Solved

We have a few new FortiAP's (running FAP 7.4.5) and managed by our FortiGate (running FOS 7.4.8).  I would like to allow our laptops to automatically connect and authenticate to our Wi-Fi network using their machine  certificates.  We have an internal Windows CA and are using Windows NPS as a RADIUS server, is there a guide available to get this working properly on the FortiGate RADIUS and SSID configuration side? I've been spinning my wheels on this for awhile now.  Do the FortiGates/AP's even support EAP-TLS (or EAP-TTLS) or do I have to stick with MS-CHAP-V2?  When adding the RADIUS server in the FortiGate, MS-CHAP-V2 seems like the limit. Thanks! 

hi everyone,running fortios 7.4 on fortigate 70g with sd-wan across three wans (all have fixed external IPs):isp1: cable internet (docsis, static config, no dhcp passthrough)isp2 & isp3: two separate 5g connections (fixed external IPs, but dhcp passthrough to the firewall, ip/netmask/gateway set automatically)the problem:isp2 & isp3 work perfectly — they show dynamic 0.0.0.0/0 routes and are fully used by sd-wan.isp1 needs manual ip/netmask and a static route. it shows “up” in sd-wan but carries no traffic unless both 5g connections are disabled.routing table shows isp2/isp3 dynamic routes at the top, while isp1 sits static and is ignored.isp1 says enabling dhcp passthrough on their docsis modem is too much work and would break their provisioning, so they won’t change it.questions:any supported way to make sd-wan handle static-only wan links?any cli tricks to make sd-wan treat that static route like a dhcp one?would upgrading to 7.6 help, or is this just a hard limitation?need

Hi,We have integrated fortigate with forticlient EMS, the remote access profiles and EMS tags are able to push on the forticlient successfully. We are having a scenario.In forticlient, after connecting the EMS through its IP, if profile didn't pushed and we manually enter the SSL VPN remote gateway and sends a connection request, it gets connected.Whereas we want to restrict it such that VPN will only gets connected once its profile will pushed from EMS, if we manually connect the SSL VPN, it should restrict. We have also implemented a scenario like VPN will only be connected once EMS gets connected, but now we have another challenging scenario which I had mentioned earlier. I request the seniors to please help out on this. Thanks

Hello everyone, I am trying to figure out if it is possible to use mclag and fortilink to connect the following devices together and how to do it. I have thought of two possible scenarios, but I am not sure if either of them is possible, so I am asking for your opinion. In the first case, I am afraid that I do not have enough ports 10gbit ports to create all link connection, while in the second case, I am afraid that it is not really feasible because I would basically want to have two independent tier1. I don't need guidance with the configuration, I just need help understanding which scenario might be the best one. The system will consist of the following devices, each with four 10Gb ports, which I would like to implement (using fiber SFPs to connect everything). 1x Fortigate FG-120G2x Fortiswitch FS-448E-POE2x Fortiswitch FS-424E-POE FirstHere I don't have the fifth 10Gb port in the 448s to be able to go from the first 448 to the second 424 and from the second 448

We are migrating our network infrastructure to FS1048e switches. We have some legacy equipment that  refuses to communicate at a port speed of 1Gbps. The transceivers we are currently using are FN-TRAN-GC. Copilot suggested FN-TRAN-SFP+GC, but the website it referenced is a third party site that doesn't give me much confidence in its accuracy. Our requirements for the transceiver are an RJ-45 connector, compatible with the FS1048e that can operate at a speed of 100Mbps. Has anyone else run into a similar need and found a working transceiver for the FS1048e?

We have been going through the process of setting up our Firewall to access Forticlient connections. All went well with connecting via just a Pre-Shared Key but we wanted to implement Saml using Entra ID. We went through multiple documents and have everything setup correctly (At least we think so). When we try to connect we get the popup to provide our credentials. After the credentials are submitted we are shown a <FQDN> server IP address could not be found. I made another connection using an external browser and when I make the connection I can see it sending the request to our Public facing IP address and then resolves to <FQDN>/remote/saml/login. The message in this window is 'can't reach this page'. There are Firewall policies setup to allow all traffic from the VPN Tunnel so we can verify that it works before scaling back but still does not work. The only thing that comes to mind is I read that the <FQDN> needs to be reachable from the internet. Ours i

Hi,I am planning to use ADC in transparent mode and would like to know if there are any limitations compared to L3 mode. I couldn’t find clear information on this.For example, are there fewer load-balancing methods or health check options available in transparent mode than in L3 mode?Regards, # https://docs.fortinet.com/document/fortiadc/7.2.4/handbook/592141/transparent-mode

Hi FNAC AdmisFortiNAC-F 7.2.9Ruckus ZD1200 v10.xThe WLC doesn't support CoA. So if I understand well the FNAC will send a RADIUS disconnect request in order to change the client's VLAN. But this doesn't happen.The test I've made is to fail the scan of the client. When the client is in wire network it is sent to quarantine, however when it is on WiFi it is not sent to quarantine and not even disconnected.Furthermore when the host is at risk and I try disconnect and reconnect to the SSID, it is put in the production VLAN instead of the isolation VLAN.Followed FortiNAC's "Ruckus Zone Director Wireless Controller Integration" document, but it doesn't mention anything about the issue and its resolution.

