Solved

Dear Experts, When IPsec VPN at IPsec aggregation with SD-WAN is down, Trap fgTrapVpnTunDown(1.3.6.1.4.1.12356.101.2.0.302) is not sent,although "VPN tunnel down" is enabled at SNMP events.For information linkDown(2) of MIB 1.3.6.1.6.3.1.1.5 is sent. Can someone tell me how & what I should change so that fgTrapVpnTunDown is sent? Thanks in advance. 

Is it possible to make the Fortigate route traffic in this way:External dns pointing to fortigate public ip > fortigate external interface > route the traffic based on dns to a internal IP ONLY if it matches the requested dns?example using other dns names:google.com > 8.8.8.8 (fortigate external ip) > 192.168.1.200 (internal system) Essentially asking if the fortigate can serve the same purpose as a reverse proxy which checks source packets trying to match dns and redirect to a local server. I hope i explained in a understandable way and thanks in advance.

Hi, I have a problem with forticlient 7.2.2.0776 on Mac OS Sonoma 14.1.2.When I'm connected to forticlient for a specific customer, I can't access Internet at all (email, Teams, web browser...). However, when I log on to the same customer via forticlient on a Windows computer I don't have the problem. So it seems like an issue related to my Mac. But what is strange is that I have another customer who uses forticlient and when I log on to that customer on the same Mac, I have access to internet, so it doesn't seems related to my Mac after all. I'm very confused and don't know where the restriction is- Is it something that I should do on my Mac (but if yes why it's working for another customer on the same mac?)- Is it something that the admins of my customer should do on their side (if yes, do you know what they should do?) RegardsYoan.

Hello everyone,I’m planning a new installation for FortiNAC and I’m trying to decide between FortiNAC 9.4 or FortiNAC-F 7.6. I’m not entirely sure about the key differences between the two versions and which one would be the best fit for my needs.Could someone please explain the differences between FortiNAC 9.4 and FortiNAC-F 7.6? Specifically:What are the feature differences?Are there any performance or scalability considerations?Which one is more suitable for a medium to large enterprise environment?Additionally, if anyone has experience with configuring either of these solutions, I would greatly appreciate any tips, best practices, or even a step-by-step guide to help me get started.NB: my licence is : FortiNAC Control and Application Extended VM Certificate (FNC-CAX-VM for 2 VMs)(LIC-FNAC-PRO-100)Thank you for your help!Best regards,

Hi, We are planning on rolling out a handful of Fortigates 90G - currently we have 3 setup in a non-production environment. We are receiving a TLS link between some sites and other sites will use ADVPN Hub\Spoke with SD-WAN and dual ISP. The VPN part is working fine and so I've removed those links for the time being.  For the TLS we have 2VLANs on our hub FortiGate (200,300) setup under port3.  Our PC connected to the main Fortigate can each all other Fortigates. The other PCs connected to the other Fortigate can reach the hub but cannot each the Fortigate at the other end. The reason looks like BGP is not interesting the route into the routing table. As it is the only path to the destination, I am not sure why and am clearly missing something.  Willing to post any config that will help. Here are screen captures of what I'm referring to. The first one is the main Fortigate where the trunks for the TLS from our ISP will come in and the second one is th

greetings guys,I am trying to understand how the sd-wan performance SLA probing traffic (for example, Ping/ICMP) is steered.I have configured the SD-WAN performance SLA, two member interfaces are selected in the SLA, let's say, port1 (MPLS in the picture) and port2 (OL_INET in the picture). the SLA is using Ping as the probing protocol probing the detect server 10.74.x.x.port 1 is an MPLS underlay interface, port 2 is an overlay based on Internet IPsec tunnel. If I use the CLI in fortigate, I do see the probing traffic (ICMP echo/request) is flowing through the member interface added in the SLA. diag sniffer packet OL_INET 'dst host 10.74.x.x' 4 0 ainterfaces=[OL_INET]filters=[dst host 10.74.x.x]2025-02-24 06:43:45.156019 OL_INET -- 10.250.a.b -> 10.74.x.x: icmp: echo request diag sniffer packet OL_INET 'src host 10.74.x.x' 4 0 ainterfaces=[OL_INET]filters=[src host 10.74.x.x]2025-02-24 08:01:03.828714 OL_INET -- 10.74.x.x -> 10.250.a.b: icmp: echo reply the 1

