Solved

Hi,In a VDOM used to proxy clients request (acts as a proxy server on 8080), although DNS filter is enabled in feature visibility, but is not displayed (everything is there, WAF, IPS, Web, ...) but DNS filter is not present In the other VDOMs, such as a VDOM linked to the one mentioned above which has direct Internet access, DNS filter is present but as I said in Proxy polices in our Proxy VDOM serving clients request it is not present. Thanks in advance for your help Regards

Hello guys,  I have  two fortigates whit a vpn site to site stablished ( 192.168.88.0/24 local address in site 1  and 192.168.115.0/24 in site 2 ) this is up.  Ok, now in site 2 I have permited only specific ips  192.168.88.13-14-15 to connect to 192.168.115.0,  no more. This is ok, ping and other services, for example  192.168.88.13 ----->  192.168.115.163  ping up in site to site. Also I have a vpn client to site  IPSEC whit forticlient to some  remote users in the ip range ( dhcp vpn ) 192.168.88.201-250  over site 1. I wish that a remote user for example  whit ip 192.168.88.210 to reach the ip 192.168.115.163 in the site 2 but only with the ips mentioned above 192.168.88.13-14-15SQUEMATICRemote user ( 192.168.88.210 client to site)------>FG1----------Mapped(192.168.88.13)>(site to site IPSEC) -------> FG2 ------ >Server (192.168.115.163) What is the step by step?    Thanks&

Hi, got the following situation: Our FortiGate is connected to our AD. The users have corresponding groups on the AD and can sign in to the corresponding FortiClient connections. The users are NOT defined on the FortiGate, not as local and not as LDAP. Now we would like to make them use 2FA in the FortiClient via e-mail, so without using FortiTokens, FortiAuthenticator or similar.  Is there any way to do this without having to create users on the FortiGate?We are talking of at least 300 users, I'd say. Possibly even more. Thanks for the help in advance!

Right now we are testing the Web Filter in EMS, we had a few users click on a bad URL. The users are not in our test group and we would like to know if the users had been if the test group would the URL they clicked on have been flagged? Is there a spot we can test URLs? 

Hi, only on my computer, the static route is not created when I connect with the FortiClientVPN .on other PCs no problem.Do you have any advice on why it doesn't work?S.O. win 11 thanks in advanceFabrizio 

Hi Team,I have installed windows agent in test server and that is working fine after doing all the troubleshooting. like we have to configure event forwarding from collector to supervisor. I am getting logs for the same.But issue is that when I installed the agent in production server, all agents are showing disconnected.I have researched a lot about this issue but not getting help. Request you to please help in this situation. Thanks in advance.FortiSIEM 

Hi, just upgraded from FortiManager 6.4.10 to 7.2.3 and I'm wondering where the SD-WAN templates for Interface Members, Health Check Servers and BGP Neighbors are now located. Formally in version 6.4.10, SD-WAN templates - Interface Members, Health Check Servers and BGP Neighbors is where we entered the Per-Device Mapping information.  Clearly, it's radically different in 7.2.3 and I've not been able to find an apples to oranges comparison. I have a case open with support but 2 days later they are still researching.FortiManager 6.4.10FortiManager 7.2.3 

We have hub-spoke setup on Azure. Fortigate FW(H/A) is in Hub vnet-A , it peer to two spokes vnet-B and vnet-C . It need route traffic between vnet-B, vnet-C .Current setup is Vnet-A peering with Vnet-B and peering with Vnet-CIn spoke Vnet-B , have user define route table say - going to vnet-C subnet , next hop is primary FG-A internal ip address. this route table associated to vnet-b subnetsIn spoke vnet-c , have user defind  route table say  - going to vnet-B subnet , next hop is primary FG-A internal IP adddress. this route table associated to vnet-c subnetsIn Hub vnet-A , have use define route table say - going to Vnet-B subnet, Vnet-C subnet ,next hop is primary FG-A internal IP adddress. this route table associated to vnet-a internal subnetsNow VM in Vnet-B can talk to Vnet-C .But when FG do failover, , sdn connector change Vnet-A internal route table , say -going to Vnet-B subnet, Vnet-C subnet ,next hop is new primary FG-B internal IP adddress.But sdn connector can no

