Solved

Hello everybody, I've been working with a ZTNA for about a year without problems.Since Forticlient EMS upgraded to 7.2.5 version, something strange is happenening. This user, who has always worked with ZTNA, can't access network resources anymore (he was Off-Fabric during the connection attempts).This is one the logs: date=2024-10-09 time=16:14:43 id=7423779172176101376 itime="2024-10-09 16:14:43" euid=3 epid=101 dsteuid=3 dstepid=1053 logflag=3 logver=702101706 type="traffic" subtype="ztna" level="notice" action="deny" policyid=15 sessionid=10994158 srcip=xxxx dstip=10.1.0.214 srcport=52177 dstport=3389 duration=19603 proto=6 sentbyte=10454368 rcvdbyte=31622617 logid=0005000024 service="RDP" app="RDP" appcat="unscanned" srcintfrole="wan" dstintfrole="lan" policytype="proxy-policy" eventtime=1728483282890140384 wanin=31622617 wanout=7184424 lanin=10454368 lanout=32300828 crscore=30 craction=131072 crlevel="high" poluuid="7f1a8a84-dfd7-51ee-4200-2edb944b93d3" srccountry="Italy

Hello everybody,Some time ago I created a ZTNA environment on my Forticlient EMS, assigning some tags to some users.For example, look at these two users (this first one uses a macOS device, the second one a Windows device):the first one was Off-Fabric too when the attempts occured. As you can see, both users have the same tags.The ZTNA Firewall policy is unique:  So,  both user should access or not the ZTNA.The strange fact is that the Windows user can access the ZTNA: date=2024-10-10 time=13:23:01 id=7424106010597392384 itime="2024-10-10 13:23:01" euid=1040 epid=1070 dsteuid=3 dstepid=1051 logflag=1 logver=702101706 type="traffic" subtype="ztna" level="notice" action="accept" policyid=15 sessionid=11466583 srcip=….. dstip=10.1.0.207 srcport=7854 dstport=3389 duration=13850 proto=6 sentbyte=1112395 rcvdbyte=6568260 logid=0005000024 service="RDP" app="RDP" appcat="unscanned" fctuid="6C40ACFAC7B043A4851701EB5FDD3B3D" srcintfrole="wan" dstintfrole="lan" policytype

I'm testing FGSP and VRRP using foritgate VMs.  The topology is as follows:  FirewallA (VRRP Master)--------L2VPN--------FirewallB (VRRP Backup) There are 3 servers:Server A connects to Firewall AServer B connects to Firewal BServer C is in the VRRP domain and will reside in either Firewall The issue I've observed is When Server C tries to connect to Server B, it fails and the debug flow shows a reverse check failure.  I am not sure why this is happening with FGSP enabled, as all other traffic syncs across fine.  However, Server B is able to connect to Server C. When I make Firewall B the VRRP master server C can connect to Server B, but then loses access to Server A.  It seems like FGSP isn't synic traffic that's directly conncted to the Fortigates that is acting as VRRP backup.  All other transit traffic thats asymmetric FGSP handles it fine. 

Hi All, I need to configure my firewall to identify users using Kerberos for single sign on without an use of an explicit proxy. I was only able to find articles with Kerberos authentication with explicit proxy. My Device : FG-401FOS Version : 7.0.15 Thank you !... 

Hello, I would like to take port01 to configure my DHCP, but when I take it off Vlan Switch I can no longer access the fortigate, how do I do it?    

Hello Experts,in Cisco SD-WAN we have components (vBond, vManage, vSmart, vEdge) what are the device's names do the same rules in Cisco SD-WAN?in Cisco:vBond: OrchasrtaionvManage: ManagingvSmart: Control PlanvEdge: the edge router Thanks

Hello everybody, ZTNA is not clear at all for me.I'm working from remote and in my Forticlient I've been assigned a tag: ZTNA_DEVI'm not connected to any VPN.On fortigate, there is a ZTNA Rule:  192.168.1.4 is a ZTNA server that manages a Virtual Machine.I've also a Firewall policy:This policy says that all users that whose destination is ZTNA_DEV (192.168.1.4) and have the tags ZTNA_DEV are allowed.But there is one thing I don't understand. I'm working from remote, so I'm not in the enterprise network. How can reach that server?The firewall policy is saying that the incoming interface is wan1, but how can I reach it?I know I have the tags, but how is possible that with these tags I should reach the internal network?Where am I wrong?Thank you so much! 

Hi everybody.I have the problem of receiving a privacy error when trying to access the 60F (firmware 7.6.0)  from lan.The real problem is that blocked pages don't display the Fortigate correct blocking page.I have done the Let's Encrypt ACME certificate and it works for connections out the lan. The privacy error is given because I use https://192.168.1.1 and the expected certificate is for xxxx.fortiddns.com (used for let's encrypt).I have, clearly, imported Fortinet_CA_SSL certificate in user's endpoint.I also tried to regenerate certificate and re-import it, without any change.I have an identical device working on another site, with exactly same configuration that doesn't have this issue, I really can't undersand the reason and how solve it.Thanks for helping.  

