Solved

 We use sslvpn web portal to reach http/https server. We are not able to proceed after browser hits the url https://hostname-fortigate/proxy/xxxxxxx/https/login.microsoftonline.com/common/GetCredentialType?mkt=en-USI did debug for sslvpn and following is the error:[313:root:5dd]SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384[313:root:5dd]do_http_validate:442 method (POST) on uri (/proxy/xxxxxx/https/login.microsoftonline.com/common/GetCredentialType) not allowed.[313:root:5dd]sslConnGotoNextState:309 error (last state: 1, closeOp: 0)[313:root:5dd]Destroy sconn 0x7f0f70cae000, connSize=0. (root)[313:root:5dd]SSL state:warning close notify ()

We were having trouble accessing a specific website and the issue ended up being our Geo Blocker policy was preventing access to the website. We have temporarily resolved the issue by disabling the Geo Blocker policy but would like to reenable this policy while still allowing access to the website we were previously experiencing issues with. I called the company that owns the website/server, and they gave me the public ip address for their webserver I created both a subnet allow policy and an ip range allow policy to hopefully allow access to this server while the Geo blocker policy is on. Neither allow policies seemed to work and when I looked up the company's server ip address it is located in a country that is not blocked by out firewall. I am assuming they either gave me the wrong ip address, somehow the webserver is associated with a country that is blocked by our policy, or I configured the allow policies wrong. Would anyone be able to assist in listing out the steps required to

I’ve been working on integrating LDAP with FortiClient EMS server v7.4.0 build1793 running on Ubuntu 22.04 but am getting "Auth Method Not Supported" when trying to add LDAP authentication server.In the EMS web console, when I go to Administration > Authentication Servers, I select "ADDS" from the dropdown, enter localhost and the admin creds, but when I hit "Test", I get an "Auth Method Not Supported" error.slapd is running and listening:# netstat -aptn |grep LIST |grep 389tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 326786/slapdtcp6 0 0 :::389 :::* LISTEN 326786/slapdAnd doing a tcpdump, I can see the traffic (although not the username and passwd being passed):17:30:52.956097 lo In IP (tos 0x0, ttl 64, id 42008, offset 0, flags [DF], proto TCP (6), length 115)127.0.0.1.41008 > 127.0.0.1.389: Flags [P.], cksum 0xfe67 (incorrect -> 0x25f2), seq 1:64, ack 1, win 512, options [nop,nop,TS val 3342323866 ecr 3342323866], length 63E..s..@.@..j.........0.......d[......g......7...7..0=...`8.

Hello,My board is wanting to buy Firewall via Amazon site , will I have any issue with configuration or support problem ? today I pay for this personal service of putting ready license , do I need to do some kind of registration at fortigate ? As I'm just starting to work with firewalls, I'm afraid I won't be able to configure the equipment.https://www.amazon.com/FORTINET-FortiGate-FortiCare-FortiGuard-Protection/dp/B08126TLGJ/ref=sr_1_1?crid=1GCVFTC60DS9R&dib=eyJ2IjoiMSJ9.NkFXLMZMwVINF-vHID1IVIvS4VAG98wBT9ISu4tag6lKAwEZ9MRlWo5Mo9HI7LzbTOIWZgcw7FcyE1rDCxU00Ae0SCs6bFn9FVDey5XWBgKF7ci2gBL8btbuX1qfhXssSYw8NrMGxrAetBCWMuaHKA.GZY71woOBcUqaQ2hzu19lFsB98ekh-cIm84kPKhRhFc&dib_tag=se&keywords=fortinet%2Bfirewall%2B60f&qid=1724073149&sprefix=firewall%2BForti%2Caps%2C200&sr=8-1&th=1Translated with DeepL.com (free version)

Hi All, I'm trying to find out how to configure our FG100D (6.2.14-FW-build1364-230411) to send to our Syslog Server (ELK) just every 5 mins. There is no option in the WebUI or even in the CLI to configure this. Is there any way to do this? All I can see is in the FortiAnalyzer option. Thank you. Oliver

