Support Forum

I have four standalone switch 1048E.  I am in the process of implementing to new fortigates.  I am having an issue where the switch isnt passing the vlan accross to the uplink port.  This is the HA port for the Fortigate pair. I have packet captured off both the inbound and Uplink port.  I can see the fortigate is sending the HA packets to the port but nothing appears to be getting to the uplink port.  I have reviewed the config to ensure that the vlan is set to allow on that trunk. So my question is that has anyone seen this on Fortiswitches and if so what can I do to fix it.  I have had an open support ticket for months and no resolution so hoping the community can help me out. Thanks ahead time.

When we add credentials in FortiSIEM admin settings, it only asks to map IP.Same IP can belong to multiple clients also, But in mapping there is no option to select collector. So how to map credentials to correct device linked to correct collector. Also do i need to allow supervisor to firewall port 22 if i want to add SSH credentials? This is not possible by allowing collector to firewall connection over port 22?

Hello,I am experiencing an issue with the dot1x configuration on FortiNAC.I am using FortiNAC 700F, version 7.2.8.0149. I have followed all the steps shown in this video:https://www.youtube.com/watch?v=7pRg2-SVipoThe problem is that I don’t have the "EAP-Type-Name" option.I still followed the entire video and applied the instructions, but when I connect a PC to the switch port where dot1x auto-registration is enabled, the PC shows "authentication failed." On the FortiNAC side, I don’t see any activity logs. Here is the switch configuration: interface GigabitEthernet0/17switchport access vlan 2switchport mode accessswitchport voice vlan 150srr-queue bandwidth share 1 30 35 5priority-queue outauthentication host-mode multi-hostauthentication port-control autoauthentication periodicauthentication timer reauthenticate 180mabsnmp trap mac-notification change addedsnmp trap mac-notification change removedmls qos trust device cisco-phonemls qos trust cosdot1x pae authentic

Hi, im having an issue with my FortiEMS as it says that my license is about to expire but i already renewed it.I already tried the function "Sync License now" on the Dashboard but it didn't help.Is there any other way to get the EMS to read the new license?Im using FortiEMS 7.2.4Thanks  

Hi Team,We have a requirement to setup alerting from Fortimanager and the alerting should be pushed to ticketing tool to create the ticket.We have multiple Fortigate SDWAN devices are being managed from Fortimanager. Can we aceive the below?> FortiManager to pull all the devices CPU, Memory, Interface utilizations and all the SNMP traps.> Can we set the thresholds for each of the traps and system resources.> Fortimanager to trigger an alert to SNOW when it hits the threshold.Is it acheivable?Can all the devcies be monitored from Fortimanager at all?Do we need to setup each device or can we setup the thresold or any monitoring config from Fortimanager and push it to the devices, kind of centralized management?Any suggestion or guidance will really help.Regards,Sanjay S

Good day. Simple issue: I want to use SDN connectors with an onpremise FW (physical, not cloud). But for PCI compliance, I need to rotate the access keys periodically. Has anyone encounter a situation to make an automation between the cloud and the firewall, so the firewall pulls the new access keys and installs them into itself? Can it be done using a Lambda or API? (let it be AWS or Fortinet) I have the feeling that it can be done using the Fortigate API, so I can call it from AWS and pass the new access keys, but wanted to be sure. Thank you. #Fortigate

Dear Team,We hope this email finds you well.We are currently working on a task to delete a specific ADOM from our FortiManager, which contains templates and policy package databases. Before proceeding with the deletion, we need to take a backup of this particular ADOM.However, we have reviewed the documentation available to us and could not find any information related to taking a separate backup for an individual ADOM.Could you please confirm if it is possible to take a backup of a single ADOM? If yes, kindly guide us on the procedure and share the relevant documentation or steps that we can follow.We would appreciate it if you could provide this information at the earliest, as the customer is urgently requesting this action.  Thanks,Nithishkumar S

We have a Third Party that would like to allow us access to a subnet on their system via a Site to Site VPN. There is no need for them to access stuff on our network but they want us to use a small subnet to avoid clashes on their end of the network ( 192.168.255.1 / 24 as an example ) we have set this subnet up as a Vlan and have setup and established a IPSEC Tunnel and the tunnel works if your on aforementioned subnet.  Is there anyway to get a Fortigate FG100 to route traffic from another subnet over this tunnel? I can't create a static or policy route to route traffic to the gateway address 192.168.255.1 as it just complains it's a interface address (well yes )) Essentially we want it to take traffic from our vlan(s) and act as a NAT gateway sending stuff over the VPN. In the past we have done this by having another router take traffic out of the main router and pipe it back in via a WAN port. This is a little Jank though and I was hoping for something a bi

When i try to connect to vpn through IPSEC IKv2 on specific devices its giving me no response from peer. i tried everything and even opened the specific ports on the firewall and router thought maybe it could block the connection and still the same issue. 

