Solved

Hello, IPsec aggregation I/F is not seen when I try to input it as SDWAN member.Here is my environment.       (wan1) --- NAT router1 --- (wan2)FG1                                                     FG2       (wan2) --- NAT router2 --- (wan2) At FG1, as VPN tunnel, vpn1_1 and vpn1_2 are createdAnd AGGnat I/F is created as aggregation of the both.At FG2, the situation is similar.In VPN tunnel, AGGnat I/F is up. However, this I/F is not seen as SDWAN member. How can I solve? Any comments are appreciated.  

Hello! I have several WLANs in Tunnel traffic mode (FortiAPs) with their own DHCP configuration, using external DNS.Additionally, I have VLANs that use our internal domain DNS/DHCP. The issue is that devices on these WLANs are attempting to communicate with devices on the VLANs (and vice versa).For example, logs related to Windows Delivery Optimization (TCP/7680) show this activity. Since there are no policies allowing communication between these networks, my logs are getting filled with 'implicit deny' entries:Same thing here: I could be mistaken, but since the tunnel is sending WLAN traffic directly to my Fortigate, and the only policy in place is for outbound to the WAN, devices on different networks shouldn't be able to see each other, correct?Where might the misconfig be? Thanks in advance.

I am going to be installing a Fortigate in a small secondary school. Can you guys give me a rundown of tips and best practices for content filtering in this environment? I would love to get a list of recommended config options along with instructions on how to set it up. Setting up filtering for a school seems like a bigger challenge as opposed to setting them up for a business which is where most of my experience with Fortigate is. Thanks!

Hello Experts, In site-to-site VXLAN under SDWAN IPsec over NAT,does Fortigate at NAT outside need to specify WAN IP address of the other Fortigate?Here is my network environment.    Inside    Outside  |---| -- NAT1 -- |--------| --- |---||FG1|            |Internet|     |FG2||---| -- NAT2 -- |--------| --- |---|   Inside    Outside   Both network I/F of FG2 are configured as "Dialup User".FG2 does not know WAN IP address of FG1 before FG1 connects to FG2.In order to establish VXLAN between FG1 and FG2, after getting FG1 network I/F IP addresses I needed to specify static route to the IP addresses at FG1. Are there any other solutions? Any comments are appreciated.

When I add FGT v7.2.8 build1639 (Mature) in FGTM v7.2.6-build1632 240809 (GA) a Detect Failed message appears. Can anyone help me? Fortimanager does not ping Fortigate. Fortimanager does not ping Fortigate. They are on the same network. I configured allowed ping. 

Hello Team,                 I am paloalto more guy and I used to utilize Paloalto's EDLs, so I wanted to ask about any Dynamic group that contains Malicious IP addresses, URLs, or domain lists that are included in the FortiOS and I can use them in my policies.If not, what are recommeded other sources "feeds" to add as External groups as feed that I can use for more protection in my policies?or also any  Malware Hash feeds that are valuable.TIA                  

Hello.I upgraded my gate firewall to 7.2.9->7.4.3->7.4.4 and the SSL VPN menu is gone.I can't find it when I look for it in Feature Visibility.Does anyone know?I've done 7 of them, and this is an issue with 2 devices that don't use a VPN.I also found that it is enabled in the preferences below. ----config vpn ssl settingssetstatus enable------ Does anyone know anything about this? Oh , For gate is 101F.

Hi Fortinet Community,I have a FortiGate 60F with a 7.4.4 with a Trusted Hosts configured for admins.But in Log & Report>System Events I see Alerts every 3 mins:Administrator remote2 login failed from https(188.124.36.193) because of invalid user name.How can I block this specific IP from login attempts?GUI tutorials are from couple of years old.Maybe someone can make CLI tutorial?Thanks in advance.

Hello, We have a production FortiGate with multiple vdom configured. And we would like to use the Security Fabric Automation feature. However, its only visible under the global vdom and not in any other vdoms like root and custom vdoms that were configured. Is there a way this automation can be turned for specific vdom? Thanks,

Dear Team, We have upgraded FAZ from v7.0.12 to v7.2.7 and post that getting error message "Please register this device" while trying to login to the FAZ gui.Please find attached snap and guide. Regards,Ganesh 

Kinldy let us know when the updated FortiOS 7.4.5 is getting relased. On 7.4.4 there is a known bug for SDWAN SLA performnace issue without any packet loss. The same seems solved on 7.4.5. 

