Support Forum

Hello everybody,Some time ago I created a ZTNA environment on my Forticlient EMS, assigning some tags to some users.For example, look at these two users (this first one uses a macOS device, the second one a Windows device):the first one was Off-Fabric too when the attempts occured. As you can see, both users have the same tags.The ZTNA Firewall policy is unique:  So,  both user should access or not the ZTNA.The strange fact is that the Windows user can access the ZTNA: date=2024-10-10 time=13:23:01 id=7424106010597392384 itime="2024-10-10 13:23:01" euid=1040 epid=1070 dsteuid=3 dstepid=1051 logflag=1 logver=702101706 type="traffic" subtype="ztna" level="notice" action="accept" policyid=15 sessionid=11466583 srcip=….. dstip=10.1.0.207 srcport=7854 dstport=3389 duration=13850 proto=6 sentbyte=1112395 rcvdbyte=6568260 logid=0005000024 service="RDP" app="RDP" appcat="unscanned" fctuid="6C40ACFAC7B043A4851701EB5FDD3B3D" srcintfrole="wan" dstintfrole="lan" policytype

Hello,I have a question about LACP or MCLAG.In FortiSwitch managed via Fortilink, can an MCLAG or LACP connection be made vs. third-party switches?Reviewing the documentation, I only find examples with FSWs in standalone mode.https://community.fortinet.com/t5/FortiSwitch/Technical-Tip-MCLAG-channel-bounding-on-standalone-FortiSwitch/ta-p/281951

Greetings, I have a weird scenario using Forticlient connecting to SSLVPN. Our users connect to our Internal network using SSLVPN when they are working remotely. They are using Forticlient VPN with email token for enhanced authentication.Lately, we encountered issue such that user were not prompted for email token and get direct access to the network but no access to any of the servers or internal network such as file share. We have 2 Active Directory servers and that the email token is set to point to AD1 while AD2 is our primary Active Directory. Both AD are replicated.Has anybody encounter such issue before?

I'm testing FGSP and VRRP using foritgate VMs.  The topology is as follows:  FirewallA (VRRP Master)--------L2VPN--------FirewallB (VRRP Backup) There are 3 servers:Server A connects to Firewall AServer B connects to Firewal BServer C is in the VRRP domain and will reside in either Firewall The issue I've observed is When Server C tries to connect to Server B, it fails and the debug flow shows a reverse check failure.  I am not sure why this is happening with FGSP enabled, as all other traffic syncs across fine.  However, Server B is able to connect to Server C. When I make Firewall B the VRRP master server C can connect to Server B, but then loses access to Server A.  It seems like FGSP isn't synic traffic that's directly conncted to the Fortigates that is acting as VRRP backup.  All other transit traffic thats asymmetric FGSP handles it fine. 

We have FAC version 6.6.2 with FSSO and a FGT ver 7.4.5Sometimes a computer wich is connected to wired network, disconnect the cable and get IP from wireless network, the FAC FSSO does not get the information updated, and the user does not get internet conecction because of this problem.   FortiAuthenticator FortiGate FortiAP 

Hello guys! I am facing serious problems with Google Chrome Kyber. Specifically on 40F series. I have a couple of firewalls on 3 different versions (7.4.3, 7.4.4 and 7.4.5). Each of them has issues but with different behavior: Google Kyber IssuesSlowness to open websites or pages that won´t load. 7.4.3 - Google Kyber problemWhich feature is impacting? Web FilterSolutions:1. Disable Web filter2. disable Google Chrome Kyber3. Adjust tcp-mss-sender and receiver to 1450 in the policy7.4.4 - Google Kyber problemWhich feature is impacting? Application ControlSolution:1. Disable Application Control2. Disable Google Chrome KyberAdjusting tcp-mss-sender/receiver doesn´t work 7.4.5 - Google Kyber problemWhich feature is impacting? Application ControlSolution:1. Disable Application ControlDisabling Google Chrome Kyber doesn´t workAdjusting tcp-mss-sender/receiver doesn´t work I am migrating a lot of customers from other vendor to Fortigate with Fortimanager and trying to

Hi All, I need to configure my firewall to identify users using Kerberos for single sign on without an use of an explicit proxy. I was only able to find articles with Kerberos authentication with explicit proxy. My Device : FG-401FOS Version : 7.0.15 Thank you !... 

