Support Forum

Hi folks,i deployed the FAC for eap-tls authentication on my network and it's working fine.Now i'm asked to setup sso login in order to login on the FAC without using the local admin account, i can't understand how to do this although the documentation i found.The sso is already deployed for my fortigate login, how can i do the same thing for the Fac, i'm using azure to achieve this task.Do you have any advice? Thank you

hi,just would like to confirm if my conversion below is correct?it's for NAT between two internal networks in our environment to reach the MGMT subnet 172.29.0.0/16.do i also use the "nat-source-vip enable" so the "mapped-ip" will be be used for SNAT in the reverse direction? interface Port-channel101.61 nameif outside security-level 0 ip address 172.20.248.78 255.255.255.248 interface Port-channel101.60 nameif inside security-level 100 ip address 172.20.248.70 255.255.255.248 object network obj-172.16.7.70 host 172.16.7.70 nat (outside,inside) static 172.20.32.1route outside 172.16.7.0 255.255.255.0 172.20.248.77 1route inside 172.20.0.0 255.255.0.0 172.20.248.69 1-----config firewall vipedit "vip-172.20.32.1"set extip 172.20.32.1set mappedip 172.16.7.70set extintf "po1.60"set nat-source-vip enableend config firewall security-policyedit "DNAT for 172.20.32.1"set srcintf "po1.60" set dstintf "po1.61"set srcaddr "any"set dstadd

Hi Guys, I just enrolled in to the course recently and i was given a task at work to try and connect to my firewall remotely and some of my clients are not connecting to the network due to insufficient IP's. Any suggestion? Rgards

Hello i have topology to azure like below pic and found asymmetric routing.Azure by default will use both tunnel simultaneously but when in the fortigate set traffic to azure only to peer 1 so azure can't communicate with the onprem.Anyone know how to make FortiGate can accept traffic from both tunnel?

Hello, I'm trying to set up threat feed (external connections) via Fortimanager (v7.0.13) for my 2 Fortigates (v6.4.12 and v7.0.15). They are in two corresponding ADOMs on Fortimanager (6.4 and 7.0). Syntax in the file according to the documentation (the same for both versions) 1.1.1.1 # This is a test However, for version 7.0, comments are recognized correctly, but for version 6.4, they are not. (screenshots). Tell me, please, what the problem might be?

Hopefully someone can help with this as my knowledge with BGP, ADVPN, Hub\Spoke is not strong - but it is growing. We plan on having 4 spoke devices and 1 hub device all with 2 wan interfaces (if we get things working we may introduce a second Fortigate in HA mode at the hub). Some locations will have a TLS link back to the hub but not all locations will.Currently I have 2 spokes and 1 hub setup all with 2 WAN and 1 TLS in a lab environment. For the TLS spoke 1 is on VLAN200, spoke2 is on VLAN300 and the hub has a trunk with vlan200 and 300 on port3. This configuration is how our ISP has told us they will be setting up the TLS. The WAN links are using VPN with ADVPN (dialup tunnel for hub) - no VPN for the TLS\LAN links. iBGP is setup for routing with SDWAN advertising our private network and the TLS VLANs. The TLS is the preferred route and the VPN is backup. If we only use the VPN everything works - if we plug in the TLS links - everything works. Once we lose a spoke TLS li

Hello,After we added 8 different new “Domain Name Threat Feed” as External Connector to our FW device and activated it, the device CPU reached 99-100% in a short time and the systems became inoperable and could not be operated from the interface. Is this an expected situation, do you have any suggestions to prevent this from happening again, what can be done for CPU-based interface access problem? Below is the list of 8 added;Threat Intelligence Feeds DNS Blocklist - mini version https://raw.githubusercontent.com/hagezi/dns-blocklists/main/wildcard/tif.mini.txt Threat Intelligence Feeds DNS Blocklist - mini version only domains https://raw.githubusercontent.com/hagezi/dns-blocklists/main/wildcard/tif.mini-onlydomains.txt Fake DNS Blocklist https://raw.githubusercontent.com/hagezi/dns-blocklists/main/wildcard/fake.txt Fake DNS Blocklist only domains https://raw.githubusercontent.com/hagezi/dns-blocklists/main/wildcard/fake-onlydomains.txt Encrypted DNS/VPN/TOR/Proxy Bypass DNS Bloc

Hi I've noticed that every time I create batch guest users, the number in the username keeps increasing: user0250user0251user0252 ...and so on. I have already deleted all users and the guest group. However, after creating a new guest group and generating new batch users, the numbering continues from the last user (e.g., user0253, user0254...). I can't find where this counter is stored or how to reset it.Thanks.

