Support Forum

Hello FAC adminsI'm working on FAC 6.6.2.I noticed that FAC's local LDAP can be used only for local user DB.So far I mainly used it as RADIUS server (Corp LDAP as back-end) in order to add MFA.But now following our new requirement I didn't find a way to use it as LDAP server for accounts that are imported from Corp LDAP.Is it me or this feature is not available? 

Hello, Recently, I upgraded all my FortiGates from FortiOS 7.2.6 to 7.4.5. After several weeks with no issues, I took a closer look at my configuration and noticed an unusual increase in IPSec VPN errors. Specifically, the TX error counter on the IPSec VPN interface has been steadily increasing on all FortiGates with a PPPoE WAN interface. stat: rxp=6099751 txp=4612589 rxb=3619539840 txb=1263016689 rxe=0 txe=3928 I thoroughly reviewed my configuration and conducted several tests. While I can replicate the TX errors, they don’t appear to impact traffic or data transfer. Given this, I decided to open a support case. After several weeks of investigation, no specific issues related to FortiOS have been identified. I’ve also attempted to adjust the MTU and TCP-MSS settings in my firewall policies, but these changes haven’t resolved the issue. I already tried to edit these values to lower size but nothing change. Here’s the relevant part of my configuration:conf

Hey Guys ! HELP ME OUT or Drop some suggestions. So I need to convert Azure Firewall config which is is JSON to Fortigate CLI config. What will be the best approach? Or is there any tools out there https://tutuapp.uno/ ? Or I will have to do it manually.

I intend to configure FortiGate such that users are required to re-authenticate every 10 hours, regardless of whether user session are active or inactive. I have applied the following commands, but the session timer seems to refresh instead of decreasing. Could advise if this configuration is correct? config user settingset auth-cert "Fortinet_Factory"set auth-timeout 600set auth-timeout-type hard-timeoutend Remark: i suspect it refreshing because of allow-idle

Can someone please explain why this keeps happening?Here is the AntiSpam Profile:  Session Profile:

I am currently using Fortinet's managed rule (version: Main_1.0_20211210) on AWS WAF. I would like to confirm if there have been any updates or changes regarding this rule in November 2024.I understand that this managed rule has expired, but I would appreciate any additional information you can provide.Thank you for your assistance, and I look forward to your response.Best regards,

Can someone explain to me how to show the object installed in the Remote FGT or Local FGT.Example 1Create addressName Local-SubnetIP/Netmask: 192.168.1.0/24Mapped DeviceLocal-FGT 192.168.1.0/28Which IP/netmask is shown on FortiManager for this firewall address object for devices without a Per-Device Mapping set? Example 2Create addressName LocationIP/Netmask: 192.168.1.0/24Mapped DeviceRemote-FGT 172.168.1.0/24Which IP/Netmask will be installed on Remote-FortiGate, for the Local firewall address object?

getting send anyway error when using fortigate captive portal with http port.though it works post clicking on send anyway but I need to understand why I'm getting that aler  

I am using FortiClient VPN-only version on macOS Sequoia 15.1.1. I configured the VPN, and during the connection process, I entered my password followed by the dynamic token generated by FortiToken. However, I receive the following error:"Login failed. Permission denied."I have followed the steps in the official documentation (https://docs.fortinet.com/document/forticlient/7.4.1/administration-guide/903183/macos), including:Activating system extensionsEnabling full disk accessEnabling notificationsI restarted my Mac after applying these settings and double-checked that they are correctly configured. Despite this, the error persists.Has anyone else encountered this issue? Are there additional configurations or troubleshooting steps I can try?Btw, The same vpn configuration works fine on Windows 11.

