Support Forum

New setup with a 60F on 7.4.6.With 3 interface: WAN (6.6.6.6),Vl10_Users(10.0.10.1/24),Vl20_Servers(10.0.20.1/24)I did a rule that allow traffic between Vl10 and Vl20 with no ''inspection profile''.When NAT is disable on this rule trafic doesn't work between a host in Vl10 to another host in Vl20.Has soon I enable the rule with NAT, the host in Vl20 see traffic originating from the host on Vl10 with it's NATed IP.I don't want to enable NAT on this rule in order to see the originated source IP on the host in Vl20.Both hosts have they gateway pointing to the corresponding interface on the FW.I should not have to Nat traffic when routing should only be involved. I can do some show or debug if needed.Rule in question:set name "Allow_All_To_DNS"set uuid ...........set srcintf  "VL-10_OLD_LAN"...set dstintf "VL-20_SRV"set action acceptset srcaddr "all"set dstaddr "host_10.0.20.20_DNS-SRV"set schedule "always"set service "DNS" "ALL_ICMP"s

How can I enable DHCP options for a single host? For example, I need to assign a different gateway to a specific host.

Dear All,Can someone tell me why for internal traffic do we need to enable nat in the policies.Like example;I have the following network 192.168.1.0/24 on vlan x and network 10.64.28.0/24 on vlan y. Both vlan's are using firewall as gateway and a sub interface configured with trunk to allow both vlan's. The problem if i do not enable nat on the policies both subnet cannot communicate.  Thanks

hiMy FortiGate 200F , OS version : 7.0.16setting use ssl vpn and dns suffix (my environment have mutiliple domain)config vpn ssl settings     set dns-suffix “test1.com; test2.co.uk; test3.net”  endmy internal web  =>  https://www1.test1.com   apple iphone  forticlient vpn  After connecting   can connect  https://www1.test1.com  => OK input hostname   www1 => OKbut  android forticlient vpn  version 7.4.1.0176  , not working  only input  Complete FQDN https://www1.test1.com  OK  , hostname  not OK  What is the reason for this? 

i am getting error in installing vpn 6.0

Hello Expert, I would like to setup client server vpn, but would prefer to use a customize setup as instead of ADVPN (I have move control of the setup)I notice the option to use dialup user for customize setup can I use this option Instead of the ADVPN?I humbly request some guidance   Thank youRegards 

I have been experimenting with different sim card vendors in a Fortigate 60F-3G/4G. I have been trying to establish a remote access VPN connection to fortigate over 4G. So far I have been able to create a VPN connection locally so I know I understand the process and how it should work. I have also managed to get this working when the Fortigate is connected to the internet on it's WAN1 interface. I noticed when I insert a sim card, unlike the WAN 1 interface, the sim card interface (WWAN) receives a private IP address.I have tried:Vodafone: APN wap.vodafone.co.uk O2: APN payandgo.o2.co.uk3: automatically assign APN Vodaphone sim was a pay monthly, I tried with both pay monthly and pay as you go O2 sim and the 3 sim was pay as you go. On all sim's i can ping out to the internet from the Fortigate just fine.  I've also tried using DDNS (use public IP) with no joy. Any help is greatly appreciated!

Hi FAP & FSW adminsIf I'm not misunderstanding, since managed FAP's and FSW's configs are pushed from FGT, then it should not be required to follow upgrade paths for FAP and FSW. Is this correct?

Hi I want to reorder SSL Cipher suites, is possible?For example>> 

Hello everybody,We distribute device scep certificates via intune over a PKI instance to authenticate our devices via LAN and WiFi via a RADIUS server. However, our Fortigate does not serve as the RADIUS server. We use a Cloud Radius server and also a cloud provider as PKI for the scep certificates.Currently we use IPsec VPN via SAML login and pre shared key.Is it possible to use the already distributed devices certificates for remote login of the IPsec VPN instead of the pre shared key? However, I would still like to use SAML for user authentication. Or does this make no sense at all?Regardsfabs

 I get this message when I click on an extension in the IP Extension section. Can you assist me with this matter

Hello FML admins FortiMail 7.6.1. We have an issue with one remote mail server of "somedomain.com". The issue is more about TLS than SMTP. When we send an e-mail to that domain they receive successfully.However when they send us an e-mail from the same mx of that domain then the session can't initiate TLS, and we see the following errors in the session logs. STARTTLS=server, error: accept failed=-1, reason=sslv3 alert unexpected message, SSL_error=1, errno=0, retry=-1, relay=mail.somedomain.com [1.2.3.4] I see the reason is "sslv3 unexpected message" which should mean the handshake was unsuccessful.When I check the remote mx (as server) with openssl command I see it supports TLSv1.3. So I find it strange that it is trying to initiate a SSLv3 session (error message is about SSLv3). Since I have no control on the remote side, any idea on how I can workaround this issue from my side?Can this be fixed by setting an AC policy with using TLS profile with minimum

first time working with FortiSwitches so this is probably an easy fix?Topology.FortiGate firewall connected to a FortiSwitch using the fortilink interfaces. Then the first switch connected to another Fortiswitch. From the FortiGate GUI, I can see the information on switch one, and in 'fortiswitch ports' it shows its connected to switch two by the S/N under the 'native vlan' field.  But on switch two, I can see the port connecting to switch one is up, but no other information. Also in the 'managed switches' topology view it shows switch two as not connected.Switch one and two are connected via port22 on both, the switch port config is default and on switch two it created a trunk to switch one, it gets the created vlans from the ForiGate.Switch two, config switch trunkedit "SwitchOne"set mode lacp-activeset auto-isl 1set members "port22"nextAny help would be apprecicated.

