Solved

Hello,I use fortigate and fortiauthenticator and my configurations are correct,but some users can establish a connection after a few tries while vpn,When I look at the fortiauthenticator logs, it says that the user was previously authorized and remains in the cache, remove itlogs as below how can I solve this problem ) facauth: Sending email token code (timeout 180) to firat.gazel@cnbce.com 2024-06-13T13:56:29.921757+03:00 FortiAuthenticator radiusd[24056]: (34) facauth: Updated auth log 'firat.gazel' for attempt from 10.100.100.1~176.236.73.154: Remote LDAP user authentication partially done, expecting email token 2024-06-13T13:59:18.771835+03:00 FortiAuthenticator radiusd[24056]: (35) User-Name = "firat.gazel"2024-06-13T13:59:18.772239+03:00 FortiAuthenticator radiusd[24056]: User-Name = "firat.gazel" 2024-06-13T13:59:18.772331+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: ===>Username:firat.gazel 2024-06-13T13:59:18.773880+03:00 FortiAuthenticator radiusd[24056]: (3

Hello everybody, i would highly need your assistance in preparing for FCP Network Security Exam, i can see that there's a core exam which is NSE4 and one elective exam my question is how to prepare to the exam ?there're alot of topics in FCP network security, may i know which topics is mandatory for the exam and what should i start to study as i must take the exam in a month from now ??where the NSE-4 topics?! how can i get it ?please assist!    

Long time lurker, first time poster. Hi everyone.We’re upgrading some FortiAP 221C access points with FortiAP 223E access points. Straight swap I thought and plugged the 223E into the same PoE injector which was powering the 221C, a Ubiquiti branded PoE-AF injector - UniFi PoE Adapter (15W) - Tech Specs (ui.com). The document that came with the 223E AP says to use a PoE AF injector.This worked fine on my test bench. The 223E powered up and I was able to add it to the controller, then took it to its permanent location where is failed to power up at all. Now it won’t power up on my test bench either.I contacted my reseller who said I needed to use the GPI-130 PoE injector which is a PoE AT specification? I purchased one which has worked with a second 223E on the same cable that the first one failed on using the AF injector but I can’t understand why?

We are in the process of doing a basic Forticlient EMS setup. I've been going through all documentation and searching for answers to the last part of the puzzle.  Our setup: Forticlient EMS on Windows ServerFabric is configured on FortiGate and syncing tags correctly (although not currently used)We have setup a VIP to permit the telemetry port 8013 through to the EMS server. We have configured one ZTNA connection for an RDP server. We are currently using default 443 for the ZTNA connection to the inside device on port 3389 just for testing. The client device is connecting to the EMS server and is receiving the ZTNA destination correctly.  We have configured a ZTNA Server to allow the TCP traffic from external ip on port 443 to the internal ip on port 3389.  We have also created a Firewall Policy for ZTNA to allow the traffic to the ZTNA Server. But at this point when we try to connect to the RDP server on our test machine, we never see

Hi. I registered FortiSwitch to my previous account, and now i would like to move registration to desidered company  account. Is it possible? For FortiGate it's quit easy. I cant find any info in documentation and in GUI/CLI. Thanks for any tip.  FSW 124F - 7.2.4. Managed by FortiGate. b/rwkasprz 

Hi,I have a brain-damaging situation ;) and maybe someone out there has a good idea.We have a Master/Slave Fortigate setup. On each Fortigate, we have 2 uplinks, which may contain the uplink because of redundant BGP setup behind.I now have the problem:- Do I assign Port 1 for the first BGP uplink to the SSL gateway, it would not work, if Port 1 is down and Port 2 is up- Same here, assigned Port 2, is the same, as with Port 1- I would need to assign an ip-address on both ports. So I could enable both ports for the SSL VPN gateway. VRRP would not work, because both are active and up because the routers behind are, tooWe need it, that are staff can login to the VPN, not using different hosts / IPplease, no DNS Stuff with refresh/TTL, this is not the kind we use to fix the problem ;)Any help would be niceThanksRonny 

Hello everyone, I have two Fortigate 201F firewalls in HA (active-active mode), both firewall are connected to the same Switch core (two stacked switches) which are connected by an aggregate port (two sfp for device). The problem is when I try to disconnect the two sfps from one forti to view if the traffic continues to the other firewall, this results in that traffic won't reach. It is as if the second firewall does not receive any traffic, but on the first firewall if I only disconnect a single SFP the traffic continues to arrive.Why the traffic wont arrive from the second firewall?

