Solved

I'm playing with another VDOM setup.  This time the Root vdom will hold the primary traffic while a sub vdom will only have an inbound IPSec VPN connection for remote clients to connect too via forticlient.  I've got the root vdom setup and it's passing traffic correctly. The VPN terminates at VDOM-A.Here is a network mapI've got a VIP at the root vdom that's passing traffic through to the 10.2.2.2 IP.  I've got the firewall rule at root that's allowing traffic inbound to the VIP.  In VDOM-A, I've got VPN configured with the 10.2.2.2 interface (the intervdom link) so it should be all setup correctly.  The "external" (this is all in a lab, no actual real IPs involved) IP for the IPSec VPN is 40.40.40.35.  When I try to connect from a VPN client, the connection just times out and won't connect.If I run a "diagnose sniffer packet any 'host 40.40.40.35'" and run a ping 40.40.40.35 from the VPN client, I see traffic.  However, when I actually try to connec

Hello FAC adminsI'm working on FAC 6.6.2.I noticed that FAC's local LDAP can be used only for local user DB.So far I mainly used it as RADIUS server (Corp LDAP as back-end) in order to add MFA.But now following our new requirement I didn't find a way to use it as LDAP server for accounts that are imported from Corp LDAP.Is it me or this feature is not available? 

Hello, Recently, I upgraded all my FortiGates from FortiOS 7.2.6 to 7.4.5. After several weeks with no issues, I took a closer look at my configuration and noticed an unusual increase in IPSec VPN errors. Specifically, the TX error counter on the IPSec VPN interface has been steadily increasing on all FortiGates with a PPPoE WAN interface. stat: rxp=6099751 txp=4612589 rxb=3619539840 txb=1263016689 rxe=0 txe=3928 I thoroughly reviewed my configuration and conducted several tests. While I can replicate the TX errors, they don’t appear to impact traffic or data transfer. Given this, I decided to open a support case. After several weeks of investigation, no specific issues related to FortiOS have been identified. I’ve also attempted to adjust the MTU and TCP-MSS settings in my firewall policies, but these changes haven’t resolved the issue. I already tried to edit these values to lower size but nothing change. Here’s the relevant part of my configuration:conf

Can someone explain to me how to show the object installed in the Remote FGT or Local FGT.Example 1Create addressName Local-SubnetIP/Netmask: 192.168.1.0/24Mapped DeviceLocal-FGT 192.168.1.0/28Which IP/netmask is shown on FortiManager for this firewall address object for devices without a Per-Device Mapping set? Example 2Create addressName LocationIP/Netmask: 192.168.1.0/24Mapped DeviceRemote-FGT 172.168.1.0/24Which IP/Netmask will be installed on Remote-FortiGate, for the Local firewall address object?

getting send anyway error when using fortigate captive portal with http port.though it works post clicking on send anyway but I need to understand why I'm getting that aler  

Despite the following, we are still getting a barrage of brute force login attempts on our SSL VPN.- disabled web mode- using non 443 port- edited to the HTML page to hide login fields- created local-in policy to narrow sources, etc- tweaked the login attempt-limit, block-time, and login-timeout I am wondering if forcing the user to present a client certificate would reduce these attempts. In other words, does the enforcement of a client side certificate happen before a username/password attempt is made ? Any other ideas ? Don

I'm now on day 2 trying to fix this. This is just such a waste of my time; I'm going to have to scrap the VMs and start again soon. This is what seems to be required every time I need to renew the licence on these. am I hitting a BUG ?Multi VDOM setup in a lab, the LAB has its own NAT and firewall to access the internet.Any out rule. I'm Assuming the VM is using the "root" VDOM for the licencing. LAB-XXX-FW-A (root) # execute ping service.fortiguard.netPING guard.fortinet.net (208.184.237.61): 56 data bytes64 bytes from 208.184.237.61: icmp_seq=0 ttl=43 time=156.5 ms64 bytes from 208.184.237.61: icmp_seq=1 ttl=43 time=156.6 ms^C--- guard.fortinet.net ping statistics ---2 packets transmitted, 2 packets received, 0% packet lossround-trip min/avg/max = 156.5/156.5/156.6 msLAB-XXX-FW-A (root) # endLAB-XXX-FW-A # config globalLAB-XXX-FW-A (global) # execute vm-license XXXXXXXXXXXXXXXXThis operation will reboot the system !Do you want to continue? (y/n)yRequesting FortiCare li

Hi i have worker with data  and keeper for query how to add both node in Supervisor. i am doing this 1st time so please suggest me. 

Hello everyone, I'm writing to ask you something. If you look at Fortigate's Forword Traffic -> deviceSome logs show the device name correctlySome other logs do not display the device name properly.I posted something similar before, but I don't think it worked out well, so I'm writing it again. https://community.fortinet.com/t5/Support-Forum/About-automatically-collected-device-information/td-p/356012 Please let me know what items I should check.     And I'm guessing, but I'd like to ask if it's related to the issue that you didn't activate the device detect function.  Thank you

hi,can someone confirm if the workflow new "session list" only applies under "policy & object" section in FMG?i don't see the "session list" option under "device manager" section.   

