Solved

I'm currently trying to troubleshoot the VPN tunnel why it won't work and what is missing for it to work. Problem is, I can't reach or have any connection to the dialup peer for the VPN. I only have a backup of the config so I can try to imitate the general configuration. The certificates that were used for the VPN have been imported to the local certificates in the Fortigate. The authentication from the peer were so:(Lancom-Router)Local Authentication: Digital-SignatureLocal Identity-Type: ASN. 1-DistinguishedLocal Identitity: /CN=Lancom-RouterRem. Authentication: Digital SignatureRem. Identity-Type: ASN. 1-DistinguishedRem. Identitity: /CN=UF-360Local Certificate: Lancom-Router-Cert(Fortigate)config vpn ipsec phase1-interfaceedit "Lancom-Router-VPN-CERT"set type dynamicset ike-version 2set authmethod signatureset net-device disableset localid "/CN=UF-360"set certificate "UF-360"set peer "Lancom-Router-Peer"nextendconfig user peeredit "Lancom-Router-Peer"set ca "CA_UF-360"set sub

We are using Forticlient EMS 7.2.3 and 7.2.3 and split-tunnel for certain traffic (MS Teams for example). To prevent accessing local services (NAS box for example) we enabled exclusive routing on our Fortigate 7.0.0 as per Enabling SSL VPN Full Tunnel - Fortinet Community. However, we can still access local resources/services. 

Using Fortigate 6.412. Can the DNS Server feature support hosting SRV records? I see A and other record types in the UI but no SRV. 

Hi,I have two FG201F FortiGate devices connected via an IPsec tunnel, both running firmware version 7.0.15. The latency between the two FortiGates is approximately 17ms. The VPN's are configured in an SDWAN. Here is the problem:Server-A, located behind FG-A, needs to communicate with Server-B, which is located behind FG-B. FG-B uses an aggregated port combining interfaces X1 and X2, both of which are 10GB interfaces.When Server-A communicates with Server-B through the aggregated interface, the connection speed is only 20-30 Mbps. However, if I move the VLAN of Server-B to a non-aggregated port, such as Port 2 (which is a 1GB interface), the traffic speed increases significantly to 600-800 Mbps.Both interfaces are connected to a Dell N4032F stacked with an N4032. On the switch, the configuration is a simple port channel in active mode.It's noteworthy that if you connect from a server behind Port 2 (FG-B) to the VLAN behind the aggregated interface (also FG-B), you nearly achieve th

Hi,I have a Fortigate Cluster with several VDOMs.rootVDOM1VDOM2I connected the Fortigate cluster to a FortiAnalyzer. I created an ADOM1 in which I placed VDOM1.I want the admin of VDOM1 to be able to see system and traffic logs. I'm not able to do this actually, the "FortiView">Traffic option is grayed out.How can I fix this?Thank you for your help!

I'm looking for some best practices for setting the 'starting default' wired switchport vlans when deploying NAC. What is reccommended for each of these cases ?a) dead end VLAN with zero access ?b) guest network VLAN that denies access to any corporate resources ?c) a isolation vlan with a captive portal ? 1) Switchports configured for 802.1x used by corporate computer access. I have a NAC policy to identify 802.1x/TLS cert auth and change the port to a 'prod' vlan.  2) Switchports dedicated to IOT devices. Device profiling will trigger a access policy to put these devices in the right vlan like camera, door badge systems, printers, etc. 3) Switchports dedicated for byod devices. Access policy will force the users into a registration portal w/ dissolveable agent.  Thanks for any insight.  

