Solved

WAN1 - Spectrum COAX internetWAN2 - Spectrum eLAN to HQ. We have a problem with this location where the internet goes down more than it should. When it goes down, we're able to route internet traffic over WAN2 which is usually just for internal traffic. I'd like for this to happen automatically. I set the administrative costs on the static route to 0.0.0.0/0: 10 for WAN1 and 110 for WAN2. This works just fine if I manually disable WAN1 for testing. I think the problems lies with the Spectrum router we're forced to use in order to have a static IP address. WAN1 is connected to the Spectrum router and gets an IP address from DHCP. 192.168.0.2 or whatever. If the internet goes down, the link for WAN1 stays up, so the Fortigate doesn't realize there is a problem. Any ideas?

Hi, Our users work via Remotedesktop on Windows Server 2016 (VM-Ware ESXi VM-Version 19) with FortiClient VPN 7.2.4 (free).Their SSL-VPN with one predefined Gateway to an external Partner works fine. Some of the users now have to connect at the same time to another SSL-VPN. Can I realize this kind of "multiuserconfiguration" on this single Windows Server ?What would be the recommended Best Practice ? Thanks, Roland

I created a global variable, how can I update its value in a playbook task? I need to evaluate a variable in a playbook that will then be read in a playbook that runs an hour later. Thanks

I am trying to learn how to setup a webportal so that users can connect via the web to our Fortigate and get proxied over to a specific internal website.   What documentation should I be looking at to learn how to make this happen?  I am running Fortigate VM in AWS version 7.4.4

Hi,I am facing a strange issue regarding Tacacs setup:it works well without any problem with a specific server (which is a Cisco ISE PSN), and my login attemps seen in Cisco ISE Live logs.but when I configure another PSN , I can login to the device, but my attempts is not seen in Cisco ISE Live logs. It's also strange, when I test it by 'diagnose test authserver tacacs+...' then my login test/attempt is seen in ISE Live logs.I have captured traffic on this firewall to see what happens on packet level and found that when login attempt is not seen in Cisco ISE Live logs then firewall simply resets connection during TCP handshake right after syn+ack packet coming from PSN. So connection is not established at all.Thanks,

I have the following issue and need your help, please. I have a FortiGate device and a router with an internal network of 192.168.0.0/24. I've set up multiple branches in OSPF area 0, excluding the internal network 192.168.0.0/24 because the second branch needs to act as the main distributor. Additionally, I have two tunnels with another company, set in OSPF area 10. To ensure they see a specific IP address (e.g., 192.168.0.136) from our network, I used "redistribute static". However, enabling this causes the second branch to not see the 192.168.0.0/24 network. When I disable it, the issue reverses, and the other company cannot see the second branch. Is it possible to resolve this by creating access lists for both OSPF areas? Here's   the configuration snippet for "redistribute static":           FortiGate    

Anyone have an issue setting up an active-passive HA on FortiADC where both devices want to be Primary?Neither see any peers.Mac address spoofing is enabled on our virtual switches.The thing that's weird is a 169.x.x.x IP is being assigned.The devices cannot ping the other 169.x.x.x IP.   (P) FORTIADCP001 # get system ha mode : active-passive hbdev : port4 datadev : group-id : 14 group-name : group1 mgmt-status : disable priority : 1 config-priority : 10 override : enable hb-interval : 2 arps : 5 hb-lost-threshold : 6 arps-interval : 6 l7-persistence-pickup : enable l4-persistence-pickup : enable l4-session-pickup : enable auto-config-sync : enable monitor

Hi (New to Fortinet )I am hoping i can get some feedback regarding a project that i am currently working on, In our data center, we are replacing the switches with a managed fortiswiches 2048s. The firewall is a 3rd party appliance and will not be replaced at this moment. Proposed topology  I would like to manage the switches via the firewall as the controller. is this even possible?  Is this a best practice? are there any potential issue with routing/config that i should be aware of ? Thanks in advance!

