Solved

Hello Community,Please for your support.Just a brief explanation of the topology and the case at first. We have a NAC VM Cluster, in which we have enrolled our inventory switches. we want dynamic vlan assignment for the users, based on an the Role attribute that each user has ( attribute 60 = vlan 60). Switches has the respective AAA config and i can see on the NAC that the radius accept is sent when the user is connected to the port. Users have the supplicant configuration for the Radius authentication as well. Thing is that when the user connects on the switch, NAC does not assign any vlan dynamic as it should and it marks the port as down  (not connected), on the nac gui even though on the switch side the port is still up and working on the vlan that it was. normal policies work as it should ( for instance vlan assignment on Cisco IP phones). Below some screenshots that may help The above case is when we try to connect only one device per port. When we have an ip phon

Hi Team,     While I am trying to make a custom parser for Windows/any other device type while using the convertHostNameToIp function with setEventAttribute, validation shows failed.Full function is below:<setEventAttribute attr="srcIpAddr">convertHostNameToIp($_saddr)</setEventAttribute>Below is my custom parser for testing.  While testing with other functions like resolveDNSNameAll other functions are working fine except convertHostNameToIp. Please give me any suggestions for this issue.Below is my custom parser.Validation failed: convertHostNameToIp<eventFormatRecognizer>TMSSQLSERVER</eventFormatRecognizer><parsingInstructions><collectAndSetAttrByKeyValuePair sep=" " src="$_rawmsg"><attrKeyMap attr="hostName" key="Host: "/></collectAndSetAttrByKeyValuePair><setEventAttribute attr="srcIpAddr">convertHostNameToIp($hostName)</setEventAttribute></parsingInstructions>Validation is pa

Hi A customer of mine grants me access to his network using forticlient. I installed the Ubuntu version using the official repos from here https://www.fortinet.com/support/product-downloads/linux Now I'm getting this error message FortiClient SSLVPN is unavailable: FortiClient VPN trial has expired.Please contact your administrator or connect to EMS for license activation. Looking in other threads (https://community.fortinet.com/t5/Support-Forum/Forticlient-free-version-expires/m-p/231) that I need the "FortiClient VPN" only. However I don't know how to get that. I've found this article https://docs.fortinet.com/document/forticlient/7.2.2/administration-guide/666761/linux but I'm not sure how to get any of these files. I'm able to log in support.fortinet.com, but if I go to Firmware downloads, I only see a blank list and the error message Sorry, you don't have any product covered by a Fortinet support contract. Where do I get

Can a Cisco C9300L-48P-4X switch be used to fully power a FortiAP 441K via dual PoE sharing, or can dual PoE sharing be accomplished via FortiSwitches only?

Hello. We have 3 public ip addresses and 2 web servers. I would like both to be behind the FortiGate but I want to make sure I set it up properly. From what I understand, I am not supposed to use both WAN interfaces and instead I am supposed to assign multiple ip addresses to one interface. If it matters, one of our ip addresses is on one subnet and the other two ip addresses are on a separate subnet. Ideally, the two webservers would use the single ip address and one of the other two. The only reason is that the dns records already point to these two and i don't want to change them if i don't have to. But if it's easier or better to use the two ip addresses that are on the same subnet, I can update everything as needed. I will still be using the same Fortigate and internet connection for all the devices on the network as well. What all do I need to do to set this up properly? Let's say the following: Public IP address info:Static Ip 123.45.25.105Gateway 123.45.25.254Subnet Mask 2

Hi everyone, i've downloaded a fortigate VMware Appliance (v7.2.4) and want to run it in permanent trial mode as described in the official support article: Permanent trial mode for FortiGate-VM | FortiGate / FortiOS 7.2.4 (fortinet.com) When i try to activate the evalution license over the https interface, i always get the error message: "Error downloading license: Invalid serial number".When i try to activate the evaluation license over console, i get the error code 61 - "Failed to download VM license".I'm using a new and never before used fortigate account (with a new mail address) and the vm has full internet access ("execute ping google.com" from the console works).Do you have any idea, what the problem could be?best regards,Hannes

