious in the logs.  I've turned on traffic logs and they tell me nothing.  I currently have it in OP mode "transparent inspection", port 1 is Mgmt on a different subnet, port 2 and 3 are plugged into each FW.  Any ideas would be great......

Hi !  I have a strange behaviour with dialup vpn. I have an HQ Fortigate with theses interfaces configured :port1 : 172.15.1.1/24dmz : 172.18.1.1/24 I have a Fortigate Client connected with dial-up vpn to this HQ. When I execute a traceroute on this Foritgate Client to reach for exemple a server behind my HQ Forigate with IP 172.15.1.218, the result is shown like that :  traceroute to 172.15.1.218 (172.15.1.218), 32 hops max, 3 probe packets per hop, 84 byte packets1 172.18.1.1 4.866 ms 5.031 ms 5.181 ms2 1172.15.1.218 5.355 ms 4.989 ms 4.527 ms Why dmz interface ip is in the path ????? Is it a normal behaviour ?  Thanks

Hello, I need help solving a routing problem. HQ and Brand Fortigate FW are connected via VPN IPsec Site to Site, everything is working fine, we can ping and have access from servers and ressources LAN to LAN from both side.  I created a static route from Brand's LAN 10.0.151.0/24 to HQ's router 10.0.78.253 on Firewall Arkoon. We host a SaaS solution with a service provider and this one to authorize the different lan to connect to the solution (France agencies + UK agency) On our Arkoon Firewall, we have authorized the different LANs that must have access to the LAN of the SaaS solution, 192.168.100.0/24. This works very well for all the agencies in France, except for the UK LAN with 10.0.151.0/24 addressing. When i do tracert cmd from a computer brand's LAN 10.0.151.109, I can ping 10.0.78.253 and 10.0.78.254.But, when I try ping or tracert with 192.168.100.20 it cannot found a route and it fails at first jump after 10.0.151.254. Thank you

Hello, Can I please get my nickname changed from MusicMaikel to SupportLibraICT? Thanks

Hi, two of our customers can't reach a website, but that webmaster says he can't remove them, because they are listed in the "Fortinet MaliciousServer list" and he can't remove them. The cause was the firewall of those two clients of ours, which they have since replaced. How do you get yourself removed from that list?Who should I ask? Thanks!

Hello everyone ! I need your help today. I have a FortiGate managed by FortiManager.I added some user in my FortiGate (User & Authentication > User Definition), I retrieved the configuration in my FortiManager. Now all is correct. But, if I push a policy package or update it, all my local users are deleted ! Why and how can I prevent this behaviour ?  Thanks

Hello. I have a FortiGate 60F and I have a layer-2 switch attached to one of the ports. On that nameless L2 switch is my WiFi WAPs (just some old Aruba's we had laying around). I want to have a guest network on those WAP's, but also want to have normal connectivity like I currently have. I'm trying to fumble my way through, but I can't seem to figure out a way to allow multiple IP/VLANs on one port. The L2 switch is on Port3, and I have that as part of the internal VLAN Switch (default setup) as pictured. Port3 > 8-port L2 switch > two Aruba WAPs with 2 VLANs (VLAN 0 and Guest VLAN)

Hi everyone, If I understand well, Web filter gives you more control over the things you can allow or block, in addition you don't need to use the FortiGuard DNS servers, so you don't have this limitation. Then, my question is, why do you need DNS filter if you can do the same or better with Web filter? Any example? Regards,Julián

Hello everybody! I encountered a problem - I cannot create a report template of youtube usage by individual users. The report has to contain: username, name of a video, a link to the viewed video, traffic, viewing start(date and time), viewing ending(date and time), view duration. Mates, please, write a solution if you are able to, thank you!

Hello @All,I have to Set up some internal DNAT and SNAT Entries and on reading some guides how to do that.I have seen that there is a feature calling Central SNAT available.I'm not really understand for what it is.Could someone explain to me what is the goal of Central SNAT and do I need that? Many thank'sTBC

Hi all, I run anomaly DoS detection between a students network and our campus lan. Thresholds are still default values. Problem is our campus dns server.I get many udp_dst_session, udp_flood, ip_dst_session just because of legitim (?) dns requests. 99% of all triggered anomalies are: clients -> dnsserver:53/udp. Sure, I could adopt thresholds but this would affect all udp traffic. Better would be to whitelist udp traffic to this dns server. Is this possible? anomaly: ip_dst_session, 7735 > threshold 5000, repeats 1312 times since last log  BTW: how are thresholds counted? udp is ip traffic, so does a 53/udp packet count for all three categories (udp_dst_session, udp_flood, ip_dst_session). And is this threshold for one client to server or all clients to server? Encylopedia says "the number of concurrent UDP sessions to an IP address is above specified threshold level", so I would assume latter.

Hi Folks! i have a special problem, we want that our user´s can use our public ip over vpn, but i don´t find any options in our fortigate FW60. has anyone the same? maybe someone can help. thanks a lot