Support Forum

Hi,  I want to change my security fabric from Stand Alone on my Gates to Fabric Root, are there any issues that I should be aware of when changing from one to the other? Only my FAZ is currently showing in my Physical Topology, but I'd like to add my FNAC, Manager, Mail, Sandbox and a few other gates in smaller locations. Cheers,

Hello guys,I am wondering if it is possible to set the default status of this feature (Receive quarantine report) to disabled?So we can enable this just for users which we want? We have deployed Fortimail in Gateway mode.Thank you for any tips :)

I use a ssl-webportal to have access to exchange owa with a predefined bookmark.the bookmark looks like https://10.123.99.28/owaAll firewall rules are correct.The OWA Login screen is indicated, but after entering the login data, I got a login failure withERR_CONNECTION_RESET 

I’ve been working on integrating LDAP with FortiClient EMS server v7.4.0 build1793 running on Ubuntu 22.04 but am getting "Auth Method Not Supported" when trying to add LDAP authentication server.In the EMS web console, when I go to Administration > Authentication Servers, I select "ADDS" from the dropdown, enter localhost and the admin creds, but when I hit "Test", I get an "Auth Method Not Supported" error.slapd is running and listening:# netstat -aptn |grep LIST |grep 389tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 326786/slapdtcp6 0 0 :::389 :::* LISTEN 326786/slapdAnd doing a tcpdump, I can see the traffic (although not the username and passwd being passed):17:30:52.956097 lo In IP (tos 0x0, ttl 64, id 42008, offset 0, flags [DF], proto TCP (6), length 115)127.0.0.1.41008 > 127.0.0.1.389: Flags [P.], cksum 0xfe67 (incorrect -> 0x25f2), seq 1:64, ack 1, win 512, options [nop,nop,TS val 3342323866 ecr 3342323866], length 63E..s..@.@..j.........0.......d[......g......7...7..0=...`8.

Hello people, I have a new projet, to deploy FortiNAC VM. I am a newbie with FortiNAC, any tips for a first deployement ? I will take any advice from people that configured it before. Thank you in advanceKind regards,

Hi folks I hope you're all doing well. I'm writing because I have a little "cosmetic" problem with my Fortigate 60E which is in use by one of my companies clients. Our monitoring tool notifies a lot of drops on interface 5 (more than 500k/hour). So I started troubleshooting. First I run the dia hard deviceinfo nic internal5 command: Description :FortiASIC NP6LITE Adapter Driver Name :FortiASIC NP6LITE Driver Board :60E lif id :7 lif oid :71 netdev oid :71 Current_HWaddr xx Permanent_HWaddr xx ========== Link Status ========== Admin :up netdev status :up autonego_setting:1 link_setting :0 speed_setting :10 duplex_setting :0 Speed :1000 Duplex :Full link_status :Up ============ Counters =========== Rx Pkts :18208097703 Rx Bytes :11024838411269 Tx Pkts :15296225169 Tx Bytes :10319894982632 Host Rx Pkts :3749448284 Host Rx Bytes :9406441080 Host Tx Pkts :582392616 Host Tx Bytes :11678029692 Host Tx dropped :0 Couldn't see any problems. Then I run the

Hi FortiMail integratorsWhat are the "recommended" method(s) to migrate a configuration from FML hardware to FML VM?

  Hello FortiPAM admins, I'm looking for a way to hide secrets sensitive credentials ( Username and Password ) from users with View or Edit roles  

Hello,we just solved a problem we had for weeks with our Fortigate / Azure SSO implementation and i thought maybe i can help someone save some time. We are running multiple fortigates for different companys. Since all those companys do use Office 365 we decided to let Microsoft handle the MFA for the SSLVPN login. We set it up and everything was running good besides one single user in one of our companys that wasnt able to login. He always received a error code -7200. We tried everything we could think of. Ressetting passwords, MFAs and even delete the hole SSL and SSO configuration on this fortigate. Alwasys the same error. No mater on which client this user tries to login the error stays the same.Debugging and the logs in our analyzer showed the error message sslvpn_login_saml_group_mismatch so we double checked for errors in the configuration but we could not find some. Tonight my last thought was that maybe 117 Groups are to mutch for a saml response. Microsft states

Hello Fortinet Community,I am currently working on configuring a FortiGate firewall setup and need some confirmation with VDOM failover configuration. Here’s the scenario I am working with:  - Firewall 1 (Fw1): VDOM A and VDOM B are configured as active.  - Firewall 2 (Fw2): VDOM A and VDOM B are configured as passive.  - Conversely, VDOM C is active on Fw2 and passive on Fw1.Is it possible to set up the VDOMs in this way, with Fw1 having active VDOM A and B while Fw2 is passive, and the opposite configuration for VDOM C?

when im trying to access this course -> FCF - Getting Started in Cybersecurity 2.0 Self-Pacedspecifically the first module or any module within the course, im not able to see anything inside, nothing is displayed, please provide me with a solution as to why is this happening, im attaching the screenshot 

Hi, have an issue with a newly configured EMS and Forticlient solution. On the Forticlient we are missing the "ZTNA Connection Rules" tab and when we configure a ZTNA Destination in EMS it doesn´t work or shows up in the hosts file. The ZTNA Destination profile also includes to allow personal  We have also configured the ZTNA Server in the Fortigate, connected it to the fabric and verified licensing ("Zero Trust Access: Included"). The endpoint have a ZTNA Serial Number, endpoint  and the ZTNA features is installed.  Have anyone experienced this issue before? Image of the Forticlient Thanks!  

