Solved

hi,can someone confirm if the workflow new "session list" only applies under "policy & object" section in FMG?i don't see the "session list" option under "device manager" section.   

Hi all, To support my problem description, please see attached diagram below, which is a simplified overview of my network. I am entirely new to Fortinet firewalls. I've always worked with Cisco firewalls but recently the company has decided to move away from Cisco and switch to Fortinet devices. I am setting up a FortiGate 70F on the latest firmware 7.6.2. By default out of the box the Fortinet was configured with WAN1, WAN2 and DMZ ports configured as "Physical Interfaces". Port 1 through 5 were setup in VLAN Switch Mode, with VLAN 0 configured on the default 192.168.1.0/24 network.My office network is on VLAN 70, subnet 10.70.70.0/24.I broke up the VLAN Switch and removed port 2 through 5 from it so that they would turn into physical interfaces again. Only port 1 is still in the VLAN Switch mode. See below:  Port 5 is currently my initial admin access port while I configure the firewall (that's why its called "Initial"). Whenever I connect this interface to

Hi, noticed something unexpected today. Internet access for specific host is blocked based on app filter.  When checking the UTM blocked rule i see it's actually blocked because of :  However, when viewing the APP_FILTER cloud.IT is only set to monitor :  Could be blocked on one of the overrides, but i see no further info in the Analyzer logs on which override.Is there any way to debug this further? 

when you face playbooks que overflow you won't be able to run any other playbook till all those are completedyou can simply run these commands to clear the que.rabbitmqctl purge_queue celery -p fsr-clusterand then restart all the services 

Hello everyone,strange issue here: I do have a FortiGate 120G with a bunch of FortiAPs. Since last week, one of our devices (Microsoft Surface) does not work any more on one specific AP.The FortiAP 231F is mounted in our assembly hall. The surface does connect to the Wifi (WPA2 enterprise) but it seems it does not receive an IP adress (dhcp via windows server). The IP get set to 169.254.14.38.  If I move to another access point (e.g. the one providing wifi on my desk -> FortiAP 231G) with the same settings and providing the same Wif works without any issues.As soon as I move back to the maintenance hall and the surface connects to the FortiAP 231F networking does not work any more. Windows showing "connected but no connection to internet". Any ideas? All other devices work without problems and the Surface did too until last week (nothing on the Forti configuration changed)

Hello, I would like to know how to use FortiAuthenticator to configure saml SSO login for Fortigate administrators, and how to specify a FAC group for Fortigate administrator login

Hello Fortinet Community, I have a network environment consisting of a FortiGate , Windows Active Directory 2019, Huawei iMaster NAC, and a newly purchased FortiAuthenticator . Both the FortiGate firewall and Huawei NAC are configured to authenticate users from Windows Active Directory using LDAP.Here’s the current workflow: When a user device connects to a switchport, the iMaster NAC detects the user and identifies their organizational unit (OU) (e.g., HR, Technical, etc.).Based on the detected OU, the switch assigns an IP address to the user from the corresponding VLAN (e.g., VLAN 10 for HR, VLAN 20 for Technical).After successful NAC authentication, the FortiGate firewall presents a captive portal when the user attempts to access the internet or DMZ. Upon successful authentication via the firewall portal, the appropriate policies are applied based on the user.The issue arises because users are required to enter their credentials twice: once for NAC auth

helloI need to restrict IPSEC VPN I need to connect only from UAE if anyone try to connect from outside UAE he ca notthanks

SAML based SSO VPN is not working

I have setup fortinet DPI but im getting untrusted cert error

How can I setup SWG on fortisase

Hi Guys, I am using Fortigate SFP module on Fortigate firewall & using brocade & extreme SFP module on switch. but the port is not coming up. Is there any compatibility issue with extreme & brocade SFP module ? Attached are the snapshots.Fortigate SFP ModuleExtreme & Brocade SFP Module  

Hello, In Fortinac I´m trying to add an Fortinet Fabric. I already added the Fortigate, but to add the fortiswitches do I need to have an valid Fortilink subnet (exemple 192.168.10.X)? I need to configure SNMP in the fortiswitch too? Thanks in advance 

The detailed information is: You are not allowed to access this resource because the SAML request from your service provider (https://192.168.199.60:10443) has expired. Please try to access your service provider page again.

Hi, I just want to know this in generic, I know it depends on environment of each network But is there a top recommended FGT firmware version that would be stable.in My environment we are upgrading to 7.0.16 

When we add credentials in FortiSIEM admin settings, it only asks to map IP.Same IP can belong to multiple clients also, But in mapping there is no option to select collector. So how to map credentials to correct device linked to correct collector. Also do i need to allow supervisor to firewall port 22 if i want to add SSH credentials? This is not possible by allowing collector to firewall connection over port 22?

