Support Forum

FortiGate 7.4.4-1 in GNS3 unable to ping GNS3 VM, unable to ping windows 11 host machine, unable to ping gateway.   FortiGate IP address: 192.168.0.33/24GNS3 VM IP address: 192.168.0.52/24Windows IP address: 192.168.0.125/24Default Gateway: 192.168.0.1/24 C:\Users\<username>ping 192.168.0.33Pinging 192.168.0.33 with 32 bytes of data:Reply from 192.168.0.125: Destination host unreachable.Reply from 192.168.0.125: Destination host unreachable.Reply from 192.168.0.125: Destination host unreachable.Reply from 192.168.0.125: Destination host unreachable.Ping statistics for 192.168.0.33:Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Warning: Got ICMP 3 (Destination Unreachable)FortiGate-7.4.4 (IP address: 192.168.0.33\24) running in GNS3 (2.2.47 version).GNS3 VM (2.2.47 version with IP address: 192.168.0.52\24) running on Oracle VM Virtual Machine.Windows 11 with IP-address: 192.168.0.125 with Default Gateway: 192.168.0.1 Able to ping GNS3 VM IP-addr

anyone with experience on the diagnose debug for sessionsync (FGSP)? i tried the -1 on 7.2.8 and think I once saw the sync packets on the output, but at the moment I don't see anything when the system is working normally and session sync is working. when i run a resync all command with diagnose test application sessionsync 9 I do get some output, but not during normal operations. another debug level perhaps? i did try a few, but couldn't get any other output to show.

I am looking to get SNMP traffic to flow across an IPsec tunnel. I know I have to change the source ip in the CLI for this to work properly. My question is, I have been instructed to use a source IP from a local phase 2 selector. This is a route based tunnel so phase 2 is 0.0.0.0/0 on both sides. There is a static route for 0.0.0.0/0 to go out the WAN1 port for the IPsec tunnel. Would I be using the WAN1 interface ip for the source-ip in the CLI, or how would I go about making this change? Thank you.

Hello,i have a fortigate 901G and connected to old isp modem with vlan subinterface and do static route to the next hop ip,WAN port led blinking Green and Static Orange, So :i created also loopback interface on foritgate and configure it with public ip and ping from this ip to 8.8.8.8 the ping is not compeleted with 100% many times give me loss with 20% and 40% and 80%a tried to change port speed to 100Full Duplex from 1000 auto nego. and it is still lossing the packets ping and user not able to connect to internet or ping  - So is there is any recommendations from you to solve this problem .

I know the differences between using flow based vs proxy based.I recently switched all our profiles and rules over to flow based to see if this was causing slowness in the response times users were seeing. It ended up being a DNS server issue after I took packet captures and saw the DNS queries were getting server failures half the time.Generally just curious if people are using flow based out there or proxy based in your environments!

Hello everybody,I've a simple IPsec tunnel on my Fortigate 60F (v7.2.10):  Is it possible to reserve a particular address to a specific client based on the MAC address. Let's suppose I want to reserve 10.212.134.221 for the client whose MAC address is xyz. Is it possible? My attempt was:I connect from the xyz PC, then I go to Settings -> DHCP Monitor -> Select the client ad reserve the address. Unfortunately, during the IPsec connection, the client is not shown inside the monitor.Is there any way to do what I want?Thank you!

Hi All, I am writing to inquire about a challenge I've encountered while implementing Fortinet Single Sign-On (FSSO) on my FortiProxy in a lab environment.Current SetupI have successfully integrated the FSSO Collector Agent in DC Agent mode with my Active Directory (AD) and Domain Controller (DC) servers.However, when attempting to define a user object of FSSO type under the User Definition submenu, only AD Groups are generated. I am unable to select specific AD Users.QuestionsDoes the FSSO configuration on FortiProxy differ from that on FortiGate? On FortiGate, I can define FSSO users by selecting specific AD Users under User Definition. This does not appear to be the case with FortiProxy.If defining FSSO users by specific AD User is not possible on FortiProxy, how can I implement FSSO in FortiProxy policies? I have several proxy policies that require source addresses to be defined by specific AD Users. I would appreciate any insights or guidance you can provide to resolve t

