Solved

Hi everybody, we have a FortiGate acting as a VPN gateway for a client VPN for home office users. Authentication is done using Azure AD with SAML and the FortiClients are managed by an EMS though we only use the remote access profile. Whenever I try to connect to the VPN, FortiClient asks for the Azure credentials and then fails with error "FortiClient VPN unable to establish VPN connection. The VPN server may be unreachable(-6005)". Connecting through web mode however, works, so the problem's not with the VPN or SAML config. I created a custom VPN connection using the exact same settings that are configured by the EMS profile. Yields the exact same result. If I disconnect the FortiClient from the EMS however, the connection established without any issues. The problem is independent from FortiClient version (tested with 7.2.3, 7.2.4 and 7.4.0), so my guess is that some setting on the EMS is interfering with the VPN but I haven't managed to find a solution yet.Thanks in advanc

hi,i have an upcoming change window and just would like to confirm the 'revision' function in FG.1) if i click on configuration > revisions > save, this will create a backup config that is local in the device?2) i use VDOMs, so does the config include the all VDOM? i.e. 'global', 'root' and others?3) how can i view the full content on the revision config? is there a CLI command I could use?4) if i need to revert the config using the CLI, the 'latest' config would be the most bottom revision id? would this be revision 27? (global) # exec revision list configLast Firmware Version: V0.0.0-build000-REL0 ID  TIME                   ADMIN             FIRMWARE VERSION           COMMENT<SNIP>26 2024-02-19 21:54:37 Admin-Full V7.2.x-build1xx-REL0 Automatic backup (session

Hi all, we have recently update FGT to FortiOS 7.2.8.We found out a problem during the Re-Install policy.The process returns an error and we must "Retrieve" the configuration to complete the install. We use FortiManager 7.2.5.Can you help us?Regards.

Hi, Laptop using Forticlient 7.x VPN on Windows 11Home for a year, so far is OK, recently, I have been unable to access the IPSec VPN from my laptop. Each time I attempt to log in, FortiClient displays the error message 'IPsec VPN connection is down.' When I check the FortiClient log, the last entry reads 'Phase1 retransmit reaches maximum count.'I also tried accessing the IPSec VPN on other branch office FortiGate firewall (model 61F) using FortiClient, but the same error message appeared. LaptopWin11Home, Forticlient 7.x FirewallFortiGate 30E, firmware v5.4xFortiGate 61F, firmware v7.2x Can someone help? Thanks in advance.  Clement  

We recently upgraded from a standalone FortiGate 1500D running FortiOS 7.2.8 to a pair of Fortigate 601Fs running the save version of FortiOS as an Active-Passive HA pair. Our deployment consists of 10 total VDOMs and 8 10G physical interfaces. There are also 2 copper HA links and 1 copper management link per FortiGate. For this deployment's configuration, we pulled a config from the current FortiGate 1500D, passed it through FortiConverter, and loaded the resulting configuration onto the new FortiGate 601F's without issue. All references and settings were identical to the previous FortiGate. Each physical interface contains either the inside, dmz, or public vlans for multiple clients that we service. The physical interfaces themselves have no IP assigned to them. Rather, each physical interface holds multiple disjoint subnets corresponding to a client's network.  Although the physical interfaces are grouped by inside, dmz, public, the VDOMs are grouped according to

Hi Fortinet Community v6.4.9 -  #fortigatev6.4.8 -  FortiManager  We have had a FortiClient set up in the past which we have lost the PSK to as it appears to have been manually changed and not recorded. We have a backup conf of the VPN to re-apply so it can still be used (1 connection), but this does not work for clients with multiple VPN connections. Is there a way to recover this key or will we need to resort to resetting it? Thanks #forticlient     

Hi everyone,I am relatively new to Forti and networking in generaly and I have one problem i can`t wrap my head around.On Fortigate 100F I have two WAN interfaces enabled with diferent public subnets.WAN1 is my primar interface with default route for my internal users to go to internet.WAN2 is interface i inted to use for publishing web services.I creaed virtual server with WAF for that purpose and pointed it to WAN2.When i tray to access web servise from outside my local network ti works like a charm, but users in internal network can`t access those web services.Domain on which this web service is published is public and DNS records are held by 3rd party registrar.I don`t have split DNS in local network to be able to sent internal trafic directly to local IP of my web server.So far I tryed to add second default route for WAN2 with higher administrative distance and I tryed to configre PBR but with no luck (maybe i`m not doing it right)Is the PBR solution at all for my problem?BR 

