Solved

I have two fortigate 60F which connected via ipsec (HQ office and branch office)I need to allow users from branch office to connect to HQ's web server. currently i can ping from HQ to branch office users, but not able from branch to HQ's office.I am new to fortigate configuration, guys can u help me what i need to configure? 

Hello everyone,I am testing FortiClient EMS trial because we want to get EPP/APT for our clients till end of the year. I went for a direct install of version 7.4 because it runs on Linux. In the Remote Access Profile there is no way to create a SSL VPN tunnel in the gui, I can only see IPsec there.Does someone else having this issue? (Couldn't find it in the known issue list and wanted to ask here before asking official support) 

How to register and manage a Fortigate Device behind a dsl router with dynamic ip address? Fortimanager is in LAN private network of a Fortigate behind a dsl router with static public ip. FMG(priv ip)-->FortiGate-->(NAT)-->dsl-router(static ip)-->internet andFGT-->(NAT)-->dsl-router(dynamic ip)-->internet  

My Fortigate firewall and Fortiswitches are defined and working synchronously on Fortimanager. I want automatic backups of the firewalls and switches on a regular schedule, for example once a week. How can I do this?

Hello community,A few weeks ago we migrated the AWS vpn from static to BGP, and since then we have noticed that there are several Hold Timer Expired messages received “IP AWS”. I have checked physical cables, and connectivity and there are no problems. The problem is also not due to saturation because it occurs at night when there is no staff working.What else could it be, or if anyone else has had this happen. 

I have 50+ remote branch offices that use Fortigates with a single WAN connection, which uses one IPsec tunnel back into our Primary HQ. However, we would like to add a second IPsec tunnel as a backup path at another location at Secondary HQ FG. Is there more than one way to set this up? If so, what are those setups, and which is more feasible to do? My end goal is when the IPsec tunnel goes down because Primary HQ route is not active, it should route to the Secondary HQ automatically. Also, FG is running firmware 7.2. I heard others recommend using two IPsec tunnels and also creating a BGP neighbor as an option. I wasn't sure if there were any other ideas.

What is the difference?  Any pro's con's to one or the other? Why would you need DNS filtering if you're already doing web filtering? If you do not use the FortiGate as a DNS server does DNS filter do anything?

Hi,Please can it be clarified why the Fortigate firewalls have MFA functionality using email without subscription(free) as opposed to Fortianalyser that only offers the Token subscription based option for MFA(no free version) ?kind regardsGavin

Hi, I am currently working on this KB: FortiGate alt-primary, alt-secondary DNS ... - Fortinet CommunityIt mentions that Public DNS servers return a name resolution error 'NXDOMAIN' so that another server selection takes place between alt-primary and alt-secondary DNS servers. How do I know if the Public DNS server returns an NXDOMAIN error? Do we see it using debug?I am not able to successfully implement the KB for internal look ups, but for external look ups it is working as expected.Anything else which I can do to trouble shoot or look into? Thank you!

Hi everyone,I have the topology below, WAN-1 & WAN-2 are in the same Zone (Internet) with a fail-over scenario between WAN-1 (Primary) and WAN-2 (Backup), what I want to achieve is to create 2 IP Pools as follows to use as a NAT in the outbound policy:1. IP Pool For WAN1: Mail-Server-WAN1: 195.1.1.10 --> 192.168.100.1002. IP Pool For WAN2: Mail-Server-WAN1: 88.31.25.10 --> 192.168.100.100If I create an IPv4 Policy, Source: the mail server 192.168.100.100/32, Destination: 0.0.0.0/0 and put the 2 IP Pools as a Dynamic IP Pool this will work without problem in case of a fail-over will happen.If not, what is the right approach for such a scenario? Thank you so much in advance, much appreciated.

