Solved

Hello everyone, I have read the documentation and multiple community posts, but I'm still confused if a FortiGate can act as an IPAM server alone? The documentation says the FortiGate can act as a standalone IPAM server:https://docs.fortinet.com/document/fortigate/7.4.8/administration-guide/166728/configure-ipam-locally-on-the-fortigate  But I also have seen community post that say the opposite:https://community.fortinet.com/t5/Support-Forum/IPAM-feature/td-p/312696 https://community.fortinet.com/t5/Support-Forum/IP-Address-Management-IPAM-feature-on-Fortigate-enable/td-p/260963  So can a FortiGate be a standalone IPAM server or no? The documentation isn't very specific for a standalone FortiGate that manages multiples networks or maybe I have missed that part. Also when I configure an interface on the FortiGate for IPAM, with rules and all, it doesn't configure the DHCP server on the interface. It leaves the DHCP pool blank even though screenshots wi

Hi everyone,I’m working with a FortiGate 100F where interfaces X1 and X2 (10 Gbps) are in a dedicated VDOM used only for public-facing web services. We’re using SD-WAN and Virtual Servers in ssl-mode half, with a wildcard certificate to handle incoming HTTPS traffic for different subdomains like cloud.mydomain.com and nest.mydomain.com.Here’s my situation:I’m not a networking expert — actually, I’m pretty new to FortiGate and still learning as I go. It’s a small company and we all wear many hats, so I do a bit of everything, from servers to firewalls to figuring out reverse proxies when needed :grinning_face_with_sweat:Inside the server called nest, I’ve got multiple virtual hosts configured (for Joomla, Unity, etc.), and I’d love to route incoming HTTPS traffic based on SNI — ideally sending requests for cloud.mydomain.com to one backend, and nest.mydomain.com to another, or at least letting a single server like nest receive the correct traffic and handle it based on the domain.From w

Hallo everyone. I recently started working for a company that has this network topology.I see that the Aruba switches are set to MСLAG with Fortiswitches, but from the Fortiswich side there are no MCLAG settings. At the same time, Fortiswiches are online and available through Fortigate. I tried to set up MСLAG on FortiSwitch, but I encountered the fact that the Aruba side is specified as native VLAN 4094, and there is no such VLAN on FortiSwitches, at least I don’t see it through Fortigate GUI.Should I create a new VLAN with ID 4094 or is it better to change the native VLAN on Aruba?I am confused that VLAN with ID 4094 is specified everywhere in Aruba settings as native and the network works.

In version 7.4.8 for Fortigate 90G, the support for SSL VPN has been removed. Why is there no mention of this in the documentation? I need the SSL VPN functionality on this device. Where can I address my complaint about the removal of functionality for this model without any warning?

Hi Team, Could someone please guide me on can we add fortisiem agent while have splunk agent is in the system ?  do we need add exceptions ? What to look for before adding agents ? Is there any performance issue ? @Secusaurus @Anthony_E 

Hello everyone.I have a question regarding the status of some hosts in FortiNAC that are showing as "Disabled Online". I have already checked the settings to find out the reason, but so far I have not been able to find the cause and resolve the issue. Has anyone else experienced this? If so, can you share what was done to resolve the issue?Thank you for your attention.

I have a firewall configured on Transparent mode (two interfaces, inside and outside). Also I have a MGMT interface connected to the same vlan. In this case can it form L2 Loops? What is best practice?

Hello,FortiClient 7.2.x (also 7.4.x) shows invalide certificate warning after every reboot of the client, also the setting to do this on ems are not enabled. Any idea?Fortinet says this normal.....  

Hello.  Does it matter if the mode of the policy and the mode of the web filter are different except when Fortigate's policy is flow mode and web filter is proxy mode? Thank you. 

IPSec VPN with SAML was configured according to https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-Microsoft-Entra-ID-SAML/ta-p/307457. The configuration seems to be in place according to the documentation, but I get ERR_CERTIFICATE_INVALID (which is to be expected), but if I click 'Continue (unsafe),' the Script Error shows up. Error says 'Permission denied,' and the URL says 'about:blank.' If I click 'Yes' for 'Do you want to continue running scripts on this page,' it simply goes back to the untrusted certificate popup. It cycles back and forth indefinitely. Does anyone have an idea as to what I can try? Thank you.  

