Solved

Hi everyone, Looking for help with a strange API authentication issue on one specific FortiGate. Setup:25 FortiGate firewalls managed via automated backup scriptUsing API v2 endpoint: /api/v2/monitor/system/config/backup?scope=globalSame API user (BACKUP-SUPER_ADMIN) configured on all devicesProblem: One firewall (let's call it FW-TEST) consistently returns HTTP 401 Unauthorized, while the exact same script works perfectly on the other 24 devices. What I've tried:Regenerated API token multiple timesVerified user permissions (identical to working firewalls)Manual test with Postman: same 401 errorGUI login with same account: works fineCompared API settings between working and non-working FW: no differences foundQuestion: Has anyone encountered a situation where one FortiGate rejects API authentication while others with identical config work fine? Could there be hidden settings or firmware-specific quirks that affect API token validation? Using FortiOS version if you k

I have been looking through the Fortimanager API documentation and there is a section mentioning running CLI commands against managed devices: https://how-to-fortimanager-api.readthedocs.io/en/latest/007_device_management/007_device_management.html#how-to-run-cli-commands-against-a-managed-device However, there is a warning message saying it is not yet supported and 'Caught in #1155085, #1072897 and #1133627.' I have tried it myself and get the same result as the example, so it definitely isn't working at the moment. I'm wondering if there is anywhere we can see where the progress of this is at- I have tried searching those aforementioned numbers which I assume are case tickets, but haven't found anything. It would be useful to have a timeframe on when this functionality might be made available.

Error message:/saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>__samld_sp_login_resp [826]: Failed to process response message. ret=-111(Failed to verify signature.)samld_send_common_reply [91]: Code: 1, id: 539, pid: 5739, len: 64, data_len 48samld_send_common_reply [99]: Attr: 22, 12,samld_send_common_reply [99]: Attr: 23, 36, Failed to verify signature.samld_send_common_reply [119]: Sent resp: 64, pid=5739, job_id=539.[5739:root:0]epoll saml recv resp error.[5740:root:216]Timeout for connection 0x7f7ebad000. My SAML IDP uses Casdoor, which is an open source identity authentication system. I made sure my certificate is the public key certificate imported from the Casdoor system.

Hi, I've configured a ZTNA Server + Rule + Destination for RDP Session to a certain server.Therefore I configured a PROXY Port  which is then TCP Forwarding to Port 3389. Anyhow no RDP connection can be established.Any ideas? KR Chris

Hi,I am trying to connect a pair of Fortigate HA in A-P mode to 2 Aruba Core switches and wondering what the best practice is.  The Aruba switches are working in VSX mode.  Let's call them CS1 and CS2.  The connection will be like the following:CS1 port11 -> FG1 port 11CS1 port21 -> FG2 port 11CS2 port11 -> FG1 port 12CS2 Port21 -> FG2 port 12With VSX when connecting switches I can just put all 4 links in 1 LACP lag and it works fine. Now with interconnection between the Aruba switches and the Fortigate HA I am trying to find out what is the best option?  1. To put all 4 links in 1 multi-chassis lag on the Aruba side  and set lacp-ha-disable enable on the Fortigate side2. create 2 lags on the Aruba side, 1 lag to FG1 and another lag to FG2.What is the best practice here in terms of stability and failover time? Thanks,  

I see that starting from 7.4 we have an option to upgrade multiple ADOMs at once but they have to be on same version. https://docs.fortinet.com/document/fortimanager/7.4.0/new-features/107391/fortimanager-can-upgrade-multiple-adoms-same-version-at-the-same-time-7-4-1Is there any way to upgrade all ADOMs together regardless of current ADOM version ?

Hello,I’m trying to integrate SentinelOne with FortiSIEM following the official guide:https://docs.fortinet.com/document/fortisiem/7.4.2/external-systems-configuration-guide/780558/sentinelone According to the documentation, a “pre-defined HTTPS Credential Definition for the SentinelOne Singularity Activities API template” should be available for download. The Download Link: https://filestore.fortinet.com/docs.fortinet.com/fsiem/Public_Resource_Access/ESCG/SentinelOne/SentinelOne_Activities_https_advanced_definition.jsonHowever, when I click the provided link, it returns a 404 Not Found error, see the screenshot below:   If possible, could you please provide the JSON file or an updated link to download the SentinelOne HTTPS Credential Definition template?Thank you.

