Solved

I'd like to use FAC's TACACS+ service. Users will be pulled in from EntraID via SAML. Of course Entra has MFA via MA Authenticator.What happens in this scenario ? FAC couldn't broker Entra's MFA right ? Would I need Fortitokens in this case to do MFA ? Don

Dear Fortimail admins, I want to create a group email address on FortiMail like on Exchange and Google workspace. My goal is to have an address (ex : marketing@domain.com) that automatically forwards incoming emails to multiple recipients (ex : 4 users). Essentially, I want to set up a distribution-style group so that when someone emails marketing@domain.com, all members receive the message.Is there a way to configure this on FortiMail in server mode? Kind regards,

Hey guys. I'm trying to get my FAZ to backup its settings to an SCP server of mine. However I want to make sure I'm on the right path. I've set up SCP on my FortiGates, so I assume it can't be too much different.  config system backup all settingsset cert : set crptpasswd : So are these the Private key and the password used to unlock the key? I've tried generating a keypair with PuttyGen, but not sure how to apply it to these settings.  Can anyone point me in the right direction?

Hello, please help me understand this article. I have a WAN interface in a SDWAN zone which is used for DNAT. And occasionally the policy that contains the VIP won't get hit and traffic doesn't pass. Now there's this article explaining how to handle VIPs when the interface is a SDWAN member.Creation of a VIP (DNAT) when WANs are in... - Fortinet Community The article basically states:- On the VIP, use the physical interface, not the zone- On the policy, use the physical interface as incoming interface, not the zone Now the catch is,  you can't even use zones in the VIP interface selection GUI. And furthermore, you can NOT select the physical interface in a security policy when it is part of a zone.What is this tip even about? The first one is useless because that's a restriction of FortiOS and the second one is also not applicable because it's just not possible. If "wan" is part of "virtual-wan-link" you can only ever reference that zone in a policy, never the

Hello Team, We have HA device both devices are login via Radius server, however we are facing issue with secondary firewall not able to login it shows Authentication Failure but on primary firewall we can be able to login the firewall without any issue. as of now workaround we are using that reboot the secondary firewall and after that it works fine but after couple of days issue raise again showing Authentication Failure. we tried to use set source-ip but nothing worked only solution we can afford as of now REBOOT. Can you please look into this serious issue  Thanks

Hi FNAC adminsFortiNAC 7.2.9FortiOS 7.4.9 with managed switchesIntegration is fine and all works great so far except when I add a new VLANs in my FortiLink it is not detected by FortiNAC, while all pre-existing VLANs are all detected.Performed Read VLANs, Resync Interfaces, Validate Credentials, L2/L3 poll, but new VLANs still not detected.I mean don't see the new VLANs when try Model Config, and don't see then when I try Test Device Mapping.Even when I assign the new VLAN manually to to a port on my FGT, the FNAC doesn't want to reflect this change (it keeps only known VLANs).Opened a ticket but no fix so far.Any idea about this issue?

The IPS is not working on my FortiGate (120G-v7.4.9). How can I find out what's wrong? The profile is configured and assigned to the groups in the firewall policy. My license is active until 2026.Best regards FGT-120G-L# diagnose test application ipsmonitor 1pid = 1979, engine count = 7 (+1)diag: read_retry:0 stuck:0 lock_retried:0 discarded:0 executed:0 lock_preempted:00 - pid:1988:1988 cfg:1 master:0 run:11 - pid:2333:2333 cfg:0 master:1 run:12 - pid:2334:2334 cfg:0 master:0 run:13 - pid:2335:2335 cfg:0 master:0 run:14 - pid:2336:2336 cfg:0 master:0 run:15 - pid:2337:2337 cfg:0 master:0 run:16 - pid:2338:2338 cfg:0 master:0 run:17 - pid:2339:2339 cfg:0 master:0 run:1pid: 2334 index:2version: 07004000FLEN07800-00007.00004.00587-2508271856up time: 35 days 14 hours 12 minutesinit time: 1 secondssocket size: 64(MB)database: ipsetdb appdbstate: raw(4/6):107/108 l2:109 l7:110(8 clients)bypass: disablepid: 1988 index:0 cfgversion: 07004000FLEN07800-00007.00004.00587-2508271856up time:

Good morning, I'm having a problem with two-factor authentication using email. Nobody is receiving the token (it was working fine until yesterday). I see the message "Failed to send alert email from fortinet-notifications.com to..." I pinged fortinet-notifications.com and it responded, but I don't see any other information in the logs. How do I fix this?I have a FortiGate 120g Fortios v7.4.9 build2829 (Mature).How can I resolve this?

