Solved

Hi, We have two Sites, Site A and Site B already connected by telephone line(old), so they share the subnet ip address, now we want to have a VPN tunnel as a Backup with two Fortigate on each side, we cannot change the subnet ip address,  Configuring Site-to-site IPSec VPN in Central SNAT mode with overlapping subnets doesn't work because this will change to new IPs, which is the best solution for this?

Hello team!! I read the first 8 chapters of the "FortiClient EMS 7.4 Administrator Study Guide".  After this I started to open the FortiClient Cloud, and created some different objects there.  But playing with my FortiClient Cloud, before set this in production, I get some questions.  Please, answer my questions or guide me to reach the answers.  Sorry if there are obvious questions.1) I configured an authentication server (Windows AD), and this is connected, but when I create a Group Assignment Rule, I cannot select a Domain Group, just workgroup group.  Why?  (All computers objects are in All Endpoint as "Not installed", and I am able to use Domain Groups in "Manage Deployment")2) If I want that a group has a ZTNA application (The app is hosted in a server which is in the same site that Fortigate), I need to create 2 applications?  (One for on-fabric endpoints and the another for off-fabric endpoints).  If not, where do I need to point thi

I'm currently setting up a FortiGate firewall and facing a strange issue. The FortiGate WAN interface is directly connected to my ISP router. From the FortiGate, I can ping the ISP gateway successfully.However, from the ISP router side (or any host behind it), I cannot ping the FortiGate IP.Here’s what I’ve checked so far:Ping is enabled on the WAN interface (set allowaccess ping is configured).The interface is up, IP is correctly assigned, and the cable is physically connected.No local-in policy is blocking ICMP.No trusted hosts are configured under the admin settings.Subnet and default routes appear correct.and when I connect that ips wire to my laptop it can get the internet access and able to ping my ip from outside network.

I have played with FortiWeb trial VM and the demo center (FortiWeb Demo) and after reading some docummentation and watching (9) FortiWeb API Protection: Overview - YouTube and (9) FortiWeb - Machine Learning Based API Protection - YouTube I see that FortiWeb has ML for API discovery but what about discoverying if API endpoints don't enforce authentication or authorization or using weak authentication? The traffic could be legitimate but the devs in some cases by mistake don't enforce API autentication/authorization on some API endpoints or a forgotten old version of an API URL endopoint (shadow API). Can FortiWeb see the requests and still after time with Anomaly detection make suggestions for API security improvement even if all the requests don't have authorization header (not a deviation but still a security issue) ?

Hello,  I played with fortiweb trial Evaluation limitations | FortiWeb Private Cloud | Fortinet Document Library and demo https://fortiweb.fortidemo.com/ and I also watched FortiWeb API Protection: Machine Learning based Protection but it is not clear if FortiWeb can  generate swagger or openapi file based on ML/AI learning of the API traffic? Maybe if not the on-prem appliance (vmware or in a cloud like AWS/Azure) if the FortiWeb cloud can ?

can we deploy the User Based policies in similar way we were able to do onsite Active Directory integration using SSO. We normally use FSSO agent for that on AD server, how can we do that on Azure. PS. I am not talking about forticlient or VPN usage here but actual firewall rulebase using the User Groups. 

Hello, I'm reaching out as I couldn’t find the proper place to submit feature requests on the Fortinet website (such as support or partner portals). Therefore, I'm sharing this feedback here in the community forum in hopes it reaches the appropriate team. One of my customers operates a network with approximately 100 FortiSwitches, all integrated via FortiLink with FortiGate. Managing ACLs on FortiSwitches in this environment has been extremely frustrating. Here’s the issue:I want to apply ACLs that allow or deny traffic based only on destination service ports, while keeping source and destination IPs as 'any'. This is a very common requirement in real-world environments. However, this configuration is not possible when the FortiSwitches are managed by FortiGate via FortiLink. The managed FortiSwitch ACL configuration lacks the ability to define service ports. There is also no option to disable FortiGate control over ACLs, which means that even if I manually con