Hi.I created web filter and application filter and blocked social media and **bleep**ography catagories.later created the policy and assigned this security fiters to this policy .Problem is that,after assign this security profiles ,i cannot use anydesk app.i d'not any block to remote access catagories.how can i solve this problem? please help me

Hello everyone! I am looking into a FortiNAC implementation and the following question came around. Tried to check documentation but there are some differences on it so would appreciate a third opinion to make sure the right setup is being followed. When deploying multiple isolation networks on FortiNAC (Registration, Authentication and Remediation for example) all of them have different IPs on config wizard, yet all belonging to the same interface port2. On a L3 setup, which IP should be indicated as DHCP relay (helper) on each interface? The main IP for port2 or the equivalent to the VLAN that is being configured? Found this and other examples saying the first is correct:https://docs.fortinet.com/document/fortinac-f/7.2.0/high-availability-fortinacos/377092/layer-3 In the image is possible to see that all helpers, no matter the VLAN, point to 10.10.100.2 and 10.50.100.2 which are the registration port2 IPs for each FortiNAC server.It also says the following:&

Hello, I'm a beginner and I'm doing a lab I need to update a fortigate to version 7.2.7The adom on the fortimanager is version 7.0 1)Should I first update the adom and then the fortigate, or vice versa? 2)If I don't update the adom and leave it at 7.0, will that cause any problems?3) The fortimanager is in version 7.2.1, do I need to update it too?If so, what order should I follow?Update Adom then fortigate then fortimanager? Thank you very much.   Translated with DeepL.com (free version)

Connecting FortiExtender and Fortigate (FortiWifi)Hello. I am trying to connect the other party's FortiWIFI-40F through FortiExtender 511F and FortiWifi-61E.FortiExtender 511F is equipped with a SIM to enable 5G communication.What I am curious about is the Ethernet connection between FortiExtender-511F and FortiWifi-61EI need to connect AWS's TGW to VPN using the 5G network, and the other party also needs to connect to VPN through FortiWIFI-40F.AWS's TGW has already been created and tested for connection to FortiWIFI-40F and VPN, but the connection between FortiExtender-511F and Fortiwifi-61E is not working well, so I am asking the community.Current situation isMeFortiExtender-511F-> 5G network connectedFortiWifi-61E -> PC connected to the lower level and management access possibleBoth devices are connected to the lower level PC with serial consoleOpposite partyFortiWIFI-40F -> Connected to the ISP and internet network and there is a lower level PCManagement access is set betw

Hello, we are using Fortiweb VM version 7.0.8 and i'm not specialist in the system. Our Exchange server is behind the fortiweb. We have a lot of attempt to connect to the exchange using EWS.  I can see in the Traffic (Log & Report) for attempts and the return code is 401 (forbidden). My question : Is it possible to create a rule/policy to automatically block IP for all attempt getting the Return code 401? Thank you

Hello FortiSIEMer,Hope u have a great day! We notice that we didn't receive any logs on the supervisor from the endpoints, then we tail the phoenix logs : 2024-07-21T02:24:12.306312+03:00 collector phEventPackager[7946]: [PH_EVT_PACKAGER_FILE_UPLOAD_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phEventPackager,[fileName]=phEventPKGProcess.cpp,[lineNumber]=1013,[filePath]=/opt/phoenix/cache/parser/events/evt_1721500592_13_73.dat,[errorNoInt]=401,[destName]=super.barq.local,[phLogDetail]=Failed to upload event file to worker2024-07-21T02:25:13.317998+03:00 collector phEventPackager[7946]: [PH_EVT_PACKAGER_FILE_UPLOAD_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phEventPackager,[fileName]=phEventPKGProcess.cpp,[lineNumber]=1013,[filePath]=/opt/phoenix/cache/parser/events/evt_1721500586_32_72.dat,[errorNoInt]=401,[destName]=worker.barq.local,[phLogDetail]=Failed to upload event file to worker

Good day, I am getting a lot of Microsoft URLs being re-signed as untrusted see below, I have a FGT200F running firmware 7. I have noticed that the Destination is not the same as the hostname, any thoughts as to what is happing? Server certificate is re-signed as untrusted, certificate-status: untrusted.Destination                                                                                    hostnamev10.events.data.microsoft.com                                                      uk-v20.events.data.microsoft.comteams.events.data.microsoft.com                        &n

hey guys.I have passed in january fortigate administrator 7.2I want to complete now the fcp and I studied faz.which exam can I pass to complete the fcp.there is on pearson vue two exams :Fortinet Analyazer 7.4 or Fortinet Analyazer 7.2is that matter which one I will pass ? thanks for the help :) 

