Solved

Greetings, we're currently trying to build our new IPsec VPN Config coming from SSL-VPN.While reading the XML Reference Guide for configuring IPsec i stumbled upon an Inconsistency on "implied_SPDO" The "<implied_SPDO>" and the "<implied_SPDO_timeout>" literally contradict each other.For example on: https://docs.fortinet.com/document/forticlient/7.4.2/xml-reference-guide/96295 (however its the same on all Versions that i looked at) implied_SPDO states that Internettraffic is allowed when its set to 1.implied_SPDO_timeout however states  that "FortiClient blocks all outbound non-IKE packets when <implied_SPDO> is set to 1" and "Thus, setting <implied_SPDO> to 1 may have the side effect of blocking access to the captive portal, which in turn blocks access to the IPsec VPN server" Which makes no sense, according to various KB Articles here this looks like that non-IKE packets are allowed whe

Hi, in case any banking customer located in particular country and while initializing Fortisase portal we select same country pop only. Can we select additional pop location later on as per the requirement ?Also what to do if there is no logging pop location within the country. As customer belongs to banking sector will not allow to select logging to another country's pop.Pleas guide.. 

Hello, I have some old Fortigate equipment that need the latest version of the firmware, and I just noticed that Fortinet does not provide it until I have a support contract. Is this true? and I need to purchase the contract to download it for my old equipment?

HiI added a personal VPN connection to my FortiClient EMS. It connects to the VPN and everything looks ok. But when i do a route print it hasnt addad any interface, gateway or routes for the VPN. The corprate VPN works fine though.What can the problem be?If I do the exact same with another computer the personal VPN works fine, so it seems that it has something to do with my computer.Both computers have fresh updated Windows 11 on the same network. I have tried different versions of the FortiClient, both non-EMS clients and versions from 7.0.1 to the newest. Turned of the firewall. Nothing helps.It looks like the FortiClient isnt allowed to add the routes for my personal VPN, but only on this one PC?Any help or suggestions are appreciated. /Anders

May I create two different ssl-vpn portals with two different ports? For examples 10443 and 11443.

Hello, Fortigate 600 v7.2.9.Ports 1 and 2 on the Fortigate are not yet in use. I activate both.I plug PC1 into port 1 and PC2 and port 2.Should the two PCs be able to talk to each other now (of course I gave them both an IP address from the same network)? So are they in the same Layer 2 network?Or do you have to tell the Fortigate that ports 1 and 2 should be in the same vLAN, so to speak.I'm not actually talking about ports, but rather aggregates, but the logic should be the same. ThanksAlbMin

Hi all,it's possible to create an email warning message (on the fortigate or fortianalyzer) when the interface limit has been exceeded over 2 minute? Thank's in advanceMaurizio

Dear community,  anybody using Fortigate API to retrieve log traffic with this endpoint : /api/v2/log/disk/traffic/forward/system?filter=srcip==10.227.108.88&rows=10 I can get logs for a specific source or destination IP, but do you know anyway to get logs for a network ( example : 10.0.0.0/8) ? Running version :"version":"v7.2.10","build":1706 Thanks in advance for your help ;)  Looking the FortiDev documentation, only available filters are the following, but they didn't make the trick to filter on network after several test : filterarray[string] (query)Filtering multiple key/value pairsOperator | Description== | Case insensitive match with pattern.!= | Does not match with pattern (case insensitive).=@ | Pattern found in object value (case insensitive).!@ | Pattern not found in object value (case insensitive).<= | Value must be less than or equal to pattern.< | Value must be less than pattern..>= | Value must be greater th

Team, I have all the required licensing for FortiSASE (advanced, SPA etc) and have a requirement to provide access to private resources (RDP) for contractors (non-managed devices). Before I go down this route, is this a supported configuration using agentless ZTNA? Or am I better placed to leverage a different solution?TIA.Justin. 

Hello, I am looking for older version of FortiClient VPN version 7.0.8.0427. Can someone please help me with the information about where I can get the software.Thanks,VRG

I tested SSL-VPN and IPsec Remote Access with Fortigate VM Evaluation.But,it didn't work both.Is that Evaluation limitation?I found Restrictions,as "Support low encryption operation only",that means I can't use  SSL-VPN and IPsec Remote Access?