Have a pair of 601E FortiGate units in a remote location. Connected to a cloud environment via S2S VPN.  Among other things, I need to be able to send the FortiGate logs up to the cloud, and don't want to lose them if the S2S goes down for any reason. Found the documentation to send logs via a proxy.  Would like to use the extra GE ports on the unit to directly connect a physical proxy server.  Looked through the documentation and it's not entirely clear what I need to do on the FG.  Would think the port would need a VLAN identifer, but non-taged.Seems simple, but after wading through the various posts, it seems unclear.  Perhaps I just need to read the right doc. The other related question: Is it possible to connect a "host" machine with two network interfaces to both units when the FGs are configured as Active/Passive?

friends, a question, do you know how I can create a report in the fortianalyzer where it shows me the countries that each user who connects to the VPN belongs to? I have a face 7.2.3 and it does not have a default report on what I comment.

Hi all, I've got a customer with a lot of transit circuits as well as vpn redundancy configured today, but adding prefixes is pretty painful with all the fortigates.  I'm exploring using OCVPN or ADVPN along with extending BGP to the Fortigates to ease dealing with new routes and failover paths here. I've ready everything I can find on OCVPN+BGP, there isn't a whole lot of detail how BGP works around it, other than the docs out there indicate it seems to use an IBGP mesh with the hubs being route reflectors.  ADVPN docs indicate using EBGP between sites, which is really what I'm looking for to use EBGP between sites in general internally vs IBGP and needing to use reflectors. I just don't know if I can leverage OCVPN and EBGP that every hub/spoke site would be a new private ASN. What is the preferred method of deploying BGP with OCVPN around either of these as an upgrade/replacement for traditional prefix-based tunnels?  Is there a recommendation for/against OC

Hello, I've recently deployed a FortiGate 60E at our branch office and have been experiencing intermittent VPN disconnections. These disconnections are causing disruptions for our remote workers, especially when they are accessing shared resources on our intranet.You can also check this - https://community.fortinet.com/t5/Support-Forum/Fortigate-AP-RADIUS-Authentication/m-p/19493splunkcourse Here are some details:Firmware Version: v6.4.3VPN Type: IPsecAverage Number of Concurrent Users: 15-20Disconnection Frequency: Approximately 2-3 times daily, lasting for 5-10 minutes.Initial diagnostics don't indicate any apparent issues with bandwidth or the physical network. I've also checked for IP conflicts and found none.Has anyone experienced similar issues with the FortiGate 60E or other models?Are there any specific logs or diagnostics that could shed light on the root cause?Could this be related to any known firmware bugs or configuration nuances? Thank you in advance!

How long will the EOS and EOL of the FortiGate 100F last ?Thank youFortiGate

Hello everyone, I've got following setup:- 1x Fortigate 90E (FortiOS 7.4.0 build 2360)- 1x FortiAP 222E (FortiOS 7.4.0 build 0529)- 3x FortiAP 210B (FortiOS 5.2 build 0265) The FortiAPs 210B are quite old `:], but we've still been using them successfully until now... After the FortiGate update (from 7.2.5 to 7.4.0), it doesn't detect these devices anymore. In the past, there were situations where we had to manually activate them via WiFi Controller (or something similar happened with them). Now it looks different, and we have no idea whether it's a matter of issues with the FG update or if support for these devices has been completely 'cut off' with version FortiOS 7.4. Has anyone of you encountered something like this?Sincerely,JerryN

Hi, I want to connect thru the Fortinet Client (sslvpn) on my iPhone and direct all traffic thru the Fortinet 60E to the Internet. Is this possible? If so, is there somewhere a working example? The manual is not quite clear in this. Thanks,Peter.

