Solved

Hello, used products: FortiGate 80F/FortiGate 400F I have a simple Hub and Spoke Szenario, which works perfectly in 7.4.8 and less. If I upgrade my spoke to 7.4.9 I can't establish my VPN any more. Spoke says: ike V=root:0:vpn-pfi-hub: connection expiring due to mode-cfg client IPv4 error ike V=root:0:vpn-pfi-hub: going to be deleted ike V=root:0:vpn-pfi-hub: schedule auto-negotiateHub says:twin connection Spoke config: mode-cfg, but with manual assigned ip on the interfaceHub config: mode-cfg, no ip assignmentThere must have been a change in 7.4.9 - but I can't find it. If I downgrade, everything works.Kind regardsTwoSoulz

The documentation states you can define multiple certificates in an SSL profile in replace mode and it will compare the server name identification (SNI) and the common name (CN) with the certificate list in the SSL profile, and use the matched certificate as a replacement. If there is no matched server certificate in the list, then the first server certificate in the list is used as a replacement.However, this does not seem to work if you are using wildcard certificates. I have an SSL profile that has multiple separate wildcard certificates defined in the profile that is used to protect a highly available reverse proxy for several domains and subdomains.e.g. SSL Profile in replace mode has separate wildcard certificates for *.abc.net, *.abc.com, *.io.abc.com, *.abc.org, *.bbc.com, *.bbc.org. If a request comes in with an SNI of www.abc.com it will instead return the first certificate *.abc.net as the exact CN name matching does not match the wildcard.Has anyone else experienced this is

Hello everyone, After finalizing the bulk registration using the Persistent Agent, I’m wondering what’s considered the best practice to register a brand new device.The issue I’m seeing is kind of a chicken and egg problem:New devices can’t access the network because they get isolated (no Persistent Agent yet) But to deploy the Persistent Agent with GPO, the device first needs to join the domain And to join the domain, it needs network access first...How are you guys usually handling first time onboarding for new company devices after the first enrollement ?BR,

The issue:Clients connected to a vlan with Block intra-VLAN enabled can't reach the FortiGate for around 2 minutes and 30 seconds after failover. Clients connected to a vlan with no Block intra-VLAN enabled do not have this issue.All switches are managed by the Fortigate.Topology:2 X Fortigate 601F in HA A/P2 X Core switches FortiSwitch 1024E in MCLAG2 X FSR-216F-POE connected in a ring to the MCLAG switches. So, the first switch connects to the first 1024E switch and the second connects to the second 1024E switch with a link between the two FSR-216F-POE switches. (We can't change this because of the physical fibers)I have tested with two clients connected to the same switch. Client A connected to port 1 on a vlan with intra-vlan blocking enabled, and Client B connected to port 2 on a vlan with intra-vlan blocking disabled.Client A was having issues after the failover and could not reach the Fortigate for around 2 minutes and 30 seconds. Client B does not have any problems. It looses o

Hi, I am trying to migrate IKEv1 to IKEv2 Dial-UP VPN tunnels for devices that use Forticlient and that do not use Forticlient(e.g. MacOS).The configuration includes a split tunnel setup.When a Forticlient enabled client attempts an IPSec connection the client acquires a split tunnel VPN session. I can see the following few lines in the debug session that indicate routes will be installed in the routing table of the device. ike 2:QDIPS_0:10843292: processed INITIAL-CONTACTike 2:QDIPS_0:10843292: mode-cfg assigned (1) IPv4 address 172.28.12.1ike 2:QDIPS_0:10843292: mode-cfg assigned (2) IPv4 netmask 255.255.255.128ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:10.0.0.0/255.0.0.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:172.16.0.0/255.240.0.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:192.168.0.0/255.255.0.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:91.200.16.0/255.255.254.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:141.176.34.0/255.255.255.0:0ike 2:QDIPS_0:1

