Support Forum

Was searching how to set up for a small network/lab and came across a company called Smallstep that provides free server and certificate services for small networks. They also offer corporate and enterprise solutions. Does anyone know if they are a legitimate and secure source for this? I had also read that setting up your WPA3 radius network using EAPS could be done somehow without using certificates but I can't find any material on this. Also would this usually require a static IP from my ISP? Can anyone direct me to relevant resources?

I noticed a problem. When the updated version is the same (31.962 at the time of posting), the signatures under the v7.2.10 build1706 (Mature) version are much less than the total signatures displayed on Fortiguard, only 12,346. On the 0S6.2.16 system, it is 18,861, which is close to the total number of entries, and on another OS7.4 device, it is also close to the total number of entries. I have followed the tutorial to turn on extended signatures and set exclude-signatures to none.Will this affect Fortigate's security features?Update record query:Intrusion Prevention Service | FortiGuard Labs

Here is the overall architecture200F(X3 and X4) <->(port 23 and 24) T1024E <--> 424E <--> 231GFirmware: 200F (7.4.4), T1024E (7.3.4), 424E POE (7.3.4) The issue is between the 200f and T1024E. The design was working great until I started working with the fortinet engineer on the 231G wifi connection issues. The engineer disable cap-wap offload and since then the switch randomly disables the ports connected to the fortigate (fortiswitch port 23 and 24) which completely brings down the network. What it feels like is happening is a network loop which locks up the switch but I am guessing here because that is just what it looks like when its happening. A reboot of the T1024E fixes the issue. After back to back outages I disabled capwap offload and the network stabilized. My plan is to bring back the customers old switches to stabilize the network and get the fortiswitch setup downstream from their switches until I find a root cause. I will set it up as a standal

Recently upgraded my firewall fleet (about 15 60f's, 2 100f's)We're experiencing a crash of some sort every 2-4 days.Of course a ticket has been opened and they're working it, albeit very very slowly. Pretty disappointed in their lack of urgency and overall continued lack of code quality.The crash debug logs from the console session has:NP6XLITE: __np6xlite_tunmgr_write:61 timeoutNot sure if anyone has seen this or knows anything about this issue ---- we're experiencing a high impact when this crash occurs, of course.

I am in process of downgrading a firmware of 124E however encountering following error when trying to do so:  ""Downgrade WarningSome incompatible administrator accounts were found with FortiSwitchOS versions<7.0.0. if desired, convert incompatible accounts using the "execute system admin account-convert <admin>" commandUnconverted accounts will not be able to log in with FortiSwitchOS versions < 7.0.0."" I executed the the command multiple times then it prompts for New Password then I am unable to type anything in CLI.  Current BIOS Version: 04000008Firmware Version: v7.2.5.build0453.230707 (GA) Trying to downgrade to: FSW_124E-v7-build0444-FORTINET.out

Hello everyone,I have noticed that there is a redundant entry in the Administration Guide (https://docs.fortinet.com/document/fortigate/7.4.7/administration-guide/443323/dialup-ipsec-vpn-with-certificate-authentication). It appears that the subject field of the certificate can be verified in two ways: once with "set subject" and once with "set cn" along with "set cn-type". However, "set cn" and "set cn-type" can only be configured via the CLI.Is there a specific reason for this redundancy?

Hi,Don't want to start with the boring stuff, it's below.I have a FortiGate FG-120G-BDL-950-12 with FC-10-F120G-131-02-12 what will replace a NSE-3000 (only) all other switches AP's remain Cambium.Is there a comprehensive detailed design, implementation guide available what is fairly recent and up to date.Recently tasked to replace a NSE-3000 router with something capable of BGP and have at least 3 SFP+ port, it was a long and slow process navigating through the sales team to acquire the correct hardware and licensing for it as they just wanted to sale the most expensive product they had in the catalogue  :rolling_on_the_floor_laughing:I have no experience deploying Fortinet product but have managing 3x F40 & F60 for over a year,  most of my knowledge of FortiGate product is from experimenting, self paced learning portal and web sources and their paid support service.I have heard in one of my conversation with the sales team from FN that there is implementation

