Solved

I have 4 real DNS servers behind a common Virtual Server using UDP forwarding on port 53 on our FortiGate that has been working for several years. I now have the requirement for the client IP to be preserved for the DNS servers so they can apply their own policies to the client traffic based on source IP. It is currently being replaced by the FortiGate's IP. Any suggestions on how to achieve this? Cheers - Mike SOLVED: it was easier than NAT(which was not on) it was the flow/proxy setting - oops

Hi,we have a VLAN on a 40F that is being provided through some 3rd party access points. We enabled the disclaimer portal for that VLAN for guest access. We don't want them to type in an E-Mail or provide guest accounts.The disclaimer portal works well but we need to extend the (idle) timeout to more than 300 seconds.Where can I do that? None of the settings seem to alter that value. I tried:config user setting > set auth-timeout Xconfig wireless-controller timers > set client-idle-timeout Xconfig system settings > set auth-timeout X In this article using a mail collection portal, it is somehow set to 10 days (864000) by defaultRetail environment guest access | FortiGate / FortiOS 7.6.0 | Fortinet Document Library But mine always looks like this:192.168.3.17        src_mac: 98:69:8a:XX:XX:XX        type: disclaimer, id: 14, duration: 368, idled: 210        expire: 90, allow-idle: 300 

I have a fortigate 60f connected to a fortiswitch 108F-FPOE (full power switch), then connected to a fortiap 231f and a 441k.  I have created an ssid that only supports wifi6e using 6ghz, is enabled, has wpa3 sae for security, shows that it is enabled in the dashboard. however it is not broadcasting... one small issues I noticed I set the channels to only allow uni5 and uni6 however it still says it is using channel 1.  any support would be great thanks. 

Hello everyone,I did enable web filter on our FortiClients when outside company LAN. Some users notified me that they get a lot of pop up notifications from FortiClient: It seems like FortiClient does block some IPs that belong to Microsoft teams (according to ioc.fortiguard.com). These IPs get blocked over several clients.Any ideas how to fix this? As far as I know normally there is the URL shown in these logs, seems like Microsoft Teams accesses to IP directly without DNS? 

Hello everybody, I'm working in a ZTNA environment. we have a simple ZTNA Firewall Policy rule that is working perfectly for each single Windows user.All the users (windows or macos) have the same tags. I have these tags too (I'm a macOS user):when a macOS user tries to access ZTNA, we can see on Fortigate an error like this:date=2024-10-09 time=16:14:43 id=7423779172176101376 itime="2024-10-09 16:14:43" euid=3 epid=101 dsteuid=3 dstepid=1053 logflag=3 logver=702101706 type="traffic" subtype="ztna" level="notice" action="deny" policyid=15 sessionid=10994158 srcip=xxx dstip=10.1.0.214 srcport=52177 dstport=3389 duration=19603 proto=6 sentbyte=10454368 rcvdbyte=31622617 logid=0005000024 service="RDP" app="RDP" appcat="unscanned" srcintfrole="wan" dstintfrole="lan" policytype="proxy-policy" eventtime=1728483282890140384 wanin=31622617 wanout=7184424 lanin=10454368 lanout=32300828 crscore=30 craction=131072 crlevel="high" poluuid="7f1a8a84-dfd7-51ee-4200-2edb944b93d3" srccountry=

Hello everyone, Does anyone please know where I can find Fortinet products presentations individually on the Partner portal ? Best regards,

Hi,We have a Fortinet account, when we login in the support website, we never recieve the security code to e-mail. When we try the "Lost FortiToken" option we recieve the code but it doesn´t work either What can we do? Regards

I am using the FortiWeb 7.6.0 Web Application Firewall and have a question regarding the threshold-based profiles under the bot mitigation policy. Specifically, this pertains to features like: • Vulnerability Scanning Detection• Crawler Detection• Slow Attack Detection• Content Scraping Detection Currently, I do not see an option to set separate thresholds for single IPs versus shared or NATed IPs. This presents a challenge, as shared IPs naturally generate higher traffic and are more likely to exceed thresholds. The WAF then monitors and blocks such IPs for a default duration (e.g., 5 minutes), which could disrupt legitimate users behind those shared IPs. To address this, one solution could be increasing the thresholds to accommodate shared IP traffic. However, doing so risks giving excessive leeway to a single IP, which could be exploited by malicious users. Whitelisting shared IPs is not a viable option either, as it could lead to security risks if one of the users be

Since FortiToken is OAUTH compliant, can we not use Google Authenticator instead? Anyone been able to work that out? thanks,

