Solved

I have created Fortlink with dedicate to Fortiswitch checked. I setup internal DHCP and connected POE switch with Access Point. I am getting DHCP management address to switches but not getting DHCP from downstream port where access point is plugged in. There is no way to tag Fortilink interface in any downstream switch port unless I create interface type vlan. My question is, is there any way to use Fortilink as management vlan to provide DHCP for switches and DHCP also for  access points only using Fortilink rather creating a separate interface type vlan under Fortilink and add downstream switchports to it. I would like to know if this is possible.   

I have a question regarding Radius Server with Dynamic Vlan Assignment for SSD profiles. Basically I would like to have Dynamic VLAN Assignment and VLAN pooling enabled. I am running 7.4.5 code version and whenever I enable Dynamic VLAN Assignment, it disabled the VLAN pooling. I did find a documentation that it is possible 7.4.1 version came that both dynamic vlan assignment and vlan pooling is possible, reference: https://docs.fortinet.com/document/fortigate/7.4.0/new-features/924614/support-dynamic-vlan-assignment-with-multiple-vlan-ids-per-name-tag-7-4-1However; this is not working in code 7.4.5 code version. I would really like to have this feature that support vlan pooling with Radius because this setting in Cisco called RADIUS Server Overwrite interface, Meru called Radius With VLAN Pooling, allows us to have restricted access and unrestricted access at the same time based on the Network Policy server rules. This makes it easier to have users in groups tied to authenti

Fortimanager version 7.4 and Fortigate version 7.4.3. Fortigate is 40F.While pushing any config to Fortigate below line automatically come sin the config preview. The installation faisl due to this config too.config web-proxy global set proxy-fqdn "default.fqdn" endbelow is the error getting. Any idea to fix this please.------ Start to retry -------- 40F-TEST $ config web-proxy global 40F-TEST (global) $ set proxy-fqdn "default.fqdn" 40F-TEST (global) $ end ---> generating verification report (vdom root: web-proxy global:proxy-fqdn) remote original: to be installed: "default.fqdn" <--- done generating verification report install failed 

HiYesterday I had to disable full SSL inspection in our proxy policies due to poor browsing performance. Fortigate 200E running 7.0.15 No policy changes were made, and user numbers, session numbers and interface throughput are average for daily use. This is an edge firewall. I tested early this morning before most users were in, and still had slow performance. I tried restarting the WAD processes, to no avail. CPU and memory are both fine, with no change when DPI is disabled/enabled. I notice no change in CPU/SPU ratio when turning DPI on/off either. Any ideas where I should look to diagnose this, and has anyone else experienced a similar problem?  

Hi, The Fortigate 50G-SFP documentation does not specify whether the SFP port can function as a secondary WAN. Does anyone have information about this? Thanks!

Our health check has come back that our login pages are viewable over the internet.I have disabled HTTPS/HTTP over the WAN but page still shows.Any quick fix please?Thanks

Hi,I've looked on Broadcomm's (nee, VMware) support site, but I was hoping someone here has already delt with this and might share the port list to successfully connect 1 vCenter server to 1 host and 2 VMs over a site to sire IPSec tunnel. I'm looking to limit access of the whole remote network to the vSphere infrastructure.TIA 

We have some hyper-v VMs that we upgraded from 7.2.3 to 7.2.5 forticlient. SSL VPN no longer works after upgrading.We can repeat the problem by downgrading to 7.2.3 and then successfully connecting then upgrading to 7.2.5 and breaking it again.we need to run 7.2.5 to fix a wild card FQDN issue with ztna destinations that we were experiencing on 7.2.3.

