Solved

I have a campus network with 63 FortiSwitches managed by a stack of 1101E Gates in an HA.MSTP is running in it's default state other then I did lower the priority of the distribution switches I want to be the root bridge.My question is what is the best way to setup MSTP? Right now I'm using instance 0 but I did see a MSTP best practice paper that suggested not using instance 0.  I have a single region and 68 Vlans. I would like to keep using instance 0 just because it's simple. I would appreciate any recommendations. 

Following this link - https://docs.fortinet.com/document/fortiauthenticator/6.0.0/cookbook/812128/creating-a-local-ca-on-fortiauthenticator I am a little confused, the cookbook suggests you have to create a user certificate? i have over 500 LDAP users, that cant be right can it? it also suggests you create the local users on the FAC? thats a bit pointless, my FAC is connected to AD, so why would I need to create the users again,  Im looking for a solution where the users connected to the business WIFI, using their machine certs, not sure why we need user certs, is it another check or something? thanks 

Dear, please help me in this case: I have a Fortigate 100F which was return to the factory and configured as an edge in another datacenter.The internet provider gave us a private WAN IP x.x.x.x; but to go out to the internet, we must do it through a secundary WAN IP y.y.y.y.The Firewall was already registered in FortiCloud before the factory reset. Currently it appears registered in FortiCloud.The system information on the dashboard confirms the WAN IP y.y.y.y; but when trying to connected to FortiCloud it gives us "FortiGate Cloud Internal Error".When generating a PING using the CLI witch the source-ip y.y.y.y to the service.fortiguard.net URL, I do manage to reach it, but when I connected to the internet, it gives me the aforementioned error.When reviewing the traffic I see that in the rule Implicit Deny the origin y.y.y.y with destination to the Fortinet DNS, port TCP/853 es accepted. 

Hello,I have a requirement, only 5Ghz and 6Ghz  need to be available for an office.Actually, only 5Ghz is available for users and it works well.I checked this link https://docs.fortinet.com/document/fortigate/7.2.0/new-features/169732 but I need more explications.I created a 6Ghz SSID, select WPA3 SAE et activate H2E.Then for the Operation profile, I'm not sure according to my requirements. I understand, all the bands needs to be ON for the wifi6E, but I don't want 2.4Ghz, so I created a profile where Radio 1 is disabled, and link it to the new 6Ghz SSID. I can't made a real test until next month. Another question, if on the 6Ghz SSID, I keep active the 2.4Ghz, it's only for 6Ghz use or a user can connect to this frequence ?I want to know if the configuration is correct or if you have some tips. Thank you  

I have 400F device and on this device we have configured around 1000 site to site VPN tunnels in active passive mode. We need to configure 330 link monitoring entries. I am able to configure 256 entries after that getting an error reached maximum entries. How can we increase the limit of link monitoring entries.  

What are the ramifications of disabling the clickhouse-server.service,Or asked another way what criteria would I need in order to make an informed decision? Id like a little more knowledge about clickhouse and if its set up by default and how to know if it actually is being used.I I don't think the log rotation is set up on a lot of the clients collectors at any rate so periodic removal of logs has to take place until there is a final solution. Thank you in advance. 

Hello Everyone,   I have a production device that has already had our template that is for 1 MPLS -1 internet connection ran on it. I want to add another internet connection to that device. I already have a template for 1 MPLS- 2 internet connections which would be perfect. Would I be able to just add the variables for the 2nd internet connection and run the 1 MPLS-2 internet template even though it will have all the same variables from when I used the 1 MPLS- 1 internet except for the additional 2nd internet connection, or will it fail since there will essentially be duplicate variables? I thought I remember hearing or reading somewhere that it will just skip them, but maybe I made that up.  Thanks!

Running a Fortgate 60E running firmware 7.4.5 with a Fortilink connection to a Fortiswitch 124E PoE switch running firmware 7.6.0.  I have created an active trunk using two ports (15 and 17) on the switch controller and trying to change the vlan from the default to another VLAN I have created. When I do this in the GUI I get a red banner in the upper right that says "Failed to Save Changes". I get no other information that I can find in the logs or documentation on why this would happen or how to resolve it.

