Solved

Hello.  Does it matter if the mode of the policy and the mode of the web filter are different except when Fortigate's policy is flow mode and web filter is proxy mode? Thank you. 

IPSec VPN with SAML was configured according to https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-Microsoft-Entra-ID-SAML/ta-p/307457. The configuration seems to be in place according to the documentation, but I get ERR_CERTIFICATE_INVALID (which is to be expected), but if I click 'Continue (unsafe),' the Script Error shows up. Error says 'Permission denied,' and the URL says 'about:blank.' If I click 'Yes' for 'Do you want to continue running scripts on this page,' it simply goes back to the untrusted certificate popup. It cycles back and forth indefinitely. Does anyone have an idea as to what I can try? Thank you.  

Hello Running FAZ 7.4.7  What does has this impact on (exceeding the daily logs license)?Does this mean new logs will not be saved?Or it has (something) related to TAC support?  

Hello, I'm trying to configure an IPsec tunnel to replace ssl-vpn, but i can't make split tunnel to work. I have split-tunnel enabled with just an internal network allowed, and a policy that explicity allows traffic to that network. The problem is, once connected, the tunnel pushes a default route to the client, so all the traffic goes thru the Fortigate.I already tried things i saw on this forum but nothing worked To add info; doesn't matter what config i do on the forti or client side, doing "route print" always show a default route to the Forti (when i'm connected). 

Hi NAC admins FortiNAC 7.6.3.FortiOS 7.4.8 managing FortiSwitches 7.4.6. According to "FortiNAC - FortiSwitch FortiLink Integration Guide" doc, both SNMP MAC Notification & Syslog methods are supported.https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/bf034eae-75df-11ef-8355-fa163e15d75b/FortiNAC-F_7.x-FortiSwitch_FortiLink_Integration_Guide.pdf From the pros and cons list on page 7 & 8, am I supposed to I understand that Syslog method is more recommended than SNMP MAC notif method?Anyone tried both and can advise on the best one?

 Hello friends, I'm facing a problem regarding the phAgentManager down process.When investigating the logs, I saw that this is related to the Office365 integration with SIEM. The Failed (Failed to parse hostName(s), invalid hostName or DNS lookup failed.) error occurs when I try to test the credentials that were configured, even simulating incorrect credentials it continues to give this error.I have other API integrations, as well as other solutions and they work normally. The error of failure to resolve the DNS of the Office 365 service seems quite strange to me, I've already checked the DNS issues of the supervisor and there is no resolution problem. I would like to know what I can do to solve this problem. Thank you

Hello, I'm interested in the following type of information.We have configured and set up IPsec remote access VPN on a FortiGate device. At this stage, it works without issues only on version 7.2.When I tried to connect using FortiClient version 7.4, it got stuck and showed the message:"timeout while responding IP address".What could be the cause of this?Have you had similar experience?Please share your experience if you have.

Hello team!! I have many questions about VPN Licences.I think I understand the following, please let me know if I am wrong:* Up to FortiOS 6.2: I have licences for 10 Standalone Forticlient* From FortiOS 6.2 or higher: Unlimited Standalone Forticlients In first place I don't care about support, I am worried about how many client I could connect to Fortigate VPN.What about L2TP VPNs?  There is a limit for the amount of clients?I see an article here for FortiClient, but not for L2TP VPNs. Thanks in advance.Regards.Damián 

Hi guys.I'm trying to upgrade my Fortigate 600E in our production environment. I don't have a forticare account and our contact will get firmware for us. Now I want to verify them by using MD5 checksum. I did a reserach and fortinet said If you go to their site and paste firmware file name, It will give you checksum. But no matter what name I type in bar, It says it couldn't find information about it.Since this is a production unit, I highly appreciate if anyone can give me hash details of these files. Thank you in advance.File: FGT_600E-v7.2.10.M-build1706-FORTINET.out.zipFile: FGT_600E-v7.2.11.M-build1740-FORTINET.out.zip

Hi There, Was wondering is there a way to export or import Alerts/Incidents module viewing templates.Tried to find it on the Apllication itself and also the Export Wizard module but with no luck.This feature dosn't have to be clickable, could be a manual files copying process.Any suggestions? Thank.Regards.

