Solved

Hey all, Fortigate 81f with 7.0.14 Attempting to get SSLVPN SSO working with Microsoft Entra ID.  The process is failing before getting any type of login prompt. Testing from the FortiClient I get "The response from https://vpn.domain.com was invalid."Testing from the Test option within Entra ID I get - Access Denied (from https://vpn.domain.com page) I've double checked all the URL's between the Entra ID application and the saml config.  The SSO group on the Fortigate is in the firewall policy. Sanitised config:config user saml edit "Entra ID VPN" set entity-id "http://vpn.domain.com/remote/saml/metadata/" set single-sign-on-url "https://vpn.domain.com/remote/saml/?acs" set single-logout-url "https://vpn.domain.com/remote/saml/?sls" set idp-entity-id "https://sts.windows.net/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxx/" set idp-single-sign-on-url "https://login.microsoftonline.com/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxx/saml2" set idp-single-logout-url

Hi all,Wondering if anyone has any suggestions for dealing with 429 Rate Limit exceeded messages when using the Crowdstrike connector. I run multiple enrichment automations using different Crowdstrike actions and they often trigger the rate limiting error below:{"Error message": "HTTP Status Code 429: Too Many Requests Details:API rate limit exceeded. Connector :: crowd-strike-falconV2.3.1","failed_step_id": 530078,"failed_workflow_id": 68102,"status": "failed","execution_time": "42 seconds 480 ms"}I'm wondering how to approach this, perhaps using a "do until" loop to check to make sure status is not failed?Any help would be greatly appreciated, thanks!

Hi All.I have a 100F device (6.2.8) setup for SSL VPN for remote connections using the VPN-only forticlient.  Windows works perfectly.  MacOS does not!  The VPN shows "Connecting" and then simply goes back to no message.  There are no errors.  The VPN does not connect.  Mac = Big Sur 11.4Forticlient = 7.0.1.0060 Facts:- the VPN actually connects and authenticates.  Logs show this.  Also, putting in fake login details generates an client error for the wrong user/pass.  The correct user/pass generates no messages.  It connects but then for reasons unknown gets disconnected. Fortigate Logs:[263:root:42]got SNI server name: vpn.ourdomain.systems realm (null) [263:root:42]client cert requirement: no [263:root:42]SSL state:SSLv3/TLS read client hello (49.178.7.112) [263:root:42]SSL state:SSLv3/TLS write server hello (49.178.7.112) [263:root:42]SSL state:TLSv1.3 write encrypted extensions (49.178.7.112) [263:root:42]SSL state:S

Hi Support, Got a question regarding the Android ForticlientEMS 7.2.2. On 12 march we saw a message regarding ForticlientEMS 7.2.2 having a vulnerability. (See link under)All of our EMS client have been updated to the latest version 7.2.4. Now is my question, when will the Android app be updated to the latest version because from what i can see is that this version on the App store is 7.2.2.0127.And second question, does this vulnerability also apply to the Android FortiEMS? Link:PSIRT | FortiGuard LabsFortiClient - Apps on Google Play Kind regards, Dennis Zaan

Dear Team  Im having issues with RDP Firewall Policies and accessing the Web Gui of Fortigate. This is my WAN to LAN network from the Host Machine to Guest. Im accessing the Firewall from the Host Machine (DMZ network).I have created a Firewall policy for my Windows RDP Server as follows :          From: WAN(192.168.2.47) To: LAN(10.10.10.1) Source: All Destination: RDP Server Virtual IP External Network: 0.0.0.0 mapped to 10.10.10.22 (Windows Server) External Port: 3389 MappedtoPort: 3389 SERVICE: RDP NAT : ENABLED AV: default SSL: deep-inspection            The Issue with it is once i enable the policy and Remote access to the Server, I loose access to the Firewall

Hello ,my fortiADC does not schow any traffic log in Log & Report -> Traffic Log., I already selected all the different filter but no log appears. I selected also all options in Log & Report -> Log Setting -> Local Log, but it also did not help. For now i can only see the Event Log. is that normal?