Setting up a FortiGate for multiple distinct schools (30). Each requires custom web filters. We manage all sites under one VDOM. Configuring custom web filter settings were a category is blocked and they want to allow a specific site. Block social media but allow Facebook. Once a category is blocked, an allow does not work. So we started to create custom categories for web rating overrides. We must of hit the limit of custom categories "maximum number of entries has been reached", we have 52. Is there a way to increase that number per VDOM? v7.4.8

Hi,I am tryingt to switch form ssl-vpn to ipsec dial up vpn. I worked on this for days now. No success. I have got a Fortigate 80F with Fortios 7.2.1 and FortiEMS & Forticlient running (Forticlient 7.2.11 / FortiEMS 7.2.10) There are 4 IPSEC Site2Site tunnels Forti to Forti1 Dialupconnection (IPSEC) with fixed IPs (local and remote)1 Dialupconnection (IPSEC) with variable dial up IP (IKE V1) And now I try to add an additional IPSEC-Dialup-Access.I configured the Fortigate as follows:NetworkRemote Gateway Dialup, Interface WAN1IPv4 client range: 172.16.10.1-172.16.10.30/255.255.255.255 (even tried 255.255.255.224)IPv6 is not used but there is: ::-::/128 AuthenticationPre-shared KeyIKE Version 2Accept Peers: Specific Peer ID: homeoffice.local P1 ProposalAES128-SHA256 / AES256_GCM-PRFSHA384DH: 18Key-Lifetime: 86400 P2 SelectorsName HomeofficeipsecLocal Address 192.168.10.0/255.255.255.0Remote Address: 172.16.10.0/255.255.255.224 P2 ProposalAES256 SHA

Hi FNAC adminsI see FNAC-F doesn't support SCEP.Anyone knows when it is planed?

Hi FNAC adisOn FortiNAC-F 7.2.9 we can see logs of local RADIUS but can't find anywhere the logs of RADIUS proxy.Any idea where we can find that?

I have 2 VPNs configured in my forticlient VPN, one of those works fine but the other after it connects I can't acess any server in my network.I checked that it shows that Received bytes are constantly at 0. I was using an older version of the client for years until it stopped working for this 2nd VPN, then I updated it to version 7.4.0.1658, but the problem continued. Can anyone help me understand what is the problem?

Hello, in the proccess of troubleshooting my Entra SAML DialUp IPsec tunnel I noticed something weird. While SAML auth via TCP 9443 worked fine, the handover to the IKE negotiation didn't work. There were no packets being received by FortiGate referring to IKE negotiation or ESP, only SAML via 9443. I was blaming my ISP first but running a local Wireshark on my WiFi interface revealed that there aren't even packets leaving my device for that peer IP referring to IPsec. To limit potential sources of errors, I replaced the SAML auth with a local firewall user and tried to log in. However, that doesn't work as well. Now there are NONE outgoing packets to the gateway IP! Upon login, FortiClient freezes for a bit and then says "IPsec connection is down" - like without even trying. I tested on 3 diferent devices now and I can't get it to work. My only assumption is that Wireshark doesn't capture the traffic to the gateway and that there's an iussue somewhere in the config

Hello FortiNAC community We have FNAC 9.4.3 controlling WiFi access with FNAC local RADIUS + Winbind.All works fine except when a user's password has expired.With our old MS AD RADIUS, when user with expired password wants to connect to WiFi, it asks him to reset his password. However with FNAC RADIUS it doesn't, so the user is unable to connect and unable to reset his password. Any useful idea would be appreciated. 