I seem to get an awful lot of port scans to port 500, many/most on the same IP block.I'm certain they're doing an overall scan of the network, but I've just implemented a notification alert on the following:[ul]SSL VPN login failureIPsec tunnel errors[/ul]via Log & Report > Email Alert Settings (300E model) so I can keep tabs if any of my users are having problems (or are the target of a brute force attack). ..so I'm most aware of the port 500 hits.  However, because these garbage notifications are bloating my inbox, I've overlooked legitimate login failures for my users, unintentionally. What's the best approach to either stopping these scans from triggering an alert, or blocking the probes?I'm fairly new to Fortinet products, so I'm not completely well-versed in the full capabilities of the firewall. Possible approaches:[ul]Block the CIDR of the most frequent offenders for UDP 500 (may/may not be problematic, as it's on the Hurricane Electric network.. most

After upgrading from FortiClient 7.0.10 to 7.2.3, I've noticed that the exclusion list in the Web Filter no longer works.  No changes were made to the web filter policies, web browser plug-in is enabled in the policy and installed on the client, what gives?  My clients are all configured to use the web fliter plugin only when the endpoints are off-fabric, sync mode ad check user initiated traffic only are both enabled in their profiles.  I've tried every combination of the three and get the same result. For example, If I try to block Facebook, Twitter, or TikTok using a deny entry for each in the Web Filter Exclusion list, the sites do not get blocked on the client.  I've tried all three exclusion types (Simple, Regular Expression, and Wildcard) and none of them block the sites any longer. I've tried in both Edge and Chrome with the same results. Downgrading back to 7.0.10 resolves the issue. Anyone else experiencing this?

How can I change the IPsec tunnel preshared key? It can't be done in the gui. When I edit my tunnel and select the option for preshared key, the field key entry field doesn't appear like it does when creating a new tunnel. Is there a way to do this in the cli? So far I haven't found it.

Hello, is it possible to get a mail notification from fortinet, whenever a new Firmware release of Fortigate is available? GreetingsAndreas

Hello everyone I am a network analyst and I have updated a forti 60f from version 7.0.2 to version 7.2.9 and now I can't manage it remotely, how do I reach the equipment without having to go physically ?

Hi everyone, I'd appreciate some help over this problem. We use 3 DNS servers : 1 FortiGate DNS Server, and 2 DCs DNS. We can only use 2 IPs on most of our equipment, and we want to have FortiGate IP + Virtual IP (Load balancing to both DCs). This means to stay on our LAN (X.X.0.0/16) only, and the VIP would be on the same network as the real servers.  Here is a scheme to get a better idea: So for now I followed more or less this technical tip I found : https://community.fortinet.com/t5/FortiGate/Technical-Tip-VIP-IP-virtual-server-type-on-the-same-internal/ta-p/221782 I do have a Virtual server, and a corresponding address. Here are my configurations :VIP:Address:Policies: The issue is, whether from vlan10 or vlan213, I can't access at all to my VIP. The thing is, I am getting timed out and I'm not receiving a destination unreachable error. Still, the Hit count of my vip or the traffic trough my policies stays at 0.  Any hints on

hi,i'll be doing an OS upgrade on a FG HA pair.if for some reason I need to "downgrade", do I just select the OLD firmware, reboot and then restore the config referenced to the OLD firmware?is the downgrade the same as upgrade process, i.e. i only upload the firmware in the primary/active FG, it will auto push firmware to secondary, auto reboot secondary, then auto reboot primary?

I have a LAN with 2 FGT's.  SSLVPN coming in to FGT1 can not reach FGT2 and server on FGT2.  Not sure where my issue might be.

I recently installed a forti image V7.0.11 on pnetLab. I set up my lab which contains the forti, the cloud and a computer. I configured everything and I was able to go out on the internet. After some time the ping to the internet no longer works from the pc but the forti pings the internet well. At first I said to myself I may have changed something without realizing it. So I set up another lab, it was the same thing. I set up a third lab and I set the timer to about 1 hour the ping to the internet stopped. Every 1 hour I have to set up a new lab. I need your help.

Hello,I have a problem with FortiClient (7.0.5.0238). I lost internet connection when connecting SSL VPN via FortiClient. I found this article: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Lost-internet-connection-when-connecting-SSL/ta-p/286345 but this solution is not working because: "After connecting to the VPN, do another 'route print' command. Note that, in the results displayed, the 'gateway' IP for the '0.0.0.0' entry has changed." - NOT, the gateway is still the same for both adresses and deleting route 0.0.0.0 is useless. Do you have any other ideas how to solve this problem?