I am using IPSec to establish a VPN tunnel to the Fortigate. This works and I am able to ping multiple VLANs on our network. What I would like to do is have the VPN clients landing into VLAN_VPN, from that VLAN I want to use Firewall policy to allow the VPN Clients to other VLANS.I am able to do this, but the traffic always flow from VPN Interface to the other VLANs directly without forcing them through the VLAN_VPN. The Fortigate sees the other VLANs as directly connected, so the fortigate just sends the traffic directly from the VPN interface to the other VLANs. Any suggestions on how to accomplish forcing the traffic to the isolated VLAN_VPN and then using policy to allow traffic to the other VLANsThanksKevi n ThanksKevin

Description:Hello everyone,I’m facing a strange issue with our FortiGate 30E (firmware version 6.2.16). One of our internal staff networks uses a DHCP relay configuration. The relay forwards DHCP requests to a central DHCP server, from which devices such as computers and phones receive their IP addresses.Today we encountered a problem where some iOS devices (iPhone and iPad) couldn’t connect to the network via DHCP.Here’s what we observed:Not working:iOS 18.7.1iOS 18.6.2Working fine:iOS 18.3.2iOS 18.5iOS 26.01It seems that only newer iOS versions are failing to obtain an IP address through DHCP relay.Below is the configuration of the DHCP relay on the FortiGate interface:set dhcp-relay-ip "10.148.102.102"set dhcp-relay-type regularset dhcp-relay-agent-option enableset mtu-override disableset wccp disableset drop-overlapped-fragment disableset drop-fragment disableset interface "lan"set vlanid 79Has anyone experienced a similar issue where newer iOS versions fail to obtain an IP address

Dear Experts, At SD-WAN configuration, when manual mode is used, is "set priority-members" of "config service" stronger than "set priority" of "config members"?I tried several values and it seems to be such thing.Also, how should we use the both, including use of other modes? Thanks in advance, 

Hello Experts, I have an issue about site-to-site SD-WAN. Here is the situation.There are 2 ipsec tunnels between 2 Fortigates.One tunnel (called as X) is a simple ipsec tunnel.The other (called as Y) is a ipsec aggregation tunnel which has 3 ipsec tunnels (Y1, Y2, Y3)FG1 -- X ------- Network_A ------- X -- FG2    -- Y - Y1 -- Network_B -- Y1 - Y --         - Y2 -- Network_C -- Y2 -         = Y3 -- Network_D -- Y3 -(I hope you understand the above configuration.) When all Network_A,B,C,D belong to normal network, everything is ok.(Both X and Y are seen as green in SD-WAN performance SLA). However, when Network_B,C,D belongs to slow network such as satellite,Only X is OK (alive). Y is not alive as SD-WAN, although all ipsec tunnels (Y1, Y2, Y3)and aggregated Y are established as vpn tunnel.(Y is seen as red  in SD-WAN performance SLA, however all are seen as green in VPN page.) In this case of slow netw

Hey everyone,Is anyone else getting this message when trying to launch a self-paced lab?“The Training Institute Lab platform is experiencing an unplanned outage affecting self-paced lab provisioning. Please try again later.”I’ve been trying for a while, but it still shows the same message.Is this a known issue or maintenance? Any update on when it’ll be fixed?Thanks!

Dear community, I am configuring DC agents to push logons information to Collector Agent (CA on dedicated server).I am using this msi setup command line:msiexec /i DCAgent_Setup_5.0.0302_x64.msi COLLECTORAGENTLIST="10.y0.xx.11;10.y0.xx.11" DONOTRESOLVE=1 IGNORELIST="mydomain\?*-s;mydomain\HEALTHMAILBOX?*" ENABLELOG=1My question is about IGNORELIST parameter. It seems that my DC agents is still sending information about service accounts (mydomain\?*-s) that are supposed to be filtered. This syntaxe is working well to filter at Collector Agent level, but I would prefer to filter as early as possible in FSSO process, so at DC agent level.The msiexec command is accepted, collector agents list param is well used to setup DC agent but not ingnorelist param.Thanks for any advices. 

Hello everyone, I tried to exempt an DDNS FQDN, but it still gets blocked by the FortiGate.SSL-Log:SSL connection is blocked, certificate-status: expired untrusted I tried with an Address FQDN object and also via this method https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-Exemption-based-on-FQDN-in-Proxy-based/ta-p/387569 . The connection to the FQDN still gets blocked. I also have to add we are using a different HTTPS port to reach the address (3438) and yes the remote certificate is expired since it came with the device.

"No logs from a device" rank top in the availability But, how to show which device not sending out the logs.  

I have three static routes to reaching my bgp Neighbour via ipsec tunnel by using ike/32 injection with same AD,metric and priority how fortigate will select the best path for bgp control plane message.@Jean-Philippe_P @msingh_FTNT @Anthony_E 

Newbie question here, I'm working in an MSP, and one of our clients Fortigate FW license expired which caused web browsing to be blocked. I've look into this and was able to get things working before we renewed the license. Our team is planning to give recommendations on purchasing a similar fortigate appliance with identical license but with different expiry dates. I just want to be sure if this will work, if the primary FW loses its subscription will the 2nd device take over if the subscription on it are still active?

We have standardized on using Power BI for reporting metrics on our different systems.  Has anyone created FortiSOAR reports using an external report system like Power BI?  If so, how did you accomplish this?

