Solved

A collector with high cpu usage. It's reporting, procs are up.. the stop start  seems to be very short in duration what is it actually doing? Thanks

Hello, do you have a video I can follow to close a VPN between two fortigate? What would be the best practice?

 Hello everyone, I want to set up the "Push Notification" option for FortiToken mobile. I followed the technical tip here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiToken-mobile-push-notification/ta-p/195578It works very well, but I would like to know if I can configure it for my two WAN lines?FTMThank you, 

Anyone experiencing similar issue since yesterday  ?  It happened suddenly, with no modification on web filtering rules from our side, nor any updates done on Zoom app nor Forticlient.  Forticlient 7.0.9Zoom 6.2.2 and 6.2.3MacOSX Sequoia 15.0.1  

Hello everyone,I am encountering issues with setting up multicast traffic in a Layer 2 environment. Although the PCs can ping each other and are correctly connected to the Wi-Fi network, the VLC client is unable to receive the multicast stream sent by OBS Studio.ScenarioThe network Lab consists of the following devices:1 FortiGate2 FortiSwitch2 FortiAP2 PCs on Wi-Fi (IPs: 172.16.0.2 and 172.16.0.3), one running OBS Studio and the other running VLC.TopologyFortiGatePort 1 connected to Port 24 on FortiSwitch 1.Port 2 connected to Port 24 on FortiSwitch 2.FortiSwitch 1 and 2Connected to each other through Port 23.FortiAP connected to Port 21 on each FortiSwitch.ConfigurationVLAN 200 for Wi-Fi Network:Subnet: 172.16.0.0/22FortiGate Gateway: 172.16.0.1DHCP managed by FortiGate: Range 172.16.0.100 - 172.16.0.254IGMP Snooping Enabled on FortiSwitches and FortiAP:IGMP snooping is enabled globally on both FortiSwitches and FortiAP.IGMP Querier is disabled since multicast traffic is expected to

My company is trying to set up a site-to-site IPsec VPN tunnel with another companies' network. When configuring the VPN tunnel, we ran into an issue where both networks on either end of the tunnel have the same ip range/subnet 10.1.10.0/24. It is the primary and only private Ip/subnet for our company and the other company utilizes the IP range and subnet along with a few others. Rather than changing our private Ip range/subnet I was looking to utilize NAT to translate our private Ip to another range/subnet when accessing the other company via the VPN tunnel. But have been having a difficult time finding information on exactly what steps to take to complete this within the FortiGate GUI. We have a FortiGate 40F any help or even recommendations would be appreciated.

Hello everyone, i have a question about using FortiGate as a DNS server, we are trying to make use of FortiGate for other then just the use of it for vpn only. My question is FortiGate as the DNS server relaible to use? because w have two windows DNS Servers that are running normal but we wanna see if we use FortiGate for DNS and should it be recursive mode and how to implement this idea.

Hello,Just got a brand-new Fortinet setup.Tried to do EAP-TLS with computer authentication + LDAP + Company PKI.But can't get it to work, so went back to basic, and using FortiAuthenticator as CA and User authenticationI am getting this error: 2022-01-14T20:46:50.517025+01:00 FortiAuthenticator radiusd[19012]: (85) eap_tls: Verify User Kenneth (GUI user type: 0, id: 3) certificate binding2022-01-14T20:46:50.517384+01:00 FortiAuthenticator radiusd[19012]: rlm_eap_tls: Certificate binding check failed. (CN=Kenneth, Issuer=/C=DK/L=Viborg/O=HandbergIT/OU=IT/CN=fac.handberg.pri)2022-01-14T20:46:50.517642+01:00 FortiAuthenticator radiusd[19012]: (85) eap_tls: ERROR: TLS Alert write:fatal:internal error Have imported the user certificate in Local user certificate personal store. Do someone have any idea why?

Hi,I am trying to connect my Fortiweb Manager to a new Fortiweb installed at a client.The two devices see each other, the local user created on the customer's fwb dedicated to hookup is ok; but on "onborading" I get this error:Failed to connect to FWB device       Is it possible that this error is caused by the fact that the fortiweb in the client home has not yet been licensed ? ThanksFortiWeb #FortiWebManager

delete post

HI , I recently got into firewalls,  I have Fortigate 200F, I want to do SSL-offloading with  it if possible ?my question is , is it possible to do it with Fortigate and if yes , then what makes it different from Fortiweb ? when i can offload traffic on my Fortigate and inspect it ? 

