Solved

We decided to implement an SD-WAN solution for two branches and the head office. We plan to deploy one FortiGate firewall at each branch and a clustered firewall (HA pair) at the head office. We are facing a licensing issue when attempting to apply a FortiManager Cloud license for this solution due to the clustered device. Can we proceed with a FortiManager Cloud license for three devices for this solution, or do we require a license for ten devices?

Hi,Due to recent vulnerabilities in radius, we would like to enable Message-Authenticator on our clearpass server.After enabling this option in clearpass, we get errors in clearpass that the radius packet received from FortiGate-1100E (v7.2.8 build1639 (Mature) is without Message-Authenticator as below.Is it possible to enable this? Source RADIUSLevel ERRORCategory AuthenticationAction UnknownDescriptionFailed to decode RADIUS packet - Received packet from x.x.x.x without Message-AuthenticatorTIA :) 

Hi folks.I did not found an answer in the following request:FortiGate ver. 7.6 with managed FortiSwitches & FortiAp's.Created an SSID in tunnel mode, and i want to mirror this traffic to a port in the FortiSwitch for sniffing.Any idea?(creating software switch does not have the choice of selecting  the SSID interface).Thanks 

I am trying to debug some ssl-vpn connection stuff.  If I run "diag debug application sslvpn -1" it generates a lot of debug lines.  Downloading the output and filtering through it to find what I need is not fun.  Is there a way to filter this by the source IP of the remote VPN client?  Or by some sort of VPN session ID?  Or something so that I can focus on troubleshooting a single user without having to wade through all the other connection data?

Does fortinet consider start providingh VPN only MSI format installers? so we can push the vpn clients thru GPO or other RMM tools? and if there is one for, if you could create one that is OFFICIAL, i would like to get hands on it. FortiClientVPNSetup  I am looking for the latest the greatest version. 

Hi FGT/EMS adminsIn FOS 7.2.10 I was able to add multi TCP Forwarding entries in my ZTNA server, while in FOS 7.4.7 I can add only one.Why this has changed? Did I miss something?

Hi There,I hope it is possible.My company uses Office 365, therefor we use the office 365 Active directory solution.in case it is possible - I was wondering how do I integrate between my 40F, running the latest firmware with the Active directory - in order to login to the 40F.I want to use my AD user instead of local user. I prefer not to install LDAP server etc. since we don't have hardware for it.

Fortinac is configured to send firewall tags to my gate. Communication is working fine. For wired switchports in Role Based Access mode, the tags are being properly sent when the Network Access Policy is matched.  However, I can't seem to get it working for wifi. Although the correct NAC policy is hit, logical network is assigned, and VLAN is changed, I still get:Looking up LogicalNetworkConfiguration for LogicalNetwork prod-wifiUsing SSID Name:root:corp_wifi, id: 439Returning LogicalNetworkConfiguration: AccessConfiguration- Task ID:[null]- Network:[prod-wifi]- Access Value:[VLAN_230]- Access Action:[2]- Alias:[false]- Send Groups To Firewall:[false]- RadiusAttributeGroupId:[1]- Version:[9]- Tags: []- Firewall Groups: [] One thing I noticed is there really isn't a config for applying RBAC to a Wifi SSID. Could this be the issue ?  

Hi, EDIT:I alreay find the solution, just set the set name using "msg", and it is working as expected.---------------------------------------------------------------------------------------------------------------------------------I am new to fortigate, I just got a fortigate 60e(192.168.98.99) with os version 7.4.7, and a debian device(192.168.98.178) directly conneted 60e.I setup a link monitor on 60e in order to monitor if the debian device is online or not.Till now, link monitor is working as expected: # diagnose sys link-monitor status Link Monitor: n1, Status: alive, Server num(1), cfg_version=0 HA state: local(alive), shared(alive) Flags=0x1 init, Create time: Sun Jan 26 16:39:12 2025 Source interface: internal5 (12) VRF: 0 Interval: 2000 ms Service-detect: disable Diffservcode: 000000 Class-ID: 0 Transport-Group: 0 Class-ID: 0 Peer: 192.168.98.178(192.168.98.178) Source IP(192.168.98.99) Route: 192.168.98.99->192.168.98.178/32, gwy(192.168.98.9

