Solved

hi,i have a licensed forticonverter and converted a cisco ASA config.the ASA config had only basic LAN, WAN, no NAT, and "inbound" ACL (internet > WAN) applied on the WAN/outside.my question:1.do i need an FW policy for the "outbound" traffic (LAN > WAN)? is this for "ALL" traffic outbound?2.do i need to have a "reverse" FW policy for each "inbound" ACL/FW policy? config firewall security-policyedit 1set srcintf "port 1"   <<< WAN/outsideset dstintf "any"set srcaddr "all"set enforce-default-app-port disableset dstaddr "all"set service "echo-reply"set schedule "always"set logtraffic disableset status enableset action acceptset comments "access-list acl_outside extended permit icmp any any echo-reply"nextedit 2set srcintf "port 1"    <<< WAN/outsideset dstintf "any"set srcaddr "all"set enforce-default-app-port disableset dstaddr "all"set service "time-exceeded"set schedule "always"set logtraffic disableset status enableset action acce

Hi there, I'm trying to generate an ACME cert on my FortiGate, just as I've done on my EMS server, but it always fails with a "Timeout during connect (likely firewall problem)" error:  Port 80 is wide open to the world and you can see the traffic coming in when running a diag sniffer. From me running a curl against http://vpn.<mydomain>.com:  I'm at a loss. Does anyone have any ideas or suggestions? Thanks!

I have one blocked when the MAC of the machine is not registered in my DHCP reservation it does not browse, would there be any warning when anyone tries to put a machine on my network to warn that it is trying to get IP?

Hi, In fortisase portal we are able to enable scheduled vulnerability scanning. We are checking for the option to enable the auto patching for the vulnerability.We checked fortisase admin guide and not seeing any option of auto patching.Will fortisase do the auto patching like Forticlient EMS ?Please guide..  Regards,Ganesh Karale

Hi,I'm looking to add radius authentication for administrators on the FAC in our deployment, currently we're using simple local users.I would like the Radius request to be sent to a remote radius server, from the FAC. The FortiAuthenticator is running version v6.6.2, build1669 (GA).I can't find any cookbooks or guides on how to enable radius for administrators using a remote radius servers. Is anyone able to provide me with either a guide, or some assistance ?Thanks in advance!

Hello everyone, I want the FML administrator(s) to receive a "notification" whenever an email is being quarantined, I thought about creating a notification profile, but I want a notification specific for quarantined emails. Does anyone have a better suggestion ? Thanks in advance Best regards,

I have a hub-spoke setup using BGP in a SDWAN setup. The SDWAN is due to having a fibre connection and a 4G for failover. So obviously I have both under each Zone.HUB -> Spoke1HUB -> Spoke2The hub has a Dialup IPsec tunnel for fibre connection and one for 4G connection to allow multiple connections from all the Spokes.Spoke1 has static IP IPsec VPN connection from its own fibre connection to the fibre connection of the HUB, and Dynamic DNS IPsec tunnel from its own 4G to the HUB's 4G connection. Spoke 2 has the same setup to connect to the HUB. I use BGP to advertise my internal networks of each of the 3 sites. Everything internally is working and the internal networks can talk to each other, including when failing over to 4G. My problem comes in with the FortiClient VPN. At each site I have a Dialup FortiClient VPN setup. When I connect to the remote VPN, I can access only the resources of the LAN at the site I am connected to. I can't talk to other IP ranges

We just had to revert to Forticlient VPN (free) 7.2.8 for IPSec with SAML and we're running into an issue with the inline webbrowser staying logged into the wrong Entra account (we support multiple clients). I can't find a way to clear the cookies. I've used the button within the app, deleted everything I could find in the Appdata\local\forticlient dir. cleared cached for microsoft in Chrome and Edge and Internet Explorer. I can't get it to shake my Entra joined Windows credentials. Does anyone know how to get it so that I get prompted for Microsoft credentials at each login. This was working earlier today and now doesn't.

