Solved

Hi, Would like to check if there are latest information already about the release of newer firmware version for FG-90G?Due to vulnerabilities, I am keen on knowing when the expected dates are. Thanks!

Ok, I will admit I am a little outside my knowledge base with this one. In my investigation, I am learning that what I am looking for might be this header passed from the browser called X-Forward-For. Based on what I am seeing, this shows or can show, the clients original IP, then successive IPs as they pass through proxies.  I am not sure if this is something that is handled at the browser level itself (but I do see extensions available where you can easily customize/add, etc...), but I also see past articles about this header and Fortinet products... but it appears the traffic flow is that maybe being inbound, like protecting a web server behind a FortiGate or FortiWeb device. My inquiry for my traffic outbound from my network. Is there a way to inject that header as it passes through the firewall so if an external webserver can log that info via its auditing, I can glean the private client IP of my user (assuming I have access to that external webserver's audit logs o

Hi Team, Does restarting the WAD process have any impact on the network? Thank you!

Hi guys, Hoping to find Fortigate WAF configuration and troubleshooting help. I see the Fortigate docs provide bits and peices of this WAF technology for FortiGate firewall (mostly just scratch the surface), Youtube videos provide a little bit more info and I can sort of set it up and assign WAF policy to an active security policy but what's next? Is there a way to verify configuration, traffic flows, detection of hacks, logging, which WAF features should be enabled and for what reason, how to troubleshoot and etc. We are currently use FortiOS 7.0.12 and don't have the FortiWeb appliance. Thanks for any assistanceJimmy

I am having troubles installing forticlient VPN in my ubuntu 23.10. I have followed https://www.fortinet.com/support/product-downloads/linux but whatever the choice of version of forticlient I use, I always get the error that libgconf-2-4 (> 0) is needed but not available.Any hint on how to solve this problem?Jordi

Dear Fortinet Community,We are deploying a WAF (FortiWeb) in an Environment and Migrating a Web Application behind FortiWeb. We have a dual gateway seanerio in our environment for FortiWeb, for traffic to route its proper destination we used PBR here to route return or response traffic towards it destination.After all configurations of virtual server, server pool, virtual IPs, server policy, adding certificates of servers in FortiWeb, Migrarted Web Application working properly and doesn't pop-up SSL Certificate error in the browser but on the same Hostname we have an android application of the client , it shows SSL Certificate error on Android Application we open our application. For clarification we called a certificate in Server Policy of FortiWeb for this Service and that certificate is Wild-Card Certificate.Please suggest is there any configurations missing at our FortiWeb end or something else.

Hello people, I have a new projet, to deploy FortiNAC VM. I am a newbie with FortiNAC, any tips for a first deployement ? I will take any advice from people that configured it before. Thank you in advanceKind regards,

  Hello FortiPAM admins, I'm looking for a way to hide secrets sensitive credentials ( Username and Password ) from users with View or Edit roles  

Hello,we just solved a problem we had for weeks with our Fortigate / Azure SSO implementation and i thought maybe i can help someone save some time. We are running multiple fortigates for different companys. Since all those companys do use Office 365 we decided to let Microsoft handle the MFA for the SSLVPN login. We set it up and everything was running good besides one single user in one of our companys that wasnt able to login. He always received a error code -7200. We tried everything we could think of. Ressetting passwords, MFAs and even delete the hole SSL and SSO configuration on this fortigate. Alwasys the same error. No mater on which client this user tries to login the error stays the same.Debugging and the logs in our analyzer showed the error message sslvpn_login_saml_group_mismatch so we double checked for errors in the configuration but we could not find some. Tonight my last thought was that maybe 117 Groups are to mutch for a saml response. Microsft states

Hello Fortinet Community,I am currently working on configuring a FortiGate firewall setup and need some confirmation with VDOM failover configuration. Here’s the scenario I am working with:  - Firewall 1 (Fw1): VDOM A and VDOM B are configured as active.  - Firewall 2 (Fw2): VDOM A and VDOM B are configured as passive.  - Conversely, VDOM C is active on Fw2 and passive on Fw1.Is it possible to set up the VDOMs in this way, with Fw1 having active VDOM A and B while Fw2 is passive, and the opposite configuration for VDOM C?

when im trying to access this course -> FCF - Getting Started in Cybersecurity 2.0 Self-Pacedspecifically the first module or any module within the course, im not able to see anything inside, nothing is displayed, please provide me with a solution as to why is this happening, im attaching the screenshot 

Disadvantage of using a internal CA issued certificate? Why is it not common?

 Hello Fortinet Community,I’m seeking advice on configuring the network setup shown in the attached image.  Here’s the scenario: Two large sites (HQ1 and HQ2) and several small sites, all with FortiGate firewalls, connected in a Security Fabric. HQ1’s FortiGate is the fabric root.FortiNAC Setup: A FortiNAC Manager with two control units located in HQ1 and HQ2. No HA.HQ1 hosts the primary domain controller, and HQ2 hosts the secondary.Given this setup, I have several questions:Should only the FortiNAC Manager integrate with Active Directory, or should the control units also be integrated?For the Security Fabric, is integrating the FortiNAC Manager with the Fabric Root sufficient, or should the control units also be integrated?How should the Email server, EMS, and FortiAnalyzer be integrated? Is it sufficient to connect only the FortiNAC Manager, or should all control units be included?Unfortunately, I haven’t found clear documentation on these integrations. I’d appre

Hi Im looking to do the following, I have 3 wan interfaces (wan1, wan2 and wan3), im looking to make an arrangement of sdwan so some of the users (UsersA) primary output is wan1 with wan2 acting as the fail over, and the rest of the users (UsersB) use wan3 as their primary output with again wan2 acting as a fail over. The issue im coming across is how do i prevent from Users A from using wan3 as their output, I've set up the users A rule for wan1 and wan2 but when both of these are inactive their output then becomes wan3. Same case for usersB, if wan2 and wan3 are inactive their output becomes wan1. UsersA should never use wan3 and UsersB should never use Wan1 How do I prevent this?, the rules only have their respective wans selected but if none of their wans are available it uses another wan not in its rule.

i setup 2 IPsec tunnel with counterpart at AWS. the tunnel is working fine but there are 2 separate links showing that the tunnel is down.how do i remove the unwanted tunnel.phase2 selector route is down.or shall i do i reset to bring up the tunnel.