Cannot apply default webfilter-profile to external Firewall policy.  It fails with no error and I am not sure what I am doing wrong or how to correct this problem. I am following the guide below while using FortiManager Cloud: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-deep-inspection-and-import-a/ta-p/196840  I can apply the below settings:application-list - defaultav-profile - defaultips-sensor - defaultssl-ssh-profile - deep-inspection However, when I configure: webfilter-profile - default The policy fails to apply with no error, see log below: Starting log (Run on device)  Start installingtestsr-fortigate $  config firewall policytestsr-fortigate (policy) $  edit 8testsr-fortigate (8) $  set ssl-ssh-profile "deep-inspection"testsr-fortigate (8) $  set webfilter-profile "default"testsr-fortigate (8) $  nexttestsr-fortigate (policy) $  end  ---> generating verific

Hello All,I have Fortinet Single Sign-On (FSSO) Agent installed in DC Agent mode on both of my domain controllers (DC01 and DC02).Observations:When a user logs into the network with DC01 as their logon server:The user appears in the Show Logon Users list on the FSSO agent.The collector forwards this information to FortiGate, and the user is also visible in the FSSO user list on FortiGate.When a user logs in with DC02 as their logon server:The user appears in the Show Logon Users list on the FSSO agent on DC02.However, this information is not forwarded to FortiGate.Troubleshooting Steps Taken:Verified that FortiGate can connect to both domain controllers on TCP/8000 without any issues.Confirmed that the registry path Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FSAE\DCAgent\CA contains the IP addresses of both DC01 and DC02 on both servers.Confirmed the IP address of DC02 as a secondary-server in the FortiGate configuration.Restarted FSSO services on both DC01 and DC02.De-authenticated

Hello Guys,  I hope you're all doing well.I'm fairly new to Fortinet's SD-WAN and recently tried to do a deep dive into it. So I set up a lab with fortimanger and 3 fortigate, one as a hub and the other two as spoke. The aim is to understand how it really works and to set up all the configuration using a CLI model without using “orchestration overlay” in order to understand all the steps. I've read a lot of different articles on Fortinet documentation and other websites and I've seen a lot of different configurations/design depending on the Forti OS version. I'm really struggling to understand the different designs and the best mode to use depending on the situation, and also how certain concepts work. So I hope to find my answers here... Since the 7.0.x version : => BGP on loopback + ADVPN 2.0 (RR-less) :    => BGP on loopback + ADVPN 2.0 (RR) : Before the 7.0.x version : => BGP on overlay interface (VTI) +

I have a site to site vpn mounted with my private subnet (10.0.1.0/24) and Teltonika router RUT951 subnet (192.168.10.0/24) which is connected to internet through dial up (SIM Card Telcel). The site to site is up and successfully running on phase1 and phase2 selectors..... But I canNOT ping or telnet from server in private net to the router RUT951 itself nor any device behind the router.But I am able to do ping or telnet successfully from router RUT951 to server in private net. From Fortigate CLI tried to do ping on 192.168.10.1, but no luck.My guess is the issue should be on the firewall of the router RUT951, but I am new on this so I need help. I have both policies allowing all access from RUT951 -> PRIVATE NET and PRIVATE NET -> RUT951 like below: PRIVATE NET -> RUT951 Policy (This one does not work if doing ping or telnet disabling or enabling NAT, same result). RUT951 -> PRIVATE NET (This one works perfect i can do ping

I'm playing with another VDOM setup.  This time the Root vdom will hold the primary traffic while a sub vdom will only have an inbound IPSec VPN connection for remote clients to connect too via forticlient.  I've got the root vdom setup and it's passing traffic correctly. The VPN terminates at VDOM-A.Here is a network mapI've got a VIP at the root vdom that's passing traffic through to the 10.2.2.2 IP.  I've got the firewall rule at root that's allowing traffic inbound to the VIP.  In VDOM-A, I've got VPN configured with the 10.2.2.2 interface (the intervdom link) so it should be all setup correctly.  The "external" (this is all in a lab, no actual real IPs involved) IP for the IPSec VPN is 40.40.40.35.  When I try to connect from a VPN client, the connection just times out and won't connect.If I run a "diagnose sniffer packet any 'host 40.40.40.35'" and run a ping 40.40.40.35 from the VPN client, I see traffic.  However, when I actually try to connec

Hello FAC adminsI'm working on FAC 6.6.2.I noticed that FAC's local LDAP can be used only for local user DB.So far I mainly used it as RADIUS server (Corp LDAP as back-end) in order to add MFA.But now following our new requirement I didn't find a way to use it as LDAP server for accounts that are imported from Corp LDAP.Is it me or this feature is not available? 