Hi, all. I cannot ping a local interface IP on the Fortigate from a AWS host, connected through a VPN tunnel. I can ping the interface using a dial-up (FortiClient). It goes like this: From PC connected through FortiClient (IP is 10.10.1.2):Pinging 192.168.4.1 with 32 bytes of data:Reply from 192.168.4.1: bytes=32 time=1ms TTL=255Reply from 192.168.4.1: bytes=32 time=1ms TTL=255Reply from 192.168.4.1: bytes=32 time=1ms TTL=255 From linux host in AWS:PING 192.168.4.1 (192.168.4.1) 56(84) bytes of data.(zzzzz)--- 192.168.4.1 ping statistics ---22 packets transmitted, 0 received, 100% packet loss, time 21481ms To a host on the interface subnet, from linux host in AWS:PING 192.168.4.13 (192.168.4.13) 56(84) bytes of data.64 bytes from 192.168.4.13: icmp_seq=1 ttl=127 time=21.1 ms64 bytes from 192.168.4.13: icmp_seq=2 ttl=127 time=21.2 ms On the Fortigate, a trace shows Packet Trace #2004,2024/12/04 08:57:54,"vd-root:0 received a packet(proto=1, 172.31.32.14:53

Hello, i have a problem with my FortiClient 7.2.4 that is connected to a FortiEMS.The clients connect to the EMS with an invitation code but after they go offline and then online again they have to reenter the invitation code again.Is there a reason why a client has to reenter the invitation code and how can i prevent that? Many thanks

Dear forum, I am unable to implement successful SAML authentication using azure entra ID for fortigate/forticlient vpn.Fortigate 200F v7.2.10FortiClient 7.4.0.1658Azure/Entra ID for SAML AuthenticationVPN Phase 1/2 settings working correctly (confirmed with local auth).Any guidance would be greatly appreciated.Logs:Parkside-Core-FW1 # diagnose debug resetParkside-Core-FW1 # diagnose debug application ike -1Debug messages will be on for 30 minutes.Parkside-Core-FW1 # diagnose debug application fnbamd -1Debug messages will be on for 30 minutes.Parkside-Core-FW1 # diagnose debug enableParkside-Core-FW1 # [2579] handle_req-Rcvd auth cache message[132] __saml_auth_cache_push-Auth cache created, user='F23484CE-7E30-4530-8175-C0754B374085', SAML_server='saml-entra-id', vfid=0[139] __saml_auth_cache_push-Hash bucket 157[3438] fsm_initialize-Sent ACCT-ON[2085] fnbamd_cfg_init-[468] fnbamd_add_ca_hash-new ca 'ACCVRAIZ1', subject '/CN=ACCVRAIZ1/OU=PKIACCV/O=ACCV/C=ES', vfid -1[468] fnba

Dear all,Can you please advice me how I can block the auto update of WPS office software in FortiGate firewall ?

HelloAnyone available for urgent support I have fortigate 81e I have config admin login to fortigate using two factor authentication and now when I login to fortigate I don't receive otp I tried to access it over console it also ask for otp that I didn't receive I need urgent support please 

Hi all,A stated in subject, my question is about passwordless logins. So we are trying to implement yubikey with PIN + Touch as a primary authentication. Then Fortiauthenticator agent for windows with PIN + Token as a secondary/fallback authentication in case user forgets his yubikey. This two already work without any issues. Now comes the 3rd part :) On top of this we want to implement Always ON VPN with Forticlient and EMS. User should have zero interaction with forticlient.  My question here is if this is even possible to do? Thank you for your help

Hi all,We are slowly moving to password-less based login for our users. We have already piloted YubiKeys as our primary method of authentication. As a failsafe we are now testing also FortiAuthenticatior agent for windows since we already have it on-premises. The login with PIN and Token works fine without any issues. What is happening is, that from time to time (once, twice, multiple times per day, or maybe not even happening) login screen starts behaving erratically not displaying login screen at all. In the event logs I can see, that it was caused by crashed LoginUI.exe and Fac_AgentCredentialProvider.dll and ucrtbase.dll. Here is the log:Faulting application name: FAC_Agent.Service.ServiceHost.exe, version: 6.0.0.0, time stamp: 0x66dba094Faulting module name: ntdll.dll, version: 10.0.19041.5007, time stamp: 0x688f8c4bException code: 0xc0000374Fault offset: 0x00000000000ff3c9Faulting process ID: 0x14d4Faulting application start time: 0x01db40bfcd70a7caFaulting application

