Solved

 Hi,I am using a FortiNAC-CA 7.2.4 (FortiNAC-OS) with a basic FortiNAC license. Network Infos:The FortiNAC is connected via cable to a switch and terminates on a FortiGate through port6 (0.0.0.0/0) with a VLAN stub and VLAN Isolation. I have configured port1 for MGMT (Layer 3) and port2 in L3 Isolation mode, with an IP on the VLAN stub and a Range Scope for the VLAN Isolation. The FortiGate acts as a DHCP relay towards the IPs of the FortiNAC (both port1 and port2). FortiNAC infos:I created two groups (MAB_VLAN2 and MAB_VLAN3) and two roles (ROLE_VLAN2 and ROLE_VLAN3). I then set up user configurations with the following logic:If the user does not belong to the groups VLAN2, VLAN3, or Registered_Host → Logical Network IsolationIf the user belongs to group VLAN2 and has ROLE_VLAN2 → Logical Network VLAN2If the user belongs to group VLAN3 and has ROLE_VLAN3 → Logical Network VLAN3I am using a test switch and a test PC, and from manual testing, it seems everything

Hi I'm trying to migrate from EMS 7.2.5 to 7.4. I have gone through all the steps in the Admin guide and have now hit a brick wall.  I am getting an error "Authentication (publickey) failed" and "encountered RSA key, expected OPENSSH key" and the migration is failing. I found this article at  https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-Getting-an-error-when-performing-EMS/ta-p/328415 which did help with another error I had. However, the article just says to the generate the public key, which I have done and re-done several times with no effect.  Has anyone had this issue? Can anyone help please? ThanksRoy

Hello everyone, I'm facing an issue after enabling VXLAN over IPSEC and creating software switches on my FortiGate. I have several scripts that connect to various Microsoft services (e.g., Office 365, Azure), and they were working perfectly before these changes. However, since enabling VXLAN over IPSEC and configuring the software switch, the scripts are no longer able to connect to the Microsoft services. If I remove the VXLAN from the software switch, the scripts start working again, which suggests that the problem is directly related to the VXLAN configuration or software switch. Does anyone have suggestions or insights on what to check in the VXLAN over IPSEC or software switch configuration that might be causing these connection issues? Thanks in advance for your help!

For example, for TLS 1.2, i want to enable / use only these cipher suites and in order / priority. Meaning that all other TLS1.2 not in the list below, will not be accepted / allowed. Is there any possible way to do so, if so how? If not, what would be the best / closest method in achieving something like this or similar. THANK YOU SO MUCH!!! I really appreciate any sort of help.TLS1.2 Ciphers1 TLS_DHE_RSA_WITH_AES_256_GCM_SHA3842 TLS_DHE_RSA_WITH_AES_128_GCM_SHA2563 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA3844 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA2565 TLS_DHE_RSA_WITH_AES_256_CBC_SHA2566 TLS_DHE_RSA_WITH_AES_128_CBC_SHA2567 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA3848 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA2569 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA10 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA    

Hi So we had a test AP setup in Fortigate under a physical interface with a guest and a staff WIFI setup - all worked correctly and correct DHCP IP assigned. I have since connected a Fortiswitch, i have created a new VLAN and took the IP address and range from the existing physical guest VLAN and used that on the new fortiswitch VLAN (then changed the address on the physical)the AP is up + online, I can see both SSID's, but when I attempt to connect to the guest WIFI I get a random IP address on the wrong subnet an the device never connects.....log states 'Wireless station DHCP process failed with no server response'  I have adjusted all policies to allow traffic as far as I can see. Any ideas? Thanks.  

Hello All,Could you kindly assist with a document or guide from Fortinet outlining best practices and recommendations for hardening the configuration of a FortiGate firewall, specifically for the 60E model? I'm particularly interested in configurations involving services such as Malware Protection, IPS, Antivirus, URL filtering, DNS filtering, VPN, Policies and other security features.Your assistance is greatly appreciated.

Hello, I am looking for some clarification on the SDN Connector behavior.We are running the HA-Failover option using SDN-Connectors to change the azure route tables next hop entries to the then primary fortigate node on failover.By now we reached about 30 connectors for different subscriptions and started getting API throttled by Azure.Since we do not use any sdn-connector functionality besides the failover I have two questions:1. From testing it looks like the connectors are not trying to update the next hop entry on the azure route tables when the update-interval cycles but are only retrieving the service tags and doing an inventory of the resource groups.There are entries like this:azd sdn connector AZURE_SDN_001 start updating IP addressesazd sdn connector AZURE_SDN_001 finish updating IP addressesbut they do not actually change the next hop entry so i figure it's also just a inventory for the dynamic object functionality of the sdn connectors, is that correct?2. Is a failover the

Hi, After configuration, I would try to login to the Forticlient VPN 7.4.0 with my account. But the sign in pop-up is redirecting to the email login again and again. My PC is Windows 10.What should i want to do. Redirecting pop-up Thank you,Chaniru Manamperi

