Solved

Hi guys! Like in the subject we have a Forti 40f with a static public ip over dhcp client from ISP.From the ISP we also get another public IP block/pool which is routed to our fixed IP. The goal would be that I can use my new public IP's on my 2nd Mikrotik router. Many posts about this say that VIP's should be used but as I'm not a Forti native guy can I find some GUI tutorial for that? Thanks!

Hi Team,  I am replacing Cisco ISE with FortiNAC. The Cisco ISE is currently configured to profile the Access Points and send a Cisco Neat attribute. This Neat attribute helps the Cisco switch assign a truck role to the port.  In FortiNAC, Network Access > "Configuration" - It does not provide any option to send radius attribute only and VLAN ID is mandatory. https://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/116681-config-neat-cise-00.html cisco-avpair = device-traffic-class = Switch I want to check if FortiNAC has a way to sort this situation.  Regards, Barry Ghuman 

With forticlient 7.4.0.1636 on a laptop running a new install of Debian 12, the VPN connection process seems to complete normally but there is no traffic (bytes received remain at zero). Inspection of the logs shows no apparent problems, but I cannot connect to the remote systems ("no route to host"). But if I do "nmcli device status" I see that a fctvpn tunnel has been created. I can manually connect this by doing something like: sudo ip route add 10.100.123.123 dev fctvpnf01234567 After this I can access the specified host as normal, and the traffic counts update. Any ideas why the normal connection process is not completing?

Dear Fortinet Community,We are currently experiencing challenges with a WAF deployment project using FortiWeb version 7.4.3. Our goal is to migrate several web applications behind FortiWeb, but we have encountered a routing issue due to our network configuration.In our setup, we have two different FortiGate physical appliances, each configured for separate ISP connections. One FortiGate is connected to a physical port on FortiWeb with a distinct subnet, while the second FortiGate is connected to another physical port on FortiWeb. We have created two different virtual IPs (vIPs) on both FortiWeb ports where each ISP terminates, and we have linked these vIPs to a single virtual server.Currently, we have configured a default route pointing to one of the ISPs. However, the issue we are facing is that all responses are being routed through the ISP associated with the default route. We have attempted various solutions, including Policy-Based Routing (PBR) and static routes, but none have res

Hello everybody,I have a BIG problem and was start when I decide to upgrade my 200F ( Np6 Xlite cpu )at new release 7.2.8.My scenario is a FGT with multiple a IpSec VPN Dynamic and several SSL VPN Portal .In the initial version 7.2.3 we had no stability and connection problems. After the update we noticed disconnections after a few minutes and constant instability. We were forced to downgrade at the more stable 7.2.5. Even version 7.2.8 that read in the release notes that the problem had been solved was not a solver of the problem.We also have several test FWs that have an NP6 process and also on those we have noticed the same problem. ( 300E , 3000D ).And on these we also put the latest version 7.4.4. with the same result. Below I show you the typical configuration of a VPN connection: config vpn ipsec phase1-interfaceedit "VPN_XXX"set type dynamicset interface "VLAN_7"set mode aggressiveset peertype oneset net-device enableset mode-cfg enableset ipv4-dns-server1 10.12.

Hi Is there a way, when i guide one of my host into VPN tunnel and it works great.Is there a way, to ping it over a WAN interface also ? 

Hello expert, I configured a ssl vpn remote and was successful able to establish a remote session  from my laptop.how can i view the entire logs for any attempt from my laptop to resource on the "lan" network behind the FortiGate.I search under log and report  forward traffic unsure if I  am searching the correct place but I am not seeing any  inbound traffic. I humbly request some guidance. Thanks  Regards    

Hi.We are using Cisco ISE with the pxgrid connector to fortimanager and that works fine.but need to create fortigate policies with a user on both source and destination cause our cisco sda uses /19 subnets and seperated with sgt tags (pxgrid).But when im trying to install a policy im only able to do source user, on destination there's no user tab.Is that working as intended? cause then i need to have fortinet to make it work, out local fortinet team said it should work.thx Morten

Hi, Kindly, while install the Linux agent, this error appears.as i know i should add -v to validate the certificate? 

Hi, I saw many posts but no solution that worked for us. Since yesterday, after the update to 7.4.4 we cant connect via SSL VPN with LDAP and FortiToken Users. Local Users are working fine. We tried with different users (NO user can connect and we have like at least 20 per day), different PCs and different Forticlient Versions. We did not change anything from yesterday and on the other office with FG100F and 7.4.3 it still works without any problem with the same LDAP configuration. Is it possible that this is a bug in 7.4.4. Any ideas o suggestions? Thanks!

Hi everyone, I'm just want to block appsheet.com website on my site. I have create a security profile with Web Filter to block it and create a policy for it. But User still access. What wrong with my web filter ?. 

I have two fortigate 60F which connected via ipsec (HQ office and branch office)I need to allow users from branch office to connect to HQ's web server. currently i can ping from HQ to branch office users, but not able from branch to HQ's office.I am new to fortigate configuration, guys can u help me what i need to configure? 