Hello everyone,I'm currently setting up a lab environment to authenticate mobile users (smartphones, tablets) to a WiFi network using certificate-based authentication via 802.1X.I'm following this Fortinet guide (but i'm using a Bridge SSID and not a Tunnel SSID):FortiNAC WiFi 802.1X based network using FortiNAC Local RADIUS ServerInfrastructure:FortiGateFortiAPFortiNAC-F version 7.2FortiGate Configuration:SSID:RADIUS Server settings:NAS IP: set to FortiGate IPradius-coa enabled via CLI VLAN Interface ID 69 created and enabled with:RADIUS AccountingSNMPPINGSecurity Fabric ConnectionFortiNAC Configuration:Local RADIUS: Configured and enabled all TLS typesWinbind Domain: Configured (used for another SSID with LDAP + Persistent Agent)Network > SSID:SSID bound to Default RADIUS ServerCustom Settings:RADIUS Mode: LocalRADIUS Attribute Group: RFC_VLANEnforced Wireless Role: default, registration, and logical networksVLAN Port Group (ID 69):Authorized Access PointsForced Authenticatio

FortiGate-81F # diagnose debug fsso-polling detailAD Server Status(err: server can not be accessible):ID=1, name(172.18.0.1),ip=172.18.0.1, port=0, source(security), users(IPv4:0, IPv6:0),username=swd\lcloperator2read log eof=0, latest logon timestamp: Thu Jan 1 03:00:00 1970polling frequency: every 10 second(s), success(0), fail(106)LDAP status: initLDAP query: success(0), fail(0)LDAP max group query period(seconds): 0this is branch location firewall the AD is in DC location also i checked the Fortinet documents but still i didn't find any solution can you please help me on this Note: Agentless polling mode

I have loaded FG image on Hyper-V, how can I request virtual license in offline (without Internet on Firewall)  mode?

After configuring the VPN address provided by the client (scss.square-enix.co.jp) on other computers in the local area network, all connections were normal. However, one of the computers encountered the aforementioned error. Could you please take a look and identify the cause? The version number of FortiClientVPNSetup is 7.2.3.0929 Failed to establish the VPN connection. This may be caused by a mismatch in the TLS version. Please check the TLS version settings in the Advanced of the Internet options. (-5029) 

Hello, We're running a pair of FortiGate 121G (v7.2.11 build1740) in active/standby mode, acting as a gateway/DNS and DHCP server for the wireless guest users.The Security Policy along with the DNS Filter policy is very generous with literally nothing blocked. There are absolutely no issues with any laptop (Windows or Mac) and Android phones/tablets, but I have consistent issues coming from iPhones. It takes some time to load any page and sometimes it works fine and sometimes it just times out. Reloading the page seems to help. I initially blamed Private Relay, but turning it off doesn't seem to help, and there is nothing in my policy that could affect it. Everything is under DHCP and it's the same SSID for all devices. Would greatly appreciate any tips since I can't find any errors in the logs, nor traces that some web resources are blocked. Thanks.

Good morning, Since upgrading to 7.4.3 on my 601E firewall cluster, my AP's (only 9 of them) keep dropping offline with no good explanation in the logs that I can tell.  I never had a problem with the previous version I was at which was 7.4.1.  A reboot of the AP (either by resetting the POE on the switch port or by unplugging and plugging back in) will bring the AP back online and connected with clients but then randomly (could be hours or days later) it will drop back off.My Fortigate cluster is stable (no HA changes) and seems to be normal.  The APs are all 221Es running 7.4.2 firmware.  The only log entry I see that seems to be related to when they drop is:Action ap-failReason Control message maximal retransmission limit reachedProfile resv-dflt-FP221E5519035229Physical AP ap-2b-publicMesh Mode mesh root apMessage Failure happened on AP ap-2b-public. I did find a document (https://community.fortinet.com/t5/FortiAP/Troubleshooting-Tip-After-a-failover-F

Blocking External Access to the Anydesk ApplicationHello, good morning.I'm trying to block external access to the Anydesk application installed on computers on my internal network. I've tried several times to block access by creating firewall rules to block access from WAN to LAN, but to no avail. However, I can normally block access from LAN to WAN using Web Filter, Application Control, or Anydesk's internet service.Could you help me with the best way to implement this external block?My goal is for users on my internal network to be able to use Anydesk for remote access normally, but for external access to Anydesk on my local network to be blocked.Thank you in advance.

