Support Forum

Dear team, I'm stuck with an error message: gw validation failedI'm using strongswan 6.0.2 on Linux.I'm able to communicate with the FW, but it seems that something is not recognised or misunderstood communication between the client and the server.swanctl.conf :connections { fortigate { version = 2 proposals = aes256-sha256-modp1536,aes256-sha256-modp2048,aes256-sha1-modp1536 local_addrs = %any remote_addrs = 192.168.14.250 fragmentation = accept mobike = no send_cert = always local-pkcs11 { auth = pubkey round = 0 cert { handle = 040840f509340ed8a314 slot = 0 } } remote { auth = pubkey id = 192.168.14.250 } local-eap { auth = eap-mschapv2 eap_id = tdupont round = 1 } children { net { local_ts = 0.0.0.0/0 remote_ts = 10.226.2.0/24,10.226.3.128/25,10.226.4.80/28,10.226.20.0/24,10.226.101.0/28,10.226.130.0/24,10.72.10

When trying to login to our Fortimanager trial version with a Forticloud account I get:Response validation failed. SAML response rejected I followed the outline of document and verified I have the right permissions and am using an IAM account in the same tenant.https://community.fortinet.com/t5/FortiAnalyzer/Troubleshooting-Tip-FortiCloud-SSO-login-error-Response/ta-p/320401 This feature should work, even with a trial license right?

Hey forum. Real life issues has risen in our short time with fortigate and IPsec.Boss man had issues connecting to the VPN while at a car dealer. Tried on the old ssl Palo Alto and connected right away.How is the issue of many places block IPsec traffic? I think we had our marketing guy get blocked at hotel but he didn’t complain until he came back.

Model: ForitGate-50GI would like to assign the same IP range subnet to between physical interface and internal wifi interface:Lan 1: 192.168.1.1/27internal wifi: 192.168.1.1/27 by default system be return warning msg some Lan1 or wifi interface subnet used. as above case, does it should be add a FortiAP or switch device to solve it? 

Hello Everyone,We are currently working for a pretty “gigantic” client in the Middle East, whose final request is to route, and apply security policies to the Customer support department before we finish the implementation and contract.I dont have any experience with routing networks with heavy SIP usage through firewalls, especially NGFW with security features enabled. Now, the technical part… So the branch office has it’s own 100G box, which is not connected via SDwan and will not be since it is completely separated by the main network. The end-user devices will pass through the firewall, while the Cisco call manager servers will remain routed via the dedicated router. The end user devices have a “virtual phone” installed, and communicate with these servers to provide support to customers. Judging by the numerous issues we have encountered with more sensitive protocols, we suspect SIP will be the same. I want to ask you, fellow members, for any tips, tricks and guides you can provide

Redirect after Captive Portal not redirecting not working with www.google.com. its a simple setup. users getting authentication page. they enter username and password. but its not redirecting to url we set redirect after captive portal field. what could be the reason captive portal has setup under ssid. we have fortiap and fortiswitch in this setup fortigate 121Gversion 7.4.8 

Dear All, Description - I have two IPsec tunnel interfaces for the same destination, want to give preference tunnel 2 over tunnel 1.I have two IPsec tunnel interfaces which is the member of SDWAN ZONE. I wanted to give preference tunnel 2 interface for the same destination with using priority inside the static route.  but did not get preference tunnel 2 over tunnel 1.If I use SDWAN rule to give preference tunnel 2 interface over tunnel 1 interface. it is taking tunnel 2 interface to forward the traffic for the same destination. but when I use route priority inside the static route then preference is not getting to tunnel 2 interface. I just want to confirm with you all if any IPsec tunnel interfaces are member of SDWAN ZONE cannot be used route priority to give the preference  over other tunnel.Instead of we can use SDWAN Rule to give the preference over another tunnel.  Also please share source of knowledge if related it.a Thank you all.  R

Hello Community, I am facing an issue with FortiNAC policy matching and VLAN enforcement.Environment:FortiNAC FJuniper switch (dot1x authenticator)Current Behavior: On the switch, the session is shown as Authenticated via RADIUS. VLAN assignment only works when I manually force the Registration or Authentication VLANs.However, FortiNAC displays the following:Auth Type: MABNo policy matchedThis occurs even though the Network Access Policy is configured with:RADIUS Auth Type: 802.1XGroups: UsersGroupLocations: AnyObservations: MAC-RADIUS is enabled on the switch interface. Although the device is configured for 802.1X authentication and FortiNAC correctly learns the user identity (DOMAIN\username), FortiNAC does not seem to classify the session as 802.1X, only as MAB. Port Group Membership shows Role Based Access is enabled, but no policy hit is recorded. What checks or actions can be performed to resolve this classification issue?

