Solved

Dear Team, We have Endpoint authenticated via FortiNAC via RADIUS Local. Endpoint has Persistent Agent installed. Our purpose is to give endpoint access when their PC is compliant but we noticed that endpoint shown OFFLINE on FortiNAC after around 30-40 minutes. This offline cause endpoint compliance being failed. During that time, FNAC also mark switchport as Link Down, Not Connected while on Actual Switch , Port is still connected, Authorized by Radius, MAC Address Table shown on the switchport. Note: Endpoint has PA installed, Switch integrated with L2 Polling SNMP, RADIUS.  Thank You FortiNAC

Hey All,I am having an issue with setting up VIPs to redirect incoming traffic on a FortiGate with Central NAT enabled to a remote public IP. A few months back, I had a need to change existing VIPs that mapped from public to private, so that the new mapped IP was another public IP that is not ours. I found this article, and it all worked nice a smooth from testing to deployment in production. This was on a 200F at 7.2.8 without Central NAT. The one strange thing is that I don't get any hits on the Policy Routes. Now, I have to configure the same thing on two more FortiGates, both also at 7.2.8 - one is a 200F without Central NAT and the other is a 100E with Central NAT enabled. I'm having an issue with the 100E. There is a Central NAT policy that says any>internet / src all | dest all / NAT as outgoing interface. There are three other policies that should not be affecting my traffic as they have defined interfaces and addresses that are not involved with this. The 100E has

Hello Dears I am trying to do internet service database group but i am not seeing anything related to create group on firewall level   any one can help ? Bests

Scan is coming back with failures on the follow, these all relate to either the Fortinet_CA or the Fortinet_Sub_CA.  I've already updated my certificate for Administration as well as my SSL VPN certificate with a valid certificate.  How can I go about updating the items below?  Being they appear to be Root CAs I don't see them "attached" anywhere.  When I look at Certificates in the unit they show up under Remote CA Certificates.  Basically it doesn't like the length of these or the fact that they are showing as self-signed.  I'm assuming if I remove these it will cause issues with other Fortinet Certificates, best option to proceed? SSL Certificate - Invalid Maximum Validity Date Detected 1003 / tcp over sslSSL Certificate - Signature Verification Failed Vulnerability1003 / tcp over sslSSL Certificate - Invalid Maximum Validity Date Detected1000 / tcp over sslSSL Certificate - Signature Verification Failed Vulnerability1000 / tcp over sslSSL Certific

I have a 40F that I've configured to allow SSL VPN connections from remote computers (work from home primarily).  I've got Forticlient to connect, and while connected can still connect to the internet (split tunneling) and ping the 40F at 192.168.2.99.  However, I can't access our server or any other devices on the office network. I've read on other responses to similar questions that I need to set up a policy to allow the SSLVPN traffic to access that same subnet.  I can't figure out for the life of me how to do that. Using ipconfig I can see the remote computer gets a correct ip pursuant to the configuration I have (192.168.2.200).  However, I also notice that the subnet mask is 255.255.255.255.  From what I understand, that's putting it on a different subnet than the rest of our office lan (192.168.2.0 255.255.255.0) What else do I need to do? Thank you.

Hello Expert, I config ssl vpn on my fortigate 400E firewall but would like to enable 2FA for my user account.I would to use the forticloud option for the 2FA.Could any one provide guidance most of the videos online are using fortitoken or email method for their demonstration because I suspect the presenters done not have a forticloud account. My organization has a forticloud account.  Thank you.

Hello Dears i am trying to configure policy route making the outgoing interface is SD-WAN interface , i am not seeing the SD-WAN interfaces on list interfaces any suggestion plz? Bests 

Greetings,My organization uses Gmail through the Mac Mail app. Incoming emails are working, but outgoing/sending is not. Below is a log of my co-worker trying to send a message. I am kind of a noob and hoping for someone who can help translate.OR maybe I am not even looking at the right log? Thanks! 

Hello, I have a use case where I'd like to take a CVE's JSON details, and convert certain fields to XML format. The reason for this would be to create custom vulnerability checks for Rapid7 InsightVM programmatically using the specified CVE. I can pull the CVE data using a connector, then I would need to convert the relevant fields to XML. I see that there is a utility to convert XML to JSON, but does the reverse exist?

Hello, I have the following problem. I have a FortiGate and a tunnel set up between two companies. I receive two IP addresses via OSPF for routing, as we use OSPF. The problem is that the other party has set up an access list and they only receive the IP 192.168.0.136/32. The issue is that this network is on my FortiGate. How can I send them this network? I tried to set up port forwarding using a blackhole; I activated a public IP and set up port forwarding from 192.168.0.136 to 10.185.195.15. They receive this IP but cannot establish a telnet connection. Can you help me with a way to make the /32 network accessible via OSPF? Below are screenshots of the configuration. Friends, I’m waiting for your help, I really need it.     

Hi, I checking on my FortiAnalyzer, seem the resource for the CPU really high. I monitored it almost 1 day and restart some of the service but still same. Based on the exe top output, some application that utilized most of the cpu are siemagentd & postgress. Its take a lot of time to generate a report when the cpu high. Anyone can assist me on this ?  

Good day team,Case: Caught a staff member, she enabled hotspot on their laptop because the staff wifi was temporarily down, found her pc name in the ssid list on my phone LOL. Many devices were connected in her dhcp client list. LOL, i mean, we IT staff doing so much stuff, we dont actively monitor this. Additionally, in all the major IT corporation that I have worked and managed, this feature was never really acted on or considered to be changed/disabled by the IT Bosses. Even my fellow sys engineers as myself did not pay this much mind. Something as simple as a hotpsot. Crazy world.Which is the best method?What did you do in your LAN?Which method worked for you? Is this possible with Forticlient? Would love some direct responses/suggestions/steps here.

