Support Forum

Hi,Please can it be clarified why the Fortigate firewalls have MFA functionality using email without subscription(free) as opposed to Fortianalyser that only offers the Token subscription based option for MFA(no free version) ?kind regardsGavin

Les cuento brevemente, estoy realizando un laboratorio en eve-ng, con el objetivo de replicar algunas pruebas para rendir sdwan.El problema como muestra la imagen no permite añadir un fortigate al manager. Mannager 7.0.12 F

Hi, I am currently working on this KB: FortiGate alt-primary, alt-secondary DNS ... - Fortinet CommunityIt mentions that Public DNS servers return a name resolution error 'NXDOMAIN' so that another server selection takes place between alt-primary and alt-secondary DNS servers. How do I know if the Public DNS server returns an NXDOMAIN error? Do we see it using debug?I am not able to successfully implement the KB for internal look ups, but for external look ups it is working as expected.Anything else which I can do to trouble shoot or look into? Thank you!

Hello, I have Fortigate 200F with firmware 7.4.1 We have FortiAPs at 2 different locaitons that are using same ssid an profile. I would like to create 2 different ssid profile so i can create seperate DHCP address range. Thanks,

Hi everyone,I have the topology below, WAN-1 & WAN-2 are in the same Zone (Internet) with a fail-over scenario between WAN-1 (Primary) and WAN-2 (Backup), what I want to achieve is to create 2 IP Pools as follows to use as a NAT in the outbound policy:1. IP Pool For WAN1: Mail-Server-WAN1: 195.1.1.10 --> 192.168.100.1002. IP Pool For WAN2: Mail-Server-WAN1: 88.31.25.10 --> 192.168.100.100If I create an IPv4 Policy, Source: the mail server 192.168.100.100/32, Destination: 0.0.0.0/0 and put the 2 IP Pools as a Dynamic IP Pool this will work without problem in case of a fail-over will happen.If not, what is the right approach for such a scenario? Thank you so much in advance, much appreciated.

Hello,I am setting up a VPN tunnel between a Fortigate and a stormshield using a VTI to mount IPSEC (Phase 2).Below is my architecture The tunnel is well assembled and UP (phase1 + phase2)Phase-2 is mounted on the VTI (architecture constraint) . I want to communicate between my 2 remote LANsI configure a sercurity-policy to manage my trafic and configure static route that goes to reach the LANs behind each firewall. Traffic can't pass. After debug, the packet always stops at phase-2 on the fortigate side.I would like to know how to make my VTI a network gateway to be able to route my current LAN and my future LANs.Or I want some feedback of someone who build VPN with Fortigate and stormshield using VTI as gatewaySincerely

I am following this KB article: http://kb.fortinet.com/kb/microsites/microsite.do?cmd=displayKC&externalId=FD32359 trying to use LDAP to authenticate users logging into the SSL Portal based on their group membership in AD. I have two AD user groups and depending on which group the user belongs to they will get one of either two portal pages. I tested logging in as any user of either AD group but I get a permission denied error with an alert message in the event log: " SSL user failed to logged in" Reason: no_matching_policy" My Fortigate - 200B/v4MR2 Patch 7 LDAP config config user ldap edit " LDAPServer" set server " 10.50.1.2" set cnid " sAMAccountName" set dn " dc=domain,dc=local" set type regular set username " CN=LDAP Agent,OU=Agents,DC=XYZ,DC=local" set password ENC next end The two VPN Groups to authenticate config user group edit " GeneralVPN" set sslvpn-portal " Default

See pic, when starting Forticlient it has a default selection of the "Ricardo America" VPN server. I need however always to use the "Ricardo EMEA" VPN server. Is there a way (can also be a startup with a shortlink that uses specific "switches" for this) that I can always start the FortiClient with the "Ricardo EMEA" VPN server preselected? Thanks, Johan  

We have an IPSec tunnel between two FortiGate devices - FG500E and FG40F, both running version 7.0.14.The IPSec is established without any problems, but the traffic inside the tunnel has some very strange issue. The tunnel IP addresses are 10.0.66.16/32 and 10.0.66.17/32.The FG500E device sends the packets inside the tunnel, but when it receives the response, for example ping requests, it sees the traffic as received from the VLAN interface on which is built the tunnel, thus discarding the traffic. As a result the two tunnel interface ends cannot ping each other and the communication is not possible, as we use iBGP for routing. Has anyone experienced some similar issue and how to fix this?