Hello Everyone,We are currently working for a pretty “gigantic” client in the Middle East, whose final request is to route, and apply security policies to the Customer support department before we finish the implementation and contract.I dont have any experience with routing networks with heavy SIP usage through firewalls, especially NGFW with security features enabled. Now, the technical part… So the branch office has it’s own 100G box, which is not connected via SDwan and will not be since it is completely separated by the main network. The end-user devices will pass through the firewall, while the Cisco call manager servers will remain routed via the dedicated router. The end user devices have a “virtual phone” installed, and communicate with these servers to provide support to customers. Judging by the numerous issues we have encountered with more sensitive protocols, we suspect SIP will be the same. I want to ask you, fellow members, for any tips, tricks and guides you can provide

Hello dears! I have been struggling to find a solution for my problem! by mistake I have activated the two way authentication token on my fortigate dashboard and I have only one account admin no backup account and no backup configurations as well ! I have tried to access through SSH. & serial port it keep asking for the token ! on mobile token I could generates the code but on dashboard it says that authentication failure ! 

Current Setup:I have configured FSSO with FortiGate.By default, when defining users in a firewall policy using FSSO, I have to select users via CN (Common Name) rather than sAMAccountName.To resolve this, I created a User Definition on the FortiGate with the type Remote LDAP. This allows me to define the user in the firewall policy using the sAMAccountName. Observations:In my testing, this works well. When a user logs in/out of Windows, FSSO detects the event and sends the log events to the FortiGate.Even if a user changes their IP while logged in, FSSO detects the new IP and updates the FortiGate.Overall, the tests are successful. Questions:1. Because I cannot find any official documentation supporting this specific configuration. Are there any hidden risks?2. Is this feasible for a production environment?3. Can someone explain the mechanism and the difference between this and the standard configuration?

We've been working with private cellular, and one of the requirements is that SCTP be sent over the network. With a 60E or 60F, there are no problems. With a 90G, we aren't seeing the COOKIE-ECHO packets, at all. Put a 60F in, we see them in a packet capture, put the 90G back in and they don't show up.Has anyone been successful in getting SCTP to work with a 90G?

Hello everyone,We need to replace our Sophos UTM and were thinking of doing so with Fortinet systems.Since we use quite a few Sophos UTM services, I'm wondering which Forti system I can use to map which services, or whether it's even possible to map all services.Here are the “services” I need to provide: Network ProtectionFirewallIPSVPN: IPSec / SSLReporting Email ProtectionEmail receptionVirus protectionEmail encryptionSpam protection (Quarantine , daily SPAM-report) Web ProtectionWeb-ProxyVirus protectionHTTPS-ScanningWebserver ProtectionWAF (Web Application Firewall) for On-Premise Exchange OWA access GeneralActive-Passive ClusterAD synchronizationReportingIs it possible to deploy all services with Fortinet?

Can a realm be set up with a virtual host name (so that the certificate I use for VPN will match the URL set in FortiClient) for SSL VPN?  I found the virtual host under Config vpn ssl web realm.  Is this only for web based VPN connections?

I am looking to implement client side certificates to our SSL VPN.  Does this set up require each client to have their own individual cert or can I use a common cert for users?

Afternoon all,  I have a Fortigate 91G running on 7.4.7 presently as it's still running SSO SSL VPN, linked to EntraID for SAML.With the SSL VPN being deprecated on later versions for this unit, we are trying to migrate to dial-in IPSec VPN but am being given the restriction of using certificates instead of the PSK to implement this.So, is it possible to implement a dial-in IPSec that links to EntraID for SAML, but doesn't require the PSK, and allows me to use a certificate instead?I have so far managed to get the Forticlient to connect and you see the Phase1/Phase2 tunnels on Status/Networks/IPSec but no traffic fails to flow over it.  Forticlient is stuck during the connection phase as well, not displaying the counter and details like it would when connected successfully. Feels like there's a disconnect between the PKI configured and SAML authentication systems, which may be the issue.Sanitised Phase 1 configuration in use---------------------------------config vp

