Solved

How to Protect Fortigate from IPv6 Security Risks

Hi everyone,I have installed the following FortiGate VM image in EVE-NG:Image: FFW_VM64_KVM-v8.0.0.F-build0167-FORTINET.out.kvmAfter booting the VM, I don't see any option to add or upload an Evolution License during the initial setup.When I click Cancel on the Add License screen, it immediately returns me to the device login window, and I'm unable to proceed any further.Has anyone experienced this issue before?Could you please help me with the following questions:Is this VM image compatible with an Evolution License? How can I upload or activate the Evolution License on this image? Is there any additional configuration required for EVE-NG or the VM before licensing?I have attached a screenshot of the issue for reference.Any suggestions or guidance would be greatly appreciated. 

Hi all, This is my first post on these forums, so hello to everybody :) I'm going to start by asking a question i don't expect many people to be able to answer but i hope somebody who is familiar with BGP and ADVPN can crack this one.  I have labbed up the below scenario and its working great.  Hub/spoke topology with direct spoke to spoke connectivity on demand. http://cookbook.fortinet.com/configuring-advpn-in-fortios-5-4-dynamic-hub-and-spoke-vpns/ I have got abit more adventurous and added a secondary WAN connection to each firewall and added a second round of ADVPN config/VPN's to establish tunnels over the new WAN connection in a bid to achieve ADVPN redundancy should the primary VPN's fail. The interesting bit is that it does work (kind of) - If i shut the VPN's down on the hub it works, both spokes will speak to the hub via the second VPN tunnel and agree new spoke to spoke connectivity over the secondary connection.  However it does not

I am using console server to connect to all my network gears such as Aruba, Cisco, FortiAll Aruba can use micro usb console  and some usb-cAll new Cisco can use mini usb console and some usb-cFew Forti can use mini usb console SerialtoUSB converter already $8 (not including console cable)Good one generic micro usb cable only $2. 4x cheaper SUGGESTIONS:1. could you make all new Forti has microusb or usbc console tq  

The port switch connected to the ipphone and if i plug endpoint to the port of the ipphone then the port switch is shutdown even there are no port security in the port switch. Anyone know why?I can see the log from the switch Jul 20 14:30:13: %AUTHMGR-5-SECURITY_VIOLATION: Security violation on the interface GigabitEthernet2/0/1, new MAC address (f4a8.0d3d.5aeb) is seen.AuditSessionID  11C8640A000038317E6EAFB7  switchport access vlan 251 switchport mode access authentication host-mode multi-domain authentication order mab dot1x authentication priority dot1x mab authentication port-control auto authentication periodic authentication timer reauthenticate 180 mab snmp trap mac-notification change added snmp trap mac-notification change removed dot1x pae authenticator dot1x timeout quiet-period 10 dot1x timeout server-timeout 30 dot1x timeout tx-period 10 spanning-tree portfast 

Hello.First, I apologize for my imperfect English. Recently, I started learning about networking using FortiGate.When running FortiOS v7.6.6, I configured IKEv2/IPsec VPN on a FortiGate 60F.At that time, the VPN connection worked correctly.However, after upgrading the FortiGate to FortiOS v7.6.7, the VPN connection stopped working.No VPN configuration changes were made between the upgrade and the failure.Based on the FortiGate logs and packet captures taken with Wireshark,I suspect that during the certificate authentication process,the intermediate certificate that should be sent from the server to the client is no longer being transmitted. After rolling back to FortiOS v7.6.6, the VPN connection started working again.I also confirmed that the VPN connection works on FortiOS v7.6.7when the R12 intermediate certificate is manually imported into Windows.This seems to indicate that the client is not receiving the intermediate certificate from the FortiGate during authentication.The follow

There is an analyzer with version 7.0.13. When you search fortigate log for the last 7 days on Analyzer, pages of logs come up. However, there is no total log count for the last 7 days anywhere on the page. How can I see the total number of traffic logs in any interval I enter.

