Solved

Hello I am installing fortiSIEM 7.3.1When I try to access the gui, it fails with error below"Proxy ErrorThe proxy server received an invalid response from an upstream server.The proxy server could not handle the requestReason: Error reading from remote server"

Hi all,Our infrastructure is not directly connected to internet and most of the web traffic is coming from the reverse proxy IP of our ISP.We want to use Fortigate automation to create an address object of the attacker and put it into a group that will be denied in a policy rule. This based on IPS-Logs. With the ip address of the attacker, we also want to automate the creation of a custom ips signature based on the X-Forwarded-for field we are seeing in the IPS logs.Working with %%srcip%% in the CLI script is working but of course, this gives us the IP of the reverse proxy, not the real IP of the attacker on the Internet. So not possible to block all traffic from the RP of our ISP.Is it a way to use the x-forwarded-for IP in a CLI_script in Fortigate automation ?Thanks in advance RegardsFrédéric 

I have a TRUNK-LAG configured for Aggregate mode. This interface contains VLANs 40–48. I want to add VLAN 49 as tagged on the TRUNK-LAG and untagged on SWVL-49. How can I do this?   

Hi, we changed to a FGT90G cluster and we have to change from SSL VPN to IPSec. We are running 7.4.7 and I think it will be the last image with SSL activated. We only used SSL VPN since it seemed easier to configure with different Groups, etc. Now trying to do the same with IPSec we have several problems. Our IPsec configuration:>In the IPSec Client Address range we used another range than SSL VPN (X.X.X.50-100 and IPSec X.X.X.150-X.X.X.200.>We enable Enable IPv4 Split Tunnel and define in Accessible Networks ALL since we want to have access to the LAN and also the MPLS networks>In XAUTH  User Group we have INHERIT FROM POLICY to use the same user groups we had before with SSL VPN Now our problems:> With the Forticlient 7.2 we cant connect, the client shows connecting but nothing happens. Also in the FG I dont see any information about the IPSec access. With older versions, I tried a 6.4 the connection works. > Since SPLIT Tunnel i

Trying to understand all of this so I have a few questions around the setup:I want to do TCP forwarding to support SSH but we use an internal bastion host.  So all users login to the host with their own login and from there can SSH to host in production.  From what I can tell I cannot do host key checking since that would me all users need to login to a single account.When setting up the ZTNA server one of the questions is the Default Cert.  What cert is that?  If my destination host is jump.example.com would that cert be for *.example.com???  And if so I also need to copy it to the EMS server and tell EMS to push it down to the client????Lastly,  I am trying to setup ZTNA to use SSO thats connected to our ADFS.  So if I SSH to jump.example.com should I get prompted for SSO login?  At least once in a while?

Hello guys! Got a bit confused with FG's auth process for remote ssl-vpn users. For now we have a simple LDAP/AD (w/o agent) based authentication for remote users and ACL based on AD group names, everything just works and works fine. Now I got the case that I have to implement MFA via an MS NPS(plus azure MFA) as a radius server (please don't ask why). I don't understand how to implement this transparently. Do I have to add all existing groups by name in the same way how I do this with LDAP into each ACL(that's could be long, but ok)? And how the FG knows in which group a user in ? What if the user is in several groups? So can anyone elaborate these moments ? I read this article , but it's still unclear https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-User-Groups-to-match-multiple-Remote/ta-p/358789 AFAIK the FG gets the group name AVP from the radius server (MS-NPS) , but is it all groups for each client or like a first group per client ? Do we have to change sett

Hi!  We have a pair of Fortigate VM64 in HA on VMware (provider is OVH).We are migrating clients from PaloAlto to this Fortigate. We have around 30 VDOM (and we need to add more), with VDL link to the root.We have EMAC VLANS for the interface (WAN, Private and DMZ). It is working, but when the sessions increase around 30K and higher, everything become very slow.The ping between private and dmz inside any vdom increase around 100-150ms with lost packets. The CPU is used max 20%, and the memory around 60%. We have a ticket with Fortinet, but for them , with a packet capture, there were able to show that the fortigate don't add any latency in the packets. We move back one of the client to PaloAlto and they are now happy!The PaloAlto use the same VMware farm. To be able to make the EMAC VLAN and VDL work, we needed to enable the promicious mode on the port group on VMware. Maybe this is the problem. The links are 10GBs, and the traffic on the trunk t

Hello expert. i Humbly request some guidance. I have a fortigate 80F and tried connected  to manage the  fortiswitch 524D via fortilink but the following error  "offline" (see screen shots) I have included a two screen shots for clarity.    Regards