Hello Running FAZ 7.4.7  What does has this impact on (exceeding the daily logs license)?Does this mean new logs will not be saved?Or it has (something) related to TAC support?  

Hello, I'm trying to configure an IPsec tunnel to replace ssl-vpn, but i can't make split tunnel to work. I have split-tunnel enabled with just an internal network allowed, and a policy that explicity allows traffic to that network. The problem is, once connected, the tunnel pushes a default route to the client, so all the traffic goes thru the Fortigate.I already tried things i saw on this forum but nothing worked To add info; doesn't matter what config i do on the forti or client side, doing "route print" always show a default route to the Forti (when i'm connected). 

Hi NAC admins FortiNAC 7.6.3.FortiOS 7.4.8 managing FortiSwitches 7.4.6. According to "FortiNAC - FortiSwitch FortiLink Integration Guide" doc, both SNMP MAC Notification & Syslog methods are supported.https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/bf034eae-75df-11ef-8355-fa163e15d75b/FortiNAC-F_7.x-FortiSwitch_FortiLink_Integration_Guide.pdf From the pros and cons list on page 7 & 8, am I supposed to I understand that Syslog method is more recommended than SNMP MAC notif method?Anyone tried both and can advise on the best one?

 Hello friends, I'm facing a problem regarding the phAgentManager down process.When investigating the logs, I saw that this is related to the Office365 integration with SIEM. The Failed (Failed to parse hostName(s), invalid hostName or DNS lookup failed.) error occurs when I try to test the credentials that were configured, even simulating incorrect credentials it continues to give this error.I have other API integrations, as well as other solutions and they work normally. The error of failure to resolve the DNS of the Office 365 service seems quite strange to me, I've already checked the DNS issues of the supervisor and there is no resolution problem. I would like to know what I can do to solve this problem. Thank you

Hello, I'm interested in the following type of information.We have configured and set up IPsec remote access VPN on a FortiGate device. At this stage, it works without issues only on version 7.2.When I tried to connect using FortiClient version 7.4, it got stuck and showed the message:"timeout while responding IP address".What could be the cause of this?Have you had similar experience?Please share your experience if you have.

Hello team!! I have many questions about VPN Licences.I think I understand the following, please let me know if I am wrong:* Up to FortiOS 6.2: I have licences for 10 Standalone Forticlient* From FortiOS 6.2 or higher: Unlimited Standalone Forticlients In first place I don't care about support, I am worried about how many client I could connect to Fortigate VPN.What about L2TP VPNs?  There is a limit for the amount of clients?I see an article here for FortiClient, but not for L2TP VPNs. Thanks in advance.Regards.Damián 

Hi guys.I'm trying to upgrade my Fortigate 600E in our production environment. I don't have a forticare account and our contact will get firmware for us. Now I want to verify them by using MD5 checksum. I did a reserach and fortinet said If you go to their site and paste firmware file name, It will give you checksum. But no matter what name I type in bar, It says it couldn't find information about it.Since this is a production unit, I highly appreciate if anyone can give me hash details of these files. Thank you in advance.File: FGT_600E-v7.2.10.M-build1706-FORTINET.out.zipFile: FGT_600E-v7.2.11.M-build1740-FORTINET.out.zip

Hi There, Was wondering is there a way to export or import Alerts/Incidents module viewing templates.Tried to find it on the Apllication itself and also the Export Wizard module but with no luck.This feature dosn't have to be clickable, could be a manual files copying process.Any suggestions? Thank.Regards.

