Solved

Hello,We are trying to adjust the threshold for the Fortigate DOS IPv4 L4 anomalies rule because it triggers too many incidents on our FortiSIEM.The issue is that it is hard to know how far the threshold (5000 pps in our case) is overtaken.The raw log, as sent by the FW to the FortiSIEM is the following: <185>logver=702101706 timestamp=1741353017 devname="*redacted*" devid="*redacted*" vd="root" date=2025-03-07 time=13:10:17 eventtime=1741371017400546868 tz="-0500" logid="0720018432" type="utm" subtype="anomaly" eventtype="anomaly" level="alert" severity="critical" srcip=*redacted* srccountry="Reserved" dstip=*redacted* dstcountry="Reserved" srcintf="VLAN35" srcintfrole="lan" sessionid=0 action="detected" proto=17 service="udp-53" count=13 attack="udp_dst_session" srcport=57032 dstport=53 attackid=285212775 policyid=3 policytype="DoS-policy" ref="http://www.fortinet.com/ids/VID285212775" msg="anomaly: udp_dst_session, 5001 > threshold 5000, repeats 13 times" crscore=50 cr

I did a simple exercise where I connected the two PCs to the physical FortiGate (to port1 and port2). Then I created a rule where I set the incoming traffic to port1 and outgoing traffic to port2 (with all other parameters set to 'all'). I also created another rule to permit the reverse traffic. However, all traffic is being denied due to the implicit deny rule. Does anyone have a suggestion regarding this configuration? I can ping the FortiGate from the PCs. The FortiGate is not registered yet (I did the same configuration in VMware Workstation with the FortiGate running on a VM, and it worked).

Hello, FortiGate-100E # diag sys ntp statussynchronized: no, ntpsync: enabled, server-mode: enabledipv4 server(192.168.0.61) 192.168.0.61 -- unreachable(0x0) S:7 T:684no data I have the following issue: I have activated NTP on a FortiGate 100E. Unfortunately, I do not have a WAN interface configured on the interfaces, and I cannot assign an external IP address directly to the device. I want to extend the NTP address to the firewall through a tunnel, so the access is open. The access is open, and I can ping it from different interfaces that I have configured under "listen on interfaces."However, it still cannot synchronize and has a 2-minute delay. What could be the cause of this issue? What should I check first, and if possible, could you provide a solution? #FortiGate #NTP #System_Settings

Hello Team, now I have a cluster of FGT 500E with five vdom that manage via FortiManager. I need migrate all configurations of FGT 500E on a new cluster FGT 400F. Now on FGT 400F i have configured only the management interface. what is the best way to migrate configurations? Configure the new cluster locally and then hook it up to the fortimanager or the other way around? Thanks for the supportBR

Hello I have a question: when using SDWAN rules with Maximize Bandwidth (SLA) or Best Quality strategies, what happens to sessions already started on an Internet link that no longer meets SLA requirements? Are these sessions terminated by Fortigate or do they remain on the low-performance link until they are formally terminated by the application?

I'm looking for configuration example on the FortiAP to solve this use case.  Client connects to an Open SSID, gets an IP from FortiNAC's registration interface. It is then directed to FortiNAC registration portal. Once the user is authenticated, NAC policy is applied and the Wifi vlan is changed to allow access. On the "Main" SSID interface, should there be any IP address ?Should Captive Portal be enabled with the external IP of NAC's registration interface ?Would you have two SSID "subinterfaces", one for each the registration vlan and guest access vlan ? Or just one for the guest access vlan. Any example configs or guide on the AP side would be much appreciated. I believe I have what I need on the NAC side.Don    

Greetings...  I have a FortiGate 60F in a building that is central to three legs of a campus, south, west and north. Mounted on south, west and north exterior/outdoor walls of the central building are three FortiAP 234F units providing WiFi to each leg as noted. Some recent renovations have left the signal poor at the end of each leg inside buildings, so we have purchased three more FortiAP 234Fs and plan to turn the existing WiFi network to a Mesh Wireless Network and are curious as to the best route we should go to configure this. Currently, all three APs are directly wired to the FortiGate and use the same SSID to make connecting and roaming the campus seamless. Each leg will have two FortiAP 234F units, a total of six on campus, one direct wired connection to FortiGate as noted and one mounted at end of each leg to provide stronger signal. Is it best to set up each leg as its own Mesh Wireless Network with its own SSID, or can all six units use one, si