Hi all, I'm an experienced network guy with 28 years of experience, but it's all Cisco. I'm new to Fortinet. Here's my question: I'm working on a design for a customer with multiple satellite offices that connect back to two datacenters (primary and DR). They are all interconnected with two layer-2 ELAN WAN meshes.  I want to centralize all of my routing onto the Fortigate firewalls at each location. But because the WAN links are from two separate vendors each Fortigate is going to have two physical handoffs, one to each vendor's network. My plan is to create a WAN zone on each Fortigate and then put both physical interfaces in that same zone. (I don't need any filtering/firewalling between those interfaces.) I'm trying to find out if I am going to run into any asymmetric routing issues. The WAN circuits will be load balanced so I can't promise that packets  from a particular session that go out on one vendor's circuit won't return on the other vendor's circuit

Based on another solution by @funkylicious we created a FQDN that was addressable from the internet. We also created a certificate with the FQDN in the common name and the IP address in the Subject Alternative Name. When Forticlient tries to connect to the FQDN the web browser states the connection is not private and lists that the Cert Common Name is Invalid. I notice in the address field that instead of the FQDN being listed it is showing the IP address. I thought that have the IP address in the SAN would address this. Our security policies do not allow users to continue if there is a security certificate mismatch. So trying to figure out why the IP address is showing up when connecting to the VPN instead of the FQDN. Do I need to make another certificate that explicitly names the IP address instead of the FQDN?

Hello   I'm having trouble configuring an IPsec VPN. I configure one IPSec VPN and everything works fine. Clients connect and everything works fine. When I add another VPN, the previous one stops working. Below is the configuration of the first working VPN:                  I'm adding a second VPN    After adding a second VPN, "VPN_Gamma," the first one stopped working. Only after disabling the vpn_VPN_Gamma_remote policy did the first VPN start working again. What could be causing this?

Hi,I am considering using destination NAT on the secondary IP address of the internet-facing port to build a DMZ network.Although I were able to configure destination NAT for the secondary IP address, but it is not working.My hypothesis is that the product's specifications might prevent a secondary IP address from being used for destination NAT.I appreciate any advice from someone with knowledge on this.Thanks,Kenji

I have been discussing if a Fortigate HA in A/P can work with BGP/EBGP from a single ISP.  So I wanted to see what exactly is possible.  The ISP was going to be providing the routing on their side with my firewalls accepting the connection.  I have put a logically diagram of what I am looking to build.  

Hi, Just want to know if FortiManager can access FortiSwitch CLI or edit the port of the FSW? If not, is it included on the future improvements/NFR of Fortinet? Thanks.

Hi, seeking for your insight regarding on VTP testing between 2 Cisco Switch connected to 2 FortiSwitches. I already enable flood-vtp on both fortiswitches and cisco switches configured as server and client mode.  After a change in the server cisco switch, FortiSwitch hang up and cisco switch port hang up also. Possibly due to VTP traffic flooded to the port. 

HiI have a new Public Certificate and need to upload it to FortiManager VM 7.4.5I select the certificate and private key, enter the certificate name, enter a password and click OK.  Then the certificate page refresh but the new certificate it's not there.  No error message appear. I was able to upload the same certificate files to FortiAnalyzer, so the certificate is good.

Good morning, everyone! I have a FortiGate model 100F, version 7.4.7. I configured an IPsec VPN on it for employees to connect via FortiClient. I created the FSSO connector, which brought the groups, and I created the LDAP connection (tested and validated). What happens is: in the VPN policy I created, when I add the group from AD, when I try to connect, it displays an error and won't connect. Looking at the logs, I saw an error called FNBAM_ERROR. What could this error be? Thank you.

Hello, We have been testing IPsec dialup connections using autoconnect and Entra ID credentials and so far it has worked pretty well. One area of concern is how to exclude situations where we may not want the auto connect to kick off (IE, local admin login or a user login that is not a member of the VPN group). We are using EMS to configure FortiClient on Windows devices. We have the VPN tunnel configured for auto connect only when off-fabric which covers a majority of these one off situations but is there a better way to exclude users/situations from the auto connection? Maybe something like "stop auto connection after 3 failed attempts"? We have always up max tries set to 3 but this seems to only cover reconnect attempts. Another thought was creating an additional remote user group on the firewall as a "catch all" group for users who are not members of the defined VPN groups and allow them to establish a vpn connection but  go out the WAN only. Local accounts off-

After updating the firmware of the Fortigate 60F from 7.2.2 to 7.2.4, I encountered that SNMP responses stopped coming from the interface configured on the non-managed VDOM.The configuration is as follows: SNMP server → Managed VDOM → Non-managed VDOM (SNMP target interface).The administrator's trusted host is also registered with a /32.The firewall policies between the VDOMs are verified to be correct. No changes were made during the update.Additionally, I have configured the set vdoms as described in the URL below, but nothing has changed.https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Configure-SNMP-in-multi-vdom-to-send-trap-to/ta-p/398884 When checking the communication logs in the managed VDOM, allowed communication from the SNMP server IP to the SNMP target interface is visible. However, in both send and receive directions, the received byte count is 0B.Using a sniffer in the managed VDOM, no response packets are observed.Similarly, a sniffer on the non-mana

