Solved

Hello,we have a Webserver at backend with following configuration:Ubuntu 20.04apache 2.4PHP 7.4Software GLPIKerberos SSOIf we unsing on windows pc the internal url (fqdn) from Webserver the user loged in automaticly.Parameter Satisfy Any is disbaled in that case! If we using external Fortiweb URL we enter user an password we get this Browser Message: UnauthorizedThis server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required. If we aktivate Satisfy Any in apache ssl config the login with external (over fortiweb) is woking after enter Credentials.But with this configuration, the login with internal URL require a authentcation. On Fortiweb we have as Site Publish rule this: Can someone tell me what is wrongmany thanks for helping

Dear users, Just a question. Yesterday I have set up the Fortimanager and imported some Fortigates into it. All went well except the policy packages. All of them have status modified.  I know I can push the policy back to the FortiGate to get it in sync but I'm afraid that it will broke somethingIs there a quick way to fix that? How would you fix the modified packages to get them in sync

Hi all, We have 2 (non-HA) FortiAuthenticators on prem that were configured to use DC agent with DNS IP validation, but were finding that when someone moves from a wired to a wireless connection that it would take too long for DNS to replicate and FortiAuthenticator to update the IP address of a workstation. We have therefore installed the SSOMA on a couple of devices as a PoC, which works great for the above issues, but we are seeing an issue with VPN connected and On-Prem connected clients that are on the same LAN subnets. Example:User 1 connected to Cisco AnyConnect on 10.0.0.1 with local wireless network: 192.168.0.1User 2 connected to On-Prem network on 192.168.0.1 The FortiAuthenticator sees both connections for User 1 and updates its' DB, then when User 2's SSOMA updates FortiAuth, the DB removes User 1 IP: 192.168.0.1 and adds User 2 IP: 192.168.0.1. Then User 1's SSOMA updates FortiAuth, which removes User 1's entry. We have IP Filters created, but as the b

New to FortiExtender. Trying to determine if using FortiExtenders might be a good choice for a  WAN2 connection in the event that the existing WAN1 connection goes off-line for a time. I'm curious what options exist to subscribe to the SIM cards. I know that some cellular carriers have fairly low cost data plans, but that it is easy to exceed the allowed data usage. I think that there are other plans that have high or unlimited data useage caps but that are quite expensive.  Does Fortinet offer cellular data plans? Are there some plans that are well suited for this usage? Do any plans pool data allotments such that a single SIM card in use in a month can use the pooled plan minutes of all SIM card plans? 

Hello, i have the following problem:we purchased new Hard Tokens and i wanted to activate them in the fortigate. All i get is a Invalid serial number message.I found the old problem with the Serial Number Checking Tool but this is failing too with a SN Not Found massage.The SN are all starting with "FTK200BA8" Is there a new chicking tool or do we have to contact our reseller? Thanks in advance and greeting,Dominik Gronau

Hi all. I'm hoping someone will be able to advise me on a work around, or an alternative solution, to avoid the following limitations with Microsoft NPS Extension for Azure MFA (without having to implement a completely different solution!): https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/36647266-mfa-nps-ext-support-for-network-policies-via-rad For context, our customer originally had a FortiClient to FortiGate SSL VPN that utilized LDAP authentication, allowing different levels of network access depending on AD user group membership.Our customer subsequently moved their AD into Azure cloud and introduced Azure MFA.Our customer now wants to integrate the existing SSL VPN to with their Azure MFA for 2-factor authentication. We followed the following Cookbook document to successfully implement this: https://docs.fortinet.com/document/fortigate/6.2.0/azure-cookbook/517582/configuring-forticlient-vpn-with-multifactor-authentication 

Hi,  When we have different region HUB topology in the network. Each Hub will have iBGP peer with its spoke and eBGP peer with the other region Hub. So , when we build IPSEC tunnels between the Hubs whether this should be a full mesh tunnel or a dialup tunnel?.  Should we need to add these ipsec tunnel interfaces (Between Hub to Hub) as part of SDWAN interfaces and to write SDWAN rules at hub for a spoke in one region to speak with other spoke??.. Or the other option is , without bringing HUB to HUB ipsec interfaces in SDWAN interface and just play with BGP routing ??. What is the best way to deploy and any documentation available for this. When we add it in SDWAN interface, we get benefit of running performance sla on top of it and to pick the interfaces.. RegardsRaja 

