Solved

Let's say my environment consists of 1 spoke and two hubs. All sites have at least 1 ISP. There is an MPLS link between each spoke and the hub, no MPLS between spokes.Spokes will route through the Hub via MPLS via OSPF to reach each other.If an MPLS link fails at the spoke, I'd like to IPSec to the Hub and other spokeIf an ISP link fails at a spoke, I want to use the underlying routing protocol to route through the Hub for internet traffic.In this scenario, should both the ISP and MPLS links be in the same SD-WAN zone like "underlay"? Or should they be separate zones like "mpls" and "isp" ?Looking for any best practices on how to create zones based on topology and use case.Don

Hello, does the linux forticlient 7.0.x support two factor authentication with the fortitoken app?If yes, what distributions are supported? GreetingsAndreas

Dear All, Need help for configuring Source IP on FortiAuthenticator to connect with FortiAnalyzer, I can't see any configuration to change source IP on FortiAuthenticator eventhough I am accessing via ssh, there is no available command to configure source IP. FortiAuthenticator using two ports (port1 & port2) default for communication with FortiAnalyzer is with port1. Can I change it to port2?I can see the setting in Fortigate but not with FortiAuthenticator. Please help to advice.FortiAuthenticator FortiAnalyzer 

Hi My Fortigate device OS version is 7.0.2.When I configure Azure AD SAML authentication with the documenthttps://docs.fortinet.com/document/fortigate/7.0.2/administration-guide/33053/outbound-firewall-authentication-with-azure-ad-as-a-saml-idp333Go to step 4,  The SAML IdP sends the SAML assertion containing the user and group. After the browser log in to azure, it seems that it can't return to FortiGate, Whether my identifier (entity ID) uses public IP or private IP.  it aways say:The connection has timed outAn error occurred during a connection to 192.168.11.1:1003.  Who can help me the possible problems? Thanks a  lot    

Hi Team,I have FSR7.3.x. I have installed and configured the Arbor DDoS connector in FSR. Now I want to block the IPs on Arbor DDoS through SOAR. But when I see the actions available in the connector, the Block IP or Block IoCs kind of action is not available. Kindly let me know if I want to block the IPs on Arbor through SOAR, how can I do this? I shall be extremely grateful. The version of the Arbor DDoS connector is:Arbor DDoSVersion 1.0.0-6388Certified: NoPublisher: Community The available actions are: GET ALERTSRetrieves a list of all DDoS alerts or specific alerts from Arbor DDoS, based on the search criteria you have specified. GET NETWORK SUMMARY REPORTRetrieves network summary reports from Arbor DDoS, using various filters such as the name of the customer associated with the report, the unit associated with the report, etc. you have specified. GET TOPTALKER REPORTRetrieves the top talker external or internal reports from Arbor DDoS, based on the r

I was tasked with leading a POC for the FortiEMS system to help manage our VPN already in place. A senior teammate set up the server months prior before I took this project and passed it off to me. I grabbed a clean install of Windows machine that is not on the domain and used that one to test on. The first install worked great, registered itself, and stayed online. Wanting to become proficient with the EMS server, I unregistered the device, deleted it from the EMS server, and then uninstalled it from the test machine. I recreated a new invite and now it refuses to connect.     I am looking for any FAQ or suggestions on how to troubleshoot this issue. Did I go about this incorrectly?

I have installed forticlient_vpn_7.2.2.0753_amd64.deb on a Debian  system and an unableto connect.  The forticlient gui starts and I configure the connection as instructed by the networkadministrator.  I have tried both Debian 11 and Debian 12 with the same results.  When I click "SAML Login" on the forticlient vpn screen showing the vpn name nothing happens.  No errors, no authentication popup, and no connection is made. main.log:[2024-02-22 10:33:19.561] [info] WindowManager handlePossibleProtocolLauncherArgs argv=["/opt/forticlient/gui/FortiClient-linux-x64/FortiClient"][2024-02-22 10:33:19.577] [info] WindowManager handleCreateMainWindow[2024-02-22 10:33:19.620] [info] MAIN MainWindow - createWindow Platform detected: fedora[2024-02-22 10:33:19.829] [info] web-contents-created contents.id=1[2024-02-22 10:33:19.906] [info] Saml - init[2024-02-22 10:33:19.907] [info] Saml - listenSamlLoginRequest[2024-02-22 10:33:20.486] [info] compliance configDir=/home