Hi Forticollegues,I'm implementing a Fortinac solution to manage dynamic vlans via unique WiFi SSID.The wifi networks and all wired networks are managed by Fortigate.In Fnac inventory I see all Fortigates ports mapped and FNAC learn all client mac address from wired and wireless ports.There is some methods to instruct the Fnac to learn mac address only by wireless networks? I don't need to manage all wired networks and I see a lot of rogue devices from Fortigate wired ports.Thank youVincenzo

Hi,we are sw company, and have own security product (authentication server). It can work like radius + otp (and many others methods) so I try to integrate OTP to ftgt. It works (with free ssl vpn client). But after I try use 2FA online method, with push notification. And here I have problem. Forticlient send AD user name and correct password, mobile app recieve notification, but FortClient instantly shows OTP dialog. With no reason, I not send more validation req. -- UPDATE ---This is because I have second functional radius server with MS365 MFA on it. And fortigate from unknown reason switch to this, second server, almost instantly after password send. When I change IP of second radius to nonsense, everything works.Fortios have only 2 parameters I know, timeout in radius definition, and global, remoteauthtimeout. Both set to 120s and not helping.This seems now like some error in fortigate logic, so I create ticket on it, sorry for this post, I believe in time of writing that this can

Hello Community. Please give some tip on how to create lists like (words, emails, names, etc) for later use. case scenario: using the filter "Mail Sender" --> IN --> (select from cmdb the list emails)   Regards.

 Hi,I am using a FortiNAC-CA 7.2.4 (FortiNAC-OS) with a basic FortiNAC license. Network Infos:The FortiNAC is connected via cable to a switch and terminates on a FortiGate through port6 (0.0.0.0/0) with a VLAN stub and VLAN Isolation. I have configured port1 for MGMT (Layer 3) and port2 in L3 Isolation mode, with an IP on the VLAN stub and a Range Scope for the VLAN Isolation. The FortiGate acts as a DHCP relay towards the IPs of the FortiNAC (both port1 and port2). FortiNAC infos:I created two groups (MAB_VLAN2 and MAB_VLAN3) and two roles (ROLE_VLAN2 and ROLE_VLAN3). I then set up user configurations with the following logic:If the user does not belong to the groups VLAN2, VLAN3, or Registered_Host → Logical Network IsolationIf the user belongs to group VLAN2 and has ROLE_VLAN2 → Logical Network VLAN2If the user belongs to group VLAN3 and has ROLE_VLAN3 → Logical Network VLAN3I am using a test switch and a test PC, and from manual testing, it seems everything

Hi I'm trying to migrate from EMS 7.2.5 to 7.4. I have gone through all the steps in the Admin guide and have now hit a brick wall.  I am getting an error "Authentication (publickey) failed" and "encountered RSA key, expected OPENSSH key" and the migration is failing. I found this article at  https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-Getting-an-error-when-performing-EMS/ta-p/328415 which did help with another error I had. However, the article just says to the generate the public key, which I have done and re-done several times with no effect.  Has anyone had this issue? Can anyone help please? ThanksRoy

Hello everyone, I'm facing an issue after enabling VXLAN over IPSEC and creating software switches on my FortiGate. I have several scripts that connect to various Microsoft services (e.g., Office 365, Azure), and they were working perfectly before these changes. However, since enabling VXLAN over IPSEC and configuring the software switch, the scripts are no longer able to connect to the Microsoft services. If I remove the VXLAN from the software switch, the scripts start working again, which suggests that the problem is directly related to the VXLAN configuration or software switch. Does anyone have suggestions or insights on what to check in the VXLAN over IPSEC or software switch configuration that might be causing these connection issues? Thanks in advance for your help!

For example, for TLS 1.2, i want to enable / use only these cipher suites and in order / priority. Meaning that all other TLS1.2 not in the list below, will not be accepted / allowed. Is there any possible way to do so, if so how? If not, what would be the best / closest method in achieving something like this or similar. THANK YOU SO MUCH!!! I really appreciate any sort of help.TLS1.2 Ciphers1 TLS_DHE_RSA_WITH_AES_256_GCM_SHA3842 TLS_DHE_RSA_WITH_AES_128_GCM_SHA2563 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA3844 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA2565 TLS_DHE_RSA_WITH_AES_256_CBC_SHA2566 TLS_DHE_RSA_WITH_AES_128_CBC_SHA2567 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA3848 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA2569 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA10 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA    

Hi So we had a test AP setup in Fortigate under a physical interface with a guest and a staff WIFI setup - all worked correctly and correct DHCP IP assigned. I have since connected a Fortiswitch, i have created a new VLAN and took the IP address and range from the existing physical guest VLAN and used that on the new fortiswitch VLAN (then changed the address on the physical)the AP is up + online, I can see both SSID's, but when I attempt to connect to the guest WIFI I get a random IP address on the wrong subnet an the device never connects.....log states 'Wireless station DHCP process failed with no server response'  I have adjusted all policies to allow traffic as far as I can see. Any ideas? Thanks.  