I installed FortiClient VPN version 7.4.0.1636 on Ubuntu 22.04.4 LTS with the GNOME 42.9 desktop environment using the Wayland windowing system. After creating a new VPN connection and attempting to log in via SAML, the application became unresponsive. Upon exiting and reopening the app, I noticed that the VPN connection configuration I had previously set up was not saved, it had disappeared. sudo dpkg -i forticlient_vpn_7.4.0.1636_amd64.deb 

When adding an authentication server in EMS I only ever get 1 domain even when the tenant has multiple domains registered and synced. These aren't subdomains but two different unique domains.example1.comexample2.comThe only information I provide is the tenant ID, client ID, and secret. And then I only get 1 domain available for doing user to OU matching to assign policies.How do I get all of the available domains that are synced in azure so I can can assign policies? Currently I have to create workgroups and assign the users to that either manually or with group assignment rules. 

Dear Concern, I am visiting a website, but the page is not opening. In the forward logs, I see 'TCP reset from client' under 'action', and sometimes it shows 'accept'. The webpage says 'refused to connect'. How can resolve. I have FortiGate 201F firewall and firmware version is 7.0.10 If I check from another network, the webpage opens properly. can anyone help me to resolve the issue

When using VPN, the user does not receive the local IP assigned by FGT (not the wrong IP). Sometimes it happens like this.

Hi everyone, I have a Linux virtual webserver in ESXI that I would like to be accessible over the internet. Currently it's accessible locally but I have tried all the settings on Fortigate to make it accessible over the internet to no avail. I am plugging the 2nd Physical NIC directly to either internal 4 port and bridging the virtual webserver connection in ESXI to that 2nd NIC but not getting any good luck. I also did create VIPs in Fortinet to the Internal 4. I would really appreciate any help I could get.

Hi All, Is there a way to check or determine in the Fortigate firewall if the difference in bandwidth of MPLS site (our site has 20Mbps and our client has 2Mbps only) will result in slow in traffic?We and our client have both 2 ISPs for redundancy, but the client's other ISP is much slower, so they prefer to connect using the other. When our main ISP was down, we swung to the other resulting in much slower traffic. But our client checked their current bandwidth and said that they were only using 60% of the traffic and insisted to check where the bottleneck was. I'm trying to figure out how to check and present to the client that the issue is their bandwidth unfortunately, when I check the bandwidth monitor in Dashboard, I can only see the grouped MPLS tunnels of ISP1 (interface 1) and ISP (interface 2) with Hardware Switch as type. There is no option to check the separate interface. Even the VPN Event logs don't help that much. Is there a way to check this? Thank you in

I have two firewalls.At one end a firewall with a dedicated link and at the other a Sophos firewall with dynamic IP.I will have to increase the Dialup Type configuration.Does anyone have any documentation that covers this type of configuration.The biggest problem is at the Sophos end, I've already tried several ways.But without success, I've seen several ways on the web but without success.If anyone can give me some direction, I'd be grateful.

Hello, I am facing an issue on DM after Guest self registration on a port used with dot1x the vlan never get changed. The capture of Disconnect-Request :The Disconnect-NAK :  After shut no shut the port, the correct vlan get applied, do i need to apply cli configuration with port bounce as a workaround ? any other options ?@ebilcari Thank youRegards! 

Hi all,in FortiSIEM 7.0.2,I want to deleteone or more CMDB devices using REST APIs.I'm trying with the /phoenix/rest/device/list/delete API.The command is: curl --location 'https://Server-IP/phoenix/rest/device/list/delete' \ --header 'Content-Type: application/json' \ --header 'Authorization: Basic xxxxxxxxx' \ --data '["111111"]' where 111111 is the deviceId. The result contains:HTTP Status 415 - Unsupported Media Type

Hi, Would like to check if there are latest information already about the release of newer firmware version for FG-90G?Due to vulnerabilities, I am keen on knowing when the expected dates are. Thanks!