Hi we are new to fortigate's and need a little help/advice. We are currently adjusting the security level of our firewalls to a higher level. i.e we setup up the firewall rules first, next we implemented the IPS-sensor on a interface policy. After this we added the web-filter profile to the same policy. so far so good, but when we added the AV-profile also to this interface policy a important application stopped working. We checked the security logs but there are not active blocks/messages regarding what is being blocked. We made a second interface profile and only added the AV-profile and enabled it ... the applicationn is no longer being blocked but we are thinking that second profile is not being used (see config information under)config firewall interface-policyedit 1set uuid xxxxxxxxset logtraffic allset interface "port1"set srcaddr "all"set dstaddr "all"set service "ALL"set ips-sensor-status enableset ips-sensor "xxxxx all_default"set webfilter-profile-status enableset webfilter-

Hello everyone, Looking for a solution to this after a week of searching and trying. I wanted to setup a FG 100F v7.0.15  to be a vlan switch. I removed all the ports from the switch except port1 as it will not allow me to remove the last port of course. Problem... after setting up all the vlan switch vlans and adding the ports I want to the vlans, I create the trunk.  The trunk will not hand out the IP address from native vlan 1 or 0 on this product. To test my work before adding to the network, I take the PC and tag the NIC with the corresponding VLAN and I get the correct IPs per VLAN. If I remove all tags on the NIC leavin the NIC on 0 (Untagged) I get nothing when I am expecting the native VLAN 1 IP addressing.  What gives here? 

hi,i'll be creating multiple (a lot) SNAT policy in a multi-VDOM FGT which is an "F" series (1000 plus model)my question, do i enable/allow log "all sessions" or just "security events"?can my current platform (1000 plus F model) can handle such log?i just want to prevent any high CPU/memory due to lots of NAT processing/cache. 

Buen díaEstoy teniendo problemas al sacar un reporte en FortiAnalyzerTengo agregado un equipo FortiAuthenticator, revisando en los logs de event, veo los registros correctamente.En log type selecciono Event (es la única opción que tengo)El problemas esta que cuando ejecuto el query en datasets SELECT * FROM $event. Valido el query y no me manda error pero al ejecutarlo para ver los registros no me manda ninguno a pesar de que tengo registros en Log View -> Event.Hago el mismo proceso en otra ADOM con un Fortigate y aquí si me trae registros. Tendrás alguna solución o  recomendación respecto a esto.  

Cannot seem to find the downloads site for Windows agents for the SIEM. I found the pdf it would be nice to add the link to the actual instal file in the doc. Thanks

Hi everyone, after upgrading my FortiGate 91G from FortiOS 7.0.16 to 7.2.10, the SSL VPN interface (ssl.root) disappeared from Network > Interfaces in the GUI. However:•The SSL VPN works normally and users are able to connect.•From CLI, the ssl.root interface is visible and the status is su:get system interface | grep ssl Output:name: ssl.root ip: 0.0.0.0 0.0.0.0 status: up type: tunnel The SSL VPN configuration seems active and correct. But if I go online the SSL VPN INTERFACE is not visible. You give me feeds

Hello everybody: I want to enable two-factor authentication but only for local users who use the forticlient to connect VPN (fortigate 60F).I want to use email, I already have the email-server configured.The option does not appear, so I have to configure the email-server.This is my configuration:show system email-serverconfig system email-serverset server "mail.emailexample.com.ar"set port 26set security smtpsendAccording to the documentation:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Email-Two-Factor-Authentication-on-FortiGate/ta-p/194890There are two steps to complete this configuration:Configure the SMTP server.config system email-serverset reply-to {Sender_email_address}set server {SMTP_server_FQDN/IP}set port {SMTP_server_port_number}set authenticate {enable | disable}set username {username}set password {password_string}set security {none | starttls | smtps}end Create a user(s) with email two-factor enabled.config user localedit {username}set type passwordset