Hi,I am facing the task of migrating EMS from version 7.2.8 to 7.4.x. If I follow the migration documentation, will the SAML SSO settings also migrate or will I have to re-configure SAML SSO for this installation? RegardsAndrzej

Hi, I read the CVE article below and wonder if I need to upgrade FortiOS:Fortinet Security Advisory: FG-IR-24-535My FortiOS version is 7.0.16, and the HTTP/HTTPS administrative interface is enabled only on the LAN interface (disabled on the WAN interface).Do I need to upgrade FortiOS to protect against this vulnerability?

I am stuck in a situation where I am facing an issue with Google Meet video and voice within the enterprise network.I am using a 100F FortiGate firewall and have created a policy to block all unnecessary traffic from the public internet. Additionally, I have created a policy for Google Meet with no inspection. However, I am still facing the same issue.Can anyone help me with this? Is there any issue with NPU-offloading which is causing the issue in the google meet performance. 1. Implemented QoS for Google Meet, but it did not work.2. Implemented a no-inspection policy to bypass UTM features. #fortigate

So, I have an E61 firewall and it's got a nice SSL VPN on it for my 10 or so users who are in other countries.  These users connect and we are using an LDAP integration for authentication. Today, I found out that people are trying to access the SSL VPN using real usernames from the org, and when they enter the wrong password three times, the user is locked out of Active Directory. For now, the SSL VPN is disabled. I need a solution for this.   My first thought is to get some tokens and enable 2FA. Can some of you experts make some suggestions about how to best mitigate this? Thanks

I need to make it so that when a machine plugs a network cable into my network it can't get an IP via DHCP, but when I register the machine's MAC it can use my NETWORK, how could I do that?

We decided to implement an SD-WAN solution for two branches and the head office. We plan to deploy one FortiGate firewall at each branch and a clustered firewall (HA pair) at the head office. We are facing a licensing issue when attempting to apply a FortiManager Cloud license for this solution due to the clustered device. Can we proceed with a FortiManager Cloud license for three devices for this solution, or do we require a license for ten devices?

Hi,Due to recent vulnerabilities in radius, we would like to enable Message-Authenticator on our clearpass server.After enabling this option in clearpass, we get errors in clearpass that the radius packet received from FortiGate-1100E (v7.2.8 build1639 (Mature) is without Message-Authenticator as below.Is it possible to enable this? Source RADIUSLevel ERRORCategory AuthenticationAction UnknownDescriptionFailed to decode RADIUS packet - Received packet from x.x.x.x without Message-AuthenticatorTIA :) 

Hi folks.I did not found an answer in the following request:FortiGate ver. 7.6 with managed FortiSwitches & FortiAp's.Created an SSID in tunnel mode, and i want to mirror this traffic to a port in the FortiSwitch for sniffing.Any idea?(creating software switch does not have the choice of selecting  the SSID interface).Thanks 

I am trying to debug some ssl-vpn connection stuff.  If I run "diag debug application sslvpn -1" it generates a lot of debug lines.  Downloading the output and filtering through it to find what I need is not fun.  Is there a way to filter this by the source IP of the remote VPN client?  Or by some sort of VPN session ID?  Or something so that I can focus on troubleshooting a single user without having to wade through all the other connection data?

Does fortinet consider start providingh VPN only MSI format installers? so we can push the vpn clients thru GPO or other RMM tools? and if there is one for, if you could create one that is OFFICIAL, i would like to get hands on it. FortiClientVPNSetup  I am looking for the latest the greatest version. 

Hi FGT/EMS adminsIn FOS 7.2.10 I was able to add multi TCP Forwarding entries in my ZTNA server, while in FOS 7.4.7 I can add only one.Why this has changed? Did I miss something?