I can not get this figured out.  I’ve got a FortiGate running v7.2.9 (also tried with v7.2.8) and I’m trying to configure our SSL VPN to use an external DHCP Server to assign our clients IP addresses.  I followed the instructions outlined here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-with-external-DHCP-Server/ta-p/215644 The SSL VPN Clients are able to connect to the VPN and do successfully obtain an IP address from our DHCP server, along with the correct DNS servers, however, the clients are not able to access anything at all once connected.  The clients get assigned the proper routes to get to our internal LAN and WAN (confirmed by checking print route on the clients), so no problem there.  I have firewall policies in place to allow traffic from the SSL root to the LAN and WAN.  Nothing is showing up in the firewall logs as being blocked and the hit count/bytes are increasing (indicating the policies are being hit).  If I d

HelloI see in admin guide that ZTNA tags can be with with SSL VPN to filter the traffic based on tags, but I don't find the same with dialup IPsec VPN.Is it officially supported?

Hello community. We are implementing fortigate in the OCI cloud. We have seen several tutorials that indicate that for each network I want traffic to be sent over the fortigate I need a VCN.My question is, can I create 1 single VCN Spoke and there have all the subnets I need making the traffic go through the FW. I have tested with the above configuration and sending traffic between subnets in the same spoke VCN but the FW does not do policy validation, it sends the traffic directly.

Hello all,Our Fortigate 101E is running FortiOS 6.4.15. I understand that 6.4 is end-of-support soon, if not now. I'm wondering which version of 7.x to go with. Any recommendations? Which one is the most stable? Thanks for any input. Rod

How to access Gui Fortigate using FMG IP, just change the port on URL according to FortiManager IP

to IT gurus.   What must be done on the Aruba switch port in order for Fortiswitch to initiate?As of right now, the Aruba switch serves as our lone connection to FortiGate while we work to manage a new Fortiswitch. See the following quick topology. Fortigate connected to Aruba ( Trunk port  Native Vlan1 ,)Aruba  ( Trunk port  Native Vlan1 ,) connected to Fortiswitch (Port 49 trunk, Native vlan1)Fortigate sees the Fortiswitch and Athorises it however its status : "offline",  "port disconnected" Logs from Fortigate:  Switch-Controller authorizedCAPUTP session status notificationSwitch-Controller Tunnel UpSwitch-Controller Switch Sync Error    - Message global-lldp-settings failed:-13Switch-Controller Switch Sync Error - Message global-lldp-profile failed:1Switch-Controller Switch Sync Error -Message qos.dscp-map failed:-7621NAC MAC cache sync - NAC MAC cache cleared on switch S14xxxxxxxxx port (null

What's up all. Novice at networking here, bear with me. Trying to dump my cheap home firewalls and go with the real thing. Looking to purchase a Fortigate Firewall and Catalyst 1200 Series Switch. Pretty basic setup. I need to:Create VLANS and have them access the internetCompletely isolate the VLANS at Layer 3I have been looking at a few different ways to do this but need help. I can figure out most of the config but could use assistance with the design / have a few config questions. Would you:Go layer 2 VLANS at the switch and then tag them up to the firewall and create firewall policies to separate the VLANS? Would I even need to tag them on the firewall?Would inter-vlans need to be created on the firewall to deny all traffic or could I just create firewall polices for each lan and have the switch handle the tagging?orGo Inter-vlan on the switch and create ACLS on the switch as opposed to having the firewall do the work. It seems strange to me to have a firewall perform switchi

Hello team!!! We have 2 FGT100F in HA and configured interfaces called "mgmt" as "in band"Now we need to access from a computer in any other interface and get:150.0.0.4 is the IP of Fortigate HA in a specific VLAN and 150.0.0.3 is another device in the same VLAN.I know this is a public IP, but this is complicated to change the IP in all the devices in this VLAN.From 150.0.0.3 I can ping 150.0.0.4, but not the HA IP on mgmt interfaceFrom another device in mgmt interface, I can ping the HA IP on mgmt interface, and each Fortigate as wellPreviously, we had disabled src-check in mgmt interfaceI tried to add a local-in policy to allow this (config firewall local-in-policy), but still the same behaviorWe need to access to Fortigate from any VLAN, using the IP on the mgmt interface.  Is this possible? Thanks in advance.Regards,Damián

Hello, Does the FG-901G AC version(NOT DC) have a location for a 2-hole grounding lug on chassis? The quickstart guide shows that the DC version ships with grounding lugs. We have an AC version coming and not sure if we can use a 2-hole 6AWG grounding lug on it.. Thankyou.. full P/N  FG-901G-TAA-FGDUS

