Solved

 Hello. I would like to configure wan1 as the SD-WAN members on the case of new device.But, it is not appeared wan1 on interface for creating new SD-WAN member.It is appeared wan2 and dmz interfaces.How can I create SD-WAN members with wan1? Regards. 

Hey, Guys,I don’t know if you can help me with this problem, but I have tried many types of configurations network and of interfaces, therefore, the problem still happening.  On Windows I’m abel to Connect and use services of this VPN, but on Ubuntu, after some atualizations of system, when I try to connect the FortiClient shows the “VPN Connect” but the bytes received are iqual 0 and I can’t access the services and VMs. I already try restart network confugurations and reinstall FortiClient, but still not working. Thanks for your attention

Hello, I have strange situation related to my configuration of  SSL VPN and LDAP users on my FG100F unit.Currently all people in my agencies using their LDAP accounts to connect VPN and work remotely. Last week one person reported to me that it is possible to change expired password using Forticlient. It is normal because I have configuration which allows to users to change their Windows (LDAP) password. Unfortunately this user changed password for exactly the same as he had before. In my GPO I have password history for last 10 and compliance policy on high level (at least 10 characters etc.)But for now I see that it is possible to change it though Forticlient  Does anyone know how to force FortiGate to use AD policy during password change ?  BR Konrad

helloI have FortiGate40F and already I have DDNS from x.dyndns.orghow I can configure this DDNS from FortiGate (from GUI  only server from fortiddns.com )for example when I write x.dyndns.org with specific port from browser forwarding to server inside my Network Best Regards 

I have the below config, and seem to have an issue where the fortigate isn't sharing the direct connected routes, between BGP peers.FortigateInterfacesaggregateinterf: IP 172.19.0.6 255.255.255.248. No Vlan.MGMT: IP 192.168.183.58 255.255.255.192, VLAN 200, Parent: aggregateinterfCCTV: IP 192.168.183.190 255.255.255.192, VLAN 250, Parent: aggregateinterf.SwitchVRF WANVRF LANVRF MGMTVRF CCTVSVI: WAN, IP 172.19.0.2/29, VRF WAN, VLAN 101.SVI: CCTV, IP 192.168.183.130/26, VRF CCTV, VLAN 250SVI MGMT, IP 192.168.183.2/26, VRF MGMT, VLAN 200SVI: LAN1, IP 192.168.168.1/24, VRF LAN, VLAN 300SVI: LAN2, IP 192.168.169.1/24, VRF LAN, VLAN 301 On the switch, I leak the routes between LAN and WAN.I have BGP peering from the switch as below.VRF WAN to aggregateinterf, 172.19.0.6/29VRF MGMT to MGMT vlan, 192.168.183.58/26 Now BGP is established and I can see the fortigate as the default route.The issue I am having is, the fortigate is not advertising each interfaces connected route to the ot

I have a new implementation of FortiSASE and trying to integrate with EntraID for SSO. We have followed all the steps as documented here including API permissions : https://docs.fortinet.com/document/fortisase/latest/agent-based-vpn-autoconnect-using-entra-id-sso/547823/configuring-entra-id-options-for-agent-based-vpn-autoconnect SSO still doesn't work and every time, I lock the policy Source to EntraID group (My account is a member of this group), and i try to connect to agent based VPN, it gives me the following error. AADSTS50105: Your administrator has configured the application FortiSASE ('677888668-56ff-4675-7561-ddee90078') to block users unless they are specifically granted ('assigned') access to the application. The signed in user 'abcd@ybg.com' is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator. Please contact your administrator to assign access to this application. Does anyone knows

So I have a few laptops in our organization that this has happened to now, I originally thought it was the most windows update that did it as both users advised that issue started occurring after a windows update.  But after experimenting with one of the laptops I have wiped it multiple times now (as issue kept reappearing) my tests I started installing things one by one and rebooting.  I started with our 7.2.5 installer and had no issue, but when I updated to 7.2.7 is when issue resurfaced. I then created a 7.2.7 installer wiped the laptop and first thing I did after joining our domain was install forticlient 7.2.7 and it issue immediately happened.  When the issue occurs the login screen flashes every few seconds and resets to the initial screen, it is painstaking to just reboot it into maintenance mode to use the recovery drive.  It has happened on 2 different model of laptops (Surface Laptop 6 and Asus Expert Book) I have a bunch of laptops that are just fi