We've had sections created on each of our FortiGates (currently running 7.4.6) that we manage via FortiManager. Today upon logging into FMG, two of the FortiGates now have the section before every firewall rule and not the specific sections wherer they've been for the past few years.  I suspect the cause is something within the FortiManager, because we deployed changes to these two firewalls yesterday, and when I look at what's about to be deployed to another firewall, every line of the firewall policy has "set global-label "blah(##)".  Can someone point me in the right direction as to how to disable this behavior? Thank you.

Hello Team,We are currently working on configuring per-user firewall policies for SSL VPN access using both LDAP and Azure IdP (with MFA) to restrict access to specific destinations for individual users.Our FortiGate firewall is successfully integrated with Microsoft Azure IdP for SSL VPN authentication using token-based MFA. Additionally, we have integrated our on-premises Active Directory with the FortiGate firewall for SSL VPN access.However, when creating firewall policies, we are encountering a limitation where policies are applied at the group level, rather than allowing us to define policies for individual users.Can someone advise on the best workaround for this scenario? Specifically:Do we need to create individual user groups in Active Directory and Azure IdP for each user to achieve per-user control?Alternatively, is there a method to configure this directly on the FortiGate firewall?We are also utilizing FortiClient EMS for managing remote access VPN policies. If there's a w

Hello community! Which FortiSIEM version is preferred for critical production environment in terms of stability, bug free and LTS7.3.0, 7.3.1, 7.3.2 or 7.4.0? Thank you very much in advance. Regards,Miguel.

Hello, I’m experiencing an issue where the Web Filter profile on FortiClient EMS does not block access to sites categorized under Gaming, despite being explicitly set to Block. Details: Web Filter profile is correctly applied in EMS.FortiClient shows the Gaming category as blocked.Testing was performed on macOS M3 (Apple Silicon).The Web Filter browser extension is installed on both Firefox and Chrome.However, no block page is displayed and the user is able to browse gaming websites freely.  It appears the Web Filter is not being enforced properly on macOS endpoints.Is there anyone who has encountered this issue or has suggestions on how to resolve it? Thanks in advance.  

Hello colleagues,I have a question related to the FortiGate 7.6.0 and the property security-rating-result-submissionconfig system global set security-rating-result-submission {enable | disable} endThis property was documented and available in the 6.2 version of the product:Security rating | FortiGate / FortiOS 6.2.16 | Fortinet Document LibraryAfter upgrade of the FortiGate to the version 7.6.0 I cannot find this property anymore:config system global | FortiGate / FortiOS 7.6.3 | Fortinet Document LibraryI also found the information that this property was excluded from the CLI in the document:https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/51fcbb4f-33ff-11ef-bfe5-fa163e15d75b/fortios-v7.6.0-release-notes.pdf995885 Removed the set security-rating-result-submission setting under system.globalCan please someone confirm that the propertysecurity-rating-result-submissionis officially excluded and it will not be available in the product anymore(or it was r

Hi All, I am new to FortiGate and i am doing a lab for LDAP I set up the LDAP server on the FG and the connection to the LDAP server is successful however, when I test a user credential on the LDAP it says invalid credential even though i am sure the credentials are correct. not sure where I can go from there?  your help and guidance is much appreciated  

Good evening  I want to monitor a lan to a zabbix server with ip address 192.168.1.87 connected in bridge adapter but a tracer to a zabbix server and i see the ip 10.50.3.21 FortiGate-HomeLab # show system interface port1config system interfaceedit "port1"set vdom "root"set ip 192.168.55.10 255.255.255.0set allowaccess ping https ssh snmp http fabricset type physicalset lldp-reception enableset role wanset snmp-index 1nextendFortiGate-HomeLab #FortiGate-HomeLab # show system interface vlan20config system interfaceedit "vlan20"set vdom "root"set ip 10.10.20.3 255.255.255.0set allowaccess ping https ssh snmp fabricset device-identification enableset role lanset snmp-index 29set secondary-IP enableset interface "port2"set vlanid 20nextendFortiGate-HomeLab #FortiGate-HomeLab # show firewall policyconfig firewall policyedit 1set name "vlan20-port1"set uuid a58b44a4-3d9d-51f0-e235-a09bba7147a0set srcintf "vlan20"set dstintf "port1"set action acceptset srcaddr "vlan20"set dstad

I am using Fortigate Firewalls between Windows clients and domain controllers. In this case by allowing DCE-RPC, does the firewall allow the required return sessions without allowing dynamic port range? What are the requirements like firmware, IPS etc?