Solved

Hi, I have successfully connected a main office to a branch office using a VXLAN over an IPSec tunnel. The tunnel is connected at each end to a soft switch, which also contains a physical LAN port. Everything appears to work correctly from the branch office; however, the main office is having issues accessing certain websites. These websites can be accessed from the branch office without issue. If the tunnel is removed from the soft switch in the main office there is no issue accessing the websites from the main office.I found the following article which describes the situation: VXLAN interface impact on software switch... - Fortinet Community. Based on the article I set honor-df to disable which appears to have corrected the problem but am not sure if this will have other ramifications across the network. Is this the best way to correct this problem, of is there another solution?Thanks in advance for any help.Regards Robert Andrews

I would like to create a link between a warehouse and the main office. The main office has a Fortigate 61E and the warehouse a Fortigate 40F. Essentially, I would like to bridge the warehouse and main office in a way such that one port on the 40F is the main office network. They are installing a security system in the warehouse and would like to use the controller in the main office rather than installing a separate controller in the warehouse. The requirement is that the controller and all security devices are the same subnet. There are no servers etc. in the warehouse, only two workstations which would also need to authenticate against an AD server in the main office. I have tried various combinations of site-to-site VPNS without success. Is this at all possible? Thanks for any help. Kind RegardsRobert Andrews

Hello, I have a problem with the stability of the IPsec tunnel between two Fortigate 40F, on both the system version is 7.4.3. The tunnel can work for a few days without a problem, and then it becomes very unstable, you can see large ping fluctuations, packet losses, sometimes it will return to slight stability, but you can still see that the pings are a bit higher than normal. The problem is solved by re-establishing phase 2. Both locations have fast and stable fiber optic connections from the same provider. There are no errors in the logs on both sides, for Fortigate the tunnel is stable.In the first screenshot, the red line indicates the moment when the tunnel stabilizes after the problems, and the green line indicates when I re-establish phase 2, the pings are immediately smaller and more stable. The second screenshot shows the moment of jerking and switching to the backup SD-WAN tunnel. I will add that the problem occurred even when only one IPsec tunnel was establi

Hello I want to know where can I have see a complete course of nse 4 on the site of fortinet please. the official course on fortinet. How can I Schedule my exam thanks.

Hi, I'm new to Fortigate and this week got my WF-81F-2R-A and it works great, using SSL VPN perfectly on the free FortiClient VPN on Linux. For added security I created a certificate inside my Fortigate with 'LetsEncrypt' and put it in my Fortigate's VPN Settings with no problem. Then I tried to put that certificate in the free FortiClient, and no matter what I can't see the certificates to load. Am I doing something wrong or is the software intentionally misbehaving without courtesy of an error or warning message? I looked all day online for an explanation or guide. All I ever see is "press the Import Certificate button to import a certificate" kinda stuff. Thanks for any assistance,B83

How do get the icons in Predefined Internet Services to show in color?, I have another 80Fand the Predefined Internet Services are display in color .I have include a screen shot for easily of reference. Thanks Regards 

Hello guys!I'm deploying FortiNAC and facing a problem that I want to know if this proceed or not. The Registration Interface are providing IP by DHCP to new PCs correctly, but I'm trying to do simple ping from new PC with Registration IP to the Management IP of FortiNAC and this do not reply. But if I do ping from the FortiNAC to the same PC with Registration IP it gets replies. Is this normal behavior natively on FortiNAC? Or do I need to setup something to permit this ping replies?

On the Fortigate under SSL-VPN Settings you need to specify an Address Range.  But you also need to do the same thing under SSL-VPN Portals Source IP Pools.  Presumably if you have multiple portals each one would have their own IP pool.  So why are you forced to enter in the range twice?

Good Day Guys, I am having a problem accessing the SDWAN rules on my Fortigate 200F. This happened before, restarted the device but this time round after restarting it, still not working. Any suggestions?Spinning Wheel. Nothing happens.

This is my first time using Fortimail and I have to admit, this system has a lot of bugs/issues, a bit unstable. The VM/webadmin tends to freeze at times. I once lost an entire configuration, where the vm was reset thus losing its 1 yr license/expired, I had to turn on udp to reapply 1yr license to get the VM up. Now the VM upon starting in Hyper-V is broken. I need to replicate this Fortimail VM for redundancy, but I will not replicate a broken VM. Additionally, there are other VMs on the same host comprising Fortimail and they are working fine i.e. checkpoint creation/removals, replication etc can be done.Can i get some assistance?