How do we prevent a scenario when the first email is sent to a particular recipient within the IBE system, being intercepted by a hacker? After this hackers can create accounts in IBE and read emails. 

HiSo we are testing deep SSL inspection and have a policy setup with our own cert (tried it with default as well).If I go to a site that is outside of the allowed categories on the web filter I get the usual FortiGuard Intrusion prevention blocked, have the page re-evaluated or override.The page shows it's connected by HTTPS and has a valid certificate.If i click on override I'm taking to the same URL but on port 8015,eg : https www.cdn-national-lottery.co.uk:8015/ovrd?fblob=UE-1  but this site returns a "This site can't provide a secure connectoin" and ERR_SSL_PROTOCOL_ERROR, on closer "inspection" (cough) it doesnt seem to have a certificate against the site.   I can't see how the initial page has a valid Certificate but the 8015 port override page doesn't have a cert, any ideas?  If I change the 8015 URL to HTTP it then loads the page,  Login to override gets to to http on port 8015 with ERR_EMPTY_RESPONSE and "This page isnt working

I just download a VM machine of Fortigate 7.0.2 (I tried with 7.0.1 also) and i cant access with https to the forti GUI. I checked the interface and is perfectly configured: with "allowaccess ping https ssh fgfm"I also tried to to access with ssh and works perfectly fine.Even i tried to configure the interface and add "http" and worked too!(but i want https not http) The Chrome error that appears to me is the typical: [ This site cant be reached ---- "ERR_CONNECTION_REFUSED" ] (i also tried to disable the windows firewall, but nothing works) Its a new and default Fortigate VM System, so i dont know why doesn't work.Anyone knows what is happening? Thanks!

Hello, we are facing a number of issues using Forticlient version 7.2.4 , i undersand they may be fixed in future versions. Is there a plan and date to release a version 7.2.5 of Forticlient anytime soon? Thank you Martin

Hi everybody, we have a FortiGate acting as a VPN gateway for a client VPN for home office users. Authentication is done using Azure AD with SAML and the FortiClients are managed by an EMS though we only use the remote access profile. Whenever I try to connect to the VPN, FortiClient asks for the Azure credentials and then fails with error "FortiClient VPN unable to establish VPN connection. The VPN server may be unreachable(-6005)". Connecting through web mode however, works, so the problem's not with the VPN or SAML config. I created a custom VPN connection using the exact same settings that are configured by the EMS profile. Yields the exact same result. If I disconnect the FortiClient from the EMS however, the connection established without any issues. The problem is independent from FortiClient version (tested with 7.2.3, 7.2.4 and 7.4.0), so my guess is that some setting on the EMS is interfering with the VPN but I haven't managed to find a solution yet.Thanks in advanc

hi,i have an upcoming change window and just would like to confirm the 'revision' function in FG.1) if i click on configuration > revisions > save, this will create a backup config that is local in the device?2) i use VDOMs, so does the config include the all VDOM? i.e. 'global', 'root' and others?3) how can i view the full content on the revision config? is there a CLI command I could use?4) if i need to revert the config using the CLI, the 'latest' config would be the most bottom revision id? would this be revision 27? (global) # exec revision list configLast Firmware Version: V0.0.0-build000-REL0 ID  TIME                   ADMIN             FIRMWARE VERSION           COMMENT<SNIP>26 2024-02-19 21:54:37 Admin-Full V7.2.x-build1xx-REL0 Automatic backup (session

Hi all, we have recently update FGT to FortiOS 7.2.8.We found out a problem during the Re-Install policy.The process returns an error and we must "Retrieve" the configuration to complete the install. We use FortiManager 7.2.5.Can you help us?Regards.

