Solved

Hello, I would like to know how to use FortiAuthenticator to configure saml SSO login for Fortigate administrators, and how to specify a FAC group for Fortigate administrator login

Hello Fortinet Community, I have a network environment consisting of a FortiGate , Windows Active Directory 2019, Huawei iMaster NAC, and a newly purchased FortiAuthenticator . Both the FortiGate firewall and Huawei NAC are configured to authenticate users from Windows Active Directory using LDAP.Here’s the current workflow: When a user device connects to a switchport, the iMaster NAC detects the user and identifies their organizational unit (OU) (e.g., HR, Technical, etc.).Based on the detected OU, the switch assigns an IP address to the user from the corresponding VLAN (e.g., VLAN 10 for HR, VLAN 20 for Technical).After successful NAC authentication, the FortiGate firewall presents a captive portal when the user attempts to access the internet or DMZ. Upon successful authentication via the firewall portal, the appropriate policies are applied based on the user.The issue arises because users are required to enter their credentials twice: once for NAC auth

helloI need to restrict IPSEC VPN I need to connect only from UAE if anyone try to connect from outside UAE he ca notthanks

SAML based SSO VPN is not working

I have setup fortinet DPI but im getting untrusted cert error

How can I setup SWG on fortisase

Hi Guys, I am using Fortigate SFP module on Fortigate firewall & using brocade & extreme SFP module on switch. but the port is not coming up. Is there any compatibility issue with extreme & brocade SFP module ? Attached are the snapshots.Fortigate SFP ModuleExtreme & Brocade SFP Module  

Hello, In Fortinac I´m trying to add an Fortinet Fabric. I already added the Fortigate, but to add the fortiswitches do I need to have an valid Fortilink subnet (exemple 192.168.10.X)? I need to configure SNMP in the fortiswitch too? Thanks in advance 

The detailed information is: You are not allowed to access this resource because the SAML request from your service provider (https://192.168.199.60:10443) has expired. Please try to access your service provider page again.

Hi, I just want to know this in generic, I know it depends on environment of each network But is there a top recommended FGT firmware version that would be stable.in My environment we are upgrading to 7.0.16 

When we add credentials in FortiSIEM admin settings, it only asks to map IP.Same IP can belong to multiple clients also, But in mapping there is no option to select collector. So how to map credentials to correct device linked to correct collector. Also do i need to allow supervisor to firewall port 22 if i want to add SSH credentials? This is not possible by allowing collector to firewall connection over port 22?

Hello,I am experiencing an issue with the dot1x configuration on FortiNAC.I am using FortiNAC 700F, version 7.2.8.0149. I have followed all the steps shown in this video:https://www.youtube.com/watch?v=7pRg2-SVipoThe problem is that I don’t have the "EAP-Type-Name" option.I still followed the entire video and applied the instructions, but when I connect a PC to the switch port where dot1x auto-registration is enabled, the PC shows "authentication failed." On the FortiNAC side, I don’t see any activity logs. Here is the switch configuration: interface GigabitEthernet0/17switchport access vlan 2switchport mode accessswitchport voice vlan 150srr-queue bandwidth share 1 30 35 5priority-queue outauthentication host-mode multi-hostauthentication port-control autoauthentication periodicauthentication timer reauthenticate 180mabsnmp trap mac-notification change addedsnmp trap mac-notification change removedmls qos trust device cisco-phonemls qos trust cosdot1x pae authentic

Hi, im having an issue with my FortiEMS as it says that my license is about to expire but i already renewed it.I already tried the function "Sync License now" on the Dashboard but it didn't help.Is there any other way to get the EMS to read the new license?Im using FortiEMS 7.2.4Thanks  

We have a Third Party that would like to allow us access to a subnet on their system via a Site to Site VPN. There is no need for them to access stuff on our network but they want us to use a small subnet to avoid clashes on their end of the network ( 192.168.255.1 / 24 as an example ) we have set this subnet up as a Vlan and have setup and established a IPSEC Tunnel and the tunnel works if your on aforementioned subnet.  Is there anyway to get a Fortigate FG100 to route traffic from another subnet over this tunnel? I can't create a static or policy route to route traffic to the gateway address 192.168.255.1 as it just complains it's a interface address (well yes )) Essentially we want it to take traffic from our vlan(s) and act as a NAT gateway sending stuff over the VPN. In the past we have done this by having another router take traffic out of the main router and pipe it back in via a WAN port. This is a little Jank though and I was hoping for something a bi