Hi There,I hope it is possible.My company uses Office 365, therefor we use the office 365 Active directory solution.in case it is possible - I was wondering how do I integrate between my 40F, running the latest firmware with the Active directory - in order to login to the 40F.I want to use my AD user instead of local user. I prefer not to install LDAP server etc. since we don't have hardware for it.

Fortinac is configured to send firewall tags to my gate. Communication is working fine. For wired switchports in Role Based Access mode, the tags are being properly sent when the Network Access Policy is matched.  However, I can't seem to get it working for wifi. Although the correct NAC policy is hit, logical network is assigned, and VLAN is changed, I still get:Looking up LogicalNetworkConfiguration for LogicalNetwork prod-wifiUsing SSID Name:root:corp_wifi, id: 439Returning LogicalNetworkConfiguration: AccessConfiguration- Task ID:[null]- Network:[prod-wifi]- Access Value:[VLAN_230]- Access Action:[2]- Alias:[false]- Send Groups To Firewall:[false]- RadiusAttributeGroupId:[1]- Version:[9]- Tags: []- Firewall Groups: [] One thing I noticed is there really isn't a config for applying RBAC to a Wifi SSID. Could this be the issue ?  

Hi, EDIT:I alreay find the solution, just set the set name using "msg", and it is working as expected.---------------------------------------------------------------------------------------------------------------------------------I am new to fortigate, I just got a fortigate 60e(192.168.98.99) with os version 7.4.7, and a debian device(192.168.98.178) directly conneted 60e.I setup a link monitor on 60e in order to monitor if the debian device is online or not.Till now, link monitor is working as expected: # diagnose sys link-monitor status Link Monitor: n1, Status: alive, Server num(1), cfg_version=0 HA state: local(alive), shared(alive) Flags=0x1 init, Create time: Sun Jan 26 16:39:12 2025 Source interface: internal5 (12) VRF: 0 Interval: 2000 ms Service-detect: disable Diffservcode: 000000 Class-ID: 0 Transport-Group: 0 Class-ID: 0 Peer: 192.168.98.178(192.168.98.178) Source IP(192.168.98.99) Route: 192.168.98.99->192.168.98.178/32, gwy(192.168.98.9

Hi we are new to fortigate's and need a little help/advice. We are currently adjusting the security level of our firewalls to a higher level. i.e we setup up the firewall rules first, next we implemented the IPS-sensor on a interface policy. After this we added the web-filter profile to the same policy. so far so good, but when we added the AV-profile also to this interface policy a important application stopped working. We checked the security logs but there are not active blocks/messages regarding what is being blocked. We made a second interface profile and only added the AV-profile and enabled it ... the applicationn is no longer being blocked but we are thinking that second profile is not being used (see config information under)config firewall interface-policyedit 1set uuid xxxxxxxxset logtraffic allset interface "port1"set srcaddr "all"set dstaddr "all"set service "ALL"set ips-sensor-status enableset ips-sensor "xxxxx all_default"set webfilter-profile-status enableset webfilter-

Hello everyone, Looking for a solution to this after a week of searching and trying. I wanted to setup a FG 100F v7.0.15  to be a vlan switch. I removed all the ports from the switch except port1 as it will not allow me to remove the last port of course. Problem... after setting up all the vlan switch vlans and adding the ports I want to the vlans, I create the trunk.  The trunk will not hand out the IP address from native vlan 1 or 0 on this product. To test my work before adding to the network, I take the PC and tag the NIC with the corresponding VLAN and I get the correct IPs per VLAN. If I remove all tags on the NIC leavin the NIC on 0 (Untagged) I get nothing when I am expecting the native VLAN 1 IP addressing.  What gives here? 

hi,i'll be creating multiple (a lot) SNAT policy in a multi-VDOM FGT which is an "F" series (1000 plus model)my question, do i enable/allow log "all sessions" or just "security events"?can my current platform (1000 plus F model) can handle such log?i just want to prevent any high CPU/memory due to lots of NAT processing/cache.