Solved

Hello guys! Got a bit confused with FG's auth process for remote ssl-vpn users. For now we have a simple LDAP/AD (w/o agent) based authentication for remote users and ACL based on AD group names, everything just works and works fine. Now I got the case that I have to implement MFA via an MS NPS(plus azure MFA) as a radius server (please don't ask why). I don't understand how to implement this transparently. Do I have to add all existing groups by name in the same way how I do this with LDAP into each ACL(that's could be long, but ok)? And how the FG knows in which group a user in ? What if the user is in several groups? So can anyone elaborate these moments ? I read this article , but it's still unclear https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-User-Groups-to-match-multiple-Remote/ta-p/358789 AFAIK the FG gets the group name AVP from the radius server (MS-NPS) , but is it all groups for each client or like a first group per client ? Do we have to change sett

Hi!  We have a pair of Fortigate VM64 in HA on VMware (provider is OVH).We are migrating clients from PaloAlto to this Fortigate. We have around 30 VDOM (and we need to add more), with VDL link to the root.We have EMAC VLANS for the interface (WAN, Private and DMZ). It is working, but when the sessions increase around 30K and higher, everything become very slow.The ping between private and dmz inside any vdom increase around 100-150ms with lost packets. The CPU is used max 20%, and the memory around 60%. We have a ticket with Fortinet, but for them , with a packet capture, there were able to show that the fortigate don't add any latency in the packets. We move back one of the client to PaloAlto and they are now happy!The PaloAlto use the same VMware farm. To be able to make the EMAC VLAN and VDL work, we needed to enable the promicious mode on the port group on VMware. Maybe this is the problem. The links are 10GBs, and the traffic on the trunk t

Hello expert. i Humbly request some guidance. I have a fortigate 80F and tried connected  to manage the  fortiswitch 524D via fortilink but the following error  "offline" (see screen shots) I have included a two screen shots for clarity.    Regards

Hi all, I'm an experienced network guy with 28 years of experience, but it's all Cisco. I'm new to Fortinet. Here's my question: I'm working on a design for a customer with multiple satellite offices that connect back to two datacenters (primary and DR). They are all interconnected with two layer-2 ELAN WAN meshes.  I want to centralize all of my routing onto the Fortigate firewalls at each location. But because the WAN links are from two separate vendors each Fortigate is going to have two physical handoffs, one to each vendor's network. My plan is to create a WAN zone on each Fortigate and then put both physical interfaces in that same zone. (I don't need any filtering/firewalling between those interfaces.) I'm trying to find out if I am going to run into any asymmetric routing issues. The WAN circuits will be load balanced so I can't promise that packets  from a particular session that go out on one vendor's circuit won't return on the other vendor's circuit

Based on another solution by @funkylicious we created a FQDN that was addressable from the internet. We also created a certificate with the FQDN in the common name and the IP address in the Subject Alternative Name. When Forticlient tries to connect to the FQDN the web browser states the connection is not private and lists that the Cert Common Name is Invalid. I notice in the address field that instead of the FQDN being listed it is showing the IP address. I thought that have the IP address in the SAN would address this. Our security policies do not allow users to continue if there is a security certificate mismatch. So trying to figure out why the IP address is showing up when connecting to the VPN instead of the FQDN. Do I need to make another certificate that explicitly names the IP address instead of the FQDN?

Hello   I'm having trouble configuring an IPsec VPN. I configure one IPSec VPN and everything works fine. Clients connect and everything works fine. When I add another VPN, the previous one stops working. Below is the configuration of the first working VPN:                  I'm adding a second VPN    After adding a second VPN, "VPN_Gamma," the first one stopped working. Only after disabling the vpn_VPN_Gamma_remote policy did the first VPN start working again. What could be causing this?

Hi,I am considering using destination NAT on the secondary IP address of the internet-facing port to build a DMZ network.Although I were able to configure destination NAT for the secondary IP address, but it is not working.My hypothesis is that the product's specifications might prevent a secondary IP address from being used for destination NAT.I appreciate any advice from someone with knowledge on this.Thanks,Kenji

I have been discussing if a Fortigate HA in A/P can work with BGP/EBGP from a single ISP.  So I wanted to see what exactly is possible.  The ISP was going to be providing the routing on their side with my firewalls accepting the connection.  I have put a logically diagram of what I am looking to build.  

Hi, Just want to know if FortiManager can access FortiSwitch CLI or edit the port of the FSW? If not, is it included on the future improvements/NFR of Fortinet? Thanks.

Hi, seeking for your insight regarding on VTP testing between 2 Cisco Switch connected to 2 FortiSwitches. I already enable flood-vtp on both fortiswitches and cisco switches configured as server and client mode.  After a change in the server cisco switch, FortiSwitch hang up and cisco switch port hang up also. Possibly due to VTP traffic flooded to the port. 

HiI have a new Public Certificate and need to upload it to FortiManager VM 7.4.5I select the certificate and private key, enter the certificate name, enter a password and click OK.  Then the certificate page refresh but the new certificate it's not there.  No error message appear. I was able to upload the same certificate files to FortiAnalyzer, so the certificate is good.

