Solved

how to upgrade FAC in HA

FORTIMANAGER UPGRADE PROCESS

The customer wants to configure Microsoft Entra ID in FortiClient EMS while using Azure AD Connect to synchronize users. They currently have on-premises Active Directory integrated with EMS for user synchronization. Can both On-Premises AD and Microsoft Entra ID be used simultaneously in FortiEMS, with specific endpoint policies assigned to users from Entra ID and others to users from on-premises AD 

Since upgrading our EMS server to 7.2.5 and our clients to FC 7.2.5, the clients Web Filter, Video Filter, Vulnerability, and System Events no longer populate in EMS at all.  These events don't update under the Endpoint Views for the clients and therefore the Vulnerability Dashboard does not show any information for detected Vulnerabilities either.  If you check the clients, they are definitely logging these events and, they are just no longer being populated in EMS.  I've checked every setting in EMS and on the Client configurations and I can not find out what is breaking this.  I've confirmed that the necessary ports are still open and that there are no filters in place to prevent them from showing in EMS.  The clients are still successfully updating everything else in EMS just not the event info. Anyone else come across this and have a fix?

Hello everyone, i working on new job and there is FortiGate 100F (i`am new to fortios) Users pass captive portal authorization for internet access, but Security mode on Lan Interface is disabled,also didn't find anything at config. FortiOS cookbook shows that captive portal configurate at Interfaces, where another places i can find current settings of captive portal? FortiOS 6.2.16 FortiGate #FortiOS 6.2.12

Hi I have issue when i already authenticated myself in Captive Portal but I cant connect to the internet. on the browser says error Your connection is not Private; NET: ERR_CERT_COMMON_NAME_INVALID.  but if i disable the captive portal, i can open the internet with no problem.   Could you please advise?

Hi All, Error Message: Connection with License Server Failed I have two subnet configured on my firewall fortigate 60F. SAP B1 was configured on the 172.18.10.x subnet and users are coming from subnet 172.18.10.x.  We can do ping and connect to the server, but we are not able to log in as we get the error message above.  anyone have same problem?

I have this problem with Fortinac. I have a port and computer A is plugged into this port. When computer B is plugged into the same port, both computer A and B appear under the port even though computer A is not plugged in. Even though I deleted computer A, it is still under the port. The device is quarantined because there is more than one device. Fortiswitch can be used.

getting below error on FAC 2024-11-24T17:02:41.605283+05:30 NIC-FAC-MC radiusd[7644]: (25771) facauth: Remote ldap user 'manoj': NULL password is not allowed2024-11-24T17:02:41.605289+05:30 NIC-FAC-MC radiusd[7644]: (25771) facauth: Remote LDAP user authentication failed2024-11-24T17:02:41.605799+05:30 NIC-FAC-MC radiusd[7644]: (25771) facauth: Updated auth log 'manoj': Remote LDAP user authentication(chap) with SMS/email dual token failed: invalid password USER IS remote user AD user and we are using chap on the FGT acting as a client

Hello, I have some issues with dns forwarding between to fortigates (601E and 601F) over a site to site VPN tunnel.In general the VPN is working great and there are no connectivity issues at all.Main-Site (FG 601F) has some internal DNS zones with entries and some of them forward to other DNS servers. The DNS service is enabled on all interfaces and each client on main site gets all dns entries of Main-FG as it should.On site B (FG 601E) I tried to create the same DNS zones as on Main site and entered the Tunnel IP of Main-FG as DNS forwarder. If a client on Site B tries to query anything from those zones from FG-B it gets no answer. If the client tries to directly query the Tunnel IP of Main-FG it works, but that's not what I want. Does anyone has an idea what could be wrong? I already experimented with source-ip and stuff but it didn't help. Both Fortigates have FW 7.4. Greetings,daniels7

