Solved

Hello all,  Affected: FortiOS 6 to 7.2.4. Webbrowser, Devices, everything that is not Windows.If you have Certificate Inspection, deep inspection enabled, Windowsupdates are not possibel anymore. To only way is to import the CA in the Fortigate. But the question arises, why was this CA not integrated into any Windows devices? Example: https://sls.update.microsoft.com i noticed that the Microsoft Update Secure Server CA 2_1 certificate is not trusted by Fortigate.But not only that. This certificate is not trusted at all. From no device, no website, no tool. Only Microsoft Windows itself has this CA on board. How can that be?  https://www.ssllabs.com/ssltest/analyze.html?d=sls.update.microsoft.com&s=52.165.165.26&hideResults=on openssl s_client -connect sls.update.microsoft.com:443 CONNECTED(00000003) depth=1 C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft Update Secure Server CA 2.1 verify error:num=20:unabl

Hello all,  i'am using here a Fortigate 60E with some Fortiaps 433F. The Fortgate is linked with LDAP and Radiusserver. WLAN Entperprise WPA2 and WPA3 works with this auth methods:  TTLS + PAPTTLS + GTCPEAP + GTC I have tried to find reasonable info's as to what the difference is, but have not found it. So my question is: "What is the difference between the methods, what should I use?". Thanks a lotBest Regards :)

Hello, I cloned the existing "Windows Security Log Cleared" rule in the rules and created it in a new name, only I made the within value 120, not 600, and made the rule in the default disable. However, this time, when the rule was triggered, it created an incident with the name in the default and gave a sync error error in the rule. What could be the reason?

Dears, What is the best way to connect a TP-Link 1600 VDSL ISP router to a FG90EI want to use the FG for VPN, DHCP and other policies. the ISP router is providing a nated IP 192.168.0.xI tried connecting a wire from the router to WAN1 port after disabling DHCP on the router and set a static IP on the WAN port, is this the way to go or I should be doing something else? I read posts saying that I should be changing the connection mode to bridge. what is your recommendation  Thank you in advance  

 Hello, All my users are in a LDAP group "Users".All my admins are in LDAP group "Admins" and "Users" I have a SSL VPN portal for all users (Group Users).I have created a specific portal for all admins.But the admins are recognized like simple users. They are a possibility to do this ? Because i tried to change order but nothing change, my admins are seen like simple users. Thks

Hello everyoneI am running a Fortimanager with 7.4.2On the Fortimanager I have div ADOM.I have entered an address object in an ADOM (Any Interface) and want to synchronize it with the Fortigate (100F). Now that works. Does anyone have a tip why this does not work?

Hi All,I have a syslog server and I would like to sent the logs w/TLS.My syslog server has a certicate assigned to it from my local cert authority which is a Windows CAI uploaded my cert authority cert to the Fortigate but still does not work.THas anyone gotten TLS syslog to work when the CA is a local Windows CA that shows under remote certificates?

We are doing FSSO on a gate. I have DC agents on the AD servers.  In the external connector FSSO Agent, the user group source is set to Local LDAP with proactive retrieval enabled. The gate sees all the users, no problem there. In my FW policy we want to allow ALL authenticated users. What is the most scalable way to accomplish this without having to manually add new individual users to a defined group or directly to the policy? Would changing the config from Local LDAP to Collector Agent work ? Thanks for any help here.    

 Is it normal for a private virtual machine not to access the internet in edit mode?The license wants to verify but cannot verify because there is no access?Also how can I connect the virtual machine to my local license server?

HelloI have some questions regarding FortiNAC-F.I see the main difference is in the new FortiOS like shell, but what are the most important added values in FortiNAC-F?How do I choose between FortiNAC and FortiNAC-F? Is FortiNAC suitable for some customers and -F suitable for others?As Fortinet has now 2 NAC products, I guess the legacy FortiNAC will be discontinued, right?If FortiNAC will be discontinued, when and what will be its last version?Since FortiNAC-F is relatively new, is the latest 7.2.5 version considered as mature? Does Fortinet recommends it more than FortiNAC 9.2.8?

