Solved

Hello everyone,I recently discovered that the FortiAuthenticator supports a proxy authentication mode for remote RADIUS servers:FortiAuthenticator DocumentationHowever, the FortiGate does not seem to offer a similar option:FortiGate 7.4.5 Documentation (our current version)FortiGate 7.6.1 Documentation (latest version)If you want to set up remote Dial-Up IPsec VPN tunnels using EAP-TLS authentication via Microsoft NPS (RADIUS), it seems you would need to purchase a FortiAuthenticator solely to forward the requests to the remote RADIUS server.Will FortiGate ever introduce a proxy mode for authentication via remote RADIUS servers?

Hi all,I've a FG-1800F that I've upgraded to 7.0.16.SSLVPN tunnel mode works well, but SSLVPN  web mode have a problem when i try to connect using http/https or other protocols.It shows the message "SSL VPN Proxy Error. Reason: Access Denied".I state that firewall policies are correctly configured so much so that I can navigate via tunnel without problems.By debbuging I see the ouptut below:[5530:root:56b2]deconstruct_session_id:709 decode session id ok, user=[testuser], group=[VPN],authserver=[LDAP],portal=[fullaccess],host[x.x.x.x],realm=[],csrf_token=[BF28A52BF8CD26D67351B134F895BF9],idx=4,auth=16,sid=3e129ec9,login=1732875556,access=1732875556,saml_logout_url=no,pip=no,grp_info=[FP00ys],rmt_grp_info=[pSVTnq][5530:root:56b2]dns_query():296 tried IPv4 0 www.google.com[5530:root:56b2]dns_on_read():178 got result[5530:root:56b2]sslvpn_policy_match:2641 checking web session[5530:root:56b2]remote_ip=[x.x.x.x], user=[testuser], iif=34, auth=16, dsthost=[www.google.com], portal=[full-

Hello,I am trying to set up automatic failover wan using link-monitor and not SDWAN.  Before I even get as far setting up the link-monitor I am running into an issue.  My primary is wan2 and backup is wan1.  I have tried setting the static route for the backup to a higher priority and/or distance value.  When they are both connected it uses wan2 (what I want) then if I unplug wan2 it switches to wan1 (also good), but when plug wan2 back in it still uses wan1.  Shouldn't it switch right back to wan2?  I think I must be using the distance and or priority incorrectly.wan1 and wan2 are in a zone and my internet access policy uses the zone.   

Hello,I am currently dealing with an issue related to the FSSO feature, which helps us manage rules on Fortigate. We are experiencing a situation where a user is not authenticated via FSSO when they switch from a wired connection to Wi-Fi. After this change of adapter, the user receives a new IP address and FSSO does not authorize them immediately. We also have a feature enabled that should detect IP address changes, but either it works with significant delay or not at all.Could someone advise me on how you handle FSSO during a change in the connection method? We would like to continue using rules for selected users. Best regards and thank you,Jan

Hello, We have an issue with configuring and using ZTNA tag for filtering internal traffic.We would like to base our config on following example:https://docs.fortinet.com/document/fortigate/7.0.0/new-features/477578/ztna-ip-mac-filtering-examplebut we would like to use it with many Fabric firewalls not just one (as it is shown in the example). Here is our setup:1) EMS server (7.2.6) assigns ZTNA tag - it works OK2) Forti manager (7.2.8) synchronizes ZTNA config to all our firewalls (7.2.9) - it works OK3) We configure internal traffic rules using ZTNA tag as source criteria. Unfortunately, we discovered that above config works properly only within one firewall. That is because ZTNA tag is mapped ONLY to local IP addresses on the firewall.Thus if we want to use ZTNA tag globally as a source criteria, it doesn't work (because particular firewall maps ZTNA tag to only local IPs and doesn't know anything about remote source IPs for that tag). Question:Is there a way to

Hello,i have an issue on FortiAuthenticator HA on virtual machine,when trying to create HA Active-Passive between two virtual machine the HA status on the two nodes become primary with one has high priority and the second has low priority but no sync happen between the both devicesi have attached a copy of the config of the ha setting on both devices

Quick background on the environment.Root vdom contains all the physical connections to the VMWare stack and the internet. VDOM A - All internet bound traffic (inbound or outbound) runs through an intervdom link.  Everything works as expected.I understand how one would pass traffic through for either all ports or a single port from an external IP, through a VIP on Root, to the intervdom link IP of VDOM-A and then another VIP on VDOM-A to 'inside' VDOM-A.What happens when you need to have multiple external IPs all routing to something within VDOM-A?  With the intervdom link, VDOM-A essentially only has 1 'external' IP.  For example, you've got external IP: 40.40.40.40 that goes to WebserverA in VDOM-A and you've got 40.40.40.41 that goes to WebserverB in VDOM-A.  Do I create separate intervdom links for each external IP?Do I take the VIP from external to Root and do something like take 40.40.40.40 port 80 outside, translate it to 172.17.172.1 (intervdom