Hi,I need same help, after system upgrade fortianalyzer to 7.4.3 gui not work.I have available disk space, the settings are all correct according to the previous version.   

Hello team We have configured the SD-WAN network, now the FGT 70 is at brach and FGT 200F at HQ, now all Underlay Network is reached through ISP means 70F at branch can ping 200F at HQ ,but LAN network is not reached trough Overlay what is the issue?

Hello  Please anyone has experience with this log, that seems that Worker is denying logs from Collector. (This is a Clickhouse environment with one Worker and one Supervisor) [root@shard1 ~]# tail -f /etc/httpd/logs/ssl_access_log ip_collec- 10001 [11/Jul/2024:09:48:46 -0500] "PUT //evthandler2?10001 HTTP/1.1" 550 527 ip_collec - 10000 [11/Jul/2024:09:48:51 -0500] "PUT //evthandler2?10000 HTTP/1.1" 550 527 ip_collec - 10001 [11/Jul/2024:09:49:47 -0500] "PUT //evthandler2?10001 HTTP/1.1" 550 527 ip_collec - 10000 [11/Jul/2024:09:49:52 -0500] "PUT //evthandler2?10000 HTTP/1.1" 550 527 ip_collec - 10001 [11/Jul/2024:09:50:48 -0500] "PUT //evthandler2?10001 HTTP/1.1" 550 527 ip_collec - 10000 [11/Jul/2024:09:50:54 -0500] "PUT //evthandler2?10000 HTTP/1.1" 550 527 ip_collec - 10001 [11/Jul/2024:09:51:49 -0500] "PUT //evthandler2?10001 HTTP/1.1" 550 527 Regards.

Hello friends, I would like to know if there is a way to set up 2FA for logging into Fortigate. I understand that it can be done for VPN-SSL and I have done it, but is it possible to set it up for Fortigate administration via email or any other method? Thanks in advance.

Does anyone have experience configuring 2 FortiADC Virtual Devices in Active-Passive HA mode within a VMware environment? We are having a problem when the 2 VM's are on different hosts.

Hi, FG-60F instead inter-vlan routing sends packet to wantraceroute 10.102.9.3traceroute to 10.102.9.3 (10.102.9.3), 30 hops max, 60 byte packets1 _gateway (192.168.1.99) 0.404 ms 0.382 ms 0.373 ms2 customer.abc.net (X.X.0.0) 83.877 ms 73.327 ms 83.850 ms...Routing table looks well:get router info routing-table allCodes: K - kernel, C - connected, S - static, R - RIP, B - BGPO - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter areaV - BGP VPNv4* - candidate defaultRouting table for VRF=0S* 0.0.0.0/0 [10/0] via X.X.0.1, wan2, [10/0][10/0] via X.X.0.1, wan1, [15/0]C 10.0.2.0/30 is directly connected, Wireless-BC 10.0.3.0/30 is directly connected, Wireless-CC 10.102.1.0/24 is directly connected, vlan-10C 10.102.2.0/24 is directly connected, vlan-20C 10.102.3.0/24 is directly connected, vlan-30C 10.102.6.0/24 is directly connected, v

We can manage the Forti-APs in fortigate Transparent Mode ?  @nithish.k@snsin.com,@sanjeevi.s@snsin.com

Hi guys! Like in the subject we have a Forti 40f with a static public ip over dhcp client from ISP.From the ISP we also get another public IP block/pool which is routed to our fixed IP. The goal would be that I can use my new public IP's on my 2nd Mikrotik router. Many posts about this say that VIP's should be used but as I'm not a Forti native guy can I find some GUI tutorial for that? Thanks!