Hello all. Looking for anybody who has run into this issue and may be able to provide guidance.We have a pair of FGT 70Gs running 7.4.9 connected to a stack of 148F FSWs running 7.2.5. This is our standard stack and we run it at dozens of sites.We have NAC enabled via the built in managed FSW setting (not FortiNAC). We add devices via NAC policies individually and via wildcard filters such as Vendor name and device type (Example: IP Phone). Our switchports are configured in NAC mode and based on the device that plugs in, the dynamic VLAN will assign to what's configured in the NAC policy.Anywhere from a couple to a few times a day, users with devices plugged into these NAC-mode switchports say their devices are doing network hard down, and then coming back up moments to minutes later. I checked logs and am seeing that the entire NAC MAC address cache appears to be deleted out and then added back, all at once but separated by short periods of time. This aligns exactly with when the issu

Hi,We're reviewing our VPN authentication setup and would like to add MFA for remote users.At the moment, OpenVPN authenticates users against our on-premises Active Directory. Because some parts of our environment don't have reliable Internet access, we're trying to avoid cloud-based MFA platforms.I'd be interested to hear how others have approached this.Did you integrate MFA through RADIUS, LDAP, or another method? Which solution has been the most reliable in production? Any issues with OpenVPN authentication or user experience after enabling MFA? Anything you'd recommend before rolling it out?Thanks in advance for sharing your experience.

I’m using the 3-seat free FortiClient EMS Cloud offering that came with my FortiGate licensing and have run into a strange issue enrolling an iPhone.My Fedora 43 Linux laptop registers successfully to the same EMS Cloud tenant, so the tenant and license appear to be working, at least in general. However, my iPhone will not register and always gives:“Registration Failed, Error: The invitation code is invalid.”What makes this confusing is that the invitation code does not seem to be truly invalid, because every failed iPhone attempt still causes the invitation Use Count to increase in EMS Cloud. At the same time, the failed attempt does not consume a license seat.What I’ve already tried:confirmed I am using the full FortiClient iOS app, not VPN-onlytried multiple invitation typestried existing and newly generated invitation codestried bulk invitationstried QR code onboardingtemporarily disabled Enforce User Verificationsigned out and back into EMS Cloudconfirmed EMS now shows user v

Hi everyone,On my FortiGate running v7.4.9, I have a specific VDOM configured for one of my clients.Currently, this VDOM is integrated with a FortiAuthenticator (FAC), which in turn queries two remote LDAP servers to handle MFA for client VPNs. I now need to configure these same two remote LDAP servers directly on the FortiGate (under User & Authentication -> LDAP Servers) so I can use Active Directory groups in our firewall policies. I would like to know if there are any specific best practices to follow, and I have a couple of questions: LDAP Query Load: Are these two remote LDAP servers at risk of being overloaded with too many queries due to this dual integration (FAC for VPN + FortiGate direct for security policies) ? Cache Management: Would you recommend enabling and tuning the cache on the FortiGate (increasing `set cache-ttl` to 300 or higher) ?If so, what is your recommended value for a production environment ? Thanks in advance to everyone for any advice or insights !

Hello dear community, I got a new customer that has an unlicensed FortiGate 50E and FortiAPs 221E on firmware 6.0.x. They want to replace the FortiGate with the 50G model but want to keep the APs for now. The target FortiOS for 50G would be 7.4.12. As the config would be converted/migrated, what would be the best upgrade path to avoid losing the APs management?Put the 50G on 7.4.12 and convert the 50E configuration as is Upgrade the 50E and 221E APs to latest possible 6.2 branch and then convert the 50E configuration for 7.4.12 Upgrade the 50E and 221E APs to latest possible 6.2 branch, convert the 50E configuration for 7.0.19, then upgrade the 50G to 7.4.12 Please let me know if more details are needed. Best Regards

Hi FGT adminsFortiOS 7.4.12. All HTTPS sited are blocked with error: “SSL connection is blocked due to unable to retrieve server's certificate”.In the latest FOS updates the FGT probes the certificate itself (self generated traffic) before allowing or denying the traffic, right.I checked this tech tip and I know we can change cert-probe-failure as workaround.But I my case I know the issue is caused by my WAN interface having one primary private IP and one public IP as secondary IP (ISP constraint). I had to change source-ip for many services like DNS and FortiGuard in order to make them reachable. But can’t find similar source-ip for certificate probe traffic.I know one other workaround is to make public IP primary and private IP secondary but I prefer avoid this change in case there is “source-ip” customization for cert probe.Any useful info would be appreciated.