Hello everyone,I’m planning to replace my current Vigor 3220 router with a FortiGate 100F as the main firewall and router for my network. Current Network TopologyCore Switches: 2 × Dell S4112F (OS10), N160-N161 configured as a VLT pair.Access: Dell N1148T Switches N162-N165 connected via trunk ports to Core Switch.Old Router: Vigor 3220 (172.16.16.221) Connected via 1Gbit Link to Dell N1148T -N162 Switch port52. SVLANs: 1 (Mgmt), 110 (Servers), 120 (Users), 140 (WiFi), 510 (Staging Server), 520 (Staging Users).FortiGate 100F (test LAN 172.16.16.222 :( connected to Dell N1148T-N162 on port 51 (trunk)Currently, all inter-VLAN communication happens at the Core Switch level (the Dell S4112F pair). Each VLAN has its own SVI and VRRP configuration on the cores.  Fortigate Test Network At the moment, I created two testing VLANs (510, 520) and added static routes on the core switches so that those VLANs go through the FortiGate: ip route 0.0.0.0/0 172.16.16.221ip route 10.5

Hi, we need to config remote-access ipsec vpn on fortigate. can configure using a floating public IP address?the routing for this floating IP is configured properly, should be routed to the firewall via internet and local internet router. Can someone please advise? thanks in advance! 

We currently have two sites, Site A and Site B, with identical destinations defined over separate VPN tunnels. Each site has a separate SNAT range using different IP addresses, so they know which location/route to send traffic back to. Both of our firewalls are setup as Central SNAT, and they are running 7.4.6. We're about to implement a new solution that requires us to change the destination IP range at Site B, so that the new system can check each path for dropped packets, latency, etc., and then it will send the traffic over the best path. For example, our internal host 192.168.1.1 currently sends to VendorA host 192.168.2.55. Traffic to VendorA is advertised exactly the same to both of our sites, but SiteA is the preferred site. SiteB will only be used if SiteA goes down. This won't work with the new system. What we need to do is to keep the destination for VendorA going out SiteA as 192.168.2.55, but we need to change the VendorA subnet going out SiteB as 192.168.3.55. I

I'm on the verge of buying the FortiToken 410, but it comes in a 5-pack and I'm running a one-man show network. Can I use the FortiToken for authentication on other platforms—like my email account, web hosting provider, or password manager? Your answer is very much appreciated :) Thanks in advance <3

  I am currently working on integrating FortiGate with FortiSOAR and facing an issue while installing the FortiGate connector.FortiSOAR Version: [7.6.2]FortiGate Version: [7.0.0]Environment: VM (CentOS/RHEL baseWhen I try to install the FortiGate connector using the following command: sudo yum install cyops-connector-Fortinet-FortiGate  I get the following error:Errors during downloading metadata for repository 'fsr-app':- Curl error (28): Timeout was reached for https://repo.fortisoar.fortinet.com/7.6.2/fortisoar/x86_64/repodata/repomd.xml [Connection timed out after 30000 milliseconds]Error: Failed to download metadata for repo 'fsr-app': Cannot download repomd.xml I have already tried the following:Verified network connectivity (ping to 8.8.8.8 and 1.1.1.1 works).Edited /opt/cyops-integrations/.env/pip.conf to point index-url to https://repo.fortisoar.fortinet.com/connectors/deps/simple/.Increased timeout and retries in pip.conf.Still facing the same is

We have just upgraded our 100F from 7.0.17 to 7.4.9 with 7.0 going end of support.It upgraded to 7.2 and then to 7.4 Everything seems to work fine with the exception of FortiAnalyzer Cloud. It's refusing to connect and send logs. We did upgrade the FAZ from 7.4 to 7.6.4 however it hasn't seemed to make any difference and both versions seem to support our Fortigate version. I have also removed the device and re-added it to FA Cloud still with no luck.  There's no access issues that I know of # exec ping fortianalyzer.forticloud.comPING fortianalyzer.forticloud.com.geo.fortinet.net (154.52.2.161): 56 data bytes64 bytes from 154.52.2.161: icmp_seq=0 ttl=52 time=20.6 ms64 bytes from 154.52.2.161: icmp_seq=1 ttl=52 time=20.5 ms64 bytes from 154.52.2.161: icmp_seq=2 ttl=52 time=20.5 ms64 bytes from 154.52.2.161: icmp_seq=3 ttl=52 time=20.5 ms64 bytes from 154.52.2.161: icmp_seq=4 ttl=52 time=20.5 ms--- fortianalyzer.forticloud.com.geo.fortinet.net ping statistics ---5 pac

Hi, I have been trying to access the training portal for some hours. I tried login with master account, did not work, sub-user, did not work. I even created different account. I am using my own FortiCloud account. By the way this worked yesterday. Anyone else experiencing this issue?Thanks in advance