Hello team, i have a question about Netflow.Netflow is clear to me that it can be enabled on a network interface to track traffic either in RX or TX or both. I wanted to know if it is possible to enable netflow only for a certain type of traffic and not for all traffic to pass the interface where it is enabled.I looked in the official documentation but could not find anything about it. Thanks for the helpBR

I have SSID verification on fortigate firewall with Fortinac radius. I have a problem like this. Although there is mschapv2 in the radius settings, a user in the domain joins the network without any problems, while the user I created as a guest in the Fortinac interface Credentials Invalid (MSCHAP2) error, what is the reason for this? 

I have recently set up some SSL VPN Portals on a Fortigate, that are mapped to specific groups, the Fortigate is a Radius client from the FAC, The FAC uses LDAP to look up the user in AD, then looks at RSA for a token to authenticate the users.   All of the above is working abolutely fine, except for groups being passed to the Firewall to be used in the Portal mappings and Policies. I have to create a user on the Gate as a remote radius user, using the same name exactly that the FAC uses. this works... but some of the portals have 30-40 users. I had to create 30-40 individial users with the same name as the FAC.   Groups dont work in the same way, The documentation say you just create a Firewall Group with the same name on the Firewall, and make sure the FAC is sending the group-name attribute, which in my case it is., but it doesnt work, I have to switch back to using username. is this a bug?

I have a problem with Fortinac. Quarantine vlan defined in fortinac interfaceFortinac port 2 ip address10.10.24.100Quarantine vlan10.10.22.10-10.10.22-250I turned on vlan quarantine in Fortigate firewallGateway10.10.22.1DHCP relay 10.10.24.100When I do this, a user who enters the quarantine vlan gets ip without any problem.But my main problem is thisI have a domain and users log in with LDAP. However, in the quarantine vlan, the user cannot log in. It gives a domain error. If I manually enter the domain in the DNS section in the network settings, it gets better. But I cannot add DNS because DHCP distributes nac.How can I solve this?

Is there a way we can tell how much memory has been allocated to Fortiauthenticator VM. All I see is a System resource widget which tells me memory allocation not the total amount of memory and 'get system status' does not help either?  Tried looking in admin guide could not find any reference. 

I have 2 vlans named Nac vlan and quarantine vlan.The nac vlan is defined in Fortinac ethernet2. dhcp relay to the nac vlan is available in my quarantine vlan. the two vlans communicate with each other and with the active directory. However, I have a problem like this. a device that has just joined the network joins the quarantine vlan. although the quarantine vlan has communication with the active directory, I cannot get the device to the domain. when I enter the ip address of the active directory as dns to the device in quarantine, I can get the device to the domain. why could this problem be? or is there a place where I can enter dns under the quarantine vlan?

Hello, everyone,I would like some advice on how I could make a bridge of a LAN subnet over a WAN connection.I would like to use a GRE tunnel that succeeds through an IPSEC connection between the two FGTs the ability to reach hosts from the other site that share the same subnet. However, I have not found many examples of this configuration.Instead, I have seen a solution called Lan Extension that uses an IPSEC tunnel where VxLANs are carried. It is a solution that I see as very complicated to put on .Do you have experiences for this kind of needs and scenarios ?Thanks   Fabio

Hi, how is it possible to classify alerts coming from FortiSIEM (or coming from other)? I would like to be able to decide, based on the contents of a field, which playbook to activate. I can do this in a playbook that identifies the type of alerts and activates the corresponding subplaybooks. Is there a better way?