we have two main switches configured in MC-LAG. Call it Fortiswitch A/B. In a spanning tree config would they both have identical priority? or would A be 4096 and B 8192 for example? What about if they are managed by the FortiGate. Does the FortiGate need to be the root? Can you set the spanning tree priority on the FortiGate itself? What is the best practices here?  Thanks, 

I configured trunks on my fortiswitch to structure the double port of my APs in LACP. on the access points I ran the same command:cfg -a FAP_ETHER_TRUNK=2but on a graphic level the trunk on the switch side remains red. I can see the switch through the firewall.only the first AP installed sees the green trunk, the others remain red.even the trunk to the firewall itself remains red despite all the ports connected in green. I don't understand why.the firewall is updated to the latest firmware version available and everything else is updated too. 

Hi Fortinet Community, My address object is edit "Wifi-address"set type interface-subnetset subnet 192.168.0.0 255.255.255.0set interface "Wifi-interface"next how ever my interface status is unused/disable/down edit "Wifi-interface"set vdom "root"set ip 192.168.0.1 255.255.255.0set allowaccess ping fabricset status downset device-identification enableset role lanset snmp-index 8set interface "port4"set vlanid 888next ...  however, I am use the same Address Object to use in new Firewall Policy but using different interface in source/destination like source is port9 destination is wan1. the policy can created. i ask ChatGPT, is this possible? Behavior with Disabled Interface:When you disable an interface, FortiGate may interpret that the address object no longer has a valid binding, effectively treating it as "unbound." This could allow the address object to appear in policies for different source/destination interfaces.This behavior can be se

Hello, By customer request, we have installed 7.2.8 on a FortiSwtich 424E-Fiber and a few FSR-112D-POE Rugged Switches. I did not factory reset when the software was updated. We have no issue with using the following command on the 424E:config switch interface    edit "portx"        set auto-discovery-fortilink disable However, we can not issue this command on a FSR-112D-POE switch. Why? How can we disable "auto-discovery-fortinet"? The command is requesting a "integer" (3-300), not "enable/disable". I have read through countless documentation and now I am confused about this. One document says to disable "auto-isl", yet I have this option disabled per interface. Is this all I need to do?Another document says that ports 9-11 are automatically set to "auto-discover-fortinet". Does this mean ONLY these ports? How can I disable this function then?I am looking for a clear and concise answer and method to disable "auto-discovery-fortinet" for the

Dear all i have FortiVOice 100 F and i have Cisco CUCM in another Branch , my two sites connect via MPLS and the two side see each other , now i  need to connect FortiVoice with Cisco CUCM , so any one can call from FortiVOice to CUCM voice ... 

How can we protect foritgate against a huge number of attempts to establish an IPsec tunnel, secured by a certificate with a bad certificate in request? That fact strongly imposes a huge load on one of the CPUs.

Hi, Is it possible for FortiGate to have a multiple router ID? My plan is to set up BGP over IPSEC tunnel. Thank you!

I registered more than 25 devices in my Fortianalyzer without problems, but I am not able to keep two of them 100% connected. I can see the logs and they have registered correctly in the analyzer and I can see the logs in real time, but if I do a filter for a longer period of time, it does not show data. Both the equipment and the Fortyanalyzer are in the latest version, both have policies allowing communication to be released for everything, like the others that worked. Can anyone help me with the demand?

Dear Community,  We have received a directive from our cybersecurity department to block all third-party VPN applications (such as Hotspot, SuperVPN, SpeedVPN, etc.) on Android and iPhone devices used by end users.After reviewing the article https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-third-party-VPN/ta-p/220170, we implemented the recommended settings. While we can confirm that ISAKMP traffic is being blocked, we have encountered an issue where the SuperVPN app on an Android device is still able to establish a connection.Furthermore, we are unable to implement deep inspection for VPN traffic, as our cybersecurity team has explicitly denied this approach due to privacy concerns. As per the policy, no administrator is permitted to view unencrypted traffic.We kindly request your assistance in resolving this issue and ensuring that all third-party VPN applications are effectively blocked, without the need for deep inspection.Thank you for your support

Some of our users are confronted with this problem pretty randomly while trying to establish a SSLVPN connection. Usually, 2nd or 3rd attempt are working. The reference tells noting about error -20105 related to connection problems (other than log upload failed, which is disabled).I could not find anything related to error code 20105 in this forum so far - any suggestions? A typical log file pattern looks like this: 30.03.2021 15:54:14    Error    VPN    FortiSslvpn: 16144: error: poll_recv_ssl -> SSL_get_error(): 5 30.03.2021 15:54:14    Error    VPN    FortiSslvpn: 16144: error: poll_recv_ssl -> WSAGetLastError():2746 30.03.2021 15:58:05    Error    VPN    id=96603 user=SYSTEM@NT-AUTORITÄT msg="SSLVPN tunnel connection failed (Error=-20105)." remotegw=extranet.xxx.xx vpnstate=connected vpntunnel="SSL VPN" vpntype=ssl vpnuser=xxxxx

I am working on a project that involves creating a SDWAN in a complicated situation. (See picture below). As you can see, I need to create another ADVPN.Would it be possible for someone to assist me? Thank you 

i have problem with fortivoice i have pc and phone connect to fortiswitch , i put the pc vlan as native vlan and voice as allowed vlan the problem is pc and phone take ip from native vlan (PC) , and when i put the voice in native and pc in allowed (pc and phone also take ip from Native vlan ) >> (Voice ) i mean allowed vlan not working