Solved

FortiClient EMS 7.4.1.1872FortiClient 7.2.9.1033 I have gone in to EMS -> Endpoint Profiles -> ZTNA Destinations.  Edited the ZTNA profile.  Disabled it.  Then re-enabled it and made sure the EYE was looking. This has been pushed out to my machine only.  However, in EMS when I find my endpoint I still see ZTNA enabled (hidden) under Features and my client is not showing the Destinations tab even after waiting minutes. What am I missing here????

Hi all,i have 3 branches with MPLS link to HQ and a DIA access.We have only one ISP that manages two different connections for every branch. The ISP give me the possibility to use the local internet connection as a DIA in every branch. The ISP manages the redundancy of MPLS and internet link between the two different connection they provide. I want to build an IPSEC tunnel over the MPLS for security reasons and use this also to route some particular internet traffic. In case this link goes down I need to route all the internet traffic through the DIA. I always need the possibility to use the DIA for other traffic. Branches does not need to talk each other. This is the network scheme. I only manage fortigates. Routers are managed by the ISP. I've coloured the path that i want to implement.  - Should I use SDWAN to manage that?- Do I need BGP?- How do i manage route changes and nat changes?  

Greetings Im having some problems with my VXLAN over IPSec implementation. Im able to establish connection to the remote site. Telnet, SSH, RDP, VOIP is working fine but Outlook and some HTTP or HTTPS application don't work. I have read many article about this issue and all says that is a MTU or fragmentation issue. But I follow all the recommendation and nothing seems to work. First thing I notice is that VPN interface, Software-switch and vxlan mtu were set to 1370. I manage to bring the VPN and vxlan mtu to 9000 and Software-switch to 1500. My physical interface are all set to max mtu (9216). I also disable the honor-df bit but the maximum mtu that i can pass without fragmentation is 1472. And I think that is fine because 1472 + 28(header overhead) = 1500. But still cant get Outlook to work. I also adjust the mss in the policy to 1432 (1472-40). Also I lower my encryption to 3DES SHA1.My main FW is a 100F and the remote is a 60F. Im runnig 7.2.4. I will appreciate any

Hello, My wireless clients do not receive an IP Address when connecting to a SSID.My Infrastructure is as follow;FortiGate 120G <fortilink> FortiSwitch FS-108F-FPOE <port1> FAP231 On the FortiSwitch port1 the native vlan is 5 and the allowed vlan are 30 and 40 On the FortiGate in the fortilink interface the vlan5 is configured with a subnet 192.168.5.32/27 and a DHCP server to provide management subnet for the FAP231 (this is working).On the fortilink I configured the vlan 30 without any IP or DHCP serverOn the fortilink I configured the vlan 40 with a subnet 192.168.40.0/24 with a DHCP server (192.168.40.10-192.168.40.250).In the SSID section I configured the SSID GUEST_30 in Tunnel mode, with a subnet 192.168.30.0/24 and a DHCP server (192.168.30.10-192.168.30.250) open authentication with a local captive portal, and the vlanid 30.In the SSID section I configured the SSID OFFICE_40 in Tunnel mode, without a subnet or DHCP server, WPA2 Personnal (will go to

Have few Fortigate devices (6.4.12) managed by Fortimanager (7.2.2) and have problem with packet capture in Fortimanager.Packet Capture is grayedAny suggestion why this option is not available in Fortimanager? Only solution is to make packet capture directly on device but then device will "out of sync".

I know Fortinet is doing away with SSL VPN.  I am close to moving off SSL VPN and going to Dialup IPSec VPN.  However, its taking a while due to issues I am working with support on.  At the same time I am trying to get my head around ZTNA and from what I have been reading ZTNA uses SSL VPN too but in a more secure way. Please tell me that ZTNA using SSL VPN is NOT going to be going away any time soon????  I am looking to use ZTNA so users can access internal websites on port 443, SSH to hosts, RDP to hosts.  I know there are different methods for each of these.  I just want to make I am not wasting my time by setting this up with ZTNA.