Hi Am facing a strange issue where when I uploaded the backupconfig of the firewall we lost https or http access to the firewall I will explain everything below (I did a session with forti support but the result was you shouldn't take back up config from 7.6.0 version to 7.2.10 version tbh I wouldn't say this is true at some point but I will try my lost hope here) So we have a fortigate firewall that is on 7.6.0 we wanna role back because this version is seriously bad I toke the passive firewall factory reset it also rolled back to 7.2.10 then toke the back up config from 7.6.0 and uploaded it in the 7.2.10 suddenly no https \ http access I will write everything down that I tried : 1-interface up allow access ping https http ssh(i can ssh into the firewall)2-change the https port to default 3-no local in policy is configured4-trust host is configured I added the whole subnet of my vlan (me and the firewall are on the same vlan)5-diagnose sniffer to see what is being

Dears, TrendMicro Worry-Free Business Security Services (WFBS-SVC) provides different URLs used as reference for allowing listing from firewall or proxy server. We created a rule in FortiGate using FQDN trendmicro.com but it is not working and it is resolving in only 1 IP. TrendMicro has more than 1. How we can resolve this ? Thank You   

Hello, Securtiy Events Summary logs do not appear on FortiGate. FortiGate version 7.2.9. Does anyone have a solution for this?

I have just installed Windows 11 on my desktop PC and installed FortiClient v7.0.9. I have steup my FortiClient app the same way as it was on Windows 10 but it is not working. I just get a failed to connect check your internet and VPN pre-shared key message. It works fine on my Windows 11 Laptop though? Anyone else had this and can offer any advise?

Management access | FortiGate / FortiOS 7.0.0 | Fortinet Document Library"Management access to the FortiGate will be limited to a single physical interface."Foritgate 80E, has 2 WAN ports, but it is really not possible to access management GUI both public IP address on WAN1 and WAN2. So far, I can access management GUI on WAN1 public IP address only.

Hi,I'm working on new Fnac 7.6 deployment.I need only visibility functions, in particular I need to associate user/host/ip address and see all in fortiview.It is necessary the persistent agent or I can retrieve the information in another manner ?Also I don't understand why in fortiview dashboard I can't see the ip address, only mac-address, but in adapter window I see the ip address resolved by mac-address.In inventory I set L2 polling and L3 polling on core switch.Thank you Vincenzzo 

when FGT is collecting tx/rx traffic for specific interface to draw graph, what is options used in this graph ? [i mean inside FG itself , collected logs not yet exported to FMG / or FAZ ]what is sampling rate for traffic , is it based on time , packets , etc ? [please provide reference]--then when its sent to FMG i see on fresh logs it can show up to 5 minutes distance , then if we explored old graph , distance is compressed to about 30 minutes [please provide reference]FortiGate FortiManager 

I have a situation where I have 4 unique subnets.192.168.0.0/24192.168.1.0/24192.168.2.0/24192.168.3.0/24 Currently, there are no Vlans defined on the switch, so they are all in VLAN 1.  A Cisco router is currently serving as a Gateway for this site and has the followinginterface GigabitEthernet0/0/0  ip address 192.168.0.1 255.255.255.0  ip address 192.168.1.1 255.255.255.0 secondary  ip address 192.168.2.1 255.255.255.0 secondary  ip address 192.168.3.1 255.255.255.0 secondary I would like to slip in a Fortigate Firewall to serve as the gateway device, but i need a way to service all of the subnets that are all residing in Vlan1 over a single ethernet cable.  I have tried to give the port a parent IP address, similar to Cisco, with secondary ip addresses...but i cant ping from the network to the respective secondary ip address and vice-versa.  The parent ip address works fine.  any ideas?  I have tried configuring the C

Hi, We want to use the "script feature" located in "login > configuration > scripts" to upload and run objects/rules instructions. When all goes well, script is "success", but when one command fails, part of hundred of lines, GUI returns only "script failure" without any log. Where could we find what has failed in the whole script ? Does this feature have any log ? Regards,

How can I achieve Multi-Site (Primary and Secondary)  HA Deployment with following 3 Supervisors without DB3 DB servers3 Keepers2 workerswith version 7.3.0 