Just need a little validation check against something I am implementing yet feel like I am losing something as well. What I mean by that is, I have in my environment, an edge firewall (this is where my users get their primary Internet from), a core firewall (that is acting also as my core router for my private WAN and firewall for my datacenter servers), and my site firewalls. Most of my security inspection is happening at the site firewalls. Since those traffic flows have now been inspected at the site level, I had no inspection for that traffic at the core if it went to the edge, again with no more inspection at the edge (only inspection was for some segmented VLANs off the core to my datacenter servers, etc...). Now that I want to implement QoS/traffic shaping on some traffic (Apple and Microsoft blowing up my bandwidth), my assumption is that I am going to have to implement traffic shaping also end to end... so edge, core, and site. Am I thinking correct on this? I feel like t

 Hello everyone,We’re currently trying to improve our visibility into offline devices in FortiSIEM, specifically in cases where agents or devices silently stop sending logs.So far, we’ve tested a few approaches for alerting:Rules using Followed By / Not Followed By to detect when events stop coming in.A rule that triggers if fewer than 50 logs are received in 24 hours (since our agents usually send ~2 status logs per hour).Unfortunately, these attempts haven’t worked as expected. We’re also not sure what the default “No Log Rule” actually triggers on, as it seems to be an internal event and generates too many false positives.Has anyone else run into the need for better alerting/reporting on devices that stop sending logs (due to agent failures, collector silent failures, etc.)? If so, how did you solve it?For reference, here’s one of the report definitions we’ve built in an attempt to make this more visible on dashboards:  WITH last_seen_per_ip AS (SELECTreptDevIpAddr,MA

Hey all, I recently setup an IPSec VPN to replkace our SSL VPN using Entra and SAML. I had an issue with setting an authusrgrp in the phase1-interface and getting it to work with the user groups that are SAML based. Unset authusrgrp in Phase-1 fixed the issue, and the FW groups starting mathcing on the traffic, but since I moved away from PSK and onto Certificates for IPSec VPN the same behaviour came back, but the authusrgrp knob is gone now due to the certificates. Can I use SAML based FW groups to segregate traffic while using certs? More specifics;We have departmental groups setup in the Entra application, and we need to make sure their access is restricted as such. I'd prefer to only have a single Phase-1 interface that's a 'catch all' for all SAML users (single IP range for all) and let the FW determine who can access what by the SAML groups, if possible.Any thoughts on what might be causing the FW groups to not match on traffic? 

Hi all,   We have 2 X 100D Hardware Appliances running firmware version 6.0.4 (build 0231 GA) in NAT (Flow-based) Mode (HA: Active-Passive).They primarily protect our wireless network which is open to use by staff and visiting members of the public. In general we do not do full SSL inspection.However, I have been testing 'Full SSL Inspection' on a few devices. I have downloaded the Fortinet_CA_SSL certificate from the firewall appliance and installed it on my test platforms (Windows & Android).On the whole, most things appear to work fine except Google Play Store on the Android device, it just won't connect to Google Play at all. If I revert to default SSL Certificate Inspection everything works fine.My Web Filter Policy blockes sites categorised as Advertising and Web Analytics. My Application Control Policy also blocks Google.Ads and Google.Analytics. It should be noted that when I allow these applications Google Play still doesn't work with Full SSL Inspection enabled.My We

We're currently in the process of migrating our FortiManager and FortiAnalyzer VMs from one host to another. We've thoroughly verified the configuration migration from the old instances, but we have some uncertainties regarding the licensing aspect of this transition.Specifically, we’re concerned about the implications of reactivating our existing licenses on the new VMs. Does Fortinet provide a grace period that allows us to run both the old and new VMs simultaneously during the transition? We want to ensure that we can safely shut down the old VMs without encountering any licensing issues.Any insights or suggestions on this process would be greatly appreciated. Thank you!

Hello, I am encountering an issue with my configuration that I am unable to resolve. I have two sites connected with VXLAN over IPSEC. On each of my sites, I have two VLANs (VLAN 10 and VLAN 20).  Here are my tests: SITE A / VLAN 10 successfully pings SITE B / VLAN 10SITE A / VLAN 20 successfully pings SITE B / VLAN 20SITE A / VLAN 10 successfully pings SITE A / VLAN 20SITE A / VLAN 20 successfully pings SITE A / VLAN 10SITE B / VLAN 10 successfully pings SITE A / VLAN 10SITE B / VLAN 20 successfully pings SITE A / VLAN 20SITE B / VLAN 10 successfully pings SITE B / VLAN 20SITE B / VLAN 20 successfully pings SITE B / VLAN 10However, SITE A / VLAN 10 cannot ping SITE B / VLAN 20SITE A / VLAN 20 cannot ping SITE B / VLAN 10SITE B / VLAN 10 cannot ping SITE A / VLAN 20SITE B / VLAN 20 cannot ping SITE A / VLAN 10Do you have any idea why? Thanks for your help!