Hi, all. I cannot ping a local interface IP on the Fortigate from a AWS host, connected through a VPN tunnel. I can ping the interface using a dial-up (FortiClient). It goes like this: From PC connected through FortiClient (IP is 10.10.1.2):Pinging 192.168.4.1 with 32 bytes of data:Reply from 192.168.4.1: bytes=32 time=1ms TTL=255Reply from 192.168.4.1: bytes=32 time=1ms TTL=255Reply from 192.168.4.1: bytes=32 time=1ms TTL=255 From linux host in AWS:PING 192.168.4.1 (192.168.4.1) 56(84) bytes of data.(zzzzz)--- 192.168.4.1 ping statistics ---22 packets transmitted, 0 received, 100% packet loss, time 21481ms To a host on the interface subnet, from linux host in AWS:PING 192.168.4.13 (192.168.4.13) 56(84) bytes of data.64 bytes from 192.168.4.13: icmp_seq=1 ttl=127 time=21.1 ms64 bytes from 192.168.4.13: icmp_seq=2 ttl=127 time=21.2 ms On the Fortigate, a trace shows Packet Trace #2004,2024/12/04 08:57:54,"vd-root:0 received a packet(proto=1, 172.31.32.14:53

Hi all,We are slowly moving to password-less based login for our users. We have already piloted YubiKeys as our primary method of authentication. As a failsafe we are now testing also FortiAuthenticatior agent for windows since we already have it on-premises. The login with PIN and Token works fine without any issues. What is happening is, that from time to time (once, twice, multiple times per day, or maybe not even happening) login screen starts behaving erratically not displaying login screen at all. In the event logs I can see, that it was caused by crashed LoginUI.exe and Fac_AgentCredentialProvider.dll and ucrtbase.dll. Here is the log:Faulting application name: FAC_Agent.Service.ServiceHost.exe, version: 6.0.0.0, time stamp: 0x66dba094Faulting module name: ntdll.dll, version: 10.0.19041.5007, time stamp: 0x688f8c4bException code: 0xc0000374Fault offset: 0x00000000000ff3c9Faulting process ID: 0x14d4Faulting application start time: 0x01db40bfcd70a7caFaulting application

Hi, Can anyone share the link where I can see the EOS / EOL products, right now I need the FortiAP EOS. Thanks

Background on environment.Root vdom contains all the physical interfaces for traffic to the internet and vmware stack.  All traffic coming into or flowing out of the VDOMs has to route through Root.  Vdom-A and Vdom-B share IP schemes, so everything has to route through the Intervdom network 172.17.17.0/28.  Vdom-A has a VPN tunnel to another site.  The traffic to establish the VPN flowsInternet > Root Vdom > VIP in Root VDOM that translates the external traffic to 172.17.17.1 (the vdom-a side intervdom link between Root and Vdom-A) > Vdom-A picks up and establishes the VPN tunnel.In my initial test, the VPN establishes and traffic flows so I know I've got that part set up correctly.  However, Vdom-A will have a server with a "public IP" (let's call it 40.40.40.40 just for ease of conversation) that should be only accessible through the VPN.  I'm having some difficulty in establishing where the private IP (let's call it 10.10.10.40 for ease o

How does fortisase spa works and how can we setup

I've come across a strange something I've never seen before in web categorisation. There is a link that Is currently getting blocked on of my FG's. Looking at the logs on the FAZ it was Categorised as Advertising but when looking on FortiGuard's web filter lookup It has the category of business. Creating a simple exemption would get me access to the link but was just wondering why there would be this difference. FG is running on 7.0 could it just be the OS version the FG is on? 

Is it possible to sync the fortigate webfilter with the EMS

Hi, I'm getting an SSL certificate warning when using FortiClient VPN on 1 of my Linux machines but not on 2 other Linux machines. Why does this only happen on 1 machine and not on the others? I've tested this on 3 machines, and only 1 of them has this problem (openSUSE). Context: - There are no certificate warnings at all if we visit the SSL endpoint in the browser, or when we run 'sslscan' or 'testssl.sh' on the SSL endpoint: vpn.ourdomain.tld:10443All good here. - All 3 machines are running the same FortiClient version: 7.2.2 (build 7.2.2.0753) - libssl versions on the 3 machines:Debian: 3.0.11Fedora: 3.0.8openSUSE: 3.1.4 - All 3 machines are using the same DNS server, same DHCP, same internet connection. - The cryptographic policies are set to DEFAULT. - To make FortiClient usable at all on openSUSE, I temporarily(!) disabled AppArmor. That allows me to establish a successful VPN connection, although I see the certificate warning shown in the

I'm facing issue while using 2fa fac agent for wins loginthe fac agent login portal itself is not getting trigger and getting bypass with admin login

Hi,on CLI console I want check interfaces configuration without success.admin@fortinac:~> show system interface-bash: show: command not foundadmin@fortinac:~> execute show system interface-bash: execute: command not foundI try also with root user without success.With command get the result is the same.Fortinac appliance is a virtual machine.Could you help me?  Thanks  

Hello everyone,I recently discovered that the FortiAuthenticator supports a proxy authentication mode for remote RADIUS servers:FortiAuthenticator DocumentationHowever, the FortiGate does not seem to offer a similar option:FortiGate 7.4.5 Documentation (our current version)FortiGate 7.6.1 Documentation (latest version)If you want to set up remote Dial-Up IPsec VPN tunnels using EAP-TLS authentication via Microsoft NPS (RADIUS), it seems you would need to purchase a FortiAuthenticator solely to forward the requests to the remote RADIUS server.Will FortiGate ever introduce a proxy mode for authentication via remote RADIUS servers?