Solved

Hello community, We have a FortiManager cluster on GCP (manual failover) and we have upgraded to 7.2.1.If anyone knows if vrrp automatic failover is supported on GCP? Thank you in advance

We have enabled configuration changes alert in out fortigate under Security Fabric->Automation->Configuration Change.Eg. the timestamp and email was sent out at 14 Sept 8.18am when no users login to the firewall to make changes. 

I am using Parallels RAS with FortiAuthenticator. Right now it shows 2FA for all the users who are imported into FortiAuthenticator but allow login to other users without 2FA. How to enforce 2FA for all users and deny if they are not imported into FortiAuthencator. I can't find any settings of Parallels side to restrict.

I am trialing FortiAuthenticator in our network which is behind Fortigate firewall. I can use FortiToken with 2FA and it works fine. I also tried push notification and it works too, however we have to open public ip:port to FortiAuth server to make the push notification working. Do we really need to open the port for the push notification to work. During test without opening the port the push notification shows up on the mobile but the approval/deny response does not reach to server.

(Using a 300E on FortiOS 7.0.6) When I try to use multiple ports in a FortiLink interface, switches do show up in an unauthorized state, but after authorizing the switches, only one of the switches are able to come online. Each switch is connected to a different port with in the FortiLink interface, and still only one comes online. As you can see below, I have "Split interface disabled" I believe this is correct.The switch that is online is in port 23. Why is this? If I enable "Split Interface" then I know only one of the 2 ports will work (the first one (left to right) listed). Is there a feature I have not enabled somewhere? 

We are using a SSL VPN with users authenticating against AD with LDAPS.  I have enabled the "Require client certificate" option in the VPN SSL Settings.  I have installed the root certificate from our internal CA on the Fortigate and have installed "Workstation Authentication" certificates from our internal CA on all of our client machines and checked the box to "Allow Non-Administrators to Use Machine Certificates" in the EMS deployed SSL VPN Client Profile.  This is all working perfectly and clients are able to connect successfully.  The issue I am having is that if I revoke one of the machine certificates from our internal CA, the machine can still connect successfully.  I would have expected a machine without a valid certificate from our CA to be denied. I have configured the CRL on the Fortigate to auto check the internal CA's CRL.  If I check the CRL on the Fortigate under System -> Certificates -> CRL, it shows that it is connected succes

Hi, I have imported a certificate in FMG, following these steps:  Inside one specific ADOM -> Objects Configuration > Dynamic Objects > Local Certificate > Create New > Enable Per-Device Mapping > Create New (new mapping) > Import Certificate. Now I can se the Dynamic Object created, and I can deleted it, but I cannot find the actual certificate in order to delete it, and I still have it available in the list when creating a new Dynamic Object Local Certificate. How can I find and delete the certificate? Thanks.

We use a website that authenticates user access based on our office public IP address.  I have a vpn user that needs access to this website.  How can I force access to this site for vpn users to reflect our public IP rather than their home IP?  We would like to keep using split tunnel for all other internet access.

facing an issue with one of the access switch is going offline again and again.  Fortigate as a controller running a on 6.4.9Core Switch 1048E running v 6.4.11Access Switch 124F running v6.4.11 Ntp is synced. only on switch 124F is having an issue. core switch connected as MCLAG Peers other access swi has below configuration config switch trunkedit "E48T0000000213-0"   ----->>>>> to another Core SW 1048Eset mode lacp-activeset auto-isl 1set mclag-icl enableset members "port45"nextedit "G6H00000000"  ------->>>  TO Fortigateset auto-isl 1set fortilink 1set mclag enableset members "port48"nextedit "4FF00000009417-0"  -------------->>>> Access Sw 124F connectedset mode lacp-activeset auto-isl 1set mclag enableset members "port2"next *************************************************** Troubled switch logs  connectivity        

Hello Everyone, I have installad the FSSO Agent and DC Agent in a Domain Controller following the guide below, except for the Working Mode in the DC Agent, where I have set the "Polling Mode" intead DC Agent Mode. After the configuration, I can see all the AD Groups in the Fortigate. So, I have add the group "Domain Users" in the rule to access the Internet, but when I did that all users have lost internet access. To test, I created a user group with the Firewall Type, mapping it with the Domain Users' group in the External Group option, selecting the configured LDAP Server. With this group in the policy, it works. Anyone knows why the group retrieved directly from the AD (FSSO Agent) didn't work, but the mapped local user group works? The working mode of the DC Agent I have set can be the problem?