Ok, I will admit I am a little outside my knowledge base with this one. In my investigation, I am learning that what I am looking for might be this header passed from the browser called X-Forward-For. Based on what I am seeing, this shows or can show, the clients original IP, then successive IPs as they pass through proxies.  I am not sure if this is something that is handled at the browser level itself (but I do see extensions available where you can easily customize/add, etc...), but I also see past articles about this header and Fortinet products... but it appears the traffic flow is that maybe being inbound, like protecting a web server behind a FortiGate or FortiWeb device. My inquiry for my traffic outbound from my network. Is there a way to inject that header as it passes through the firewall so if an external webserver can log that info via its auditing, I can glean the private client IP of my user (assuming I have access to that external webserver's audit logs o

Hi Team, Does restarting the WAD process have any impact on the network? Thank you!

Hi guys, Hoping to find Fortigate WAF configuration and troubleshooting help. I see the Fortigate docs provide bits and peices of this WAF technology for FortiGate firewall (mostly just scratch the surface), Youtube videos provide a little bit more info and I can sort of set it up and assign WAF policy to an active security policy but what's next? Is there a way to verify configuration, traffic flows, detection of hacks, logging, which WAF features should be enabled and for what reason, how to troubleshoot and etc. We are currently use FortiOS 7.0.12 and don't have the FortiWeb appliance. Thanks for any assistanceJimmy

I am having troubles installing forticlient VPN in my ubuntu 23.10. I have followed https://www.fortinet.com/support/product-downloads/linux but whatever the choice of version of forticlient I use, I always get the error that libgconf-2-4 (> 0) is needed but not available.Any hint on how to solve this problem?Jordi

Dear Fortinet Community,We are deploying a WAF (FortiWeb) in an Environment and Migrating a Web Application behind FortiWeb. We have a dual gateway seanerio in our environment for FortiWeb, for traffic to route its proper destination we used PBR here to route return or response traffic towards it destination.After all configurations of virtual server, server pool, virtual IPs, server policy, adding certificates of servers in FortiWeb, Migrarted Web Application working properly and doesn't pop-up SSL Certificate error in the browser but on the same Hostname we have an android application of the client , it shows SSL Certificate error on Android Application we open our application. For clarification we called a certificate in Server Policy of FortiWeb for this Service and that certificate is Wild-Card Certificate.Please suggest is there any configurations missing at our FortiWeb end or something else.

Hello people, I have a new projet, to deploy FortiNAC VM. I am a newbie with FortiNAC, any tips for a first deployement ? I will take any advice from people that configured it before. Thank you in advanceKind regards,

  Hello FortiPAM admins, I'm looking for a way to hide secrets sensitive credentials ( Username and Password ) from users with View or Edit roles  

Hello,we just solved a problem we had for weeks with our Fortigate / Azure SSO implementation and i thought maybe i can help someone save some time. We are running multiple fortigates for different companys. Since all those companys do use Office 365 we decided to let Microsoft handle the MFA for the SSLVPN login. We set it up and everything was running good besides one single user in one of our companys that wasnt able to login. He always received a error code -7200. We tried everything we could think of. Ressetting passwords, MFAs and even delete the hole SSL and SSO configuration on this fortigate. Alwasys the same error. No mater on which client this user tries to login the error stays the same.Debugging and the logs in our analyzer showed the error message sslvpn_login_saml_group_mismatch so we double checked for errors in the configuration but we could not find some. Tonight my last thought was that maybe 117 Groups are to mutch for a saml response. Microsft states

Hello Fortinet Community,I am currently working on configuring a FortiGate firewall setup and need some confirmation with VDOM failover configuration. Here’s the scenario I am working with:  - Firewall 1 (Fw1): VDOM A and VDOM B are configured as active.  - Firewall 2 (Fw2): VDOM A and VDOM B are configured as passive.  - Conversely, VDOM C is active on Fw2 and passive on Fw1.Is it possible to set up the VDOMs in this way, with Fw1 having active VDOM A and B while Fw2 is passive, and the opposite configuration for VDOM C?

when im trying to access this course -> FCF - Getting Started in Cybersecurity 2.0 Self-Pacedspecifically the first module or any module within the course, im not able to see anything inside, nothing is displayed, please provide me with a solution as to why is this happening, im attaching the screenshot