Let me submit one issue ...In my network, I have two FortiGate 201E firewalls (both are same model but different serial numbers) ...one is use for production (it is with licensed) and another FortiGate 201E is no use (just for backup purposed and licensed expired). I have taken configuration from production one and try to put in my backup firewall (backup config is put to backup firewall).  After config received and rebooted the backup firewall, it can't access with web access (normally we have access with https://(firewall iP:44443)) but I can access with SSH. I can see https, ping, ssh, are allowed access from backup firewall's management interface.  So, is there any issue? It is related to licensed expired on backup firewall.  If anyone got same issue..., could you please suggest to me for how to. Thank you.

Hi community, Under interface there's 2 setting where we could set the estimated bandwidth, however I am not sure sure to understand the difference and/or how they relate to each other or rest of config.  config system interfaceedit "my-inet-iface"set inbandwidth <some_value_in_kbps>set estimated-downstream-bandwidth <some_value_in_kbps>set outbandwidth <some_value_in_kbps>set estimated-upstream-bandwidth <some_value_in_kbps>nextend I do understand the need of those values, but I find them redundant and/or not sure how they relate to other config (QOS/SD-WAN) 

It Posible to manual Block Type FileHash-SHA256?  example  

 Is it possible to RSPAN vlans from managed FortiSwitches...  All the articles I have been able to find are for standalone switches and only talk about mirroring a port not a vlan.  With the Cisco equipment it was possible. See below: 

Hello, I've built a Hub-and-Spoke lab as I need to deploy SD-WAN, which is my ultimate goal here. The configuration went smooth with no issues I can remember. However, after the configuration is complete, and BGP is up, the spokes are not able to reach each other. I tried troubleshooting, and found that the Hub is not passing the traffic. Below is my topology on EVE/PNet  I'm not sure where the issue is. But the firewalls doesn't pass the traffic through the tunnels! I need to get SD-WAN fully running here. All 3 firewalls are running the same version: FortiOS-VM64-KVM v7.2.4,build1396,23013 (GA.F). For the IPSec Tunnels, I created the tunnels using the wizard using the Hub-and-Spoke Template I'm really not sure what is missing here.

Hi, everyone. I'm curious about the same content as the title, so I post it on the forum.  FortiAP is currently using FP221E and FP231F FortiSwitch is using 124E and 424D I'm trying to patch both AP and Switch FP231F is patched to v7.2.5 and I'm trying to patch FP221E with the same version, but I don't see the latest Firmware Image of FP221E The current operating system version of FP221E is FP221E-v7.2-build0280. I also tried to patch FortiSwitch 124E to v7.4.2 and patch 424D to the same version, but I don't see the latest Firmware Image as above. The current OS version of 424D is S424DN-v6.2.4-build213,200501 GA.https://www.fortiguard.com/psirt/FG-IR-22-038 In particular, fortiswitch is trying to patch it to solve the vulnerability, and if you know the answer to my question, please reply. Thank you.  

Hi All,If we configuration User SSL-VPN, Can we configuration One ID per One user concurrent access? Example:I just only can login my SSL-VPN with my laptop only.  If i have TAB/IPAD, I can't login with TAB/IPAD.**The configuration without enable MFA. Fortigate Version 7.2.7

Hello.I want to increase fortigate disk capacity. (/data)The disk is full as shown in the picture below.(The equipment is Fortigate 40F, and the version is v7.0.9_build0444.)  How can I do this?Please help me, Thank you.

I'm new to Fortinet certification (completed FCA -NSE3) program and now looking into FCP (Network Security).The page states that one has to Take 1 Core and any one Elective within 2 years. Does one have to take Core exam before Elective? or... it could be in any order but both must be completed within 2 years? Thanks...

