Solved

Hi, last week we updated our FG cluster to FG200F with 7.4.5.We had some problems but in general it seems quite OK. Only with SSL VPN we still have problems and we cnat get it functioning.1. Connecting with Local User it works fine, I get the certificate window and I can login, no prob!2. User from LDAP, connection to LDAP works fine, I can even test my credentials and OK but than connecting to the SSL VPN I dont geht the ceretificate pop up and after 48% I get Permission denied and -455We did the same as in all other FGs. We imported the same remote certificate and everywhere it works. We checked groups and everything and it should be OK.In System Events VPN I get:Action ssl-login-failReason sslvpn_login_unknown_user What else can we try? It seems like the FG is not checking the certificate and we try with "Require Client certificate" and without and no change  Thanks!

hello, On a Fortinet vdom I need to migrate current SSL VPN with LDAP Auth to Azure SAML Auth.There are LDAP Auth UserGruups, every UserGroup is mapped to a single VPN SSL Portal.What I need to achieve is to set up Azure SAML Auth and map new User Groups to the same VPN Portals. UserGroup-1-LDAP -> Portal-VPN-SSL-1UserGroup-1-SAML-AZURE -> Portal-VPN-SSL-1 Is it possible without compromise or modify actual VPN SSL Portal configuration? Thanks a lot, Graziano 

Hi FG admins From this tech tip:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Most-common-cases-of-SIP-implementation/ta-p/190676 I have this scenario (phones behind NAT): Did all the required config, and even more:config system settings set sip-expectation disable set sip-nat-trace disable set default-voip-alg-mode kernel-helper-basedendconfig system session-helper delete 13endconfig voip profile edit "default" config sip set rtp disable set contact-fixup disable end end... Played with the above parameters and FG reboot but didn't work. I mean I have this behavior:Calling from internal IP phone to external mobile cell phone (GSM): It rings but no voiceCalling from internal IP phone to internal IP phone: IP phone doesn't even ringIn the traffic logs I could see some "TCP reset from server" on SIP connections.So I'm starting to think that probably on server side must be somehow configured to accept calls from IP phones behind NAT. Anyone knows somet

i have enabled syslog logging for 1x FG100E and 1 x FG100F.but the log collector does not seems to receive any logs from these 2.Only the main firewall FG401E is able to send logs to the log collector without issues.is there any limitations for FG100 series ?

Good day,I need an explanation or on the contrary a solution to the following problem(Note: I am an amateur in this world and my English is not very good)  I have a machine with IP 192.168.1.10, I also have two ISP channels, these are located within the virtual-wan-link SDWAN zone and finally I have a rule for the Internet output of the mentioned machine When reviewing the machine's traffic, it is evident that its output is being generated through my first Internet channel and in addition, packets are seen sent but not received by the destinations, that is, web pages. As a solution to this problem, an SDWAN rule was created so that all traffic to the Internet from said machine was carried out through my second Internet channel, which generated an effective response, that is, packets sent by the source (Machine) were shown as packets received by the destination (Web pages).  We consulted with the provider of our first internet channel to determine if the public

I would like to permit only screenconnect (cloud hosted) on a computer that is in network. This computer does not need internet but we would like to be able to connect to it remotely via screenconnect in case of troubleshoot. We already do this at another site but with logmein (similar product) and it works perfectly but in that case I can select all the logmein destination (internet service) but there's is no screenconnect or connectwise entry in the internet service section on the fortigate. Is there any way that I could do this?

Hello Sirs, I am a noob as FortiSIEM. Recently I have received a firewall from Taiwan that call ShareTec, INF-8600That's the firewall log flow as below.  10.40.53.34        Feb 19 17:39:26        l7fw        daemon        info        conntrack        CEF:0|Sharetech|INF-8600T|9.0.2.5|10|TRAFFIC|10|deviceExternalId=E2056E3621080056 dvchost=INF-8600T cs1Label=Rule cs1=102 act=allow proto=UDP start=1739957929000 end=1739957966000 src=10.40.53.214 dst=10.10.12.11 spt=58463 dpt=443 out=4992 in=0 cn1Label=APP cn1=1270 Also i try to writed alot time with AI such as below, <DOCUMENT><eventFormatRecognizer><![CDATA[^([^\t]+)\s+([^\t]+\s+[^\t]+\s+[^\t]+)\s+([^\t]+)\s+([^\t]+)\s+([^\t]+)\s+CEF:.*]]></eventFormatReco

Dear TAC Team,I am experiencing difficulty locating the downloaded database from FortiClient EMS. While the GUI indicates that the database was downloaded and saved at a specific time, I am unable to determine the exact directory or repository where it is stored. Unlike FortiGate, the database does not appear in the browser's default download directory. Could you please provide guidance on the standard directory or repository where the database is saved by default? Additionally, any steps to locate or configure the backup path would be greatly appreciated.Thank you for your assistance.

