Support Forum

Hello, I'm interested in the following type of information.We have configured and set up IPsec remote access VPN on a FortiGate device. At this stage, it works without issues only on version 7.2.When I tried to connect using FortiClient version 7.4, it got stuck and showed the message:"timeout while responding IP address".What could be the cause of this?Have you had similar experience?Please share your experience if you have.

Hi. I need to connect 500 Cisco routers with a Fortigate. What is the best way to approach this? Preferably I want it to be an IPSec tunnel interface. As I know, AD VPN is only supported by Fortinet devices, so it won't work for me, but is there an alternative? Thanks in advance.

Hello team!! I have many questions about VPN Licences.I think I understand the following, please let me know if I am wrong:* Up to FortiOS 6.2: I have licences for 10 Standalone Forticlient* From FortiOS 6.2 or higher: Unlimited Standalone Forticlients In first place I don't care about support, I am worried about how many client I could connect to Fortigate VPN.What about L2TP VPNs?  There is a limit for the amount of clients?I see an article here for FortiClient, but not for L2TP VPNs. Thanks in advance.Regards.Damián 

Hi, we have a ssl-vpn configured on mobile phones and the connection is discounted after every phone call, is there a way to prevent the disconnection? 

Dear Team, We have encountered an issue where the departing service provider deregistered the FortiGate devices instead of utilizing the "Transfer a device to another FortiCloud account" option. Could you please advise on the necessary steps to re-register these devices under our FortiCloud account, including the process for transferring any existing contracts associated with the equipment? Thank you in advance for your assistance.

Hi everyone, My fortigate device blocked this kind of traffic destination Apple.Store, how do i allow the traffic? Thank you.  

i m trying to customize Fortiweb os with terraform, VMware tools is already installed on vm but  i get this output errorError:│ Virtual machine customization failed on "/Datacenter_flexos/vm/fortiweb":││ An error occurred while customizing VM fortiweb. For details reference the log file /var/log/vmware-imc/toolsDeployPkg.log in the guest OS.this is my code:resource "vsphere_virtual_machine" "Fortiweb" {  name                 = "fortiweb"  datastore_id         = data.vsphere_datastore.datastore.id  host_system_id       = data.vsphere_host.esxi_host.id  resource_pool_id     = vsphere_resource_pool.resource_pool_fortigate.id  num_cpus             = data.vsphere_virtual_machine.fortiweb-template.num_cpus  num_cores_per_socket = data.vsphere_virtual_machine.fortiweb-template.num_cores_per_socket    guest_id     &n

Hello, I need your help. I'm trying to set up an IPsec remote access VPN on FortiGate for the first time. Unfortunately, when I try to connect, after clicking "Connect," it shows "timeout while connecting to IP address." I was following this guide.https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-IPsec-remote-access-with-full/ta-p/275672https://www.youtube.com/watch?v=diRUIQGnWqs If you can, please help me — what could be the reason?

Hi guys.I'm trying to upgrade my Fortigate 600E in our production environment. I don't have a forticare account and our contact will get firmware for us. Now I want to verify them by using MD5 checksum. I did a reserach and fortinet said If you go to their site and paste firmware file name, It will give you checksum. But no matter what name I type in bar, It says it couldn't find information about it.Since this is a production unit, I highly appreciate if anyone can give me hash details of these files. Thank you in advance.File: FGT_600E-v7.2.10.M-build1706-FORTINET.out.zipFile: FGT_600E-v7.2.11.M-build1740-FORTINET.out.zip

Hello, I have to connect 500 cisco routers from different branches on my virtual fortigate firewall. what is the best practice for routing?

I'm working on a new design for our SD-WAN and BGP. We're currently on 7.2.10, but I'm planning on attempting an upgrade to 7.4.7 tomorrow. We have two hubs, a primary (we'll call it PH for Primary Hub) and a backup (we'll call it DR), as well as many branches. Current configurationUnderlay: There's a metro ethernet (ME) connection between all sites. PH has two DIA connections, and all other sites have a single DIA. Overlay: We're using the ME directly, no VPN. Each site (besides PH) has two VPN connections between the site and PH, one for each DIA on PH. There's currently no VPN between the branches and DR, but I intend to correct that.BGP is on the tunnel and ME addresses. All sites besides PH are route reflector clients, and PH is doing the reflecting.SD-WAN: PH has health checks and rules for each other site. It prefers ME first, VPN-DIA1 second, and VPN-DIA2 third.It's all very manual and honestly, it's a bit of a mess right now. It's certainly not optimal, and I'm

Hello everyone,I'm currently setting up a lab environment to authenticate mobile users (smartphones, tablets) to a WiFi network using certificate-based authentication via 802.1X.I'm following this Fortinet guide (but i'm using a Bridge SSID and not a Tunnel SSID):FortiNAC WiFi 802.1X based network using FortiNAC Local RADIUS ServerInfrastructure:FortiGateFortiAPFortiNAC-F version 7.2FortiGate Configuration:SSID:RADIUS Server settings:NAS IP: set to FortiGate IPradius-coa enabled via CLI VLAN Interface ID 69 created and enabled with:RADIUS AccountingSNMPPINGSecurity Fabric ConnectionFortiNAC Configuration:Local RADIUS: Configured and enabled all TLS typesWinbind Domain: Configured (used for another SSID with LDAP + Persistent Agent)Network > SSID:SSID bound to Default RADIUS ServerCustom Settings:RADIUS Mode: LocalRADIUS Attribute Group: RFC_VLANEnforced Wireless Role: default, registration, and logical networksVLAN Port Group (ID 69):Authorized Access PointsForced Authenticatio

