Support Forum

Hi I have some Fortigate devices. I would like to have them both in my Fortimanager and my Forticloud. The Fortimanager is managed locally via a VM. Is it possible to do so? Can you give me more information? (I tried to add a device that is already added in Forticloud to my Fortimanager, but it failed)

Hi I'm trying to implement SSO with the IDP Authentik in a local environment. But the log said that I have this clock issue: __samld_sp_login_resp [847]: Clock skew tolerance: 0 __samld_sp_login_resp [852]: Clock skew issue. samld_send_common_reply [91]: Code: 5, id: 1, pid: 3728, len: 53, data_len 37 samld_send_common_reply [99]: Attr: 22, 12, f samld_send_common_reply [99]: Attr: 23, 25, Undefined error. samld_send_common_reply [119]: Sent resp: 53, pid=3728, job_id=1. And the datetime is just the almost the same from both sides: $ date Tue Aug 27 01:04:39 AM +07 2024FGVMEVL-CYXEDR9C # get system status System time: Tue Aug 27 01:03:49 2024 and I don't use NTP server on Fortigate side: FGVMEVL-CYXEDR9C # get system ntp ntpsync : disable type : custom syncinterval : 60 ntpserver: source-ip : 0.0.0.0 source-ip6 : :: server-mode : enable authentication : disable interface : "for

 Hello,I'm a beginner.What is the advantage of using the firewall in transparent mode?When the firewall is in transparent mode, can I assign an IP to its interfaces?I don't understand the difference between transparent mode and virtual wire mode?

 Hello, good afternoon community, a question may be very basic but I would like to know if you can configure an SSL VPN without having a public IP.

We have someone traveling and they would like us to not block from a geo filtering standpoint in Mexico/Caribbean. I would like to give them a list of countries to pick from for us to unblock. Is there a way to export this list? Via CLI would be OK too.

I'm looking to propose a FortiGate ruggedize 60F for an industrial environment, after reviewing the datasheet I notice that SSL VPN might not be supported. Extract from the DatasheetThere is nothing in the data sheet which indicates the memory of the device, for this deployment SSL VPN will be required. Can anyone provide some clarity on this?

Hi, I am trying to figure out if I can setup 2 separate SSLVPNs with 2 separate SSL certificates, but I am getting nowhere.Is this possible?

I am looking to install a second firewall at a an existing site, they are currently connected via metro-e that goes from a centurylink rad to a cisco 9300 which also handles vlan, dhcp, etc which currently connects us site to site. I have a diagram attached of the setup. My question, how can I add this fortigate firewall into the site. I want the network at Site 1 to communicate back to hq via metro-e but i want the cisco that is already at the site to handle dhcp and vlans. Any guidance would be greatly appreciated.

Hello All, Need help on below points. 1. Im planning to remove/disable central management from fortigate using below steps. go to security fabrics--click fabric connector--edit central mgmt--click disable and save does removing fortigate from fortimanager flush the configuration on fortigate ?. 2. Does configuring snmp services for out of band with reserved management interfaces [HA] allow user to take administrative access of fortigate through snmp server or its just for monitoring. I'm following below link for configurationhttps://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/313152/out-of-band-management-with-reserved-management-interfaces

Hello FCT adminsWe have FCT 7.4.0 (with EMS).Web filter works on Windows 10 and Ubuntu 2x but it doesn't work on MacOS 12 for both Firefox 129.0.2 and Chrome ver. 127.0.6533.120 (not tested with Edge).Below some output from FCT debug log that seem relevant.20240821 09:10:54.787 [INFO ] confighandle_darwin:158 unable to load custom page err unable to read custom page warning_page_FGD_down.htm20240821 09:10:54.849 [INFO ] fct_isdb:100 fctISDB updated, 0 inserted20240821 09:10:55.233 [ERROR] proxy_darwin:125 CA certificate is intalled but not trusted. Attempting to trust20240821 09:10:58.656 [DEBUG] fgdahandle:329 Init request20240821 09:10:58.656 [DEBUG] helper_darwin:78 attempt 1 retrying after error: failed to select IP20240821 09:10:58.657 [INFO ] fgdahandle:178 Launching FortiGuardAgent [-domain fctguard.fortinet.net -callback-port 50711 -log-level 255 -log-file /Library/Application Support/Fortinet/FortiClient/Logs/fortiguard_agent.log]20240821 09:10:58.862 [DEBUG] fgdahandle:238 re