Hi,I many users who are using FortiClient since we migrated to FortiGate 100F.One user has not been able to connect and he gets the following error message.I have tried his laptop and used my credentials and it works fine which means there is no problem on FortiClient side.I have done a reset of his password in DC. Still not working.Is there a way i can see what is happening when he is trying to connect like a debug or any lg I can check on my FortiGate 100F?Please see attached file.He has only to put his username and password. Thanks in advanceTazio 

Good morning, I'm trying to monitor my Fortigate 60D (v5.4.1,build5447 (GA)) using a monitoring tool that uses SNMP.I have enabled the LAN interface to allow SNMP Packets config system interface    edit "Transit"        set vdom "root"        set mode static        set dhcp-relay-service disable        set ip 10.0.0.2 255.255.255.252        set allowaccess ping https ssh snmp fgfm        set pptp-client disable        set arpforward enable        set broadcast-forward disable        set bfd global        set l2forward disable       &n

Good morning, My question is probably more of theory nature: Our customer is using Proxy IP telephony provider. For that we had to configure Custom Service to communicate with the provider. Recently our customer started receiving multiple spam calls directly to their softphones. Together with Fortigate support we found a misconfiguration in the Custom service /firewall policy pair and spam calls have stopped.  Before that, I could see a lot of connected sessions to the ports used by telephony service providers from the attacking IP's random ports. Now, I don't see those any more. BUT when I start a sniffer, I still see packets from same IP with SIP INVITES hitting my external interface: the output looks like this:  I am not good in interpreting the sniffer data yet so I am not sure of what I am I looking at. Since the Forti View session does not show any sessions established from these IP's, and there is nothing on the external ports from the sniffer data,

Hi, I have a FortiGate 60E and created a VPN using IPSec Wizard (Remote Access, Windows Native, L2TP/IPSec with Pre-shared Key). The incoming and outgoing policies have NAT enabled (Use Outgoing Interface Address). I am able to connect to VPN from home but when I try to connect a 2nd computer to VPN, it will either fail or kick the 1st computer from VPN. However, if I try to connect the 2 computers to different VPN destinations, there is no problem. So, this only happens when connecting both computers to the same VPN destination. May I know how can I troubleshoot this? Thanks

It started 24 hrs ago - I get this critical warning every 15 minutes... It appears that all customers with 7.2.0 or 7.2.1 firmware are getting the warning. Devices model are FG60F, FG60E and FG80F. Customers with 7.0.0 and 7.0.6 are fine.  

Hello, I am new to Fortinet and setting up a Fortinet firewall VM in EVE-NG. With below setup, I am not able to ping from INSIDE_R1 to OUTSIDE_R2. Topology:INSIDE_R1 --- (port 2)-Fortinet Firewall-(port 3) --- OUTSIDE_R210.0.0.2/24     10.0.0.1/24                    20.0.0.1/24        20.0.0.2/24 Fortinet VM: Version 7.2.0 with eval license Firewall policy is to allow All source coming into Port2 toward All destination and get out of Port3, for all services, all the time. NAT is also enabled to use the outgoing interface address. INSIDE_R1 has a default route pointing to firewall inside interface IP, 10.0.0.1. INSIDE_R1 can ping firewall's inside IP 10.0.0.1 and outside IP 20.0.0.2. Firewall can ping OUTSIDE_R2's IP of 20.0.0.2. However, INSIDE_R1 cannot ping OUTSIDE_R2's IP of 20.0.0.2. OUTSIDE_R2 does not get any packets from INSIDE_R1 based on its debug output

I have a Fortigate 100e, I was looking at the VPN log and saw some odd entries: date=2022-08-24 time=15:31:23 eventtime=1661380284231585110 tz="-0700" logid="0101040019" type="event" subtype="vpn" level="information" vd="root" logdesc="L2TP client disconnected" action="disconnect" status="success" msg="Client 154.89.5.116 control connection (id 1) finished" There's a bunch of entries that show this "disconnect"  but there are no messages saying there is a connection. such as "Action=Connect" or "msg=..Started" has anyone seen this before? does anyone know what this means (in big picture).  am I in danger?