Im currently on FortiOS 7.2.8. Traffics are being dropped by FortiGate when asic-offload is enabled. To work this out, we are currently set the asic-offload to disable but this is not a long term solution. Is this a bug on 7.2.8? https://docs.fortinet.com/document/fortigate/7.2.8/fortios-release-notes/236526/known-issues Does this issue will be resolved in what FortiOS? 7.4.x or 7.2.x ? Appreciate your feedback. TIA :) 

Hello FortiClient admins I have two Ubuntu clients with FortiClient 7.4.0 installed.Both are registered.The first hosts can access apps through ZTNA destination, while the second shows the following error: "No ZTNA client certificate was provided" Following a quick search I found that the first node has a client certificate "/opt/forticlient/ems_cert.crt", while the second doesn't. "Probably" the certificate was removed due to a previous uninstall with purge.Tried to unregister the endpoint an re-register it again but didn't help.Any idea on how I can reinstall the client certificate on the host?

Dear all, i want to set up dhcp server on dedicated vlan for my clients on fortigate.Basically, i want to import list of mac address which will receive an ip from dhcp range (not reserved). On web UI, i did not see any menu which allows me to do that. How can i achieve it ? Best regards.

 Hi Fortinet Community, I would like to explain our scenario and seek your advice on an issue we're encountering.In our environment, we have configured two Domain Controllers (DCs). Each DC has a separate FSSO-DC Agent and a separate FSSO-Collector Agent. In total, we have two collector agents and two DC-agents across our two DCs. We are using the DC Agent Mode, where the DC agent sends logon information (Windows security logon events) to the collector agents. The issue we're facing occurs when a user (e.g., 'abdul.rehman@example.com') logs into a Windows machine. The user is successfully authenticated by FSSO and gains access to resources according to the Firewall Policies. At this point, we can see in the FortiGate FSSO Users Dashboard that the user 'abdul.rehman@example.com' is listed with the assigned IP address (e.g., '192.168.100.100'). The problem arises when the user attempts to access one of our internal systems (a server or another PC) using the RDP protoc

HelloI have installed a Fortigate 60F firewall at a customer. When the customer uses FortiClient VPN they cannot access their Microsoft Dynamics Navision. If they use the Windows native VPN client, everything works as it should.So why not just use this all the time? This is because the firewall does not allow two simultaneous Windows native  VPN clients from the same IP address…I get this error (see the attached file, and bear with the fact that it's in Danish. I'm sure you can translate it).

Hello,Some our user can't connect to the Azure SQL Server with error I try to disable my App Control and the user is able to access to Azure SQL.Here my App Control settingThen i try to disable 'Block applications detected on non-default ports' on the app control, enable this app control on the firewall policy and the user is able to access to Azure SQLSo anyone can help me to make more understand why the 'Block applications detected on non-default ports' should be disabled?

Hi Team, I am building a playbooks that reads the password protected pdf files extract the indicators, create its record and then block the indicators and update its record in indicator if the indicator blocked successfully. In order to update record in reference playbook I need to pass indicator IRI value in the reference playbook but unable to pass the value.Attaching playbook. Assistance is required in passing the IRI value in the reference playbook. Thanks in advance.

I have activated a FortiGate VM-Trail license, followed the deployment process, and am able to access the GUI. The FortiGate can also access the internet. However, under "Firmware and Register," the device is indicated as "Not Registered." But when using the CLI and entering the "get system status" command, I can see that the device license status is valid. Am I missing something? Serial-Number: FGVMEVRFEK_AEUBFLicense Status: ValidVM Resources: 1 CPU/1 allowed, 1930 MB RAM/2048 MB allowedLog hard disk: AvailableHostname: FGVMEVRFEK_AEUBF

Hi— I use FortiClient with cellular data both directly on a Verizon iPhone and through ‘hotspot’ (on the phone) to connect an iPad and Windows laptop. As of about 2 weeks ago, I began receiving an Error: Invalid DNS Server message each time I try to connect any device through the cellular network. Any WiFi network works without issue and connection is no problem, however the cellular network can not connect. I used a colleagues Verizon phone with FortiClient and entered my credentials— no issue. I’ve contacted Verizon who says there’s nothing wrong with my line and to contact Apple or Fortinet for support. Uninstalling and reinstalling the app has not yielded any result. Anyone else experiencing? Any ideas or suggestions on how to resolve? Thanks!!