Good day,I'm fairly new to the Fortinet ecosphere. We just started using FortiClient Cloud a couple of weeks ago. I've noticed in the clients' details a "Third Party Features." For our domain joined clients it picks up that BitLocker is enabled, but it doesn't see that Sophos Endpoint Agent is installed for the Anti-Virus protection. The couple of non-domain clients show Microsoft Defender just fine. Has anyone else run into this? The FortiClients installed are all 7.2.4.0972.Thank you in advance

Good people of Fortinet community. I need some help in implementing a multilink failover setup. We have 2 main sites connected as shown in the diagram belowBoth sites have WAN links on X1 with a failover Virgin link between sites. We currently route all traffic  on main site through X1: 195.57.84.0/24.I want to set up in such a way that only web traffic on main site goes through X1. All other traffic (ipsec, dnat, snat, etc) goes through X2 VLAN 280: 195.57.85.150, but should be able to failover to X2 VLAN 110: 10.10.1.1 should VLAN280 goes down.Would this just require static routes with different priorities and policy routes, or would putting VLAN 280 and VLAN 11O in SD-WAN be a better option? Your opinion is highly appreciated. Thanks!

I have a customer with Peplink using Starlink and is complaining that the connection is slow and not all traffic going through my firewall . I can see traffic coming in and also tested with a laptop showing significant speed. But when my internet is connected to their Peplink, there seems to be issues with slowness and dropouts? Is there any special configuration required from my end or is there any compatibility issue between the two?Just to clarify that when using only Starkink on their PEPlink there are no issues. But when plugging in my cable as another internet source they experience slowness and dropouts.Appreciate your feedbacks. TIA :) 

Hi and Hello,we've got some difficulties with the FortiClient Webfilter Chrome Extension. We want to force activate the extension in incognito mode. We compared 3 Clients but the reg key in:HKCU\SOFTWARE\Google\Chrome\PreferenceMACs\Default\extensions.settings...is vor every client different.Is there a scheme for that?or does anybody get the force activate to work?

How to clear a single user login event cache in FSSO Agent in showing the logon user on the active directory?the clear user cache button erases all the list! and users will disconnected from the internet they must log off and log in again,

hello guysi have a problem in my network , i cant ping ping from outside (port3) to inside (port1) and vice versa although I have configured all the settings correctly I think. ip addresses and policies and static routing  and that is the static routing and policeis configurationRouter(config)#do show run | in routeip route 0.0.0.0 0.0.0.0 Ethernet0/3ip route 192.168.0.0 255.255.0.0 10.10.10.4Switch#show run | in routeip route 0.0.0.0 0.0.0.0 Ethernet1/2FortiGate-VM64-KVM # show system interfaceconfig system interfaceedit "port1"set vdom "root"set ip 192.168.80.1 255.255.255.0set allowaccess ping https ssh http fgfmset type physicalset device-identification enableset lldp-transmission enableset role lanset snmp-index 1nextedit "port2"set vdom "root"set ip 192.168.100.201 255.255.255.0set allowaccess ping https ssh http telnetset type physicalset snmp-index 2nextedit "port3"set vdom "root"set ip 10.10.10.4 255.255.255.0set allowaccess ping https ssh snmp fgfm radius-acct ftm s

Hi, Anyone who knows how to automate commands or where can i request a new feature on fortinet. below is the command that we want to automate-Disable NAT Traversal-Re-enableNat Traversal-Bring down the relevant tunnel and bring it back up again. because customer don't want to do manually like this every two weeks because ISP side reset their connection every two week. Hope you guys can help.Thank you

Hello, everyone.I have a question regarding the host check feature on FortiGate SSL VPN.Here are the version details:FortiGate 61F v7.4.4 build 2662FortiClient VPN 7.4.0.1645macOS Sonoma 14.6.1I configured the host check policy as follows:config vpn ssl web host-check-software edit "test_mac" set os-type macos config check-item-list edit 1 set type process set target "kernel_task" config vpn ssl web portal edit "split-tunnel" set host-check custom set host-check-interval 600 set host-check-policy "test_mac"Since "kernel_task" is an essential process on macOS, it should be recognized. However, the connection to the SSL VPN always fails due to the host check.The same issue occurs with file check.I have given FortiClient and fctservctl2 full disk access permissions.If I set os-type macos to windows, the connection succeed. What could be the issue?