Good morning, everyone! I have a FortiGate model 100F, version 7.4.7. I configured an IPsec VPN on it for employees to connect via FortiClient. I created the FSSO connector, which brought the groups, and I created the LDAP connection (tested and validated). What happens is: in the VPN policy I created, when I add the group from AD, when I try to connect, it displays an error and won't connect. Looking at the logs, I saw an error called FNBAM_ERROR. What could this error be? Thank you.

Hello, We have been testing IPsec dialup connections using autoconnect and Entra ID credentials and so far it has worked pretty well. One area of concern is how to exclude situations where we may not want the auto connect to kick off (IE, local admin login or a user login that is not a member of the VPN group). We are using EMS to configure FortiClient on Windows devices. We have the VPN tunnel configured for auto connect only when off-fabric which covers a majority of these one off situations but is there a better way to exclude users/situations from the auto connection? Maybe something like "stop auto connection after 3 failed attempts"? We have always up max tries set to 3 but this seems to only cover reconnect attempts. Another thought was creating an additional remote user group on the firewall as a "catch all" group for users who are not members of the defined VPN groups and allow them to establish a vpn connection but  go out the WAN only. Local accounts off-

After updating the firmware of the Fortigate 60F from 7.2.2 to 7.2.4, I encountered that SNMP responses stopped coming from the interface configured on the non-managed VDOM.The configuration is as follows: SNMP server → Managed VDOM → Non-managed VDOM (SNMP target interface).The administrator's trusted host is also registered with a /32.The firewall policies between the VDOMs are verified to be correct. No changes were made during the update.Additionally, I have configured the set vdoms as described in the URL below, but nothing has changed.https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Configure-SNMP-in-multi-vdom-to-send-trap-to/ta-p/398884 When checking the communication logs in the managed VDOM, allowed communication from the SNMP server IP to the SNMP target interface is visible. However, in both send and receive directions, the received byte count is 0B.Using a sniffer in the managed VDOM, no response packets are observed.Similarly, a sniffer on the non-mana

Just need a little validation check against something I am implementing yet feel like I am losing something as well. What I mean by that is, I have in my environment, an edge firewall (this is where my users get their primary Internet from), a core firewall (that is acting also as my core router for my private WAN and firewall for my datacenter servers), and my site firewalls. Most of my security inspection is happening at the site firewalls. Since those traffic flows have now been inspected at the site level, I had no inspection for that traffic at the core if it went to the edge, again with no more inspection at the edge (only inspection was for some segmented VLANs off the core to my datacenter servers, etc...). Now that I want to implement QoS/traffic shaping on some traffic (Apple and Microsoft blowing up my bandwidth), my assumption is that I am going to have to implement traffic shaping also end to end... so edge, core, and site. Am I thinking correct on this? I feel like t

 Hello everyone,We’re currently trying to improve our visibility into offline devices in FortiSIEM, specifically in cases where agents or devices silently stop sending logs.So far, we’ve tested a few approaches for alerting:Rules using Followed By / Not Followed By to detect when events stop coming in.A rule that triggers if fewer than 50 logs are received in 24 hours (since our agents usually send ~2 status logs per hour).Unfortunately, these attempts haven’t worked as expected. We’re also not sure what the default “No Log Rule” actually triggers on, as it seems to be an internal event and generates too many false positives.Has anyone else run into the need for better alerting/reporting on devices that stop sending logs (due to agent failures, collector silent failures, etc.)? If so, how did you solve it?For reference, here’s one of the report definitions we’ve built in an attempt to make this more visible on dashboards:  WITH last_seen_per_ip AS (SELECTreptDevIpAddr,MA

Hey all, I recently setup an IPSec VPN to replkace our SSL VPN using Entra and SAML. I had an issue with setting an authusrgrp in the phase1-interface and getting it to work with the user groups that are SAML based. Unset authusrgrp in Phase-1 fixed the issue, and the FW groups starting mathcing on the traffic, but since I moved away from PSK and onto Certificates for IPSec VPN the same behaviour came back, but the authusrgrp knob is gone now due to the certificates. Can I use SAML based FW groups to segregate traffic while using certs? More specifics;We have departmental groups setup in the Entra application, and we need to make sure their access is restricted as such. I'd prefer to only have a single Phase-1 interface that's a 'catch all' for all SAML users (single IP range for all) and let the FW determine who can access what by the SAML groups, if possible.Any thoughts on what might be causing the FW groups to not match on traffic? 