Hi guys We recently deployed some fortigate NVAs in our Azure environment. We have used the templates in the Fortigate GitHub repository, The configuration we went with was Active-Active, using an internal and external Azure load balancer, so being in an LB sandwich. We’ve been struggling to figure out how to perform NAT and PAT whilst being in this configuration. Can someone with the same configuration please share detail around how to achieve this? It’s been driving me mad!

Dear Team, 1) Head Office --- FortiGate firewall2) Branch office --- FortiGate firewall  Requirement below:-  Only few URL's  traffic burst out  in branch office ISP and remaining all application or internet access and internal server all traffic burst out from Head Office This is possible, then please share the KB-Article. 

I have a FortiGate FGT200F device running firmware 7.* and want to swap from using the internal allocation of VPN IPs via Address List to an internal Windows DHCP server. What I am having issues understanding is if I set up the DHCP helper/relay on the FortiGate and point to my current DHCP server how does the DHCP server know which IP to allocate? The DHCP server currently issues IPs for internal devices but if I need it to issue IPs for VPN clients then it will need to issue a different IP. This may be a Windows question but thought someone may have done this before and have some guidance. Julian    

Disadvantage of using a internal CA issued certificate? Why is it not common?

 Hello Fortinet Community,I’m seeking advice on configuring the network setup shown in the attached image.  Here’s the scenario: Two large sites (HQ1 and HQ2) and several small sites, all with FortiGate firewalls, connected in a Security Fabric. HQ1’s FortiGate is the fabric root.FortiNAC Setup: A FortiNAC Manager with two control units located in HQ1 and HQ2. No HA.HQ1 hosts the primary domain controller, and HQ2 hosts the secondary.Given this setup, I have several questions:Should only the FortiNAC Manager integrate with Active Directory, or should the control units also be integrated?For the Security Fabric, is integrating the FortiNAC Manager with the Fabric Root sufficient, or should the control units also be integrated?How should the Email server, EMS, and FortiAnalyzer be integrated? Is it sufficient to connect only the FortiNAC Manager, or should all control units be included?Unfortunately, I haven’t found clear documentation on these integrations. I’d appre

Hi All, I have setup FAC as a RADIUS server and connecting AD using LDAP. The FAC has joined the AD domain and FAC able to retrieve the user from AD domain. When I try to authenticate user using 802.1x, it shows the authentication failed due to the machine you are logging onto is protected by an authentication firewall. May I know if anyone encounter this issue before and what could be the possibility that causing this issue?   

At my job, I have "inherented" Fortianalyzer VM running 7.0 with 5GB/day perpetual license. The support contract ended on 2020 and I would like to request three years forticare support license inorder to update it and have support because tbh, I am not familiar with FAZ.My question is that will the license start from the day that the license was purchased or will the license start from the day that the old one ended.

Hi Im looking to do the following, I have 3 wan interfaces (wan1, wan2 and wan3), im looking to make an arrangement of sdwan so some of the users (UsersA) primary output is wan1 with wan2 acting as the fail over, and the rest of the users (UsersB) use wan3 as their primary output with again wan2 acting as a fail over. The issue im coming across is how do i prevent from Users A from using wan3 as their output, I've set up the users A rule for wan1 and wan2 but when both of these are inactive their output then becomes wan3. Same case for usersB, if wan2 and wan3 are inactive their output becomes wan1. UsersA should never use wan3 and UsersB should never use Wan1 How do I prevent this?, the rules only have their respective wans selected but if none of their wans are available it uses another wan not in its rule.

i setup 2 IPsec tunnel with counterpart at AWS. the tunnel is working fine but there are 2 separate links showing that the tunnel is down.how do i remove the unwanted tunnel.phase2 selector route is down.or shall i do i reset to bring up the tunnel.

Hello,I have app control to block video/audio to blocking access to youtube.When i check in the log i found the firewall sometime block access to youtube and sometime is allowing. Anyone know what should i do? 

I have a 100F and the WAN Interface only shows speed settings for auto. No 1000Full, 100Full, ect... Fortigate is on 7.2.8. If I go to a lan port I have more options. My ISP has set their interface to 100Full, but on the fortigate get hardware nic wan2 it's showing half duplex 100. I am not able to force to 100Full. Are 100F's not able to set port speed other than auto?   

Hi community! I have the following network:I have control over FortiGate 1 and 2 but the routers (Cisco) belong to my customer.I have a BGP peering between FG1 and R1 and between FG2 and R2. There is no BGP peering between FG1/2 and the remote sites routers.The customer does have a BGP peering between R1/2 and all remote sites.I'm looking for a way to advertise a default route from each fortigate but have control over what route the remote site will prefer.For example, i want Remote1 to prefer FG1 over FG2 but keep Remote2 and Remote3 to prefer FG2.Since i don't have a peering connection with the remote site i don't believe i can do it directly from FG1/FG2 (?)I found this article explaining how to pre-pend a default route but this would just allow me to do an active passive for all remote sites.I can ask the customer to take actions based on community tags i send to R1/R2 but i cannot set a BGP peering between the FG and the remote sites (There are actually many remote sites and

My goal is to implement FSSO for the purpose of creating firewall policies based on group membership. The caveat is that there is no LDAP server to provide group membership. We have a custom VPN application that is successfully sending username-to-IP info to Fortigates using API method here (https://fndn.fortinet.net/index.php?/fortiapi/1-fortios/3828/1/user/). However, this makes policies cumbersome because they can only be populated by source users and not groups.  Any ideas ? Could Fortiauthenticator solve this problem in some manner ?Don