Hello, I am trying to update FortiSIEM content version from 901 to 908, but I receive a “server unreachable” error during the update.For testing, I allowed all-all access on the firewall for FortiSIEM, but the issue still persists.Has anyone experienced a similar issue? Are there any specific URLs/FQDNs, ports, or log files that should be checked for FortiSIEM content updates? Best Regards,İsmail ÜREK

I have a new Fortigate 60F that I am setting up. I upgraded the firmware to 7.2.1 and then used the web GUI to restore factory settings to give me a fresh base to work from. After the factory reset, I can see that the 60F is acting as a DHCP on the network, but I have been unable to ping it or access the web GUI to set it up. I don’t have a console cable and it may be difficult for me to get one as I am in a somewhat remote area. Does anyone have any thoughts on what could be causing this behaviour and/or how it could be resolved? Any assistance greatly appreciated.

Hello Fortinet Community,I have a question regarding FSSO and Active Directory user visibility in FortiGate logs.Currently, the customer has LDAP/FSSO configured, and user identification works correctly for a LAN segment directly connected to the FortiGate. In those logs, we can properly see the authenticated username along with source IP, destination, and bandwidth usage.However, there are additional user segments that are not directly connected to the firewall. These networks are learned through static/dynamic routing from other network devices. For traffic coming from those routed segments, the logs only show source/destination IPs and traffic usage, but no associated username.My main question is:Can FortiGate/FSSO associate users with IP addresses regardless of whether the network is directly connected or learned through routing protocols?From my understanding, FSSO performs User ↔ IP mapping based on authentication events from Active Directory, so theoretically it should not depen

Hello everyone,I know that Fortinet previously removed the possibility to transfer FortiToken licenses from one FortiGate to another FortiGate.I would like to know if it is still possible to transfer FortiTokens from a FortiGate to FortiAuthenticator now. Has anyone done this recently ?Thanks in advance.BR,

Can we set lease time for SSL VPN IP range? I don’t want same user use different IP if the user disconnect for short period.

Hello, I am using FortiAnalyzer 7.6.5. Under Log View > Logs, I can only see the Log Browse screen. Normal log categories like Forward Traffic, Event, Security Events, Web Filter, IPS, etc. are not visible. Logs are being received by the FortiAnalyzer, and under Log Browse I can see files such as tlog.log, elog.log, etc. The ADOM type looks correct, and there is no issue with admin privileges. In this case, what could be the reason for the normal log categories not being displayed? Could it be related to the Analytics/SQL database, log indexing, or any known issue with FortiAnalyzer 7.6.5? Thanks.

Hello Community, Would appreciate it if someone can point me to the right direction regarding the following. For example lets say there are 2 DoS policy with tcp_syn_flood configured like such (policy ID1 comes before policy ID2) Policy ID 1tcp_syn_flood, threshold 500, Action block Policy ID 2tcp_syn_flood, threshold 50, Action monitor The question isQ1  If policy ID 1 counter registers 400 therefore block was not triggered (below the threshold) will the packets get evaluated by policy ID 2? Regards.

We have a FortiGate + FortiAuthenticator(bought and registered through a Fortigat partner). We are using the free forticlient vpn, but because it is not getting updates we are looking at fortiems. I downloaded the installer and installed it on Ubuntu. On opening EMS I get a hardware ID which I need to connect to FortiCloud and get the 3 free trial licenses. But I don't see any possibility on FortiCloud to do this.Please point me to the right place to do this.

Hello everyone, From what I understand, the recommended method to register company assets is to integrate LDAP and enable the option where endpoints with the Persistent Agent get automatically registered once users authenticate with their AD credentials.So basically, if a user has the agent installed on their laptop and logs in using AD, the device gets automatically registered, please correct me if I’m wrong here.However, I came across information suggesting this method should mainly be used during the initial onboarding phase and be disabled after. My question is:How are new company users/devices automatically registered after that initial onboarding?Is there a best practice to handle ongoing automatic registration for new assets? Thanks in advance.BR,

Hello WiFi adminsIn FAP-231K datasheet, the AP supports 802.3bt (PoE++), 802.3at (PoE+) and 802.3af (standard PoE).What is the exact impact (on all aspects) if using .3at or .3af instead of .3bt?