Hello Fortinet Community,I'm currently facing an issue with my FortiNAC-F 7.2.8 (previously 7.2.7, upgraded in an attempt to resolve this) when trying to connect to switches via the Validate Credentials button in the device configuration. The credentials are verified to be correct, and FortiNAC successfully connects to the devices via SNMP. However, it fails to connect using CLI for validation. Here’s a breakdown of the problem:SNMP Connectivity: Successful – FortiNAC recognizes the device through SNMP without any issues.CLI Connection (SSH) Fails with Validation: When attempting to validate CLI credentials on FortiNAC, the connection fails even though the credentials are accurate.Direct SSH Attempt from FortiNAC CLI: When I directly try to SSH into the switch from FortiNAC's CLI, I receive the following error: Unable to negotiate with [Switch_IP] port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1, diff

 Hi everyone, I have a LAN user wants to connect to a LAN server from the public address that is in the same subnet as the fortigate external address. I have setup VIP and firewall policies but it does not seem to work, debug flow shows it was DNATed to the server's internal address but the traffic does not go through(my server does not receive any traffic), the final log of the pakcet was "allowed by policy" then followed with nothing. My topo and configs are as follow, any idea is appreciated.config firewall vipedit "vip"set extip "10.1.1.2"set mappedip "192.168.8.200"set extintf "wan" # have tried with "any" but also not workingset portforward enableset extport 443set mappedport 443config firewall policyedit 1set name "lan1-to-lan2"set srcintf "lan1"set dstintf "lan2"set action acceptset srcaddr "all"set dstaddr "vip"set schedule "always"set service "ALL"edit 2set name "wan-to-lan2"set srcintf "wan"set dstintf "lan2"set action acceptset srcaddr "all"set dstaddr "vip"set schedul

ALL, I am creating my Fortigate Lab, using vmware workstation pro.i have downloded the lates VM-FGT_VM64-v7.6.0.F-build3401-FORTINET.out.ovf.zip (98.44 MB)i did all config, and i can reach out to internet, but when i try to activate the trial license using GUI or CLI, it give me Timet error msg. find the SC belos, and please helpNOte, i alread do all theses steps inthis link:https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/441460/permanent-trial-mode-for-fortigate-vm     

Hi FML adminsOn FML 7.6.0, Monitor > Log > History, I can't find Session ID anymore, so I can't display detailed session log, and I can't find a way to display additional columns in order to show Session ID column.Is it me or is this a regression?

I have a FGT40F (behind NAT) at a remote office and a FGT61F at my home office with an IPsec tunnel between them. Both were on 7.4.3 and all good. I updated the 40F to 7.4.4 and now the IPsec VPN will not connect. I rebooted both ends and tried to enter a new key and still no luck.  I then rolled the 40F back to 7.4.3 and loaded the config back onto it and it still won't connect.  I've read about a new FW version changing something that affects VPN but I have not been able to tie that to my situation. Thanks for any help.

Hi, I made the mistake of uninstalling an old version of Forticlient to install the 7.2.2 and since then Forticlient doesn't work for any of my clients. When I try to log on, it gets stuck on "connecting". I gave full disk access to both Forticlient and fctservctl2. But I haven't enabled the "extension" which was prompted in mac OS 13 in "security and privacy" but not anymore in Mac OS 14. How do you enable forticlient extension in Mac OS 14? I have the same issue with older version now. log of fortitray.log: 20231208 19:24:56 TZ=+1100 [FortiTray:INFO] AppDelegate.swift:128 App: FortiClient-7.2.2.077620231208 19:24:56 TZ=+1100 [FortiTray:INFO] AppDelegate.swift:129 OS: Version 14.1.2 (Build 23B92)20231208 19:24:56 TZ=+1100 [FortiTray:INFO] AppDelegate.swift:261 Checking privileged helper.20231208 19:24:56 TZ=+1100 [FortiTray:INFO] AppDelegate.swift:270 Privileged helper was installed.20231208 19:24:56 TZ=+1100 [FortiTray:EROR] ConfigManager.swift

Hello, I’m currently trying to connect to my company’s FortiClient VPN while working from another country. However, the connection is being blocked due to the firewall’s restrictions on connections originating from outside the allowed region.To overcome this, I attempted to set up a proxy using an Amazon EC2 instance located within the allowed region. I’ve tried various methods, including using socat, stunnel, and nginx, to forward the traffic from my local machine to the VPN server via the EC2 instance. Unfortunately, I haven’t been successful in establishing a working connection.FortiClient often stalls at 31% or 40% during the connection process, which I suspect could be due to TLS version mismatches or certificate validation issues. In some cases, FortiClient fails to present the usual certificate acceptance prompt.Are there any specific configurations or tools you’d recommend to make this work? Thank you

Hi, We have an IPSec Tunnel between office1 and office2 to connect two Servers. We need office1 users to connect to the server in office2 using another interface instead of the IPSec Tunnel and let only the servers communicate over IPSec. How can we achieve this, if it is possible? BR.