When I visit https://219.148.36.28, due to anti-ddos device protection, the website always responds with an incorrect syn+ack for the first time. If the client can respond with rst, it is considered normal. When I was in the company, the fortigate version was 4.0. When foritgate received the wrong syn+ack packet, fortigate would discard the packet. Now I set up an environment to test the“ anti-relay” function，Refer to the cli manual description. When anti-replay is set to strict, syn+ack packets with incorrect sequence numbers should be drop. However, when I tested, fortigate did not drop the wrong syn+ack packets，but forward this packet . Why don not drop the wrong seq packet? I debugged and saw that there was a debug saying This can be a challenge ack packet. What does this mean?1. My topology is as follows2. debug info3. fortigate sniff4. config system global ,set anti-replay strict5. firewall policy ,set anti-relay enable 6. only how one firewall policy 

I am testing out client based ssl-vpn using SAML Auth.  When I debug saml on the fortigate I see that group that comes back from SAML is correct but I am getting added to the wrong portal.  I have users group configured as per https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/azure-administration-guide/584456/configuring-saml-sso-login-for-ssl-vpn-with-entra-id-acting-as-saml-idp with:config user groupedit FortiGateAccessset member azureconfig matchedit 1set server-name azureset group-name <object ID>nextendnextend How does the fortigate relate the group name to the portal name?

Hello community,I need help hiding the WAN IP of my FortiGate, using proxy services like Cloudflare. I have currently set up my FortiGate with a subdomain (mifirewall.mypage.com) and an SSL certificate from Let's Encrypt, which works perfectly in DNS mode with Cloudflare. However, when I switch to proxy mode to enhance security and hide the IP, the system stops functioning as expected.Additionally, this configuration with Cloudflare is used not only for managing the device but also as the address for SSL VPN clients. This makes it crucial to maintain constant functionality and accessibility through Cloudflare.Has anyone faced a similar problem when activating proxy mode in Cloudflare? How did you resolve it? I am particularly interested in knowing if there are specific configurations or adjustments I could apply to solve this issue.Thank you for your time and assistance.

Hi FortiGate adminsAny one used the "none" interface as SD-WAN member?I wonder if we can use it like a black hole, like when we don't want to route some traffic through any SD-WAN members when some SD-WAN members are down (not to fall in the implicit SD-WAN rule). I know we can do that with firewall policies but I wonder if we can do it at SD-WAN rules level.

Hi,Can anyone confirm me the SKU below support 1GB/Day of Log ? or more ?and how much Capacity ?SKU : FC-10-0081F-585-02-DDDesignation : FortiAnalyzer Cloud: cloud-Based central logging & analytics. Include All FortiGate log types, IOC Service, Security Automation Service and FortiGuard Outbreak Detection Service. Thanks

Hi,I try to implement site to site vpn between 2 Fortigate in my lab but I got this error on both side : ike Negotiate ISAKMP SA Error: ike 0:ffd4573d1a2ff133/0000000000000000:220: no SA proposal chosen Commands output :Hub # show vpn ipsec phase1-interfaceconfig vpn ipsec phase1-interfaceedit "VPN-to-spoke"set interface "port2"set peertype anyset net-device disableset proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1set comments "VPN: VPN-to-spoke (Created by VPN wizard)"set wizard-type static-fortigateset remote-gw Spoke_IPset psksecret ENC pkX9mSvmif/AZCPktG9xlCHmSNyAmQ2L3IigVETGNrOEVgH1t22s1u6cEl2aLk+V/WMJn7Qnm246 TgPqCL6nchuxAdm0bbBpKQvAODxUp72Vfror9YyanMzw2iwhFEIG2KABhJnUGGgkIWql3lxk0SUmefRrVdRahgC2HLiGJ0+TaqhF3U sjhCTKE5K6zP4ACd1yCQ==nextendHub # show vpn ipsec phase2-interfaceconfig vpn ipsec phase2-interfaceedit "VPN-to-spoke"set phase1name "VPN-to-spoke"set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20p oly1305s

i try to login via a python script, after some struggeling with the certificates i get a return code 200.but when i try to parse the return value it's not a json object (or structure) it's html. login-request and check response: response = requests.post(loginURL, json=login_data)print(f"response status code : {response.status_code}")if response.status_code == 200:print(response.text)try: json_data = response.json() for key in json_data: print(key)except ValueError as e: print("some ERROR raised:") print(e) and the print of the response ist html:<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>FortiSandbox</title><base href="/ng/"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="icon" type="image/x-icon" href="favicon.ico"><style>@charset "UTF-8";body{font-family:Lato,Helvetica,Arial,sans-serif}body{font-weight:var(--nu-theme-dimension-norm