Hi Team, Can you help with the following issues:I want to restrict the number of mails received from incoming emails from Gmail, Yahoo, and Outlook domains. However, the session profile can only be applied to the IP Policy and not directly to domains. What solution is available?Is there a way to see the sender's IP address (not the sending server's IP) for an email on FortiMail?Thanks. 

Hello community, Is there a way to block MAB for rogue devices in FortiNAC? The issue i'm facing is with a Cisco Switch with the following configuration in the portsinterface GigabitEthernet1/0/9switchport access vlan 31switchport mode accessswitchport voice vlan 18authentication host-mode multi-domainauthentication order mab dot1xauthentication priority dot1x mabauthentication port-control autoauthentication periodicauthentication timer reauthenticate 180mabsnmp trap mac-notification change addedsnmp trap mac-notification change removeddot1x pae authenticatordot1x timeout quiet-period 10dot1x timeout server-timeout 30dot1x timeout tx-period 10spanning-tree portfast This port is intended to work with MAB for a Phone and with 802.1x for PC, however when a PC with no supplicant with certificate connected to the phone, the switch sends mac to FortiNAC, and I see Login OK with mac address, and therefore the device is able to receive the Default VLAN (in this case VLAN 31 whi

Hello guys. We have a couple of HTTP 1.1 web sites which sit behind our FortiWeb and we're having some issues with the chunked transfer encoding configuration. We're trying to follow the fortiweb troubleshooting guide instructions on the topicHow does Web Protection modules support Transfer.Encoding: chunked . According to the docs, we should set chunk encoding to enable and this should be enough for ensuring that buffering won't be used for those type of requests. Unfortunately, this isn't what we're seeing after enabling this setting. For starters, all the resources from the HTTP server are returned to the clients as chunked (even those that aren't being encoded into chunks by the http server), ie, fortiweb is transforming all http server responses into chunked transfers after enabling the previous setting (ex.: the http server will buffer js files before returning them and these requests are transformed into chunks which are then sent to the real client).&nb

Hello guys, Even though I'm still not sure on how FortiWeb  supports chunked encoding, I'm hoping that someone can help me understand the faq's content on this topic, specificaly on the behavior form 7.0.2 onwards. The doc starts by saying the following: From 7.0.2, FortiWeb replaced set chunk decoding enable/disable with set chunk encoding disable/enable.The default configuration is disabled, which equals to set chunk decoding enable in 7.0.1; FortiWeb will decode chunked response and convert it with Content-Length.When configured as set chunk encoding enable on 7.0.2, FortiWeb decodes and reassembles the chunked response, performs the WAF modules’ operations, and encodes the new content with chunked again, then sends it to the clients. I understood it as saying that whenever FortiWeb detects a chunked encoded response from an HTTP 1.1 server, it will receive all the packets from the server, decode it and then apply all

Hello guys. I'm trying to use an openapi doc  to validate all the web api calls made to one of our web apps. I've already uploaded the openapi doc and set everything up. However, there's an issue: it seems like FWB can't handle array parameters passed through query string and it  will always consider them a violation of the openapi docs. Here's a snippet of our openapi doc that is used for validation: openapi: 3.0.1 ... /api/pedidosassistencias/pesquisa: get: ... parameters: - name: estados in: query schema: type: array items: $ref: '#/components/schemas/EstadoPedido' description: Estados do pedido a filtrar ... `EstadoPedido` is an enum and the openapi doc does enforce those values (the ones passed on the next snippet are all valid). We've tried several different strategies in order to pass the array through the query string: // several parameters option 1 (

I realize the following is a not so great idea but would like to know if this is even possible since management may require it.Is it possible to give all users with a valid AD account permissions to create pre-provisioned guest wireless accounts in FortiNAC? Based on the following snippet from the FNAC admin guide, I can't use the AD Domain Users group: "The domain users group cannot be used to set administrator privileges because user details for users in that group are not populated in FortiNAC when a directory synchronization is done." So, before I ask our AD admin to create a new group named something other than Domain Users and add all user accounts to it, I'm posting to see if this is even possible. 