Hello,   Can a FortiGate use a proxy server to activate a FortiToken mobile code? In the documentation (https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/492260/configuring-a-proxy-server-for-fortiguard-updates) I read that: "Proxy tunneling is supported only for registration, AV, and IPS updates. For FortiGate virtual machines, proxy tunneling can also be used for license validation." and I'm not sure if FortiToken activation is supported in proxy tunneling or not.   Thanks

HelloIs it possible to change my forum nickname to "stasy" ?Thank you

Hello forum,I would like to know how many of you are dealing with upgrades of firmware from Fortinet Devices.We have a range of Fortinet equipment, FortiGates, FortiAZ, FortiSwitches, FortiAPs.We have them on multiple locations.How you guys are dealing with upgrades, where to look if the upgrade is suitable for us, what type of automation you use, etc..It's really hard to catch up with everything since I'm not just a Fortinet guy. I'm System Admin so I have a lot of other task's and its getting overwhelmed..  

Hello, how can I use an FQDN for NTP?

hi,i would like to constantly monitor our WAN utilization in a certain VDOM.i already added a widget under dashboard > network > interface (added WAN subif).my question are:1.is this widget permanent? or is it auto removed after my login session?2.can other admin see/view the widget i created? or is this view only exclusive to my profile?3.i can only see 1 hour, 24 hour and 1 week view option? is this fix or can i adjust this view to 12 hours or 30 days/1 month, 12 months?

Hi Team, We are facing issue after enabling Geo blocking for other country except India. Policy which I have configured - Incoming interface - SDWAN interfaceOutgoing Interface - Vlan Interface.Source country - IndiaDestination - VIPNAT - Natted IP (1.1.1.1-100.100.100.1) For examplePolicy - Accept Issue  that has been observed - Internal servers are not able to access site - for example - www.xxx.comwhich VIP is mapped with this policy When I enabled source - ALL that time is everything is going on smoothly. thank you.     

Hi all, Previously I have implemented Fortigate integrate with Okta authen. but now we still having some issues which is I am not really sure about it. Here is the config that I implemented in Fortigate  config user saml edit "okta-idp" set cert "Fortinet_Factory" set entity-id "https://xxx.xxxx.xxx.xx:10443/remote/saml/metadata/" set single-sign-on-url "https://xxx.xxxx.xxx.xx:10443/remote/saml/login/" set single-logout-url "https://xxx.xxxx.xxx.xx:10443/remote/saml/logout/" set idp-entity-id "http://www.okta.com/exxxxxxxxxxxxxxxxxxxxx" set idp-single-sign-on-url "https://xxxxx-url.apac.xxxx.com/app/apac-xxxxx/xxxxxxxxxxxxxxxxx/sso/saml" set idp-cert "REMOTE_Cert_1" set user-name "username" set digest-method sha256 next end xxxxxfw01 (corporate-saml) # show config user group edit "corporate-saml" set member "okta-idp" config match edit 1

I'm trying to understand some Fortinet firewall logs but I'm not sure I fully understand what is being logged by the firewall when it comes to direction (Incoming vs Outgoing)For example:srcip=7.7.7.7 dstip=192.168.10.50 srcport=45845 dstport=80 srcintf="port5" srcintfrole="wan" dstintf="port10" dstintfrole="lan" proto=6 direction="outgoing"I'm not sure why that would be categorized as outgoing instead of incoming. Since the traffic appears to be initiated from an external source. Would it not be incoming traffic? Or is it because the last interface is it hits is the LAN interface and it's "outgoing" from there?The idea is i want to alert on SIEM level for IPS detections initiated by internal devices not comming from the external wan !! Please anyone can help in that!!

