Support Forum

How can I connect a VPN via a FortiGate 50E with a FritzBox via the FortiClient VPN program

I want to build a HA with FortiClient and my current EMS has 150 client licenses but do i need to buy another 150 for the implementation of a HA or will the client use the same license when switching to the second EMS?

hi everyonei have configureded ssl fortigate vpn with ldap authentification (windows 2008 server)i have this error in vpn events : sslvpn_login_unknown_useri have configured the ldap server, and add domain user in the fortigate i don't know where is the problem i use fortigate100d with  forti os v5.6.2 

Hello Community, Why I don't have ddns settings in fortigate interface, although I can configure ddns via CLI. Is it because of a license issue? 

Dear FortiNAC ExpertsWe have FortiNAC 7.6 - 802.1X Radius is configured with Cisco Switches and authentication is through LDAP-WinBind MSCHAPv2 , PC machines are windows 11, Now we are facing issue with new users / password change of the user or if user login to other PC in same domain, FortiNAC throw error credential failed when we change password in AD or new user logins.In this setup i think user does not have access to LDAP before logging into machine. it does not allow to enter credentials etc  how to fix this issueThanks in advanceFortiNAC @ebilcari   

We are having a bizarre problem since updating to 6.2.1 (we updated due to a memory leak issue in 6.2.0). Certain sites are giving us a ERR_SSL_PROTOCOL_ERROR only in Google Chrome. I have tried all the usual troubleshooting for this error, but the only thing that fixes it is restarting the fortigate. Two sites (facebook.com and login.renweb.com) both use TLS 1.3, but we can get to facebook without a problem and we cannot get to the other site. After rebooting the device, it works for several days and then starts behaving poorly again. Other browsers work fine, including Internet Explorer, Edge (not Chromium based) and Firefox. I have attempted to disable SSL certificate inspection, but that does not seem to affect the problem one way or another. I also tried putting the fortigate back on its factory certificate. My next step will be to revert to 6.0 branch, where I did not experience this issue, but I figured I would post first to see if anyone had similar exp

Our domain has been added to fortiGuard's antispam blacklist.Contact information for www.fortiguard.com is disabled.I would like to make a request to correct the false positive detection of anti-spam,but if anyone knows where to contact me, please follow me.

I was thinking about learning on how to configure Fortinate Firewalls and I was thinking about buying a small home firewall to play with. The purpose is to learn syntax and whatever I need to know. My question is do the small home firewalls use the same UI as the enterprise editions? My line of thinking is that if I learn it on a small piece of equipment, it'll carry over to the enterprise editions.Your thoughts or suggestions?

When we scan our website's IP address on www.virustotoal.com it shows that it is marked Malware by Forticlient. All the other vendors show it Clean. I am not able to find any place on Fortinet or FortiGaurd to check the IP address directly, neither a way to start a process of de-listing our IP address. The only relevant link I found on the website was https://www.fortiguard.com/updates/irdb , but it seems to be not working. Any help regarding this will be highly appreciated.

We have a external vendor who request us to setup IPSec tunnel with their Cisco router.the requirement is us to do NAT with the following static NAT address mapping table. True IP (Our LAN)      NAT IP10.200.xx.xx               10.229.xx.xx any issues if we use the following to setup the IPsec tunnel ?IKEv1Phase 1 (at life time 24 hours) :Authentication: SHA-256Encryption: AES-256Key Exchange operation security: DH-group-16 (4096 bit)Phase 2 (at life time 1 hour):AH-Authentication: NoneESP-authentication: SHA-256ESP-encryption: AES-256PSF: DH-group-16 (4096 bit)

I wanted to share a method I discovered for migrating configuration files from the old hardware platform to the new hardware platform without using the Forti converter tool. You can achieve this by copying the initial lines from the new configuration files and pasting them into the old configuration files. Once this is done, you can import the modified old configuration files into the new hardware platform, and it should work perfectly. Best of luck with the migration process. 

Hello everybody,I'm the Fortigate 60F (v7.2.10) admin, and I log into it at: https://vpn.xxx.com:40443/ or https://10.1.0.1:40443/ I defined a local-in policy to momentaneously deny the access to this page to all the users. All the policy above this one are disabled: edit 5set uuid d5c73f7a-eae5-51ef-8ecd-4cb99f22bef3set intf "any"set srcaddr "all"set dstaddr "login"set service "HTTPS-40443"set schedule "always"next The dstaddr is:   while the service is:  I should access the login page from everywhere. Why? What I am doing wrong? vpn.xxx.com is a DNS entry:    

Hello.Below is my understanding of the conditions for SD-WAN rule processing. Is this correct?The interface must be configured as an SD-WAN member.An SD-WAN policy must exist, and the traffic must match that policy’s conditions.The FIB is used to determine the next hop. FIB entries come from the RIB , which updates the FIB automatically. To add information to the FIB, routes must first be added to the RIB.

