Support Forum

I have configured two WANs on my fortigate 100F.I wrote two routes to the 0.0.0.0/0 network with the same weight and priority.one that points to wan1 and one that points to wan2.and I would like to ensure that the PCs in group 1 navigate with wan1 and those in group 2 with wan2. what should I configure??if I write two policies to DOC only one works. 

Hi,I'm trying to schedule a full-config backup, from a 40F to a ftp server visible on vpn s2s. using this command:execute backup full-config ftp '/xxx/FGT_%%date%%.txt' 10.3.64.113 user pwd I receive this output:"Send config file to ftp server via vdom root failed." ping from fgt to the server not working, so I did a packet capture for destination ip 10.3.64.113 and I found that the Fortigate use, by default, the wan interface, but in this case that port is disabled and I'm using A port as a Wan port. what can i do to route the backup procedure correctly via vpn s2s using the correct tunnel-interface?

Hello guys,So basically my client wants to know if there is a way to force the fortigate to validate an AD group prior to all others, so that the users in that group (that belong to other groups also), may get the permissions set in that first group.He wants to know if theres is any sequence in wich the fortigate does that, and if so how is it done, by alphbetical order? As an example /VPN GRUPO ANF/AD_VALIDA , whould this be verified before this one /VPN GRUPO ANF/BD_VALIDA Thanks

I configured a VPN L2TP via IPsec on a Fortigate (401F). To manage authentication I used FortiAuthenticator that connects to a OpenLDAP server. Radius is used to connect Fortigate and FortiAuthenticator.In the end of the configuration all works but now I have a problem, that´s because I have 2 different user groups and I want to make different firewall policies (manage access) to each group. Let´s imagine a group "students" and a group "teachers", both authenticate via L2TP but with different accesses.How can I create different policies based on the group of the users?

All,  I've setup a 100E with web filtering profiles and connected it to my DC successfully. However when I enable Web filtering and use the groups and users I've created users cannot login. I can login as a local firewall user but not an LDAP user. I've had users try their username, their full name, their username@domain.local, and domain\username. None of the above work. is there something I'm missing here? 

Hi, we have two FortiGateRugged 60F in an active-active HA cluster.internal1 and internal2 ports were originally members of a hardware switch interface, with 5 VLANs. We changed the configuration to a software switch interface, to have a more granular control over the vlans for the seperate two ports, because the first approach doesn't allow to assign some VLANs on internal1, and some other (but overlapping) VLANs on internal2. The problem: Prior to the change from hardware switch to software switch, we could unplug the cable on port internal2 on FortiGate A (Primary, higher priority) and the traffic would be forwarded through internal2 on FortiGate B.But this isnt possible anymore. If we unplug the cable, there is no rerouting/forwarding and the connection is simply lost. I guess the FortiGate cluster still keeps FortiGate A as Primary, even though one interface is down? I wanted to add the two interfaces to the "monitored interfaces" of the HA, but this isnt possible -

Hello Fortinet Community,I'm currently facing an issue with my FortiNAC-F 7.2.8 (previously 7.2.7, upgraded in an attempt to resolve this) when trying to connect to switches via the Validate Credentials button in the device configuration. The credentials are verified to be correct, and FortiNAC successfully connects to the devices via SNMP. However, it fails to connect using CLI for validation. Here’s a breakdown of the problem:SNMP Connectivity: Successful – FortiNAC recognizes the device through SNMP without any issues.CLI Connection (SSH) Fails with Validation: When attempting to validate CLI credentials on FortiNAC, the connection fails even though the credentials are accurate.Direct SSH Attempt from FortiNAC CLI: When I directly try to SSH into the switch from FortiNAC's CLI, I receive the following error: Unable to negotiate with [Switch_IP] port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1, diff

Hi All, I've configured a policy with SSL Deep Inspection for my company and installed the Fortigate CA certificate on our devices in order to now be shown the certificate warning. However (on both mac and windows devices) when using Firefox it does seem to work correctly and the certificate shown by the browser is the Fortigate's, though when using either Chrome or Edge the certificates shown in the browser are the original webserver certificates, just as if the deep inspection policy didn't exist at all. What am I missing?  

 Dear Support Forum, I have an ipsec tunnel problem from branch to HO, where the download traffic from branch to HO remains 0 bytes,and in the configuration of the ipsec tunnel HO to the branch the peer id (gC.b) appears as the username.Is there anyone who can help to solve this problem? 

