Solved

I have a user who is trying to run 3D CAD sessions over the SSLVPN. Yes, I know this is a terrible idea, and yes, he's been told. However. He is insisting that sessions initiated with SAML are slower and less responsive than are sessions authorized with a RADIUS connection to a NPS server that uses the Azure MFA plugin. I don't understand how this is possible. Is it possible? If so, how should I proceed, seeing as how we're using the free SSLVPN client?

I have an active-passive cluster of FG-201Fs running 7.2.5. On each member I have a Aggregate interface composed of two 10G X interfaces, with VLAN interfaces defined on the Aggregat When I look at SNMP counters for one particular interface, it is not accumulating any counts for any of the parameters. I've manually pulled the SNMP values for this interface and they remain at zero. If I create a Traffic graph for the interface on a Dashboard, the graph remains at zero over time. Meanwhile an apparently identically defined VLAN interface on the same aggregate is showing traffic accumulations and generating traffic graphs in a credible way. I am 99.999% sure traffic is passing across this VLAN, if I do a "di sniff packet any..." it will show packets traversing the VLAN, Aggregate, and physical X interfaces. I've tried manually changing the snmp-id of the interface, but that hasn't worked. Any idea what I've done wrong?

Dear all, I hope ur doing well, i need your help for understand something. I have a Windows server Forti EMS 7.2.1, and i used a fortimanager for download signature AV, vulnerabilty...My fortiguard signature information is update. I have forticlient EMS 7.0.9 deployed on endpoint, and i would like to know if Forticlient on endpoint can download signature from Forti EMS or there is only 2 ways (from internet or from fortimanager).If its possible i would like to know where can i configure it. Thanks for your help ! 

Hi all, I am facing a challenge I am not sure Fortinet has taken into account. I am doing ZeroTouchProvisioning towards my FortiManager, both KVM and VMWare, same issue for both. The thing that is the issue is that the App Signatures in FortiOS are many years old, and once license is Valid, the FortiGate Auto-Links to FortiManager, and the process fails due to us using App IDs not existing on the local FortiGate VM until it has been updated... Is there a way to trigger or force execute update-now before Auto-Link happens? I have tried Automation scripts with no luck. I have also pre-made Disk images that had updated App signatures, but they wont Auto-Link because they are not "untouched" when it comes to the FortiGate configuration.. I can factoryreset-shutdown the Disk Image, but that also erases the App Signatures I loaded, ie back to square one..  Any ideas anyone??

Has anyone successfully created an IPSec VPN tunnel between a FG on a Sierra Wireless XR80/90? I've created a tunnel, routes, and policies successfully, but can't get communication across the tunnel.Tried Sierra Wireless's documentation too, with no success.https://source.sierrawireless.com/airlinkos/XR80-4.1/reference/networking/howto/vpn/Like I said, the tunnel is up, but can NOT get traffic to flow across.

Hello, we have the following constellation: Location 1 -> Fortigate 200Location 2 -> Fortigate 200IPSEC VPN between for routing traffic from vlan 72 location 1 to vlan 73 location 2  This works well.Now our colleagues want to use ssl vpn from home to get also access to vlan 72 in location one and vlan 73 in location two. I configured ssl vpn on location 1 fortigate and it works for getting access to vlan 72. I also setup a policy to vlan 73 but didn't worked so far.  Any idea or is this technically not possible and I need to configure a second ssl vpn on location 2 firewall? Thanks for you help :)

Hello, community.I need to get the actual number of analytics days displayed in these places. Can I get this value via CLI or JSON API? (no matter which form: days, hours, minutes or seconds)#Fortianalyzer

Hi guys, i set up SSL vpn from fortigate to our AWS setup. we have 2 AWS accounts and i am able to reach resources in one account without any issues but not the other one. All the config is the same across both accounts. on prem wifi is also going through fortigate and through that both AWS accounts are reachable and i am using the same LAN link as incoming interface for SSL vpn.  any ideas of what could be the problem? thanks

Friends, how about a question?This fortinet link indicates that it is at the top of the “magic quadrant of Network Firewalls” https://www.fortinet.com/lat/solutions/gartner-network-firewallsIs that information updated or is it current information from 2023? since it indicates 2022.or where I can find the current information, to know if it is still at the top.

Hi All,We have a Hardware Switch set up on our HA pair of 200F units on 7.0.12. We have Ports 1-8 assigned to the HS, but we only currently use Port 1. I would like to change the HS to only be assigned to Ports 1-4 so I can reuse 5-6 for a second HS.What I have not been able to find an answer to is, if I remove ports 5-8 from the existing HS, will it cause any outage to the connection on Port 1 when I click OK?Thanks!

Hello to all,I've configured a load balancing between 2 interfaces, by setting one to 62% and the other to 38% of the internet trafic. But it does not seem to work well, indeed I notice that the traffic is not shared as configured above.I use a Fortigate 200D, Firmware version: v5.4.1, build1064 (GA).I would like to know how to fix this problem please.Your help will be very appreciated.

How can I ensure that I also see notifications in FortiAnalyzer, such as blocked websites from the FortiClient connected to a FortiEMS?

If you forget the password into the firewall.Or if you forget the ip address to go inIs there any way to retrieve the running configuration without factory resetting it?