Hi Everyone, i have a problem when i try to connect the EMS 7.2.5 to my LDAP server the same parameters work well in version 6.4.9 and 7.0.13 but since the update to version 7.2.5 impossible to reconnect the LDAP server i have the error message: unable to read LDAP response packet: unexpected EOF does anyone have an idea about this error Thanks for your help 

Hello everybody, We are facing an issue where the Application control isn't showing in the security profile in our FortiGate firewall we are using 60f we noticed this problem since we updated the firewall to the latest version 7.6.0, also note that when I go to certain policy it doesn't show when I edit the policy ,but strangely when I point my mouse on the security profile part in the policy it shows the application control and i can edit it.can anybody tell if this is a bug or something else. Thanks in advance

I have installed Forticlient on Debian 12 But it shows the error. Then i installed it on ubuntu 22.04 but it also shows same error. On windows and android vpn client works fine but does working on linux any one knows the solutionFailed to connect to vpn tunnel please try againDetails Error Error invoking remote method keytar.deletePassword error unknown or unsupported transport for address disabled  FortiClient @support 

We have Active/Passive with Virtual Clusters setup. With default HA configuration, the "link-failed-signal" is disabled. From some doc, it says the option is to enable/disable signaling to internal hosts when failover happens for fast switchover. So it sounds good but why it is disabled by default? Should I manually enable it? Please advise. 

Hello, When I register smartphones via dot1x auto registration, devices appear in the host view as "registered hosts." This is OK; it gets the job done. However, I couldn't find a way to modify the device type other than manually editing the host and setting it manually.  When a user has multiple devices (phones, tablets, PC, etc..) This creates a bit of complexity in the host view.IT admins have to sort things out manually for multiple devices with the same registered user. I tried to find a way around by using device profiling rules for iPhones and Androids by vendor name and DHCP fingerprint and confirming the device rule on connect. But it didn't work. (I know this profiling is for rogue devices; an already registered device would not hit this rule, but I tried anyway.)  Here is the question,  Is there a way to change the device type automatically after dot1x registration?It would be great to have Androids and iPhones sorted out with their icons a

Hello, Im trying to add the user: "user" to the group: "group1" using the api v2 of a fortigate v6.4.15Below is my request with the return (200:OK) but no revision_change, so its doing nothingAlso below the GET requests on the user and group1 to show the configs What am I missing ? Thanks for reading !   curl -k -X PUT -H "Content-Type: application/json" -H "Authorization: Bearer abcdefg" -d '{"member": "test"}' https://FORTI-URL/api/v2/cmdb/user/group/group1{"http_method":"PUT","revision":"5d01f6d0438463b2da7bd48c54508be3","revision_changed":false,"mkey":"group1","status":"success","http_status":200,"vdom":"root","path":"user","name":"group","serial":"FGT6xx","version":"v6.4.15","build":2095}    curl -k -X GET -H "Content-Type: application/json" -H "Authorization: Bearer abcdefg" https://FORTI-URL/api/v2/cmdb/user/local/test{"http_method":"GET","revision":"5380e9e62a96d94149368f7c05789ab7","results":[{"name":"test","q_origin_key":

Hello, I am new to FortiSOAR and need some help understanding how to achieve one of my use cases.I am getting alerts from Microsoft Defender for Endpoint through Data Ingestion and all is well on that front. However, when an alert that indicates that a suspicious file has been observed I want to add the filename, filehash and so on to the alert with a playbook. This is where I struggle. I need some pointers to know HOW to get the information from the Sourcedata to populate the alert itself. I have tried by looping through the objects array but I can't get it working.I can provide screenshots and config if needed.Thanks in advanceAlexander

We had recently been informed that we need to update our VPN clients.  Our user goes to this link https://links.fortinet.com/forticlient/mac/vpnagent to get the latest update.  But when we tested it this week, both fresh install / update comes up with the same error "Failed to connect to the update server." We had tried on two devices.   We also went to the website itself - Product Downloads | Fortinet Product Downloads | Support.  And we see the same error.The link for the windows update/fresh install works fine. https://links.fortinet.com/forticlient/win/vpnagent Any suggestion?

Hello everybody, I have a firewall policy regarding an IPSEC tunnel. This policy is saying that all the addresses that belong to ipsec_range can reach the internal destinations.This policy, if I connect, is working fine:I can reach on of  my VMs: Everything is all right.What's the problem?The user that has connected to the tunnel, belongs to a group: Let's suppose I  want to say:I want to filter the source not only by ip address, but also by user group. the same user has an address in ipsec_range and also belongs to IPSEC_USER.Everything should be okay, right?No! I can't reach my VM anymore. What am I doing wrong?  

Hi,I have configured Fortigate to send traffic logs to a remote syslog server.The GUI displays the destination IP along with the corresponding domain correctly.But only the 'dstip' is sent to syslog server, while the 'domain' is not included.How can I send the 'domain' along with the 'dstip'?

