Solved

HelloI see in admin guide that ZTNA tags can be with with SSL VPN to filter the traffic based on tags, but I don't find the same with dialup IPsec VPN.Is it officially supported?

Hello community. We are implementing fortigate in the OCI cloud. We have seen several tutorials that indicate that for each network I want traffic to be sent over the fortigate I need a VCN.My question is, can I create 1 single VCN Spoke and there have all the subnets I need making the traffic go through the FW. I have tested with the above configuration and sending traffic between subnets in the same spoke VCN but the FW does not do policy validation, it sends the traffic directly.

Hello all,Our Fortigate 101E is running FortiOS 6.4.15. I understand that 6.4 is end-of-support soon, if not now. I'm wondering which version of 7.x to go with. Any recommendations? Which one is the most stable? Thanks for any input. Rod

How to access Gui Fortigate using FMG IP, just change the port on URL according to FortiManager IP

to IT gurus.   What must be done on the Aruba switch port in order for Fortiswitch to initiate?As of right now, the Aruba switch serves as our lone connection to FortiGate while we work to manage a new Fortiswitch. See the following quick topology. Fortigate connected to Aruba ( Trunk port  Native Vlan1 ,)Aruba  ( Trunk port  Native Vlan1 ,) connected to Fortiswitch (Port 49 trunk, Native vlan1)Fortigate sees the Fortiswitch and Athorises it however its status : "offline",  "port disconnected" Logs from Fortigate:  Switch-Controller authorizedCAPUTP session status notificationSwitch-Controller Tunnel UpSwitch-Controller Switch Sync Error    - Message global-lldp-settings failed:-13Switch-Controller Switch Sync Error - Message global-lldp-profile failed:1Switch-Controller Switch Sync Error -Message qos.dscp-map failed:-7621NAC MAC cache sync - NAC MAC cache cleared on switch S14xxxxxxxxx port (null

What's up all. Novice at networking here, bear with me. Trying to dump my cheap home firewalls and go with the real thing. Looking to purchase a Fortigate Firewall and Catalyst 1200 Series Switch. Pretty basic setup. I need to:Create VLANS and have them access the internetCompletely isolate the VLANS at Layer 3I have been looking at a few different ways to do this but need help. I can figure out most of the config but could use assistance with the design / have a few config questions. Would you:Go layer 2 VLANS at the switch and then tag them up to the firewall and create firewall policies to separate the VLANS? Would I even need to tag them on the firewall?Would inter-vlans need to be created on the firewall to deny all traffic or could I just create firewall polices for each lan and have the switch handle the tagging?orGo Inter-vlan on the switch and create ACLS on the switch as opposed to having the firewall do the work. It seems strange to me to have a firewall perform switchi

Hello team!!! We have 2 FGT100F in HA and configured interfaces called "mgmt" as "in band"Now we need to access from a computer in any other interface and get:150.0.0.4 is the IP of Fortigate HA in a specific VLAN and 150.0.0.3 is another device in the same VLAN.I know this is a public IP, but this is complicated to change the IP in all the devices in this VLAN.From 150.0.0.3 I can ping 150.0.0.4, but not the HA IP on mgmt interfaceFrom another device in mgmt interface, I can ping the HA IP on mgmt interface, and each Fortigate as wellPreviously, we had disabled src-check in mgmt interfaceI tried to add a local-in policy to allow this (config firewall local-in-policy), but still the same behaviorWe need to access to Fortigate from any VLAN, using the IP on the mgmt interface.  Is this possible? Thanks in advance.Regards,Damián

Hello, Does the FG-901G AC version(NOT DC) have a location for a 2-hole grounding lug on chassis? The quickstart guide shows that the DC version ships with grounding lugs. We have an AC version coming and not sure if we can use a 2-hole 6AWG grounding lug on it.. Thankyou.. full P/N  FG-901G-TAA-FGDUS

Hello everybody,I've a problem in my network with my FortiGate.I've a simple SSL-VPN (web mode is disabled) whose access is restricted to italian and albanian addresses:The problem is that there are many connection attempts, and each of these attempts has a different IP address: date=2024-09-27 time=12:27:33 id=7419267613974331394 itime="2024-09-27 12:27:34" euid=5123 epid=3 dsteuid=3 dstepid=3 logver=702101706 logid=0101039426 type="event" subtype="vpn" level="alert" action="ssl-login-fail" msg="SSL user failed to logged in" logdesc="SSL VPN login fail" user="abl0000" remip=87.4.68.245 group="N/A" tunnelid=0 tunneltype="ssl-web" dst_host="N/A" reason="sslvpn_login_unknown_user" eventtime=1727432853997409279 tz="+0200" devid="FGT60FTK23099PH2" vd="root" dtime="2024-09-27 12:27:33" itime_t=1727432854 devname="ntd-fg"date=2024-09-27 time=12:16:21 id=7419264723461341184 itime="2024-09-27 12:16:21" euid=4699 epid=3 dsteuid=3 dstepid=3 logver=702101706 logid=0101039426 type="event" sub