Hi all, I've been working with support on this without any success so far (and they've confirmed all the setup is correct) but I'm trying to move from SSL VPN to IPSEC and have setup SAML with EntraID and this works fine when using the Apple App on iPads but I cannot get it going on a Windows machine. When I try to connect it prompts me to log into Azure and then says "you have successfully logged in" but that window just stays there and the FortiClient just shows as "Disconnect" but it's not actually connected whereas on the iPads it does the Azure bit and then that window disappears and the VPN starts to connect.I've tried it with Windows 10 and 11 and also server 2016 and also with various versions of FortiClient and although I can see the SAML connecting in the logs on the FortiGate there is nothing after that i.e. it doesn't then start to connect the VPN, it's as though whatever should happen after that just doesn't happen.I've got a feeling this is more of a Microsoft thing

Hello I couldn't find any examples with debian linux strongswan using swanctl.conf on the forums, the only examples I've found are for ipsec.conf. Here is what I know we are using: 1. FortiClient VPN -> IPsec VPN2. Pre-Shared Key3. XAuthHere is my non-working strongswan swanctl.conf:connections { thecompanyvpn { remote_addrs = sa.company.com version = 1 aggressive = yes proposals = aes256-sha256-modp1536 local { auth = psk id = "Tunnel-A" } remote { auth = psk } local-xauth { auth = xauth eap_id = worker1 } children { child_1 { start_action = start esp_proposals = aes256-sha256-modp1536 } } } } secrets { ike-company { secret = "our preshared key" } eap-employee { id = worker1 secret = "my secret password" } }This is the logs:Oct 08 21:22:04 nova charon-systemd[116776]: parsed TRANSACTION request 853593004 [ HASH CPRQ(X_TYPE X_USER X_PWD) ] Oct 08 21:22:04 nova charon-systemd[116776]: no XAuth password found

Hello.I have launched the EMS server.Test users are logging in and everything is OK.The problem is as follows: after preparing the VPN client distribution, the system sends an emailto recipients inviting them to download the client and register in EMS.  The issue is that when clicking the link to download ie. Windows FC  [https://myserver.com/installers/default/VPN-Client/FortiClientSetup_7.4.4_x64.exe] the page displays Not Found. The requested resource was not found on this server.The registration link works, the client retrieves the settings and registers in EMS. The problem occurs even in Deployment & Installers. When clicking the download link, it does not download but instead shows the message: Not Found . The requested resource was not found on this server.     What should be done to enable the download? Thank you for your help. 

FortiGate OS 7.4.8 Windows 11 Pro | FortiClient is up to date FortiSASE configurationWe have a handful of users who are unable to stay connected on the VPN while connected to iPhone hotspots. FortiClient will connect, then drop after a few minutes and then reconnect and again drop (loop behaviour). The VPN is stable on fixed (non-mobile) network connections.Anyone know why this happens or has a workaround?

Hi all,I have previously used SSL VPN with SAML auth and users have been assigned ip addressing from specific ranges. I have set up a proof of concept with IPSec VPN and am looking to do the same thing.I understand you can reference a user group in the phase 1 settings of the IPSec VPN, but am struggling to make this work with different user groups on different phase 1 tunnels. Also to mention each user group should have a unique ip range and should not share the range on 1 tunnel.Any ideas please?

Does FortiADC has support for OpenAPI 3.1 ? I see Swagger 2.0 and OpenAPI 3.0 are supported but what about 3.1 and 3.5?

Although we have had Fortigates for over four years now, I had the pleasure to ask for an RMA recently.Went well, got the device quickly, replaced it, when I went to print the return label it said I have to pay for shipping the device back. I don’t know about you guys, but I have never seen this with any other vendor. It really caught me by surprise.I don’t have access to a company card, they are really not common here, so for me, as just a network engineer, it means that I have to pay for shipping put of my pocket. We pay Fortinet around 20k/year for support, how can they not cover this?The only solution I got from their support was to change our contract to RMA Plus and we could then keep the broken devices (to do what with them?).It really left such a bitter taste. I will for sure propose to change vendors in the next upgrade cycle, arguing that Fortinet is not serious enough.

HiIs there any way to add a secondary radius server on Fortimail 400F running code 7.2.6, for Admin authentication?Thanks in advance. 

Hello everyone,I'm requesting your assistance and suggestions regarding the type of IPsec tunnels.In a hub and spoke architecture configured in ADVPN mode, we need to size the central hub that will be deployed within the hub.Each spoke connects and initiates communication with the hub in VPN dial-up mode to subsequently enable spoke-to-spoke communication.Are all of these tunnels destined for the hub considered site-to-site or client-to-site VPN tunnels in Fortinet terminology? Thanks for your assistance Regards