Hi,I hope everyone is doing well. we are trying to configure the voice VLAN for the whole network in cisco switches everything is simple I finished the configuration but am having a hard time trying to research about ForitSwitch command or GUI to set up the voice VLAN can I get any documentation or some brief explanation on how to configure it via GUI or CLI would really appreciate it .

First my environment is on Huawei cloud, I have fortigate FW connected to VPC1, and VPC2 connected VPC1.VPC's subnets:VPC1: 10.0.0.0/16VPV2: 10.1.0.0/16I have created VLANs on firewall that matches each subnet on VPC2, for example I have a server connected to VPC2 with IP address 10.1.1.100, so in firewall under my LAN interface I created VLAN interface with subnet 10.1.1.0/24static routes have been created on Huawei from VPC1 to VPC2, and vise versa.static routes have been created on Firewall to communicate with VPC2 through VPC1.With my current configuration:I have access to server connected to VPC1 through VPN, but not to VPC2 server (note that I only have access to VPC2 servers using VPC1 server).I don't have ping to servers on VPC2 from firewall.I can access FW from VPC1 and VPC2.Both VPCs have access to internet (traffic is passing through firewall)What do I need to let the VLANs communicate with the subnets on the switch?

 Hi all, I have some question regarding the routing in FortiGate here. I have attached the topology here for better understanding. I only have a control of ID FortiGate and cannot see the configuration on Azure WAN and other Head Office. Current condition is in the green box, all Head Office FortiGate has IPSec tunnel to Azure WAN, and I think the Azure WAN is responsible for the BGP routing to all other Head Office. From ID Head Office, I can connect to TH Head Office and JP Head Office. Everything is working well. So, I have a new Branch office in ID. I can create the site-to-site VPN between ID Head Office and ID Branch, but the problem here is to connect the ID Branch to TH Head Office or JP Head Office via ID Head Office. Does anyone ever have this kind of configuration and can give me suggestions about how to configure it? Thank you.

Hello everybody, I've been working with a ZTNA for about a year without problems.Since Forticlient EMS upgraded to 7.2.5 version, something strange is happenening. This user, who has always worked with ZTNA, can't access network resources anymore (he was Off-Fabric during the connection attempts).This is one the logs: date=2024-10-09 time=16:14:43 id=7423779172176101376 itime="2024-10-09 16:14:43" euid=3 epid=101 dsteuid=3 dstepid=1053 logflag=3 logver=702101706 type="traffic" subtype="ztna" level="notice" action="deny" policyid=15 sessionid=10994158 srcip=xxxx dstip=10.1.0.214 srcport=52177 dstport=3389 duration=19603 proto=6 sentbyte=10454368 rcvdbyte=31622617 logid=0005000024 service="RDP" app="RDP" appcat="unscanned" srcintfrole="wan" dstintfrole="lan" policytype="proxy-policy" eventtime=1728483282890140384 wanin=31622617 wanout=7184424 lanin=10454368 lanout=32300828 crscore=30 craction=131072 crlevel="high" poluuid="7f1a8a84-dfd7-51ee-4200-2edb944b93d3" srccountry="Italy

Hello everybody,Some time ago I created a ZTNA environment on my Forticlient EMS, assigning some tags to some users.For example, look at these two users (this first one uses a macOS device, the second one a Windows device):the first one was Off-Fabric too when the attempts occured. As you can see, both users have the same tags.The ZTNA Firewall policy is unique:  So,  both user should access or not the ZTNA.The strange fact is that the Windows user can access the ZTNA: date=2024-10-10 time=13:23:01 id=7424106010597392384 itime="2024-10-10 13:23:01" euid=1040 epid=1070 dsteuid=3 dstepid=1051 logflag=1 logver=702101706 type="traffic" subtype="ztna" level="notice" action="accept" policyid=15 sessionid=11466583 srcip=….. dstip=10.1.0.207 srcport=7854 dstport=3389 duration=13850 proto=6 sentbyte=1112395 rcvdbyte=6568260 logid=0005000024 service="RDP" app="RDP" appcat="unscanned" fctuid="6C40ACFAC7B043A4851701EB5FDD3B3D" srcintfrole="wan" dstintfrole="lan" policytype