Hello folks,in my deployment i'm using a fortigate 200F with Sso (Azure) and everything was working correctly before  upgrading from 7.0.12M to 7.2.7.After the upgrade i'm facing that authd process is constantly consuming 97% of cpu resources and Sso is not working anymore.Thought it was a bug so decided to upgrade newly from 7.2.7 to 7.4.3 but i still have the issue.Tried to reboot the firewall (a HA pair) and until there are no authentication requests from clients, the cpu is ok (authd process is not present in the process list or is at 2%), as soon as there's an authetication request the authd process goes to 97% and so the cpu.In this condition the Sso is not working, i check the configuration and nothing changed, took a debug and sniffer packet from client and all the routing is ok, checked fsso configuration both on firewall and Azure and it's ok.Did you face something similar? Do you have any advise? The upgrade triggered something but i can't understand what is the ro

I am currently experiencing issues while attempting to upgrade the Fortigate firmware to version 7.2.4. The upgrade is failing both through the GUI and TFTP methods. The original firmware version is 7.0.10. However, when attempting to upgrade to random version 7.2.6 or downgrade to version 6.4.14, I can successfully perform the upgrade or downgrade using TFTP. If anyone has encountered the same issue and has found a solution, please let me know. The model of the Fortigate is 80F. I wanted to upgrade to 7.2.4Booting OS... No default firmware. Error: Default firmware boot failed!!! Switch to BACKUP after 31 seconds. Press any key to stop. FOS boot failed. You may try backup. Please power cycle. System halted. System will auto-reboot after 59 seconds ('CTRL+D' to reboot immediately). resetting ... FortiGate-80F (05:42-06.01.2023) Ver:05000100 Serial number: FGT80FTK23045999 CPU: 1200MHz Total RAM: 4 GB Initializing boot device... Initializing MAC... NP6XLITE#0 Please wait for OS

Hello, we have a FG80 we are using for testing and it has no valid licence. This FG always had 2FA with FortiToken. Now I wanted to change the Token but it will not be sent. I tried with my mail and also with Gmail account and via SMS and I dont get anything. Is this something they removed because of no valid licence? Thanks 

Hi everyone, We just configured our SSL VPN with SSO/SAML and are facing issues. Some users get stuck at 40% after logging in with their Entra account and going through the MFA process while others are able to connect without any problem. When it gets stuck at 40%, we don't see any logs on the Fortigate, but we can see that it went through the Entra App successfully. We are using a custom port, Let's Encrypt Cert and we disabled the web mode for the split-tunnel.The users with issues are in the same group as the one that works successfully. FortiClient is V7.4.0.1658. Fortigate 101F is v7.2.9.  Thanks

Current fortinet 61F firmeware version 7.0.11 for wireless using FAP U323EV to 7.0.132 version, I have configured 2x ssid guest for tunnel and another one for brdige mode most of them works during the night time and next day morning it stopped broadcast the SSID.also found out some forward traffic logs where it showing FORTI-AP interface is not able to talk to DNS whil

Hello everyone, I’m trying to set up VLAN over IPSEC using VXLAN on my FortiGate, but I’m facing issues where the tunnel doesn’t seem to work as expected. The tunnel comes up, but traffic from the VLAN doesn’t seem to pass through. I’ve tried troubleshooting using various methods, but I haven’t been able to resolve the issue.  Here’s the configuration I’m using for VXLAN 506: On site A :config system interface edit "IPSEC_VXLAN" set vdom "VDOM1" set ip 10.5.5.1 255.255.255.255 set allowaccess ping set type tunnel set remote-ip 10.5.5.2 255.255.255.252 set snmp-index 42 set interface "vlnk_HYP0" next end config system interface edit "VLAN_506" set vdom "VDOM1" set role lan set snmp-index 506 set interface "port1" set vlanid 506 next end config system vxlan edit "VXLAN_506" set interface "IPSEC_VXLAN" set vni 506 set remote-i

Hello everyone, I'm currently using FortiManager 7.4 with two connected FortiGate devices. I had two separate firewall policies for each device, and I am trying to merge them into a single policy package. My goal is to push this policy package to both FortiGates, ensuring that only the necessary rules are applied to each device. However, during the policy installation process, I encounter the following error message: "The following ADOM interfaces have no mapping. All ADOM interfaces should be mapped before continuing with installation." In each block I have framed, the interfaces do not exist locally, but they are present in the remote device. What is wrong? Any ideas? Thanks for your help!