I have a second-hand FortiGate 80C and fortiap 223b,I want to upgrade them.When I downloaded it in the technical support, I found that I needed the contract number, but I didn't.Who has time to download their firmware and mail it to me,I'd really appreciate!my email 958041914@qq.com  or zlajl90712@outlook.com

Hello,Tried to make IPSEC tunnel between my fortigate and server build on OPNsense.My fortigate is 100F behind SNAT. SNAT is made by Virtual IP and forward connection form external IP to IP on loopback interface. Don't have any interface directly connected to internet so have to use Virtual IP as SNAT. Opnsense is also behind SNAT 1:1 .Something like :OPNsense 10.0.0.1/21<-->SNAT<-->95.100.100.1<-->Internet>95.100.200.1<-->SNAT on Virtual IP>10.200.0.1/32 on loopback<-->Local netIPs are for show purposes only.I've made successfully tunnel , phase1 and phase 2 is on green from both side.Problem is that  that Fortigate receives incoming packets from OPNsense but reject it as it comes from unknown SPI. In log details I have correct local IP, correct remote IP and the most important correct SPI number from both sides.I'v tried IKE v1 and v2 , with NAT nad without NAT and many other options. Nope, all the time Fortigate even if tunnel from

I can create a GeoIP and select a country to distribute the rules to the region at once. But what if I want to add or exclude some addresses in this list? I have Fortigate-600D-LENC (that is, it is not connected to cloud services and auto-updates) and I have not found a way to view the database of addresses included in the GeoIP of a particular country.

Hello, I have Fortinet Firewall 200E with SDWAN configured and I need to configure a VPN ipsec Client to site  I create the tunnel, I added the policy I can connect but I cant reach the local subnet  is there any think specific with sdwan  just for information it works within SDWAN thx for help  

Dear FortiMail Expert,Pls bear with me, not so technical questions. I just want to hear how others may address such questions.I bumped to one of my client and asked me the ff entries in FML Datasheet. Is anyone willing to share his/her tought on below items?1. Recipient-Based Policies (per Domain / per System) —Incoming or Outgoing800 / 3,0002. Antispam, Antivirus, Authentication, and Content Profiles(per Domain / per System)50 / 403. Email Routing (per hour)**1.5M3.a FortiGuard Antispam + Virus Outbreak (per hour)** 1.0 Million-->these numbers are bidirectional or intended for inbound only?  thank you in advamce

 Hi, Did someone face a block on all in the last 2 hours google.com and www.google.com starting to automatic block duo to sandbox block?Fortigate version 6.4.6 - 6.4.8

Hi,I use the below query to provide a summary of every user that hits the categories identified in the list. I would be very grateful if anyone knows of a way to include the Source IP address as one of the returned columns. Given that lots of our users have more than one device, it would mean I wouldn't have to go back to the Analyzer for confirmation.Kind regards,NetMan_Bath selectfrom_dtime(dtime) as timestamp, user_src, catdesc, hostname as website,action as status, sum(bandwidth) as bandwidthfrom###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src,dtime, catdesc, hostname, utmaction as action,sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidthfrom $log-trafficwhere $filter andhostname is not null andlogid_to_int(logid) not in (4, 7, 14) and ((logver>=52 and countweb>0)or((logver is null) and utmevent in ('webfilter', 'banned-word', 'web-content','command-block', 'script-filter'))) and (catdesc='Child Abuse' or catdesc='Child **bleep**ual Abuse' or

Hi all, I setup user auth with FSSO DC agent mode, and as there is many entries I would like to filter a bit.The filter criteria I would like to setup is based on the workload IP addresses.I have many users, connecting from home, that have FSSO entries with their own private home IPs.For example. user lamdba is seen with its VPN tunnel IP to Office and its private IP (so 2 FSSO entries).As the last ones are useless for filtering, I would like to know if it is possible to filter on DC agent or Collector Agent ?Thanks a lotFB