Hello everyone,I am testing FortiClient EMS trial because we want to get EPP/APT for our clients till end of the year. I went for a direct install of version 7.4 because it runs on Linux. In the Remote Access Profile there is no way to create a SSL VPN tunnel in the gui, I can only see IPsec there.Does someone else having this issue? (Couldn't find it in the known issue list and wanted to ask here before asking official support) 

How to register and manage a Fortigate Device behind a dsl router with dynamic ip address? Fortimanager is in LAN private network of a Fortigate behind a dsl router with static public ip. FMG(priv ip)-->FortiGate-->(NAT)-->dsl-router(static ip)-->internet andFGT-->(NAT)-->dsl-router(dynamic ip)-->internet  

My Fortigate firewall and Fortiswitches are defined and working synchronously on Fortimanager. I want automatic backups of the firewalls and switches on a regular schedule, for example once a week. How can I do this?

Hello community,A few weeks ago we migrated the AWS vpn from static to BGP, and since then we have noticed that there are several Hold Timer Expired messages received “IP AWS”. I have checked physical cables, and connectivity and there are no problems. The problem is also not due to saturation because it occurs at night when there is no staff working.What else could it be, or if anyone else has had this happen. 

I have 50+ remote branch offices that use Fortigates with a single WAN connection, which uses one IPsec tunnel back into our Primary HQ. However, we would like to add a second IPsec tunnel as a backup path at another location at Secondary HQ FG. Is there more than one way to set this up? If so, what are those setups, and which is more feasible to do? My end goal is when the IPsec tunnel goes down because Primary HQ route is not active, it should route to the Secondary HQ automatically. Also, FG is running firmware 7.2. I heard others recommend using two IPsec tunnels and also creating a BGP neighbor as an option. I wasn't sure if there were any other ideas.

What is the difference?  Any pro's con's to one or the other? Why would you need DNS filtering if you're already doing web filtering? If you do not use the FortiGate as a DNS server does DNS filter do anything?

Hi,Please can it be clarified why the Fortigate firewalls have MFA functionality using email without subscription(free) as opposed to Fortianalyser that only offers the Token subscription based option for MFA(no free version) ?kind regardsGavin

Hi, I am currently working on this KB: FortiGate alt-primary, alt-secondary DNS ... - Fortinet CommunityIt mentions that Public DNS servers return a name resolution error 'NXDOMAIN' so that another server selection takes place between alt-primary and alt-secondary DNS servers. How do I know if the Public DNS server returns an NXDOMAIN error? Do we see it using debug?I am not able to successfully implement the KB for internal look ups, but for external look ups it is working as expected.Anything else which I can do to trouble shoot or look into? Thank you!

Hi everyone,I have the topology below, WAN-1 & WAN-2 are in the same Zone (Internet) with a fail-over scenario between WAN-1 (Primary) and WAN-2 (Backup), what I want to achieve is to create 2 IP Pools as follows to use as a NAT in the outbound policy:1. IP Pool For WAN1: Mail-Server-WAN1: 195.1.1.10 --> 192.168.100.1002. IP Pool For WAN2: Mail-Server-WAN1: 88.31.25.10 --> 192.168.100.100If I create an IPv4 Policy, Source: the mail server 192.168.100.100/32, Destination: 0.0.0.0/0 and put the 2 IP Pools as a Dynamic IP Pool this will work without problem in case of a fail-over will happen.If not, what is the right approach for such a scenario? Thank you so much in advance, much appreciated.

Hi,I deployed forti in aws.the forti deployed in az 1a.I have 2 subnets, 1a and 1b.I attached to forti 2 eni1 eni for the wan traffic.1 eni in 1a az.in the subnets route table, I route 0.0.0.0/0 traffic to eni that is attached to forti.I attached the relevant security groups for the eni and for the ec2 machines. I facing with problem that subnet 1b don't have outbout connection and I cant connect directly to the ec2 machines in subnet 1b, I can connect only from the 1a ec2 machines. What I configured not correctly?Thanks Daniel

Dear,I have installed FortiNDR in my VMware ESXi 6.5 environment. The installation consists of two platforms: FortiNDR-Center and FortiNDR-Sensor. Below are the details of the installation files and the configurations:Installation Files:Center: FNDR_VMC-CENTER.v7.4-build0534-FORTINET.out.ovfSensor: FNDR_VM-SENSOR.v7.4-build0534-FORTINET.out.ovfVMware Resource Allocation:FortiNDR-CenterName: FortiNDR-VMCIP: 10.0.1.150/24Route: 10.0.1.1RAM: 32GCPU: 8FortiNDR-SensorName: FortiNDR-VMCIP: 10.0.1.151/24Route: 10.0.1.1RAM: 8GCPU: 4Everything appears to be functioning correctly; however, I am unable to register the FortiNDR-Sensor with the FortiNDR-Center. I have followed the installation and registration steps as outlined in the documentation, but the sensor fails to register.Could you please assist in resolving this issue? Any guidance on additional steps or configuration checks that I might have missed would be greatly appreciated.Thank you for your support.

Hello Support,  I have purchased a used Fortigate 60E, I want to register it but i don't have any service contract. How can i get this any help ?

 I'm facing issues while trying to set up FortiClient VPN on KUbuntu 22.04. The installation goes smoothly after manually adding a dependency package. However, when I attempt to connect using Single Sign On (SSO), the authentication window briefly opens and closes, leaving me stuck on the "Connecting..." stage. This is the window where I should enter my username and password and then use a 2FA app for verification.Even after enabling "Use external browser as user-agent for saml user authentication," the problem persists. The same behavior occurs, and an external browser doesn't open as expected.I had no trouble with this kind of connection on Kubuntu 20.04. Has anyone managed to successfully establish this type of connection on (K)Ubuntu 22.04?