Solved

Dear Team,We are experiencing an issue with SSL VPN authentication when using email-based OTP and custom realms.**Device:** FortiGate 100F**Firmware:** v7.2.8 build1639 (Mature)**Authentication type:** Local users with two-factor authentication set to email**Issue:**- When users authenticate via the **default realm** (i.e., no "set realm" in the authentication rule), the OTP email is sent, and login proceeds successfully.- When configuring a **custom realm** and associating the same users via an `authentication-rule`, the login fails with **"permission denied"** and **OTP is not triggered**.- Debug logs show: `two factor check for [user]: off`, even though user configuration includes `set two-factor email`.**Troubleshooting done:**- Verified user has `set two-factor email` and valid email address.- Tried assigning user directly in `authentication-rule` and via user group — behavior is the same.- Reset password and email OTP on the user — no change.- Verified that SSLVPN works in both r

Is there a way to Block all Internet traffic except Veeam Malware detection URL?The DNS is changing every time (IP's) so based on IPaddress Its not working always.And I also created a DNS filter   But I see still traffic to others based on IP (I think) Is there another way to fix this? Kind regardsDaag

I do have a ticket open on this but getting little traction.  Hoping I might get better traction here. My users currently use SSLVPN with SAML to our ADFS server perfectly.  I read the docs and created a IPsec config for the users using a new IKE port.  I created a new FSSO that only differs from the one used by SSLVPN in the port number.  Created a new Relaying Party Trust which is a mirror image for the SSLVPN one (just changed the port number).  All of the certs are exactly the same. When I test and debug I see the username and group coming back to the Fortigate in the debug.  Right after that I see:__samld_sp_login_resp [830]: Failed to process response message. ret=-111(Failed to verify signature.) Which means its having Cert issues.  Not sure I understand how this can be.  The certs used on the fortigate are the same for IPsec and SSLVPN.  The cert in the Relaying Party Trust is the same between the 2 config.  I hav

Hi Everyone, We have several locations that need to RDP into our office to access the same PC via the same RDP port.  Our current setup is: VIPName: VIP RDP PC1External IP: Our building's external/public IP.Map to: PC1's LAN IP.Port Forward to: 3390 TCP I created a Firewall Policy:Name: RDP To PC1Incoming: WANOutgoing: VLAN5Source: AllDestination: VIP RDP PC1Service: AllNAT: DisabledAction: Accept For some reason, I can RDP in from home. When a coworker tries to RDP in from their home, they can't. Before we could RDP in when we were using a different firewall, Netgate 6100, so I know it's not our home setup. We just installed this Fortigate 90G, which is very nice. Any assistance is greatly appreciated. Thank you very much,Sonny

I deployed a FortiNAC VM and configured policies to assign users to VLANs based on their department. To achieve this, I used an Active Directory attribute to assign a role to each user, which FortiNAC then parses via AD synchronization.  In the User Accounts page (first image), I can see that the correct role "112" has been assigned to the user. However, in the Hosts section (second image), the user’s laptop—where the same user is logged in—does not have the expected user role assigned (it should be 112 but is missing).This discrepancy prevents proper VLAN assignment. How can I troubleshoot and ensure that the role is correctly applied to the host?

I have configured SSL VPN on one of my FGTs using GUI, the same way as it was configured on another one (the idea is to move some business critical services from one office to another). Then I have discovered that FortiClient can't connect because of a connection timeout. Further debugging with packet sniffer has revealed that only SYN packets are coming from client, nothing goes back. The next step was the flow debugger:MyFGT # 2025-01-09 16:58:51 id=20085 trace_id=195 func=print_pkt_detail line=4489 msg="vd-root received a packet(proto=6, my.client.ip.address:51567->my.fgt.ip.addresss:10443) from wan1. flag [S], seq 1184327228, ack 0, win 65535"2025-01-09 16:58:51 id=20085 trace_id=195 func=init_ip_session_common line=4645 msg="allocate a new session-000fdb96"2025-01-09 16:58:51 id=20085 trace_id=195 func=fw_local_in_handler line=398 msg="iprope_in_check() check failed on policy 0, drop"I have read a dozen of pages on the internet, in Fortinet knowledge base and in this forum, als