Hello everybody,I've a problem in my network with my FortiGate.I've a simple SSL-VPN (web mode is disabled) whose access is restricted to italian and albanian addresses:The problem is that there are many connection attempts, and each of these attempts has a different IP address: date=2024-09-27 time=12:27:33 id=7419267613974331394 itime="2024-09-27 12:27:34" euid=5123 epid=3 dsteuid=3 dstepid=3 logver=702101706 logid=0101039426 type="event" subtype="vpn" level="alert" action="ssl-login-fail" msg="SSL user failed to logged in" logdesc="SSL VPN login fail" user="abl0000" remip=87.4.68.245 group="N/A" tunnelid=0 tunneltype="ssl-web" dst_host="N/A" reason="sslvpn_login_unknown_user" eventtime=1727432853997409279 tz="+0200" devid="FGT60FTK23099PH2" vd="root" dtime="2024-09-27 12:27:33" itime_t=1727432854 devname="ntd-fg"date=2024-09-27 time=12:16:21 id=7419264723461341184 itime="2024-09-27 12:16:21" euid=4699 epid=3 dsteuid=3 dstepid=3 logver=702101706 logid=0101039426 type="event" sub

Hello folks,in my deployment i'm using a fortigate 200F with Sso (Azure) and everything was working correctly before  upgrading from 7.0.12M to 7.2.7.After the upgrade i'm facing that authd process is constantly consuming 97% of cpu resources and Sso is not working anymore.Thought it was a bug so decided to upgrade newly from 7.2.7 to 7.4.3 but i still have the issue.Tried to reboot the firewall (a HA pair) and until there are no authentication requests from clients, the cpu is ok (authd process is not present in the process list or is at 2%), as soon as there's an authetication request the authd process goes to 97% and so the cpu.In this condition the Sso is not working, i check the configuration and nothing changed, took a debug and sniffer packet from client and all the routing is ok, checked fsso configuration both on firewall and Azure and it's ok.Did you face something similar? Do you have any advise? The upgrade triggered something but i can't understand what is the ro

I am currently experiencing issues while attempting to upgrade the Fortigate firmware to version 7.2.4. The upgrade is failing both through the GUI and TFTP methods. The original firmware version is 7.0.10. However, when attempting to upgrade to random version 7.2.6 or downgrade to version 6.4.14, I can successfully perform the upgrade or downgrade using TFTP. If anyone has encountered the same issue and has found a solution, please let me know. The model of the Fortigate is 80F. I wanted to upgrade to 7.2.4Booting OS... No default firmware. Error: Default firmware boot failed!!! Switch to BACKUP after 31 seconds. Press any key to stop. FOS boot failed. You may try backup. Please power cycle. System halted. System will auto-reboot after 59 seconds ('CTRL+D' to reboot immediately). resetting ... FortiGate-80F (05:42-06.01.2023) Ver:05000100 Serial number: FGT80FTK23045999 CPU: 1200MHz Total RAM: 4 GB Initializing boot device... Initializing MAC... NP6XLITE#0 Please wait for OS

Hello, we have a FG80 we are using for testing and it has no valid licence. This FG always had 2FA with FortiToken. Now I wanted to change the Token but it will not be sent. I tried with my mail and also with Gmail account and via SMS and I dont get anything. Is this something they removed because of no valid licence? Thanks 

Hi everyone, We just configured our SSL VPN with SSO/SAML and are facing issues. Some users get stuck at 40% after logging in with their Entra account and going through the MFA process while others are able to connect without any problem. When it gets stuck at 40%, we don't see any logs on the Fortigate, but we can see that it went through the Entra App successfully. We are using a custom port, Let's Encrypt Cert and we disabled the web mode for the split-tunnel.The users with issues are in the same group as the one that works successfully. FortiClient is V7.4.0.1658. Fortigate 101F is v7.2.9.  Thanks

Current fortinet 61F firmeware version 7.0.11 for wireless using FAP U323EV to 7.0.132 version, I have configured 2x ssid guest for tunnel and another one for brdige mode most of them works during the night time and next day morning it stopped broadcast the SSID.also found out some forward traffic logs where it showing FORTI-AP interface is not able to talk to DNS whil

Hello everyone, I’m trying to set up VLAN over IPSEC using VXLAN on my FortiGate, but I’m facing issues where the tunnel doesn’t seem to work as expected. The tunnel comes up, but traffic from the VLAN doesn’t seem to pass through. I’ve tried troubleshooting using various methods, but I haven’t been able to resolve the issue.  Here’s the configuration I’m using for VXLAN 506: On site A :config system interface edit "IPSEC_VXLAN" set vdom "VDOM1" set ip 10.5.5.1 255.255.255.255 set allowaccess ping set type tunnel set remote-ip 10.5.5.2 255.255.255.252 set snmp-index 42 set interface "vlnk_HYP0" next end config system interface edit "VLAN_506" set vdom "VDOM1" set role lan set snmp-index 506 set interface "port1" set vlanid 506 next end config system vxlan edit "VXLAN_506" set interface "IPSEC_VXLAN" set vni 506 set remote-i

Hello everyone, I'm currently using FortiManager 7.4 with two connected FortiGate devices. I had two separate firewall policies for each device, and I am trying to merge them into a single policy package. My goal is to push this policy package to both FortiGates, ensuring that only the necessary rules are applied to each device. However, during the policy installation process, I encounter the following error message: "The following ADOM interfaces have no mapping. All ADOM interfaces should be mapped before continuing with installation." In each block I have framed, the interfaces do not exist locally, but they are present in the remote device. What is wrong? Any ideas? Thanks for your help!