Solved

Hi FNAC adminsI see FNAC-F doesn't support SCEP.Anyone knows when it is planed?

Hi FNAC adisOn FortiNAC-F 7.2.9 we can see logs of local RADIUS but can't find anywhere the logs of RADIUS proxy.Any idea where we can find that?

I have 2 VPNs configured in my forticlient VPN, one of those works fine but the other after it connects I can't acess any server in my network.I checked that it shows that Received bytes are constantly at 0. I was using an older version of the client for years until it stopped working for this 2nd VPN, then I updated it to version 7.4.0.1658, but the problem continued. Can anyone help me understand what is the problem?

Hello, in the proccess of troubleshooting my Entra SAML DialUp IPsec tunnel I noticed something weird. While SAML auth via TCP 9443 worked fine, the handover to the IKE negotiation didn't work. There were no packets being received by FortiGate referring to IKE negotiation or ESP, only SAML via 9443. I was blaming my ISP first but running a local Wireshark on my WiFi interface revealed that there aren't even packets leaving my device for that peer IP referring to IPsec. To limit potential sources of errors, I replaced the SAML auth with a local firewall user and tried to log in. However, that doesn't work as well. Now there are NONE outgoing packets to the gateway IP! Upon login, FortiClient freezes for a bit and then says "IPsec connection is down" - like without even trying. I tested on 3 diferent devices now and I can't get it to work. My only assumption is that Wireshark doesn't capture the traffic to the gateway and that there's an iussue somewhere in the config

Hello FortiNAC community We have FNAC 9.4.3 controlling WiFi access with FNAC local RADIUS + Winbind.All works fine except when a user's password has expired.With our old MS AD RADIUS, when user with expired password wants to connect to WiFi, it asks him to reset his password. However with FNAC RADIUS it doesn't, so the user is unable to connect and unable to reset his password. Any useful idea would be appreciated. 

Hello all, I am currently setting up 802.x1 EAP-TLS authentication on an external cloud radius server on my FortiSwitch 448E-POE (Fortilink) and am experiencing a minor issue.Basically, I wanted to do this via TLS TCP (RadSec).I noticed that the FortiSwitches only send the packets as UDP. Presumably, the current FortiSwitch FW S448EP-v7.6.2-build1085,250526 (GA) does not support TLS over TCP, is that correct? In any case, there is no mention of “set transport-protocol tls” in the radius profile on the switch.The FGT with FW v7.6.3 build3510 (feature) seems to support this; at least, I can see that the packets are sent as TCP and they also arrive on my RADIUS server.In any case, I have now adjusted the RADIUS client so that it performs authentication via UDP on the RADIUS server. The query is also successful and arrives at the RADIUS server.The problem is that when I try to authenticate on a port of the FortiSwitch, no packets arrive at the RADIUS server. In debug mode, I can see t

Hi everyone!, I'm currently facing a problem with DDNS associated with fortiddns.com. The service isn't updating and returns an update error. Additionally, when I attempt to edit the configuration, no servers appear as available. This started after the DNS incident. I have another FGT 100F with the same configuration and it's not experiencing the issue. Has anyone else run into this problem?Any insights or suggestions would be appreciated.best regards! 

So we trying to setup a new Dialup IPSec tunnel but we keep getting a connection time out message. We rebuild the tunnel and policies multiple times thinking we missed a step but from the videos we found online this should be the simplest thing to do. I can see the traffic make it to the firewall and I see in the local traffic logs that the traffic is denied (even though we setup local-in-polices) to allow the IKE traffic.  So we are stumped and we are hoping that we are missing something simple that a more experienced person setting these things up might clue us in on. Our firewalls are running 7.4.8 and we are running Forticlient 7.4.3 (We've also tried 7.0.9 and 7.2.9 since some posts we stating older versions worked vs the latest version). I feel something is blocking the traffic on the Firewall I'm just not sure what it could be. Thanks for all and any help. Phil

Hi community,I have the following VoIP setup:Avaya IP Office v2 --- FG-80F --- ISP1 / ISP2 (SD-WAN)My goal is to configure a simple failover, where the FortiGate automatically switches to the secondary ISP if the primary link goes down.However, I’m running into the following issues: With SIP helper / SIP ALG enabled:Once the SIP communication is established (INVITE, ACK, etc.), the SIP ALG forces the voice traffic to go out through the failover link (ISP2), even though it should stay on the primary.This breaks the voice session.I’ve tried separate rules and SD-WAN policy routes, but the issue persists. With SIP helper disabled (no ALG):The SIP/SDP packets are sent out through the correct WAN link.However, the SDP headers are not NATed and still carry the LAN IP address.As a result, packets reach the destination but the remote side cannot reply. Has anyone faced a similar scenario?I solved this problem configuring the wan ip on the avaya but just can set 1 of them so if m