Hello,  I have a problem with disabling usernames that register on the Captive Portal create on my FortiAuthenticator.After the registration but before approval by an Administrator, if the user tries to authenticate with the credentials they registered with, the FortiAuth disables the user and the link that comes (with email) to Administrator or sponsor generates an error and cannot be approved.I have to go into management and reenable the user manualy.Any ideas to avoid this? Thank's

Hi allI am scratching my head for past days and would appreciate fellow community if anyone of you had similar experience.  I am trying to test multicast over Fortigate IPSec.Fortigate version 7.4.3 using EVE-NG VM Cisco IOL using EVE-NG   Diagram and configuration file is like this:https://drive.google.com/drive/folders/1vKQwaPGqhGTgDzZmf8rGQZHmeRi9vST5?usp=drive_link  R6 join IGMP 224.5.5.5 using Lo0 (192.168.11.1)R7 try to send ping 224.5.5.5 from Lo1 (192.168.22.1) Fortigate configuration follow this:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Multicast-traffic-over-site-to-site-IPsec-VPN-with/ta-p/194209#:~:text=set%20multicast-forward%20disable%20set%20multicast-ttl-notchange%20enable%20set%20gui-multicast-policy,mode%3A%20%23%20config%20router%20multicast%20set%20multicast-routing%20enable with addition that I found out that I need to enable PIM at port 3 (connecting to cisco router). By doing this, the router and t

Hi all. Odd issue. When connecting on one of my laptops, the VPN won't connect. Password is accepted and token is requested. When token is entered, the login screen resets as if nothing happened. No error message and the connection fails. Intel MacBook air running latest version of Foritclient on Monterey.  Thanks!

I'm working with a FortiGate 100F and attempting to migrate 10 VLANs from port5 to a newly created virtual switch. My goal is to preserve all existing configurations, including policies and routing tied to these VLANs, during the migration. I've tried editing the backup configuration file to replace port5 with the virtual switch's name and re-upload it, but after doing so, all my VLANs vanished from the configuration. I ensured that syntax and references were correctly maintained in the edit.Has anyone successfully completed a similar migration, or can provide insights on how to retain VLAN configurations when moving to a virtual switch? Are there specific steps or considerations in the FortiGate setup to prevent the loss of VLAN configurations during such a process?

Dear teamIm having an issue with Fotigate Firewall VM64, im creating a LAN-to-all policy for internet access but cant set addresses at Source:10.10.10.0/32 for my VM computers(windows 10). i have to set it as 0.0.0.0 0.0.0.0 for it to work. any insight on the same? Regards....

Good day family, Could someone assist in telling me the actual port numbers to open on my fwl to allow management/communication between a dmz server (in front of the fwl) and forticlient ems(behind fwl). Been researching, but a bit overwhelmed.

Hi I have upgraded a cluster (which isn't in production yet) to 7.2.8. Both firewalls are now on 7.2.8 but sync is failing due to a mismatch in certificate.ca running diagnose sys ha checksum show global certificate.ca on both reveals a few differences in the hashes for example Atos_TrustedRoot_Root_CA_ECC_TLS_2021CommScope_Public_Trust_ECC_Root-01 Most are the same there's about 10 that are not was wondering the best way to resolve this  thanks 

Please guide me to block an IP 10.84.161.2 in the same vlan. I have created the rule as above but machines in the same vlan can still see each other. Please help me 

Hi youI'm using FG v7.4.3, I created a file filter to block downloading of .exe files, but users can still download the .exe file, specifically the Chrome installation file, specifically its file is ChromeSetup.exe 

We just placed an order for 10 of the FS-148E-POE switches.  We want to connect the switches together using SFP connectors and fiber patch cables.  My problem is selecting the correct SFP transceiver and the correct MM fiber patch cable.  I AM waiting for Fortigate pre-sales support to reply, but I thought I'd post here in the even that someone may have some expertise on that. So, ten FS-148E-POE and I need to know the right SFP transceiver and MM fiber patch cables to connect all of these switches together. Thank you

Hello Everybody, I have a big problem on my hands. I currently use the fortigates network with version #7.0.14M and the objective is to migrate to version 7.2.8M. However, I have a problem, because we use Hardware Switch and also software swit   My problem is when I upgrade to the desired version, the hardware switch stops working, if the sub interfaces are members of the software switch. If you remove it from the software switch, the vlan interfaces are UP. In the switch software, they are DOWNAny tips?