Hello,i'am a new user in fortigate world :) with FG-51EI read some tuto to learn how it works, and i'm stuck with routing between vdom.it won't work :'(i'm french, and my isp provider is named free.To be able to watch tv with their player, it have to get an IPV6 SLAAC without DHCPv6. unfortunately, i don't know how to do that with fortigate. (it's not the subjet but if someone can help me for this point, i will be very happy )So i create a root vdom in transparent mode, with member interface wan 1, and port 1. my tv player works without problem.now, i create another "test" vdom in NAT mode, for testing, homelab. the interface member are the others portsi wish to link this nat vdom with the root transparent vdom, and .... no way to make it works :'(i miss something but i don't know what.I relied on these links, for helpinghttp://socpuppet.blogspot.com/2014/09/a-meshed-vdom-transparent-using-inter.htmlhttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Connect-2-Transparent-VDOMs-w

This is my first foray into the need for VXLAN and have some questions. My current site has a L3 Aruba switch, which handles my internal VLANs, an egress VLAN connecting to my FortiGate which connects to both a private WAN circuit to my data center (which in turn, provides Internet) and a backup Internet circuit for Internet failover and the IPSEC VPN spoke to hub (data center). Bought new building that we will be moving to, so want to implement VXLAN so I can use the same VLANs and subnets for all the new equipment going in so when we do actually move, it will be an easier transition. So the VXLAN config will be a temporary situation (no more than 6 months is my guess). From a design perspective, my idea is to implement the same low cost Internet "backup" at the new site, but it will be the main Internet connection until time gets closer for the move to add the higher dollar private WAN circuit as the primary. I will establish a IPSEC VPN connection between the two sites dir

Hi  Am running Fortinac v7.4.0.0427 (GA) and the Endpoint Compliance doesn't run when a registered host connects back to the network ,or it takes very long to do so ,6+ mins however if i scan the host ,the compliance action is executed .Any idea why this could be happening ?

Hi  I want to achieve this :When a registered host is connected ,its first put in isolation vlan until it passes endpoint compliance ,is this possible? I have set the default vlan as isolation ,however when a registered host connects ,its moved from isolation -> production then isolated.Thanks 

Dear all,A question about how FortiGate handles the communication with a SCEP server when the CSR is based on elliptic curve.As stated in this FortiGate article [1], a CSR based on elliptic curve can be sent to a SCEP server.In that case, and as specified in the SCEP rfc8894 [2]:"The form of encryption to be applied depends on the capabilities of the recipient's public key. If the key is encryption capable (for example, RSA), then the messageData is encrypted using the recipient's public key with the CMS KeyTransRecipientInfo mechanism. If the key is not encryption capable (for example, DSA or ECDSA), then the messageData is encrypted using the challengePassword with the CMS PasswordRecipientInfo mechanism. "That further says: "Note that some early implementations of this specification dealt with keys that were not encryption capable by omitting the encryption stage, based on the text in Section 3 that indicated that "the EnvelopedData is omitted"My question: when emitting a CSR based

Hi guys. I have an issue with this device. Aleatory, it would work for some days, other days it would not turn on the radios. The logs shows it constantly leaving and joining. Accessed the SSH interface, and got the following log. Every exactly 24 seconds it shows a "signal 11 (Segmentation fault) received". What does it mean?   FP221ETF18009026> crash1: 2024-11-25 10:45:23 <05543> $ 8: e5d33000 e0822003 e15b31b6 e28310022: 2024-11-25 10:45:46 <05753> firmware FortiAP-221E v5.04,build437b176,170810 (Release)3: 2024-11-25 10:45:46 <05753> application wtpd4: 2024-11-25 10:45:46 <05753> *** signal 11 (Segmentation fault) received ***5: 2024-11-25 10:45:46 <05753> Register dump:6: 2024-11-25 10:45:46 <05753> r0: 00a47790 r1: 00a47790 r2: 00a5778e r3: 00a577de7: 2024-11-25 10:45:46 <05753> r4: 0023d598 r5: 000000a5 r6: 00000008 r7: 000000008: 2024-11-25 10:45:46 <05753> r8: 00000000 r9: 00000000 r10: b6fe9f7c fp: bead4a2c9: 2