Hi,When I add new interface, I cannnot Hardware Switch Interface Type.CLI too,======================XXX(test2) # set typevlan VLAN interface.aggregate Aggregate interface.redundant Redundant interface.loopback Loopback interface.wl-mesh WLAN mesh interface.fext-wan FortiExtender interface.emac-vlan EMAC VLAN interface.ssl SSL VPN client interface. CLI too==========================# set typevlan VLAN interface.aggregate Aggregate interface.redundant Redundant interface.loopback Loopback interface.wl-mesh WLAN mesh interface.fext-wan FortiExtender interface.emac-vlan EMAC VLAN interface.ssl SSL VPN client interface.Would anyone be kind enough to tell me the solution?Model:FortiGate-120GOS:v7.4.8 build2795 (Mature)Thank youKenji,

Hello,  I wanted to know if this FG model (FortiWiFi 50G 5G) can be connected to the ISP via a wired access. Meaning, can we use the WAN port to connect to our ISPs PE?  Thanks in advance.  \Best, ~zK 

Hi there, I have an FG40 behind the ISP router (and I can't remove it) whit a NAT 1:1 configuration.With a phone (connected to WLAN) I have to reach the NVR (connected to LAN) pointing to the public IP of the office.If the phone is outside of the office, pointing to the public IP, I can reach the NVR because I have created dedicated rules on firewall.If the phone is in LAN (WLAN but is the same), pointing to the public IP, I can't reach the NVR.How can I solve this ?Thank you 

I have FortiGate-VM in AWS 7.6.2, FortiManager 7.6.2, FortiEMS Cloud 7.4.   I am slowly rolling out ZTNA in place of SSL VPN.  One of the most annoying things I have run across is that its super easy in FortiManager and FortiGate to show which users are actively doing SSL VPN.  But there does not seem to be any such way to show who is actively using ZTNA. I can manually comb through the logs but thats a pain.  Is there some easy way to see who are the active ZTNA users?

We have 2 sites (SiteA & SiteB) that have 2 VPN tunnels with HQ. e.g.:  SiteA ---- HQ ---- SiteBNow I can access to HQ on site A and access to HQ on siteB.Can I access to SiteB devices on SiteA?

I ADVPN with BGP and SDWAN enabled, is add route in the VPN Phase1 Interface should be enabled or diasbled? 

We have multiple Fortiswitches managed by a Fortigate.  I need a command to see the MAC addresses on a specific port on a managed switch.  For example, I need to see the MAC addresses on port 1 of switch "1234."  I can use this command to see "port1": diagnose switch-controller switch-info mac-table | grep port1 But this command lists all the port 1s for all the managed switches. I need a command that let's me specify which managed switch I want to view. Thanks.

We are converting checkpoint configurations to fortigate (finally getting rid of it)But I have seen the interface setting and here is something I am not used to itIn Checkpoint the LAG interface itself (the physical) has a network without VLAN the Forticonverter converter exactly the same settings. see screenshots bellow:I am used to put all IP addresses and betworks to logical interfaces with VLANIDSo my question is, will this work normally in fortigate? with VLAN ID 1 ? untagged ? can this interface (the physical) be assigned to policies later ? Thanks 

Using the FortiClient VPN to connect with SAML authentication, logins worked before we created a Conditional Access policy that enables "Require device to be marked as compliant" and "Require Microsoft Entra hybrid joined device". When we connect Microsoft blocks the login because it doesn't recognize the device with the following info. You can't get there from hereThis application contains sensitive information and can only be accessed from:domain joined devices. Access from personal devices is not allowed.The current browser is not supported, please use Microsoft Edge, Internet Explorer, Chrome or Firefox 91+ to access this application.If you're not planning to do this right now, you might still be able to browse to other domain sites. Otherwise, sign out to protect your account.Sign out and sign in with a different accountMore detailsError Code: 53001Request Id: RequestUUIDCorrelation Id: CorrelationUUIDTimestamp: 2024-09-14T20:46:27.958ZApp name: My VPN Enterprise AppName

