Solved

Hi everyone,I'm currently configuring SD-WAN on a FortiGate device, and I’ve noticed that the default routes (0.0.0.0/0) are not being generated automatically for all WAN interfaces as expected.I have four WAN links added as SD-WAN members, and SD-WAN is enabled. However, when I check the routing table, I only see two default routes. I was expecting FortiGate to automatically generate a default route per interface when SD-WAN is active.Here’s what I’ve done so far:Added all interfaces to the SD-WAN zoneAssigned gateways for each member (both working members are configured via DHCP)Checked SD-WAN rules and performance SLA (removed them just for debugging)Verified that all interfaces are up and reachable (adding a static route for my source IP, just to check ping over internet)Still, the routing table doesn’t reflect all default gateways. I suspect I might be missing a step or perhaps some specific configuration is required to force the routes.Has anyone faced this issue before? Should I

Hello everyone,There is some study material on the training institute portal or here on the Fortinet support page regarding the configuration and functionality of a Fortigate used as an IDS/IPS probe.I would like to learn more about this and the admin guides just tell you step by step how to enable or configure a certain function.Thanks to all

FortiWEB full URL RewritingHello Team,i'm trying to rewriting this site From https://Example.com/xyz/#/t yuto https://test.qwe.com:447/   still not working 

I have cause to pull some information from a device connected to one of our switches (FortiSwitch 124F-FPOE), which are connected to / managed by our ForiGate's. Commands such as diagnose lldprx neighbor summary work fine in the CLI of the FortiGate, however it then only see's the devices connected directly to it. If I open the CLI on the switch and run the same command I get. command parse error before 'lldprx'Command fail. Return code -61 I then tried to enable LLDP in case it was off and that was causing the first error, however I have tried going to both config system global and config system settings and running set lldp-reception enable but I just get a similar error. command parse error before 'lldp-reception'Command fail. Return code -61 Any idea what I'm doing wrong? 

Dear all, In FAC 6.6.4I'm facing an issue while trying to sync remote LDAP user group with more than 500 user (510 exactly).The sync rule fails with error Unable to query remote LDAP server SRV_LDAP (ldap.xxx.xxx.xxx.com) for users to sync (rule xxxxxxxxx): ldap_search_ext_s search failed: Size limit exceededIs there a way to overcome this limit? What are the options to sync and use large LDAP groups? I didn't find anything in the documentation related to ldap group limit size. Thank you all! Best Denis

The LDAP configuration on FAC works fine when tested from the FortiGate, but after I enabled FortiToken on FAC, the VPN connection fails. Why is this happening?FAC version: 6.6.2FG version: 7.4.7FortiClient version: 7.4.3.1790

Hello,I need to migrate an SSL VPN from a fortigate 7.2.10 to another fortigate 7.4.8, but the SSL VPN feature doesn't exist; I tried to enable it via CLI and it doesn't appear either set gui-sslvpn enable Fortigate 180F

Greetings, I am configuring RADIUS authentication on my Fortigate 101F running FortiOS Version 7.4.3. The Microsoft NPS Server has been configured according to this guide. My radius configuration is as follows: config user radiusedit "RADIUS"set server "172.16.9.3"set secret PSKset nas-ip x.x.x.xset auth-type ms_chap_v2set source-ip "x.x.x.x"nextend The connection between the Fortigate and the NPS is successful, but test user credentials test fails. The CLI test output is as follows: diagnose test authserver radius RADIUS mschap2 user passwordauthenticate 'user' against 'mschap2' failed, assigned_rad_session_id=1486429090 session_timeout=0 secs idle_timeout=0 secs! Running a packet capture between the Firewall and the Radius Server I get an access-reject response with the following MS-CHAP error Code: 3ID: 190Length: 42Auth: 91 C7 F9 28 0A 50 59 33 13 39 B3 75 58 04 AC EEAVP: l=22 t=Vendor-Specific(26) v=Microsoft(311)VSA: l=16 t=MS-CHAP-Err

We have the below assets:Windows CAFortiNAC-VMFortigate-40FFortiSwitch-108F-POEFortiAP 221EWe are trying to setup the Corporate WiFi Access with FortiNAC, using a certificate. Flow:Users must Connect to an SSID with WPA2 Enterprise and FortiNAC confirms a user as corporate with certificate checking.  We did all the steps we know and when a test pc try to connect in the Corporate SSID, we take the FortiNAC-RADIUS error below: Auth: (93) Login incorrect (RADIUS not enabled on device (Post-Auth)):What is the issue resolving path? Bests,PK

We are planning a FortiSIEM ClickHouse deployment with an expected EPS of 15,000, using the following architecture: 1 Supervisor Node (without a dedicated data disk — i.e., no Disk 5)1 Worker Node (with a data disk, intended to store all event data) We have a few queries regarding this setup:Is it possible to install the Supervisor without a data disk, considering that all data will reside on the Worker and the Supervisor will function solely as a Keeper node? Can we configure the Worker with both “Data” and “Query” roles enabled, and create a ClickHouse cluster with a single shard and one replica without supervisor ? Could you please recommend the most suitable and supported architecture for this 1 Supervisor + 1 Worker node setup? @Secusaurus @Anthony_E could you please help here 

