Solved

hello everybody, I defined a ZTNA Group that includes two ZTNA Tags:  I know that a firewall policy can work with ZTNA Tags. But is it the same for a local-in-policy?Looking at the documentation: config firewall {local-in-policy | local-in-policy6} edit <policy_number> set intf <interface> set srcaddr <source_address> [source_address] ... set dstaddr <destination_address> [destination_address] ... set action {accept | deny} set service <service_name> [service_name] ... set schedule <schedule_name> set comments <string> next end It generally talks about a destination address. But is the local-in-policy capable of understanding a ZTNA group?I didn't find anything indicative about this. I'm working on a Fortigate 60F v7.2.11.Thank you

Hi. I have a Cisco switch configured with gateway IP at 10.24.111.65. The switch is connected to the fortigate through a trunk with VLAN 101 tagged. Im trying to do vlan-routing from my VLAN1 which is configured with gateway in the fortigate to VLAN101 with the Cisco Switch as gateway. I have created VLAN101 in the fortigate without address.Firewall policies from-to VLAN1-VLAN101.Static route Destination 10.24.111.64/255.255.255.192, Gateway 10.24.111.65 and Interface VLAN101 I cannot ping the gateway or any devices on vlan 101 from vlan 1. (Reply from 192.168.80.254: Destination host unreachable.) The devices on VLAN101 are showing up in the fortigate users & devices under VLAN101. What am I doing wrong?The cisco and all devices connected to that is supplied by a third-party supplier and I cannot do any configuration on that network.

Today we received a security audit assessment from a 3rd party security company. They indicated they can login successfully to our border FortiGate firewall using jsconsole from a trusted management interface. The trusted management interface is connected to the Out-of-band (OOB) Management network and is restricted to specific internal users including the 3rd party security company performing the audit. Can anyone speak to this access, good, bad, indifferent?Can jsconsole be used to make changes to the firewall?Is there a way to block jsconsole access?Thank you 

Ran into this issue today and figured I would post the solution, since I couldn't find it. Situation is a VPN hub/concentrator running 5.2.8 with multiple IPSec VPN peers configured as dynamic/dialup peers. When testing the new firewalls one at a time before shipping out, each one worked fine. But after users received them at their site, none worked. They all kept bouncing up and down. Tunnels would establish, and then with 2-3 seconds go back down again, over and over. The solution was to disable add-route under the Phase 1 settings for each VPN peer: config vpn ipsec phase1-interface     edit "DVPN-PEER-1"         set add-route disable     next end I didn't capture the log message, but what was seen was a message indicating that route 0.0.0.0/0 was being passed from one VPN to the other. Since Phase 2 selectors are set to all zeroes, and add-route is enabled by default for a dynamic pe

I'm testing Fortigate-VM-Evaluation adn EMS Client Trial(Server),Fortigate-VM can't accept certificate of EMS Client.Fortgate-VM:OS Firm 7.2.10EMS:7.0.7build0398Is there any possible mistake to setup for EMS and Fortigate、or perhaps, Evaluation cannot be used.By the way,when I tried phisical-Fortigate-100F with EMS、it worked.Physical-Fortigate-100F could accept certification of EMS.Please help!!

I want to WAN2-port to Dedicated as Ethernet Trunk.Is this possible?Even WAN2-port role is changed to LAN-role,there is no "Dedicated as Ethernet Trunk".I have to choose port1～port6 using by "Dedicated as Ethernet Trunk" ? 

Hello,I'm trying to connect with iPhone on a tunnel SSLVPN (with MS SSO configured) and the FortiClient VPN app on device says:"The network connection was lost."The same SSLVPN tunnel works fine from an Android device.How can I resolve ?Regards,Leandro

Am I right in thinking that setting set username-sensitivity enable for a local LDAP user just removes the set username-sensitivity disable line from the user's config? set username-sensitivity enable doesn't persist in the config when I enter it, and I want to be sure I have this right. I assume entering set username-sensitivity enable is the same as entering unset username-sensitivity ?