Hi,We have a really simple rule e.g.Source: private IPsDestination: Some AWS URL objects which resolve the correct IP addresses (confirmed using dns dump from the FW)Service: TCP/443No SSL. No URL filtering. We see the traffic in the logs on the firewall and by all accounts they should be permitted but we see they are being blocked: Threat Action: BlockThreat name: Policy violationThreat severity: MediumThreat type: Reconnaissance When I check the individual threat logs -> Antivirus, Intrusion prevention, Application control, web filter, filer filter, there is nothing in the logs. In addition we removed all UTM profiles to test and still had the same issue with the same threat block. Fortigate 3301E running 7.0.15. Example trace (which doesn't show any block): id=20085 trace_id=594 func=print_pkt_detail line=5867 msg="vd-XXX-PROD:0 received a packet(proto=6, 10.X.X.X.136:53314->3.5.245.179:443) tun_id=0.0.0.0 from portC1.999. flag [S], seq 2081025662

is there any sample of an initial endpoint policy for NAC-F ? I just want to see what a very simple basic initial policy looks like . Assuming this would be some sort of posture check? What is the most common policy type that is being used fort a simple deployment? Thanks, 

ok trying to have secure VPN connections for two different type of users.   We currently have a Fgate 60F V7.2.1; Windows AD environment; Fclient 7.2.5; EMS on Windows server   We can't use the SSL VPN.   I have two sets of users 1/ home PCs using the fclient free version; IPSEC VPN (IKE V1) then they RDP to their desktops; only RDP allowed in the firewall policy 2/ work supplied laptops using fclient with EMS; to have full normal access; currently using SSL however we have to move away from SSL.    Questions are A: is 1. a silly thing to do.  Should we just bite the bullet and buy bad laptops that are locked down to only allow the VPN and nothing else. Can we have a home PC connect securely, only allow them to RDP to their desktop; is this a massive security risk.   B: can I have two IPSEC dialups set up on the Fgate? Can anyone share a decent doc that actually explains what all the options do or even better says choose these ones.&nbs

Hi, Can anyone share the link where I can see the EOS / EOL products, right now I need the FortiAP EOS. Thanks

HiI am observing an issue as DNS entry stuck / not refreshed to default for local network adaptor while disconnects the FortiClient IPSec VPN. Following URL is found over the internetFortiClient DNS gets stuck : r/fortinet Resulting, if the user connects another network later, it connects but unable to surfing internet due to wrong DNS entries It is being observed with 10% users only with following firmware combination:FortiGate Firmware Version 7.4.5 build 2702 (Mature)FortiClient Firmware Version 6.0.9.0277 Regards,FAhmad 

I'm trying to use two SDWAN zones to browse different services, 1 sdwan - link 1, link 2, link3, link4 2 SDWAN - link5, link6 and link7. However, when I create the default static route for the 2nd sdwan, I start to have navigation problems in the rules that have the 1st sdwan set as the exit link, can you help?

Background on environment.Root vdom contains all the physical interfaces for traffic to the internet and vmware stack.  All traffic coming into or flowing out of the VDOMs has to route through Root.  Vdom-A and Vdom-B share IP schemes, so everything has to route through the Intervdom network 172.17.17.0/28.  Vdom-A has a VPN tunnel to another site.  The traffic to establish the VPN flowsInternet > Root Vdom > VIP in Root VDOM that translates the external traffic to 172.17.17.1 (the vdom-a side intervdom link between Root and Vdom-A) > Vdom-A picks up and establishes the VPN tunnel.In my initial test, the VPN establishes and traffic flows so I know I've got that part set up correctly.  However, Vdom-A will have a server with a "public IP" (let's call it 40.40.40.40 just for ease of conversation) that should be only accessible through the VPN.  I'm having some difficulty in establishing where the private IP (let's call it 10.10.10.40 for ease o

Dear Sirs, please help me with this problem that occurred today. I have 5 users who have not been able to log in to Forticlient on their Windows computers. The VPN reaches 40% and then returns to the credentials stage, without displaying an error message.The same test is performed on another computer within the community and outside the company domain and the user does connect, but doing so from those computers does not succeed.Windows updates have been checked, keeping them up to date, uninstalling the VPN and reinstalling it, connecting to different networks, re-entering passwords in Active Directory and the problem persists on those computers.The laptops are from different brands and are on Windows 11.When validating the logs in the firewall, it shows me user attempts N/A and in the action ssl-exit-error and in Reason N/A.

Hi, I'd like to configure our customer FortiGate running on OS version 7 to get users to our external landing page first, and after they have preformed a task, redirect them back to the local authentication page. How do I do that and is that possible?