LS,I'm trying to install a new GUEST SSID using the fortimanager, 7.2.8.------- Start to retry -------- FW003 $ config wireless-controller vap FW003 (vap) $ edit "WK-GUEST" FW003 (WK-GUEST) $ config mac-filter-list FW003 (mac-filter-list) $ edit 1 FW003 (1) $ next FW003 (mac-filter-list) $ end FW003 (WK-GUEST) $ next FW003 (vap) $ end ---> generating verification report ( wireless-controller vap mac-filter-list ) add entry 1 <--- done generating verification report install failedAny thoughts?

Hi @Anonymous,Can someone help me figure out how to get the currently logged-in user details through a playbook in FortiSOAR?Thanks.

We would like to delete the default admin accounts on FortiManager, FortiAuthenticator, FortiAnalyzer and FortiClientEMS and replace them with another generic account for security reasons. Is it safe for all these systems to delete the default user admin? For FortiManager and FortiAuthenticator I can see inside the logs that there are some actions performed by the admin user internally from the system. So I would like to ensure that deleting the account won't break something. Kind reagards

I have a internal (default) network 10.25.0.0/24 on port 1 and 2. I created a new network 10.20.10.0/24 on port 3.  Clients connected to the internal network can ping the Fortigate gateway 10.25.0.1.  Clients connected to the network on Port 3 cannot ping the Fortigate gateway 10.25.10.1.  The clients can all access the internet no issues.  In Administrative Access area of the interface configuration for Port 3, I have HTTPS, SSH, PING and Security Fabric Connection checked. Why can't my connected DHCP clients ping the gateway 10.25.10.1?  I can ping this address from CLI from within the firewall no issue (execute ping 10.25.10.1).  What am I missing? Also how do I setup a one way route so that a connection to 10.25.10.X can be initiated from the 10.25.0.X network, but not vise versa? Any help would be appreciated. Thanks!

DNS-DatabaseType: PrimaryView: ShadowDNS records within my private network.A erp 192.168.1.200A erp 192.168.1.201cmd: nslookup erp.exsampledomain.com192.168.1.201192.168.1.200always final a-erp-record like above.DNS round-robin is not working.How to set ?Regards

Hi everyone,I am facing a strange issue here: One of our laptops has bad network quality on MSTeams as soon as FortiClient is connected to EMS.The issue seems to appear only on WLAN, when Ethernet is connected via dockingstation (usb-c) everything works fine. But as soon as the user moves to another location and uses WiFi MSTeams has lot of dropouts when on a call. I tried disabling all security profiles but the issue still appears.Only thing that help is disconnecting the client from EMS in the zero trust telemetry section from FortiClient.I also tried the versions 7.0.x and 7.2.x. Any ideas?The affected device is a Dell Precision 7680 with an Intel(R) Wi-Fi 6E AX211 card... I have found some older issues (2 years old) with FortiClient and Intel wifi cards but nothing related to MSTeams...

Dear Concern,  I am using FortiGuard as the DNS server on my FortiGate, but today its status is showing as RED with high latency, as shown in the pasted capture.    Previously, it was showing GREEN. Additionally, when I use Google's DNS like 8.8.8.8 or 8.8.4.4, it shows unreachable, as shown in pasted capture.  I have checked the internet, and it is working perfectly with proper browsing through the same ISPs that are terminated on the firewall.  My Second Testing, When I use Google's DNS server on FortiGate, like 8.8.8.8 or 8.8.4.4, these IP addresses are pinging from the FortiGate CLI without any packet loss while in DNS Tab in FortiGate firewall showing unreachable as mentioned in above picture.  However, when I ping a domain name like google.com, it doesn't work, meaning the DNS is not resolving.  Then, when I bypass the FortiGate firewall and check by directly connecting the ISP link to my laptop, both the IP address and the domain name are

Hi Everyone!I am testing EMS for FortiClient VPN depolymant and have depoloyed the ova image of EMS 7.4.1 on my esxi and switched to multi site management. I tried to create a deployment package to deploy FortiClient via invention. At the final step (4) of the Installer package creation process i get the following error: failed to create deployment package: not enough disk space.It does not depend if i use multi site configuration or not. i tried both. Same error.The Interface tells me, that there is 30% free space availible. Has anyone encountered the same error and has a fix?Regards,Thomas 