Hello, I have made a deny policy on the Fortigate 7.4.7 and assigned some FQDNs as source on LAN to WAN communication. However, I realized it doesn't work. When I tried the policy with the IP addresses, it worked as it should. Then, I executed below command where "ABC.Domain.com" is our internal network host's FQDN.   exe ping ABC.Domain.com   Result:   Unable to resolve hostname.   We are using the Fortigate DNS servers as below:   #show system dns config system dns set primary 96.45.45.45 set secondary 96.45.46.46 set protocol dot set server-hostname "globalsdns.fortinet.net" set dns-cache-limit 300 end    Also:   # show system dns-server config system dns-server edit "lan" set mode forward-only set dnsfilter-profile "default" next end    FYI, I'm able to ping the hostnames in my endpoints but not in comman

In the GCP environment I set up the VM where I installed the ova file downloaded directly from the Support Fortinet site (see below for example)        After installation I tried logging in with the default credentials both in SSH and from the GUI but I get this error when logging in            Thank everyone in advance!#FortiPortal #GCP

hi Community, We have a website that goes through our fortiweb with HTTP authentication with AD enable. Is there a possibilities to exclude this authentication rule based on IP Address? thanks

Hello,  We have a fortigate 80F. There is a Firewall Policy, which has WebFilter enabled for traffic from LAN to Internet. The problem is that we are trying to access a sftp with IP. I see in the logs that the IP is categorized as Unrated. I created a new Web Rating override and in the URL I've added the IP we are trying to access (The override is to use a different category to allow the access). Obviously the URL field is for URLs, so the IP is still been treated as unrated. To overcome this issue I have created a new Policy rule so the traffic for this specific IP is not using the WebFilter UTM.Is there any way (except making the Unrated category allowed) to overcome this issue?

I want to build a HA with FortiClient and my current EMS has 150 client licenses but do i need to buy another 150 for the implementation of a HA or will the client use the same license when switching to the second EMS?

Hello Community, Why I don't have ddns settings in fortigate interface, although I can configure ddns via CLI. Is it because of a license issue? 

We are having a bizarre problem since updating to 6.2.1 (we updated due to a memory leak issue in 6.2.0). Certain sites are giving us a ERR_SSL_PROTOCOL_ERROR only in Google Chrome. I have tried all the usual troubleshooting for this error, but the only thing that fixes it is restarting the fortigate. Two sites (facebook.com and login.renweb.com) both use TLS 1.3, but we can get to facebook without a problem and we cannot get to the other site. After rebooting the device, it works for several days and then starts behaving poorly again. Other browsers work fine, including Internet Explorer, Edge (not Chromium based) and Firefox. I have attempted to disable SSL certificate inspection, but that does not seem to affect the problem one way or another. I also tried putting the fortigate back on its factory certificate. My next step will be to revert to 6.0 branch, where I did not experience this issue, but I figured I would post first to see if anyone had similar exp

Hello everybody,I'm the Fortigate 60F (v7.2.10) admin, and I log into it at: https://vpn.xxx.com:40443/ or https://10.1.0.1:40443/ I defined a local-in policy to momentaneously deny the access to this page to all the users. All the policy above this one are disabled: edit 5set uuid d5c73f7a-eae5-51ef-8ecd-4cb99f22bef3set intf "any"set srcaddr "all"set dstaddr "login"set service "HTTPS-40443"set schedule "always"next The dstaddr is:   while the service is:  I should access the login page from everywhere. Why? What I am doing wrong? vpn.xxx.com is a DNS entry:    

How my product is locked why I can't registered Please help urgently   

Hello everybody, I'm working on a Fortigate 60F (v7.2.10) and I manage my Fortigate at the address: https://vpn.xxx.com:40443orhttps://79.x.x.x:40443  (for externals)https://10.1.0.1:40443  (for internals) because 79.x.x.x is the wan1 interface, I defined two local-in-policy:  login_group is an address group:     HTTPS-40443 is:    The policy n.1 works fine, if I try to access (10.1.0.1:40443 or vpn.xxx.com:40443) I correctly see the login page.From the same network (10.1.10.0/24), another device, can't (correctly).If I use an external device (for example my phone), connected to a different external network, it can access vpn.xxx.com:40443 and also 79.x.x.x:40443. The policy n.2 doesn't generate any log. What am I missing?    

Hi there, I'm encountering problems with the newest FortiClient VPN application. The primary problem is that after hitting the connect button, it displays "Disconnect," yet when I verify the IP, I'm aware that it's not connected.