This is a follow up from: https://community.fortinet.com/t5/Support-Forum/AWS-IPSEC-on-BGP-routing-how-to-control-traffic-preference-for/td-p/279609 And now my issue is that I have connected the BGP with the VPCs but the routes in between are not being accepted by AWS TGW. This is my situation, from Brazil and Virginia, I need to pass on their routes to Desarrollo. I have the prefix list, the route maps, all the jazz. But for the life of me, I cannot find WHY Desarrollo does NOT show those routes.I can see the routes that set in the "Networks" section being propagated and see them also on the TGW route table.I can see the routes from BOTH, Brazil and Virginia being propagated, but they are NOT on the TGW.I thought it was the prefix list, set it to Permit ANY, still nothing.The team I work for had the idea of enabling back the static routes on the firewall and use the Redistribute: Static. And ONLY then, the routes appeared on Desarrollo. Yes, already raised a t

Dear all, Please suggest, how to create weekly monthly wan and sdwan report in Forti analyzer .Thanks Umesh

Hi together, I have the following issue concerning the described network structure:Two main sites which are connected to our MPLS-Network. Other sites are also connected via MPLS. Each MPLS site has a MPLS-Router exchanging BGP-Routes with the Site-Firewall and redistributing it within the MPLS network. We want to throw out MPLS and replace it with IPSec tunnels. The goal is one connection from each remote site to each main site, routes also being exchanged via BGP and the two main sites also connected via IPSec to each other. From routing perspective this should not be a problem but if we now let the firewall things join we may break connections due to asynchronous routing when MPLS is still running:For example: packets entering via IPSec to main site 1 into MPLS to another location. Due to the BGP things within MPLS which we can't affect the answer packet maybe will be routed back through main site 2 as this is a "cheaper" way. Firewall on main site 2, of course, doesn't know ab

A basic question: Would Websocket app (TCP 443) traffic be filtered by a policy with a Web Filter profile? Or do we need to match it with Application Control in a separate policy before or after the web filter policy?Thanks, Toshi

Hey,I'm looking for a filter/policy to block instagram pages that contain specific hashtags. Is this possible and how to configure it ?Thx for your feedback.

Hello everyone! I am looking to leverage the Dot1x auto registration option on FortiNAC to register devices that log in to my network using WiFi. Yet, I need some way to identify that these guys became registered using this method, so I can apply scans, Net Access Policies and so on. The issue is they get assigned the NAC-Default role and I don't see any option to apply a role as we do on the portal for example, where I can give a BYOD or Guest role for example. Does anyone have any suggestions on how can I apply roles or can think of other ways to leverage this option but still have control of the way the device connected and became registered to the network? Appreciate the help! FortiNAC 

Hello,I've been asked to enumerate all devices on our office LANs and the Device Inventory Monitor seems to have all the information we're looking for such as MAC, IP, Hostname, OS, etc.  But I can't figure out a way to export this information from the web interface.  I'm surprised there isn't some kind of CSV download option or anything like that.Has anyone figured out a way to do this?

Hello, I have the following request. Which Fortinet products can perform the following tasks that I will outline? Here's what the product should do: SIEM: A local SIEM solution. Ability to separately analyze raw logs when needed, with the ability to export them in .json, .cef, and .csv formats. If the SIEM does not have this capability, the applicant must propose an alternative solution that allows retaining all security and application logs for 90 days. The solution should have User Behavior Analytics (UBA) functionality. Endpoint Security EDR/XDR: A local solution for endpoint detection and response (EDR) or extended detection and response (XDR). Privileged Access Management (PAM) Software: A local PAM solution for managing and controlling privileged access. Seven licenses required. Network Traffic Flow Recording Solution: A solution that can integrate with SIEM and firewall and/or network devices (switches, routers) to record traffic flow at the full TCP/IP packet level (in .

Dear All , hope you are doing great, i have FortiGate 60D, just unplugged it from the server room to hardware reset everything, put on my desk, plugged the power and all i got the power button is contiguously flashing green,it was working fine. tried to putty it with no access. your support much appreciated if anyone faced this before. RegardsGhadamsi

i recently upgraded my macbook and now need to install forticlient vpn on it.which version should i download?those that i tired download from fortinet support all comes with EMS with one month validityi just need the forticlient ssl vpn client

Hi everyone, How can I find the memory size of my Fortigate-100F? I have not found it listed in the Data Sheet nor have I been able to find the total amout or the free amount using the "free" command which is not recognised by the Fortigate.

Hello Guys, I had an issue when using the Default web filter profile with a blocked static URL for Youtube and other sites. I used the certificate inspection not the Deep inspection option, and when the any website should be blocked like Youtube, I got the certificate warning and only solved if I install the certificate on my machine, the goal is that how can I solve this issue to get the replacement message for FortiGuard web filter or the known error "This site can’t be reached". I have another firewalls and with the same configuration but without the certificate error. I opened a case with Fortinet TAC and they told me that you have to install the certificate on the machines! below is their message: " As per my findings, for https websites we need to install the CA certificate (in our case the FortiGate CA certificate) to the browser trusted store in order to get the replacement message. Without the certificate we received the same error as the error that you received. PFA the scree

Hello everybody,I've FortiClient EMS in my network. The filtering is working correctly, but I can't understand how to view generated logs. Is it mandatory to send logs to FortiAnalyzer or to an external server?Where can I view generated logs on FortiClient EMS?Thank you