Despite the following, we are still getting a barrage of brute force login attempts on our SSL VPN.- disabled web mode- using non 443 port- edited to the HTML page to hide login fields- created local-in policy to narrow sources, etc- tweaked the login attempt-limit, block-time, and login-timeout I am wondering if forcing the user to present a client certificate would reduce these attempts. In other words, does the enforcement of a client side certificate happen before a username/password attempt is made ? Any other ideas ? Don

 I have couple of Linux Desktops(Ubuntu 22.04 LTS and Linux Mint LTS versions) that need to use SSO for internet access and other networks. On Fortigate static ip based rules are used for these Linux desktops. These linux desktops are joined to Windows AD thru "sssd" and domain based user login is enabled. However these systems do not show up in FSSO Agent when logged in with AD user name. FSSO agent mode = DC Agent mode.On AD, the users are in correct OU and Group.Are Linux clients supported on FSSO ?.What are my options to resolve this with other than RSSO or any other Fortinet Products?. Thanks in Advance,

 when enter the username and password . this is the error . please help someone

Hi, I search how to do a "show" in the ADOM policy package. Is there a way to do that ? #!proc do_db {package cmd} { puts [exec_ondb "/adom/LAB_LBA/pkg/$package" "$cmd\n" "# "] } do_db "default" " show firewall policy " -> output : DEBUG INFO: TCL command exec_ondb: target = /adom/LAB_LBA/pkg/default # the goal is to show all policy in a policy package.. Thanks in advance for your help ! Lucas 

Hi, we have a FG200F on our main headquarter and a new office in Brasil with FG60F. We configured a VPN connection between the FGs (IKE V2, AES256-SHA256. AES256-SHA256). Both sides have 1GB internet access (well on the other side we are not so sure but some tests gave us very high bandwith). Now the problem, users from Brasil connect to our office with RDP and sometimes they complain about preformance. So it is not everyday but sometimes they cant even refresh a RDP screen. We have like 195ms latency. Has anyone experience and any ideas what we can do to check and improve? Thanks 

I have setup Deep inspection on the FortiGate and the traffic is matching the correct policy.I have taken the pcap on the FGT while the client is accessing the server and from the pcap how we can know the device doing decrypting/encrypting the packet to ensure ssl inspection working properly or not.I want to understand from the packet capture level only.

I'm now on day 2 trying to fix this. This is just such a waste of my time; I'm going to have to scrap the VMs and start again soon. This is what seems to be required every time I need to renew the licence on these. am I hitting a BUG ?Multi VDOM setup in a lab, the LAB has its own NAT and firewall to access the internet.Any out rule. I'm Assuming the VM is using the "root" VDOM for the licencing. LAB-XXX-FW-A (root) # execute ping service.fortiguard.netPING guard.fortinet.net (208.184.237.61): 56 data bytes64 bytes from 208.184.237.61: icmp_seq=0 ttl=43 time=156.5 ms64 bytes from 208.184.237.61: icmp_seq=1 ttl=43 time=156.6 ms^C--- guard.fortinet.net ping statistics ---2 packets transmitted, 2 packets received, 0% packet lossround-trip min/avg/max = 156.5/156.5/156.6 msLAB-XXX-FW-A (root) # endLAB-XXX-FW-A # config globalLAB-XXX-FW-A (global) # execute vm-license XXXXXXXXXXXXXXXXThis operation will reboot the system !Do you want to continue? (y/n)yRequesting FortiCare li

I am having an issue when I transfer a call directly to another extension, after the call is transferred there is a busy tone. The call is successfully transferred, but the phone that did the transfer is getting a busy tone.  Can anyone help with that

Hello everyone, I'm writing to ask you something. If you look at Fortigate's Forword Traffic -> deviceSome logs show the device name correctlySome other logs do not display the device name properly.I posted something similar before, but I don't think it worked out well, so I'm writing it again. https://community.fortinet.com/t5/Support-Forum/About-automatically-collected-device-information/td-p/356012 Please let me know what items I should check.     And I'm guessing, but I'd like to ask if it's related to the issue that you didn't activate the device detect function.  Thank you

