Solved

Hi, We have an IPSec Tunnel between office1 and office2 to connect two Servers. We need office1 users to connect to the server in office2 using another interface instead of the IPSec Tunnel and let only the servers communicate over IPSec. How can we achieve this, if it is possible? BR.

Hi Guys, on the fortigate 120G I have created  a automated weekly backup to our TFTP server.everything is working fine, my only concern is that the password is in plain text. is it possible to encrypt it? i have looked everywhere but can't find solution. Fortigate 120G - running firmware 7.2.10 script : execute backup config sftp E:\Backup-Netwerk/ROVPNFG/backup_%%log.devname%%_%%date%%.conf <server-IP> <username> <password>

Hi there We are rolling out MFA to our Forticlient VPN users. When user clicks connect a popup window appears for the SMAL idp, titled "Forticlient SAML Authentication". There is a timeout counter in the tile window that starts counting down from 300 seconds. When the popup appears, we can see in the FortiClient window, above the VPN Name box it says "status:connecting". The user needs to enter a login name, then a password, then a passcode, each on a different screen within the popup window. The popup closes and the user is returned to the Forticlient window which then goes through the connection stages and connects to VPN. The issue we are having is that if the user does not enter their login details within 30 seconds in the popup window, when the popup closes, the "status: connecting" message disappears and no other connection messages appear and the user is not connected to VPN. Even if we do nothing in the popup window, the "status: connecting" message disappears wi

Hi FNAC adminsIn FortiNAC or FortiNAC-F, is there a way to restrict access to admins to some containers (or switches), in such way some admins can manage some switches, and some other admins can manage some other switches.

Hi all,  does it possible to create on FGR60 and Hardware Switch interface with port(n) and WAN(n) port? I'm asking because I don't have the possibility to verify directly. Best RegardsAlberto 

Hi all I have this problem i have 2 vpn tunnels on one Fortigate the external interface is wan1 for both vpn1 --- interface ---wan1vpn2----interface-----wan2 both vpn are working and i can reach a vm on both sides from the lan interface lan ---- vpn1-----ok working.   vm1 pinglan----vpn2--------ok working  vm2 ping now i have on both vpn ends a vm i need to connect vm1 to vm2vm1 ping fortigate lan interfacevm2 ping fortigate lan interface i cannot ping vm1 from vm2 and viceversai have setup routing and firewall policies, maybe i miss something please helpthanks

Can someone share FAC Upgrade (Path) details

I've had this same problem since I've had FortiClient installations managed by EMS (6.0.4.0158) and I don't know if I'm doing something wrong, or this is just expected behavior.  Over the holiday break I assigned a deployment package to the profiles for most computers with the thought they would be upgraded by the time we got back.  That didn't happen, out of about 75 desktops, which are usually left powered on, only 12 upgraded and most of those are ones I upgraded before the break while testing to upgrade.  In EMS most of the PCs state "Endpoint Notified", but if you go to the actual computer there is no message to begin the installation - and as far as I know the deployment settings shouldn't require manual user input so I don't understand why they aren't getting upgraded. I've always had problems with getting EMS to successfully upgrade FortiClient.  It doesn't help that there are no real helpful log messages to help determine why a client didn't get the up

I'm facing issue while accessing the sec boxI tried taking the direct mgmt connection but im not able to ping nor access the sec fgt though the primary box works fine

Hi We've been having spotty internet connectivity since adding a 4G interface ( a Teltonika device in pass-through mode) to the SD-WAN on our 200E running 7.2.10. The three fibre interfaces in the SD-WAN are only running 20-30 % utilization generally, and the 4G is weighted as a last resort. The only traffic I see on the 4G is the SD-WAN SLA targets. The 4G does work well enough when I add a SD-WAN rule to force a device to use it. I came across this post saying to not use any-any in SD-WAN rules, and not to use the SD-WAN interface as a default route in heterogenous environments. We did have an any-any rule, that was an easy fix, but regarding the routing, would a zone consisting of 3 fibre connections with different ISPs and a single 4G connection be considered heterogenous? Should I instead be adding a default route for each SD-WAN zone member interface? I can't add multiple interfaces to a single default rule as per the above post.   

I'm doing an exchange program and I use Forticlient VPN to connect to the network of the institution where I study in my home country. It works normally on my laptop with a Windows OS, but when I use it on the computer in the lab, which is Linux, it doesn't work. I don't think the problem is the network or that I'm in a different country because I use the same network with my laptop. We formatted the lab's computer so that I could use it and installed the Kubuntu 22.04 LTS distribution. I installed Forticlient VPN, and when i tried to connect to the network it wouldn't leave the “connecting” status. I searched on the internet and saw that other people also had problems with this Linux distribution to connect to Forticlient VPN and that possibly the problem was the Kubuntu uses KDE. We formatted the computer again, this time using Linux Mint 21.3 (Virginia) and with that I was able to connect to the network but I can't browse the internet. The measurements are 0.4 Kb sent and

I've got a couple of VDOMs set up using a shared internet connection through Root.  Root has to have firewall policies to allow/foward/nat the traffic from the VDOMs to the internet.  I will have the security profiles implemented at the individual VDOM level so does it make any sense to have the same security profiles enabled on the Root VDOM firewall rules?  Seems to me like it would just be wasting system resources.  Basically would be checking traffic that's already been checked. Thoughts?  I'm thinking no security profiles at the Root VDOM, just rely on the individual VDOMs security profiles. 