Hi!So i have an HUB&Spoke topology (OS 7.4.6), the 2 HUBs have only 1 link each meanwhile Spoke has 2. Everything seems working fine, i receive the BPG adv from spoke and viceversa until i try to shutdown one of the WAN link on the spoke side.So i have 4 tunnel configured on spoke side:WAN 1HUB1-VPN1HUB2-VPN1WAN 2:- HUB1-VPN1-2-HUB2-VPN1-2So when i shut the WAN 2 i still see that BGP is still sending its hello packets via VPN1-2 even if the Fortigate marked bot as "down". In order to make BGP use the other active tunnels, i had to disable VPN1-2 tunnels manually.Not sure where is the issue, but i attach the configuration of the sdwan section, maybe someone can help me figure out the issue. config system sdwan set status enable set fail-detect enable config zone edit "virtual-wan-link" next edit "WAN1" next edit "WAN2" next edit "HUB1" set advpn-select enable set advpn-health-check "HUB1

Hello, Is there a way to track the username from a session authenticated through SAML Azure IDP when accessing a specific VIP using Site Publish? Should the username be automatically received via Site Publish, or do I need to create a tracking rule for this purpose?

 FortiClient - DisconnectedZero Trust Fabric Agent  Register with Zero Trust FabricEnter Server address or Invitation code:Connect 

HiI use Fortigate 101F with v7.0.12 in TP mode, but broadcast drops occur.The configuration diagram is as follows.Normally, there is no problem and when I reboot the server, the communication between the PC and the server side L2 does not work.As a result of checking, the MAC address of L3 was not learned in vdomA.So I put the mac-address of L3 port2 into the mac-address-table of vdomA statically and it works normally. This doesn't happen very often, it happens very occasionally.I enabled broadcast-forward, why does this happen?   

Hi I have FortiNAC version 7.4.1.0451 and Fortigate version 7.2.11. FortiAP 432F, SSID(traffic mode = tunnel) is using WPA2 ENTERPRISE and radius is selected pointing to the fortinac.  Fortinac Winbind status is running and joined to the domain.I get access-reject error in log. radius not enabled on device.   

Hello,Summary:I have a MSSQL DB, and i have an application which sends its logs to custom tables.Task:Can I use the JDBC connection to connect to these custom tables, and retrieve the table's columns, then I create the parser? FortiSIEM 

I have created an InterVDOM link on my firewall (7.4.7), and it can renew existing leases, but I canot seem to be able to get any config which will enable new leases to be obtained / givenThe topology is a remote site has a VPN back to HQ.  The remote site has DHCP Relays configured, pointing to DHCP servers on the LAN.  The setup works perfectly when routing the traffic from our VPN vdom to our LAN vdom over the internal switching.  But once I try and route the traffic over an InterVDOM link, all traffic other than new DHCP leases work.  As soon as I disable the policy routes, the DHCP and everything else works.

Hello TeamAm inquiring if any user has been able to set custom  email notifications for the fortinac like  Authentication failures or a connected device  instead of using the default email .#Fortinac Email notifications

Hi Team,We have integrated the FortiGate firewall with FortiClient EMS and are currently in the process of applying posture checks, specifically focusing on enforcing Antivirus (AV) software compliance on vendor laptops.The tags created within FortiClient EMS are being correctly pushed to both the FortiGate firewall and the FortiClient. These tags have been referenced in a firewall policy associated with remote VPN access. However, we are encountering an issue: when the VPN connection is established and the EMS tag is active, the destination resources become unreachable, despite the antivirus being installed and running properly on the vendor's workgroup laptop.We are testing on Azure IdP user and create a separate user for the vendor.Conversely, when the EMS tag is not applied, the destinations are reachable without any issues.Could you please advise what might be causing this behavior and suggest possible steps to resolve it?Thank you for your support.

On my FG firewall I have defined MGMT as OOB / dedicated management, and the firewall is in L2 / Transparent mode. One interface PORT1 from firewall is connected to the switch VLAN-1 and MGMT on the same switch VLAN-1. In this case is there a possibility of L2 loops formation on Switch? 

Hello everyone, I recently uploaded some images from Fortinet on my eve-ng, however, it turns on and seconds later it turns off, has anyone had this problem? I have other images that work from Cisco etc.

Hi guys, Can i get some help here? This is my first experience with FortiSASE. I have 2 sites: 1 in NL & 1 in the USA + Remote users in NL, USA, and Bangkok)I'm planning to deploy 2 FortiGate in each site in Active Standby setup. Each FortiGate will have 2 internet uplinks.Would you please advise which deployment guide should I use? When checking the KB, i get lost!What i understood is that I've to create SPA tunnel to the FortiSASE and deploy BGP for routing. but in the KB there are so many types of deployments!The sites should be able to communicate with each other in a secure channel.The users should use the FortiSASE to connect to the internet.I would like to use the forticlient to access the fortigates via its management interface. I already registered the fortigates/licenses and chose 2 PoPs in Europe and 2 in USA. Thank you in advance. RegardsSaid I re  