Hi, Laptop using Forticlient 7.x VPN on Windows 11Home for a year, so far is OK, recently, I have been unable to access the IPSec VPN from my laptop. Each time I attempt to log in, FortiClient displays the error message 'IPsec VPN connection is down.' When I check the FortiClient log, the last entry reads 'Phase1 retransmit reaches maximum count.'I also tried accessing the IPSec VPN on other branch office FortiGate firewall (model 61F) using FortiClient, but the same error message appeared. LaptopWin11Home, Forticlient 7.x FirewallFortiGate 30E, firmware v5.4xFortiGate 61F, firmware v7.2x Can someone help? Thanks in advance.  Clement  

We recently upgraded from a standalone FortiGate 1500D running FortiOS 7.2.8 to a pair of Fortigate 601Fs running the save version of FortiOS as an Active-Passive HA pair. Our deployment consists of 10 total VDOMs and 8 10G physical interfaces. There are also 2 copper HA links and 1 copper management link per FortiGate. For this deployment's configuration, we pulled a config from the current FortiGate 1500D, passed it through FortiConverter, and loaded the resulting configuration onto the new FortiGate 601F's without issue. All references and settings were identical to the previous FortiGate. Each physical interface contains either the inside, dmz, or public vlans for multiple clients that we service. The physical interfaces themselves have no IP assigned to them. Rather, each physical interface holds multiple disjoint subnets corresponding to a client's network.  Although the physical interfaces are grouped by inside, dmz, public, the VDOMs are grouped according to

Hi Fortinet Community v6.4.9 -  #fortigatev6.4.8 -  FortiManager  We have had a FortiClient set up in the past which we have lost the PSK to as it appears to have been manually changed and not recorded. We have a backup conf of the VPN to re-apply so it can still be used (1 connection), but this does not work for clients with multiple VPN connections. Is there a way to recover this key or will we need to resort to resetting it? Thanks #forticlient     

Hi everyone,I am relatively new to Forti and networking in generaly and I have one problem i can`t wrap my head around.On Fortigate 100F I have two WAN interfaces enabled with diferent public subnets.WAN1 is my primar interface with default route for my internal users to go to internet.WAN2 is interface i inted to use for publishing web services.I creaed virtual server with WAF for that purpose and pointed it to WAN2.When i tray to access web servise from outside my local network ti works like a charm, but users in internal network can`t access those web services.Domain on which this web service is published is public and DNS records are held by 3rd party registrar.I don`t have split DNS in local network to be able to sent internal trafic directly to local IP of my web server.So far I tryed to add second default route for WAN2 with higher administrative distance and I tryed to configre PBR but with no luck (maybe i`m not doing it right)Is the PBR solution at all for my problem?BR 

Hi.I created web filter and application filter and blocked social media and **bleep**ography catagories.later created the policy and assigned this security fiters to this policy .Problem is that,after assign this security profiles ,i cannot use anydesk app.i d'not any block to remote access catagories.how can i solve this problem? please help me

Hello everyone! I am looking into a FortiNAC implementation and the following question came around. Tried to check documentation but there are some differences on it so would appreciate a third opinion to make sure the right setup is being followed. When deploying multiple isolation networks on FortiNAC (Registration, Authentication and Remediation for example) all of them have different IPs on config wizard, yet all belonging to the same interface port2. On a L3 setup, which IP should be indicated as DHCP relay (helper) on each interface? The main IP for port2 or the equivalent to the VLAN that is being configured? Found this and other examples saying the first is correct:https://docs.fortinet.com/document/fortinac-f/7.2.0/high-availability-fortinacos/377092/layer-3 In the image is possible to see that all helpers, no matter the VLAN, point to 10.10.100.2 and 10.50.100.2 which are the registration port2 IPs for each FortiNAC server.It also says the following:&

Hello, I'm a beginner and I'm doing a lab I need to update a fortigate to version 7.2.7The adom on the fortimanager is version 7.0 1)Should I first update the adom and then the fortigate, or vice versa? 2)If I don't update the adom and leave it at 7.0, will that cause any problems?3) The fortimanager is in version 7.2.1, do I need to update it too?If so, what order should I follow?Update Adom then fortigate then fortimanager? Thank you very much.   Translated with DeepL.com (free version)