Solved

I am trying to migrate from FortiGate 400E version 6.4.6 to FortiGate 600F version 7.2.6, but when migrating the Access Points, I see that it appears as a 'VAP switch'. Does this option change when it updates?

Hello everyone, We are using a Fortigate 120g. However, we can't open any website. Ping and DNS works on the client and on the fortigate and the packets are forwarded on the fortigate without dropping any packets. When we connect directly to the Fortigate 120g, we can access the Internet and open web pages without any delay. When we disconnect the Fortigate 120g and connect our old firewall, everything works fine right away. What we tried:Configuring port speed 1000Full on our Cisco CL9200 switch and on the Fortigate 120g.Do you have any idea how we can fix the problem? Thank you in advance! Best regards

Good Afternoon, Some clients showed up problems to connect to the vpn(SSL-VPN), the computer is windows 10 pro 22h2 build 19045. and always stay connecting and don't show the connectiong percent before connection estabelish. I test in android and its work with client credential. i already Repair the application and also uninstalled it, and re-installed. but no success, not even with my Credentials. Any suggestion?

I just installed FortiClient EMS 7.4.0 on Ubuntu 22.0.4 according to the installation doc. All the running services check out like they're supposed to. The doc says to double-click the FortiClient Endpoint Management Server icon to fire up the gui so I can configure https access, but there is no icon to click, nor does the system have anything for forticlient in the applications menu. Anyone have a workaround for this or tell me the bin the icon is supposed to point to?

Using FAC for Radius/EAP-TLS, backend is Active Directory. My LDAP remote user synch rule seems to be working, except for the fact that my a user's certificate binding is not coming through. The user does have a cert issued. Any ideas - misconfiguration on FAC or my domain controller ?

I'm trying to test authentication by using Machine certs instead of User certs. When I configure the windows supplicant to use "User or Computer" OR "User" I can authenticate. If I force the setting to "Computer" it fails. Both the computer and user certs are valid and signed by same CA. I must be missing something in the Radius server config. Any ideas ?

Now that I have all my users using SSL VPN similar to how our old Cisco AnyConnect was working I would like to start learning and then implementing ZTNA to better control the users. My EMS Cloud, FortiClients and FortiGate all use ADFS for SAML.  Is there anyway to setup ZTNA such that the groups the user is in controls their access to devices?  For example.  If I have a user in Dev group I want that user to be able to SSH to a CIDR address list.  I also want them to be able to connect to HTTPS to another CIDR address list.  Then I have a group like AppSupport that should only HTTPs to 2 different CIDR address groups.  Then I might have a third user which has both AD groups (Dev and AppSupport) so they should be able to access the combined CIDRs. Is this at all possible???What 

A while back I found a really good Technical Tip article on setting up Fortimanager for SSO with ADFS SAML with the FortiManger in SP mode.  I am totally unable to find it anymore.  Does anyone know of any good Tech Tip articles for this or other docs besides the standard Fortinet junk manual?

Hi,I am currently testing SSL VPN multi-factor authentication. Since we already have PKI and smart cards running in the Microsoft AD environment, I followed the steps in the guide:https://docs.fortinet.com/document/fortigate/7.0.1/administration-guide/266506/ssl-vpn-with-certificate-authenticationEverything executed smoothly, but I noticed a peculiar authentication mechanism. Fortigate's certificate multi-factor authentication matches if the account subject string on Fortigate matches part of the information in the certificate subject. I believe this is not a secure and rigorous matching method. The PKI user's subject should fully match the certificate subject. It can be observed that test3-jason was initially matched by jason's subject, leading to subsequent authentication failure.How can I avoid the following situation?Additionally, can Fortigate's certificate authentication authenticate the subject alternative name in the certificate?FortiGate  The following is the ve

Hi FortiClient EMS adminsFCT EMS 7.0.13.When deploying client from EMS I get error 150 on the EMS logs.Windows events on client show 30000 ms timeout waiting for FortiClient Install Service.I checked all below prerequisites are ok.https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-FortiClient-Deployment-Error-150-for/ta-p/260271Any idea?

FG is the DHCP server. FG DHCP is issuing IP correctly and we can see the IP. The problem is we cant see the IP address in wiindows DNS so we cant do an nslookup or resolve the PC name to IP.I want to know if there is a config so that FG relay the DHCP info to windows DNS. This is the article I'm looking right now. https://community.fortinet.com/t5/FortiGate/Technical-TIP-Different-options-of-configuring-DNS-server-on/ta-p/278967 TIA :) 

Hi sir, A simple question, after I execute a command "execute shutdown" from RJ console, the FortiGate will go into standby mode, and at this moment, the RJ console and all Ethernet ports are without function, how can I wake the FortiGate up remotely? Can the FortiGate be woken up only by AC off then on it, since it does not have a power button? Thanks,Jacky

hi,i just want to confirm if i'm doing it right when creating a new FW policy section in fortimanager.do i right-click on the specific policy, in this case in want under sequence 10, then choose "add section"?is this the same as click on the policy sequence 10 > section > + add?   