Hi Guys, on the fortigate 120G I have created  a automated weekly backup to our TFTP server.everything is working fine, my only concern is that the password is in plain text. is it possible to encrypt it? i have looked everywhere but can't find solution. Fortigate 120G - running firmware 7.2.10 script : execute backup config sftp E:\Backup-Netwerk/ROVPNFG/backup_%%log.devname%%_%%date%%.conf <server-IP> <username> <password>

Hi there We are rolling out MFA to our Forticlient VPN users. When user clicks connect a popup window appears for the SMAL idp, titled "Forticlient SAML Authentication". There is a timeout counter in the tile window that starts counting down from 300 seconds. When the popup appears, we can see in the FortiClient window, above the VPN Name box it says "status:connecting". The user needs to enter a login name, then a password, then a passcode, each on a different screen within the popup window. The popup closes and the user is returned to the Forticlient window which then goes through the connection stages and connects to VPN. The issue we are having is that if the user does not enter their login details within 30 seconds in the popup window, when the popup closes, the "status: connecting" message disappears and no other connection messages appear and the user is not connected to VPN. Even if we do nothing in the popup window, the "status: connecting" message disappears wi

Hi FNAC adminsIn FortiNAC or FortiNAC-F, is there a way to restrict access to admins to some containers (or switches), in such way some admins can manage some switches, and some other admins can manage some other switches.

Hi all,  does it possible to create on FGR60 and Hardware Switch interface with port(n) and WAN(n) port? I'm asking because I don't have the possibility to verify directly. Best RegardsAlberto 

Hi all I have this problem i have 2 vpn tunnels on one Fortigate the external interface is wan1 for both vpn1 --- interface ---wan1vpn2----interface-----wan2 both vpn are working and i can reach a vm on both sides from the lan interface lan ---- vpn1-----ok working.   vm1 pinglan----vpn2--------ok working  vm2 ping now i have on both vpn ends a vm i need to connect vm1 to vm2vm1 ping fortigate lan interfacevm2 ping fortigate lan interface i cannot ping vm1 from vm2 and viceversai have setup routing and firewall policies, maybe i miss something please helpthanks

Can someone share FAC Upgrade (Path) details

I've had this same problem since I've had FortiClient installations managed by EMS (6.0.4.0158) and I don't know if I'm doing something wrong, or this is just expected behavior.  Over the holiday break I assigned a deployment package to the profiles for most computers with the thought they would be upgraded by the time we got back.  That didn't happen, out of about 75 desktops, which are usually left powered on, only 12 upgraded and most of those are ones I upgraded before the break while testing to upgrade.  In EMS most of the PCs state "Endpoint Notified", but if you go to the actual computer there is no message to begin the installation - and as far as I know the deployment settings shouldn't require manual user input so I don't understand why they aren't getting upgraded. I've always had problems with getting EMS to successfully upgrade FortiClient.  It doesn't help that there are no real helpful log messages to help determine why a client didn't get the up

I'm facing issue while accessing the sec boxI tried taking the direct mgmt connection but im not able to ping nor access the sec fgt though the primary box works fine

Hi We've been having spotty internet connectivity since adding a 4G interface ( a Teltonika device in pass-through mode) to the SD-WAN on our 200E running 7.2.10. The three fibre interfaces in the SD-WAN are only running 20-30 % utilization generally, and the 4G is weighted as a last resort. The only traffic I see on the 4G is the SD-WAN SLA targets. The 4G does work well enough when I add a SD-WAN rule to force a device to use it. I came across this post saying to not use any-any in SD-WAN rules, and not to use the SD-WAN interface as a default route in heterogenous environments. We did have an any-any rule, that was an easy fix, but regarding the routing, would a zone consisting of 3 fibre connections with different ISPs and a single 4G connection be considered heterogenous? Should I instead be adding a default route for each SD-WAN zone member interface? I can't add multiple interfaces to a single default rule as per the above post.   

I'm doing an exchange program and I use Forticlient VPN to connect to the network of the institution where I study in my home country. It works normally on my laptop with a Windows OS, but when I use it on the computer in the lab, which is Linux, it doesn't work. I don't think the problem is the network or that I'm in a different country because I use the same network with my laptop. We formatted the lab's computer so that I could use it and installed the Kubuntu 22.04 LTS distribution. I installed Forticlient VPN, and when i tried to connect to the network it wouldn't leave the “connecting” status. I searched on the internet and saw that other people also had problems with this Linux distribution to connect to Forticlient VPN and that possibly the problem was the Kubuntu uses KDE. We formatted the computer again, this time using Linux Mint 21.3 (Virginia) and with that I was able to connect to the network but I can't browse the internet. The measurements are 0.4 Kb sent and