Hi Everyone, We've been struggling with this for a couple months now. I'm wondering if anyone has even had a similar issue like this. This location switched to ATT fiber a few months ago. Right from the start we've never been able to get more than 10MB down when running speed tests. They have a 50/50MB connection. The bandwidth monitor on the status page also confirms download never getting above 10MB. Upload gets up to the mid 40s during speed tests every time.  We connected a laptop directly to ATTs equipment, ran a speed test and get 45ish down as expected. Naturally we've been treating this as a firewall config issue up to this point. Here's a list of everything we've tried so far  ATT asked to have us set our WAN port to 100full duplex which it is. We also tried auto negotiate and 100half duplex. disconnected all equipment from the firewall except for one computer. Created a bare bones policy for that computer and put in at the top of the internal to

I know how to use the FortiGate GUI to run a Cable Test diagnostic on a given interface, but I need to know how to do the same thing via FortiGate CLI.  Does anyone know the command for this?

Hi People!, I just want to ask regarding the IPsec VPN logs. We found a malicious remote IP address in our logs. I want to ask what the status = Success and 1 is negotiate_error, and the message = progress IPsec phase 2 and IPsec phase 1 SA mean. Does this indicate that the malicious IP has successfully penetrated? What are the possible troubleshooting steps or solutions to stop this? Thank you! 

I am a student trying to learn FortiGate Firewalls on EVE ng using KVM images but I am facing license issue as i activated one firewall before and it become registered on my profile as KVM Evaluation license but i deleted the previous lab and started a new one then deployed a new firewall, now there is no way I can activate it as the activation is associated with the SN of the device. I tried to download the activation and upload it on the new device but it seems that it works with only on one firewall that become registered the first time by it's SN. now how can i activate another KVM image or transfer the same evaluation license to a new SN ? as you know there is no way i will get the same SN again on EVE deploying new device.

Hi all,I'm hoping someone here has successfully been able to set this up and can give me some pointers.I'm running 6.0.4 on a 200E and need to allow Symantec LiveUpdate to run through the F/W.The updates work when I allow all traffic from DMZ -> WAN, so I know the Symantec software is installed fine. However, when I block internet traffic, allow DNS lookup to pass through as LiveUpdate uses FQDNs and follow the Symantec tech article to allow it through the firewall, it fails every time. The tech article in question can be found here: https://support.symantec.com/en_US/article.TECH102059.html I've done some packet tracing when all traffic is allowed and it looks like LiveUpdate has multiple CNAMEs returned from the DNS. Should these CNAMEs be added to the policy as allowed or should the firewall be able to deal with them? It's getting to the point where I'm considering setting up LiveUpdate to run once a day and to allow all traffic out to the internet for a 10 mi

I am looking for a bit of guidance on how to get captive portal access to resources working based on firewall policies on a Fortigate (currently running 7.2.x).  More specifically, I want to restrict management access to devices to authenticated users while allowing full access to the services running on those devices. For example, if I have users on Vlan 10 and Vlan 20 with Windows servers on Vlan 30 and Linux servers on Vlan 40, I would like to restrict RDP from Vlans 10 and 20 to Vlan 30 to only authenticated users while allow SMB through for everyone.  At the same time I would like to restrict RDP from Vlans 10 and 20 to Vlan 40 to only authenticated users while allowing HTTP and HTTPS through. Can anyone point me at a complete, end-to-end How-To on how I achieve this, including where the (FQDN) captive portal could/should sit, please?

New Firewalls HA Setup with Reserved Management Interface- I have a FortiGate400F internal firewall(not directly connected to internet) with HA A/P mode and three VDOMs.(root, vdomA and vdomB)- I use my OOB mgmt interface as reserved mgmt in order to monitor both the primary and secondary firewallFW1 mgmt IP : 192.168.1.1/24 (port 'mgmt)FW2 mgmt IP : 192.168.1.2/24 (port 'mgmt)- I also want OOB mgmt interface to use for other services such as SNMP, Syslog.- Therefore, I have config 'ha-direct enable' so that the Syslog and SNMP traffic is passing through via that OOB mgmt interface.- However, after reserved interface config, FortiGate is unable to reach to FortiGuards services due to no routing via reserved mgmt interface.- i want the mgmt interface handle all the things (mgmt, FortiGuards, License, SNMP, Syslog, RADIUS, etc) How can I archive this setup or what will be the best approach to meet my requirements.thank you.