Hi all, To support my problem description, please see attached diagram below, which is a simplified overview of my network. I am entirely new to Fortinet firewalls. I've always worked with Cisco firewalls but recently the company has decided to move away from Cisco and switch to Fortinet devices. I am setting up a FortiGate 70F on the latest firmware 7.6.2. By default out of the box the Fortinet was configured with WAN1, WAN2 and DMZ ports configured as "Physical Interfaces". Port 1 through 5 were setup in VLAN Switch Mode, with VLAN 0 configured on the default 192.168.1.0/24 network.My office network is on VLAN 70, subnet 10.70.70.0/24.I broke up the VLAN Switch and removed port 2 through 5 from it so that they would turn into physical interfaces again. Only port 1 is still in the VLAN Switch mode. See below:  Port 5 is currently my initial admin access port while I configure the firewall (that's why its called "Initial"). Whenever I connect this interface to

Hi, noticed something unexpected today. Internet access for specific host is blocked based on app filter.  When checking the UTM blocked rule i see it's actually blocked because of :  However, when viewing the APP_FILTER cloud.IT is only set to monitor :  Could be blocked on one of the overrides, but i see no further info in the Analyzer logs on which override.Is there any way to debug this further? 

when you face playbooks que overflow you won't be able to run any other playbook till all those are completedyou can simply run these commands to clear the que.rabbitmqctl purge_queue celery -p fsr-clusterand then restart all the services 

Hello everyone,strange issue here: I do have a FortiGate 120G with a bunch of FortiAPs. Since last week, one of our devices (Microsoft Surface) does not work any more on one specific AP.The FortiAP 231F is mounted in our assembly hall. The surface does connect to the Wifi (WPA2 enterprise) but it seems it does not receive an IP adress (dhcp via windows server). The IP get set to 169.254.14.38.  If I move to another access point (e.g. the one providing wifi on my desk -> FortiAP 231G) with the same settings and providing the same Wif works without any issues.As soon as I move back to the maintenance hall and the surface connects to the FortiAP 231F networking does not work any more. Windows showing "connected but no connection to internet". Any ideas? All other devices work without problems and the Surface did too until last week (nothing on the Forti configuration changed)

Hello, I would like to know how to use FortiAuthenticator to configure saml SSO login for Fortigate administrators, and how to specify a FAC group for Fortigate administrator login

Hello Fortinet Community, I have a network environment consisting of a FortiGate , Windows Active Directory 2019, Huawei iMaster NAC, and a newly purchased FortiAuthenticator . Both the FortiGate firewall and Huawei NAC are configured to authenticate users from Windows Active Directory using LDAP.Here’s the current workflow: When a user device connects to a switchport, the iMaster NAC detects the user and identifies their organizational unit (OU) (e.g., HR, Technical, etc.).Based on the detected OU, the switch assigns an IP address to the user from the corresponding VLAN (e.g., VLAN 10 for HR, VLAN 20 for Technical).After successful NAC authentication, the FortiGate firewall presents a captive portal when the user attempts to access the internet or DMZ. Upon successful authentication via the firewall portal, the appropriate policies are applied based on the user.The issue arises because users are required to enter their credentials twice: once for NAC auth

helloI need to restrict IPSEC VPN I need to connect only from UAE if anyone try to connect from outside UAE he ca notthanks

SAML based SSO VPN is not working

I have setup fortinet DPI but im getting untrusted cert error

How can I setup SWG on fortisase

Hi Guys, I am using Fortigate SFP module on Fortigate firewall & using brocade & extreme SFP module on switch. but the port is not coming up. Is there any compatibility issue with extreme & brocade SFP module ? Attached are the snapshots.Fortigate SFP ModuleExtreme & Brocade SFP Module  

Hello, In Fortinac I´m trying to add an Fortinet Fabric. I already added the Fortigate, but to add the fortiswitches do I need to have an valid Fortilink subnet (exemple 192.168.10.X)? I need to configure SNMP in the fortiswitch too? Thanks in advance 

The detailed information is: You are not allowed to access this resource because the SAML request from your service provider (https://192.168.199.60:10443) has expired. Please try to access your service provider page again.

Hi, I just want to know this in generic, I know it depends on environment of each network But is there a top recommended FGT firmware version that would be stable.in My environment we are upgrading to 7.0.16 

When we add credentials in FortiSIEM admin settings, it only asks to map IP.Same IP can belong to multiple clients also, But in mapping there is no option to select collector. So how to map credentials to correct device linked to correct collector. Also do i need to allow supervisor to firewall port 22 if i want to add SSH credentials? This is not possible by allowing collector to firewall connection over port 22?