Hi,As a replacement for SSL VPN for remote users, we have implemented IP SEC dialup.Users connect with forticlient. Everything works fine.However, I would like to be able to force the disconnection of sessions after a set time (i.e. 12 hours), even if traffic is generated.I have not been able to test any functional solutions.Do you have any idea how to do this?

Hi all, completely new into FortiEMS or in generell into Fortinet.Right now we are running on FortiEMS Cloud 7.2.5.1061 and would like to upgrade to the newest version. Found this article:https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-upgrade-the-firmware-of-EMS-cloud/ta-p/216177 Unfortunately there are no informations about what time (only day) this will happen or something about how long this will take (will there be any downtime?). Thanks, regardsMarc

hi,been trying to google search the "F" series platform/model (i.e. 40F, 101F) but got limited info/data sheets.just would like to ask:1.why is it called "F"? is it just an upgrade/iteration from previous "E" series2.is "F" series only got an upgraded ASIC/chip, i.e. SOC and CP and added number of CPUs?3.is item 2 above the only "selling" point of the "F" series?4.any other "unique" feature/distinction for the "F" series platform?

Hi,I'm trying to configure our Fortigate v7.4 to provide dialup IPSec VPN to FortiClient on Windows. The VPN works fine with user certificate but if I want to use computer certificate instead, or enable VPN before login, the VPN failed. I tried to give user access to the certificate key of the machine certificate without success. Any advices are much appreciated. Here is an abstract of the FG config: config vpn ipsec phase1-interface  edit "Staff VPN"    set type dynamic    set interface "portn"    set ike-version 2    set authmethod signature    set peertype peergrp    set net-device disable    set mode-cfg enable    set ipv4-dns-server1 x.x.x.x    set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-   prfsha256    set localid "StaffVPN"    set comments "VPN: Staff VPN (Created by VPN wizard)"   

Hello,i was looking for the OID in the FortiAP showing the number od client connected for each AP.Any guess ?Thank youB. 

Hi, Based on document, I try to download and install evaluation license. But I got the error message. Anyone can help to take a look at it? Thank you very much.  HQ-FW # execute vm-license-options account-id daxxxxx@gmail.comHQ-FW # execute vm-license-options account-password ayyyyyxHQ-FW # execute vm-licenseThis VM is using the evaluation license. This license does not expire.Limitations of the Evaluation VM license include:1.Support for low encryption operation only2.Maximum of 1 CPU and 2GiB of memory3.Maximum of three interfaces, firewall policies, and routes each4.No FortiCare SupportThis operation will reboot the system !Do you want to continue? (y/n)yRequesting FortiCare Trial license, proxy:(null)Forticare response error 61.Failed to download VM license. HQ-FW # get system statVersion: FortiGate-VM64-KVM v7.2.4,build1396,230131 (GA.F)Virus-DB: 1.00000(2018-04-09 18:07)Extended DB: 1.00000(2018-04-09 18:07)Extreme DB: 1.00000(2018-04-09 18:07)AV AI/ML Model: 0.000

Hi, last week we updated our FG cluster to FG200F with 7.4.5.We had some problems but in general it seems quite OK. Only with SSL VPN we still have problems and we cnat get it functioning.1. Connecting with Local User it works fine, I get the certificate window and I can login, no prob!2. User from LDAP, connection to LDAP works fine, I can even test my credentials and OK but than connecting to the SSL VPN I dont geht the ceretificate pop up and after 48% I get Permission denied and -455We did the same as in all other FGs. We imported the same remote certificate and everywhere it works. We checked groups and everything and it should be OK.In System Events VPN I get:Action ssl-login-failReason sslvpn_login_unknown_user What else can we try? It seems like the FG is not checking the certificate and we try with "Require Client certificate" and without and no change  Thanks!