Hello, I have seen some Fortigates with 802.3ad Aggregate interfaces that contain multiple VLAN, L3 interfaces.This is confusing me, as I assumed that 802.3ad Aggregate interfaces were essentially bonded trunks (that would not contain multiple L3 interfaces).Therefore, if you wanted to create a router-on-a-stick interface like this, can you also use an aggregate, bonded interface instead of a regular L3 interface with multiple VLAN tagged L3 interfaces ? Is there any advantage ?Thanks for any clarifications.

Howdy,I did submit a ticket for this as well.  I upgraded my 100F form 7.2.4 to 7.4 this morning.  Now users are reporting an issue with SSO for SSL-VPN.  I am using the Azure integration.  This solution has been in place for years without issue.  When users are logging in they are getting a blank pop-up box for the SSO sign-in.  Not all users, it works fine for me.  Has anyone seen this? 

I have recently successfully set up our SSL-VPN with AzureAD SSO including MFA (conditional access) Users are able to go through the process, sign in successfully and gain access, but there is a desire to extend the Azure MFA sign in window timeout process/prompts. By default, it appears there is a 30sec timer countdown set somewhere and it starts counting down in the sign-in window title bar as soon as the Azure window pops. After doing some reading around these forums, on the FortiGate itself, i doubled the default timers for the 5 x "config sys global > set two-factor--xxxx" options but as expected, no change. I also up'ed the "config sys global > set remoteauthtimeout" to 10sec instead of the default 5.*****set remoteauthtimeout 10set switch-controller enableset timezone 71set two-factor-email-expiry 120set two-factor-fac-expiry 120set two-factor-ftk-expiry 120set two-factor-ftm-expiry 120set two-factor-sms-expiry 120***** I have loosely looked through Azure an

Hello, I configured as the manual an IPsec Tunnel to be able to connect the remote clients to the LAN. I was thinking then to restrict the firewall rules (users can access to servers, others users no). But that seems to not working when I put a user group in source of the firewall rule. Is there a way to restrict the access of the LAN for some users o it will have access of all the infrastructure ?In SSL it's possible to do it easily but don´t find a way in IPsec..Many thanks

I need to block the traffic to my FTG by geographic IP. However, the 50E models do not have this ACL option, how can I do it?

Hello, I would like to configure SSH on FortiSIEM in order to monitor any change on the configuration from the fortigate side

Hi all for testing, there was an integrated evaluation license for 15 days in each Fortigate VM. Since FortiOS 6.0.1 the evaluation license expires right from the first start of the virtual machine. In the GUI, there is the message "Expired on 1970/01/01" with the possibility to upload a license file. Until FortiOS 6.0.0 it works as before. Was the feature for evaluation license removed or is this a bug? I tested with FortiOS 6.0.1, 6.0.2 and 6.0.3 with VMware Workstation 12.5. Thanks for your help. Best regardsMarcel

Hello, We have the deep inspection activated for the outcoming connexion. Microsoft has changed their certificat for the hostname europe.cp.wd.microsoft.com resently with an another CA and now I get the error "block-cert-untrusted" from the UTM. So I think to resolve this issue I have to import manually the new chain for this CA in the fortigate ? where can I get the CA list that the fortigate already know ? Does the CA list are automatiquely updated from fortiguard ?  Before I was on checkpoin and I had to import manually the CA cert. Thank you for your answerRegards,  Regards,  

We have two SSL tunnels, one is not quite ready. Can we only present one tunnel to the clients and "hide" the other one for now? 

Hi guys,I found many articles that help geo-block IP Addresses that try to connect on SSL VPN.Now we face many attempts out of the TOR network. Fortigate has the TOR_Exit_node as an Internet Service Database, and it can also be added as external Connector, but local in Policies can't be configured with either.Is there a way I miss? Fortigate has version 7.0.12/6.4.14.