Hello,We have an FAZ Hyper-V VM running the latest 7.4.3 code. I can ping it and I can SSH into the FAZ but I cannot access it via the web GUI.  Edge returns ERR_CONNECTION_REFUSED.  Firefox just says Unable to connect.  Interface has  "set allowaccess ping https ssh snmp" Platform Type : FAZVM64-HVPlatform Full Name : FortiAnalyzer-VM64-HVVersion : v7.4.3-build2487 240514 (GA)

Hi There,I tried to create a aggregate VPN between two fortigate node. FOS 7.0.14.https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/779544/ipsec-aggregate-for-redundancy-and-traffic-load-balancingthere are two VPN tunnel established already. and I added one tunnel to the aggregate vpn successfully. But I cannot add another member into the group.according to the guidance, I have to set aggregate-member enable. But I cannot do it, check the error message below. # nextPlease enable phase2 auto-negotiate if ipsec-aggregate uses redundant algorithm.This interface is currently in use.object set operator error, -23, roll back the settingCommand fail. Return code 1I tried to enable the phase 2 autonegotiation and delete the vpn tunnel and create a new one. the result is same.I tried to disable the virtual interface but the result is same. Since there is traffic on the physical interface already. I cannot disable it. I don't want to break the service.Appreciate your advice on ho

I am trying to use two IPoE lines in one fortigate. The configuration is as follows.IPoE①: for InternetIPoE②: for maintenance such as Windows UpdateHow should we configure it?I know how to set up only one line.Should I use VDOM?It is version 7.4.3. Thank you for any answerBest regards

! collector was registered at one pointlost the passwordupdated password then tried to run phtools start allprcos are down and will not come up. /opt/phoenix/bin/phProvisionCollector --add admin 'biglong pw' siem vendor orgContinuing to provision the CollectorFailed to register collector!Cause:The organization "130862006-vendor" has already registered a collector with name "collector name" (But we had to change the credentials) Do these procedures still apply  to re-register a collector?  after getting the above error  , all their ph procs are down.  :1. SSH to FortiSIEM Supervisor2. Enter the following command to login into PSQL:        #psql -U phoenix phoenixdb    3. Update the PSQL Database:        =>ph_sys_collector set natural_id='' where name=<collector name>;    4. Quit PSQL:      &

Hi All,I currently have a client who uses the FortiClient VPN (Zero trust Fabric Agent) Version 7.4.0.1658. Using the GUI work fine, no problems. However, when trying using the CLI (from this article) it fails. The process I followed was. Execute FortiSSLVPNclient.exe (version 7.4.1658)Click settings,Create a new connection (eg: MyCo), [Note the Client isn't saving the 'Do not warn about server certificate validation failure' or the 'User Name' and 'Password' in the Connection Settings dialogue box.] I'm running the exe as Admin.Once I've created the connection, the command line I'm using is: FortiSSLVPNclient.exe connect -s MyCo -h [IP]:[Port] -u [userid]:[password] i -m -qAll that happens is the GUI appears, then if I click connect it flashes "connecting", then immediately back to "Disconnected". I've upped the logging of the FortiClient SSLVPN to "everything" but can't find the logs - LOL.Any help would be appreciated.Regards:Tony.

Hello all, Since yesterday I got a flood of our IPS about the following: date=2024-10-10 time=09:55:22 devid="FG100XXXXXXXXXXXX" devname="100f_serverroom" eventtime=1728546922552439440 tz="+0200" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" severity="low" srcip=xxx.xx.xx.xx srccountry="Reserved" dstip=157.240.247.61 dstcountry="Netherlands" srcintf="VLAN72" srcintfrole="lan" dstintf="wan1" dstintfrole="wan" sessionid=1996577 action="dropped" proto=6 service="HTTP" policyid=6 poluuid="016585d8-cf8c-51ec-1bc2-98b96e341900" policytype="policy" attack="HTTP.Suspicious.Headers.With.Special.Characters" srcport=49694 dstport=5222 direction="outgoing" attackid=48934 profile="high_security" ref="http://www.fortinet.com/ids/VID48934" incidentserialno=168450119 msg="http_decoder: HTTP.Suspicious.Headers.With.Special.Characters" crscore=5 craction=32768 crlevel="low" The destination is a meta-whatsapp service. This seems to happen with ev

Hello, I have an issue where we ingest a JSON type log which has multivalue key pairs. <132>1 2024-10-08T23:36:16.523272Z a347p001con61.itp.extra pam.rgt.gouv.qc.ca NILVALUE NILVALUE - {"adf":true,"significant":0,"udf":false,"virtualservice":"virtualservice-09330216-623b-4665-aebf-f6d69b96020c","report_timestamp":"2024-10-08T23:36:16.523272Z","service_engine":"z9900001awaf401-se-jmonv","vcpu_id":0,"log_id":661818,"client_ip":"3.98.92.14","client_src_port":48994,"client_dest_port":443,"client_rtt":9,"ssl_version":"TLSv1.2","ssl_cipher":"ECDHE-RSA-AES256-GCM-SHA384","http_version":"1.1","method":"GET","uri_path":"/note.txt","uri_query":"F_notini=&T_note=&nomentreprise=blah&filenote=../../winnt/win.ini","rewritten_uri_query":"F_notini=&T_note=&nomentreprise=blah&filenote=../../winnt/win.ini","user_agent":"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)","persistence_used":true,"host":"142.80.132.13","persistent_session_id":3472328297