Hi All, I've just configured link-monitor to allow failover to WAN2 when internet access through WAN1 is unavailable.I've applied this config without any errors, but it doesn't appear to display all the settings.config system link-monitor (link-monitor) # edit "WAN_Failover" (link-monitor) # set srcintf wan1 (link-monitor) # set server "8.8.8.8" "4.2.2.1" (link-monitor) # set protocol ping (link-monitor) # set gateway-ip xxx.xxx.xx9.17 (link-monitor) # set interval 500 (link-monitor) # set failtime 5 (link-monitor) # set recoverytime 5 (link-monitor) # set update-static-route enable (link-monitor) # set status enable The resulting config is displayed below.FW1 # show system link-monitor config system link-monitor edit "WAN1_Failover" set srcintf "wan1" set server "8.8.8.8" "4.2.2.1" set gateway-ip xxx.xxx.xx9.17 next endAs you can see, the following parameters are missing.(link-monitor) # set protocol ping (link-monitor) # set interval 500

Hi All,I'm trying to configure a WAN2 failover but I'm getting stuck on NAT.I have a primary leased line internet circuit on WAN1.I have a secondary FTTC internet circuit on WAN2Both WAN interfaces are in a WAN-ZONE.All firewall policies currently have a specific outbound NAT address with a dynamic ip pool address.This outbound NAT address is different to the public IP assigned to the firewall.The IP Pool addresses are Overload addresses.I have several IP Pool addresses with incremented public ip addresses assigned.Some firewall policies will have different outbound NAT IP Pool address.It is a single public IP from the range allocated to the internet circuit on WAN1. I plan to configure link-monitor to detect when there is problem with WAN1, override the current static routes and send all outbound traffic via WAN2. The problem. When testing, If a client hits a policy like this below, it cannot get to the internet.This is due to the option, "Use Dynamic IP Pool"

Hello Expert, I configured a Stitch to backup our Fortigates firewall to an solarwinds tftp server. But I notice once the backups are completed for a week it is not running automatically for the next week. I did some troubleshooting and found that last trigger date and next scheduled trigger is same.Unsure if this is preventing the backup from running at the next appointed time.I humbly request some help . Please results before for guidance .  Guy-Head-Office-1 # diagnose test application autod 3alert mail log count: 0 stitch: Weekly_backups_to_TFTP (scheduled)local hit: 0 relayed to: 564 relayed from: 564last trigger: last relay:Sun Feb 9 14:08:41 2025next scheduled trigger:Sun Feb 9 14:30:00 2025actions:Upload Backup config to Tftp Server:done: 564 relayed to: 564 relayed from: 564last trigger: last relay:Sun Feb 9 14:08:41 2025 Thank youRegards  

In a FGCP cluster trying to get session sync traffic over the dedicated interface with the set session-sync-dev command. But the corresponding diagnose output seems to indicate it doesn't work. fgt1 (root) # diagnose sys ha session-sync-devHA sessync ports: 1dmz probe: HA probe, Standalone connected, peer_mac = 00:00:00:00:00:00HB pkts: rx=0, tx=508298SES pkts: rx=0, tx=0 Seems to indicate HB packets are send, but none received. Also the status remains probe for HA.The cluster is connect with a direct cable, no switch in between or such.Tried with other interfaces also, wan1, internal4, ... Anyone has this working and different command (diagnose sys ha session-sync-dev) output? What are your counters and status?

Hello everybody,I've a simple IPsec tunnel on my Fortigate 60F (v7.2.10):  Is it possible to reserve a particular address to a specific client based on the MAC address. Let's suppose I want to reserve 10.212.134.221 for the client whose MAC address is xyz. Is it possible? My attempt was:I connect from the xyz PC, then I go to Settings -> DHCP Monitor -> Select the client ad reserve the address. Unfortunately, during the IPsec connection, the client is not shown inside the monitor.Is there any way to do what I want?Thank you!

 I have two Sites (Site A) using Fortiddns, and Site B using Daillup . There is VPN tunnel between them and it's working fine. I want to make DNAT for my server and it's behind Site B. I don't have public IP Addresd .it's not working in this scenario?