Hi, ive been using this Installer since release and it has been working fine until recently.  Now when trying to open the application im presented with the "A JavaScript error occurred in the main process", followed by "cannot read property TraceLog of null".  I know this has been reported a number of times with previous versions and I've tried the C++ suggestions but nothing is working, any assistance would be appreciated. Thanks

Hello Friends.I have followed the exact steps described in the below KB.The user is successfully authenticated to the SSID and is viewed on the Fortigate as a firewall user (#dia firewall auth list)I can see from packet capture that FG is sending the interm accounting messages to FAC on the specified period  and I see the ACC response packets from fAC in the sniffer. However, on FAC -- monitor --- radius sessions I see 0 accounting sessions.When I view user usage details : it is not counting anything and the user is not disconnected when reaching the max kilobytes specified in the suer profile. I am not sure what I am missing here. https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-Usage-Profiles-not-enforced-for-RADIUS/ta-p/198682  

Hi all, We have a Fortigate 40F (7.6.x) with the following configured:1) WAN x.y.z.138 public address (connected to Internet)2) LAN 192.168.1.2543) VIP : x.y.z.136 --> 192.168.1.6 4) Two firewall rules: one allowed all sources to access the VIP , the other allowed x.y.z.0/24 to access the VIP The VIP forwarding is working fine except for client with x.y.z.133 (same network with Fortigate's WAN), from which all requests are just time-out and no response. Any idea is appreciated !Kenny Lin

Dear colleagues, Have any of you managed to register FortiClient in your EMS Cloud using the invitation code? I enter the correct invitation code (all in sequence and with capital letters only). After I entered the, I hope so, correct invitation code in FortiClient, the application minimizes and closes. As a result, it keeps writing that FortiClient is unlicensed and I do not have access to extended options, e.g. saving the password in the SSL VPN connection profile and Always-up connection feature. The FortiClient version is "FortiClient_v6.2.3-build0332-release.apk" downloaded from the support site in the FortiCloud panel. I will be very grateful for all hints. My Android version is 14. Best regards,Witek

Hello FNAC admins,What's the most recommended method(s) in device profiling rules ? I know it depends for each scenario. Also I wanna know if it's best to use many methods in one rule, or each rule better have one method ? Thanks in advanceBR,

Hello FNAC admin,Correct me if i'm wrong, apparently if you register a host through the host view (users & hosts > hosts), the user doesnt have to go through registration again. Does that mean that the user is like in a safe/whitelist ? Register host to user  BR,

Hi,our firewall is in version 7.6 and we have multi-vdom. I notice that from the vdoms, I can configure tacacs: #config user tacacs+, however when I'm in global, I don't have this command. is that a way to configure it under Global (#config global #config user tacacs+ ) rather than going to individual vdom and do it (#config vdom #edit x #config user tacacs)? Also if I have a ha cluster (active-passive), I suppose I don't need to config anything on passive devices, as the config getting synchronised through all the firewalls? Thanks

Hello FNAC admins,I'm reading this part of the administration guide "DNS configuration and I don't quite understand what this configuration actually do, is it a mandatory step in fortinac's deployment or we can skip it ? Thanks in advance.BR,

Hello FNAC admins,I came across this in the admin guide "You must have a license for the guest manager feature" in the Guest and contractor chapter, do we need a specific FNAC licence to manage guests and contractors ? BR,

IkeV2 VPN with EntraID SAML All configured and working to a point ! SAML authentication works fine but as soon as I authenticate the connection Immediately drops !Last Disconnect Reason: HostnameResolveNonRecoverableError Can anyone suggest where to start with troubleshooting this ? I've tried the following but found not errors.diagnose debug application fnbamd -1diagnose debug application saml -1diagnose debug application ike -1diagnose debug application eap_proxy -1  