How my product is locked why I can't registered Please help urgently   

I am hitting the correct NAC policy which should send a COA to my Fortigate Wifi controller to change the vlan. Logical Network portion working correctly. PCAPs on gate and NAC not showing any traffic being initiated. Other policies are properly sending the COA. Are there any known bugs with 7.2? Here is the final lines from the Policy Details debug log.Looking up LogicalNetworkConfiguration for LogicalNetwork prod-wifiUsing SSID Name:root:corp_wifi, id: 439Returning LogicalNetworkConfiguration: AccessConfiguration- Task ID:[null]- Network:[prod-wifi]- Access Value:[VLAN_230]- Access Action:[2]- Alias:[false]- Send Groups To Firewall:[false]- RadiusAttributeGroupId:[1]- Version:[11]- Tags: []- Firewall Groups: []Don

Hi all, I and my colleagues have tried to upgrade a FortNAC-CA-700F appliance to a newer firmwar by following this guide https://docs.fortinet.com/document/fortinac-f/7.2.3/release-notes/195805/system-update-settings After reseting the appliance to factory default we are presented this screen: If we press 'DEL' nothing happens, though if we press 'TAB' we get shown this and are required to enter a password (and we actually don't know which passwordto enter): Else, if no button is pressed, then this is shown: Not sure how to preceed.Can anybody help with this? Thanks

We are looking for an experienced FortiNAC Engineer to assist with the installation, configuration, testing, and commissioning of a Fortinet NAC Virtual Server in our network infrastructure.

Hello, I would like to upgrade a Fortigate VM on Azure.I registered the license on Fortinet but cannot add the license to my fortigate "Manual license upload failed". Is there another way to add the license? Will it allow me to download the firmware images on fortinet.support? (I don't have the "support" license). Can I recreate a VM (in the target version), put my new license on it and import the configuration of the old one? Without "causing damage"

what is this i delete all logs but after few time they show me again error how to fix it please help memory traffic log is 95% full" - Fortigateapp-ctrl memory log is 95% full

Hello everybody, I'm working on a Fortigate 60F (v7.2.10) and I manage my Fortigate at the address: https://vpn.xxx.com:40443orhttps://79.x.x.x:40443  (for externals)https://10.1.0.1:40443  (for internals) because 79.x.x.x is the wan1 interface, I defined two local-in-policy:  login_group is an address group:     HTTPS-40443 is:    The policy n.1 works fine, if I try to access (10.1.0.1:40443 or vpn.xxx.com:40443) I correctly see the login page.From the same network (10.1.10.0/24), another device, can't (correctly).If I use an external device (for example my phone), connected to a different external network, it can access vpn.xxx.com:40443 and also 79.x.x.x:40443. The policy n.2 doesn't generate any log. What am I missing?    

I have a Fortigate 80E. We want to move away from local users on the firewall for VPN and to using LDAP sync, so that we can simply add/remove people to the VPN Access security group on the AD. We also want to force 2FA/MFA when those users sign in to the VPN.  I have been unable to determine how to do this for the 30 users that use the VPN from time to time.  Can anyone point me in the right direction? I am running 7.0.5. Thank you. 

Hello,New fortigate-40f user (v7.2.10 build1706 (Mature)) here trying to struggle a port forward from WAN to LAN web server.I checked the guides for virtual ip & firewall policy, but for some reason the internal ip/ service stays unreachable.The rules i created are.1. virtual ip2.firewall policy(tested with nat enabled & disabled with same result)  Any idea what is the issue here? yoursEtep 

Hello,We are a small MSP currently thinking of migrating from Checkpoint VSX on OpenServers) to a pair of Fortigates.For now there is one feature present in Checkpoint Gaïa Os that I don't know any equivalent in Fortigate world : Inline-layers.Appart for the performance gain inherent of inline-layers (equivalent to the jump action in the iptables world), this allows us to maintain a subset of rules in one place and publish it to multiple firewall policies without having to copy/paste the modified rules inside each policies.Is there a similar feature in Fortigates?

Hi there, I'm encountering problems with the newest FortiClient VPN application. The primary problem is that after hitting the connect button, it displays "Disconnect," yet when I verify the IP, I'm aware that it's not connected.

Hello,I would like to export, for internal audit, all administrators configured on all Fortigate managed by our Fortimanager and have the output on a single file. How I can do that?