Hi allI have updated to FortiOS 7.2.3.And then I realized following bad configuration.----FG60F # config system email-serverFG60F (email-server) ## set reply-to noreply@example.comcommand parse error before 'reply-to'Command fail. Return code -61FG60F (email-server) #----By this Document, I can set 'reply-to'.http://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/526019/email-alertssomeone have how to config 'reply-to' in FortiOS 7.2.3?thanks.

I’m having issues establishing a connection when IPv6 is enabled on the Windows client’s Wi‑Fi interface. As soon as I activate IPv6, the connection to the Fortigate fails. Has anyone experienced this or knows what might be causing it?If you want it more technical or more detailed, I can refine it.

Hi I tried migrating the FAZ-400E config to a FAZ-1000G, but after rebooting, the configuration wasn't applied.but migrating the same config to a FAZ-VM works without any issues.(OS versions are identical).

My scenario for contractor is they login to the network and get isolation network, then after enter the credential the device will connect to guest network and we must change the Host Role from Guest to Contractor then the device can access to the network.Vlan changing from isolation to guest and to contactor network is working fine except if vlan guest doesn’t have internet access then after credential entered then there are pop up in the browser say ‘Failed to detect a change in your network setting’ but vlan already changed to guest. When guest network have internet access then there no popup.Anyone know what url used by fortigate to detect that change ? My goal is to give internet access on guest network to specific url so the popup will not showing.

Hi FNAC adminsFortiNAC-F 7.2.9.Do you know a way to show/set device model configuration in CLI or via Linux shell (enter-shell).

Can we put the url to download the persisten agent on captive portal than the agent downloaded automatically?

Hi everyone,We are facing an issue where FortiGate email notifications are not being received by Outlook.com email accounts (Outlook, Hotmail, Live).Our SMTP configuration is working correctly because all email notifications, including SSL VPN OTP emails and other system notifications, are successfully delivered to our company email accounts.However, when the recipient is an Outlook.com email address, the emails are never received, including the Junk/Spam folder.Has anyone experienced this issue? Is there any known compatibility issue, Microsoft filtering policy, or SMTP configuration that could cause Outlook.com to reject or silently drop emails sent by the FortiGate?Any guidance or troubleshooting suggestions would be greatly appreciated.FortiGate Model: 1101EFortiOS Version: v7.4.11 build2878 (Mature)

I use persistent agent to checking antivirus on the client before the client can connect to the network.My question is what parameter will be checking by PA? Is antivirus realtime protection is on/off, is antivirus batabase signature updated or not, or something else?

Hi guysFGT A with WAN 1 and WAN 2 interfaces with direct public addressFGT B with only WAN1 Created nr 2 tunnel ipsecTunnel 1 = FGT A WAN1    to    FGT B WANTunnel 2 = FGT A WAN2    to    FGT B WAN Created policy and static route with  administrative distance = 10 (Tunnel 1) and = 20 (Tunnel 2) When tunnel 1 is DOWN I get strange output on routing interface.Picture 1, static route works, I can reach LAN on FGT BPicture 2, static route doesn’t work, I can’t reach LAN on FGT B. I get strange IP address on static route, 10.0.04 is not public IP of FGT B Someone can suggest me any other checks?What could it be?

Can anyone confirm me if FortiGate 70G Firewall requires a separate license to operate or does the product comes with a base license when purchased new.

Hi FWB adminsAccording to FWB’s CLI ref we can access to traffic logs and attack logs via CLI.https://docs.fortinet.com/document/fortiweb/7.6.6/cli-reference/561209/logThe user is admin and its profile is prof_admin (has all rights).However when the mentioned command seems not available.fwb01 # diag log all startParsing error at 'log'. err=1Command fail. CLI parsing error.Any idea?

Hello,we have upgraded our FortiClient EMS Cloud instance to 7.4.7 recently, and we can’t seem to upgrade our FortiClients, because we are unable to choose a FortiEDR engine.The dropdown menu to select an engine version for the FortiEDR feature has nothing to select. Even when dropping down to other FortiClient versions we can’t pick any FortiEDR engine version. The fabric connection between the FortiEDR Cloud and FortiClient EMS Cloud instances are up. The installer is for regular Windows Clients.The same problem goes for our customers FortiClients EMS Cloud instance. So it seems to be a problem with the 7.4.7 version of FortiClient EMS Cloud?Also, the docs page for FortiClient EMS is currently down with the code 500 internal server error. So we can’t even look up known issues for the new FortiClient EMS version.