I am having problems when upgrading to the new version of FortiAnalyzer. The database recontruction gets stuck and does not progress. It has been taking the same time for days. This does not allow me to review and collect logs.

greetings all, I got the information as following from FortiSwitch, what is an Internal port and the usual reason why it shows so much drops? Port(internal) is Admin up, line protocol is upInterface Type is Pass Through without PHYAddress is E8:ED:D6:51:77:14,MTU 10000 bytes, Encapsulation IEEE 802.3/Ethernet-IIfull-duplex, 1000 Mb/s, link type is autoinput : 13316481778 bytes, 82631689 packets, 0 errors, 481076 drops, 0 oversizes42314 unicasts, 55849479 multicasts, 26739896 broadcasts, 0 unknownsoutput : 252618470 bytes, 1781502 packets, 0 errors, 0 drops, 0 oversizes25319 unicasts, 1754202 multicasts, 1981 broadcasts0 fragments, 0 undersizes, 0 collisions, 0 jabbers thanks you.

hi,i was trying out 'worflow' in FMG and already had a few session list/history.i can't seem to remove/purge old session ID, so i just disable workspace and re-enable it back to clear it.can the old session be manually removed from the list so that only new session will appear and be approved? 

I've set up an IPSenc VPN between a head office and a branch office, two F60 fortigates, but we can't access the head office network folders, when I put DNS on the network card it works perfectly, without DNS on the card I can ping and everything, is there anything I can do so that I don't have to put DNS on the network card?

Hello, On my Fortigate 100F I would like to create an admin user with following profiles:- Able to change the admin users password- Able to update the SSH key of users But I didn't find the possibilities to do in system/admin profiles.Thanks.

I integrate Starlink Maritine antennas on Yachts.At the time of delivery of the Yacht, the Starlink antenna is not activated.The antenna is then activated months later.I need to make a report that demonstrates the correct functioning of the antenna (I don't want advice on how to prove if it works, I want to do it with the Starlink app).With the Peplink devices that we use, by implementing the following rule it is possible to reach the antenna via the Starlink App even if it is not activated:- Outbound policy – ​​IP Address 192.168. 100.1 – Enforced WAN 1 (where Starlink is connected).Installations on Yachts include an antenna, power supply and direct connection to the Fortinet WAN.The Starlink router is not present.I tried with a static route 192.168.100.1/255.255.255.255 but it doesn't work. Is it possible to instruct a Fortinet so that when a user is connected via the App he can reach the antenna even if it is not active?I hope I was clear.I'm waiting for your suggestions

Hello,I can't find any document about FG-200E EOL.I know it end of sale but I need to know about end of support date and it has not exited at the product life cycle.Thanks.

Hi, Please see the below diagram which shows connection for fortigate SDWAN. My question is after adding two Cisco ASR1K in front of Fortigate, what special configuration do we have to add so that we can let the fortigate SDWAN work well? Thanks    

Using the menu "VPN Location Map" does show me a nice overview of the currently connected VPN connections (IPSEC, SSL VPN). However, the locations of the fortigate are most of the time somewhere in the Gulf of Guniea (0°S, 0°E). The physical location of all our fortigates is configured in FortiCloud (product details) with the address (street, ZIP, town, etc.). I did not find a way to set the device location in the fortigate GUI, nor via CLI. I checked with dia "geoip geoip-query <IP>" on each fortigate it's own location and it shows a somewhat accurate location (sometimes off by a lot, based on the ISP). So, I have several questions:How does the fortigate determine it's own location used for the VPN location map? From the location configuration in FortiCloud? (difficult, if not impossible)Via geo-ip query? (most likely)If yes, which IP is used in a milti VDOM environment with several WAN IP's per VDOM?Note: If I use "dia geoip geoip-query <my-wan-ip&gt