 Hi everyone, I have a LAN user wants to connect to a LAN server from the public address that is in the same subnet as the fortigate external address. I have setup VIP and firewall policies but it does not seem to work, debug flow shows it was DNATed to the server's internal address but the traffic does not go through(my server does not receive any traffic), the final log of the pakcet was "allowed by policy" then followed with nothing. My topo and configs are as follow, any idea is appreciated.config firewall vipedit "vip"set extip "10.1.1.2"set mappedip "192.168.8.200"set extintf "wan" # have tried with "any" but also not workingset portforward enableset extport 443set mappedport 443config firewall policyedit 1set name "lan1-to-lan2"set srcintf "lan1"set dstintf "lan2"set action acceptset srcaddr "all"set dstaddr "vip"set schedule "always"set service "ALL"edit 2set name "wan-to-lan2"set srcintf "wan"set dstintf "lan2"set action acceptset srcaddr "all"set dstaddr "vip"set schedul

As an MSP, we co-manage firewalls with in-house IT.   Combination of leased and customer owned appliances.  We have all customers in our FortiGate Cloud MSP edition instance.    Technicians are all setup with individual cloud accounts and forced MFA.   In-house IT takes the included tokens.   For other systems, we have a shared MSP login with TOTP key entered into our password management system.   Password management is protected by individual logins with MFA.   IT Glue….   I believe this is pretty common.   The problem lies in three spots.  1.  We cannot add a FortiToken to any password management system.    We have to manually add/remove technicians.   This is a huge security blunder waiting to happen.   2.   FortiTokens expense would get unreal.   We have many clients that are T&M.    We don’t get paid to have access, but when we get called, we need secure acce

Hi team,I created an admin account (local) with admin-profile as super-user. Although it is the highest privilege, I cannot add device/edit, even though I checked the information in the admin-profile (super-user) and selected the add Device feature.Thanks 

We replaced our core switch (HP 8212zl) with an Aruba CX 6405 back in June. We hired a consultant to reconfigure the config to be compatible with the new CX OS. Ever since then, FortiNAC is intermittently reporting Contact Lost events for our Aruba Controllers and Aruba APs. The controllers and the APs are on the same VLAN, and there are no ACLs or firewalls in-between VLAN 1 (new core) and VLAN 40 (wireless network). There are zero port errors on the core and it's not an STP issue. The contact lost events only occur with the wireless controllers and APs, and not with our other edge switches or servers. If we check the Aruba wireless side of things, none of the controllers or APs lose network connectivity. There's just a brief/random comms issue when FortiNAC reaches out to poll via ICMP. Does anyone have any ideas? Fortinet support is claiming it's a network issue and not on their end. I could really use some help. Thank you.

Allow me to outline for you a nightmare scenario... You're using BGP for routing, with a wholly separate netblock for those links.You have a few (let's say 6-7) AD servers doing LDAP authentication across the company VPN, and you'd like to actually leverage that redundancy.Address auto-selection based on the interface for binds to 0.0.0.0 is definitely a thing, and you're just not allowing those BGP-wrangled interfaces to talk directly with any other netblocks.You have a Fortimanager and need to configure over a hundred devices for this, when each and every one will default to using the BGP-provided address bound to the VPN interface to make outbound connections within the VPN network. Without more metavariable support, the Fortimanager is now a liability.  You may eventually figure out that CLI templates (which do support metavariables) will allow you a somewhat ugly way to slap the definitions of the AD servers into all these devices (which seems like it

ALL, I am creating my Fortigate Lab, using vmware workstation pro.i have downloded the lates VM-FGT_VM64-v7.6.0.F-build3401-FORTINET.out.ovf.zip (98.44 MB)i did all config, and i can reach out to internet, but when i try to activate the trial license using GUI or CLI, it give me Timet error msg. find the SC belos, and please helpNOte, i alread do all theses steps inthis link:https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/441460/permanent-trial-mode-for-fortigate-vm     

Hi FML adminsOn FML 7.6.0, Monitor > Log > History, I can't find Session ID anymore, so I can't display detailed session log, and I can't find a way to display additional columns in order to show Session ID column.Is it me or is this a regression?