Hello All,Could you kindly assist with a document or guide from Fortinet outlining best practices and recommendations for hardening the configuration of a FortiGate firewall, specifically for the 60E model? I'm particularly interested in configurations involving services such as Malware Protection, IPS, Antivirus, URL filtering, DNS filtering, VPN, Policies and other security features.Your assistance is greatly appreciated.

Hello, I am looking for some clarification on the SDN Connector behavior.We are running the HA-Failover option using SDN-Connectors to change the azure route tables next hop entries to the then primary fortigate node on failover.By now we reached about 30 connectors for different subscriptions and started getting API throttled by Azure.Since we do not use any sdn-connector functionality besides the failover I have two questions:1. From testing it looks like the connectors are not trying to update the next hop entry on the azure route tables when the update-interval cycles but are only retrieving the service tags and doing an inventory of the resource groups.There are entries like this:azd sdn connector AZURE_SDN_001 start updating IP addressesazd sdn connector AZURE_SDN_001 finish updating IP addressesbut they do not actually change the next hop entry so i figure it's also just a inventory for the dynamic object functionality of the sdn connectors, is that correct?2. Is a failover the

Hi, After configuration, I would try to login to the Forticlient VPN 7.4.0 with my account. But the sign in pop-up is redirecting to the email login again and again. My PC is Windows 10.What should i want to do. Redirecting pop-up Thank you,Chaniru Manamperi

I can not get this figured out.  I’ve got a FortiGate running v7.2.9 (also tried with v7.2.8) and I’m trying to configure our SSL VPN to use an external DHCP Server to assign our clients IP addresses.  I followed the instructions outlined here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-with-external-DHCP-Server/ta-p/215644 The SSL VPN Clients are able to connect to the VPN and do successfully obtain an IP address from our DHCP server, along with the correct DNS servers, however, the clients are not able to access anything at all once connected.  The clients get assigned the proper routes to get to our internal LAN and WAN (confirmed by checking print route on the clients), so no problem there.  I have firewall policies in place to allow traffic from the SSL root to the LAN and WAN.  Nothing is showing up in the firewall logs as being blocked and the hit count/bytes are increasing (indicating the policies are being hit).  If I d

HelloI see in admin guide that ZTNA tags can be with with SSL VPN to filter the traffic based on tags, but I don't find the same with dialup IPsec VPN.Is it officially supported?

Hello community. We are implementing fortigate in the OCI cloud. We have seen several tutorials that indicate that for each network I want traffic to be sent over the fortigate I need a VCN.My question is, can I create 1 single VCN Spoke and there have all the subnets I need making the traffic go through the FW. I have tested with the above configuration and sending traffic between subnets in the same spoke VCN but the FW does not do policy validation, it sends the traffic directly.

Hello all,Our Fortigate 101E is running FortiOS 6.4.15. I understand that 6.4 is end-of-support soon, if not now. I'm wondering which version of 7.x to go with. Any recommendations? Which one is the most stable? Thanks for any input. Rod

How to access Gui Fortigate using FMG IP, just change the port on URL according to FortiManager IP

to IT gurus.   What must be done on the Aruba switch port in order for Fortiswitch to initiate?As of right now, the Aruba switch serves as our lone connection to FortiGate while we work to manage a new Fortiswitch. See the following quick topology. Fortigate connected to Aruba ( Trunk port  Native Vlan1 ,)Aruba  ( Trunk port  Native Vlan1 ,) connected to Fortiswitch (Port 49 trunk, Native vlan1)Fortigate sees the Fortiswitch and Athorises it however its status : "offline",  "port disconnected" Logs from Fortigate:  Switch-Controller authorizedCAPUTP session status notificationSwitch-Controller Tunnel UpSwitch-Controller Switch Sync Error    - Message global-lldp-settings failed:-13Switch-Controller Switch Sync Error - Message global-lldp-profile failed:1Switch-Controller Switch Sync Error -Message qos.dscp-map failed:-7621NAC MAC cache sync - NAC MAC cache cleared on switch S14xxxxxxxxx port (null