Hello,I am experiencing an issue with the dot1x configuration on FortiNAC.I am using FortiNAC 700F, version 7.2.8.0149. I have followed all the steps shown in this video:https://www.youtube.com/watch?v=7pRg2-SVipoThe problem is that I don’t have the "EAP-Type-Name" option.I still followed the entire video and applied the instructions, but when I connect a PC to the switch port where dot1x auto-registration is enabled, the PC shows "authentication failed." On the FortiNAC side, I don’t see any activity logs. Here is the switch configuration: interface GigabitEthernet0/17switchport access vlan 2switchport mode accessswitchport voice vlan 150srr-queue bandwidth share 1 30 35 5priority-queue outauthentication host-mode multi-hostauthentication port-control autoauthentication periodicauthentication timer reauthenticate 180mabsnmp trap mac-notification change addedsnmp trap mac-notification change removedmls qos trust device cisco-phonemls qos trust cosdot1x pae authentic

Hi, im having an issue with my FortiEMS as it says that my license is about to expire but i already renewed it.I already tried the function "Sync License now" on the Dashboard but it didn't help.Is there any other way to get the EMS to read the new license?Im using FortiEMS 7.2.4Thanks  

We have a Third Party that would like to allow us access to a subnet on their system via a Site to Site VPN. There is no need for them to access stuff on our network but they want us to use a small subnet to avoid clashes on their end of the network ( 192.168.255.1 / 24 as an example ) we have set this subnet up as a Vlan and have setup and established a IPSEC Tunnel and the tunnel works if your on aforementioned subnet.  Is there anyway to get a Fortigate FG100 to route traffic from another subnet over this tunnel? I can't create a static or policy route to route traffic to the gateway address 192.168.255.1 as it just complains it's a interface address (well yes )) Essentially we want it to take traffic from our vlan(s) and act as a NAT gateway sending stuff over the VPN. In the past we have done this by having another router take traffic out of the main router and pipe it back in via a WAN port. This is a little Jank though and I was hoping for something a bi

Hi, all. I cannot ping a local interface IP on the Fortigate from a AWS host, connected through a VPN tunnel. I can ping the interface using a dial-up (FortiClient). It goes like this: From PC connected through FortiClient (IP is 10.10.1.2):Pinging 192.168.4.1 with 32 bytes of data:Reply from 192.168.4.1: bytes=32 time=1ms TTL=255Reply from 192.168.4.1: bytes=32 time=1ms TTL=255Reply from 192.168.4.1: bytes=32 time=1ms TTL=255 From linux host in AWS:PING 192.168.4.1 (192.168.4.1) 56(84) bytes of data.(zzzzz)--- 192.168.4.1 ping statistics ---22 packets transmitted, 0 received, 100% packet loss, time 21481ms To a host on the interface subnet, from linux host in AWS:PING 192.168.4.13 (192.168.4.13) 56(84) bytes of data.64 bytes from 192.168.4.13: icmp_seq=1 ttl=127 time=21.1 ms64 bytes from 192.168.4.13: icmp_seq=2 ttl=127 time=21.2 ms On the Fortigate, a trace shows Packet Trace #2004,2024/12/04 08:57:54,"vd-root:0 received a packet(proto=1, 172.31.32.14:53

Hi all,We are slowly moving to password-less based login for our users. We have already piloted YubiKeys as our primary method of authentication. As a failsafe we are now testing also FortiAuthenticatior agent for windows since we already have it on-premises. The login with PIN and Token works fine without any issues. What is happening is, that from time to time (once, twice, multiple times per day, or maybe not even happening) login screen starts behaving erratically not displaying login screen at all. In the event logs I can see, that it was caused by crashed LoginUI.exe and Fac_AgentCredentialProvider.dll and ucrtbase.dll. Here is the log:Faulting application name: FAC_Agent.Service.ServiceHost.exe, version: 6.0.0.0, time stamp: 0x66dba094Faulting module name: ntdll.dll, version: 10.0.19041.5007, time stamp: 0x688f8c4bException code: 0xc0000374Fault offset: 0x00000000000ff3c9Faulting process ID: 0x14d4Faulting application start time: 0x01db40bfcd70a7caFaulting application

Hi, Can anyone share the link where I can see the EOS / EOL products, right now I need the FortiAP EOS. Thanks

Background on environment.Root vdom contains all the physical interfaces for traffic to the internet and vmware stack.  All traffic coming into or flowing out of the VDOMs has to route through Root.  Vdom-A and Vdom-B share IP schemes, so everything has to route through the Intervdom network 172.17.17.0/28.  Vdom-A has a VPN tunnel to another site.  The traffic to establish the VPN flowsInternet > Root Vdom > VIP in Root VDOM that translates the external traffic to 172.17.17.1 (the vdom-a side intervdom link between Root and Vdom-A) > Vdom-A picks up and establishes the VPN tunnel.In my initial test, the VPN establishes and traffic flows so I know I've got that part set up correctly.  However, Vdom-A will have a server with a "public IP" (let's call it 40.40.40.40 just for ease of conversation) that should be only accessible through the VPN.  I'm having some difficulty in establishing where the private IP (let's call it 10.10.10.40 for ease o

How does fortisase spa works and how can we setup

I've come across a strange something I've never seen before in web categorisation. There is a link that Is currently getting blocked on of my FG's. Looking at the logs on the FAZ it was Categorised as Advertising but when looking on FortiGuard's web filter lookup It has the category of business. Creating a simple exemption would get me access to the link but was just wondering why there would be this difference. FG is running on 7.0 could it just be the OS version the FG is on?