Hello team, i have the following problem when try to configuring SNMP on interface LAN (not MGMT dedicated) The monitoring system is reachable via ipsec tunnel. When I try to configure SNMP on the LAN interface, in the local firewall logs I see traffic but no return traffic.The strange thing is that the same policy correctly allows SNMP traffic as well as HTTPS traffic from the ipsec tunnel to the ip address of the interface on which SNMP is enabled. Thanks for the supportBR

Hi, What's the functionnality can do FortiWeb and we Can't do it with FortiADC With AI Security BDL 

Hello everyone,   I am using Fortigate 7.0.12 setting up SSL-VPN with Azure MFA using FortiClient mobile (7.2.0.0101) .   The setup works fine but gives a bad user experience for thousands of users on mobile (iOS and Android)  by throwing an error webpage which is trying to reach 127.0.0.1:8020 (Error: This site can't be reached 127.0.0.1 refused to connect). I do not expect the FortiClient to be running anything on port 8020, or should it?   This error webpage is shown during the SAML authentication flow, and once it is promptly closed the connection is authenticated and browsing is normal. Has anyone found a workaround for this or some pointers to avoid this redirect error webpage?   Some info I found online about this redirect:   #https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/364443/using-a-browser-as-an-external-user-agent-for-saml-authentication-in-an-ssl-vpn-connection   I was hoping I could change t

Kindly share the OID for Fortiweb-VM. Thank you.

Hello everyone,I am working with FortiNAC-F 7.4 and I have imported a Cisco Catalyst switch v3. The ports on the switch are in VLANs. I can read them on the device, but the problem is that I cannot retrieve certain endpoints on the ports. When I check the events on FortiNAC, I receive an error:SNMP Failure SNMP failed for device SW-INFO with message SNMP getNext/getBulk Failed for device: 10.30.5.0.2Can you please help me?FortiNAC 

I get this error when installing Fortinet SSO, what could be the reason? 

Hello, I'm trying to connect my FortiGate to FortiAnalyzer. My FortiAnalyzer(10.10.0.3) VM is in VLAN 10, directly connected to FortiGate A (10.10.0.254). I successfully connected FortiGate A to FortiAnalyzer. My problem is with FortiGate B. I created an IPsec tunnel between FortiGate A and FortiGate B and created rules (any to any) to allow traffic between VLAN 10 (A) and VLAN 40 (B), but I can't contact FortiAnalyzerfrom FortiGate B (10.40.0.254). On Fortigate B, if I want to ping FortiAnalyzer, I have to execute ping-options source 10.40.0.254. If I don't, it don't ping... Do you have any ideas? Thanks  ! 

Hi, I'm new in Fortinet world.I have set two lan on two different ports on my Fortigate 60s ,v7.2.8 build1639 (192.168.1.x and 192.168.21.x). But one of them is not able to go in internet. How have I to set the correct gateway on wan1, wich works for one of them?Thank you a lot 

I have a weird one. I was in the web interface, Policy & Objects, Addresses area, and I incorrectly added a filter on the "address" line rather than the column name. The filter condition was a "contains" and the value was 0, and that returned no data ("No results" shows in the arresses and address groups area). The bad news is that because there are no returned values, the spot where I put the filter can no longer be seen to undo the filter !  The filter persists after logging out and back in, also persists in VDOM change and return. It doesn't appear to be in the user profile information stored in the backup so I don't think I can manage it via CLI. Anyone with hints on how to clear it?Brett

Hi everyone, I need some help with an issue I’m encountering with my Fortigate setup. Setup Details:- Router: ZTE (configured in bridge mode)- Firewall: Fortigate Issue:Despite successfully configuring the ZTE router in bridge mode and connecting it to my Fortigate, the Fortigate is still receiving an internal IP address instead of a public IP. Additionally, my DDNS is only working within my local network. When I try to access it from outside over the internet, it doesn’t work. Steps I’ve Taken:1. Configured Bridge Mode:Verified that the ZTE router is set to bridge mode. 2. Fortigate WAN Interface: Configured the Fortigate WAN interface to obtain an IP address automatically via DHCP.3. MAC Address Cloning: Ensured the MAC address of the Fortigate is registered with my ISP (if required).4. Release and Renew IP: Attempted to release and renew the DHCP lease on the Fortigate WAN interface.5. Restarted Devices: Power cycled both the ZTE router and the Fortigate.&nb

Hi all,I have created a topology in the EVE-NG software where my FortiGate firewall is connected to a switch, and the switch is connected to the management cloud. Now I want to open my FortiGate firewall GUI in Chrome browser, but it’s not opening.FortiGate port 5: 192.168.100.16Gateway: 192.168.100.1(If I remove the static IP from port 5 and set it to DHCP, I can open the FortiGate GUI via the DHCP IP in Chrome.)Please help me.