Hello Team, I'm facing a issue with update reord Step on playbook as mentioned on below log {"Error message": "\n Failed to create the record. The system administrator has defined a uniqueness constraint for the fields (typeofindicator, value) and a record already exists with the specified values for these fields! Note that the record might be in the recycle bin or not accessible to you. URL: https://localhost/api/3/indicators/5086526c-b0ee-44ad-810d-ab252ed73206 Call for URL: https://localhost/api/{"Error message": "\n Failed to create the record. The system administrator has defined a uniqueness constraint for the fields (typeofindicator, value) and a record already exists with the specified values for these fields! Note that the record might be in the recycle bin or not accessible to you. URL: https://localhost/api/3/indicators/5086526c-b0ee-44ad-810d-ab252ed73206 Call for URL: https://localhost/api/3/indicators/5086526c-b0ee-44ad-810d-ab252ed73206 failed with status code

Hello,I'm trying to create a new site to site vpn for a customer.Headquarter device is fortigate 80E, branch is fortigate 60F. There is already a site to site ipsec vpn between Head and Branch that is working internet provider's router at both site are not natted so fortigates route using public IP addresses.Now the customer has a new FWA faster connection at the branch and want to use this new for vpn to the HQ, but this connection has a router with firewall that we cannot disable and we cannot use a public IP address for WAN port of the branch fortigate.What are seeing connection from the HQ arriving at the branch on port 500, but when the branch sends out ike packet to HQ the branch fortigate shows error "network unreachble" Following an exaple of packet capture session 2025-04-11 16:40:01.021309 ike 0: comes 2.40.80.242:500->192.168.1.2:500,ifindex=6,vrf=0....2025-04-11 16:40:01.021384 ike 0: IKEv2 exchange=SA_INIT id=cdb44172569bf4cb/0000000000000000 len=5002025-04-11 16:4

been back and forth with forti support with no answer.LDAP with out token works ok .when we have forti token mobile we get the promt but we get regex error. (both for macOS / WINos) any one know how to solve that?  

Hi, I'm sure this is something I'm overlooking but it does have me a little confused. My Fortigates are still in a lab setting set to roll out to production in the coming weeks. Currently I have two Fortigates with private IP on WAN ports 192.168.2.1 Fortigate - > Cisco Switch 192.168.2.2192.168.6.1 Fortigate -> Cisco Switch 192.168.6.2 192.168.2.1 can ping 192.168.6.1192.168.6.1 cannot ping 192.168.2.1 but 192.168.6.2 can ping this IP.  Monitoring the interface on the 192.168.2.1 firewall. When everything other than 192.168.6.1 pings - it sends responses. When 192.168.6.1 pings - it receives the pings but does not reply.  Anything (obivous) I may be overlooking here? I don't see any SD-wan rules or policy routes that would apply... Any suggestions with debug commands I can use would also be appreciated. Thank you,  

Hello,Is there a way to see in Fortigate how much bandwidth (Mbps)is consuming an internal user?I recall before in fortiview it showed this but now (FortiOS 7.4) I can not see it. Only shows traffic in Bytes (MB). thank you.Regards.

I have been struggling with forticlient on Opensuse Tumbleweed. It worked fine until last week but now, after a zypper dup, (I did others before and there were no issues) I can't establish the connection anymore. Even trying boot across previous system snapshot, it doesn't work. I use a SAML integrated VPN and it authenticates successfully just before the client dropping the connection. Can anyone help me to fix this?    20241203 16:50:09.950 TZ=-0300 [sslvpn:INFO] main:1817 Init 20241203 16:50:09.951 TZ=-0300 [sslvpn:INFO] main:622 Load profile: BLN 20241203 16:50:09.952 TZ=-0300 [sslvpn:DEBG] main:631 Inherit local DNS: No 20241203 16:50:09.952 TZ=-0300 [sslvpn:DEBG] main:644 DNS service resetting interval: 0 20241203 16:50:09.952 TZ=-0300 [sslvpn:INFO] main:329 Get DBUS session bus address 20241203 16:50:09.954 TZ=-0300 [sslvpn:DEBG] main:333 Failed to find DBUS session bus address in dbus-daemon, try to find in dbus-broker 20241203 16:50:09.955 TZ=-0300 [sslvpn:

My site https://zarashigal.eu.org/ Is static html, hosted on GitHub pages and has no Phishing. Would you please show me where the phishing risk is on my personal site? And if not, please delist it. - Many thanks and Respect,Zarashigal

I have VLAN with IP 192.168.100.0/24 and over IPSec network with IP 192.168.100.0./22.Local users on another VLAN 10.60.18.0/23 need to access the network over IPSec and do not need to access the local network. Current situation is that users are able to access the IPSec network except those IPs that are overlapping with local IP. In other words, users are able to access IP range from 192.168.101.x, 192.168.102.x etc, but are not able to access 192.168.100.x, which because I believe because of the presence of local VLAN, despite having proper firewall policy and static routing.Any idea how to resolve this?

What are the IPs and ports need to open from private network for access SASE from FortiClient which protected by Firewall.