Hi,I'm using FotiOS 7.0.14Behind my Fortigate cluster i have running multimple web services with separate public IPs.When DOS threshlds are triggered Fortigate starts blocking source IPs including those that belongs to our Pingdom monitoring.Since quarantine is global it also influence other applications.Is there a way to configure quarantines per project or public IP? 

Hi, Assistance with a network configuration. We have two internet modems in our current setup: 1. A fiber connection linked to the Forti WAN port.2. A DIA with a static IP connected to Forti port number 4. The internet is functioning correctly from the WAN port, now we need the user login to specified sites accessed exclusively through port number 4. Modem: FortiWiFi 30EFirmware: v6.2.15 build1378 (GA)

When the Fortimanager was loaded, it was done after loading the Network, so they were left in a single address group, several mappings per device, they asked to add a new address, I wanted to know what would happen if per-mapping was disabled.

Hi,I am trying to create "Overlapping subnets for a VPN tunnel" The VPN is UP, but there is no traffic flowing through Tunnel.I have create Policies but when I checked the Route table, there was no Static Route created by the Wizard, I tried recreating the Tunnel still no Route... Created "Custom", "The remote Site behind NAT" etc. etc. Its not creating Static route.I tried manually creating static routes still no traffic flow.Remote LAN: 10.20.30.0/24Nated IP: 100.100.100.100Gateway : 70.70.70.70Local LAN, 192.168.45.0/24Any help/pointers will be appreciatedThank you

What filters need to be enabled to transfer the source IP address devname = "device_fortigate" on log forwarding? logver = 604145463 timestamp = 1705406294 devname = "device_fortigate" devid = "FG" vd = "root" date = 2024 - 01 - 16 time = 14: 58: 14 eventtime = 1705406295007253541 tz = "" logid = "15010500" type = "utm" subtype = "dns" eventtype = "dns-response" level = "warning" policyid = 459 sessionid = 1734461551 srcip = IP srcport =  srcintf = "DMZ01" srcintfrole = "dmz" dstip = IP dstport =  dstintf = "DC-Transport" dstintfrole = "lan" proto = 17 profile = "DNS-Log" xid = 25739 qname = "" qtype = "A" qtypeval = 1 qclass = "IN" ipaddr = "127.0.0.1" msg = "A rating error occurs" action = "pass" cat = 255 catdesc = "Unknown" error = "no available Fortiguard SDNS servers" 

HiWe're currently trying FortiNAC v7.2.5.0101, everything runs smoothly for most of our devices except for Meraki AP. We follow this guide for configuring/adding the AP https://docs.fortinet.com/document/fortinac-f/7.2.0/network-device-modeling/785561/cisco-meraki-ms-switch Indeed, even though SNMPv3 is enabled on our Meraki oraganization and so AP ( snmpwalk -v3 is ok) FortiNAC always throws an error while trying to add it using S/N as UserName and API Key as Password as you can see below: From a firewall perspective we got not deny or any filtering, proof is we can add the same AP using SNMPv2c for instance. From a FortiNAC perspective, there's no such log or information that may helps to troubleshoot this. Any of you guys succeed to use SNMPv3 between FortiNAC and Meraki ?Thanks a lot for your help & advices FortiNAC     

test

I want to use ADOM Global Database create firewall policy, then assigned to multiple root ADOM device's policy package.So first step, I want to normalize interface on the global database, then I create firewall policy could easily identify multiple devices physical interface name mapping.But I can't normalized interface on the ADOM global databaseOr have any suggestions? Thanks.