Hello,   We currently use a single VPN to get into our office, this VPN is using a software switch as the interface.   However, I need to create another VPN for a separate purpose (because I need to provide another subnet range to these special VPN clients). I have tried creating another VPN and I have added the same software switch as the interface, but I am unable to connect to this VPN.   This software interface has 1 main gateway IP and 4 secondary external IP addresses.   How can I implement this second VPN?   Thanks    

Hi community! I've been using the FAZ handlers and they've been a great help. I am trying to exclude the notifications for a specific network, so according to documentation it has to be inserted with Regex in Generic https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/157132/using-the-generic-text-filter For example this one works fine without adding the following sintax: and !(srcip~"10.39.14\.[1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]")   I was trying to exlude network any notification from a host within this network: 10.39.14.0/24 Bolded text is what comes in the handler, the rest is added by me (catdesc=='Malicious Websites' or catdesc=='Phishing' or catdesc=='Spam URLs' or catdesc=='Newly Observed Domain' or catdesc=='Newly Registered Domain' or catdesc~'Dynamic DNS' or catdesc=='Proxy Avoidance') and !(srcip~"10.39.14\.[1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]") However after the change I stopp

Hello All. I need to deploy Fortinet solution in small factory ( FG, FS ) and I have a question , How to connect exist ring to MCLAG cluster ( this red Ring ) - Can I mix Ring redundancy with MCLAG redundancy ?  or option 2  ofc in this ring will be more installed FSwitches. I know that in some point STP discard link , but how to avoid often recalculations of STP.part of infrastructure exist and I don't want to install new cables everywhere  What happened if I connect another ring next to red one ?

Please provide the specific KB for configuring  " sflow " in Fortigate analyzer .# FortiAnalyzer 

Hello!I have a simple WiFi for legacy devices working well with Cisco WLC, Cisco AP's and SSD with static WPA password.Today I started to integrade this WiFi with FortiAuthenticator for MAC Authentication - MAB. But i am having problems.The problem is that the authentication is working well, but the DHCP server is not delivering IP when on this mode.When I just break this integration from Cisco Wireless and FortiAuthenticator, this returns to deliver IP from dhcp.Has anyone here already implemented one of these?

Hello, I have an SSID set up on my AP that is only password protected. I've set the new DHCP server to Fortigate. School laptops and tablets connect to this SSID. However, my wifi password has been leaked to the world and I would like to ask...Can I use the DHCP options to set the IP address assignment? If I know that my laptops were made in a series and therefore have the same start of mac address, can I use Option 60 to give the devices with the specified start of mac address an IP Address? Alternatively, if the laptops and tablets are named similarly could I do the same using Option 12?Did I understand this correctly?Thank you for the answer.

Hello team, The Fortigate firewall's application control recognizes the MMS application on port 3389, I would expect it to recognize RDP. How does MMS get recognized as an application?Thank youBR

Hi   We recently upgraded from 6.0.5 to 6.0.9 and then changed the Fortiguard protocol from UDP to HTTPS.  Since then we are occasionally getting block messages 'An error occurred while trying to rate the website using the webfiltering service.   I've looked at the kb article https://kb.fortinet.com/k....do?externalID=FD33528 but am slightly confused about the sentence "This will allow users to access the web sites when a rating error occurs, and will allow the FortiGate unit to use the FortiGuard Web Filtering database that it has stored on the unit to rate the web site."   Can I just confirm that it means when it can't reach fortiguard it will rate the website using the local db and will allow/block access accordingly.  Just looking at the option on the FG "Allow websites when a rating error occurs" suggests that it is going to allow it whatever the rating is.   Thanks for your time

I have a 6 fortiswitches managed by fortilink that all show the same device info for each port multiple times. I have no idea what is causing this. This site is having multiple issues and my logs show nothing unusual. Any help or suggestions would be greatly appreciated.     

I am experiencing challenges in setting up a functional IKEv2 for dialup iOS devices. I have an IKEv1 tunnel which is working normal but I'd like to switch to IKEv2. The device is 80E running 7.2.7.Maybe one of you here have faced with similar issues before or have enough experience to point me to a right solution to fix this issue would be great.  Below are details you might need to assist me with. FWTPRFP001 # ike 0: comes 174.X.X.X:12615->19.X.X.X:500,ifindex=5,vrf=0....ike 0: IKEv2 exchange=SA_INIT id=b48f14cf6bade837/0000000000000000 len=370ike 0: in B48F14CF6BADE8370000000000000000212022080000000000000172220000A402000024010100030300000C01000014800E01000300000802000005000000080400001302000024020100030300000C01000014800E01000300000802000005000000080400000E0200002C030100040300000C0100000C800E01000300000802000005030000080300000C00000008040000130000002C040100040300000C0100000C800E01000300000802000005030000080300000C000000080400000E28000048001300003ABC9D4D7D45EB721372