Hello, Recently, I upgraded all my FortiGates from FortiOS 7.2.6 to 7.4.5. After several weeks with no issues, I took a closer look at my configuration and noticed an unusual increase in IPSec VPN errors. Specifically, the TX error counter on the IPSec VPN interface has been steadily increasing on all FortiGates with a PPPoE WAN interface. stat: rxp=6099751 txp=4612589 rxb=3619539840 txb=1263016689 rxe=0 txe=3928 I thoroughly reviewed my configuration and conducted several tests. While I can replicate the TX errors, they don’t appear to impact traffic or data transfer. Given this, I decided to open a support case. After several weeks of investigation, no specific issues related to FortiOS have been identified. I’ve also attempted to adjust the MTU and TCP-MSS settings in my firewall policies, but these changes haven’t resolved the issue. I already tried to edit these values to lower size but nothing change. Here’s the relevant part of my configuration:conf

Can someone explain to me how to show the object installed in the Remote FGT or Local FGT.Example 1Create addressName Local-SubnetIP/Netmask: 192.168.1.0/24Mapped DeviceLocal-FGT 192.168.1.0/28Which IP/netmask is shown on FortiManager for this firewall address object for devices without a Per-Device Mapping set? Example 2Create addressName LocationIP/Netmask: 192.168.1.0/24Mapped DeviceRemote-FGT 172.168.1.0/24Which IP/Netmask will be installed on Remote-FortiGate, for the Local firewall address object?

getting send anyway error when using fortigate captive portal with http port.though it works post clicking on send anyway but I need to understand why I'm getting that aler  

Despite the following, we are still getting a barrage of brute force login attempts on our SSL VPN.- disabled web mode- using non 443 port- edited to the HTML page to hide login fields- created local-in policy to narrow sources, etc- tweaked the login attempt-limit, block-time, and login-timeout I am wondering if forcing the user to present a client certificate would reduce these attempts. In other words, does the enforcement of a client side certificate happen before a username/password attempt is made ? Any other ideas ? Don

I'm now on day 2 trying to fix this. This is just such a waste of my time; I'm going to have to scrap the VMs and start again soon. This is what seems to be required every time I need to renew the licence on these. am I hitting a BUG ?Multi VDOM setup in a lab, the LAB has its own NAT and firewall to access the internet.Any out rule. I'm Assuming the VM is using the "root" VDOM for the licencing. LAB-XXX-FW-A (root) # execute ping service.fortiguard.netPING guard.fortinet.net (208.184.237.61): 56 data bytes64 bytes from 208.184.237.61: icmp_seq=0 ttl=43 time=156.5 ms64 bytes from 208.184.237.61: icmp_seq=1 ttl=43 time=156.6 ms^C--- guard.fortinet.net ping statistics ---2 packets transmitted, 2 packets received, 0% packet lossround-trip min/avg/max = 156.5/156.5/156.6 msLAB-XXX-FW-A (root) # endLAB-XXX-FW-A # config globalLAB-XXX-FW-A (global) # execute vm-license XXXXXXXXXXXXXXXXThis operation will reboot the system !Do you want to continue? (y/n)yRequesting FortiCare li

Hi i have worker with data  and keeper for query how to add both node in Supervisor. i am doing this 1st time so please suggest me. 

Hello everyone, I'm writing to ask you something. If you look at Fortigate's Forword Traffic -> deviceSome logs show the device name correctlySome other logs do not display the device name properly.I posted something similar before, but I don't think it worked out well, so I'm writing it again. https://community.fortinet.com/t5/Support-Forum/About-automatically-collected-device-information/td-p/356012 Please let me know what items I should check.     And I'm guessing, but I'd like to ask if it's related to the issue that you didn't activate the device detect function.  Thank you

hi,can someone confirm if the workflow new "session list" only applies under "policy & object" section in FMG?i don't see the "session list" option under "device manager" section.   

Hi all, To support my problem description, please see attached diagram below, which is a simplified overview of my network. I am entirely new to Fortinet firewalls. I've always worked with Cisco firewalls but recently the company has decided to move away from Cisco and switch to Fortinet devices. I am setting up a FortiGate 70F on the latest firmware 7.6.2. By default out of the box the Fortinet was configured with WAN1, WAN2 and DMZ ports configured as "Physical Interfaces". Port 1 through 5 were setup in VLAN Switch Mode, with VLAN 0 configured on the default 192.168.1.0/24 network.My office network is on VLAN 70, subnet 10.70.70.0/24.I broke up the VLAN Switch and removed port 2 through 5 from it so that they would turn into physical interfaces again. Only port 1 is still in the VLAN Switch mode. See below:  Port 5 is currently my initial admin access port while I configure the firewall (that's why its called "Initial"). Whenever I connect this interface to

Hi, noticed something unexpected today. Internet access for specific host is blocked based on app filter.  When checking the UTM blocked rule i see it's actually blocked because of :  However, when viewing the APP_FILTER cloud.IT is only set to monitor :  Could be blocked on one of the overrides, but i see no further info in the Analyzer logs on which override.Is there any way to debug this further?