Hello, we are working on this problem for some time now and we dont quite understand the problem. We have FGs in smaller offices with MPLS connected to our mail firewall in a DC. We are using VMs in our local DC connected with MPLS (biggest ISP in the country) and also now some VMs in Azure connected via main Fortigate in DC and Fortigate in Azure Cloud (internet speed 200/200mb) The problem is that users in branch offices which are working with a VM file server in Azure via SMB are reporting problems because of low performance. The ERP system has to save some files on the Azure VM and it takes a very long time. Uploadig files (later we checked with a big ISO file) we get like maximum 5-10mbits to Azure. For the IPsec to Azure we use our dedicated WAN with 1GB and have like 200mb on the Azure site. So we started testing and checking the performance on all sides. From branches we have MPLS 1 GB (divided por streams so we are not 100% sure) to our DC. Downloading and

Hello Dears, Just wondering how I can rewrite the below host and the steps to do it. x.example.com/portal-clienty.test:9443/portal-client  Thank you 

Hi All, I am in need of some expert advise on this after exhausting Forti TAC support. Details:FW: 7.2.4AP: 7.0 Build 0031 (latest).H/W: U231FProblem: The AP's are all using the same channels and because of that when users are roaming they get disconnected and I have to either reboot them or put them into a different AP profile and limit the channels they can use so that each AP uses different channels - this is particularly for 5Ghz.I don't understand why even with RRP - Enabled and DFC channels selected the APs are selecting the same channel and I can confirm the AP signals are overlapping so why is the AP not smart enough to move the AP's to different channels?Can someone please guide me on what am I missing here and Forti-TAC's suggestion is to create an individual profile for each AP and enable RRP but limit the channels or make sure they don't overlap. Your help is much appreciated. Wireless Controller,  #firewal  

Hello, In some data ingestion steps that are relying on pagination ( OpenCTI "Get Indicators" action for instance ), while using for loop in playbook step, we need to provide the output  variable of one loop as an input for the next loop to be executed. How can we achieve this? RegardsFabien

Hello @All can I use on FGT 1100e the two Mgmt/HA ports, both for HA only? Many thanks in advanced TBC

Hello Team,I have been searching for the EOL/EOS dates for several products and have reviewed the product life cycle on the support portal, but the exact information was not available. As a TAC, could you please provide the EOL/EOS dates for the following products? Additionally, why are they not mentioned on the portal, and what should we consider if we cannot find the data on the portal in the future for any other Fortinet products?- FAZ-150G- FG-200E- FG-101F

I have a SSLVPN working for my users.  They authenticate using SAML to our ASFS server.  I am trying to do a similar thing but now with IPSec.  I have changed the port but my iDP is the same.  When I try to VPN with IPSec the debug reports that its using the Assertion consumer service URL (login) url with the SSLVPN port number. Can I try to do SSLVPN and IPsec both using SAML and the same iDP server at the same time?  I do not have a test environment so this is the only way for me to test.

Hello Everyone, I have 2 internet and I configured SD-WAN with load balance on the FortiGate firewall. I have inbound policy to my web server and it works fine from outside but when I'm in my local network and use the guest wifi it doesn't load the we server page.  How can I have the return path from guest to my web server?Do I need to configure SD-WAN rule or ......? Thank you

 Good morning everyoneWe are experiencing a strange situation. The following is the scenario.The user connects via SSL VPN to the head office's fortigate and then, in this connection, with the head office's devices, the packet loss is minimal. However, this SSL VPN connection needs to access a server with an application hosted in a branch office. On this route, the SSL VPN to the head office and from the head office to the branch office has an average packet loss of 50%, sometimes 60%.Important information: communication between the head office and the branch office is normal, with an acceptable packet loss of only 0.5%.In short:User connects via SSL VPN to Fortigate at headquartersConnection established with headquartersPacket loss: minimalUser accesses devices at headquartersStable connectionPacket loss: minimalUser tries to access server with application at branch officeSSL VPN connection to headquartersConnection from headquarters to branch officePacket loss: average of 50%, s