We configure Microsoft Entra ID SSO with FortiSASE support of Configuring FortiSASE with Entra ID SSO in FortiClient agent-based mode document. But we have faced error as below. Searching for solution... 

Hi!I'm struggling with CLI template in FortiManager right now. I must delete all dhcp servers and I made script where I use purge command, but the problem  is, it gets stuck there. There is prompt where user must press y to confirm what you are doing, but I cant make it work in the script. When i copy that script manually to FortiGate then it works.I read from other posts that few people got it work when they used \ny after purge command or added y below the command or right before end command "yend". All these ways didn't work for me. I also tried both CLI and JINJA template

Haven't really looked at this for a solution, but I have a question, I want to create a Global Header Policy, and push to 10 FortiGates in an ADOM,  seems straight forward, apart from I want to create my own normalised interface in the Global ADOM , called "WAN-GLOBAL"  and select devices to map there repsective interfaces (some are wan,wan1, port1 etc)  but you cant do this.  You can only map interfaces from devices in the ADOM, thats pointless, as I cant then use a normalised interface in the Global Header, as it cant map to anything?  is it just a name in the GLOBAL HEADER? as long as its called the same there, and in the ADOM mapped interface?

My observation:Secure Boot is a general control intended for the configuration review of firewalls. We are using a customized image during firmware updates, which makes this option not mandatory. You can either provide this justification to close the finding or, if feasible, implement the control using the attached reference  https://docs.fortinet.com/document/fortigate/7.4.0/new-features/249947/enhance-bios-level-signature-and-file-integrity-checkingWhat is the relevance of changing the security level to 1 and how we can do this?

Hello  after active ZTNA in FORTIPAMi have a messge error from gui access ,help me pleaseAccess DeniedThe page you requested has been blocked by PAM policy restriction.Invalid ZTNA client certificate  

Hi all, I would like to know until which date it would be possible to take the FCSS SDWAN in version 7.2 ?Where can I get this information ?In the Fortinet Institute, the courses I took are now archived and I'm following the courses in version 7.4 but in  the Pearson Vue Portal, I don't find it in version 7.4, only 7.2 version is available for the SDWAN certification...Other question, I'm looking for any others sources that Fortinet Institute, for this certification, book, vidéo etc...Do you have a best seller to advice me ?Many thanksRegards

Hello everyone,I would like to know if you can tell me the EOL and EOSL dates for the FortiAP FP221E.I couldn’t find this information in the datasheet.Thank you.

Hi,We are migrating from AnyConnect to FortiClient and encountering many problems. Currently, a RADIUS server (NPS) is being used, which passes Cisco RADIUS attributes such as IP address, subnet mask, and a dynamic ACL (DAC) for each user.For each user created in Active Directory, a static IP is assigned, the RADIUS profile to use is specified, and the corresponding ACL policies are created on the ASA.On the Fortigate side, I have configured the RADIUS servers and set up the entire SSL portal. Since the IP is passed statically, I found a guide that suggested setting "set ip-mode user-group" under the portal.I also created the corresponding ACL that allows from SSL VPN to any, but as soon as the MFA notification arrives with Duo, I get permission denied (error -455) and the process stops at 43%.Does anyone have any suggestions?I've tried everything but can't solve it.Below is the configuration. config vpn ssl web portaledit "RADIUS1_PORTAL"   <---- my 1st portalset tun

Hi, FortiManager Version - v7.4.6 build9266 (Mature), ADOM - 7.4FortiGate-40F-3G4G - v7.4.7,build2731 (GA) (Mature)FortiSwitch-108E-POE - v7.4.5-build880,241127 (GA) Just trying to build a little lab setup using the kit above. When creating a VLAN (FortiSwitch Manager > FortSwitch VLANs), I am able to create the VLAN without issue and apply the VLAN to the switch using a template. The VLAN shows up on the FortiGate and all looks good.  The issue is when I enable DHCP on the VLAN. When attempting to save the config I get the error message: -  Copy device global objectsCopy objects for vdom root Commit failed:error -999 - TCL error(missing operand at _@_in expression "(24<<24)+(_@_<<16)+(<<8)+") namespace import global::cli_ip2valset startip_str [cli_get_value $CLI_CUR_NODE "" "" "start-ip"]set endip_str [cli_get_value $CLI_CUR_NODE "" "" "end-ip"]set id [cli_get_value $CLI_CUR_NODE "" "" "id"]set startip [cli_ip

All my user with the same installer profile have a status unreachable profil today.