Hello everyone,I'm currently setting up a lab environment to authenticate mobile users (smartphones, tablets) to a WiFi network using certificate-based authentication via 802.1X.I'm following this Fortinet guide (but i'm using a Bridge SSID and not a Tunnel SSID):FortiNAC WiFi 802.1X based network using FortiNAC Local RADIUS ServerInfrastructure:FortiGateFortiAPFortiNAC-F version 7.2FortiGate Configuration:SSID:RADIUS Server settings:NAS IP: set to FortiGate IPradius-coa enabled via CLI VLAN Interface ID 69 created and enabled with:RADIUS AccountingSNMPPINGSecurity Fabric ConnectionFortiNAC Configuration:Local RADIUS: Configured and enabled all TLS typesWinbind Domain: Configured (used for another SSID with LDAP + Persistent Agent)Network > SSID:SSID bound to Default RADIUS ServerCustom Settings:RADIUS Mode: LocalRADIUS Attribute Group: RFC_VLANEnforced Wireless Role: default, registration, and logical networksVLAN Port Group (ID 69):Authorized Access PointsForced Authenticatio

FortiGate-81F # diagnose debug fsso-polling detailAD Server Status(err: server can not be accessible):ID=1, name(172.18.0.1),ip=172.18.0.1, port=0, source(security), users(IPv4:0, IPv6:0),username=swd\lcloperator2read log eof=0, latest logon timestamp: Thu Jan 1 03:00:00 1970polling frequency: every 10 second(s), success(0), fail(106)LDAP status: initLDAP query: success(0), fail(0)LDAP max group query period(seconds): 0this is branch location firewall the AD is in DC location also i checked the Fortinet documents but still i didn't find any solution can you please help me on this Note: Agentless polling mode

I have loaded FG image on Hyper-V, how can I request virtual license in offline (without Internet on Firewall)  mode?

After configuring the VPN address provided by the client (scss.square-enix.co.jp) on other computers in the local area network, all connections were normal. However, one of the computers encountered the aforementioned error. Could you please take a look and identify the cause? The version number of FortiClientVPNSetup is 7.2.3.0929 Failed to establish the VPN connection. This may be caused by a mismatch in the TLS version. Please check the TLS version settings in the Advanced of the Internet options. (-5029) 

Hello, We're running a pair of FortiGate 121G (v7.2.11 build1740) in active/standby mode, acting as a gateway/DNS and DHCP server for the wireless guest users.The Security Policy along with the DNS Filter policy is very generous with literally nothing blocked. There are absolutely no issues with any laptop (Windows or Mac) and Android phones/tablets, but I have consistent issues coming from iPhones. It takes some time to load any page and sometimes it works fine and sometimes it just times out. Reloading the page seems to help. I initially blamed Private Relay, but turning it off doesn't seem to help, and there is nothing in my policy that could affect it. Everything is under DHCP and it's the same SSID for all devices. Would greatly appreciate any tips since I can't find any errors in the logs, nor traces that some web resources are blocked. Thanks.

Good morning, Since upgrading to 7.4.3 on my 601E firewall cluster, my AP's (only 9 of them) keep dropping offline with no good explanation in the logs that I can tell.  I never had a problem with the previous version I was at which was 7.4.1.  A reboot of the AP (either by resetting the POE on the switch port or by unplugging and plugging back in) will bring the AP back online and connected with clients but then randomly (could be hours or days later) it will drop back off.My Fortigate cluster is stable (no HA changes) and seems to be normal.  The APs are all 221Es running 7.4.2 firmware.  The only log entry I see that seems to be related to when they drop is:Action ap-failReason Control message maximal retransmission limit reachedProfile resv-dflt-FP221E5519035229Physical AP ap-2b-publicMesh Mode mesh root apMessage Failure happened on AP ap-2b-public. I did find a document (https://community.fortinet.com/t5/FortiAP/Troubleshooting-Tip-After-a-failover-F

Blocking External Access to the Anydesk ApplicationHello, good morning.I'm trying to block external access to the Anydesk application installed on computers on my internal network. I've tried several times to block access by creating firewall rules to block access from WAN to LAN, but to no avail. However, I can normally block access from LAN to WAN using Web Filter, Application Control, or Anydesk's internet service.Could you help me with the best way to implement this external block?My goal is for users on my internal network to be able to use Anydesk for remote access normally, but for external access to Anydesk on my local network to be blocked.Thank you in advance.