For some reason the  XSS or SQL injections are moved to a seperate WAF profile in Fortigate and not in the normal IPS functions but I saw the below article: Stream-based antivirus scanning for HTML and Javascript files | FortiGate / FortiOS 7.6.0 | Fortinet Document Library      As I have test fortigate I confirmed with proxy mode rule and WAF feature enabled that basic web attacks are detected but in the newer trial versions proxy rules can't be used because of the RAM limit, so I can't test if now the newer versions can scan web traffic with a flow rule not only for antivirus.  If anyone can confirm if not now then in the future flow mode rules will support WAF profiles it will be great as at the moment even the waf profile is not visible under flow rules in the trial option!   I know that FortiWeb is a true WAF that has auto policy building with url, header and parameter learnings, API protections and discoveries, Java

Hi all, we want to switch our FortiClient dial-up connections from IKEv1 to IKEv2, but we are having problems with this. I have created a new IKEv2 Test-VPN on the Fortigate and a test user that is authenticated via RADIUS. Everything in the setup works fine with IKEv1, but as soon as I change the parameters to IKEv2, the login fails. Device is a FortiGate 300E cluster with OS 6.0.10, I tested with different FortiClient-VPN versions from v6.4 to 7.0. Here is what an IKE debug shows me: ike 0: comes 178.2.99.151:64916->20.30.40.50:4500,ifindex=11.... ike 0: IKEv2 exchange=AUTH id=xxxx/xx len=80 ike 0: in xxx ike 0:IKE-v2:31239: dec xxxA65 ike 0:IKE-v2:31239: responder received EAP msg ike 0:IKE-v2:31239: send EAP message to FNBAM ike 0:IKE-v2:31239: initiating EAP authentication ike 0:IKE-v2: EAP user "testuser" ike 0:IKE-v2: auth group IKEv2-Users ike 0:IKE-v2: EAP 1195273714 pending ike 0:IKE-v2:31239 EAP 1195273714 result 2 ike 0:IKE-v2: EAP challenged for user "testuser

Hi Community  Is there anyway to enable Dynamic Threat Detection on the FortiSASE managed Forti Client   Thank You, #FortiSASE

I have the following working Dialup IPsec config working for one of my SAML user groups and now I am trying to expand it to cover other SAML groups.config firewall addressedit "OpsVPN-US2_range"set type iprangeset start-ip 10.254.128.1set end-ip 10.254.128.254nextendconfig firewall addrgrpedit "OpsVPN-US2_split"set member "Internal_10.0.0.0/8" "Internal_172.16.0.0/12" "Internal_192.168.0.0/16"nextendconfig vpn ipsec phase1-interfaceedit "OpsVPN-US2"set type dynamicset interface "port1"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset proposal aes256-sha512set dhgrp 20set eap enableset eap-identity send-requestset wizard-type dialup-forticlientset transport autoset fortinet-esp enableset assign-ip-from nameset dns-mode autoset ipv4-split-include "OpsVPN-US2_split"set ipv4-name "OpsVPN-US2_range"set save-password enableset psksecret ENC *******nextendconfig vpn ipsec phase2-interfaceedit "OpsVPN-US2"set phase1name "OpsVPN-US2"set proposal aes256-sha512set dhgr

 Hello everyone,I have two Fortigates:A Fortigate 60F and a Fortigate 70G.On the Fortigate 60F, there is a WiFi network, where I reserved the IP address 172.16.10.110.The Fortigate 60F is connected to the 70G via a link and a static route:  All traffic destined for the 70G must pass through the 60F.Conversely, on the 70G:   The connection works well, everything works fine.Now, I tried to restrict access to the 60G GUI (https://10.0.1.0:40443) using two local-in-policies: config firewall local-in-policy    edit 1        set uuid 5c0a2180-47a5-51f0-1e8d-733b986f1a94        set intf "any"        set srcaddr “My_IP_ADDRESS”        set dstaddr "login_group"        set action accept        set service "HTTPS-40443"        set schedule "always"    nextedit 2        set uuid 71f5a26c-47aa-51f0-2

I have a home lab environment, and I have created a VIP for my Citrix Lab with NetScaler frontend. Regardless of what I try traffic to the VIP is being dropped based on debug view, but I don't see any traffic in the logs. This used to work with another service but that stopped working as well. Fortigate-70FFirmware: 7.6.1   Debug Trace 2025/06/12 09:31:54,"vd-root:0 received a packet(proto=6, X.X.X.X:30212->X.X.24.153:8445) tun_id=0.0.0.0 from wan1. flag [S], seq 3633665461, ack 0, win 65535"2025/06/12 09:31:54,allocate a new session-0005eb2b2025/06/12 09:31:54,"in-[wan1], out-[]"2025/06/12 09:31:54,len=12025/06/12 09:31:54,checking gnum-100000 policy-10612025/06/12 09:31:54,"result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"2025/06/12 09:31:54,find a route: flag=80000000 gw-X.X.24.153 via root2025/06/12 09:31:54,"in-[wan1], out-[], skb_flags-02000000, vid-0"2025/06/12 09:31:54,"gnum-100017, check-ffffffbffc02ca54"2025/06/12 09:31:54

