Solved

Hi,I've got a Fortigate 40F and the source objects you can see on the logs/fortiview they don't match the current user. It's like it's showing maybe the first user that connected with that IP, but it's not updating. I've got it connected with LDAP. How can I make it update the names so they are correct on the logs? Thanks,Albert

Hi, we have a FortiGate v6.4.2 build1723 (GA) where we use SSL-VPN.  Sometime the users enter (many times) the password wrong and the Forti block the public IP of the users and they have to wait for a long time to be automatically unblocked (unbanned). How Can I unblock that IP from the forti console to allow the user try the login again ?

Hi ,  I am wondering if anyone with Fortimail instance can help to confirm if you have same problem as our fortimail. We just found if a incoming email has more than 1 particular urls, it will go nuts. Here are two example urls:https://www.google.com/url?q=https://docs.tenable.com&source=gmail-html&ust=1https://www.google.com/url?q=https://docs.tenable.com&source=gmail-html&ust=2 As soon as I added the two urls in incoming email ( from gmail or from Exchange Online), Fortimail will fail to receive the email. I have opened a support ticket with Fortinet, but the response is very slow. I am wondering if any Fortimail user can reproduce the issue. There are many urls can trigger the UriExpander error, examples:UriExpander: Broken pipe while connecting to https://t.co/bAMtodzfGIUriExpander: Broken pipe while connecting to https://goo.gl/maps/VI3i1    

i am trying to connect to my fortigate firewall using forticlient on my Macbook PRo running Big Sur 11.6.2 but without success.As i have 2FA enabled, after entering the 6 digit code and click Submit button, i am back to the forticlient login page with the password removed. my is account is working fine on Windows 10 laptop and even on my android phone but not on my Macbook PRo

Hi, Is it possible to have SSID's from multiple VDOM's on the same access point and how?

Hello dear Community,i would like to configure 2FA-Authentication via Fortimanager and FortiAuthenticator.  We have a fortigate 200F in use.This Technical Tip was very helpful for us:Technical Tip: Radius authentication with FortiAut... - Fortinet CommunityMy first question is:The SSLVPN should be configured for 80 partners. Is there a possibility that I don't have to create manual groups 80 times so I can assign them a portal? Or do I have to create 80 groups and 80 portals with different bookmarks? Is it possible that I can only configure one portal and still assign different bookmarks to the partner?My second question:I usually create the UserGroups for the LDAP users on the Fortiauthenticator and then I configure them on the Fortigate so that they can authenticate via Radius & 2FA. Is there a possibility that I can only perform the configuration via the FortiManager, so I do not have to configure on two devices? Can I use the Fortimanager to create the ldap

Hi, We got for test hardware token model 300.Working great, but in documentation written that they are "driverless".but if I put USB token into PC which isn't connected to internet we got installation failed. Can somebody suggest, what must we have to  install on endpoint workstation for success authorize already prepared token with valid certificate. We do not like to install _Setup suite since we will prepare certificates and keys in our IT department and provide support to end users.  Thank you in advance,VladimirPrague/Czech Republic. 

Q1 Is it possible to upgrade FW using "execute restore image usb" command because I want to use USB to upgrade my firewall instead of TFTP. which brings me to the next question Q2 Is USB or TFTP upgrade faster? Q3 When I want to see fortigate lldp neighbors, I use the "diagnose lldprx neighbor summary". So what is the difference between a "get" and "diagnose" command? Q4 Why isnt lldp under the "get" command? Like it is show cdp neighbor in cisco.   

I am supposed to connect an equipment to the DMZ region.What am I supposed to configure on the interface going to the DMZ?How does the firewall now what to authorise to go into the LAN and what to reject? 