Hello all, I am currently setting up 802.x1 EAP-TLS authentication on an external cloud radius server on my FortiSwitch 448E-POE (Fortilink) and am experiencing a minor issue.Basically, I wanted to do this via TLS TCP (RadSec).I noticed that the FortiSwitches only send the packets as UDP. Presumably, the current FortiSwitch FW S448EP-v7.6.2-build1085,250526 (GA) does not support TLS over TCP, is that correct? In any case, there is no mention of “set transport-protocol tls” in the radius profile on the switch.The FGT with FW v7.6.3 build3510 (feature) seems to support this; at least, I can see that the packets are sent as TCP and they also arrive on my RADIUS server.In any case, I have now adjusted the RADIUS client so that it performs authentication via UDP on the RADIUS server. The query is also successful and arrives at the RADIUS server.The problem is that when I try to authenticate on a port of the FortiSwitch, no packets arrive at the RADIUS server. In debug mode, I can see t

Hi everyone!, I'm currently facing a problem with DDNS associated with fortiddns.com. The service isn't updating and returns an update error. Additionally, when I attempt to edit the configuration, no servers appear as available. This started after the DNS incident. I have another FGT 100F with the same configuration and it's not experiencing the issue. Has anyone else run into this problem?Any insights or suggestions would be appreciated.best regards! 

So we trying to setup a new Dialup IPSec tunnel but we keep getting a connection time out message. We rebuild the tunnel and policies multiple times thinking we missed a step but from the videos we found online this should be the simplest thing to do. I can see the traffic make it to the firewall and I see in the local traffic logs that the traffic is denied (even though we setup local-in-polices) to allow the IKE traffic.  So we are stumped and we are hoping that we are missing something simple that a more experienced person setting these things up might clue us in on. Our firewalls are running 7.4.8 and we are running Forticlient 7.4.3 (We've also tried 7.0.9 and 7.2.9 since some posts we stating older versions worked vs the latest version). I feel something is blocking the traffic on the Firewall I'm just not sure what it could be. Thanks for all and any help. Phil

Hi community,I have the following VoIP setup:Avaya IP Office v2 --- FG-80F --- ISP1 / ISP2 (SD-WAN)My goal is to configure a simple failover, where the FortiGate automatically switches to the secondary ISP if the primary link goes down.However, I’m running into the following issues: With SIP helper / SIP ALG enabled:Once the SIP communication is established (INVITE, ACK, etc.), the SIP ALG forces the voice traffic to go out through the failover link (ISP2), even though it should stay on the primary.This breaks the voice session.I’ve tried separate rules and SD-WAN policy routes, but the issue persists. With SIP helper disabled (no ALG):The SIP/SDP packets are sent out through the correct WAN link.However, the SDP headers are not NATed and still carry the LAN IP address.As a result, packets reach the destination but the remote side cannot reply. Has anyone faced a similar scenario?I solved this problem configuring the wan ip on the avaya but just can set 1 of them so if m

Hi,When I add new interface, I cannnot Hardware Switch Interface Type.CLI too,======================XXX(test2) # set typevlan VLAN interface.aggregate Aggregate interface.redundant Redundant interface.loopback Loopback interface.wl-mesh WLAN mesh interface.fext-wan FortiExtender interface.emac-vlan EMAC VLAN interface.ssl SSL VPN client interface. CLI too==========================# set typevlan VLAN interface.aggregate Aggregate interface.redundant Redundant interface.loopback Loopback interface.wl-mesh WLAN mesh interface.fext-wan FortiExtender interface.emac-vlan EMAC VLAN interface.ssl SSL VPN client interface.Would anyone be kind enough to tell me the solution?Model:FortiGate-120GOS:v7.4.8 build2795 (Mature)Thank youKenji,

Hello,  I wanted to know if this FG model (FortiWiFi 50G 5G) can be connected to the ISP via a wired access. Meaning, can we use the WAN port to connect to our ISPs PE?  Thanks in advance.  \Best, ~zK 

Hi there, I have an FG40 behind the ISP router (and I can't remove it) whit a NAT 1:1 configuration.With a phone (connected to WLAN) I have to reach the NVR (connected to LAN) pointing to the public IP of the office.If the phone is outside of the office, pointing to the public IP, I can reach the NVR because I have created dedicated rules on firewall.If the phone is in LAN (WLAN but is the same), pointing to the public IP, I can't reach the NVR.How can I solve this ?Thank you 

I have FortiGate-VM in AWS 7.6.2, FortiManager 7.6.2, FortiEMS Cloud 7.4.   I am slowly rolling out ZTNA in place of SSL VPN.  One of the most annoying things I have run across is that its super easy in FortiManager and FortiGate to show which users are actively doing SSL VPN.  But there does not seem to be any such way to show who is actively using ZTNA. I can manually comb through the logs but thats a pain.  Is there some easy way to see who are the active ZTNA users?

We have 2 sites (SiteA & SiteB) that have 2 VPN tunnels with HQ. e.g.:  SiteA ---- HQ ---- SiteBNow I can access to HQ on site A and access to HQ on siteB.Can I access to SiteB devices on SiteA?

I ADVPN with BGP and SDWAN enabled, is add route in the VPN Phase1 Interface should be enabled or diasbled?