I am trying to configure the PostgreSQL connector on my FortiSOAR setup to connect to the FSR DB however, it fails with below error:Configuration Health Check Failed!FATAL: no pg_hba.conf entry for host "192.168.60.101", user "postgres", database "venom", SSL encryption FATAL: no pg_hba.conf entry for host "192.168.60.101", user "postgres", database "venom", no encryption I tried connecting to the same DB using the pgsql command line and that works fine. What could be the issue here:[root@fortisoar csadmin]# sudo -u postgres psqlPassword for user postgres:psql (16.8)Type "help" for help.postgres=# \lList of databasesName | Owner | Encoding | Locale Provider | Collate | Ctype | ICU Locale | ICU Rules | Access privileges---------------+------------+----------+-----------------+------------+------------+------------+-----------+-----------------------connectors | postgres | UTF8 | libc | en_US.utf8 | en_US.utf8 | | |das | postgres | UTF8 | libc | en_US.utf8 | en_US.utf8 | | |data_arc

Hi there.I am having some issues installing FortiClient 7.4.3 on MacOS 15.6 (24G84)Macbook Pro M4 Pro Using the terminal, I found that the installer fails at around 97%. installer: Package name is FortiClient installer: Installing at base path / installer:PHASE:Preparing for installation… installer:PHASE:Preparing the disk… installer:PHASE:Preparing FortiClient… installer:PHASE:Waiting for other installations to complete… installer:PHASE:Configuring the installation… installer:STATUS: installer:%17.931671 installer:PHASE:Writing files… installer:%39.280230 installer:PHASE:Writing files… installer:%64.101310 installer:PHASE:Running package scripts… installer:%64.661962 installer:PHASE:Running package scripts… installer:%65.221900 installer:PHASE:Running package scripts… installer:%65.786566 installer:PHASE:Running package scripts… installer:%66.347237 installer:PHASE:Running package scripts… installer:%66.911340 installer:PHASE:Running package scripts… installer:%86.516746 ins

Hi,I want to monitor a public IP from my FortiGate, and if the IP becomes unreachable, I want to automatically receive an email alert.Is this possible using FortiGate Automation? If yes, how can I set it up?FortiOS Version: 7.2.10

Hello, I have upgraded my FAC Agent version from 5.2 to 6.2 on my RDS Host.A few days later I have lost the capability to do a remote connection (aka RDP) on this server. I have completely uninstalled the FAC Agent on this server but the RDP access is still unavailable.I have the FAC Agent v.5.2 installed on another RDS Host server and everything is working nice. Nothing in the release notes, any ideas ?  Thanks,

Hello everyone,I have a network that was configured a few years ago with a FortiGate (FG) using a "hardware switch" on ports 1, 2, and 3. The setup is as follows:"internal1" interface:Contains three VLANs:VLAN 1: Used as the core VLAN (I know this is not ideal, but I am not authorized to change it).VLAN 100: Network exclusively for wireless clients.VLAN 1005: Network for phones.Network topology:FG -- Cisco Switch-- FortiSwitch 108 (FSW)The FSW is connected to the FortiGate through "internal1."I configured the FG to recognize and manage the FSW via FortiLink, even though it is not directly connected.FortiLink configuration:I created VLANs 100 and 1005 within FortiLink, assigning them IP addresses and DHCP servers different from those in "internal1."Issue:The VLANs configured on the FSW via FortiLink have no connectivity and do not receive IP addresses via DHCP.I have already configured the ports on the intermediate switches (Cisco and HPE) to allow all VLANs, but the issue persists.Any

Hi everyone,I’m running into an issue with FortiClient VPN Only 7.4.3 (VPN with SSO/EMS support) on macOS 15 Sequoia (15.6). What’s happening:The VPN requires SSO via web browser (SAML) + 2FA.On macOS 15 Sequoia, FortiClient never triggers the required Automation (AppleEvents) TCC permission.I have reset TCC (tccutil reset AppleEvents com.fortinet.FortiClient), reinstalled the app, and checked Automation, Accessibility, and Full Disk Access settings — nothing changes.Without the Automation permission, the embedded SSO browser cannot complete login, and the VPN connection fails.Environment:Personal Mac (non-supervised, no MDM)FortiClient 7.4.3 (VPN + SSO)Tested: full uninstall/reinstall, TCC reset, permissions check — still no Automation promptQuestions for the community:Has anyone managed to get SSO working with FortiClient on macOS 15 Sequoia without MDM/supervision?Is there an older version (e.g., 7.2.x) that still works on macOS 15 for SSO?Any info on when macOS 15 Sequoia will

Hello,  we have two firewalls. We started upgrading the first over automatic upgrade -> 7.0.17 to 7.2.11 to 7.4.8. This was fine. The second had to be updated manually -> 7.0.17 to 7.2.11 ok. Now the upgrade moved to System/Fabric Management. However there I can't choose a file for upgrade anymore. This is availalbe in 7.4.8 again but not in 7.2.11. How can this be solved? Kind regards,David