Solved

Hello FG adminsCould there be any kind of problem if FortiGate in NAT mode sees the same MAC addresses through two independent interfaces?This is not common at all but can happen when you have for some reason one host with one NIC connected to a L2 switch connected to 2 different interfaces on FG.

I have 3 Site A B C using FortiGate-VM (7.0 & 7.2). Three Site using 3 Ip Public for VPN gateway.IPsec Tunnel between A <-> B is Up and running.And I create another Tunnel A <-> C, But the Wizard show "Unable to setup VPN. The rollback process has encountered an error. Orphaned objects may still exist in the configuration database".

We recently acquired Next-Generation Security Licenses.  I have a couple of questions:1.  How do I assign the licenses to my endpoints2.  In the Feature Select tab, everything is grayed out and says "some features below are disabled because they are unlicensed. . . "  How will I enable these since I already have the licenses? Thanks!

Hi All,  CCTV Company is attempting to gain access to their equipment on port 10000 on a public IP on site, however they are telling me port 10000 is blocked. I have an allow any any with no services specified on the Fortigate so it should be passing through. It does work on port 554 however, and I can telnet on port 554 from the Fortigate which shows as open, but not on 10000, and the CCTV company have informed me their device is 100% listening on port 10000 etc.When I ran a debug I got the below: - Elite_Brenntag_Lutte~4JA # execute telnet 88.202.173.10 10000Trying 88.202.173.10...id=65308 trace_id=1 func=print_pkt_detail line=5868 msg="vd-root:1 received a packet(proto=6, 88.202.173.9:18559->88.202.173.10:10000) tun_id=0.0.0.0 from local. flag [S], seq 168818775, ack 0, win 65535"id=65308 trace_id=1 func=init_ip_session_common line=6049 msg="allocate a new session-017937de, tun_id=0.0.0.0"id=65308 trace_id=2 func=print_pkt_detail line=5868 msg="vd-root:1 recei

Hi there, bit of a noob here, thanks for your understanding in advance :) The hardware: Fortiwifi 60f, FS148OE Switch. The switch is connected via FortiLink and has been authorizes and is showing as online. I have the gate with a few rules, a VLAN for the switch ports on 10.2.2.0/24 I have setup a IPSEC remote vpn (split). The VPN can connect no problem and is getting IP and DNS from VPN (using Forti client).My issue is that I can access network resources - cannot ping either way.Let me know if more info is needed.... Policy as follows:config firewall policyedit 13set name "vpn_IPSEC_VPN_remote_0"set srcintf "IPSEC_VPN"set dstintf "INSIDE_FortiSwitch"   --->(10.2.2.0/24)set action acceptset srcaddr "IPSEC_VPN_range"set dstaddr "all"set schedule "always"set service "ALL"set logtraffic allset nat enableset comments "VPN: IPSEC_VPN (Created by VPN wizard)"nextend THE VPN:IP Version IP v4Incoming Interface: VOIP_HQ_WAN (WAN-UFB)Use

Hi,In our previous NG-Firewall solution we had an option to create firewall rules filtering based on a user or a group from Active Directory. We simply had an agent that transmited the user and group membership data to the firewall so the firewall could decide based on logged user from the workstation, its group membership and application proccess trying to access the destination. FortiGate has this functionality, but we are considering potencial licensing issues. I know that FortiAuthenticator provides this functionality as well as a lot more, but it is licensed per user or device on top of FortiGuard and FortiCare. Can we use menctioned functionality as its base without FortiAuthenticator and avoid aditional cost or it is required to buy FortiAuthenticator to be able to place AD user or group as source or destination firewall rule? Also, will those AD and App based rules work with Free FortiClient when a user is authenticated to the VPN?