Hi, I would route internet access throug a vpn ipsec for one of my customer, but i'v figured out that if i'll do this like this: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Remote-browsing-over-IPSec-VPN-tunnel/ta-p/190719 All of internet will be route throught the VPN of this customer. I try with vrf but my version 6.0.9 only support vrf for blackhole. How can i do this ? Thank for your reply

I'm enabling IKEv2 digital signatures with rsa-pss on a FortiGate VPN Gateway: config vpn ipsec phase1-interface    edit "xyz"        ...       set digital-signature-auth enable       set signature-hash-alg sha1 sha2-256 sha2-384       set rsa-signature-format pss    nextendWhen the peer sends an client certificate and an IKEv2 AUTH payload with an RSA-PSS SHA1 signature then everything works well: ike 0:dbmas:187: certificate validation succeededike 0:dbmas:187: signature verification succeeded using rsassa-pss-with-empty-params, oid=1.2.840.113549.1.1.10ike 0:dbmas:187: auth verify doneike 0:dbmas:187: responder AUTH continuationike 0:dbmas:187: authentication succeededWhen the IKEv2 AUTH payload contains an RSA-PSS SHA2-256 signature with a default salt size of 32 bytes then the following error occurs: ike 0:dbmas:190: certificate validation succeededike 0:dbmas:190: si

Hello there, I've got Fortigate device with following configuration:- wan1: Internet- port1: LAN (vlans) Now I'd like to connect another ISP to wan2 and new LAN (new network) to port 2.Is this should all works? I never do this so I wonder if it works in that way. Thank you in advance.AErot

Hello! I apologize if this is answered elsewhere, and would appreciate being pointed in that direction if so as I don't mean to waste anyone's time--I've spent quit a few hours now trying to figure out best practice for what I'm trying to accomplish and it seems most discussions are just a hair different that makes me go down a rabbit hole only to ultimately not make it work.  I learn a lot, but it doesn't seem to fit quite right. I would like to use a FG 81E to drop between an ISP switch and Unifi ES24 to not only handle our LAN (Unifi Wifi Campus off the ES24) but also handle fiber coming from a nearby junction box that will have a tenant on each fiber crossover (adapter) to one of the ethernet interfaces.  These tenants will potentially want their own unique public IP.  So, ideally, each interface would be configured to be it's own public IP from a /27 provided by the ISP.  The incoming ISP interface (the shared WAN1) will also be on this /27, as w

Lastest version 6.0.0.0067, win10pro PC all updated ,no antivirus , nothing special , everything works on other 100+ PCs. The screen goes blank right after starting the console with just a help option in the right corner. Tried reinsalling ,delete folder, registry entries. Anything else to try ? see pic attachment      

Currently we're having a problem on checking/monitoring specific packets from each policies. After checking out the cookbook on Fortinet, I found out that there was a application tab under FortiView. Problem is it shows that there's outgoing packets but when I click to check more details there's nothing displayed at the Application tab.Has anyone else encountered this problem or any suggestion on how to fix it or an alternative way on checking the packets from each policies.Thank you in advance.

Hi,which are the parts of the configuration that the fortigate does not synchronize in the HA Active-Passive?for example, are the ip of the interfaces synchronized? Thanks

Need help!Out of the 5 lan ports on 40C I am looking to configure  Port 1,2 and3 as a part of a Hardware Switch and also Port 4 and 5 as another Hardware Switch.Can someone guide me through this??