Good Morning! I am new to Fortinet, having just moved our company from Cisco ASAs with Firepower to approximately 30 Fortigates, mostly models 40F, but a few of our bigger sites are using 60F and 81F. Currently running firmware version 7.2.6, build 1575. We are now using FortiManager Cloud Central Management & Orchestration, v7.4.1-build4261 230914 (GA) and need to learn how to re-create the global policies that we used to apply using Cisco Firepower, now using FortiManager. Policy-wise, the 40F's are configured almost all the same, except for an extra interface or Virtual IP or two.The other sites have a bit more going on, hosting many more virtual IPs, using policy routes, etc. There are some policies we would like to apply globally, where we can make the change in one place and it would apply to all of the devices in a group. The main example would be to have a policy rule to completely block a constantly changing list of countries from ever accessing our sys

Let me explain.Users SSL VPN into firewall A.Firewall A send the traffic to firewall B via a site to site vpn.So I have to configure an SSL VPN interface on firewall B to accept the traffic from A.How do I do it?

Hello!We have a problem with Fortiweb 7.0.6: when logging in over the https and AD-authentication to manage the device, the browser shows only blank page. I've tried to log in from another server and using in-private mode, also using another browser, nothing helps. My user account was recently added. Older users can log in and see the admin page successfully. The secondary Fortiweb acts the same way. I can log in via ssh. I even disabled http and https access methods on the management port temporarily but that didn't help: when I put them back and connect with https, log in, still blank page. I wanted to kill the admin httpsd process but how to identify that one? Since this is a web server serving many webpages, I don't want to kill all the httpsd processes, only the one that serves the admin log in.

This Tech-Tip desribes how FortiSwitch OS up till 7.4.0, can have issues with TLS 1.3. This is still an issue with 7.4.2! How come, this is a problem with latest browser versions, like Chrome & Firefox?   Are FortiSwitches telling it supports TLS 1.3, but in reality, it dosen't?

I have user that can successfully VPN into firewall A.There is site to site vpn established successfully between firewall A and firewall B.User is trying to reach a subnet on firewall B.The traffic was sent from firewall A with a certain number of bytes but received with 0 bytes.Firewall B did not receive the traffic.Static route was also configured correctly.What is the possible issue? 

I tried to reach out to another #FortiGate through the SSL-VPN client connection but it's not established.I ran a debug command on the SSL-VPN server to figure out the issue.I received these logs:2024-01-16 18:07:19 [260:root:19]allocSSLConn:310 sconn 0x7fab546000 (0:root)2024-01-16 18:07:21 [260:root:19]SSL state:before SSL initialization (X.X.X.X)2024-01-16 18:07:21 [260:root:19]SSL state:fatal decode error (X.X.X.X)2024-01-16 18:07:21 [260:root:19]SSL state:error:(null)(X.X.X.X)2024-01-16 18:07:21 [260:root:19]SSL_accept failed, 1:unexpected eof while reading2024-01-16 18:07:21 [260:root:19]Destroy sconn 0x7fab546000, connSize=0. (root)I used easy-rsa to create a server-client self-signed cert bundle to use for this purpose.Another thing that I should mention is that whenever I am using "openfortivpn" package in Ubuntu or FortiClient VPN and addressing those self-signed certificate locations for the CA, server cert, and user key, the connection is established without any problem.I w

I'm able to connect to the ssl vpn, after connected I can access to my f drive but when I ping my server name I can't find my host server. Also, I cant access to http://servername:5050/Login.aspx , it shows me DNS resolve failed, but I can access to http://192.168.X.XX:5050/Login.aspx Policy 1Incoming Interface: lanOutgoing Interface: virtual-wan-linkSource: allDestination: allAction: AcceptService: all Policy 2Incoming Interface: SSL-VPN tunnel interface (ssl.root)Outgoing Interface: lanSource: SSL-VPN Address, Employees user groupDestination: Local-LANAction: AcceptService: allHow to solve this problem? Please help T.TFortiClient