I have a 100F and the WAN Interface only shows speed settings for auto. No 1000Full, 100Full, ect... Fortigate is on 7.2.8. If I go to a lan port I have more options. My ISP has set their interface to 100Full, but on the fortigate get hardware nic wan2 it's showing half duplex 100. I am not able to force to 100Full. Are 100F's not able to set port speed other than auto?   

My goal is to implement FSSO for the purpose of creating firewall policies based on group membership. The caveat is that there is no LDAP server to provide group membership. We have a custom VPN application that is successfully sending username-to-IP info to Fortigates using API method here (https://fndn.fortinet.net/index.php?/fortiapi/1-fortios/3828/1/user/). However, this makes policies cumbersome because they can only be populated by source users and not groups.  Any ideas ? Could Fortiauthenticator solve this problem in some manner ?Don 

I own a Fortigate 60F. I'm a contract worker, operating from home. The company I'm working with demands that I'm behind a firewall which is set to reject ALL TRAFFIC except only needed services and web sites, just so there is maximum rejection of anything from the outside. I have also purchased the package which has IPS so that I'm in compliance, as they are most concerned with asset egress. It's Draconian, I know. My question is, what is the most efficient way to configure for this, using the fewest policies? To simplify, let's assume I need the following 3 "essential" things: 1. The company's Okta site, we'll call it "company.okta.com"2. Ability to sync with the Dropbox service3. An Apple file server, let's call it "afp://server.company.com For example, I can't tell whether using the Web Filtering is better than an individual policies which specify FQDNs, etc.Is it best to create a policy just specifying Dropbox's "Internet Service" services? Or some other method?Thank

we are settinng up our own networking monitoring tools using Opmanager.what is the proper way to configure snmpv3 for our fortigate firewall so that the Opmanager can recognize our firewalls ?

I have FortiClient EMS Cloud and so far I have been sending out invitations to my users so they can download the client and use the CODE from the invite to register to the EMS. However, support has told me that to manage auto updates I need to create an installer for all my users some how deploy the installer to the users.  Yet, it seems to me that Manage Deployments is really for auto installing on AD Servers/ Clients.  But this probably will not work for MACs.  Nor would this work for users who's machines are not port of the Domain. So that seems to mean I need to create FortiClient Installers for users.  And give them the download link.  Only 2 problems with this method that I see.  I do not have an updated Client yet.  (Not sure its been released yet.). So if I give them the link now they will just end up re-installing the same thing they have now. Am I going down the correct path?  Are there any better docs on this then FortiC

Helo all.I have issue after reinstalling my computer to latest Windows 11. I've installed Forticlient 7.2.4.0972. I has two profiles that uses personal certificates and username an password. I has also two certificates with private kyes in Windows Key store in Presonal Certificates folder. When i try to connect to VPN in drop box i only see one certificate, even if i have installed two personal certifiactes. When i try to create new connection, i see both certificates, but after saving new connection i can't see one of the certificates in drop box again. I've tested this on two independent computers. My college also try to import my certificate on his computer (Windows 10 and older Forticlient version) and he see certifacate and is able to connect to VPN. I appreciate any help.Thank You

Hello, following this configuration scenario, what I configured is a redundant that looks towards the primary router and the secondary router and put the monitor of this redundant under it, in case a link of this redundant goes out it automatically switches it to the secondary or does the primary remain active?PRIMARYconfig system haset group-id 2set group-name "FGT-HA"set mode a-pset hbdev "ha1" 50 "ha2" 60set session-pickup enableset override enableset priority 250set monitor "Redundant"endSECONDARYconfig system haset group-id 2set group-name "FGT-HA"set mode a-pset hbdev "ha1" 50 "ha2" 60set session-pickup enableset override enableset priority 150set monitor "Redundant"end BR, Giuseppe

Hello, everyone! I am facing a question regarding custom scans on FortiNAC.Currently I have a scan to check for my AV service. Every once in a while the network agent gets updated and the syntax for the service name changes. After that, all my hosts start to fail the scans.Is there anyway to turn the service name into a regular expression? Let's say, instead of checking for a service "ABC.20.17", am I able to check for "ABC.20.*" for any patch version of the given service? Tried on my lab environment but did't work. Appreciate the help! FortiNAC 

I have been watching Rumble on my network for years.  Suddenly, midmorning today, I could no longer watch videos on Rumble.  Most of the images on the home page are blocked.  When I try to start a video on my PC, I get no video feed just the html page. When I attempt to watch videos on my Apple devices with access through my Fortigate, I get the video for the ads, but the main video will not run. I also get a message in the video box which says, "The certificate for this server is invalid".  When I access Rumble on my Apple devices using cellular data, everything works perfectly. There is no issue viewing YouTube, or any other sites I have tested. There have been ZERO changes to the configuration on the Fortigate.  The bios is up to date, and last update was several weeks ago.  Rumble video was working for most of the morning, then suddenly stopped midday with the issue describe above. Has this happened to anyone else? 

version : 7.2.3.0929 when i put ID/PASSWORD, i can see status : connecting... forever.. and no raise up percentage. just connecting.im sure connection setting. whats the problem?