Hello all... New to Fortinet and wanted to run some script syntax by the community. Need to implement some global settings on our Fgates via a FortManager script. Some of our gates are multi-vdom. So far I have this, below - have not tried it yet - just to see if I have it right before tripping over the syntax.  Thanks in advance! This would be for the multi vdom devices - lconfig global   config system global    set admin-console-timeout 300     set pre-login-banner enable    set post-login-banner enable    set admin-ssh-grace-time 60    set admin-lockout-duration 300    set admintimeout 5    set admin-lockout-threshold 3  next  config system auto-install    set auto-install-config disable     set auto-install-image disable  nextend

 I have two Sites (Site A) using Fortiddns, and Site B using Daillup . There is VPN tunnel between them and it's working fine. I want to make DNAT for my server and it's behind Site B. I don't have public IP Addresd .it's not working in this scenario? 

Is there a way to create a SSID for GUEST in meraki cloud and integrated to FNAC-F FortiNAC FortiNAC 

Hi All,I'm looking for advise on configuring a backup internet connection using vDSL.I have a Draytek 167 which I plan to set to bridge mode and perform the PPPoE authentication on the FortiGate.I have a single /32 public ip address. Any thoughts on this?The ISP is Andrews and Arnold.

Hi,I have 40F, connected to FortiSwitch 108F.I'm managing the 108F, and the FortiAPs connected to it via the controller that exist in the 40F.I've configured the SSIDs to bridge mode, and I want the use the same VLAN for LAN and SSID.at the moment I've configured under the Fortilink interface, which port a is associated to it an interface VLAN (VLAN 10). I want VLAN 10 to work over the fortilink and also via port 1when I connect a second switch (non forti) to port 1 - the port goes up and down (I guess LACP is to blame).  I have the following configuration :the interface vlan -config system interfaceedit "STAFF"set vdom "root"set ip 192.168.10.254 255.255.255.0set allowaccess ping https ssh httpset device-identification enableset role lanset snmp-index 20set ip-managed-by-fortiipam disableset switch-controller-igmp-snooping enableset switch-controller-dhcp-snooping enableset color 13set interface "fortilink"set vlanid 10next and then the ssid configurationconfig wir

Taking a deeper dive into logging on the FortiVoice platform and I am seeing that on the dashboard itself, there are call logs displayed in the Recent Call widget. Inbound, outbound, errors where an incorrect number was dialed etc. Those same entries are not showing in the Voice logs in the log monitor section or any other section in the appliance interface. They are also not showing up in the syslog feed that is set up. We have tried Debug, Informational, Warning (all options) and set the log to remote host by enabling and selecting everything in the list. Has anyone else experienced this issue, is this a bug?   

Hi,Our firewall’s geolocation policy does not permit access from Malta. However, we have noticed that some IP addresses from Malta are being allowed through. Could you provide any insights into why this might be happening and how we can resolve this issue?

I am not able to run the backup command so that the fortinet backup can upload to a sftp server. Please note, I am able to ping and connect/login to sftp server successfully when I use winscp or other tool to connect with sftp server 200F-HA1 # execute backup config sftp FortinetBKP%date%.cfg 10.10.40.8:822 fortinet fortinet1Please wait...Connect to sftp server 10.10.40.8:822 ...Please wait...Connect to sftp server 10.10.40.8:822 ...Send config file to sftp server via vdom root failed.Command fail. Return code -1

Currently I have a typical Active Directory on-prem setup. 1- Persistent Agent gleans the username from the PC. 2- NAC is linked to AD and pulls the group info for the user.3- NAC sends the group tags to the Fortigate for use in FW policy to limit access for certain groups If we move to EntraID (which does not have directory services), how can we keep this design ?Is there any kind of workaround ? Don   