I'm currently setting up an email infrastructure with FortiMail acting as our gateway, and I could use some guidance to refine my configuration for better security and functionality. Here's a brief overview of my setup and the issues I'm facing:Setup Overview:No private DNS server or LDAP.Backend testing with CWP (Postfix, Dovecot, Roundcube + Outlook, Thunderbird as mail client).Two domains to manage.SMTP authentication created on the same mail server.FortiMail in gateway mode with a DNAT VIP redirecting mail.Can send and receive emails inbound and outbound.Issues:Firewall Policies:I need help configuring firewall policies to ensure that SMTPS and HTTPS traffic goes to FortiMail, while IMAP, POP3S, and other services (webmail, etc.) go to the backend mail server.I have only one public IP, so any recommendations for port forwarding at FortiGate to manage services better would be appreciated.SMTP Authentication and Relay:I want to use the SMTP authentication created on the same mail ser

Hello, everyone. I've recently installed FortiClient VPN only v7.2.4 in MacOS Sonoma 14 and tried to restore a configuration file extracted from a Windows device generated on a previous version (v7.2.3) but ran into the "Error importing configuration file" message box. I've noticed some of the xml lines are different from the Windows and MacOS version so I had modified them but as it turns out neither a newly generated backup file from the MacOS installed client seems to be working by restoring it right after being generated. Has anyone of you been in this situation? I've thought about manually creating each VPN but I'm missing most of the PSKs of the IPsec tunnels.  Is there any known workaround or method to restore configurations?  Thanks!

 I do not care what format, it just needs to be better than the "full configuration" human-readable format. on a Juniper SRX , you can typeshow config | display XML job doneI need to get my hands on the Fortigate config in a similar format. I've googled it, and the GUI I'm looking at it  does not seem to have the "export as YAML option. Is there a way to view the configuration in the CLI as XML or anything else?RegardsSimon PS also tried to post in this forum and failed. I get thisPost flooding detected (community received posts of a unique message more than one time within 3,600 seconds)It makes it impossible to post here, trying again after one hour.

I am migrating from a FortiGate 200F to another FortiGate 200F.I did the initial Logging and then created an admin password.then i used the restore function to restore the previous config to the new one.the issues now are that, I am not able to log in using the admin Login i created or any of the login credentials from the restored.Is there something else i should have done ?

Hello.  We have an Active/passive cluster setup with 200F devices that interface with a redundant LAN network. During the setup there were issues with loops occurring that were blocked by STP in the LAN network. The cluster LAN interfaces on the firewalls function as a transit LAN with VLAN sub-interfaces below it for our network hosts.The network loops were mitigated by removing redundant links into the firewalls and the LAN network settings on the Ubiquiti switching equipment. We are not currently experiencing loop issues. But we are now trying to figure out how to fix the problematic setup to remove the STP loops and allow a redundant network.The root cause of the loops looks like software switches on the FortiGate LAN interfaces. Per this link (https://community.fortinet.com/t5/FortiGate/Technical-Tip-Building-redundant-paths-to-switch-network-from/ta-p/279038), they are identified as not participating in STP. And the software switches are also not monitored if a LAN inte

internal DNS to access some of our internal services this used to work though, and today it doest .... what could have changed?  Behind a Fortinet SSL VPN

We have the google FQDN's opened per their suggestion ( https://support.google.com/a/answer/2589954?hl=en ) and ( https://support.google.com/drive/answer/6163291 ) the kids have discovered a number of gaming sites on google homepages, all seem to be named "unblocked games" i.e.https://sites.google.com/site/unblockedgames4mehttps://sites.google.com/site/unblockedgames77https://sites.google.com/site/punblockedgames/ The problem is that blocking google by address doesn't seem to work as every request seems to use a different one, and I don't know why but I don't seem to be able to block by name. I put in a simple IPV4 policy, source = any,  Destination = "sites.google.com/site/unblockedgames4me",  blockand it doesn't work.  because it is a block there is no SSL inspection or anything like that.... When I look at the log there is nothing that says "sites.google.com/site/unblockedgames4me" just "encrypted-tbn1.gstatic.com" but I don't want to blo

I am using forticlient.forticloud.com/ems Version 7.4.3 build1926. I have deployed FortiClient 7.4.3.1790 to my endpoints. I haven't found a way to access my on site DC.