Good evening,  Experiencing an issue with FG Routing can anyonn assist,  I have the following setup on a Proxmox node: 1. Ubuntu (Client) 2. Foritgate Firewall  The Client has two interfaces attached with the following networks: 1. 192.168.61.X for management 2. 192.168.10.x (shared network to reach the Fortigate) LAN The Fortigate has three interfaces attached with the following networks: 1. 192.168.61.X for management 2. 192.168.10.x (shared network to reach the client ) LAN3. 192.168.100.x (WAN Interface to reach wan router) I cannot get internet on the client through the FG.  I can ping between both the client and the FG on the  192.168.10.0 network but if i try to ping an external network from the client with the FG as the gateway there is no reply.  After running sniffers and debug flow i can see the packet reaching the Fortigate with the following output:    FortiOS

Hello,Looking for best way to configure one of multiple wireless 223E repeaters so it broadcasts on a dedicated 2.4 GHz SSID.  Is this configured at the switch MGMT port or on the repeater itself?  There are multiple units all with the same SSID and password and both frequencies active, so there's no control over 5GHz or 2.4GHz connection.  My device does not work with 5 GHz.  Thank you.

Hi all! I'm looking for a model of P2P Wifi antennas that would work to pass the Fortilink P2PL2 over it to extend some networks over 800 meters and some close to 2KM. I can't find any model that are certified to work with the Fortilink.  If you have experienced it successfully, I'd be very happy to hear from you.  Thanks !

Hello all Is it possible to add (external/thirdparty) lists of BotNet IP addresses in the AMP/AV profile or the IPS sensor? As far as I can see it is possible to add thirdparty/external AV-Lists, however, I am not sure if AMP/AV does check IP addresses or if those thirdparty/external AV-Lists need to be AV signatures.As far as I can see there is no option in the IPS profile/sensor to add external lists. So my best guess at the moment is, that it this is no possible - did someone do this by any chance and can confirm that it indeed might be possible? Thanks a lot, much appreciated

Hello Team, We’d like to acquire an SSL certificate to use in the Guest Portal of FortiAuthenticator, but I have some doubts: - The certificate needs to be issued to a public domain (public dns resolvable) or could I use a local domain (mycompany.local)? Example, issuing the certificate to the CN fac.mycompany.local would work? I ask it, because the company doesn’t have a public domain (mycompany.com, for example). The second and last doubt is if I can use a certificate with wildcard, for example issued to *.mycompany.local, is that possible in the FortiAuthenticator? And in the FortiGate, is that possible to use certificate with wildcard too? Cheers,Gui  

Hello guysI'm Facing a problem with the log's in the forti-cloud option meanwhile it's displaying in memory but not displaying in the forti-cloud option. it was able to show 3 days ago but not showing now. so logs not reflecting in reports also In log settings,1) Memory = enabled2) send logs to Forticloud = enable (added my email and tested connectivity)upload option set to every 5 min.3) Log setting Event logging & Local Log Traffic set to all4) GUI preference Resolve Hostnames & Resolve Unknown Application is enabled please help me to resolve this issue 

I am trying to configure the file filter to block ".scr" file extension which I see is missing on my FortiGate. Is there an alternate and/or customization to block .scr file extensions?  Firmware - v6.4.8

Hello We have an environment with two sites: Site A and site B. Both sites have a Fortigate in the edge.There is a Site-to-Site VPN between this two sites. We'd like to configure in the Fortigate from site B a NPS Server that is in the site A (through VPN). Is that possible? I have tried to do that, but the NPS Server is showed as offline in the Site's B Fortigate and never goes up to online. In the site A, the NPS Server is showed online and is working fine. Is there any configuration that I have to set to the Site's B Fortigate communicate with the NPS Server in the other side of the VPN? The subnet where the NPS is placed is in the "crypto map" of the VPN and there is a policy allowing the communication. Thanks in advanced.

Hi, I am new to FortiGate Firewall. I created a VIP with port forwarding to one of our internal servers. Do I need to enable NAT in the firewall policy? If no, may I know why?  

Hello all I have an odd issue:I have TWO different cluster of fortigates (four fortigate 1100E altogether, two active/passive cluster). On each of those cluster the port 25 and port 26 are aggregated to one interface.Now it turns out that the MAC address of this aggregated interface has the SAME MAC address on EACH of the clusters.Unfortunately those two clusters have this interface in the same network - so that poses an issue. Any one an idea why this happend and how I can actually change the MAC of an aggregated interface? Thanks a lot