Hello Folks, i need to deploy 2 ipsec vpn for remote access.the ip address of each client is associated in the radius server (NPS) as radius attribute, how can i replicate this configuration for ipsec?i read i need to enable the "set mode-cfg enable" and "set assign-ip " commands, unfortunately as per the configuration below, i'm unable to change the latter commad (in gui i'm returned "-1: Invalid length of value" as i set the group, and in cli i can't edit nor delete it).furthermore i need 2 vpn, the first allowing user to use split tunnel and the other denying it, how can i achieve this scope?is it possibile?For the ip assignment i don't have fortiauthenticator so i'm forced to use the NPS. FORTIGATE (phase1-interface) # showconfig vpn ipsec phase1-interface edit "VpnRaNoSplit"set type dynamicset interface "Wan_vpn"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset ipv4-dns-server1 10.2.22.18set proposal aes256-sha256set dpd disableset dhgrp

I have two Fortigate devices: FG1 and FG2. There's a tunnel between them, with a computer connected to the LAN port on FG1 and a file server on FG2. I would like FG1 to resolve the domain to an IP address, which is why I set up a DNS server on FG1. Now, the question is: what should I enter in the DNS Forwarder, and should I check "authoritative"? I don't know what that means, but I think I should check it because I don't want the query to go to the internet, but rather to stay within my network. The DNS forwarder is set to 8.8.8.8, and it works, but I don't know why. If I set the DNS forwarder to 8.8.8.8, I understand that addresses not found in the local database will go to the internet. But why does it work if I'm setting up a new zone? Shouldn't this option be in DNS Service on the interface, not in the DNS database? And when I add a second zone because I want it to resolve another domain, what should I enter in the DNS forwarder? When I leave it blank, everything still works,

I have a problem with FortiClient VPN 7.4.0.1658 versionI need connect to the VNP server in local network.My computer with the client do not have internet access.When I am trying to connect I can observe warning message in FortiVPN_1.log:fortivpn::StateMachine::HandlePreflight_EnvironmentCompliance environment does not permit VPN connections: No Internet.In state: TunnelConnectAbortedI do not need internet to connect to the VPN, because the server is in local network.During startup I can observe in this log:fortivpn::INetworkAvailability_impl::Get LAN is available, Internet is not availableIs it possible to configure the client to not use the internet, but only local network to connect to the VPN server?

Hello everybody, we are actually using on a Fortigate (running 7.0.x OS) the SSL Offloading Feature for checking inbound-Traffic (!) to an Web-Server located in our dmz:  config firewall vip edit "Loadbalancer SSL www.example.org" set comment "for IPS on SSL" set type server-load-balance set extip 1.2.3.4 set extintf "wan1" set server-type https set monitor "192.168.1.22" set extport 443 config realservers edit 1 set ip 192.168.1.22 set port 443 next end set ssl-mode full set ssl-certificate "www_example_org 03-23" set ssl-client-renegotiation deny set ssl-client-session-state-type disable next end config firewall policy edit 99 set srcintf "wan1" set dstintf "dmz" set action accept set srcaddr "all" set dstaddr "Loadbalancer SSL www.example.org" set schedule "always" set service "HTTPS" "HTTP" set utm-status enable set inspection-mode proxy set ssl-ssh-profile "my_certificate-inspection" set ips-sensor "my_protect_server" set application-list "my_app_protect_server" se

Hi everyone, thank you for taking some of your time to read this. We switched ISP a couple months ago for a Bell Gigabit Fibe Ethernet. They gave us a HomeHub 2000 that I had to put in bridge mode to stop it from acting as NAT router (first problem). I then setup the WAN1 connection using the Bell credentials in PPOE and I could not get any signal.I called Fortigate support and we setup a DNS using fortiguard effectively creating a domain name linked to our static IP. Is this correct ?  I found two similar threads but neither mention if they have static IP. Ultimately I would like to remove the fortiguard DNS server causing latency.  - Fortinet 40f PPPOE connection fail on bell canada - Fortinet Community   - Technical Tip: Bell Fibre configuration directly o... - Fortinet Community 