We just ran into this issue and I just wanted to warn you to not do so too: if you rename global address objects in FMG you can only do that via script (TAC said this).If you assign this to an adom afterwards it will be correctly assigned.You will have the renamed object in the adom and if you right-click that object and choose "where used" it will show you the correct references.However if that is a policy and you edit that policy the corresponding field will be empty. You will not be able to deploy policy package until you correct that because it will fail because of the empty fields in your policies. This at least affects global address objects. Cannot say about service objects as we haven't checked that yet and upon deployment it didn't complain about services. Accoarding to TAC this is a known Bug that at least affects FMG v7.0 (cannot say anything about 7.2 or 7.4).This also let's me wonder why TAC suggests renaming global objects by script when they know ther

Our corporate laptops currently use external USB network adapters. Users exchange them willingly or unwillingly. This causes browsing permissions, for example, to go from an intern to a manager or vice versa. USB network adapters are a problem but you have to use them.Is there a way to match each laptop to each USB adapter?

: that there is no bgp or ospf configuration in routing table :LPA-HALLES-FW100F-01 # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area V - BGP VPNv4 * - Routing table for VRF=0S* 0.0.0.0/0 [200/0] via 192.168.14.240, wan1, [2/0]C 10.0.255.0/29 is directly connected, parc.bonnelC 10.1.255.0/24 is directly connected, boucle1.bleuC 10.2.255.0/24 is directly connected, boucle2.rougeC 10.3.255.0/24 is directly connected, boucle3.jauneC 10.4.255.0/24 is directly connected, boucle4.violetC 10.5.255.0/24 is directly connected, boucle5.vertC 10.100.255.0/24 is directly connected, interco.siegeC 10.200.255.0/24 is directly connected, interco.hallesC 10.255.0.248/29 is directly connected, interco.fs1048eC 10.255.11.0/24 is directly c

Hello, we've configured SAML VPN SSL Login with Azure AD and everything is working.When we've configured the connector we used IP address of VPN SSL service of Fortigate like this:set entity-id "https://X.X.X.X:XXXX/remote/saml/metadata"set single-sign-on-url "https://X.X.X.X:XXXX/remote/saml/login" Now we've create an FQDN to access the VPN service like sslvpnurl.domain.com. When authenticating via Forticlient users receive a certificate error because even though the certificate configured is correct on Fortigate (*.domain.com) and Forticlient is configured to use FQDN, the SAML configuration is configured with IP address, so I think it's there the problem. Now I would like to change the Entity ID, SSSO Sing In and Sign Out URL on Fortigate configuration like this:set entity-id "https://sslvpnurl.domain.com:XXXX/remote/saml/metadata"[....] [...]so the error would disappear, I believe.Do I have to change the same configuration on Azure side, otherwise auth would not

Hi guys,I am configuring a Guest SSID in tunnel mode on fortigate (FortiAP) with external captive portal authentication on aruba clearpass.The redirection to the captive portal works correctly and when I log in with a user and password, Fortigate transmits the credentials to ClearPass which authenticates the user and correctly returns an Access-Accept.However, the problem is that Fortigate does not authorize the user so it always remains on the captive portal page.Anybody have an idea about the cause of this issue ? Best regards

Hi everyone,I'm having an issue with FortiClient SSL VPN where I get the message:"A VPN SSL connection is already active. You cannot have multiple simultaneous connections. Do you want to start a new connection and terminate the existing one?"Even when I click "Yes", the connection doesn’t work properly, and I keep getting the same error.Has anyone encountered this issue before? Any suggestions on how to fix it?Thanks in advance for your help!

After a newbie error when I replace my phone before transfering my forti token...I would like to have an local admin user without fortitoken for the console port only.Anyone know how?Thanks

Firewall version 7.2.9 - 40F I need to block adult images on Google Images. Could you tell me how to do this? I have already blocked the category on Webfilter and it still doesn't work.

  Good morning, We randomly encounter IPSEC VPN traffic issues on Fortigate since update 7.4.2 -> 7.4.3. The tunnel does not fall functional, but no more network traffic for several minutes.   Are you experiencing similar issues?