Support Forum

We've been managing our FGTs with FMG for a while, and we've been trying to figure out how to restrict access to the FMG. We are using SAML SSO, so trusted hosts option isn't available - at least, it doesn't appear that logins for SSO can be restricted to trusted hosts. I also don't see an option for implementing local-in-policy. Even though all our FGTs are controlled by these controls, our FMG isn't - anyone in our organization can attempt to login, though we do have logins restricted to a particular group. Especially in light of the critical FMG vulnerability last year, this seems like a serious oversight if it can't be done - hence, I believe it can, but we just can't find the right area to configure. How are you folks approaching limiting access to which hosts can log into the FMG?

My VPN connection lasts a couple of minutes and then drops, I have to change ISP to stay connected.The strange thing about the case is the one I have the error with, it connects and for a few seconds you see the upload and download rate, then it stays still and after a while the connection with the VPN drops, what could be happening?greetings!

Hello and thank you in advance for any help.   We have 2 service providers with 2 different ip address blocks.    These service providers are load balanced.   How can I use the NAT dynamic IP pool with these 2 different outbound IP blocks. #fortigate v.7.4.6 outbound policy

I am hoping someone could offer some advice. I'm newer to the Fortinet ecosystem. I'm setting up a new network. So far, my wired traffic is working great. My WIFI is the problem. As of this writing, I have two SSIDs being transmitted. I can connect to both without issue. I have tried it on Windows, Mac, and iOS devices. If I connect to either SSID, I receive the error of no internet. I can ping 8.8.8.8 and 1.1.1.1 successfully, but if I visit Youtube.com, for example, the website gives an error to check my connection.  If I connect to NordVPN on my iOS or Windows device, I can access the internet normally without any issues. Since I'm new, I'm not sure what to share with you about my config, but I believe it's basically open and allowing all traffic. Does anyone have any ideas on where to start with this issue? For reference, My ISP is connected to a Fortigate 60F, FortiLink to a 124F-FPOE, to FortiAP 231Gs Thank You  

Dear All,Hope I will get reply soon.IPsec tunnel is showing inactive why and what can be issue behind it, could you please provide any solution on it. Thank you for your support in advanced.  

Hello,From yesterday we experiencing problems with websites beeing blocked because they belong to category that is blocked. This category is "unrated" which under DNS Filter is set to Redirect to block page.One of those websites is "docs.fortinet.com". Ofcourse that particular website category is "Information Technology", but for some reason Forigate categorizes it as "unrated".I can access docs.fortinet.com as soon as I add it to Static Domain Filter.To make the matters worse, this doesn't apply to every site.Where can I search the problem?

Hi,on my computers when Fortigate deny access on webpage and display message, this message have only text. When I see the same message on Fortigate configuration, I see that this message have also images and background. How could I fix this?

We're a K-12 boarding school with a ton of BYOD devices on our network. Currently, we have three SSIDs: Open (Mac auth), 802.1x MS-CHAP v2, and WPA2-Personal for guest access. We need to keep the open network around for devices that can't do 802.1x auth like gaming consoles. My question is, how do you handle BYOD device authentication? Is 802.1x still the only game in town? We need it to be fast and simple. I'd like to avoid EAP-TLS for these types of devices as it can make the onboarding more difficult. This is why we're still using EAP-PEAP. Any suggestions?

Someone has set up their FortiToken to go to my email and it's not my mates playing a prank...My email is somewhat exotic too, to manage to land that on the first try is impressive but also very bad for infosec.If you're a Marvel fan involving Goose and some German words, we need to have a quick chat.

Someone has set up their FortiToken to go to my email and it's not my mates playing a prank...My email is somewhat exotic too, to manage to land that on the first try is impressive but also very bad for infosec.If you're a Marvel fan involving Goose and some German words, we need to have a quick chat.

Hi Eveyone, Just want to inquire what it the current recommended Firmware for FortiSwitch S148FF ? I got an information that the Firmware v7.6.0-build1015 is not that stable as of yet. Your comments is highly appreciated. Thanks in Advance ! 

Hello, We are currently running two FSSO agents for two different domains on two different servers under these domains. Is it possible to query two different domains from a single server with a single FSSO agent? Is it possible to install two different FSSO agents on a single server? What is the best practice method for this? Regards,

  Hello, I have some questions. The customer branch and headquarters use devices from other vendors to establish IPsec tunnels for internal network access. The headquarters exit firewall is Fortigate, and the IPsec encrypted traffic for internal network access passes through Fortigate. In this case, can Fortigate provide security protection for the traffic of these internal network access

We have a few clients with public facing Citrix NetScalers with a login using MFA. The Fortigate has got Deny for Threat Feeds and limited to Geography of 1 county. but we users are getting hit with password lock outs against AD before the MFA kicks in. Can ZTNA be please in front of the public facing VIP https mapping and only open up if the Forticlient is present and connected? I have concerns on the Citrix Published desktop launching and working correctly using the Citrix Workspace client application to connect via the https proxy the Netscaler provides. via the HTTP Proxy ZTNA provides. Basically we need the ZTNA to only open up to the public IP's of Forticlients to the VIP's and not intercept nor tunnel traffic. Since Citrix already does the encryption and proxy of the ICA traffic over https. and adding it again into another session could likely break it and have massive performance issues.#XenApp #Citrix