Hello Expert,I have a design question regarding our current network setup, and I’m hoping you can help clarify a few points. While this design may seem a bit unconventional, we are limited to using the switches already implemented in our design. I would like to know if what I’m proposing is feasible, and if so, how we can achieve it.Current Setup Overview:Site 1:Two FortiGate hardware devices configured in High Availability.The setup is functioning correctly.Site 2 (DMZ):Two virtual FortiGate devices configured in HA.This setup is also functioning correctly.Site 3 (LAN):Two virtual FortiGate devices configured in HA.Their HA synchronization is working fine.Connection Between Sites:Site 1’s primary and backup firewalls are directly connected to Site 2’s primary and backup devices.Site 2’s primary and backup devices are connected to Site 3’s primary and backup devices.Key Question:If the primary firewall at Site 1 goes down, I can configure link monitoring to trigger a failover to Site 2

I have a Fortiswitch 148E on FortiOS version 7.4.3 configured to accept public key authentication over SSH. I've found that I need to add "-o PubkeyAcceptedKeyTypes=+ssh-rsa" to my ssh command in order to successfully authenticate via public key as ssh-rsa is disabled by default in OpenSSH in favor of more secure algorithms. This seems like a bit of a security oversight on Fortinet's behalf. Is there any way to enable other public key algorithms in 7.4.3? Any chance this is resolved in 7.6?

Hello,I am currently encountering an issue with an application, which I suspect is caused by the hop count being set too low in the TTL header. There is a FortiGate firewall in the routing path, so I am wondering whether it is possible to modify the hop count field in packets as they pass through the firewall. I noticed there is an option to change the TTL of the session in seconds; however, I have not found any articles on how to change the IP TTL header. Does anyone know if this is possible?Thanks.

 Hello everyone: We are new Fortinet costumer and need help with the default domain configuration in a multirealm SSL VPN scenario. For example, we have the following realms configured:- https://vpn.domain.com (default realm)- https://vpn.domain.com/realm1 (realm 1)- https://vpn.domain.com/realm2 (realm 2) Our idea is that users can connect only to these 3 realms. But when testing, we noticed that if a user mistypes one of the realms (by example: https://vpn.domain.com/realm200), the user is redirected to the default realm. This is not desired. We expect that if this happens, the connection will be discarded by the firewall because there is no realm to match. Is that possible?. Thanks in advance 

Hi all,    After upgraded FortiOS v6.2.16 build1392 (GA) cannot access to SD-WAN GUI and it's showing "failed to load data". Anyone have s

Hi, Since we upgraded our Fortigate 200B cluster to version 5 patch 4 from version 4 MR3 patch 12, after about a week of uptime the cpu goes to 100%. The diag sys top command shows that the cw_acd process is using all the cpu. Doing a exec wireless-controller restart-acd command has no effect. We have to restart the whole machine. This has happened twice now with a week in between.

Hello, I would like to take port01 to configure my DHCP, but when I take it off Vlan Switch I can no longer access the fortigate, how do I do it?    

Hello, I have just installed on-premise exchange server and configured hybrid with office365. However, I noticed that I am not able to establish a StartTLS connection with office365 on port 25 and this causes email from on-premise user to a cloud user to fail. I have allowed all services on the firewall policy just to be sure that I am not blocking it but it still fails. I have attached a screenshot of failed connection test form behind fortigate and successful test from outside of Fortigate. I am a self taught administrator on Fortigate FW and appreciate all the support I can get. Cheers,~Richard

Hi all,We are facing the Forti-Client authentication login page issue by our all the users.We are using 800D UTM having v7.4.3 build2573 version. Error is ERR_CERT_AUTHOURITY_INVALID and we checked on event Viewer log & found error : The Certificate received from the remote server was issued by an untrusted certificate authority. Because of this, none of the data contained in the certificate can be validated. The TLS Connection request has failed. Attached URL action also not worked:https://community.fortinet.com/t5/FortiGate/Technical-Tip-GUI-Untrusted-HTTPS-server-certificate/ta-p/224780 

Hello Experts,in Cisco SD-WAN we have components (vBond, vManage, vSmart, vEdge) what are the device's names do the same rules in Cisco SD-WAN?in Cisco:vBond: OrchasrtaionvManage: ManagingvSmart: Control PlanvEdge: the edge router Thanks