Overview/Scenario1. I have a use case for configuring NAT where in which an isolated Azure virtual desktop session host will traverse a NEW public ip address assigned to my Fortigate Azure NGFW virtual machine's WAN interface.2. Any IPs requiring egress traffic outbound will use cenrtal SNAT in a one-to-one mapping for all ip addresses within my AVD subnet range: `192.168.235.0/24`Questions:1. Could you please critique my implementation logic below? Relativley new to FortiGate, so please excuse the basic questions. I sourced FGT docs on [central SNAT](https://docs.fortinet.com/document/fortigate/7.6.1/administration-guide/421028/central-snat)2. As the new Azure public ip is assigned to the WAN interface of my FGT device, would DNAT be required? Not sure how FGT would route traffic from the new public IP inbound to my AVD subnet. However, there is currently no requirement to translate destination addresses to specific services within the isolated AVD subnet Proposed Azure deploymen

Looking into the benefits of FSSO in our environment for the purposes of restricting internet access. What does FSSO give you that a simple LDAP group doesn't within a firewall policy ? Or are they to be used in conjunction ?  Thanks all!

I am using Fortigate 100G in HA and running Firmware 7.2.9. The issues I am facing is the interface is able to reach the NTP Server. NTP Server : 192.168.1.10FGT MGMT : 192.168.1.4 I have added a MGMT interface under dedicated management interface, which changes the MGMT interface in different vdom and getting removed in interface GUI. I want to get the time through management interface. I have configured NTP with below config set ntpsync enableset type customset syncinterval 1config ntpserveredit 1set server "192.168.1.10"once I try to add command "set source ip" it is showing below error "192.168.1.4 does not match any interface ip in vdom root." , as Management interface is removed from root vdom So my question here is can we configured ntp on dedicated management interface vdom, or how can we achive. Also I am referring to below docs in which we can set the interface under ntp server-->edit 1, but I cannot see it in my firewall. https://docs.fo

First of all, I am inheriting this network and I believe this to be setup incorrectly however I've never seen someone try to do it this way. I have a two site-to-site fortigates with a switch behind each. I am getting inconsistent pings to the far switch. The far fortigate is also getting intermittent pings to its switch (they are connected via copper which has been swapped out).  The LAN interface is set to 192.168.0.1 and the switch's Management interface is set to 192.168.0.2. Under the FG's LAN interface are SVIs for the various vlans on the switch. It seems to me that the problem is likely that the OOB mgmt interface is being used or is there something on the FG side that I should look at?

Dear all, I have diagram as below:       --------- tunnel 01 --------------Hub (lo0)                                      (Lo0) Spoke       ---------- tunnel 02 ------------- I am using BGP on loopback to set up routing via 2 Tunnels. (FortiOS 7.4.4)And I try to set up SD-WAN Rule to steering BGP traffic (Keepalive, updates...) via tunnel02.In the sd-wan rule: I set: source is Lo0 of spoke and destination is Lo0 of Hub, Outgoing interface: i used Manual : Tunnel02 is first order and tunnel 01 is last order. Member is 2 tunnel interface SD-WAN zone. But after that, I can not see any hit count on the sd-wan rule, and diagnose packet port 179 : traffic still via tunne01. I am wondering what is my mistaken ? (or BGP update processed by SDWAN rules ?) (I have another sd-wan rule to allow all (all source and all destination), used SLA

Hey Guys We are facing Hight SSL Negotiation time, when WEB filter profile has enable on the rule at Security Profile.When we disable de WEB Filter profile on the rule, the SSL Time improve considerable .To test i'm using this curl command, for google website. But this issue occur with any destination addresscurl —resolve www.google.com.br:443:142.250.219.131 -w "DNS_resolution: %{time_namelookup}| TCP_negotiation_time: %{time_connect}| SSL_negotiation_time: %{time_appconnect}| TTFB: %{time_starttransfer}| Total time: %{time_total} \n" -o /dev/null -vsL https://www.google.com.brWhen WEB Filter profille is enable the SSL_negotiation_time is more 3 secondsWhen WEB Filter profile is disabled  the SSL_negotiation_time is not more tham milliseconds When I check on System ==> Fortiguard  My Web Filter Status is average 123 ms. Someone experienced this same issue ?