Hello,after deploying FortiAnalyzer on Azure (version 7.6.4), I am receiving the following error:"You have exceeded your daily logs GB/Day licensing limit within the last 7 days"However, a valid license for 5 GB/day is present and correctly uploaded on the portal (even if it not actually visible).Below are the screenshots and CLI outputs for reference.Could this be a bug?Is there any way to force the license to be re-read or refreshed?The file license has been downloaded and uploaded on the Faz after installing This the output from CLI:faz-xxxxxxxx # diagnose debug vminfoVM license is valid.fds_code: 200Expires in : 363 days 3 hours 51 minutesType: VM-SLicensed GB/Day: 0Max devices: 10000Management IP: 10.10.125.3Serial Number: FAZVMVM UUID: 56a1c1xx-xxxx-xxxx-xxxx-xxxxxxxxxxxxfaz-xxxxxxxx # get system statusPlatform Type : FAZVM64-AZUREPlatform Full Name : FortiAnalyzer-VM64-AZUREVersion : v7.6.4-build3579 250825 (GA.F)Serial Number : FAZVMBIOS version : 04000002Hostname : faz-xx

Hi Fortinet People, I've just seen the latest version, v7.0.18. Do I need to upgrade to v7.0.18M, 7.4.8M, or another version like v7.2.12M? Please advise for long-time use and stability.    

Hey allUsing a 'hybrid' network model with Fortigate 80F and a Cisco catalyst 9200LForti handles the routing and is relayed to Cisco.Im trying to relay OSPF routes learnt by Fortigate into iBGP handled by our ISP, however its not working.i can see in Forti that the routes are connected locally but not propagated into BGPI get routes from BGP so i can confirm that its working atleast one way, but not the other.Im trying to propagate 10.0.1.1 10.0.2.1 10.0.3.1 all /25 to BGP for advertised routingget router info bgp summary VRF 0 BGP router identifier 172.16.0.10, local AS number 65500 BGP table version is 6 8 BGP AS-PATH entries 0 BGP community entries Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 172.16.0.9 4 65535 473 449 5 0 0 03:14:03 130 Total number of neighbors 1 corenet0-a #  get router info bgp summary VRF 0 BGP router identifier 172.16.0.10, local AS number 65500 BGP table version is 6 8 BGP AS-PATH e

Currently we have a Cisco Firewall that has multiple NAT rules for Citrix applications. Now we are adding a Fortigate FW in front of the Cisco Firewall and it blocks Citrix applications. Do I need to create the same NAT rules on the Fortigate FW or could I create a range to allow all the NAT rules through the Fortigate. What would you suggest? 

Hello everyone!I am having this problem with my FGT 80F release 7.6.2F build 3462, using a Fortinet SFP model FN-TRAN-SX.Below is my environment:- The device connected on the WAN 2 interface only supports speed 100 full.- Whether connected via copper or fiber the WAN 2 interface is always set speed to 100 full.- The device connected on the WAN 2 has only one fiber NIC. The connection to WAN2 copper interface is made through media converter.Fault description In the current release, the device connected on WAN2 is only seen if it is connected in copper, while the WAN2 interface in fiber remains switched off even if we disconnect the copper cable in the branch, following output when only fiber cable is connection on WAN2 interface FGT-80F-1 # diagnose hardware shared-port wan2Get nic name: wan2 medium type 2, Copper even in the case of both cables disconnected on WAN2 the output of the following command does not change, as per your documentation (ART ID 33393

Hello, I am trying to create an SD-WAN Overlay template but hub field keeps showing None when I try to populate it. Please any ideas on what could be causing this? I'm running  FortiGate 7.6.4 and  v7.6.4  for the FortiManager. Please has anyone encountered this before or any ideas on what to do   Thank You  

Hello! Trying to sort this out a common(?) scenario with a DNAT in an SD-WAN configuration. DNAT is configured in WAN1, inbound rule has SD-WAN zone as incoming interface, inbound traffic to the DNAT works (webpage service loads normally).  SD-WAN rules for catch-all traffic (Internet bound) is set to manual, with WAN2 as preferred interface, followed by WAN1 as backup.  When traffic is originated from the target server in the DNAT, it gets NAT'd to the proper interface (WAN1), however the traffic is being steered through WAN2 due to the SD-WAN ruleOnly way that's working if an SD-WAN rule is above the catch-all with WAN1 as outgoing interface for this server only.  Is this the expected behavior? Any other options to get this working without the extra SD-WAN rule? PBR (WAN1 in WAN1 out, WAN2 in WAN2 out)? Auxiliary sessions and Asym traffic have been checked.   Running 7.2.11 on a 100F in this scenario.  TIA!