Anyone know why the static routes name addresses won't pull from my global address group? I am need to populate a static route with a number of address group that was created on my fabric root firewall. I see very limited addresses when doing this in the gut. Can this be done from the CLI?

Hi all, I'm replacing a Checkpoint with a FortiGate, config migration has gone mostly smoothly. On the previous device, SSLVPN users were authenticated against a RADIUS Server (which itself queried AD) for VPN with MFA, and also against an AD server for group information. My understanding is that both RADIUS and LDAP Auth happened simultaneously on the Checkpoint. I'm having an issue replicating this on the FortiGate. Opened a case with TAC and I understand that the same users shouldn't be on both RADIUS and LDAP, as the FG will try to authenticate them against everything it can - which has the effect of persons getting onto the VPN without MFA.I tried using realms to limit the VPN to auth against RADIUS, but with this person's AD group information isn't available for use by the policies.My current thinking is that I need the RADIUS server to send over group information. Someone suggested using SAML, but I'm not sure if I'll run into a similar issue where group info isn't availabl

I have a problem that i can't connect to the fortiguard servers. Ping to service.fortiguard.net, update.fortiguard.net and guard.fortinet.net works. I also tryed to change the porst like some articles described me to do it. But i can't solve the problem with this guides. Can you help me?

Hi All,            I just got my new fortigate 100F firewall and would like to use it as part of routing capabilities. I 'm trying a simple network setup such as physical port 1 is 192.168.1.1/24 , port 2 is 192.168.2.1/24 & port 3 is 192.168.3.1/24. I've a PC connected under port 1 branch with IP of 192.168.1.10 and Gtwy is pointing towards 192.168.1.1, the PC was able to ping and reach those firewall port 2 and port 3 IP addresses however they were NOT able to reach those devices under port 2 and port 3 for example such as 192.168.2.10 & 192.168.3.10.- I've allow all policy between src and destination between these ports.- Under network static router. I have added 192.168.1.x/24 route to gateway 192.168.2.1. Any 2 cents and suggestions on the issue will be very much appreciated.    

Hello Fortinet Community! I'm experimenting with a 40F Gate and was wondering if this is even a feasible idea.I'd like to create a Virtual Server with 3 x Public DNS Servers behind it (as an example). Then I'd like to set the System DNS to that of the Virtual Server. Then under my "internal" interface with DHCP enabled, I'd like to set the clients to use the "Same as Interface IP" which points to the gate. Is this a viable approach or am I over complicating it?

I am looking in the Image Folder for the Fortivoice 7.0.4 update and don't see the 100F listed. When I look at the release notes it shows under Supported platforms 100F listed and 100E has reached its end-of-order (EOO) date but only 100E in the Image Folder. Would the issues affect the 7.0.3 on the 100F?

Can someone explain the specific ways/differences in how the two Inspection Modes " Proxy-based" and " Flow-based" work in FortiOS v5.0.4 please? I had guessed that " Proxy-based" meant what we have clasically called " explicit proxy" , where the web browser would have to be configured to proxy to an IP address assigned to the FortiGate itself, and " Flow-based" meant what we have classically called " transparent proxy" . But I just did a test, switching the Web Filter Profile to Proxy based Inspection Mode, and without making any change in my web browser' s configuration, the FortiGuard Categories are properly applied. The FortiOS v5 handbook on page 774 gives a very brief treatment of Flow-based vs. Proxy-based, suggesting that flow-based is packet-by-packet, does no buffering, is faster; whereas proxy-based buffers up data objects which flow through the FortiGate, is slower, but could be more accurate. But I' ve been unable to find anything more detailed, and I' d prefe