Hi,I'm managing 30 branches, all connected via MPLS and running FGTs as firewalls.There's a main site with a DC (10.7.7.80).I wanted to authenticate fortigate administrators via LDAPS and use their AD accounts for login.However, it is working in some of the sites, and not working on the rest. If i check the logs on the main site, I can see the packet is acceptedbut I can also see this session timeout if I click on this line of log:Some of the FGTs are able to contact the DC, when I look on their logs, it looks the same just without this "session timeout". I tried to increase the ldap query timeout on appliances which have this problem: set remoteauthtimeout 15 set ldapconntimeout 8000 but still the same. Will appreciate any help and advices. Thanks!  

Hi, I am trying to set up FortiGate Web Authentication and SAML as idP but I am having issues, I am following this guide https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/33053 I have setup but the authentication portal is not kicking in, I have seen that on the Fortigate in the Interface, you can enable Security Mode "Capture Portal", does this need enabling as not mentioned in the guide? Overview of what I have done.1. Created Enterprise App in Entra ID.2. Created a group in Entra ID added users and assigned to App.3. Created a Single Sign-on on the FortiGate pointing to the Enterprise App.4. Create a group on the FortiGate and set the Remote Server to Fortigate the Single-Sign-on and the Enterprise App group ID.5. Created a Firewall rule to allow traffic out and added the Fortigate group created in step 4.6. Create a Firewall rule to allow traffic in. When I test from a client PC or the Enterprise App I get 2This site can

Hello, I am seeing constant alerts on my Fortigate under sslvpn events "sslvpn login failed" This is not coming from the authorized users. Is there anything that can be done on it.  Thanks

I have an IPSEC tunnel configuration that refuses to allow GUI re-configuration. Displayed error is -9999:-9999.Objective: I am migrating from one IP/ISP/fiber to another, at the remote location. Local (HQ) connection will remain the same.I wish to run both tunnels until configuration is up and running. Otherwise, termination of existing tunnel disconnects all communication with the remote fortigate 80e.I originally configured the HQ connection to point to the DynDNS address of the remote site, I am unable to reconfigure this connection to a fixed IP.This connection is up and running. Firmware v.7.2.3 on both fortigates. When I change the Remote Gateway from Dynamic to fixed, it accepts the change, it recognizes and validates the IP address (malformed addresses are rejected). and when the 'check mark' is clicked the changes get locked in.But, when I click the OK button to accept the configuration, I am greeted with a red 'tag' in the lower right that displays and unhelpful '-9999:

Dear Team, My firmware version is 7.4.4. We are routing our webservers behind through cloudflare proxy. Here what are we getting in logs are the cloudflare proxy Ip address ranges. Pls guide me how to configure the fortigate to get the Original ip of the source traffic or how to Include the original visitor IP in fortigate logs.  I have already done as per the process defined - https://docs.fortinet.com/document/fortiproxy/7.4.4/administration-guide/764110/logging-client-ip-for-forward-traffic-and-https-transaction FGT (global) # sh full-configuration config web-proxy global set ssl-cert "Fortinet_Factory" set ssl-ca-cert "Fortinet_CA_SSL" set fast-policy-match enable set ldap-user-cache disable set proxy-fqdn "default.fqdn" set max-request-length 8 set max-message-length 32 set strict-web-check disable set forward-proxy-auth disable set forward-server-affinity-timeout 30 set max-waf-body-cache-length 32 set webproxy-profile "default" set learn-client-ip enable set alway

I'm working on migrating my home OpenSUSE machine I'm using for freeradius server to authenticate admin and VPN users on my FG40F(7.2.8) from Leap 15.3 to 15.5(on a new machine). Obviously 15.5's repo has a newer version of freeradius-server image.Then when I simply copied "clients.conf" and "users" file to the new machine and pointed the RADIUS config at the 40F to the new machine, the RADIUS auth request was simply dropped without showing much reason in debug output other than "missing mandatory attribute".After some research and investigation, I figured out I had to set "require_message_authenticator = no" in the client config for the 40F at the server, which was not required with the older version of freeradius, in order to let the server accept those requests from the 40F.So I found a way around but now wondering why 40F wouldn't send the Message-Authenticator attribute with the request.Even with 7.4.4, the admin guide says it doesn't send the attribute.https://docs.fortinet.com/d

Hello I'm having problems with local traffic generated by Fortigate and SDWAN rules. When one of the links that make up our SDWAN goes offline, I receive the following error message: "unable to connect to fortisandbox. Either the appliance is not reachable or this fortigate is not authorized" Then users start receiving SSL certificate error messages when they try to access a web page, or a message like this: "Web Page BlockedAn error occurred while trying to rate the website using the webfiltering service. Web Filter Service Error no correct FortiGuard information" I tried the following commands (available at: link  ) but the problem persists: config log fortiguard setting set interface-select-method sdwan end config system fortiguard set interface-select-method sdwan end I have a 60F with version 7.0.13 build 0566 (Mature)