Hi all,I have an interesting question. I'm messing around with FortiManager's VPN Manager tool and seeing a weird issue (TAC is working on it, but thought I'd ask the community as well).FMG 7.0.12, FGTHub 7.0.15, Spoke1 7.0.15, Spoke2 7.0.15, both Spoke1 and 2 have FortiExtenders with either Verizon or AT&T (not that it should matter the provider, just being thorough). All 3 sites are connected via MPLS and have site to site VPNs configured, as well. BGP is used for routing between the sites with MPLS being primary, StS VPN being secondary.I am creating a dynamic VPN tunnel configuration where if both MPLS and primary DIA are disconnected, the FortiExtender will build a tunnel and BGP will flow over that connection until one of the other two come up. While I can appreciate that SD-WAN and ADVPN should be used, they currently are not (they will be in the future, but for the moment it isn't something that can be fully configured at this time).Dynamic VPN is configured so that the hub

Hello everybody, ZTNA is not clear at all for me.I'm working from remote and in my Forticlient I've been assigned a tag: ZTNA_DEVI'm not connected to any VPN.On fortigate, there is a ZTNA Rule:  192.168.1.4 is a ZTNA server that manages a Virtual Machine.I've also a Firewall policy:This policy says that all users that whose destination is ZTNA_DEV (192.168.1.4) and have the tags ZTNA_DEV are allowed.But there is one thing I don't understand. I'm working from remote, so I'm not in the enterprise network. How can reach that server?The firewall policy is saying that the incoming interface is wan1, but how can I reach it?I know I have the tags, but how is possible that with these tags I should reach the internal network?Where am I wrong?Thank you so much! 

Hi everybody.I have the problem of receiving a privacy error when trying to access the 60F (firmware 7.6.0)  from lan.The real problem is that blocked pages don't display the Fortigate correct blocking page.I have done the Let's Encrypt ACME certificate and it works for connections out the lan. The privacy error is given because I use https://192.168.1.1 and the expected certificate is for xxxx.fortiddns.com (used for let's encrypt).I have, clearly, imported Fortinet_CA_SSL certificate in user's endpoint.I also tried to regenerate certificate and re-import it, without any change.I have an identical device working on another site, with exactly same configuration that doesn't have this issue, I really can't undersand the reason and how solve it.Thanks for helping.  

Hello,We have an FAZ Hyper-V VM running the latest 7.4.3 code. I can ping it and I can SSH into the FAZ but I cannot access it via the web GUI.  Edge returns ERR_CONNECTION_REFUSED.  Firefox just says Unable to connect.  Interface has  "set allowaccess ping https ssh snmp" Platform Type : FAZVM64-HVPlatform Full Name : FortiAnalyzer-VM64-HVVersion : v7.4.3-build2487 240514 (GA)

hi,i got new FG 401F and i don't see any forticloud key/registration code on the chassis (checked all sides) and no document inside the box. there's also no key on any sides of the box. the 40f i got has forticloud key on top of the chassis. can someone advise if this is a e-document/PDF i need to ask from the FG vendor/reseller?

Hi There,I tried to create a aggregate VPN between two fortigate node. FOS 7.0.14.https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/779544/ipsec-aggregate-for-redundancy-and-traffic-load-balancingthere are two VPN tunnel established already. and I added one tunnel to the aggregate vpn successfully. But I cannot add another member into the group.according to the guidance, I have to set aggregate-member enable. But I cannot do it, check the error message below. # nextPlease enable phase2 auto-negotiate if ipsec-aggregate uses redundant algorithm.This interface is currently in use.object set operator error, -23, roll back the settingCommand fail. Return code 1I tried to enable the phase 2 autonegotiation and delete the vpn tunnel and create a new one. the result is same.I tried to disable the virtual interface but the result is same. Since there is traffic on the physical interface already. I cannot disable it. I don't want to break the service.Appreciate your advice on ho

Hello,- We´re running FortiOS 7.4 on FortiGate 601E (with hard drive)- After upgrading to FortiOS 7.4, there were no more entries within the GUI @ Log & Report => Forward Traffic- For "Log location" "Disk" is set in GUI Of course Disk logging is still enabled, i.e.config vdomedit vdom two show full-configuration log disk filterconfig log disk filterset severity informationset forward-traffic enableset local-traffic enableset multicast-traffic enableset sniffer-traffic enableset ztna-traffic enableset anomaly enableset voip enableset dlp-archive enableset forti-switch enableend config log settingset fwpolicy-implicit-log enableset fwpolicy6-implicit-log enableset extended-log enableset local-in-allow enableset local-in-deny-unicast enableset local-in-deny-broadcast enableendconfig firewall policyedit 2set logtraffic allset logtraffic-start enable Am I missing any additional parameter?    

Hi teamI have a problem with get Log Access not getting name in UserID column when I integrate Authen (LDAP) with ADThanks