Hello team, I have seen this before, but did not care, however now I need to solve this.Yesterday I have tried to upgrade 2 Fortigates 60F, from 7.4.5, to 7.6.3The recommended path is 7.4.5 -> 7.6.1 -> 7.6.3I could reach 7.6.1, by uploading manually the file, but when I tried to upgrade from 7.6.1 to 7.6.3, this option was not possible in 7.6.1.  I dont have any option to upgrade from file now.I tried to upgrade, following the upgrade wizard, but both Fortigates remained in "Downloading" for about 15 minutes, until appered as "Failed", no more information.I have tried this 3 times in each Fortigate, with the same issue.Both Fortigates 60F are in Argentina.Is this possible to upgrade from 7.6.1 from a file?Is there a way to avoid the Fortiguard/Fortinet servers limitations during the maintenance window? Thanks in advance.Regards,Damián

Hi all, Recently I've noticed that IKEv2 VPN connections from Europe to FortiGate boxes in the U.S. no longer work.  In the past, one could use SSL VPN to get around this issue, but with all the problems using SSL VPN and it being phased out, what are folks using as an alternative?  Thanks

Hello,i have a strange behavior. We have a nextcloud in a DMZ. The DMZ uses a 192.168.x network and a Virtual IP on the WAN is configured for the Nextcloud. From the LAN we access the Nextcloud with the 192.168.x address directly. When trying to uplad a file from WAN that is larger than 100 MB the upload freezes at perhaps 10%. When uploading a 99 MB file the upload works with no problems. When uploading from LAN, i'm able to upload files larger than 700 MB without problems. So in my view it can't be a problem with the Nextcloud. I'm trying to upload from my home and i'm at the same provider, i have only 5 hops to the destination, but from other sources have the same problem. What can i check on the Fortigate, to search for the source of this problem? I have done already a packet trace and a debug flow trace, but here i wasn't able to see a problem, only that the packets stops after a few sec. Thank you!

Fortinet made a change to their FortiOS API get /api/v2/monitor/virtual-wan/members call from version 7.4.* onwards which changed the response. We're making this call to a device running 7.4.8 (via the FortiManager proxy but hopefully that shouldn't make a difference) and the response we're getting is missing the Interface string.{"result": [{"data": [{"response": {"build": 2795,"http_method": "GET","name": "members","path": "virtual-wan","results": [{"link": "up","rx_bandwidth": 17698,"rx_bytes": 10694535825,"state_changed": 1753381417,"tx_bandwidth": 19306,"tx_bytes": 2152017150},The documentation has a little red asterisk next to Interface, but no mention why or what it means: https://fndn.fortinet.net/index.php?/fortiapi/1-fortios/5140/1/virtual-wan/ Does anyone have any ideas how we can make the interface string appear please?

Hello Community,Please for your support.Just a brief explanation of the topology and the case at first. We have a NAC VM Cluster, in which we have enrolled our inventory switches. we want dynamic vlan assignment for the users, based on an the Role attribute that each user has ( attribute 60 = vlan 60). Switches has the respective AAA config and i can see on the NAC that the radius accept is sent when the user is connected to the port. Users have the supplicant configuration for the Radius authentication as well. Thing is that when the user connects on the switch, NAC does not assign any vlan dynamic as it should and it marks the port as down  (not connected), on the nac gui even though on the switch side the port is still up and working on the vlan that it was. normal policies work as it should ( for instance vlan assignment on Cisco IP phones). Below some screenshots that may help The above case is when we try to connect only one device per port. When we have an ip phon

Hi Team,     While I am trying to make a custom parser for Windows/any other device type while using the convertHostNameToIp function with setEventAttribute, validation shows failed.Full function is below:<setEventAttribute attr="srcIpAddr">convertHostNameToIp($_saddr)</setEventAttribute>Below is my custom parser for testing.  While testing with other functions like resolveDNSNameAll other functions are working fine except convertHostNameToIp. Please give me any suggestions for this issue.Below is my custom parser.Validation failed: convertHostNameToIp<eventFormatRecognizer>TMSSQLSERVER</eventFormatRecognizer><parsingInstructions><collectAndSetAttrByKeyValuePair sep=" " src="$_rawmsg"><attrKeyMap attr="hostName" key="Host: "/></collectAndSetAttrByKeyValuePair><setEventAttribute attr="srcIpAddr">convertHostNameToIp($hostName)</setEventAttribute></parsingInstructions>Validation is pa

Hi A customer of mine grants me access to his network using forticlient. I installed the Ubuntu version using the official repos from here https://www.fortinet.com/support/product-downloads/linux Now I'm getting this error message FortiClient SSLVPN is unavailable: FortiClient VPN trial has expired.Please contact your administrator or connect to EMS for license activation. Looking in other threads (https://community.fortinet.com/t5/Support-Forum/Forticlient-free-version-expires/m-p/231) that I need the "FortiClient VPN" only. However I don't know how to get that. I've found this article https://docs.fortinet.com/document/forticlient/7.2.2/administration-guide/666761/linux but I'm not sure how to get any of these files. I'm able to log in support.fortinet.com, but if I go to Firmware downloads, I only see a blank list and the error message Sorry, you don't have any product covered by a Fortinet support contract. Where do I get