Howdy Folks! I am new to the Network Engineering side of things, as I was a Sales Engineer/Solution Architect for the last 15 years. That being said, I have a laymen's understanding of the FortiGates, but very little hands-on configuration experience. I reviewed the VDOM overview (https://docs.fortinet.com/document/fortigate/7.6.1/administration-guide/), and think I have a general understanding of what needs to be done, but need to understand the "why", order of operation, and dependencies so I can put all the different piece of the puzzle together.The above document doesnt go into VDOM and VLANs, so there is a big area of question. I have been tasked to create an outline as to how to implement VDOMs in the following scenarios... Scenario#1 - Single WAN connection being broken out into (2) separate VLANs that require a separate VDOM for Management/control. Thought is to use VDOM1/Root to for the WAN-side FW instance and VDOMs 2&3 for the LAN-side VLAN specific F

Hello, I have configured a site-to-site VPN on a 40F with version v7.2.10 build1706 (Mature), which is listed above, the problem is that some computers can connect, others cannot connect from the same site, it is valid with the server administrator it indicates that there are no restrictions on connected users, in the policy as origin (LAN) there is an IP configured with a /24 mask in the policy there are no restrictions configurations some.  I appreciate your help.

I created a SSL Realm because I had another SSO SAML with Azure ID, and I had to add another one for another diferent Tenant, but after doing all the configuration, the SSO for the new realm it's not appairing

Hello, I have a problem. Some companies do not have FortiGate licenses. Is it still possible to perform a firmware update? For example, from Firmware v7.4.3 build 2573 (Feature) to Firmware v7.6.1 build 2573 (Feature)

Hi All,The is an IPSec tunnel between a branch office and a head office. In the branch office there is a subnet 192.168.166.0/24 SSL VPN (10.212.134.0/24) - HO-FG - IPSec VPN Tunnel - BO (192.168.166.0/24) 192168.166.0/24 route with interface BO-TUNNEL is added as a static routeSubnet 10.212.134.0/24 - 192.168.166.0/24 is added in the VPN phase 2 settings.  At the moment the issue is that when SSL VPN users connect to the HO the subnet 192.168.166.0/24 is not advertised so as a result SSL VPN users cannot access 192.168.166.0/24 subnet in the branch office. Could you please help to advertise 192.168.166.0/24 subnet to SSL VPN connections.

Hi, i have followed the configuration guide from the below link Configure SAML SSO for WiFi SSID over Cap... - Fortinet Community, and the authentication works well, within the default settings. However, since the captive portal user traffic is not encrypted, I decided to switch to WPA2 with PSK and captive portal. After this change, users receive an IP address (after providing the PSK), but the auth process doesn't occur, SAML auth request is not showing during the debug, and users see a "site cannot be reached" error when trying to access any website. Is it possible to configure SAML SSO but with any level of user traffic encryption? Fortigate 61f - soft 7.2.9

Hi, I have a problem with a remote IPsec connetion. I changed from SSL VPN to IPSec and now I have the problem, that the CEO wants to connect from home but unfortunately he has the same network at home (eg at home 10.10.14.0/24 and office 10.10.14.0/24). Since we cannot change network at the office and also we cant change anything at the home network we are looking for a solution. First I thought that only including remote hosts like e.g 10.10.14.250/32 in the IPSec config Accessible Networks could help but it was not the case. Any suggestions? Thanks!

When modifying any content in the VIP configuration file imported from Fortigate on Fortimanager, clicking the confirm button prompts Map to IPv6 Port This field is required. However, Fortigate does not actually enable IPv6. If using the VIP configuration file created from Fortimanager, this phenomenon does not occur. Fortimanager version is 7.4.5

Dear Community members, I am facing the issue with SDWAN un even traffic distribution, i have chosen all available load balancing algorithms but most of the sessions are always build on single zone member. Also i setup the SDWAN rules, the interface selection is on manual mode and load balancing is enable between both.

I am attempting to limit access to our SSL-VPN to only specific IP addresses.  It works great for IPv4, but any clients on AT&T mobile internet don't work because they receive an IPv6 public IP address.   I tried adding the public IPv6 addresses to the allowed hosts but it still will not allow the connection it just says "Unable to establish the VPN connection.  The VPN server my be unreachable" For troubleshooting I added the "all" IPv6 addresses object to the allowed addresses group but it still will not allow a connection.   I can't find in the logs were these blocked connections would be so that I can troubleshoot the issue. My questions are:Is there something else I need to do in the settings on the FortiGate-101F to allow these IPv6 connections?Where would I find the logs of connections blocked by the "Limit access to specific hosts" setting?