Hey guys, so this looks like a bug but maybe someone has an idea... :)We have a FortiGate-1500D version 7.2.7 with VDOMs enabled. I created an automation task to do a backup via tftp. The backup executes the following CLI script:config globalexecute backup full-config tftp foldername/%%devname%%-%%date%%.conf 1.2.3.4The task and export itself works, however I just noticed that the content of the backup is not correct. It contains only all the interfaces from the root VDOM and their whole default config, no firewalls rules from the production vdoms, no objects etc.Now the super weird part: When I execute the CLI script manually with my hand in the CLI, it creates a correct backup full with all the necessary configurations and VDOMs etc.The exact same backup automation stitch with the same CLI script (copy+paste) also works on other Firewall, a 100F with also 7.2.7. The only visible difference for me is in the fourth line in each of the correct and incorrect backup files:Correct bac

Hello fellow Fortinet people. We have a new Fortigate Cluster (AP) with VDOMs enabled (our first Cluster with VDOM config). Now of course we want to monitore both firewalls seperately. Until now we always used the IP addresses of the dedicated management interfaces. However I just learned the following two limitations of Fortigates:«To get SNMP working with VDOM enabled: Make sure that the interface where the SNMP collector connects to is part of the management VDOM.»«Note: Dedicated management ports on a HA Cluster will not be part of any VDOM.»Now from my understanding this means we cannot use the dedicated management interfaces (which are excluded from the HA). Does anyone of you has the same config and if yes, how do you monitor both firewall seperate?

Hi All, I am trying to have Dual Hubs for my spoke. I just set up Hub A using the built-in Wizard of Fortigate.All branches and Hub A are working well on day one. We are going to have a new Firewall at DataCenter as DR second Hub now. All traffic will only go through Hub A and only use Hub B if my Hub A goes offline. To achieve this, we set up the route-map-out for both Hub A and B BGP settings. The metric for Site A is 5, and Hub B is 100. We tested the connection, Both Hubs VPN up and seem good for traffic. We tried to shut down Hub A VPN then, all traffic was routed to Hub B. When Hub A resumed, we found that the Branch learned BGP from A again and the Metric is 5. However, the route with Metric 100 from B is still the best path for the branch and does not go through the Hub A.  Please advise.

We are looking for the power draw for the 401E, for the DC.

Good morning friends, a question:In fortigate I have two tokens available, the ones that come by default. I need to assign those tokens to two users, but when I assign the token I get an error message (image).The FG version is 7.2.8, could it be a bug in the version?   

I am getting lost with all the certs so can someone please help me.  While I have System SAML SSO logins working I noticed that one of the certs involved I have no clue where it came from.  So I am trying to understand which cert is needed where. On the FortiGate:SAML SSO SP Cert: I am guessing this should be the cert of the SP.  If the SP Address is john.com the cert should be the cert+key of john.com.SAML SSO IdP cert: This should be the cert of the IdP (imported as a remote cert).  In my case the ADFS server. On the ADFS Server:Matching Relaying party trust Encryption: ADFS CertMatching Relaying party trust Signature: ADFS Cert Does this sound correct?

Hi,I want to know what are the impacts to existing dial-up clients when I extend/expand the netmask (say from 255.255.255.0 to 255.255.252.0) in dynamic Dial-Up VPN IPSec on the Hub?Maybe someone can give insight about this. Thank youAri

Hi, I have a FortiGate SSL VPN setup in full tunnel which is working but when a remote user is connected via the VPN I am unable to access the remote computer via its VPN DHCP IP for the local Lan. Do I just need to setup a firewall policy from the local lan -> ssl.root or is there more to it?   

Hi Today I upgraded my fgt to 7.4.2 version but on sdwan rules page it does not show anything. In cli i can see my sdwan rules. What is wrong?