Hi Team, I have several Fortiswitches managed via Fortilink, and I need to configure snmpv3 with one Read and one Read/Write user. This configuration must be done from Fortigate? Can you provide me the steps to follow to perform this configuration. Thanks and best regards,Juanmi

hi all,I have a SD-WAN performance SLA with two participant interface, I want to view the history curve in FortiAnalyzer but one of the participant interface is not there.however, another SLA with the same interface have the interface displayed in FortiAnalyzer.what could be the reason and how to fix it?1. SLA 2. SLA in fortianalyzer with all participants (OL_INET_SKO_112 and port17)3. SLA in fortianalyzer with only one participant (OL_INET_SKO_112)

We were working w/ Lumen on getting Fortinet SD Wan setup. We currently have Meraki and Firepower FIrewalls sitting behind a pass through port on versas, but when switching to the exact same setup on Fortinet, a lot of traffic was dropping. Mainly UDP because thats what meraki was complaining about. Is there something the Lumen tech was missing that would cause this to happen?    

Dear Team,We are experiencing an issue with SSL VPN authentication when using email-based OTP and custom realms.**Device:** FortiGate 100F**Firmware:** v7.2.8 build1639 (Mature)**Authentication type:** Local users with two-factor authentication set to email**Issue:**- When users authenticate via the **default realm** (i.e., no "set realm" in the authentication rule), the OTP email is sent, and login proceeds successfully.- When configuring a **custom realm** and associating the same users via an `authentication-rule`, the login fails with **"permission denied"** and **OTP is not triggered**.- Debug logs show: `two factor check for [user]: off`, even though user configuration includes `set two-factor email`.**Troubleshooting done:**- Verified user has `set two-factor email` and valid email address.- Tried assigning user directly in `authentication-rule` and via user group — behavior is the same.- Reset password and email OTP on the user — no change.- Verified that SSLVPN works in both r

Is there a way to Block all Internet traffic except Veeam Malware detection URL?The DNS is changing every time (IP's) so based on IPaddress Its not working always.And I also created a DNS filter   But I see still traffic to others based on IP (I think) Is there another way to fix this? Kind regardsDaag

I do have a ticket open on this but getting little traction.  Hoping I might get better traction here. My users currently use SSLVPN with SAML to our ADFS server perfectly.  I read the docs and created a IPsec config for the users using a new IKE port.  I created a new FSSO that only differs from the one used by SSLVPN in the port number.  Created a new Relaying Party Trust which is a mirror image for the SSLVPN one (just changed the port number).  All of the certs are exactly the same. When I test and debug I see the username and group coming back to the Fortigate in the debug.  Right after that I see:__samld_sp_login_resp [830]: Failed to process response message. ret=-111(Failed to verify signature.) Which means its having Cert issues.  Not sure I understand how this can be.  The certs used on the fortigate are the same for IPsec and SSLVPN.  The cert in the Relaying Party Trust is the same between the 2 config.  I hav

Hi Everyone, We have several locations that need to RDP into our office to access the same PC via the same RDP port.  Our current setup is: VIPName: VIP RDP PC1External IP: Our building's external/public IP.Map to: PC1's LAN IP.Port Forward to: 3390 TCP I created a Firewall Policy:Name: RDP To PC1Incoming: WANOutgoing: VLAN5Source: AllDestination: VIP RDP PC1Service: AllNAT: DisabledAction: Accept For some reason, I can RDP in from home. When a coworker tries to RDP in from their home, they can't. Before we could RDP in when we were using a different firewall, Netgate 6100, so I know it's not our home setup. We just installed this Fortigate 90G, which is very nice. Any assistance is greatly appreciated. Thank you very much,Sonny

I deployed a FortiNAC VM and configured policies to assign users to VLANs based on their department. To achieve this, I used an Active Directory attribute to assign a role to each user, which FortiNAC then parses via AD synchronization.  In the User Accounts page (first image), I can see that the correct role "112" has been assigned to the user. However, in the Hosts section (second image), the user’s laptop—where the same user is logged in—does not have the expected user role assigned (it should be 112 but is missing).This discrepancy prevents proper VLAN assignment. How can I troubleshoot and ensure that the role is correctly applied to the host?