Hi all,   We have 2 X 100D Hardware Appliances running firmware version 6.0.4 (build 0231 GA) in NAT (Flow-based) Mode (HA: Active-Passive).They primarily protect our wireless network which is open to use by staff and visiting members of the public. In general we do not do full SSL inspection.However, I have been testing 'Full SSL Inspection' on a few devices. I have downloaded the Fortinet_CA_SSL certificate from the firewall appliance and installed it on my test platforms (Windows & Android).On the whole, most things appear to work fine except Google Play Store on the Android device, it just won't connect to Google Play at all. If I revert to default SSL Certificate Inspection everything works fine.My Web Filter Policy blockes sites categorised as Advertising and Web Analytics. My Application Control Policy also blocks Google.Ads and Google.Analytics. It should be noted that when I allow these applications Google Play still doesn't work with Full SSL Inspection enabled.My We

We're currently in the process of migrating our FortiManager and FortiAnalyzer VMs from one host to another. We've thoroughly verified the configuration migration from the old instances, but we have some uncertainties regarding the licensing aspect of this transition.Specifically, we’re concerned about the implications of reactivating our existing licenses on the new VMs. Does Fortinet provide a grace period that allows us to run both the old and new VMs simultaneously during the transition? We want to ensure that we can safely shut down the old VMs without encountering any licensing issues.Any insights or suggestions on this process would be greatly appreciated. Thank you!

Hello, I am encountering an issue with my configuration that I am unable to resolve. I have two sites connected with VXLAN over IPSEC. On each of my sites, I have two VLANs (VLAN 10 and VLAN 20).  Here are my tests: SITE A / VLAN 10 successfully pings SITE B / VLAN 10SITE A / VLAN 20 successfully pings SITE B / VLAN 20SITE A / VLAN 10 successfully pings SITE A / VLAN 20SITE A / VLAN 20 successfully pings SITE A / VLAN 10SITE B / VLAN 10 successfully pings SITE A / VLAN 10SITE B / VLAN 20 successfully pings SITE A / VLAN 20SITE B / VLAN 10 successfully pings SITE B / VLAN 20SITE B / VLAN 20 successfully pings SITE B / VLAN 10However, SITE A / VLAN 10 cannot ping SITE B / VLAN 20SITE A / VLAN 20 cannot ping SITE B / VLAN 10SITE B / VLAN 10 cannot ping SITE A / VLAN 20SITE B / VLAN 20 cannot ping SITE A / VLAN 10Do you have any idea why? Thanks for your help!

Hi,  I am deploying 2 FortiSwitch 3032E as core/Tier1 and Multiple FortiSwitch 2048F as distribution/Tier2. 3032E are now manage by FortiGate 3701F, when I am adding the 2048F I connect the port using 100G transceiver to 3032E. There was no LED light indicating that is not physically connected correct? And on the FortiGate side, I cannot see the serial of the FortiSwitch. What do I need to do next. thanks.

I may have to edit the Subject once I have a better idea of what is going on. We successfully configured our IPSec Dial-up tunnel last week and we were able to successfully login and get assigned IP addresses. Now today I tried to login and I put in my Entra credentials, and it says it successfully logged me in but nothing happens. I just see the VPN Name and the Disconnect button. No metrics or my assigned IP address like before. I verified that I did not get assigned an IP address and the tunnel is not showing up. My coworker proceeds to sign-in and it works just fine.I ran the debugger and compared my connection to his and I found only one difference between our logins. After we get the response back from Entra his logs show the following:    __saml_auth_cache_push-New auth cache entry is created, user='{randomNumbersSet01}', saml_user='{username}', expires=1756916400, SAML_server='{SamlServerName}' Now mine is a little different:    __saml_au

Hi, I have 2 Q regarding to Fortigate A/P. Now I have my 901 FG with a dedicated port for HA. I will make this port for Heartbeat. And I do have 2 fiber links as well for HA with normal ports. Is the best practice to keep the HA default port for heartbeat sync, and use the 2 extra fiber ports for session sync only? Or there is no way to segregate between heartbeat and session synchronization, so I have to keep all of them in the heartbeat option? The second question is, I have enabled the HA with no license on my firewalls when I want to add the license for my firewalls. Is the correct way to remove HA back to standalone mode and then enable the license on each box and return to A/P mode? thanks 

hi,i'm trying to document our FG. how do i view/check the configured pre-shared key string?can this be viewed in the GUI or via CLI only? where in the GUI or what command to use?

Hello, I am trying to find a way to make an auto stitch to trigger and work when a user disconects or connects on a remote ipsec tunnel and send an email. I have it set up but cant see emails comming. Any ideas?  FGT60F # config system automation-stitchFGT60F(automation-stitch) # edit "VPNIPSEC"FGT60F (VPNIPSEC) # showconfig system automation-stitchedit "VPNIPSEC"set trigger "IPSEC VPN UP"config actionsedit 1set action "Email Notification"set required enablenextendnextendFGT60F (VPNIPSEC) #  config system automation-triggerFGT60F (automation-trigger) # edit "VPNIPSEC"new entry 'VPNIPSEC' addedFGT60F (VPNIPSEC) # showconfig system automation-triggeredit "VPNIPSEC"nextend config system automation-actionFGT60F (automation-action) # edit "VPNIPSEC"new entry 'VPNIPSEC' addedFGT60F (VPNIPSEC) # showconfig system automation-actionedit "VPNIPSEC"nextend