Hello! Could you please help me find out where I can check the end-of-life and end-of-support dates for FortiGate Firewall devices? If you could guide me on how to do this or provide assistance, I would really appreciate it. Thank you!I am interested about FortiGate 90G and FortiGate 80F

Greetings Forti Community, I use a web application that I reach on a IP address in my company network over IPsec VPN.It appears that the application sends a HTTP POST request to the server that can't get through the VPN tunnel, because the package is to big. After I change my client VPN network interface to MTU 1350, it can send the package and the access works. I change it with the following command:netsh interface ipv4 set subinterface "Ethernet 3" mtu=1350 store=persistent After that I've tried to set the MTU of the VPN IPsec Tunnel to 1350 and restart my client, I still couldn't access the web application. I've also tried different MTU values on the Firewall, but it didn't really change anything. Only if I do it on the client per command line.If I restart my client and start the FortiClient VPN, it seems that this resets my MTU on my client VPN network interface. So I'd have to execute the command to change my client MTU every time after I start the FortiClient.&nbsp

Hello,I hope everything everything good, im reaching out for help i've seen your solutions and that you have good knowledge in fortigate/forticlient we are having an isse with some forticlient on some windows laptops were we enter configs correct but its gets stuck on connecting or after i install the vs c++ redistributable it pops up but blank and after a while it shows to enter credentials for authentication and 2fa after that it disconnects on its own no error no nothing.do you have any idea on what can be the problem cause im starting to think its a windows problem maybe a network adpater problem or something else 

Hello Community, We are facing an issue in cortex XDR integration error. (Screenshot attached). API has admin rights assigned. Does anyone face same error.

I'm planning a deployment to migrate stateless router ACLs centrally managed by Ansible to FortiGates/FortiManager. I'm experienced with FortiOS but new to FortiManager and I'm trying to solve a policy management problem. We have multiple sites and we'll have one FortiGate at each site. Each FortiGate will have about 70 rules in common, but most of the sites additionally have between five and a dozen site-specific rules.To manage this, I'd hoped to be able to layer multiple policy packages accordingly on each FortiGate. For example:Rules 1-70 - Shared policy packageRules 71-85 - Site-specific policy packageImplicit denyThis is trivial with Juniper's Security Director, which allows you to apply as many "group policies" to a firewall as you want and commingle them with device-specific policies. I was expecting similar functionality from FortiManager, but, as I learn the platform, I find that it doesn't really work that way, and you're not supposed to apply multiple policy packages to a s

Dear Fortinet Community. First of all the infos:Firewall model: Fortigate 100Fversion: 7.4.5 We have a thing I cannot explain to myself. I think the behaviour to handle it like this is since we have updated from 7.4.4 to 7.4.5. But I am not sure. We see a WebFilter violation when opening a http (not https) website. This website is in the category Phishing. We encountered it when installing a program that wants to download a executable file from this http source. Category Phishing is set to block in the WebFilter. Just to let you know. I made a ssl expection exception for the website. This helps to open the webpage when using SSL (https) but not without SSL, so http. The installer wants to reach the website by http. Probably I am wrong now but in the past we have added websites to the static URL Filter in the webfilter settings in order to reach them and to override a category filter. I have understood the static web filter as something like an override for categorie

Where is the problem? tunnel up no ping

Hi everyone,Regarding the ph processes.  First phAgentManager is down disk capacity is below 85%. I just see the health is showing this one proc is down. and I cannot find one doc about this anywhere? Why am I missing this? I just tried to search the community for the name phAgentManager,  and the search tried to correct me and asked if I meant Fortiseim Manager?  Also I am looking for a set of diagnostic steps I can use to create a runbook for when one or some or all of the ph processes are found to be down and my fellow engineers come on board. I am about a month in on this gig so still learning. Not having any luck with the search.  Cheers, Karl

Good day, I am working on a project to move from Domain Joined Windows 11 computers to Microsoft Entra Only Joined computers, I have a FortiGate FGT200F with Firmware 7.X which currently authenticates users via FSSO in the local Windows Domain via LDAP to determine which Web Filter Policies to apply based on their Active Directory group membership. My test Entra Only joined Windows 11 computers are having issues getting the correct Web Filter Policies from the FortiGate and are ending up going to the Catch-All policies, does anyone have any experience with how to do authentication with Entra Only Joined computers on a FortiGate? I have Microsoft Entra Connect Sync Pass-through authentication setup and it is working to authenticate Entra Only computers to the local Active Directory so users can gain access to network resources. Would I need to create groups in Entra the same as the local Domain groups and authenticate to them? And if so, how is this done? Thanks

Hi, Is there a way of getting a free limited version FortiAuthenticator VM so I do a proof of concept before purchasing? ThanksJulian