Solved

Our AD is hardened and our service accounts are limited in what they can do.  I have a service account that I am attempting to poll active directory groups for usernames.  Currently my service account can query ldap and view event logs.  What other permissions would I need the service account to have.  Currently I have a red arrow on my active domain controller. Our domain controllers are up to date and our Fortimanager is version 6.4.3 build 2201. The connector does get a green arrow if we use domain admin credentials. thank you

Hello team!! I have the following issue with a fortigate 60F (firmware 6.4.4)We have all the rules from LAN to WAN, with "Certificate-inspection", no one with "Full-inspection", and the "Certificate-inspection" profile is the default one.Sometimes, clients are having problems browsing in the internet, because Fortigate is giving to user its own certificate and it is not trusted in clientsI know a possible solution is to install the fortigate certificate in clients but I prefer to know why is happening thisDo you know why fortigate could give its own certificate to clients even using default "Certificate-inspection" profile? Thanks in advance.Regards,Damián

Hi,Does anyone know exactly what it means no_ofld_reason: redir-to-ips??? I have two fortigate 60F, (FGA and FGB) with FortiOS 7.0 but one (FG A)of them has problems inspecting the traffic, i mean that the traffic passes without inspecting the security policies. Example, if I want to block Torrent or Remote Desktop, the traffic goes through and is not blocked by Application control. This only happens with one of the two fortigates (FG A), in the other (FG B) i can block an application or URL without problems when I run the command "dig sys session list" the result say in FG A no_ofld_reason: redir-to-ips is constant and it always stays, but in FG B it varies does it have something to do with it? FG A says: no_ofld_reason: redir-to-ips (is constant)Fortigate A redir-to-ipsFG B says: no_ofld_reason:

Good morning,I would like to know what to include as dst_port and protocol to find the rulethat allows me to pass the ping in the command:diag firewall iprope lookup  src_ip  src_port  dst_ip  dst_port  protocol  Source interfaceI have tried with "any" and "all_icmp" and it does not give an error but it does not give me the correct policy:diag firewall iprope lookup 1.1.1.1 51778 2.2.2.2 any all_icmp port35Thank you very much.

Hello everyone,I'm trying to set up FSSO on AzureVDI. We have a FortiVM in Azure, a Win2019 DC, currently one VDI Server running Windows 10. I have installed the Collector and DC Agent on the DC and the TSAgent on the VDI Server. The connector on the FortiGate is working and I can select LDAP Users/Groups. My issue is that users connecting on the VDI server are not being pushed to the collector; instead, my logins on Azure seen by the DC Agent and because of that, if an admin logs onto the VDI Server, all other users then have internet access.  Sessions on the TSAgent are being logged and assigned port ranges but they simply don't appear to be visible under "Show Logon Users" on the collector. I've specified the VDI server in the "Citrix/Terminal Server" in the collector and on the TSagent, I don't see any connection failure to the collector. Any help would be greatly appreciated. Kind regards,Renato

Hello, we did setup a port forward from wan to a internal server. This works. Now we want to only allow access for iPad and iPhones over the external wan to the internal ip. Is ist possible to set this up? Regards Jens

Hello, for remote backup reasons I need to get a Seagte ReadyNAS 516 with Firmware 6.9.4 running. On the NAS I created users, shares and the needed applications (rsync, smb, http/webdav, ftp). On our FortiGate 100D (WAN DOWN 100MB/s UP 100MB/s) with Firmware 5.6.3 build 1547 I connected the NAS to a separate interface (role LAN) and set up a VIP with the required ports.   MTU is set to 1500 on both sides. File copy from my laptop over LAN works with 95MB/s (1GB/s connection). Copy files from remote locations via smb or ftp does not go higher than 512/600k (10MB/s or 5MB/s upload connection possible). Any idea what configuration mistake I made on the FG100D? Kind regardsJay

Hi all, when an ssl client is connected it can ping a host on the lan, but not vice versa. The same problem is between two connected SSL clients. The strange thing is that, on the contrary, the VNC (like access to remote desktop) works correctly. I made all the correct policies. You can help me? Firmware 6.4.8 and SD-WAN configured.I have some doubts about the Portal, you know that activating the spli-tunnel even if you do not declare the lan to reach, you can do it in the policy, and so I did. Thank you

Hello bro,I have hundreds of Fortigates to version 6.4.8, in recent weeks I have always waited to bring them to 7.x (in particular to the latest 7.0.5). What do you advise me not having, at the moment, particular problems?I only brought the Fortianalyzer to 7.x and I must say that it works very well and has solved some "reports" problems that were sometimes completely empty, without any data. Thank you all.