Please how i check current fortinet version 7.2.12 when will expire and also confirm If i upgrade to new version fortinet firewall 201 will support SSL-VPN?

Hello everyone, I’ve got RADIUS set up for FortiNAC, with FortiGate managing FortiSwitch via FortiLink.What’s the easiest way to apply security policies in bulk to multiple switch ports?  Thanks in advance,BR,

I am new to FortiGate, i am trying to setup evaluation license on a VM for training purpose, im facing a problem in accessing the GUI, i have registered the license once and it was working good and then it did not work on the next day , i have reinstalled the VM and deleted the license from my fortiCloud account, after that i always receive this message when i try to register the license “Error in downloading license : Invalid serial number “   i’ve tried to register it manually on forticloud but not worked, any advise ? 

I tried to get a copy of the macOS offline installer for the Forticlient (VPN only), but the last post leads to a dead link.

If i have ipsec tunnel for site to site connection listen on port1, then on same port i confgire ipsec tunnel for remote access then is there any miss connection?I mean is there any wrong connection when Remote Access VPN want connect then the connection will passing thru the site to site tunnel and vice versa?

Hello FNAC admins,Is it necessary to configure the Winbind part for RADIUS authentication to work properly? Or can RADIUS function normally without integrating Winbind.Thanks in advance,BR, 

Two to three months ago, we migrated to the EMS Forticlient VMware appliance 7.4.4.Today, I tested the upgrade from 7.4.4 to 7.4.5 via the GUI. I tested two times with the same result.See the log below:As you can see, I started the upgrade around 3:54 PM.The upgrade apparently finished about 30 minutes later, 4:24 PM, but I got stuck at 50% and suddenly saw a client and network error.I logged in to the EMS console via a different workstation and received the message that the EMS Ugrade completed!Only after refreshing the browser with the 50% message, did I get the message "EMS upgrade complete!"I don't see any errors in the logs, so I assume the upgrade most likely completed successfully.The (7.4.4) Forticlient on the Windows 11 workstations didn't generate any errors and could also establish an SSL VPN connection. I could also create a FortiClient installer in the EMS console1) Any idea why the upgrade dialog box is stuck at 50%?2) And I'm missing the SSLVPN option in the screenshot b

I’m trying to setup a DNS service on the network interface.  I followed the instructions on this link.  However, it doesn’t resolve anything on the public domain.  It resolves interface domain name.  It looks like Fortigate doesn’t forward the query to system DNS servers.  Anything I need to check?  I used the following link to create DNS service.  Technical Note: DNS resolution not working when DNS Server configured to 'Same as Interface IP' | CommunityBasically, I want a user to use Fortigate interface as a DNS server IP and have Fortigate to resolve internal domain relying on the local dns database but forward to system dns servers to resolve anything outside domain names.

I have 2 Fortigate 600F in a HA Cluster that needs to connect to 1 ONU. Currently, both Fortigate is connected to a L2 switch that is then connected to the ONU. However, when the ONU is rebooted, Fortigate is no longer able to obtain an ip address on the port used to connect to the ONU. If I configure link monitor, would Fortigate be able to obtain ip address after rebooting ONU?What is the recommended network configuration when using HA Cluster with ONU?

I have problems with a policy where I include an application control where I block access to facebook, youtube and others, one of the applications that I allow within the control is whatsapp but it has presented problems since yesterday, the attached files are not They send and the messages are sent several minutes later, the same as when receiving. I have been doing tests and by allowing the known applications the whatsapp starts working correctly, someone could help me know what the problem is if everything was working well until yesterday that I present this inconvenient.   My device is a Fortigate 90D The only categories that I have blocked in the control of applications are: Botnet, Game, P2P, Social.Media, Update, Video/Audio and Unknown applications (now in monitor mode for whatsapp work) The other categories are in monitor mode