I have configured SSL VPN on one of my FGTs using GUI, the same way as it was configured on another one (the idea is to move some business critical services from one office to another). Then I have discovered that FortiClient can't connect because of a connection timeout. Further debugging with packet sniffer has revealed that only SYN packets are coming from client, nothing goes back. The next step was the flow debugger:MyFGT # 2025-01-09 16:58:51 id=20085 trace_id=195 func=print_pkt_detail line=4489 msg="vd-root received a packet(proto=6, my.client.ip.address:51567->my.fgt.ip.addresss:10443) from wan1. flag [S], seq 1184327228, ack 0, win 65535"2025-01-09 16:58:51 id=20085 trace_id=195 func=init_ip_session_common line=4645 msg="allocate a new session-000fdb96"2025-01-09 16:58:51 id=20085 trace_id=195 func=fw_local_in_handler line=398 msg="iprope_in_check() check failed on policy 0, drop"I have read a dozen of pages on the internet, in Fortinet knowledge base and in this forum, als

Hello, we are working on this problem for some time now and we dont quite understand the problem. We have FGs in smaller offices with MPLS connected to our mail firewall in a DC. We are using VMs in our local DC connected with MPLS (biggest ISP in the country) and also now some VMs in Azure connected via main Fortigate in DC and Fortigate in Azure Cloud (internet speed 200/200mb) The problem is that users in branch offices which are working with a VM file server in Azure via SMB are reporting problems because of low performance. The ERP system has to save some files on the Azure VM and it takes a very long time. Uploadig files (later we checked with a big ISO file) we get like maximum 5-10mbits to Azure. For the IPsec to Azure we use our dedicated WAN with 1GB and have like 200mb on the Azure site. So we started testing and checking the performance on all sides. From branches we have MPLS 1 GB (divided por streams so we are not 100% sure) to our DC. Downloading and

Hello Dears, Just wondering how I can rewrite the below host and the steps to do it. x.example.com/portal-clienty.test:9443/portal-client  Thank you 

Hi All, I am in need of some expert advise on this after exhausting Forti TAC support. Details:FW: 7.2.4AP: 7.0 Build 0031 (latest).H/W: U231FProblem: The AP's are all using the same channels and because of that when users are roaming they get disconnected and I have to either reboot them or put them into a different AP profile and limit the channels they can use so that each AP uses different channels - this is particularly for 5Ghz.I don't understand why even with RRP - Enabled and DFC channels selected the APs are selecting the same channel and I can confirm the AP signals are overlapping so why is the AP not smart enough to move the AP's to different channels?Can someone please guide me on what am I missing here and Forti-TAC's suggestion is to create an individual profile for each AP and enable RRP but limit the channels or make sure they don't overlap. Your help is much appreciated. Wireless Controller,  #firewal  

Hello, In some data ingestion steps that are relying on pagination ( OpenCTI "Get Indicators" action for instance ), while using for loop in playbook step, we need to provide the output  variable of one loop as an input for the next loop to be executed. How can we achieve this? RegardsFabien

Hello @All can I use on FGT 1100e the two Mgmt/HA ports, both for HA only? Many thanks in advanced TBC

Hello Team,I have been searching for the EOL/EOS dates for several products and have reviewed the product life cycle on the support portal, but the exact information was not available. As a TAC, could you please provide the EOL/EOS dates for the following products? Additionally, why are they not mentioned on the portal, and what should we consider if we cannot find the data on the portal in the future for any other Fortinet products?- FAZ-150G- FG-200E- FG-101F

I have a SSLVPN working for my users.  They authenticate using SAML to our ASFS server.  I am trying to do a similar thing but now with IPSec.  I have changed the port but my iDP is the same.  When I try to VPN with IPSec the debug reports that its using the Assertion consumer service URL (login) url with the SSLVPN port number. Can I try to do SSLVPN and IPsec both using SAML and the same iDP server at the same time?  I do not have a test environment so this is the only way for me to test.

Hello Everyone, I have 2 internet and I configured SD-WAN with load balance on the FortiGate firewall. I have inbound policy to my web server and it works fine from outside but when I'm in my local network and use the guest wifi it doesn't load the we server page.  How can I have the return path from guest to my web server?Do I need to configure SD-WAN rule or ......? Thank you

 Good morning everyoneWe are experiencing a strange situation. The following is the scenario.The user connects via SSL VPN to the head office's fortigate and then, in this connection, with the head office's devices, the packet loss is minimal. However, this SSL VPN connection needs to access a server with an application hosted in a branch office. On this route, the SSL VPN to the head office and from the head office to the branch office has an average packet loss of 50%, sometimes 60%.Important information: communication between the head office and the branch office is normal, with an acceptable packet loss of only 0.5%.In short:User connects via SSL VPN to Fortigate at headquartersConnection established with headquartersPacket loss: minimalUser accesses devices at headquartersStable connectionPacket loss: minimalUser tries to access server with application at branch officeSSL VPN connection to headquartersConnection from headquarters to branch officePacket loss: average of 50%, s