Hi, We have a FortiAnalyzer VM deployed on ESXi last year at our customer's place. Everything was working fine but since a week we were not able to see any logs on "Log View". When we checked the dashboard, we can see that the FortiAnalyzer is receiving logs from the FortiGate but it is not Inserting them into the database. The logs are still present in Log Browse (Compressed). FortiAnalyzer is in Analyzer mode and not Collector mode. How do we fix this ?   Thank you. FortiAnalyzer FortiGate 

Hello, I have an incoming route-map applying a MED metric of 10 to a received default route.I can see this metric of 10 showing in the route table so confirms it works. However, I am also receiving another default route from another BGP peer with a MED metric of 1.I can see this route coming in, however it is not replacing the existing default route with metric 10. I thought lowest metric wins. How come the new, lower metric default route is not taking over from the existing one ? Thanks for any help.

I am having trouble when try to reach a server which is used as a NAT with virtual IP address from the VLAN20. Please could you give me some idea what's holding vlan20 to reach that server? Debug flow : id=20085 trace_id=885 func=print_pkt_detail line=5665 msg="vd-root:0 received a packet(proto=6, 192.168.2.3:61108->10.10.10.2:443) from ENKA SITE. flag [S], seq 3245614174, ack 0, win 64240"id=20085 trace_id=885 func=init_ip_session_common line=5836 msg="allocate a new session-00c7d9b0"id=20085 trace_id=885 func=_pre_route_auth line=106 msg="pre_route_auth check fail(id=0), drop"   My topology is here: Vlan10 - 192.168.1.0/24Vlan20 - 192.168.2.0/24 WAN1 : 10.10.10.2/24WAN2 : 20.20.20.2/24 STATIC ROUTE : WAN1 - 10.10.10.1 - Priority 0STATIC ROUTE : WAN2 - 20.20.20.1 - Priority 5 Policy Route : Incoming interface: VLAN20 - Source: 192.168.2.0/24 - Destination : 0.0.0.0/0.0.0.0 - Action: Forward Traffic - Outgoing interface: WAN2 - Gateway: 2

hello we switched from the version 5.6old to v6.4 ,now using fortigate 1000d v6.4 cannot find source devices/devices for SSid so i can add the devices in the source like we can add in the old version 5.6..in order to restrict devices by mac-id. Thank you

Hello friends, I have the two following questions. Perhaps you can help me :-). 1. Is it possivle to configure a specific dns-server for a specific internal domain? I need it to resolve internal FQDNs like abcde.internal-domain.comby a dns-server I would like to speficy. The FortiGate-firewall should then pass the dns-requestsfor this domain (for example abcde.internal-domain.com) to the dns-server which is resposiblefor this domain. For external FQDNs (for example www.google.de) the dns-servers under "Network" --> "DNS Servers" should be used (for example 8.8.8.8 or 1.1.1.1). 2. Is it possible to configure one side of an ipsec-site2site-tunnel (Fortigate-firewall on bith sides)as "passive" and the other side as "active"? The goal is to establish an ipsec-tunnel where one side is connected to an lte-connection (mobile network) and the other side is connected to a dsl-connection (static ip address on wan-interface). The Fortigate-firewall on the lte-side shou

hi fortinet community, i almost done setup fortimanager 7.0 in my internal network. rules to connecting the internet using a proxy. My problem is I wanna login fortimanager with forticloud account to activate trial license, but got error "timeout". I already done setup "config fmupdate av-ips web-proxy & config fmupdate web-spam web-proxy" but still same got error "timeout". do you have a suggestion bro ? Thanks FortiManager FortiCloud Products

Brand new FortiGate 60F. For some reason, instead of a Hardware Switch it has a VLAN Switch (Network >> Interfaces). I'd much rather have it have a Hardware Switch, like the other FortiGate Firewalls we administer, but how do I change it/delete it? I've tried factoryreset and factoryreset2, but it has survived :( So how do I delete the VLAN Switch, change it to a Hardware Switch? I'm ready to wipe the configuration and start from scratch. The FortiGate is running FortiOS 6.4.8. Thanks!