Hello I created a Performance SLA to monitor the quality of a link to connect to a specific server on the Internet. The measurement uses tcp-connect and makes requests to a specific IP and Port. The defined check interval is 500ms and the time to consider the packet as lost is the default of 500ms. Let's say I'm having 20% ​​loss, does fortigate calculate this percentage based on the N number of previous packets? Or does it calculate based on the last N minutes? Is it possible to change this?Update:Based on some observations, I assume that the percentage of the "Packet Loss" metric is calculated based on the "Failures before inactive" parameter. For example, if I set 10 for "Failures before inactive", Fortigate will consider the last 10 packets for sampling. If 2 of the last 10 packets fail, I will get 20% for the "Packet Loss" metric. I did not find this information in any official Fortigate documentation, I would like confirmation.

It cuts in and out several times a day, sometimes dropping in strength and sometimes just cutting out. The ISP suggested connecting to the supplied Eero router to test it and since then it has been stable. The WAN on my 60F is set to DHCP and automatically sets itself when connected.  The set up worked seamlessly with the ONT directly connected to my WAN port on the gate for 5 or 6 months since installation.Edit: Should not have tagged this Fortiwan as it that is a product.....don't know how to remove

Hi, I have 2 computers in 2 separate VLAN's, and I need to make them see each other. There are many other computers in both VLAN's but I only want these 2 specific computers to talk with each other. I made Addresses for both computers (for their mac addresses) but it doesn't let me chose that as source and destination. Any ideas ? Thanks

Hi, the title says it al, how to block internet except one (or two) address (or IP) without using web filtering. We don't want to make a rule to enable internet then filter, that's something our auditor does not allow, so we have to make a rule that denies internet, then add exceptions.I tried to make a firewall policy from the Internet interface to the VLAN we want to block for internet, but then if duplicate the same rule but this time add one previously created FQDN address to allow, it does not work, all internet is still blocked

Goal is to create identity based FW policy.  We are looking at using FCT Mobility Agent and FAC Cloud. Trying to wrap my head around the impact in the event of a loss of connectivity anywhere in this path. SSOMA <--> FAC Cloud <--> Fortigate.  How long by default does the Fortigate cache the user/ip correlation ? Any ideas ? Don

Hello everyone, I have a connection issue with the FortiClient VPN. I am using the Ubuntu 24.10 operating system and have installed the forticlient_vpn_7.4.0.1636_amd64.deb client. The installation has no issues, but when I try to connect using the graphical interface, it stays pending on the connection without being able to establish it. Could you please help me resolve this problem?

Hi, Anyone else noticing issues with login to SSLVPN using SAML with Entra after upgrade to 7.0.17 for users with FortiClient 7.4.X ? Did an upgrade on FOS to a client and it broke the connection for newer versions butwith FortiClient 7.2.X it appears to work just fine and it used to work also with this version up until upgraded .A similar issue was also brought up here 

Hello everyone, When generating a DKIM key for multiple FortiMail appliances across different sites, should a unique key be generated for each FortiMail, or can a single key be used for all of them? If it's the second case, how would the other FortiMail appliances obtain the private key? If it's the first case, do I have to upload all public keys on the DNS ? Thank in advanceBest regards,

We are planning to utilize a RADIUS server for LDAP and OTP authentication. Our objective is to send the Username, Password, and OTP in a single request. To achieve this, we need to create a Custom Vendor-Specific Attribute (VSA) in the FortiGate firewall. This will enable us to include the OTP along with the Username and Password for authentication purposes. Could you please provide the detailed procedure for creating a Custom VSA in the FortiGate firewall? FortiGate 

Hi All, I have a question regarding a FortiSwitch managed by FortiLink. We have two data centers (DC-A, DC-B), each with a standalone FortiGate. Under each FortiGate, there are two 1048E switches serving the servers. There is a dark fiber link between the two data centers, which connects the FortiSwitches.Since there is L2 connectivity between the two DCs, I encountered an issue where the FortiSwitches from DC-B also appear on the FortiGate in DC-A (and vica-versa), prompting me to authorize them. Currently, I have set them to "Reject," but I'm not sure if this is the official solution or if there is a better approach.Could you provide guidance on the best practice for this scenario?