Does FortiGate BGP support the use of both 16 and 32 bit AS numbers? I've been looking at the FortiGate 7.4.2 admin guide and not seeing anything definite there to answer my question. Bill

Hi, the subject explains everything. This morning I installed the newest update. Since then noone can start a vpn-connection. Me neither - and I am sure, that my logon is correct. And the others can't be all wrong also. Everything else works, and in the office I can logon as administrator - everything looks fine.The LDAP-Server is running, and hasn't been changed at all, not even rebootet. I rebootet the FortiGate again, just in case - didn't help. We use FortiTokens, but it is not asking for the token - already a problem with the logon. Any Ideas?

Hello, I would like help with the following problem.As shown below, creating a URL Object (Policy & Object Address) is subject to the maximum limit.  So, I am curious as to whether it is possible to expand the limit.Thank you so much!

Hello!I am trying to import secret with secret upload template but can't understood how to mention target because after importing it shows empty and I need manually convert it and choose right target. This target address is available in host field after importing.Anyone experience such issue and can point me with solution?

Hello, I am implementing a scenario in which I have branches connected to the headquarters through IPSec tunnels. In my environment, I need to direct all traffic originating from the branch's local network through the IPsec tunnel so that this traffic destined for the internet uses the headquarters' WAN. For other services at the branch, I need to use the local WAN link. For example, branch office ether1, network 192.168.56.0/24, all traffic must be routed through the IPsec tunnel. As for ether2, network 172.16.56.0/24, traffic must be directed through the local WAN. I already have this working environment, I am using IPsec SDWAN to close the tunnels, make them redundant across different WANs and my question/problem is the following. For traffic originating from the branch network, 192.168.56.0/24 and destined for the internet to work, I must have a static default route created in the headquarters firewall, with gateway to the WAN 10.100.100.2, withou

Hello everybodyHow can i route youtube traffic only to the backup isp via fortigate.

  Hello, I am implementing a scenario where I will have a headquarters and several branches, connected through IPSec tunnels. In the headquarters firewall I will have a fixed public IP address and in the branches I will have internet links with dynamic IP addresses (CGNAT and LTE/4G). I need to connect two IPsec tunnels per branch with the headquarters, one tunnel for each WAN and I need to use SDWAN to control this traffic and define the SLA for each tunnel. I already have this working format using IPsec SDWAN, where I create 1 tunnel for each link.However, at headquarters, I only have one WAN interface and I use it in all tunnels with branches. Could this cause me some kind of problem? I've already noticed that when I make a change on the matrix side in a tunnel, it momentarily "drops" the connection in the other tunnels.What is correct on the head office side, considering that I only have 1 WAN interface, is to have 1 tunnel for each branch? Today

Hello! I'm setting up override on my cluster and I saw this article: Primary unit selection with override enabled | FortiGate / FortiOS 6.0.0 | Fortinet Document Library It says that we lose configuration changes if the primary goes down, we do changes on secondary (that is going to be temporarily primary), primary comes back up, negociates to get his primary status back and overwrite the changes made on the secondary (who lost his temporary primary status). By using the setting that the end of the article: set override-wait-timeCan we avoid losing configuration changes if the override-wait-time is long enough?Does the secondary will have time to overwrite the primary configuration before primary negociates to get his status back? I know that setting is there to smoothen the transition, but was wondering if it could have that nice side effect. Thanks!Konnan

How exactly is this code used?I want to set ondemand 10gb but it doesn't work.  filesize-limit [-h|-l|-t] -t[all|ondemand|netshare|jsonrpc|icap|device] -v[MB] -u[MB]

If i want to supply FortiGate-60F from 12V DC source - what is min and max input voltageis it the standard 12V ±10% ??

Hi All, My boss has asked to me is it possible to accessing proxy server via public IP or FQDN which published to public?The goals is he want to use proxy from internet while out of office.I have suggest to use PAC for another option but he asked for first option possibility. Can you guys help me for the solution like this is possible or do you have alternate solution to achieve the goals?FortiProxy FortiGate 

hi , can anyone please advise what is the default tcp handshake timeout value? I know the default session time out value is 3600 sec. thanks in advance!