Hi,I deployed forti in aws.the forti deployed in az 1a.I have 2 subnets, 1a and 1b.I attached to forti 2 eni1 eni for the wan traffic.1 eni in 1a az.in the subnets route table, I route 0.0.0.0/0 traffic to eni that is attached to forti.I attached the relevant security groups for the eni and for the ec2 machines. I facing with problem that subnet 1b don't have outbout connection and I cant connect directly to the ec2 machines in subnet 1b, I can connect only from the 1a ec2 machines. What I configured not correctly?Thanks Daniel

Dear,I have installed FortiNDR in my VMware ESXi 6.5 environment. The installation consists of two platforms: FortiNDR-Center and FortiNDR-Sensor. Below are the details of the installation files and the configurations:Installation Files:Center: FNDR_VMC-CENTER.v7.4-build0534-FORTINET.out.ovfSensor: FNDR_VM-SENSOR.v7.4-build0534-FORTINET.out.ovfVMware Resource Allocation:FortiNDR-CenterName: FortiNDR-VMCIP: 10.0.1.150/24Route: 10.0.1.1RAM: 32GCPU: 8FortiNDR-SensorName: FortiNDR-VMCIP: 10.0.1.151/24Route: 10.0.1.1RAM: 8GCPU: 4Everything appears to be functioning correctly; however, I am unable to register the FortiNDR-Sensor with the FortiNDR-Center. I have followed the installation and registration steps as outlined in the documentation, but the sensor fails to register.Could you please assist in resolving this issue? Any guidance on additional steps or configuration checks that I might have missed would be greatly appreciated.Thank you for your support.

Hello Support,  I have purchased a used Fortigate 60E, I want to register it but i don't have any service contract. How can i get this any help ?

 I'm facing issues while trying to set up FortiClient VPN on KUbuntu 22.04. The installation goes smoothly after manually adding a dependency package. However, when I attempt to connect using Single Sign On (SSO), the authentication window briefly opens and closes, leaving me stuck on the "Connecting..." stage. This is the window where I should enter my username and password and then use a 2FA app for verification.Even after enabling "Use external browser as user-agent for saml user authentication," the problem persists. The same behavior occurs, and an external browser doesn't open as expected.I had no trouble with this kind of connection on Kubuntu 20.04. Has anyone managed to successfully establish this type of connection on (K)Ubuntu 22.04?

Hey all - running into an issue deleting an address object that was used in an IPSEC configuration. I was able to delete the tunnel completely successfully, but as last part of clean up was to remove the address object I created to reference in the tunnel configuration. When I go to delete the address object, I get an error stating "Failed to delete object due to the following reason: used - object is copied to VDOM xxxxxx-efw.root." Any idea how and where to remove the reference from the root VDOM? I do not have any per device mappings for this object so not sure where the reference is coming from. Any help is appreciated.

The client has a Sophos Red Router which will be sitting behind my firewal and will just be using out our WAN for internet connection so there is no need to setup from my end regarding their VPN tunnel. There is no tunnel to be created from my side. What we need to make sure is that all traffic from this device, and all other devices behind it, passes through my fortigate firewall without any issues. FOS 7.2.14FG200F Does my current Any Any rule allow all their traffic in and out? Any suggestions or comments is highly appreciated. TIA :)  

Hello, I have a Fortigate with several VDOMs (root, VDOM1, VDOM2), all managed with Fortimanager. For debugging purposes, I need to give the administrator of VDOM2 access to the CLI of VDOM2. How can I do this? From Fortimanager? From Fortigate? Thank you for your assistance.

Hi, I would want to ask a question on the issue that was raised earlier.I have two wan lines, I have set up both tunnels on WAN1 I'm not sure if his setup is accurate. Should one tunnel be installed in Wan 1 and the other tunnel in Wan 2? Still, I have one of them tunnelled in shut down. The problem is that the client from the SAP server does not reach an AWS server, but the person from the AWS server reaches the SAP server for my client. Any thoughts?show system interface "TO AWS 2"config system interfaceedit "TO AWS 2"set vdom "root"set ip 169.254.85.6 255.255.255.255set allowaccess pingset type tunnelset tcp-mss 1379set remote-ip 169.254.85.5 255.255.255.252set snmp-index 69set interface "wan1"set mtu-override enableset mtu 1427diagnose debug enableFortiGate1 # diagnose debug flow filter daddr 169.254.85.5FortiGate1 # diagnose debug flow trace start 1FortiGate1 # id=65308 trace_id=1 func=print_pkt_detail line=5795 msg="vd-root:0 received a packet(proto=1, 169.254.85.6:83->16

Hi Team, I am currently working on this KB:FSSO breaks after installing Microsoft KB... - Fortinet Community Do I need to reboot the server or will the permanent solution work without a reboot? I just need to double check on this one. Permanent Solution:Create a new 'string value' registry entry under the following path. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Entry name: Auth4Entry type: REG_SZEntry value: dcagent This key must be added to the target server under Show Monitored DCs -> Select DC to monitor -> Select Domain Controllers for Monitoring User Logon Event -> DC Agent or Pooling mode.  Thank you!