Happy New Year,Couple questions  My goal is to create an alert based on the values in a particular value field, RequestTypethe possible values are :"oauth2:authorize" .   or   "login:login". if we find this last one we will create a rule to alert.My customer is sending logs for parsing by  Office365Parser-v1.2   they want to be alerted if the sample logs below Thank you,   Karl Henning  I have removed some stuff to anonymise   [OFFICE365_EVENT_DATA] = {"Actor":[{"ID":"2df6c5b4-66e0-456f-8028-92a389afe2cd","Type":0},{"ID":"stuff ........ClientIP":"2607:fea8:9367:a200:e0d9:d500:edea:22ce","CreationTime":"2024-09-25T13:21:21UTC","DeviceProperties":[{"Name":"OS","Value":"Windows10"},{"Name":"BrowserType","Value":"Chrome"},{"Name":"SessionId","Value":"c774a6fd-4dfc-43c2-9ee5-2f56c2bc2c49"}],"ErrorNumber":"0","ExtendedProperties":[{"Name":"ResultStatusDetail","Value":"Success"},{"Name":"UserAgent","Value":"M

Hello, Where can we find offline installers for FortiClient, please?  I.E. this version and all future versions. Often the process of the FortiClient installer connecting to the server and obtaining the files is the longest part of a job.  At least if we had an offline installer, we could anticipate how long the file would take to transfer or do it as a background process, etc.  My current install (update) to FortiClient on a remote laptop has taken half an hour to get to 15%. Thanks,Mark

We are trying to set up notifications (via automation stiches) of system configuration backups.  The automation stiches appear to support this as they have entries for the relevant log events (32142 and possibly 32145) but for whatever reason, our FortiGates are not recording the backup events in the event log.  The log setting for "Event logging" is set to "All." We can find no other place either in the GUI or CLI reference material that would indicate any other setting to enable the expected functionality. Does anyone have any insight into why the backup events are not being recorded in the event log?The models in question are 100F, 80F, 60F and firmware versions 7.6.0, 7.6.1, and 7.2.10.

We are currently running FortiClient for antivirus on our endpoints and this works well with FortiNAC Endpoint Compliance. The issue we are running into is testing a new antivirus that is not listed on the Antivirus list within FortiNAC. Is there a work around to use an unlisted Antivirus for Endpoint Compliance within FortiNAC v7.2.5?

Is there a way either on the device or on the support pages to see the history of Forti OS updates applied to the device?

Hi Community, In FortiAnalyzer: is it possible to generate a report that shows me license information from for example FortiGate using a custom dataset? Info like "about to expire licenses" from all FortiGate devices. Also things like you can get from "diagnose autoupdate ver", for example "Last Updated": <snip>Flow-based Virus Definitions---------Version: 93.00577 signedContract Expiry Date: Sun Dec 28 2025Last Updated using scheduled update on Mon Jan 27 17:12:27 2025Last Update Attempt: Mon Jan 27 17:42:10 2025Result: No Updates<snip>

Hello, I recently installed a second WAN on my FortiGate 40F. I've been facing an issue I'm not able to resolve and looking for some help. I am a beginner though, so I'll try my best to explain my goal clearly and current Goal:- My wan1 has a bunch of static IPs, while wan2 doesn't have any. - I would like to access my file server via a static IP from wan1 from the internet (only wan1 has static IPs)- I would like the application to only upload traffic via wan2 because it is 25x faster.So, it should listen on wan1, but actually use wan2 only for data transmission.  Current Setup:- Configured SD-WAN and added both members. WAN2 has a higher priority, and in general it is being used most of the time, which is good for me. - working fine- Created VIP for my server (external 37.37.37.37, internal 192.168.5.111) - working fine My Policies: - SD-WAN to LAN (source all, destination VIP)- LAN to SD-WAN (source all, destination all)  F

Hello, I understand that even if a a Telco Internet circuit supports a standard MTU of 1500 and fragmentation is either not supported or reliable, that this is irrelevant to the fragmentation that may take place on traffic passing via a Fortigate IPSEC tunnel across that Internet circuit i.e. the two concepts are separate.So, you could have a telco Internet circuit with 1500 MTU and no fragmentation support, but fragmentation can still work WITHIN the Fortigate established IPSEC tunnel.Am I correct in this thinking ?Thank you kindly.