I am trying to connect to a fortigate 80E running 7.4.7 to roll back a software version but I am having difficulty connecting to the console during the boot process. I can connect to the console port via putty when the Fortigate 80e is booted and up and running. Putty is set to 9600 8 n n 1 But when the system boots, the system outputs odd characters until the boot process is complete, then I get the login prompt I read that the Baud rate changes to 115200 during the bootloader stage and then returns to 9600. However, I have tried changing putty to 115200 and rebooting and I still get garbled output.I have tried 9600, 19200, 38400, 57600, and 115200 but all output bad characters. I have also tried a FortiGate 60E, which has the same issue. I have also tried a FortiGate 90D at 9600 and this works just fine. What are the correct settings for an 80e running 7.4.7?What else can I try? I don't understand why this is so dificult

I need to create a VDOM (named it VDOM-A) which will operate in Transparent mode with two interfaces. I want to set all firewall management using Root domain on MGMT with out of band. Is it mandatory to assign an IP address to VDOM-A at any level? In L2 mode, can it operate without assigning any IP to it?

Hi! I created a hardware switch interface type, with 2 physical ports, and cannot delete it.It's grayed out, even if I try to disable them. How is it possible to delete them, please? TY

Hello, we just changed a FG cluster and we have FG90G with 7.4.7. I know that 7.4.8 does not support SSL VPN anymore so I guess we have no other option than changing from SSL VPN to IPSec. I am trying to build up the IPSec connection same way like the SSL VPN but I cant connect. Of course standard IPSec DialUp connection is easy and always works but since we have a lot of Groups and I want to control them with Policies I dont get it running. Incomming Interface is clear, the same and I know that it doesnt block any trafficClient address range I use the same object SSL VPN rangeAccessible Networks all since I also have to route them to Azure and our VPNs (like SSL VPN)PSK I checked many times, this is 100% correctXAUTH Inherit from Policy So in the IPSec to LAN policy I just copied from SSL VPN the same range and my TEST User, destination and service all. I try to connect but I get in the Client a failure of wrong credentials and than VPN connection failed, chec

Hello everyone, I have read the documentation and multiple community posts, but I'm still confused if a FortiGate can act as an IPAM server alone? The documentation says the FortiGate can act as a standalone IPAM server:https://docs.fortinet.com/document/fortigate/7.4.8/administration-guide/166728/configure-ipam-locally-on-the-fortigate  But I also have seen community post that say the opposite:https://community.fortinet.com/t5/Support-Forum/IPAM-feature/td-p/312696 https://community.fortinet.com/t5/Support-Forum/IP-Address-Management-IPAM-feature-on-Fortigate-enable/td-p/260963  So can a FortiGate be a standalone IPAM server or no? The documentation isn't very specific for a standalone FortiGate that manages multiples networks or maybe I have missed that part. Also when I configure an interface on the FortiGate for IPAM, with rules and all, it doesn't configure the DHCP server on the interface. It leaves the DHCP pool blank even though screenshots wi

Hi everyone,I’m working with a FortiGate 100F where interfaces X1 and X2 (10 Gbps) are in a dedicated VDOM used only for public-facing web services. We’re using SD-WAN and Virtual Servers in ssl-mode half, with a wildcard certificate to handle incoming HTTPS traffic for different subdomains like cloud.mydomain.com and nest.mydomain.com.Here’s my situation:I’m not a networking expert — actually, I’m pretty new to FortiGate and still learning as I go. It’s a small company and we all wear many hats, so I do a bit of everything, from servers to firewalls to figuring out reverse proxies when needed :grinning_face_with_sweat:Inside the server called nest, I’ve got multiple virtual hosts configured (for Joomla, Unity, etc.), and I’d love to route incoming HTTPS traffic based on SNI — ideally sending requests for cloud.mydomain.com to one backend, and nest.mydomain.com to another, or at least letting a single server like nest receive the correct traffic and handle it based on the domain.From w

Hallo everyone. I recently started working for a company that has this network topology.I see that the Aruba switches are set to MСLAG with Fortiswitches, but from the Fortiswich side there are no MCLAG settings. At the same time, Fortiswiches are online and available through Fortigate. I tried to set up MСLAG on FortiSwitch, but I encountered the fact that the Aruba side is specified as native VLAN 4094, and there is no such VLAN on FortiSwitches, at least I don’t see it through Fortigate GUI.Should I create a new VLAN with ID 4094 or is it better to change the native VLAN on Aruba?I am confused that VLAN with ID 4094 is specified everywhere in Aruba settings as native and the network works.