Greetings all, I was looking at the options available for local-in policies and defined source interfaces and noticed that some interfaces are not listed.  These appear to be interfaces being used for WAN purposes, but even when switching their roles to 'undefined' they will not show up as available interfaces.  Anyone know what conditions may make an interface unavailable for use in local-in policies?

 Hello. I want to let "normal" users with the role "Standard User" to add secrets as their favorites. As you can see in the screenshot the option at a normal user is greyed out with that role. Admin users can add secrets to their favorites.  Can somebody help in which right is neccessary to add secrets as favorite? FortiPAM is running on version 1.5.0.  

Hi All, I need to know which Internet services/applications should be enabled/allowed through a Fortinet FW in order to allow Windows PCs to receive Windows/Office updates.

How can i get application signatures from api request? i want to save all app in varaible 

Hello I am having problems connecting to the FortiGuard servers on a FortiGate 40f firmware v7.0.13 build0566 (Mature) (HA Cluster). I am also receiving the message "FortiGate time is out of sync.", I use an NTP server 200.160.0.8. Images belowFrom FortiGate, I can ping the servers service.fortiguard.net, update.fortiguard.net, guard.fortinet.net. I get a response time of approximately 150ms. And I can also ping the IP 200.160.0.8 with approximately 18ms of response time. The output of the "diagnose debug rating" command is shown below: I also tried changing from https to udp with port 8888 with the commands below and I was also unsuccessful.config system fortiguard set fortiguard-anycast disable set protocol udp set port 8888 set sdns-server-ip 208.91.112.220 <-- IMPORTANT TO ADD THIS OR ANY OTHER FDN SERVER TO PREVENT DOWNTIME! endI have two internet links and I can ping the Fortiguard servers from both links. Both internet links are PPPOE. I tried to change th

Good day everyone, I've been trying to use the official Chrome Extension for searching from here https://chromewebstore.google.com/detail/fortinet-google-search/nhemkpkfgilmlepjncbgojlojaekhibm?pli=1 and no matter what I click it shows just 1 page of the search results. So wanted to ask - is it something on my side or it is by design this way?Thank you

Does anyone have information on the End of Life (EoL) date for FortiWeb 1000E? Any official sources or insights would be greatly appreciated. Thanks!

Hello everyone,I am sending the logs from our EMS server directly to our FAZ as the syslog server option.I wanted to know if the logs sent from the EMS to a FortyAnalyzer are unencrypted or are they encrypted ?From the EMS server GUI the commands are limited, is there a command from the CLI to possibly enable encryption of the logs sent to the FAZ ?If so, is there anything else to configure on the FAZ side ? FortiAnalyzer #Forti EMS

Hello guys,I'm kind of at my wits ends here.I have two FortiAP 431Gs on 7.4.5 managed via FortiLAN cloud. Both are connected to their own Fortigate 40F running 7.2.10. (So two sites, 1 AP each)The clients randomly drop throughout the day. Sometimes they will go a day or so without drops, then the clients will start to drop at random intervals sometimes every 5 minutes, sometimes every few hours.    Looking at the logs, I do not see any error messages, just client wtp disconnect messages. CPU/Memory looks to be within acceptable bounds on both the AP and the Fortigate too.What is interesting is we have 27 other sites with the same settings and no reported issues - only difference is at these sites the AP is managed via the Fortigates...The only thing I can think of if it has something to do with FortiEdge Cloud. if it matters, the sites with the APs are in the southeastern united states but for some reason they were deployed to FortiLAN cloud in Canada.but I also hav

MacOs Sequoia has changed to location of some of the security permission sets and the system extensions security profiles have changed. After installing 7.4.0.1645, the prompts to allow permissions takes a user to the permissions area where the defined permission set is no longer available to allow. You cannot continue beyond the FortiClient app prompt to change the security settings and the permissions cannot be given since the extension is not available to give permission to.  Any word on a Sequoia compatible release?