greetings all,I created two SLAs, they have the same settings (same interface participants, same SLA target, same link status metrics) but only with different detect server (probing target). SLA 1 probing 10.74.a,b, SLA 2 probing 172.29.x.y. And, I added the two SLA under the same SD-WAN rule, which is with lowest cost (SLA)the question is , what is the Boolean logic here? Let's say, 15 consecutive times of probing failure occurs to either one of the two (1 out of 2) SLAs , will the related interface become inactive? and will the SD-WAN switch to the secondary interface (the interface with higher cost)?AND, what about if I add the two probing detect servers to the same SLA? and only use the one SLA under the SD-WAN rule?Thanks,Sean

Dear All,  I am trying to reset fortigate 60F because i forget the password and using reset pin to reset but cannot can any one tell me easy way how to reset fortigate using reset button without console.  

I'm seeing a lot of  IPS logs for outbound connections that show no ID or name. example: Attack ID0Direction:outgoingReference: https://fortiguard.fortinet.com/encyclopedia/ips/0Severity:info Is this a sign of an attack or is it a bug?

I'm trying to block iMessage for all iPhone users connecting to FortiAP. We tested both deep inspection and certificate inspection in proxy mode, but it didn’t work. None of the 2000 iPhone users have the Fortinet certificate installed. For testing, we installed FortiNet certificate in one test device, but iMessage was still not blocked.How can we effectively block iMessage for all iPhone users?

HI guys, Due to a ISP change my local Fortimanger is no longer reachable with the old address. I want to deploy a new FGT to my Fortimanager, but when I try this, the old IP is listed. Where can I change the IP to the new one? Best regardsVolker 

Hi,i have disconection While I put my cluster. But while I put my fortigate on standolone, the issue disapear…an idée ? Sorry for my english I am french ! thank you 

Hello Experts, Let us assume there is a SD-WAN aggregation with WAN-A and WAN-B.Can we have a configuration so that only WAN-A is usedwhen WAN-B bandwidth is less than a specific speed (eg. < 1Mbps)and WAN-B is automatically taking out from the aggregation? Best regards,  

Recently upgraded my firewall fleet (about 15 60f's, 2 100f's)We're experiencing a crash of some sort every 2-4 days.Of course a ticket has been opened and they're working it, albeit very very slowly. Pretty disappointed in their lack of urgency and overall continued lack of code quality.The crash debug logs from the console session has:NP6XLITE: __np6xlite_tunmgr_write:61 timeoutNot sure if anyone has seen this or knows anything about this issue ---- we're experiencing a high impact when this crash occurs, of course.

Fortigate ver. 7.4.xFortimail ver 7.6.xFortimail is considered unauthorized in security fabric, but there is no option to authorize it.

I'm attempting to set up Azure AD authentication and I have followed the instructions at https://yura.stryi.com/en/2021-03-05/fortigate-ssl-vpn-azure-mfa/ to the letter up until the point where it talks about "FortiClient EMS setup" as AFAIK we don't have that and I can't find any reference to it. Regardless it seems to be talking to the azure app as when I login as an azure user I see in the logs[fsv_found_saml_server_name_from_auth_lst:123] Found SAML server [azure-saml] in group [ALM-Staff]but I then getlogin_failed:391 user[username@domain.com],auth_type=1 failed [sslvpn_login_permission_denied]Now ALM-Staff is a local user group that can already  login to the VPN (which would've been nice to know when I was setting up the groups). Following the guide I set up azure-saml and SAML_AZ_ALL using something like config user saml edit "azure-saml" set cert "Fortinet_Factory" set entity-id "https://example-company.com:10443/remote/saml/metadata/"

Hello,Is it possible to restrict VIP objects to only SSLVPN users with split tunnelling enabled? I used the following KB article but it did not seem to work. The FortiGate we are using is 7.2. https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-access-a-VIP-from-a-SSL-VPN-tunnel-mode/ta-p/196738 The VIP uses a public IP address to map to an internal IP address.  

