Support Forum

Hello, When I register smartphones via dot1x auto registration, devices appear in the host view as "registered hosts." This is OK; it gets the job done. However, I couldn't find a way to modify the device type other than manually editing the host and setting it manually.  When a user has multiple devices (phones, tablets, PC, etc..) This creates a bit of complexity in the host view.IT admins have to sort things out manually for multiple devices with the same registered user. I tried to find a way around by using device profiling rules for iPhones and Androids by vendor name and DHCP fingerprint and confirming the device rule on connect. But it didn't work. (I know this profiling is for rogue devices; an already registered device would not hit this rule, but I tried anyway.)  Here is the question,  Is there a way to change the device type automatically after dot1x registration?It would be great to have Androids and iPhones sorted out with their icons a

Good day, I am trying to move away from using the FortiGate for DHCP for SSL VPN to using an external Microsoft server but need some advice on doing this.  My current internal network uses 10.0.0.0/21 for DHCP and currently the FortiGate uses an address list to allocate IPs to the SSL VPN from 10.0.3.0/21 which is within the 10.0.0.0/21 subnet. I recently tried to implement external DHCP using the random subnet 10.1.10.0/24 which I setup on the external DHCP server and when I connected to the SSL VPN, I got an IP from the SSL VPN server but could not route to the 10.0.0./21 subnet. Did I use the wrong subnet? I investigated the 10.0.0.0/21 subnet, and it looks like 10.0.16.0/21 may be what I should have used but not sure, when moving to an external DHCP are there any routes I need to setup or does the FortiGate handle this? Maybe I need a static route from 10.0.16.0/21 to 10.0.0.0/21? Thanks in advance I am just learning about subnets and routing. Jul

Hello, Im trying to add the user: "user" to the group: "group1" using the api v2 of a fortigate v6.4.15Below is my request with the return (200:OK) but no revision_change, so its doing nothingAlso below the GET requests on the user and group1 to show the configs What am I missing ? Thanks for reading !   curl -k -X PUT -H "Content-Type: application/json" -H "Authorization: Bearer abcdefg" -d '{"member": "test"}' https://FORTI-URL/api/v2/cmdb/user/group/group1{"http_method":"PUT","revision":"5d01f6d0438463b2da7bd48c54508be3","revision_changed":false,"mkey":"group1","status":"success","http_status":200,"vdom":"root","path":"user","name":"group","serial":"FGT6xx","version":"v6.4.15","build":2095}    curl -k -X GET -H "Content-Type: application/json" -H "Authorization: Bearer abcdefg" https://FORTI-URL/api/v2/cmdb/user/local/test{"http_method":"GET","revision":"5380e9e62a96d94149368f7c05789ab7","results":[{"name":"test","q_origin_key":

Hello,I have some doubts about FortiAuthenticator Agent and 2FA with Windows logon: the documentation says that the agent (installed on the endpoint) needs to contact the domain controller using LDAP (i infer this from TCP/389).So... what happens if the user is away and it's endpoint can't contact the domain controller? The documentation is not very clear about this.Thanks

We had recently been informed that we need to update our VPN clients.  Our user goes to this link https://links.fortinet.com/forticlient/mac/vpnagent to get the latest update.  But when we tested it this week, both fresh install / update comes up with the same error "Failed to connect to the update server." We had tried on two devices.   We also went to the website itself - Product Downloads | Fortinet Product Downloads | Support.  And we see the same error.The link for the windows update/fresh install works fine. https://links.fortinet.com/forticlient/win/vpnagent Any suggestion?

Hello can someone / (staff) summarize the key new features that are available with latest release of FortiNAC-F 7.6?   Thanks, 

Hello everybody, I have a firewall policy regarding an IPSEC tunnel. This policy is saying that all the addresses that belong to ipsec_range can reach the internal destinations.This policy, if I connect, is working fine:I can reach on of  my VMs: Everything is all right.What's the problem?The user that has connected to the tunnel, belongs to a group: Let's suppose I  want to say:I want to filter the source not only by ip address, but also by user group. the same user has an address in ipsec_range and also belongs to IPSEC_USER.Everything should be okay, right?No! I can't reach my VM anymore. What am I doing wrong?  

We want to restrict incoming traffic from external to our email archive server.We are currently using M365 email service.currently we have on policy from WAN to LAN, all to archive server, services - https, ssh, ntp, dns, tcp8000.how can we restrict the incoming traffic ?

We created a new IPSec tunnel to AWS.there are 2 destination subnet that we need to connect to.172.26.0.0/16 and 172.25.0.0/16.Can we do multiple subnet to AWS ?Only 172.26.0.0/16 is reachable at AWS but 172.25.0.0/16 is not.is there any restriction for routing multiple subnets to AWS ?