Hello Everyone,I have some questions about a playbook I developed, but I'm having trouble uploading the playbook JSON file to the FortiSOAR community post. If anyone knows how to upload a playbook JSON file on FortiSOAR, please let me know.Thank you!

Hello Community. I have been using FortiClient since MacOS Catalina, until then everything was perfect, then from BigSur, everything was wrong. It does not work or simply the solutions that exist in the forums do not work or are incomplete.. I am currently running MacOS Monterey 12.4 and FortiClient 7.0.5.0166. I have this error when establishing the remote connection via VPN "Login failed. Insufficient credential(s). Please check the password, client certificate, etc."  Searching in Internet and this forum itself there are "solutions" of this type: Manually add a number of services from the FortiClient package with full disk access. This is an official note from the provider's documentation. URL:https://docs.fortinet.com/document/forticlient/7.0.5/macos-release-notes/223986/special-noticesApply the accesses from the previous point, uninstall FortiClient and reinstall FortiClient.I have applied both and it doesn't work. The strangest thing about this behav

Hello.I have a question about Ha being out of sync.Added user objects and groups to the portgate.Immediately after that, it was not synchronized.I deleted the object I created after HA was out of sync and it was resynchronized normally.As before, when you create a user object on the master equipment and then use the Run ha Sync Start command to add/delete the user object, the synchronization was not broken.Does anyone know why HA doesn't sync when creating objects?If anyone knows about this issue, I would appreciate it if you could let me know the cause and how to respond.

Hi all, I'm fairly new to the Fortinet suit of security devices. I have set up a scheduled SFTP backup on the FortiAnalyzer and FortiManager which was very simply to do. Locally, the SFTP password is hashed in the config, lovely. However, Fortigate appears to be a different story. To achieve a “Fortinet native” solution of a scheduled/automated backup. I looked at automation stitches, unfortunately the "cli script” option requires the SFTP password to be stored in clear text.  Does anyone know of any other “Fortinet native” solution to schedule automated backups to SFTP servers on Fortigates without having to store the SFTP password in clear text? Just not acceptable to store passwords in clear text in my opinion and against policy in general. My next stop is to move the automated backup process out of the Fortigate environment and move it to a netmiko/paramiko python solution. I would prefer an “in product” solution. Currently using v7.0.7. Thanks,&n

hello guys i have this challenge on BGP neighbor for sdwan 

Are there any specific commands that I can run on a FortiGate to check the following parameters of the FortiAPs associated with the FG:Number of APs associatedNumber of SSIDsNumber of Users/devices connected per SSIDTotal Number of Clients

Hi community, I hope someone in the community might have a suggestion for the issue I'm facing - I have set up a WEF from two different windows machines into a Windows Server configured as the WEC. All event logs from the two WEF machines are received at the WEC and are fully visible in the EVENT Viewer under "Forwarded Events". I have installed a FortiSiem agent on the WEC and configured to pull ALL events. for some reason I still can't see any indications of logs from the two WEF machines and can see only logs from the WEC.  I have followed all installation and configuration i could find on the matter but still can't identify the required logs. are there any special configurations i should set in the FortiSiem or any other machine which will make the Forwarded events from the two WEF be digested into the fortisiem ? any help will be appreciated. 

Dear community, I am trying to set a picklist value based on condition. The playbook execution log showed that the condition was evaluated and resolved to the appropriate picklist. Still, the severity picklist wasn't updated in the Alert module pane, as seen in the image below. INPUT Argseverity: {%if vars.input.records[0].fileHash==\"839765b93416bb945be4f4ef2804158f\"%} {{(\"Severity\" | picklist(\"Critical\"))}} {% else %} {{(\"Severity\" | picklist(\"Medium\"))}} {% endif %}EVALUATED Argseverity: {'@id': '/api/3/picklists/7efa2220-39bb-44e4-961f-ac368776e3b0', '@type': 'Picklist', 'itemValue': 'Critical', 'orderIndex': 4, 'color': '#e31b1d', 'icon': None, 'listName': '/api/3/picklist_names/4e80cba3-032f-48b4-ac03-17e3ec247aac', 'uuid': '7efa2220-39bb-44e4-961f-ac368776e3b0', 'id': 372, 'importedBy': []} Can anyone advise on what could be the issue here?Thanks. 

I have a core switch that acts as gateway for all the users.  10.10.10.254 Gateway (coreswtich) 1. I am seeing traffic from User IP but with core switch MACaddress.2.I am seeing DNS queries from host with core switch MACaddress to DNS Address that is not configured on the host. 3.I am seeing wrong IP address associated with this MAC (screen shot)4.I cannot delete it in devices (delete option is dimmed)how can i resolve this issue?