Hi Guys,Have everyone ever tried to config ADVPN with OSPF before? I am planning deploy ADVPN with OSPF between HQ and Brachs on next month. I want to do a lab with 1 Hub and 2 Spoke fisrt and follow the admin guide document, I have configured VPN and OSPF on all FG devices but the result is not as expected. All spoke can see the route from other, but the route always show the nexthop is Hub's IP. It means that spokes cannot establish neighbor together and cannot forward traffic directly. + HERE IS CONFIGURATION: ******* VPN config*********- HUB:config vpn ipsec phase1-interface edit "Hub2Spokes" set type dynamic set interface "port1" set peertype any set net-device enable set proposal des-md5 des-sha1 set add-route disable set dpd on-idle set auto-discovery-sender enable set psksecret ENC nsxqpsDPxjEVIkzt0I9tuJiVs+O2EesJODHPR21JdhMCbJNAxRwCNHmt4r9e7cBAdTGpRTbhegAA6yiVlgMaV0cNrP80m/7cVY2OdvRJWanFKO0yqnDR/ifXfT8NUo6UiljRzTkq6+fgD3+RCH8Bvw0Fy5rVu2unDl+hjh0bmmaFF70myq9

Hi Team,I need to access my client’s RDP system through a VPN connection. The client has provided VPN access, and I can successfully connect. However, when I connect to the VPN and attempt to access the remote desktop, the RDP session disconnects after a few minutes.Interestingly, when I use my home internet, the VPN connection remains stable, and I can access the remote desktop without any issues. This problem occurs only when I connect from my office network, which is behind a FortiGate firewall.My office LAN IP address is 192.168.1.100. After connecting to the client’s VPN, my assigned VPN local IP address is 10.1.0.15, and the remote desktop IP is 10.1.0.20.Could someone help me troubleshoot and resolve this issue?

Quick question.  Is it possible to use a SAAS SSO provider such as Okta, MS etc and using SAML? This is our current setup for VPN, but there seems to be a hitch when you need to involve Authentication rules because of the interface and protocol preference. Is the LDAP portion required for this? And not just relying upon the SP user data base? 

Hello :), I've previously had an offline CA setup and used it to sign certificate request for Fortigate. It was an easy process overall.  However, I now have an enterprise CA. A new folder under my CA was created as "Certificate Template". I understand it's utilization and whatnot, but my troubles come with accepting Fortigate CSRs. I immediately get shot an error "Denied by Policy Module 0x80094801, the request does not contain a certificate template extension or the CertificateTemplate request attribute."That's fine and dandy but I can't seem to be able to add that attribute anywhere before generating the CSR. I've looked online and I'm instructed with a CMD process that applies the Template to use, but I have the upcoming project of signing more than 80 of these certificates.  I'd appreciate the guidance on making this as simple as it was with my offline root CA :)

Should the certificates be imported into each firewall and then applied from Fortimanager to the cluster?

Hi,We have a FortiGate Active/Passive HA deployment in Azure, deployed across availability zones in the North Europe region.Currently, the following Azure VMs utilize public IP addresses based in the Ireland (North Europe) region for integration with a third-party vendor:- TEMPAZYHSCRPSC01- TEMPAZYHSCRSB01- TEMPAZYHSCRSQL01- TEMPAZYHSCRSQL02- TEMPAZYHSCRWEB01 *(this VM has its own separate public IP)*We have a vendor that has implemented geographical restrictions on their network, requiring public IP addresses originating from England (UK South).They have requested that we change the public IP addresses used by these VMs accordingly.Any changes to public IP addresses must include corresponding updates to all associated NAT and firewall rules within the FortiGate.## Technical Limitation> Azure currently restricts associating a public IP address from a different region (UK South) directly to an external load balancer deployed in the North Europe region.> This prevents us from simpl

I work for an MSP, we don't use Fortinet but one of our clients do business with a client that does.  When they attempt to access their website to submit invoices, they aren't able to access this site.  I was able to track it down to the IP address of my client being blocked.  When we asked this company about this, we were told that we needed to reach out to Fortinet to get the IP removed from the Malicious Server List.  Is there anyone here that can point me in the right direction to get this taken care of?  I called support, and they told me to post here.