Hi,I have configured Fortigate to send traffic logs to a remote syslog server.The GUI displays the destination IP along with the corresponding domain correctly.But only the 'dstip' is sent to syslog server, while the 'domain' is not included.How can I send the 'domain' along with the 'dstip'?

fortigate is not responding to snmp query after upgrading ..I did the upgrade as my version they say is out of support ...dahhh its not working at all now

Customer has a pfSense that is configured for WAN auto-failover between 2 ISPs (Comcast and something else). I want to replace that pfSense with a FortiGate 60F. Is this feature included or do I need to purchase an additional license to make this work?

Hi,I'm managing 30 branches, all connected via MPLS and running FGTs as firewalls.There's a main site with a DC (10.7.7.80).I wanted to authenticate fortigate administrators via LDAPS and use their AD accounts for login.However, it is working in some of the sites, and not working on the rest. If i check the logs on the main site, I can see the packet is acceptedbut I can also see this session timeout if I click on this line of log:Some of the FGTs are able to contact the DC, when I look on their logs, it looks the same just without this "session timeout". I tried to increase the ldap query timeout on appliances which have this problem: set remoteauthtimeout 15 set ldapconntimeout 8000 but still the same. Will appreciate any help and advices. Thanks!  

Hi, I am trying to set up FortiGate Web Authentication and SAML as idP but I am having issues, I am following this guide https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/33053 I have setup but the authentication portal is not kicking in, I have seen that on the Fortigate in the Interface, you can enable Security Mode "Capture Portal", does this need enabling as not mentioned in the guide? Overview of what I have done.1. Created Enterprise App in Entra ID.2. Created a group in Entra ID added users and assigned to App.3. Created a Single Sign-on on the FortiGate pointing to the Enterprise App.4. Create a group on the FortiGate and set the Remote Server to Fortigate the Single-Sign-on and the Enterprise App group ID.5. Created a Firewall rule to allow traffic out and added the Fortigate group created in step 4.6. Create a Firewall rule to allow traffic in. When I test from a client PC or the Enterprise App I get 2This site can

Hello everybody, I have upgraded my FGT60F today from 7.2.6 to 7.2.9 and then to 7.2.10This has been working fine without any issue.After a while I noticed, that the VPN-Clients were not able to connect anymore.When I inspected the Radius Server Connection (freeradius), it says: Connection status: credentials not valid   I tried a few settings, whether I will get the connection back - but this did not work. After changing back to 7.2.9 the connection with the radius server worked again.Any ideas, what the problem could be?  Thanks,Martin   

Hello, I am seeing constant alerts on my Fortigate under sslvpn events "sslvpn login failed" This is not coming from the authorized users. Is there anything that can be done on it.  Thanks

Hi guys, Let me introduce myself first, I am a Freelance IT, I setup computers, cabling and help users with common problems at office or with printers as well I can take care of servers hardware.Actually one of my clients is a branch of the foreign affairs of my country, the security for them is very important as you can imagine. I have a small linux web server installed at home, there I have a web ticketing system which I want to use to keep a fast contact with users and give a fast response and solution when they have problems. From outside the office I can access but not from inside network, it seems there's a problem with the configuration of the SSL, I have few domains in that server, 2 of them with free SSL certificate provided by lets-encrypt and the other one was the cheapest I found just to try but with the same results (ComodoSSL). In any case when I try to acces to such domains there's a message "timeout" or if I try from my smatphone "ERR_CERT_

Hello, this happens now the second time with 2 different FG60 clusters. We have support tickets open but sofar no solution. This time we had 7.4.4 SD Wan configuration and working fine now for at least 3 months. Today we updated to 7.4.5 (we had conserve mode issue) and right away we get problems with the SLA Performance and since it puts down WAN2 interface I only have read only access from the Forticloud. I can access via WAN1 and the MPLS but I am not in the office now. We had standard SLA performance rules:1. Cloudflare ping to 1.1.1.1>WAN1 OK>WAN2 DOWN2. Default DNS ping to FG DNS>WAN1 OK>WAN2 OK3. Google Ping to 8.8.8.8>WAN1 OK>WAN2 DOWN I really dont understand. I see in Fortiview that there are 500 sessions over WAN2 to the internet, it is working but since SLA performance kills the route, I dont have access from outside to the public IP. What is the issue? Anybody else with the same problem? Any suggestions? Thanks!