Hi everyone, I've received an FCP FortiManager voucher from my organization. I'm wondering if it's possible to use this voucher code for the FortiCloud Security Administrator exam instead. If not, is it possible to exchange the voucher by opening a TAC? Thanks in advance for your help!

Hi everyoneI'm trying to setup a policy with virtual servers to divide the traffic from subdomain1.domain.com and subdomain2.domain.com to different synology nas. I set up the virtual servers: and then setup a policy: The problem is that i'm obtaining this error: What could be wrong? 

 Hello Expert, I have two 400E in a HA cluster .We use the default HA ports for Heartbeat interface but had to add redundancy using the lan port.(BR_DATA port8) After reviewing numerous documentation we found that this was not best practice since the lan port is heavy use for data.I would like to assigned a new deliciated port (24)  to be my  backup heartbeat and remove (BR_DATA (port8) but would need some guidance since this is a production environment.  Also to configure port 24 as heartbeat port are there any special configuration need prior to it being assigned . GuyOffice-1 (ha) # showconfig system haset group-name "trans_amt"set mode a-pset password g==????Swdeeset hbdev "ha" 200 "port8" 100set session-pickup enableset override disableset priority 200set monitor "port8"end Thank you 

Hello, I am new to FortiManager and have successfully imported my two devices and their respective VDOMs. I have placed a specific VDOM into a specific ADOM because I want my client to manage it autonomously.When I am in the specific ADOM, I can create a firewall rule without any issues. However, when I try to push the configuration to the Fortigate, the device is not found. Do you have any idea why this might be happening?   Thank you for your help!

Hello,I have the following setup:FG 60F at our HQ - LAN IP: 192.168.205.0/24FG 60F at our DC - LAN IP: 192.168.5.0/24L2TP clients connecting with Dial-up connection and getting IP from subnet 192.168.199.0/24HQ and DC are connected via site-to-site ipsec VPN and both subnets x.x.205.0/24 and x.x.5.0/24 can communicate. When I connect to HQ as a L2TP dialup user I can access the network on HQ x.x.205.0/24 but I cannot connect to DC. I add a policy on HQ which allows traffic from L2TP-VPN to DC but it is not working. Can anyone please help set this up so a dialup user will only have to connect to HQ to gain access also to DC?

 Hello,I'm having trouble configuring an SSL VPN on my FortiGate 40F device. I've been searching for the corresponding configuration tab, but I can't seem to locate it anywhere. I also checked the "Core" section under "Feature Visibility," but to no avail. My firmware version is 7.4.4.Could you please assist me in understanding why I'm unable to access the SSL VPN configuration? I greatly appreciate your help.Thank you,

Hello,I am in the process of learning and understanding FortiManager and what it can do for my FortiGates.    I have one FGT that I am working on that was in-sync with both Config and Policy.  I changed a policy object, added a local user and added it to a group, and proceeded to install the change to the FGT.  Upon review in the Installation preview it listed out a bunch of things that were going to be deleted on the FGT.  I did not make such config changes on the FMG nor did any of my co-workers.  The FGT had not been edited either, everything was in-sync prior to the changes on the FMG.   So... what mechanism determines what things are to be deleted? is there a way to see this in the GUI? can I alter this so that it doesn't delete things unless I say so?  is there a flag to check or something? Just trying to understand what this thing is doing so that I or my co-workers don't delete something important and so that I can exp

I have Fortimanager installed.  I added my fortigate devices and can see them in the Fortimanager but I can also see that when I make changes in Fortimanager to the Fortigates I do not see the changes reflected on the FortiGate.  I am also not seeing the logs from the fortigates on the Fortimanager even though its configured. Does anyone know of any good videos or the like showing how to add Fortigates to FM and how to manage the Fortigates in FM... I am running Forigates 7.4 and Fortimanager 7.2