hello, On a Fortinet vdom I need to migrate current SSL VPN with LDAP Auth to Azure SAML Auth.There are LDAP Auth UserGruups, every UserGroup is mapped to a single VPN SSL Portal.What I need to achieve is to set up Azure SAML Auth and map new User Groups to the same VPN Portals. UserGroup-1-LDAP -> Portal-VPN-SSL-1UserGroup-1-SAML-AZURE -> Portal-VPN-SSL-1 Is it possible without compromise or modify actual VPN SSL Portal configuration? Thanks a lot, Graziano 

Hi FG admins From this tech tip:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Most-common-cases-of-SIP-implementation/ta-p/190676 I have this scenario (phones behind NAT): Did all the required config, and even more:config system settings set sip-expectation disable set sip-nat-trace disable set default-voip-alg-mode kernel-helper-basedendconfig system session-helper delete 13endconfig voip profile edit "default" config sip set rtp disable set contact-fixup disable end end... Played with the above parameters and FG reboot but didn't work. I mean I have this behavior:Calling from internal IP phone to external mobile cell phone (GSM): It rings but no voiceCalling from internal IP phone to internal IP phone: IP phone doesn't even ringIn the traffic logs I could see some "TCP reset from server" on SIP connections.So I'm starting to think that probably on server side must be somehow configured to accept calls from IP phones behind NAT. Anyone knows somet

i have enabled syslog logging for 1x FG100E and 1 x FG100F.but the log collector does not seems to receive any logs from these 2.Only the main firewall FG401E is able to send logs to the log collector without issues.is there any limitations for FG100 series ?

Good day,I need an explanation or on the contrary a solution to the following problem(Note: I am an amateur in this world and my English is not very good)  I have a machine with IP 192.168.1.10, I also have two ISP channels, these are located within the virtual-wan-link SDWAN zone and finally I have a rule for the Internet output of the mentioned machine When reviewing the machine's traffic, it is evident that its output is being generated through my first Internet channel and in addition, packets are seen sent but not received by the destinations, that is, web pages. As a solution to this problem, an SDWAN rule was created so that all traffic to the Internet from said machine was carried out through my second Internet channel, which generated an effective response, that is, packets sent by the source (Machine) were shown as packets received by the destination (Web pages).  We consulted with the provider of our first internet channel to determine if the public

I would like to permit only screenconnect (cloud hosted) on a computer that is in network. This computer does not need internet but we would like to be able to connect to it remotely via screenconnect in case of troubleshoot. We already do this at another site but with logmein (similar product) and it works perfectly but in that case I can select all the logmein destination (internet service) but there's is no screenconnect or connectwise entry in the internet service section on the fortigate. Is there any way that I could do this?

Hello Sirs, I am a noob as FortiSIEM. Recently I have received a firewall from Taiwan that call ShareTec, INF-8600That's the firewall log flow as below.  10.40.53.34        Feb 19 17:39:26        l7fw        daemon        info        conntrack        CEF:0|Sharetech|INF-8600T|9.0.2.5|10|TRAFFIC|10|deviceExternalId=E2056E3621080056 dvchost=INF-8600T cs1Label=Rule cs1=102 act=allow proto=UDP start=1739957929000 end=1739957966000 src=10.40.53.214 dst=10.10.12.11 spt=58463 dpt=443 out=4992 in=0 cn1Label=APP cn1=1270 Also i try to writed alot time with AI such as below, <DOCUMENT><eventFormatRecognizer><![CDATA[^([^\t]+)\s+([^\t]+\s+[^\t]+\s+[^\t]+)\s+([^\t]+)\s+([^\t]+)\s+([^\t]+)\s+CEF:.*]]></eventFormatReco