hi we have an IPSEC tunnel configured on our fortigate FW which is linked to Azure.this tunnel has intermittent connectivity drop outs and its affecting production servers/users and what they are doing.as far as I can tell the phase 1 and phase 2 settings are correct at both ends. this includes the pre shared key, DPD, algorithms, diffie-hellman group, key lifetime for phase 1 and 2 and the PFS.based on the fact that the VPN is on for most of the time and the drops are intermittent, this would indicate that the settings are correct otherwise the connection would not be established... am i correct in saying this? i have noticed that we DO NOT have auto-negotiate or Autokey Keep Alive enabled on this tunnel. Not sure if this is required? but ive read some posts indicating that this is a useful feature to enable.https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-the-IPSec-auto-negotiate-and-keepalive/ta-p/189536fortigate detailsFortigate 1800Fv7.2.9 build 1688&

I have FortiSIEM, FortiSOAR and CheckPoint firewall. Connected FortiSIEM and CheckPoint firewall with FortiSOAR through connector. Now can anyone please guide me that how can I take action from SOAR. For example:SIEM detects a brute force attempt. SOAR ingest data from SIEM. Now I want soar to take action against the attacker through checkpoint firewall. eg: block IP/block url.FortiSOAR FortiSIEM 

We are a Cisco meraki LAN and AP shop with Fortigates. I'm keen to go full Fortinet stack with all the NAC features, reporting and insights into end users.Cisco meraki is easy to use and is well known within the company, but expensive, what are people's experiences in moving? I have read some negative reviews on the Forti APs in particular.I've also read FortiNAC can still be used without a Forti switch and AP but has it's limitations. As I don't want to go down the ISE route as it's a headache.

Hello, I have not found a way yet to set up intercom an extension using a prefix button. We are coming from an ESI PBX where a simple press of the extension on an interoffice call could be set to auto answer. Anyone have any luck with this? As it is, I have to program an intercom button for every extension using *92XXX where the X is the extension. This takes up a lot of real estate.

We’re currently using an IPsec VPN on a FortiGate device for remote access because SSL has reached EOL. Our entire network, including both internal and public IP addresses, is IPv4-only (no IPv6). Here’s a rough summary of our setup:Public IP: For security reasons, I'll use an incorrect IP example: 300.77.11.260Internal server: 10.0.0.4/24 (NVR system requiring remote access)FQDN: vpn-mycompany.com resolves to our IPv4 public IP (300.77.11.260)Issue Summary:The IPsec VPN is configured correctly; users on Wi-Fi can connect and access the internal NVR server (10.0.0.4) without issues. However, cellular clients using IPv6-enabled ISPs experience the following problems:They can connect to the VPN and ping the internal server, but RTSP fails to load live camera views.No internet access is available, as they lose all external connectivity - Internet traffic doesn't go thru VPN.Pinging vpn-mycompany.com while disconnected from the VPN (on cellular) resolves to an IPv6 address that we haven’t

Dears, what is the difference between access control rule delivery and recipient 

Hi,   I wonder if some has experience in establishing a SIP trunk between FortiVoice and Cisco Call Manager?

I have a FGT40F (behind NAT) at a remote office and a FGT61F at my home office with an IPsec tunnel between them. Both were on 7.4.3 and all good. I updated the 40F to 7.4.4 and now the IPsec VPN will not connect. I rebooted both ends and tried to enter a new key and still no luck.  I then rolled the 40F back to 7.4.3 and loaded the config back onto it and it still won't connect.  I've read about a new FW version changing something that affects VPN but I have not been able to tie that to my situation. Thanks for any help.

Hi, I made the mistake of uninstalling an old version of Forticlient to install the 7.2.2 and since then Forticlient doesn't work for any of my clients. When I try to log on, it gets stuck on "connecting". I gave full disk access to both Forticlient and fctservctl2. But I haven't enabled the "extension" which was prompted in mac OS 13 in "security and privacy" but not anymore in Mac OS 14. How do you enable forticlient extension in Mac OS 14? I have the same issue with older version now. log of fortitray.log: 20231208 19:24:56 TZ=+1100 [FortiTray:INFO] AppDelegate.swift:128 App: FortiClient-7.2.2.077620231208 19:24:56 TZ=+1100 [FortiTray:INFO] AppDelegate.swift:129 OS: Version 14.1.2 (Build 23B92)20231208 19:24:56 TZ=+1100 [FortiTray:INFO] AppDelegate.swift:261 Checking privileged helper.20231208 19:24:56 TZ=+1100 [FortiTray:INFO] AppDelegate.swift:270 Privileged helper was installed.20231208 19:24:56 TZ=+1100 [FortiTray:EROR] ConfigManager.swift