Dear All, Greetings, Just I want to know in FortiGate is there any feasible solution If I want to block bulk public IPs.For example - 1.1.1.1/32 Note - I have to block around 2500 public IPs in our organization at the FortiGate firewall.. So please anyone can make me understand to block these IPs. Please also share a Road map to block these IPs if you know. Thank you 

Please advise what else I can look in to if you have any ideas:Issue: SSLVPN connection can access internal network, but cannot browse internet while connected via tunnel; web-access works. Details: running 80F on 7.0.2 clients running Forticlient 7.0.1.0083Firewall policies exist both inbound with NAT disabled and no inspection/policies currentlySplit tunnel is purposefully disabledSAML login with Azure works perfectTunnel and web access are enabled on coresponding portal/only web worksSSL Debug log Configurations belowSSL Settings:config vpn ssl settingsset servercert "nameSSLVPN"set idle-timeout 0set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"set source-interface "OUTSIDE"set source-address "all"set source-address6 "all"set default-portal "web-access"config authentication-ruleedit 1set groups "VPN Users"set portal "tunnel-access"nextedit 2set groups "saml-group01"set portal "name SSL-VPN"nextInterface Config: edit "ssl.root"se

The specific model we are working with is a FortiGate 100F. We usually have our Internal Interface configured with the internal network subnet. Then, we’ll have a VLAN sub-interface for Guest Network, and another VLAN sub-interface for the Accounting department network. VLAN 20, and VLAN 30 respectively. So, both of these VLANS show up under Internal Interface when we expand it. Our HPE network switch is connected to LAN1 which is a member of the Internal Interface. The network switch is aware of the VLANS and is passing them accordingly. When we run the ‘Security Rating’ tool on our FortiGate, we get the following warning:ND05.2: Non-FortiLink interfaces should not have multiple VLANS configured on them. Traffic is flowing properly and everything seems to be working as expected. Why is this against Fortinet best practices? Or, are they simply just trying to get me to use their expensive hardware switches? Do I really need to configure 3 ports on the firewall a

i put the source nat as the private interface. I put the destination nat as the public interface.Somehow the ping to the internet works.Q1 Why is this so? Doesnt ping involve the return packet? Q2 Dont I have to put source nat as public interface and destination nat as the private interface too? Q3 Under what circumstances do you put a static route and not an NAT? Q4 Why do some other products only have "nat enabled" but dont specify "ip nat inside" or "ip nat outside"?  

HelloWhen I go to the GUI for my HA Firewall, only the HA:Primary firewall will appear.How do I go to the secondary HA Firewall? In Palo Alto, I can assign an ip address for the primary firewall (e.g 1.1.1.1), another ip adress (e.g. 1.1.1.2)for the secondary firewall and a virtual ip address for the cluster (eg. 1.1.1.3). So if I want to go to the secondary firewall to check I can go to 1.1.1.2. Can I do something similar for fortigate firewall?  

We recently conducted an internal penetration test and the testing machine generated 20 times more messages on our analyzer.  I have already deleted log files, however, is there a way to delete the messages generated by that PEN test machine from the analytic database?  Thanks!

Hi,In my company we are using IP ranges that may conflict to the ones the client user is using while teleworking from home (192.168...) The users are connecting to VPN using Forticlient. I would like to identify the connection/disconnection event so when the user connects to the vpn it runs a script to update his local routing tables to avoid conflicts, and when it disconnects, it restore them back.  Is there a way to automate this script running from Fortigate/Forticlient itself? If not, Is there any event log or some way to trigger the scripts. Thanks,Albert

FortiGate  Is there a way to see why a Fortigate will not send an ICMP response? I have a batch of Fortigate 80Es with the same configuration template. Some of the Fortigates will stop responding to ping responses back to the switch (connected to a 2000E). The ping goes from my switch and the destination is the 80E loopback IP. The ICMP request does arrive on the Fortigate. I am using the command below on the CLI of the 80E to troubleshoot the ping failures. diag sniffer packet any 'icmp' 4 I can see the ICMP requests come in. Most of the Fortigates will send an ICMP reply back and the test passes. There are a few Fortigates that simply do not send an ICMP reply. I don't see a difference between the two different Fortigates that behave differently. Is there a way to see why a Fortigate will not send an ICMP response? 