Hi everyone,I'm facing an issue that I need help resolving. I'm trying to configure a FortiWiFi 40F to distribute the IPv6 ::/56 prefix provided by my Starlink High Performance connection. I believe you might know how to set this upI’ve checked some resources(https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/37673/ipv6-prefix-delegation), but they haven’t helped me successfully propagate IPv6 on the FortiWiFi 40F. I’ll attach the configuration script for your reference. I really appreciate any assistance you can provide. Best regards Octavio    FortiWiFi-40F-3G4G (interface) # edit wanFortiWiFi-40F-3G4G (wan) # config ipv6FortiWiFi-40F-3G4G (ipv6) # showconfig ipv6set ip6-mode dhcpset ip6-allowaccess pingset dhcp6-prefix-delegation enableconfig dhcp6-iapd-listedit 1set prefix-hint ::/56nextendendFortiWiFi-40F-3G4G (ipv6) # getip6-mode : dhcpnd-mode : basicip6-address : ::/0ip6-allowaccess : pingicmp6-send-redirect : enablera-send

Hello,Today I have a server that is not part of my domain, but is in my IP Range, I need it to resolve an address https://plm.group.com/Windchill for server 192.168.20.2 to work https how do I do it inside the DNS server / DNS Database?  

Hey everyone,I recently attempted to set up Dial-Up VPN authentication using TOTPRadius in combination with an LDAP server and TOTP (Time-Based One-Time Password). TOTPRadius acts as a Proxy-RADIUS server and integrates LDAP authentication with TOTP for two-factor authentication. The setup process was based on the information provided by Token2's guide, which primarily explains how to configure TOTPRadius for admin login but does not explicitly mention VPN authentication. The Test Authentication worked, but when in combination with VPN it doesn't. The Problem:When trying to authenticate a Dial-Up VPN client using FortiGate and TOTPRadius, the authentication fails with the following error message from the TOTPRadius Server shown in Wireshark: Initial login not allowed; Empty password provided for user <blank-user>; Terminating process with Reject message This suggests that the FortiGate did not transmit the user’s password when performing VPN RADIUS authenticat

Hello experts, Am trying to find a way to block download exe files over whatsapp using fortigate f70, i have applied the file policy along with ssl deep inspection, also applied application control polciy to block file upload and file downlod from whatsapp as per below document : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Block-WhatsApp-file-uploads-action-by-using/ta-p/219694 After that we have tested, all files have been blocked over whatsapp, however we only require to block exe files over whatsapp, how we can achive that? 

Hello everyone,I have issue to integrate Domain Controller (Windows Server 2019) with WMI "failed (Login to remote object error)" when I configure the credential and would test I receive this message "failed (Win32_OperatingSystem Result not found via OMI)"-IN Credentials > Access Method Definition I use OMI - All Steps are done correctely as External Systems Configuration Guidehttps://docs.fortinet.com/document/fortisiem/7.1.7/external-systems-configuration-guide/421011/microsoft-windows-server- I removed the Kaspersky from server too Please can anyone help  FortiSIEM 

Hi everyone,I'm relatively new to networking and eager to learn.I would appreciate your input regarding a technical solution. Specifically, in the following architecture, I aim to facilitate communication between zones using two firewalls configured in High Availability (HA) active-passive mode. The challenge lies in achieving complete redundancy without employing intermediate switches between servers and firewalls.   In the scenario where, for instance, FG1 is the active firewall and the connection between SRV1 and FG1 drops for a specific reason, I'm unsure how to achieve full redundancy without using intermediate switches. In such cases, the only solution seems to be manually forcing an HA failover.   I'm thinking about using HA active-active, but I haven't used FortiGate devices in this mode before, and I'm uncertain if it's the optimal solution. I understand that having a pair of switches between servers and firewalls is preferable, but due to space and cost constraints

I noticed that in Policy & Objects there is at CLI Configurations > Objects > router some router objects like prefix-list and route-map. This seems to achieve something when first wanting to use a prefix-list or route-map for example in the Device BGP configuration. But later changes in the Policy & Objects on that configuration don't seem to have an effect. Did anyone work with this successfully? How did you make this work?