Hello guys, I need help, i have a fortinet 100f and i need to have HA, when i lost a internet link, i need that switch the trafiic automatic for the other interface. I have only one firewall and i works with the same internet links at same time.For Wan 1 im using for web traffic and Wan 2 for a vpn site to site. Please you help for have 

Hello, we are preparing in one office the change from FG81E cluster to FG90F cluster. We have actual 50 One Time Forti Tokens assigned to 50 SSL VPN /IPsec LDAP Users. As I understand I have to open a Ticket so that the CS team can move them to the new serials, correct? Is there any chance to keep users with the old Tokens, like copying them in the config file or do I have to create them from LDAP again and assign them a new token? It could be difficult because I dont think that moving Fortitokens can be done in hours so maybe we have to let them x days without 2MFA. Any suggestions to do this the best possible way? Thanks! 

IPSEC VPN is UP and traffic was normally going through, without any action we started to no more receive any incoming traffic in the tunnel. No change done on both side. Everything is ok on both side in term of routing and policy FortiGate 

FortiGate-81F # diagnose debug fsso-polling detailAD Server Status(err: server can not be accessible):ID=1, name(172.18.0.1),ip=172.18.0.1, port=0, source(security), users(IPv4:0, IPv6:0),username=swd\lcloperator2read log eof=0, latest logon timestamp: Thu Jan 1 03:00:00 1970polling frequency: every 10 second(s), success(0), fail(106)LDAP status: initLDAP query: success(0), fail(0)LDAP max group query period(seconds): 0this is branch location firewall the AD is in DC location also i checked the Fortinet documents but still i didn't find any solution can you please help me on this Note: Agentless polling mode

Hellowe are running FortiClient EMS  currently on 7.2.7 and upgrading to 7.2.10.We are getting reports of staff having random connectivity drops  once or twice a day , logs do not show anything particularly useful. What we have noticed though is that the staff getting issues are not rebooting their laptops daily. Staff who do reboot daily do not seem to hit any issues. Is there any oddity around the fortinet EMS client that requires a reboot to avoid issues occurring ?

Hello, Is it possible to setup a email 2FA for LDAP users to protect the VPN IPSec-overs-TCP connection ? The feature is working fine in the SSL VPN as previously. I found this KB but meaning working with a Certificat authentication : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-email-based-MFA-with-certificate/ta-p/348005 My IPSec-over-TCP is working with a pre-shared key. Thanks

I have loaded FG image on Hyper-V, how can I request virtual license in offline (without Internet on Firewall)  mode?

After configuring the VPN address provided by the client (scss.square-enix.co.jp) on other computers in the local area network, all connections were normal. However, one of the computers encountered the aforementioned error. Could you please take a look and identify the cause? The version number of FortiClientVPNSetup is 7.2.3.0929 Failed to establish the VPN connection. This may be caused by a mismatch in the TLS version. Please check the TLS version settings in the Advanced of the Internet options. (-5029) 

Hi everyone, I'm setting up a new cluster for a new location of ours the location will be L2 connected to an existing location but also have it's own Internet connection and Fortigate cluster. At our existing location we have an Active-Passive HA cluster running and now I am considering making the new cluster Acitive-Active to not leave performance on the table.I reached out to support to ask what the recommended mode was since the documentation does not mention a best practice/recommendation as far as Active-Active vs Active-Passive but was told "we don't make recommendations". So instead asking the community about their experience with this :) We are a single company so not sure how relevant using VDOMs is to us. Thanks! 

Hello,I have three FortiGate firewalls: A, B, and C.- A ↔ B: IPsec tunnel- A ↔ C: IPsec dialup tunnelI want to allow communication between B and C **without a direct tunnel**, by using FortiGate A as a **VPN hub**.Is this setup supported, and what are the best practices for routing, phase2 selectors, and policies in this case?Thank you!

Hello.I purchased a Fortigate201G; previously, I used Mikrotik. I am unable to configure VLAN. I am creating them according to the instructions. On Mikrotik, I created tugged and untugged ports. However, the end computer does not receive an IP address from the VLAN. DHCP is enabled. Could you advise me on what I am doing incorrectly?

Hi All, We have successfully implemented SAML authentication with Azure from FGT 120G cluster running 7.2.11.It works without any issue from the edge browser for all the tested users. But from the chrome after the Azure login page is prompted and after adding the credentials it is going to a URL looping.It loops between the local IP (https:192.168.50.254/saml/****) and login.microsoftonline.com (https://login.microsoftonline.com/****) URLs.  For some couple of users it works with chrome too. Checked adding after the SSL user certificate into chrome but no luck. Any idea for a workaround or solution for this issue?  Thanks

What oid can be used for get IP address for specific port, example ip for ifindex3.