how to upgrade FAC in HA

FORTIMANAGER UPGRADE PROCESS

The customer wants to configure Microsoft Entra ID in FortiClient EMS while using Azure AD Connect to synchronize users. They currently have on-premises Active Directory integrated with EMS for user synchronization. Can both On-Premises AD and Microsoft Entra ID be used simultaneously in FortiEMS, with specific endpoint policies assigned to users from Entra ID and others to users from on-premises AD 

Since upgrading our EMS server to 7.2.5 and our clients to FC 7.2.5, the clients Web Filter, Video Filter, Vulnerability, and System Events no longer populate in EMS at all.  These events don't update under the Endpoint Views for the clients and therefore the Vulnerability Dashboard does not show any information for detected Vulnerabilities either.  If you check the clients, they are definitely logging these events and, they are just no longer being populated in EMS.  I've checked every setting in EMS and on the Client configurations and I can not find out what is breaking this.  I've confirmed that the necessary ports are still open and that there are no filters in place to prevent them from showing in EMS.  The clients are still successfully updating everything else in EMS just not the event info. Anyone else come across this and have a fix?

Hello everyone, i working on new job and there is FortiGate 100F (i`am new to fortios) Users pass captive portal authorization for internet access, but Security mode on Lan Interface is disabled,also didn't find anything at config. FortiOS cookbook shows that captive portal configurate at Interfaces, where another places i can find current settings of captive portal? FortiOS 6.2.16 FortiGate #FortiOS 6.2.12

Hi I have issue when i already authenticated myself in Captive Portal but I cant connect to the internet. on the browser says error Your connection is not Private; NET: ERR_CERT_COMMON_NAME_INVALID.  but if i disable the captive portal, i can open the internet with no problem.   Could you please advise?

Hi All, Error Message: Connection with License Server Failed I have two subnet configured on my firewall fortigate 60F. SAP B1 was configured on the 172.18.10.x subnet and users are coming from subnet 172.18.10.x.  We can do ping and connect to the server, but we are not able to log in as we get the error message above.  anyone have same problem?

I have this problem with Fortinac. I have a port and computer A is plugged into this port. When computer B is plugged into the same port, both computer A and B appear under the port even though computer A is not plugged in. Even though I deleted computer A, it is still under the port. The device is quarantined because there is more than one device. Fortiswitch can be used.

getting below error on FAC 2024-11-24T17:02:41.605283+05:30 NIC-FAC-MC radiusd[7644]: (25771) facauth: Remote ldap user 'manoj': NULL password is not allowed2024-11-24T17:02:41.605289+05:30 NIC-FAC-MC radiusd[7644]: (25771) facauth: Remote LDAP user authentication failed2024-11-24T17:02:41.605799+05:30 NIC-FAC-MC radiusd[7644]: (25771) facauth: Updated auth log 'manoj': Remote LDAP user authentication(chap) with SMS/email dual token failed: invalid password USER IS remote user AD user and we are using chap on the FGT acting as a client

Hello, I have some issues with dns forwarding between to fortigates (601E and 601F) over a site to site VPN tunnel.In general the VPN is working great and there are no connectivity issues at all.Main-Site (FG 601F) has some internal DNS zones with entries and some of them forward to other DNS servers. The DNS service is enabled on all interfaces and each client on main site gets all dns entries of Main-FG as it should.On site B (FG 601E) I tried to create the same DNS zones as on Main site and entered the Tunnel IP of Main-FG as DNS forwarder. If a client on Site B tries to query anything from those zones from FG-B it gets no answer. If the client tries to directly query the Tunnel IP of Main-FG it works, but that's not what I want. Does anyone has an idea what could be wrong? I already experimented with source-ip and stuff but it didn't help. Both Fortigates have FW 7.4. Greetings,daniels7

Hello,i'am a new user in fortigate world :) with FG-51EI read some tuto to learn how it works, and i'm stuck with routing between vdom.it won't work :'(i'm french, and my isp provider is named free.To be able to watch tv with their player, it have to get an IPV6 SLAAC without DHCPv6. unfortunately, i don't know how to do that with fortigate. (it's not the subjet but if someone can help me for this point, i will be very happy )So i create a root vdom in transparent mode, with member interface wan 1, and port 1. my tv player works without problem.now, i create another "test" vdom in NAT mode, for testing, homelab. the interface member are the others portsi wish to link this nat vdom with the root transparent vdom, and .... no way to make it works :'(i miss something but i don't know what.I relied on these links, for helpinghttp://socpuppet.blogspot.com/2014/09/a-meshed-vdom-transparent-using-inter.htmlhttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Connect-2-Transparent-VDOMs-w

This is my first foray into the need for VXLAN and have some questions. My current site has a L3 Aruba switch, which handles my internal VLANs, an egress VLAN connecting to my FortiGate which connects to both a private WAN circuit to my data center (which in turn, provides Internet) and a backup Internet circuit for Internet failover and the IPSEC VPN spoke to hub (data center). Bought new building that we will be moving to, so want to implement VXLAN so I can use the same VLANs and subnets for all the new equipment going in so when we do actually move, it will be an easier transition. So the VXLAN config will be a temporary situation (no more than 6 months is my guess). From a design perspective, my idea is to implement the same low cost Internet "backup" at the new site, but it will be the main Internet connection until time gets closer for the move to add the higher dollar private WAN circuit as the primary. I will establish a IPSEC VPN connection between the two sites dir

Hi  Am running Fortinac v7.4.0.0427 (GA) and the Endpoint Compliance doesn't run when a registered host connects back to the network ,or it takes very long to do so ,6+ mins however if i scan the host ,the compliance action is executed .Any idea why this could be happening ?