Hi Team,  I am replacing Cisco ISE with FortiNAC. The Cisco ISE is currently configured to profile the Access Points and send a Cisco Neat attribute. This Neat attribute helps the Cisco switch assign a truck role to the port.  In FortiNAC, Network Access > "Configuration" - It does not provide any option to send radius attribute only and VLAN ID is mandatory. https://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/116681-config-neat-cise-00.html cisco-avpair = device-traffic-class = Switch I want to check if FortiNAC has a way to sort this situation.  Regards, Barry Ghuman 

With forticlient 7.4.0.1636 on a laptop running a new install of Debian 12, the VPN connection process seems to complete normally but there is no traffic (bytes received remain at zero). Inspection of the logs shows no apparent problems, but I cannot connect to the remote systems ("no route to host"). But if I do "nmcli device status" I see that a fctvpn tunnel has been created. I can manually connect this by doing something like: sudo ip route add 10.100.123.123 dev fctvpnf01234567 After this I can access the specified host as normal, and the traffic counts update. Any ideas why the normal connection process is not completing?

Dear Fortinet Community,We are currently experiencing challenges with a WAF deployment project using FortiWeb version 7.4.3. Our goal is to migrate several web applications behind FortiWeb, but we have encountered a routing issue due to our network configuration.In our setup, we have two different FortiGate physical appliances, each configured for separate ISP connections. One FortiGate is connected to a physical port on FortiWeb with a distinct subnet, while the second FortiGate is connected to another physical port on FortiWeb. We have created two different virtual IPs (vIPs) on both FortiWeb ports where each ISP terminates, and we have linked these vIPs to a single virtual server.Currently, we have configured a default route pointing to one of the ISPs. However, the issue we are facing is that all responses are being routed through the ISP associated with the default route. We have attempted various solutions, including Policy-Based Routing (PBR) and static routes, but none have res

Hello everybody,I have a BIG problem and was start when I decide to upgrade my 200F ( Np6 Xlite cpu )at new release 7.2.8.My scenario is a FGT with multiple a IpSec VPN Dynamic and several SSL VPN Portal .In the initial version 7.2.3 we had no stability and connection problems. After the update we noticed disconnections after a few minutes and constant instability. We were forced to downgrade at the more stable 7.2.5. Even version 7.2.8 that read in the release notes that the problem had been solved was not a solver of the problem.We also have several test FWs that have an NP6 process and also on those we have noticed the same problem. ( 300E , 3000D ).And on these we also put the latest version 7.4.4. with the same result. Below I show you the typical configuration of a VPN connection: config vpn ipsec phase1-interfaceedit "VPN_XXX"set type dynamicset interface "VLAN_7"set mode aggressiveset peertype oneset net-device enableset mode-cfg enableset ipv4-dns-server1 10.12.

Hi Is there a way, when i guide one of my host into VPN tunnel and it works great.Is there a way, to ping it over a WAN interface also ? 

Hello expert, I configured a ssl vpn remote and was successful able to establish a remote session  from my laptop.how can i view the entire logs for any attempt from my laptop to resource on the "lan" network behind the FortiGate.I search under log and report  forward traffic unsure if I  am searching the correct place but I am not seeing any  inbound traffic. I humbly request some guidance. Thanks  Regards    

Hi.We are using Cisco ISE with the pxgrid connector to fortimanager and that works fine.but need to create fortigate policies with a user on both source and destination cause our cisco sda uses /19 subnets and seperated with sgt tags (pxgrid).But when im trying to install a policy im only able to do source user, on destination there's no user tab.Is that working as intended? cause then i need to have fortinet to make it work, out local fortinet team said it should work.thx Morten

Hi, Kindly, while install the Linux agent, this error appears.as i know i should add -v to validate the certificate? 

Hi, I saw many posts but no solution that worked for us. Since yesterday, after the update to 7.4.4 we cant connect via SSL VPN with LDAP and FortiToken Users. Local Users are working fine. We tried with different users (NO user can connect and we have like at least 20 per day), different PCs and different Forticlient Versions. We did not change anything from yesterday and on the other office with FG100F and 7.4.3 it still works without any problem with the same LDAP configuration. Is it possible that this is a bug in 7.4.4. Any ideas o suggestions? Thanks!