After firmware update 221E bricked. Trying to connect thru console pin (j44) inside AP. Maybe some information how to repair this ap.   from console i can see only:▒▒▒f▒▒f▒`~`▒▒▒▒▒▒f▒▒▒▒▒▒▒▒▒▒f▒▒f▒`~`▒▒▒▒▒▒f▒▒▒▒▒▒▒▒▒▒f▒▒f▒`~`▒▒▒▒▒▒f▒▒▒▒▒▒▒▒▒▒f▒▒f▒`~`▒▒▒▒▒▒f▒▒▒▒▒▒▒▒▒▒f▒▒f▒`~`▒▒▒▒▒▒f▒▒▒▒▒▒▒▒▒▒f▒▒f▒`~`▒▒▒▒▒▒f▒▒▒▒▒▒▒

I'm trying to add Fortigate to FMG have tried version 7.0.15, 7.2.0, 6.4.10 and always get probe failed, even after emabling low encryption: config system globalset adom-status enableset enc-algorithm lowset fgfm-ssl-protocol tlsv1.0set usg enableend Anyone have any idea if any other config needs chaing? I also tried FMG 7.0.12 and got probe failure as well.port1 on the foritgate VM is enabled for FMG-Access I installed FMG on eve-ng and ESXi, every time I get probe failed. This is the debug from the fortigate, it shows connectivity is fine? FGVMEVWXJNWHYO97 # diagnose debug enableFGVMEVWXJNWHYO97 #FGVMEVWXJNWHYO97 # diagnose debug application fgfmd -1Debug messages will be on for 30 minutes.FGVMEVWXJNWHYO97 # FGFMs: Create session 0xfb19c50.FGFMs: setting session 0xfb19c50 exclusive=0FGFMs: Connect to 172.16.10.100:541, local 172.16.10.110:4840.FGFMs: set_fgfm_sni SNI<support.fortinet-ca2.fortinet.com>FGFMs: Load Cipher [ALL:!RC4:!EXPORT:@STRENGTH]FGFMs:

Having a buggy client install that wont connect to EMS and wont disconnect from EMS either with the proper password.  Cant shut it down so we can't uninstall it. All documentation points to FCRemove thats supposed to be included in the FortiClientTools download for each version but can't seem to find it in the downloads for Mac Forticlient v6.4.9, v6.4.8, and still searching...

Hello,I think my problem is relatively simple. I have an attribute "behaviorID"An example of how I would find it in the raw logs:"behavior_id":["ad23g22d-ge7h-po87-2345-nn367s296186!7504645180225346638"] the way its currently being parsed is simple using collectAndSetAttrByJSON:<attrKeyMap attr="behaviorID" key="behavior_id"/>What I need to happen is to remove the [" at the start and "] at the end so it only remains:ad23g22d-ge7h-po87-2345-nn367s296186!7504645180225346638How do I do that?I can tell you what I have tried, but perhaps I am overthinking.1. I changed the parsing instruction to use a variable: <attrKeyMap attr="_bid" key="behavior_id"/>  2. I am using the collectFieldsByRegex function to assign the string leaving the rest out, but it keeps giving me an error.  <patternDefinitions> <pattern name="patBID"><![CDATA[\w+-\w+-\w+-\w+-\w+!\w+]]></pattern> </patternDefinitions> ..... <collectFieldsByRegex s

HiI have started with a new company 6 months ago and inherited a strange issue. Occasionally, a user or 2 will get a "Fortiguard Intrusion Prevention - Access Blocked" message when trying to access any website. Other users are able to access the websites. What I see in FortiAnalyzer are logs with no username specified. We have FortiSSO, and it appears that it is not picking up the user logon event. Sometimes, getting the user to reboot will solve the issue but may take a few reboots. Another fix is to get the user to connect to another wifi network, then reconnect to the original network connection.  This issue has been happening intermittently for different users for well over a year now and the fixes mentioned above usually resolve this. However, I now have a user, who has been unable to access the Internet all day, so I'm looking for any possible help.  This does seem like an identity issue, where FortiSSO is not picking up the logon event but I do know

This may be a trivial question but I assumed incorrectly that the "Completed On" field in the tasks module would automatically populate once a Task was marked as completed but currently it doesn't. Do I need to create a separate playbook to update this or is there a simpler answer?Thanks, Nelson