Hello, on my FortiGate I have two users as super-admin. Now I want to delete the one named "daniel" - but I cannot do this. There are no references in the GUI visible, and after searching via full-configuration on the CLI there is one entry. But I do not know how this settings came in the past to this, and also this is not visible in the GUI - or, at least, I did not see this yet. Anyway, I have no chance to get this entry changed so that the user is free to become deleted. Please see attached screenshots. Any idea for this? FortiGate 40F (FortiOS 7.6.3) Regards,Daniel 

Hi community, Looking at the following post, it seems FGT-1 sends the SYN to FGT-2 through the LAN switch. https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-HA-A-A-cluster-3-way-TCP-handshake/ta-p/197467 In the following situation, what happens if link 1 goes down? The SYN cannot be distributed from FGT-1 to FGT-2, then does the active-active configuration stop working? If not, what happens?  Regards,Julián

English is not my first language, and I wrote this post with the help of ChatGPT. If any part of this message sounds strange or unclear, please feel free to point it out Our goal:Users connect to Fortinet SSL-VPN.We want to enable split tunneling, so that only traffic destined for AWS goes through the VPN.All other traffic should go through the user's local internet connection.Challenge:Since AWS services use dynamic IP addresses, it’s difficult to keep the split tunnel routing accurate and up to date. Even when we try to add known AWS IP ranges manually, they change often, which breaks connectivity.We also tried DNS-based split tunneling — defining domains (like *.amazonaws.com) instead of IPs — but this approach hasn’t worked reliably either, possibly due to how Fortinet handles DNS resolution and route injection.Has anyone dealt with similar issues? What's the best way to implement split tunneling to AWS services when IPs are constantly changing? Is there a reliable method usin

Hi, Would like to ask what will happen to our billing if the users onboarded exceed to our current subscription of 1000 users? Right now, we onboarded 1200 users. Does this might cause over-subscription and charge us for it?

Hello,I am facing an issue with fortigate firewall in cluster a-p, both are integrated with cisco ise working as Radius server.Suddenly, we are seeing that Radius settings for ISE is failed; saying " can't contact radius server"Fortigate version is 7.2.4however, there is another set of FGT firewalls which are working fine.Only difference is that these firewalls are in DMZ and ISE is behind mgmt firewalls which are working fine. So DMZ Fws talk via transit vlan.

The goal is split multiple JSON events sent in a batch into separate events. Going through the docs available to me, I've gotten to this - <patternDefinitions> <pattern name="patSplitEventsFromAkamai"><![CDATA[\{.*]]></pattern> </patternDefinitions> <eventFormatRecognizer><![CDATA[\[PH_DEV_MON_CUSTOM_JSON\]:\[reptVendor\]=Akamai,\[reptModel\]=Cloud%20Control,]]></eventFormatRecognizer> <parsingInstructions> <switch> <case> <!-- Individual event format, process like normal --> <collectFieldsByRegex src="$_rawmsg"> <regex><![CDATA[\[PH_DEV_MON_CUSTOM_JSON\]:\[reptVendor\]=Akamai,\[reptModel\]=Cloud%20Control,\[json\]=<_json:patSplitEventsFromAkamai>]]></regex> </collectFieldsByRegex> <when test="exist _json"> <collectAndSetAttrByJSON src="$json"> <attrKeyMap attr="format" key="format"/> <attrKeyMap attr="version" key="version"/> <attrKeyMap attr="eve

I have a FortiGate 70F running 7.4.7 and I'm trying to set up a DNS server on it to resolve some internal server host names.  The system DNS is pointing to the FortGuard DNS servers.  I am using FortiSwitches connected via FortiLink for clients on multiple VLANs.  I enabled DNS Servers in Feature Visibility to add that option and noticed that it already had an entry for the fortilink interface set to Forward to System DNS, and a DNS Database entry for fortiswitch set to Primary/Shadow that has 5 entries, one for each of my FortiSwitches.  I did not make any of these, so this is apparently done automatically when you install a FortiSwitch.  I am trying to get clients on the Lab VLAN to resolve host names for 3 servers in our environment.  I went through the steps to add a new DNS Database using Primary/Shadow and added 'A' and 'PTR' records and a domain name for the 3 servers on our internal network.  I saved this and then added a '