I'm testing FGSP and VRRP using foritgate VMs.  The topology is as follows:  FirewallA (VRRP Master)--------L2VPN--------FirewallB (VRRP Backup) There are 3 servers:Server A connects to Firewall AServer B connects to Firewal BServer C is in the VRRP domain and will reside in either Firewall The issue I've observed is When Server C tries to connect to Server B, it fails and the debug flow shows a reverse check failure.  I am not sure why this is happening with FGSP enabled, as all other traffic syncs across fine.  However, Server B is able to connect to Server C. When I make Firewall B the VRRP master server C can connect to Server B, but then loses access to Server A.  It seems like FGSP isn't synic traffic that's directly conncted to the Fortigates that is acting as VRRP backup.  All other transit traffic thats asymmetric FGSP handles it fine. 

Hi All, I need to configure my firewall to identify users using Kerberos for single sign on without an use of an explicit proxy. I was only able to find articles with Kerberos authentication with explicit proxy. My Device : FG-401FOS Version : 7.0.15 Thank you !... 

Hello, I would like to take port01 to configure my DHCP, but when I take it off Vlan Switch I can no longer access the fortigate, how do I do it?    

Hello Experts,in Cisco SD-WAN we have components (vBond, vManage, vSmart, vEdge) what are the device's names do the same rules in Cisco SD-WAN?in Cisco:vBond: OrchasrtaionvManage: ManagingvSmart: Control PlanvEdge: the edge router Thanks

Hello everybody, ZTNA is not clear at all for me.I'm working from remote and in my Forticlient I've been assigned a tag: ZTNA_DEVI'm not connected to any VPN.On fortigate, there is a ZTNA Rule:  192.168.1.4 is a ZTNA server that manages a Virtual Machine.I've also a Firewall policy:This policy says that all users that whose destination is ZTNA_DEV (192.168.1.4) and have the tags ZTNA_DEV are allowed.But there is one thing I don't understand. I'm working from remote, so I'm not in the enterprise network. How can reach that server?The firewall policy is saying that the incoming interface is wan1, but how can I reach it?I know I have the tags, but how is possible that with these tags I should reach the internal network?Where am I wrong?Thank you so much! 

Hi everybody.I have the problem of receiving a privacy error when trying to access the 60F (firmware 7.6.0)  from lan.The real problem is that blocked pages don't display the Fortigate correct blocking page.I have done the Let's Encrypt ACME certificate and it works for connections out the lan. The privacy error is given because I use https://192.168.1.1 and the expected certificate is for xxxx.fortiddns.com (used for let's encrypt).I have, clearly, imported Fortinet_CA_SSL certificate in user's endpoint.I also tried to regenerate certificate and re-import it, without any change.I have an identical device working on another site, with exactly same configuration that doesn't have this issue, I really can't undersand the reason and how solve it.Thanks for helping.  

Hello,We have an FAZ Hyper-V VM running the latest 7.4.3 code. I can ping it and I can SSH into the FAZ but I cannot access it via the web GUI.  Edge returns ERR_CONNECTION_REFUSED.  Firefox just says Unable to connect.  Interface has  "set allowaccess ping https ssh snmp" Platform Type : FAZVM64-HVPlatform Full Name : FortiAnalyzer-VM64-HVVersion : v7.4.3-build2487 240514 (GA)

Hi There,I tried to create a aggregate VPN between two fortigate node. FOS 7.0.14.https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/779544/ipsec-aggregate-for-redundancy-and-traffic-load-balancingthere are two VPN tunnel established already. and I added one tunnel to the aggregate vpn successfully. But I cannot add another member into the group.according to the guidance, I have to set aggregate-member enable. But I cannot do it, check the error message below. # nextPlease enable phase2 auto-negotiate if ipsec-aggregate uses redundant algorithm.This interface is currently in use.object set operator error, -23, roll back the settingCommand fail. Return code 1I tried to enable the phase 2 autonegotiation and delete the vpn tunnel and create a new one. the result is same.I tried to disable the virtual interface but the result is same. Since there is traffic on the physical interface already. I cannot disable it. I don't want to break the service.Appreciate your advice on ho

I am trying to use two IPoE lines in one fortigate. The configuration is as follows.IPoE①: for InternetIPoE②: for maintenance such as Windows UpdateHow should we configure it?I know how to set up only one line.Should I use VDOM?It is version 7.4.3. Thank you for any answerBest regards