Hi,updating an active-passive setup for a 120G, from 7.0.15, to 7.2.9 seems to break HA totally.It looks like the internal network can not be found anymore. I raised a ticket on that. Downgrade is possible, but takes time and nervs.Take care,Ronny 2024-08-21 13:15:18 <hasync:WARN> conn=0x476086a0 connect(169.254.0.1) failed: 113(No route to host)2024-08-21 13:15:18 <hasync:WARN> conn=0x476086a0 abort: rt=-1, dst=169.254.0.1, sync_type=3(fib)2024-08-21 13:15:21 <hasync:WARN> conn=0x476086a0 connect(169.254.0.1) failed: 113(No route to host)2024-08-21 13:15:21 <hasync:WARN> conn=0x476086a0 abort: rt=-1, dst=169.254.0.1, sync_type=3(fib)2024-08-21 13:15:23 <hatalk> vcluster_1: ha_prio=0(primary), state/chg_time/now=2(work)/1724238681/17242389232024-08-21 13:15:24 <hasync:WARN> conn=0x476086a0 connect(169.254.0.1) failed: 113(No route to host)2024-08-21 13:15:24 <hasync:WARN> conn=0x476086a0 abort: rt=-1, dst=169.254.0.1, sync_type=3(fib)

 I have set up a DNS server on the flying tower. And it was referenced at the interface. There is normal internet traffic. But there is no record in the DNS query log 

Hello, I would like to setup configuration using one virtual IP to connect multiple internal IP/host. How can I do the setup? Model: FortiWeb 1000e with firmware 6.3.1-build1056  Thank You

I have 40 windows servers that perform unique functions and want ZTNA access to all of them. I guess there are a couple of different ways:1) Unique public IPs for ZTNA TCP Forwarding Server with the same external port being 3389, and internally mapped to the single server on 3389.. Easy, but takes up a lot of addresses.2) Same public IP for ZTNA TCP Forwarding Server, with unique external ports,  and internally mapped to the single server on 3389. Seems like a hassle for the end user to append a new port to and RDP session. Unless done using a SRV record in DNS with the unique port….. Does this sound correct ?Tom

Hi all,. I am having no luck finding these  link again I need FortiSIEM Linux and Windows Agents downloads the actual files not the guides or pdfs.   Thanks in advance. . 

Hi, I have question related to filters and policies, I know that I can deny or allow emails with encrypted PDFs, but I need to do this:Allow X account to always send encrypted PDFs to everyone, but if someone who received the PDF replies with the PDF attached then allow it too, but if someone sends in normal circumstances a encrypted PDF to X account then block it.Is it possible to create a rule or something like this?: If X account sends something to Z account, then X account now knows Z account, and then if Z accounts sends/replies with a encrypted PDF to X account then allow the message, but if X account does not know Z account and Z account sends encrypted PDF to X account then block it.Is it possible to do what I want to do?Thank you and I hope I'm not bothering you.

Reaching out to the community to see what 61F owners have to say about VPN tunnel usage. Curious about things such as: how many tunnels, circuit speeds, SDWAN, performance, etc. Not asking for a lot, just a quick reply.Have two tunnels now and we get Conserve mode. We are reducing policies, logging, and UTM usage. We want to get up to 6.I have worked with 61Fs before and was impressed. We are just having tuning issues in this environment.

Hello,I’m using macOS Sequoia 15.3.1 with FortiClient VPN 7.4.2.1717, but I’m unable to connect to the IPsec VPN.I’ve seen other forum posts suggesting enabling FortiTray, FortiClientProxy, and FortiClientPackageFilter under Network Extensions, but these options do not appear for me.Is there a solution for this issue?Thank you in advance. 

I have been trying to add SNMP on Fortianalyzer. I am able to get V2 working but unable to get V3 working. It have tried no auth/priv, auth/priv, auth/no priv but none seems to be working. I have followed this guide https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/62555 and wondering if i might have missed any steps?

At random moments, a user is incorrectly recognized by FSSO and does not receive the permissions they should. This happens sporadically but has been occurring more frequently lately.FSSO and the DC Agent are installed on each Domain Controller. They are configured so that each FSSO monitors all domains.Regarding the FortiGate configuration, the primary connection is set to the first DC, while the second DC is configured as a backup. FG ver 7.2.11Collector Agent version: 5.0.0319DC agent version 5.0.0315