Suppose the jitter and latency is in the red but the packet loss is 0,under what circumstances will the firewall declare the link down and remove static route from the routing table?I configured the SLA by the way. My users are video streaming and the latency and jitter of wan 1 and wan 2 is high, although the packet loss is 0.Will the links be declared dead? 

Hey, How can I upload a custom connector to the content hub? Awni

Hi All, I am planning to enable heuristic scan option in antivirus setting. I have gone through document where it says I need to enable it like,configure antivirus heuristic set mode block For higher models,config antivirus quarantineset drop heuristic  But I don't find these options in my FortiGate firewall. We have 1100E and running 7.0.12 firmware. Do I need to enable something to configure antivirus heuristic scan?  

We have a setup where we connect to our Azure resources using a Site2site IPSec VPN connection, which works as expected.  However, once my clients connects from Forticlient using SSLVPN, traffic does not get routed to Azure.I have created Firewall rules that allow traffic from SSLVPN to Azure remote IP addresses.SSLVPN splitmode is disabled, as I want all traffic over my VPN. SSLVPN Clients can connect to LAN and WAN resources.SSLVPN clients cannot connect to Azure resources.   If someone can point me into any direction, it would be very appreciated.  

I am using FortiNAC Rest APIs to fetch list of hosts using endpoint "/api/v2/host" I am following this documentation https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/b0dca655-7aec-11ec-a0d0-fa163e15d75b/FortiNAC_REST_Schema_9.2_%281%29.pdf But i am not sure about how to use filter query param or what will be its format. My intention is to bring all the NOT ROGUE devices. Can someone help me with the same?

Hi AllI have manged to setup a windows native VPN connection to my FortiGate and also gain internet access via the VPN which is all great. However I was hoping by unticking  "use default gateway on remote network" on the windows VPN interface it would then allow me to browse the internet and access local resources on the LAN I am connecting from. Unfortunately this does give me local internet and resource access back but I lose connection to the remote LAN behind the FortiGate VPN. Is it possible to have access to both via the windows VPN client? I hope that makes sense and many thanks for your help Kind Regards Speedy

According to this thread https://www.wmlcloud.com/internet-protocols/problem-can-fortigate-automatically-update-dns-records/   .....it doesn't, and explains the problems I'm having. I have a thread below in which I complain about devices not being able to resolve via hostname with a fortigate 200D handling DHCP and DNS. We were blaming it initially on the devices, but since this is the same behavior as the thread linked above.....well.... I downloaded a freeware DHCP / DNS server and had no problems resolving local DNS hostnames via DHCP. So, the problem isn't the devices.   I would appreciate some confirmation on this, because if our 200D doesn't support a basic DHCP / DNS functionality like this then we will be looking for an alternate product. Note our 200D is still on 5.4.1.....possible this issue has been patched?

Hey guys!I'm new to FortiGate with Central SNAT and I'm administering a FortiGate 500E firewall - FortiOS v6.4.13 build2092 (GA) - which today has a private network 10.xxx.0.0/22 accessing the Internet with a public IP address of 200.xxx.xxx .37 all working fine. But a new demand came up for me to create a subnet 10.xxx.3.0/24 to use as a guest network and access the internet with another public IP address like 200.xxx.xxx.38/28. I am not able to create the necessary rules in Central SNAT to allow this, at the moment all subnets are accessing the internet only with the firewall interface IP which is 200.xxx.xxx.37/28. Can anyone help me with some tips? Or would anyone know how to indicate a document that addresses a solution for this for me to study?Thank you very much in advance.

Configured IPSEc vpn on fortiagte 100(v6.0.3 build0200). When user connects using forticlient, i am able to access the lan resources behing fortigate but i am unable to use local LAN and also want local internet traffic should not go through the tunnel.

Hi:I have a Fortigate 40F setup in office  with its WAN conencted to the interent on a public IP  , LAN connect to office LAN network 10.61.x.x network I and followed this guide, https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-establish-VPN-connection-between-Windows-10/ta-p/200001 I created a VPN: dialup - Windows (Native L2TP/IPsec) using VPN wizard， which the connection is working on my laptop from home. I am able to ping LAN devices in office, however, there is no internet . I would like access internet thru office LAN network via the ipsec tunnel, is that possible ? Thanks

Hi allI have the following configuration:site A and site B, both with 2 wan connections, connected to each other via 4 ipsec tunnels (A1<->B1, A2<->B1, A1<->B2, A2<->B2)on each tunnel I have the same phases2 and the same routes, the latter with different distances.the 4 VPN interfaces are grouped in one zone on both sides.Now I need to rotate all the traffic coming from a specific IP from office B and directed towards a specific IP in office A through a specific IPsec tunnel (for example A1<->B2)in addition to the fw rules to allow traffic, I also created a route policy, but the traffic continues to pass through the tunnel with the minimum distance routeany hint to improve and/or debug the issue? is there I'd be aware of and that I'm clearly ignoring?Thank you in advance

FortiGate 200B v5.0 GA Patch 2 Previous version you could right click a policy and select move above or below and you could enter a existing policy to move it where you wanted. Any idea on how to this now in version 5 Patch 2??? Trying to get a new policy in place for our new phone system so any help with this would greatly appreciated.