Helloi try to setup automatic backup over automation.I use the cli command:execute backup full-config ftp /Netdevice-BCK/BU-FWZ/BU-FWZ-test.cfg server user passwordExecuted in cli, it works fine. When i try to start the command as automation stitch, the backup is not uploaded to the ftp server.What am i missing?RegardsMario-> Debug output when testing automation stitch: 0: config global0: config system auto-script0: edit "autod.858"0: set script "execute backup full-config ftp /Netdevice-BCK/BU-FWZ/BU-FWZ-test.cfg server user password"0: end0: end-1: execute backup full-config ftp /Netdevice-BCK/BU-FWZ/BU-FWZ-test.cfg server user password

Hello Guys I have this Fortinet configuration with HA active-passive mode, and an aggregate was configured with port3 and port4 on the fortinet side and in each Mellanox Switch that is in mlag mode (VPC in Cisco), an 802.3ad LACP with two ports was created (swp41,swp42) with a clag id. The LACP on the Switch side always shows up, but on the fortinet side, it always shows us down the lacp in the Passive Firewall when I run a diag net aggr name Lacp_Spine the status is down, but the active one is always up. I would like to ask you for help if this behavior is normal, where the passive always looks down. Thanks 

I already connect SNMP with PRTG and shown the data on their dashboard such as bandwith and port status (UP / Down).But in System Event still have message "SNMP failed to match community" The question is, how can delete that message cause every hour always shown that. Thank you for your attention 

Hello... I have a FortiGate 600E device... In the current design there is one internal interface that connects all internal vlans to the firewall:(10 users vlans, 1 guests WIFI vlan, 1 Servers Farm vlan)... This connection comes directly from a Cisco Nexus 9396 switch which is the default gateway for all of the vlans. Now I want to separate these vlans from each others in order to set policies between the users' vlans, WIFI vlan and server farm vlan...  What I know is that I have to setup the vlans in the internal connection of FortiGate device and make it the default gateway for them instead of the Nexus switch.. Is this the right way??And can the FortiGate 600E handle the routing instead of the Cisco Nexus device?? Any advice will be appreciated 

Hello Expert, Yesterday  i  factory reset my 524D switch.I connect the cable from laptop to the management port on the switch but was not able to login in.Upon troubleshoot I realize I  cannot  ping the interface.  The only access I have to the switch is via command line. I humbly request some guidance to enable access via the management port using the default ip (192.168.1.99) Thank youRegards

HIWe've just had our MC4200 RMA'd The new one is up and running but out of 68 APs it can only talk to two.None of the others can be pinged from the controller. They can ALL be pinged from my computer. My computer can also ping the controller and the controller can ping my computer.All the APs are on the same subnet as the controller. I can't think of any reason why the controller cannot talk to them when a computer on a different subnet can.We also have a box called an SA250 sitting under the MC4200. I have no idea what it is or what it does and I have never connected to it. I tried to get to it's web interface today (assuming it has one) and that does not work. It is also on the same subnet as the APs and the controller but the controller CAN ping this box.Since the replacement MC4200 was installed all the POE switches onsite have been rebooted which should have rebooted all the APs. I have also turned off and on one of the switch ports connected to one of the APs and watched the ping

we just bought a fortiweb and in my network, most of our servers dont use http and https ports but instead they use ports like udp and tcp 3500  , 3501 and so on. My question is the following: is fortiweb used to protect servers that don't use HTTP or HTTPS? like how described in my environment? or it is exclusively used for http and https access? because the idea to place all my services that use tcp and udp ports behind a fortiweb? because when im checking config guides on fortiweb it shows the policy configuration is always showing a http and https profiles, while many of my servers don't use http and https and use other ports for other applications like GPS and so on

Hi,I have a FortiGate 100F with a LAN interface (10.1.10.1) that uses the local Captive Portal to authenticate users to Azure AD using SAML 2.0 SSO.I also have a Wi-Fi Interface (10.1.40.1) that uses the local Captive Portal to authenticate guest users with temporary accounts created in ‘User & Authentication -> Guest Management’.The Captive Portal FQDN is -  captive.local.acme.co.ukI have setup the FortiGate DNS Server database, created a local.acme.co.uk zone and created two DNS A records for the Captive Portal for this FQDN.Captive -> 10.1.10.1Captive -> 10.1.40.1All appeared to work OK for a few days, but now the DNS resolution is selecting the wrong A record, e.g. 10.1.40.1 is being resolved when trying to connect to the Captive Portal from the LAN interface.Is there any way to force the correct FQDN to IP Address resolution? Or an alternative way of achieving Azure AD firewall authentication and Guest Wi-Fi on the same FortiGate?Thanks!

Has anyone been able to get a phone like this registered to a Fortivoice 40?  Also, same with a Grandstream gxp1630.  I am not able to register either.  Any help is appreciated..