Hello,I am trying to setup a IPSec VPN tunnel between a Fortigate VM and a Cisco ASAv in GNS3. I have multiple subnets behind the Fortigate and one subnet behind the ASA. When I create a IPSec tunnel on the Fortigate, I use a group-object with all the local subnets from the Fortigate as the local-network at the phase 2 selectors.When the tunnel is configured at both ends, the fortigate lists the IPSec tunnel, but the phase 2 tunnel is not up all the way. Only one subnet is listed up and the other subnets are down. I found the following Technical Tip where they say that I need to create multiple phase 2 selectors for each local subnet from the Fortigate.How to configure VPN for multiple subnets - Fortinet CommunityWhen I do this, the VPN works as it should. But is there a way to only need one phase 2 selector for every local subnet? Or do I need to make a selector for every subnet that needs to be allowed over the VPN?Kind regards,Jeffrey

Dear seniors：Does anyone know if FG-90G has ACL policy function?For example, the command of "config firewall acl"Is this function only available for models above 100?Thank you very much if anyone can give a definite answer(It would be better to have screenshots) 

This issue has been discussed in may ways and referred to in post such as this: https://forum.fortinet.com/tm.aspx?m=119883#183227 But I wanted to see if anyone has any remaining ideas. To set the stage, in a proper Windows AD environment, DNS integrated with AD only allows secure updates from an authorized DHCP server that allocates IPs from one or more pools assigned to one or more subnets.  Authenticated clients can also have their NICs configured to register in DNS, but Microsoft suggests this isn't a good option: https://support.microsoft.com/en-us/help/2933537/clearing-the-register-this-connection-s-addresses-in-dns-option-does-n This requires a proper understanding of scope and DNS options such as lease time and scavenging.  I read a lot of posts by folks who don't understand how this works, such as setting the lease or scavenging time too low.  More info here: https://blogs.msmvps.com/acefekay/2016/08/13/dynamic-dns-updates-how-to-ge

i want to config "set anti-replay strict" ,but when i show this configure,But when I checked the configuration, I couldn't find the content of my configuration. Is it due to VM licensing reasons? Or is it a problem with my configuration? If it's a configuration issue, how should I configure it

I am struggling a little here to figure out realms and the best way to have policies, the documentation says the realm name should match the domain? well that isnt true, you can call your Realm anything, as I have, so why does it state this? The realm to me, is just the AUTH mechanism is it not? The reason I ask is, I have a realm called "bob" and that used an LDAP server and chained with an additional RSA server to allow SSLVPN users, this all works fine (hence my question on the name of the realm being irrelevant) I now need to add a Policy for WIFI users, that uses the same LDAP server but not chaining, so I create a new realm called "fred" and just untick the chaining, the policy looks for the Radius Attr of SSID and then looks up LDAP as normal, is this the right way to do it? if not? why not!  

I need some help.  I am tying to register my FortiClients using their individual invitation codes to FortiClient EMS Cloud.  In FortiClient EMS Cloud I am using SAML to our ADFS host.  I have provided the config the CERT to the ADFS host.  In the Relaying Party Trust I have Encryption as blank (no cert).  Under Signature I have the ADFS cert again. The error the end user is getting is this:  Error with SAML configuration settings: Signature validation failed. SAML Response rejected, invalid_responsePlease notify your EMS Administrator for assistance. In the Python Debug log I am seeing this:2024-04-01 06:29:04,767 INFO request_handler POST /fct_saml/iwn8nrmm3e/acs ems-1808417.forticlient-emsproxy.forticloud.com Default application/x-www-form-urlencoded manual2024-04-01 06:29:04,788 DEBUG ems_logger 6 6 Error with SAML configuration settings: Signature validation failed. SAML Response rejected, invalid_response2024-04-01 06:29:04,917 INFO req

As the title says, switching between certificate-inspection, deep-inspection and custom-deep-inspection does not help load most common & reputable (both international and Vietnamese) websites on either Microsoft Edge or Google Chrome, such as:office.comvietcombank.com.vnbidv.com.vnvnexpress.netSetting the SSL/SSH inspection profile to no-inspection makes it work with one exclamation on the policy rule.Is there any idea about this?

Hello, I would like to ask you because I am in the process of configuring a Fortigate 40F where I have a port which goes to a switch with TAGs (vlan). But I would like to define another port of the Fortigate with the same TAG (vlan) which goes to another managed switch. How can I define a second port with the same vlans? A big thank you to you. Olivier