Hi,  Our WebDevs have been having issues with getting hit with bots, and have determined that the bots never access a certain directory URL. All regular users hit this page with each page they load, I'm told. Is there a method, possibly with user management, to mark a user as valid and allow me to block the rest?Thanks!

hello expertsi have a serious problem with removing an aggregated interface in an almost empty VDOM.recently i take a backup  from a VDOM in a fortigate 600c 5.2.8 and restore it on a fortigate600d 5.2.8 and it runs in a company with strict SLA so i can't reboot it even!in this VDOM only there are 2 elements.one: an aggregated interface named "port-agg"two: an interface vlan that is assigned to the aggregation interface, named "Vlan-400".there are no reference to the Vlan-400, but in GUI it shows number 1 in the references column! but when i click on it ... there is nothing !i restored a default factory backup to that VDOM, but the interfaces still are remained.the command "diagnose sys checkused system.interface.name" does not give a proper information.is this a serious BUG in fortigate or it has a plain solution?can i force the fortigate to remove that VDOM whitout removing those fake references? regards.

Fortigate 81FFortiOS 7.0.16 Hi all, I'll see if I can explain this clearly. We have an external DNS A record webserver.com that points to one of our public IP addresses 1.2.3.4. On the Fortigate we have a Virtual IP that points to an FQDN internal DNS A record webserver.internal. webserver.internal has a private IP address 192.168.1.1. On the Fortigate we have a firewall rule that permits access to the Virtual IP on port 443. Internally we have a Windows failover cluster service that can change the IP address of webserver.internal to another private IP on a different subnet 192.168.2.1. Issue: when webserver.internal is pointing to 192.168.1.1 everything works fine. When webserver.internal is pointing to 192.168.2.1, there is no longer any external access.  Internal access continues to work fine. After the IP address of webserver.internal changes, this change is successfully reflected on the Fortigate. On the Fortigate if I go to Addresses, the w

hi,can someone confirm if the workflow new "session list" only applies under "policy & object" section in FMG?i don't see the "session list" option under "device manager" section.   

core switch working as layer 3 routing per vlans and the two fortigate working as HA A-P i need two know how the connection works the design also , if there more the idea please need to know all possible solutions and if there any topology diagram the clarify the solution 

Wildcard FQDN address objects do not instantly resolve the names like non-wildcard objects.  Instead, for wildcard objects, the Fortigate watches DNS queries as they pass through the firewall and it sniffs the IP addresses that are returned from DNS servers.  The address objects will cache the IP for the length of the DNS TTL and then flush the IP from the address record (though that can be manipulated to a static TTL in the CLI).The problem we see quite frequently is that if devices have DNS servers at a main hub site and check their DNS from the hub across an IPSEC tunnel, the Fortigate does not see that traffic and the address objects are never populated with IP addresses.  The Fortigate at the hub site sees the traffic because the DNS server forwards the request to a public DNS server and gets a response, so the hub Fortigate is always up to date.  But the branch Fortigates do not see that traffic, I'm assuming because they don't watch IPSEC VPN tunnels to sniff

Hi all, To support my problem description, please see attached diagram below, which is a simplified overview of my network. I am entirely new to Fortinet firewalls. I've always worked with Cisco firewalls but recently the company has decided to move away from Cisco and switch to Fortinet devices. I am setting up a FortiGate 70F on the latest firmware 7.6.2. By default out of the box the Fortinet was configured with WAN1, WAN2 and DMZ ports configured as "Physical Interfaces". Port 1 through 5 were setup in VLAN Switch Mode, with VLAN 0 configured on the default 192.168.1.0/24 network.My office network is on VLAN 70, subnet 10.70.70.0/24.I broke up the VLAN Switch and removed port 2 through 5 from it so that they would turn into physical interfaces again. Only port 1 is still in the VLAN Switch mode. See below:  Port 5 is currently my initial admin access port while I configure the firewall (that's why its called "Initial"). Whenever I connect this interface to