Hello, I want to ask you for advice. I am currently managing a FortiGate device where I am running a VPN setup. Within this VPN, I have a requirement to authenticate users against two separate Azure tenants. Both tenants are configured with FortiGate SSL VPN applications. I have tested the connection, and I observed that when users are in different tenants, the authentication always attempts to validate against a single SAML provider (Users can be authenticated through one tenant, but users from the second tenant are experiencing issues. The system attempts to authenticate them through the first tenant, where they do not have access). I am looking for a solution that allows the system to attempt authentication in the second tenant if the initial SAML authentication fails. I would appreciate any advice.Jan 

Hello Team, I was gaining knowledge about incidents and I came to know that we can setup an external lookup tool like Virustotal from which we can repudiate the IOCs. I am curious to know that how we can build a custom external lookup tool which can be used just like Virustotal for enrichment. I want answers particular to development so answer keeping in mind development. Questions are as below:  Can that only be created by FortiSIEM platform team or I as developer can develop this and than submit to FortiSIEM by developing on my own?If I can develop, what is the procedure or coding best practice must be followed ?Which languages are used in development ?This looks more kind of manual enrichment of each IOC which I select, Can this be automated for every incident ?Feel free to reach out in any kind of clarity over this questions. If anyone has sales team or technical team contact details than please send it over here who can answer these questions. TIA.

Hello Everyone.  Home user here, been thinking about replacing my old linksys router with a fortigate firewall.  Nothing crazy, probably just the 40F.  Was looking at the support options, can anyone tell me if you're able to download firmware updates for your firewall with out having to pay for a yearly support contract?Thanks!

Hi all, I encounter an issue when trying to register to EMS from my local FortiClient. The version I have now is 7.0.2 for FortiOS. I am trying to troubleshoot this however am clueless where to start for the debugging.... 

Hi All,  I've built a lab with SD-WAN ADVPN set up over an MPLS network, with an Internet VRF and a Private VRF, all looks to be working fine, except for BGP multipath routing.  I have a Server IP, learning the IP through BGP over both Hubs not a problem, with the preferred path entering the routing table, however, I thought with multipath routing it would install both routes in the routing table?As a result, my SLA to the server in SD-WAN is showing as down over 1 of the Hubs, so it can't flip over if packet lass or high latency occurs etc Any ideas please? Thanks in eager anticipation  (topology, routing table and SLA attached if it helps)

Hello, we are changing in small offices from FG30E to FG40F and some 30G which we would like to try.  First, I cant download newer FortiOS versions from the support portal, it seems that the 30G only has the 7.2.X version, cant be true, no? Also in the Web Gui I cant activate a AV profile. I can add a new one but than I cant choose it in the policy. Any experience and feebdack from this modell? Thanks!

Hello Expert, I have fortigate 80F running version 6.4.I create a firewall policy and would like to to Clone Reverse the Policy.When I right click on the policy I not see the option to clone reverse. Is there some feature that has to be turn on before the option becomes visible.I humbly request some guidance   . Thank youRegard Jomo

hi,i'm trying to configure a new FW policy and just wanted to know the difference between ICMP and Ping service.1.which is best practice to use/choose?2.if i need to clone/edit a custom ping or icmp service, i.e. echo reply, which service do i use/edit (icmp vs ping)?3.what is also the difference between the "traceroute" service vs the custom ping "time exceeded" (type:11,code:0).

hi,i'd like rename an existing VDOM but can't seem to do this either on the local FGT device or FMG.can this be done via CLI? if there is, what is the command?is there a feature visibility that i should enable for me to edit the VDOM name?