Hello! Currently we are looking to create an API with the support portal (device inventory).To setup the correct API we need some documentation but the are behind the Developer Network.Is there any way to access the link from the following documentation? We are not able to access the developer network. It's about the FortiOS REST API documentation. https://docs.fortinet.com/document/fortigate-cloud/24.1.0/administration-guide/557024/api-accesshttps://fndn.fortinet.net/index.php?/fortiapi/1-fortios/ Best regards,Tim

 Hi GuysI've been planning an outdoor network, and I have a doubt about the installation of 432F. Is this AP designed to be built on ceiling or on wall/pole? The radiation pattern on Fortinet docs seems this AP in a ceiling position. Do you think in terms of outdoor environments, this pattern will change in case of installing this AP on pole at 4/5 meters high?  I appreciate your time in advance. RegardsEstéfano A.  

Install & configure step by step:Install FortiClient VPN 7.x (7.0.9 and 7.2.4) onto macOS CatalAllow fctservctl2 and FortiClient with Full Disk Access permission in Security & PrivacyLaunch FortiClient for the first time and accept the termsAdd a new IPSec VPN profileEnter username and passwordConnectThe dashboard show status "VPN Connected" but there is no connection actually. On the other hand, the version 6.4.9 works perfectly. Any idea that it is a bug or FortiClient 7 has dropped support for Catalina?

 Greetings,I should configure a WiFi SSID on a UniFi Controller that performs redirects to a Captive Portal on a FortiGate so that the users are picked up by a FortiAuthenticator. In particular:Users connect to an SSID issued by the Unifi Controller.As soon as the user connects, a FortiGate Captive Portal should appear and read the users from the FortiAuthenticator.After user login, he can go Online.It can be done?If that's not possible, I was thinking about:SSID without passwordCaptive Portal on the FortiGate interface (which would also be the gw of the users connected via WiFi)Authentication on the FortiGate Captive Portal with users drawn from the FortiAuthenticator.Thank you very much for helping.

Hello, I fail in connecting a FG-200F v7.2.4 to FortiClient EMS cloud. In "Fabric Connectors" -> "Connection status" it reads: FortiGate not authorized, but in FortiClient EMS cloud neither the Authorization pop-up is displayed nor occurs the device in EMS cloud Administration -> Fabric Devices.Does some know how to debug this?I am also searching for a how-to on registering a Fortigate by using a EMS cloud-generated Fortigate key by GUI or CLI. best regardsMartin Haneke

HiWe have some remote users with windows 7 and forticlient vpn app does not install on windows 7. I created a native l2tp vpn tunnel, it created 2 firewall policies automatically. I also want to have split tunneling enabled. When they connect via this tunnel, they can not connect to our internal network nor internet. What should i do to have access to internal networks and internet at the same time? Thanks.

good morning friends.Could you help me with this query.I have a virtual fortianalyzer and I notice that the ADOM License option indicates "unlicensed".Could you tell me what that option is for?On my Faz I have a synchronized FG. 

Hello teams,I have new installation of FortiSIEM Supervisor All in One, and my request is it's possible to configure NFS storage for event database and how to do this?best regards

Hello everyone, I'm somewhat new to FortiGate setup. I work in IT Security, and I'm currently creating a new policy on my FortiGate. This policy aims to limit social media usage within my company. I would like to know if it's possible to make an exception for guest devices when they connect to our network. In this case, I've configured a different segment IP from our office segment IP ?Note : This is my current setting

Hello Peoples,I am not a computer person, so type slowly so I can understand.In other words - please treat me with respect as I may not understand terminology.I have been through all my available IT resources and they have washed their hands with my problem which leaves me stuck.Last week, for no apparent reason (perhaps windows update?), my VPN connection to my university for my course stopped working. Being an external student in a remote area this is a problem.  On my PC workstation, over the course of the last week, I have now completely reimaged my machine with a clean win10 64 install.  I have updated all drivers - everything from motherboard chipset, PCI and network drivers.  I am running windows defender in standard config but no other security such as nortons.The symptoms are:1. Send connection request2. Receive MFA challenge3. Forticlient says connecting after MFA challenge4. Says connected, with bits received and correct IP address to host shown.5. No bits rec