I have an IPSEC tunnel configuration that refuses to allow GUI re-configuration. Displayed error is -9999:-9999.Objective: I am migrating from one IP/ISP/fiber to another, at the remote location. Local (HQ) connection will remain the same.I wish to run both tunnels until configuration is up and running. Otherwise, termination of existing tunnel disconnects all communication with the remote fortigate 80e.I originally configured the HQ connection to point to the DynDNS address of the remote site, I am unable to reconfigure this connection to a fixed IP.This connection is up and running. Firmware v.7.2.3 on both fortigates. When I change the Remote Gateway from Dynamic to fixed, it accepts the change, it recognizes and validates the IP address (malformed addresses are rejected). and when the 'check mark' is clicked the changes get locked in.But, when I click the OK button to accept the configuration, I am greeted with a red 'tag' in the lower right that displays and unhelpful '-9999:

Good day I am looking at purchasing a Fortimail 200E appliance and I see you you can still get a Forticare license per year. My question is, if I purchase it for a year and in a years time I want to renew, will I be able to or will I have a device that is no longer usable or can I renew it year on year for the next 5 years, one year after another? Sorry if this question has been answered, I can't find any solid answers. Another question, will the Fortinet Fortimail 200E work with a Fortigate Firewall 61F? Thank youEdward

Dear Community members, i require the IPS signatures file to upload into FortiGate. Please share link where to download the updated signatures.

Hi Team, I have configured 2 IPSEC to the same remote destination and it was working fine with version 6.4 however after the upgrade it stopped working. The reason for that is that the Tunnel ID for the second tunnel is assigned with an IP of 10.0.0.1 and not the public IP (which is assigned to the first IPSEC). Apparently, there is a behavior change on version 7.2. (In general, tunnel IDs are assigned the IP address of the remote gateway. If multiple tunnels use the same gateway IP address, then a random IP address from the subnet 10.0.0.0/8 is assigned).  Has anyone encountered a similar issue and what is the recommended fix? Appreciate your help and assistance. 

Hello!I have an environment with VPN connections using Native Android VPN. I've configured the policy and tunnel, and everything is working fine. However, I need to reserve IP addresses for the devices. In the current L2TP configuration, it's only possible to define an IP range, which results in random IP allocation. I would like to know if it’s possible to point to a DHCP relay, use the firewall's own DHCP, or any other method that allows IP reservation for each device. Below is the functional VPN configuration: Firewall OS Version 7.0.14 config vpn ipsec phase1-interfaceedit "VPN_XXXXXXX"set type dynamicset interface "port2"set peertype anyset net-device disableset proposal aes256-md5 3des-sha1 aes192-sha1set comments "VPN: VPN_XXXXXXX (Created by VPN wizard)"set dhgrp 2set wizard-type dialup-androidset psksecret ENCnext config vpn ipsec phase2-interfaceedit "VPN_XXXXXXX"set phase1name "VPN_XXXXXXX"set proposal aes256-md5 3des-sha1 aes192-sha1set pfs disables

Hi all,I have read some post to try to configure my fortigate 600E like a reverse proxy. The posts are closed, and that is the reason why I opening this.. I would like to emulate a reverse proxy to connect to internal servers (not DMZ servers) using my external firewall. I would like to know if the final connection to the real servers, is established by Fortigate or from the internet client. I'm not sure about this. I've posted that:https://community.fortinet.com/t5/Support-Forum/Fortigate-SSL-Offloading-with-SNI/m-p/348745#M253392 Do you know if the TCP connection is stablished  from Fortigate? I'm not sure if in both cases it works like a real reverse proxy. I don't want direct TCP connections to the real servers from internet clientsThanks ¡¡¡ 

Dear Team, My firmware version is 7.4.4. We are routing our webservers behind through cloudflare proxy. Here what are we getting in logs are the cloudflare proxy Ip address ranges. Pls guide me how to configure the fortigate to get the Original ip of the source traffic or how to Include the original visitor IP in fortigate logs.  I have already done as per the process defined - https://docs.fortinet.com/document/fortiproxy/7.4.4/administration-guide/764110/logging-client-ip-for-forward-traffic-and-https-transaction FGT (global) # sh full-configuration config web-proxy global set ssl-cert "Fortinet_Factory" set ssl-ca-cert "Fortinet_CA_SSL" set fast-policy-match enable set ldap-user-cache disable set proxy-fqdn "default.fqdn" set max-request-length 8 set max-message-length 32 set strict-web-check disable set forward-proxy-auth disable set forward-server-affinity-timeout 30 set max-waf-body-cache-length 32 set webproxy-profile "default" set learn-client-ip enable set alway