Hi,There is a 200F firewall with no online license (has expired). While going to enable remote logging it comes back to disabled after applying. Is there any special license (just online license enough or even needs more licenses) to enable this feature on a 200F firewall? Regards,

Hi,I have couple of website and file sharing servers .the website is integrated to active directory (ldap) if I implement fsso , does it mean the users does not require  to enter the username and password for other services like websites and filesharing  once they  login to the pc (active directory credentials ) Thanks 

I've configure the FortiGate on our network to authenticate firewall traffic using Azure AD as the IdP. All Internet access works as expected once each user has authenticated to Azure.  Users are complaining that first thing in a morning several applications (Teams, Slack, Outlook, Softphones, etc) are not working until they manually launch their browser (which in turn authenticates them to the FortiGate). Something that some of them forget to do! Is there a way I can exempt these applications so that they work regardless of whether or not the user has authenticated to the FortiGate?

Hello Everyone i have CA Server Microsoft in my network and i can use in deep inspection and Worked properlybut many time tries to create Certificate for MGMT Access in FWB and FGT and result It was not successfulplease help me to Solve this problem i try create certificate with FQDN , IP    

Hi there, after we resolved our problem with the general functionality with Kerberos Auth and explicit Proxy (Solved: Re: FortiOS 6.0 Explicit Proxy Kerberos problem - Fortinet Community), we thought about how to get an failover/ha setup while our domain controller all can be used as KDC We followed these steps Handbook | FortiGate / FortiOS 6.0.0 | Fortinet Documentation Library with additonal steps in the mentioned thread before. Also have read this Technical Tip : Configuring FortiProxy Kerberos au... - Fortinet CommunityBut in any examples, handbooks we are aware....there is this part of the configconfig user krb-keytab    edit "http_service"        set principal "HTTP/fortiproxy.mt-test.local@MT-TEST.LOCAL" <<< Same as the principal name in the ktpass command on Windows Server        set ldap-server "dc01" <<< the defined ldap server for authorization  &n

Hello guys,I have a cluster of Fortigate connected with another couple of FGT with two links in protocol BGP.I have choose to set one primary and one in backup with the weight.I would like now share the links in active way mode, to load balacing both of them in upload than in download, so in routing table have for each remote network both the links with the same distance and metric.This is my conf:Thanos_GRA (BGP_DR) # sh router bgpconfig router bgpset as 65000set router-id 2.1.71.238config neighboredit "2.1.71.237"set description "Gravina_vs_Siziano_1"set remote-as 1267set keep-alive-timer 45set holdtime-timer 120set connect-timer 60set weight 200nextedit "2.1.71.245"set description "Flaminia_vs_Siziano_2"set remote-as 1267set keep-alive-timer 45set holdtime-timer 120set connect-timer 60set weight 90nextendThanos_GRA (BGP_DR) # get router info bgp network 192.168.202.0VRF 0 BGP routing table entry for 192.168.202.0/24Paths: (2 available, best #1, table Default-IP-Routing-Table)Adverti

Hello All, I am a bit new to this level of networking, but I am trying to learn.I have a printer on one interface that needs to be accessible from the other two.My product is a FortiWiFi 60D, version 5.6.12.My config is:wan1 = connection between small office and internetphysical LAN = 10.10.79.Xwifi1 = device is located here 10.10.80.Xwifi2 = 10.10.180.Xwifi3 = 10.10.81.X (Guest)I can ping the printer from LAN, wifi1, and wifi2, but it doesn't show up in AirPrint like it used to (prior to FortiWifi 60D being installed) which makes it difficult for the Apple products to connect to it and print.In "Addresses" under "Policy & Objects" I have it defined as: "Canon Printer", subnet, 10.10.80.34/32, interface = "any", Show in Address List = enabled, Static Route Configuration disabled.In IP4Policy the very first policy I have is:Name: Printer #1 PolicyIncoming Interface: physical LAN, wifi1, and wifi2Outgoing Interface: wifi1Source: physical LAN, wifi1, and wifi2Destination: "C

Hi, I'm setting up a site-to-site IPSec VPN from fortiwifi40f to GCP Google; but I am getting the following error. Delete IPSec phase1 sa, when I check the logs I find that from GCP (Google Cloud Plataform) it tells me that the peer is behind a NAT, because of that it cannot match the public IP in the fortigate. In my FortiGate I have a private IP on the wan interface that the service provider gives me and they manage the public.Can you help me a bit with this?