Hi,I deployed forti in aws.the forti deployed in az 1a.I have 2 subnets, 1a and 1b.I attached to forti 2 eni1 eni for the wan traffic.1 eni in 1a az.in the subnets route table, I route 0.0.0.0/0 traffic to eni that is attached to forti.I attached the relevant security groups for the eni and for the ec2 machines. I facing with problem that subnet 1b don't have outbout connection and I cant connect directly to the ec2 machines in subnet 1b, I can connect only from the 1a ec2 machines. What I configured not correctly?Thanks Daniel

Hi,Our users keep having problems logging in with Forticlient VPN only.It happens very often that Forticlient stops at 48% and issues the warning -7200. Sometimes you have to repeat the login process 3-7 times and then the client asks for the Fortitoken and can then log in successfully. FortiOS v6.4.15We are using LDAP authentication with Fortitoken. It doesn't matter whether I set username-sensitivity to disable or leave it at default enable. Does anyone know the problem and can help? [326:root:d3a]allocSSLConn:298 sconn 0x7f268edacd00 (0:root)[326:root:d3a]SSL state:before SSL initialization (77.239.xy.xyx)[326:root:d3a]SSL state:before SSL initialization:DH lib(77.239.xy.xyx)[326:root:d3a]SSL_accept failed, 5:(null)[326:root:d3a]Destroy sconn 0x7f268edacd00, connSize=1. (root)[327:root:d3c]allocSSLConn:298 sconn 0x7f268edac800 (0:root)[327:root:d3c]SSL state:before SSL initialization (77.239.xy.xyx)[327:root:d3c]SSL state:before SSL initialization (77.2

Ohio .o/ We have a fleet of ~100 users whom access our services over an SSL VPN. All runs smoothly 98% of the time ( ...  ). Occasionally, we have users unable to connect. Always at the most opportune times (i.e. when they're on the other side of the country). More often than not, the reason a user cannot connect is due to their neglect - ensuring certificates and access is up-to-date/approved/etc ... Alas, there has been quite a few re-occurrences of the "Fortinet SSL VPN Virtual Ethernet Adapter", under 'Device Managers -> Network Adapaters', disabling itself. Users get to 98% and it drops. To fix, it's a simple re-enable the adapter and everything works once again. But I'm unsure why it's happening in the first place. The savviness of majority of our users - proves that even 5 clicks to fix is difficult     I've attempted to attach a screenshot of the disabled adapter in Device Manger - hopefully it comes through. We're running Fo

  I have a fortigate 60F and sometimes i have block dns connection. The connection is blocked by aplication control wich detects a network service and blocks it,but in aplication control network services are allowed.  As i was saying somentimes in logs a get a block message somentimes i get an allow message.I also made in dns a whitecard for that dns.     

Hello friends, a question:Through fortigate or fortianalyzer, is it possible to view the "remote gateway" of user connections through the SSL VPN?

Is this a known bug for 7.4.4 ? Currently using Dynamic GatewayInterface "A" enabled - distance "5" Priority "5"Interface "B" enabled - distance "5" Priority "1" This is the only result Im getting:# get router info routing-table deCodes: K - kernel, C - connected, S - static, R - RIP, B - BGPO - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter areaV - BGP VPNv4* - candidate defaultAppreciate any suggestions or troubleshooting guide. TIA :) 

We are trying to setup a PBR to send specific traffic from 1 host to another host over a IPSEC VPN instead of a metro-E link but are having a return traffic issue. We have fortigates at both ends of the tunnel and tried setting PBR in both. For the gateway, we are using the remote VPN IP and also have tried adding a static route at the same administrative number with a lower metric (lower priority). Kind of stuck as to if we are missing anything else needed for PBR to work and return traffic.

Dear,I have installed FortiNDR in my VMware ESXi 6.5 environment. The installation consists of two platforms: FortiNDR-Center and FortiNDR-Sensor. Below are the details of the installation files and the configurations:Installation Files:Center: FNDR_VMC-CENTER.v7.4-build0534-FORTINET.out.ovfSensor: FNDR_VM-SENSOR.v7.4-build0534-FORTINET.out.ovfVMware Resource Allocation:FortiNDR-CenterName: FortiNDR-VMCIP: 10.0.1.150/24Route: 10.0.1.1RAM: 32GCPU: 8FortiNDR-SensorName: FortiNDR-VMCIP: 10.0.1.151/24Route: 10.0.1.1RAM: 8GCPU: 4Everything appears to be functioning correctly; however, I am unable to register the FortiNDR-Sensor with the FortiNDR-Center. I have followed the installation and registration steps as outlined in the documentation, but the sensor fails to register.Could you please assist in resolving this issue? Any guidance on additional steps or configuration checks that I might have missed would be greatly appreciated.Thank you for your support.

In the NSE-7 7.2 EFW study guide it says this: Although IPS uses flow-based techniques to identify threats but you can apply profile in both flow-based andproxy-based firewall inspection. So does attaching an profile turn the rule into a Flow based rule? How can the firewall do both at the same time? In one case the packets are allowed to pass (Flow) and in the other they are help (Proxy). I am just trying to understanding exactly how IPS works with a proxy rule. Thanks.

HiI am working with Forti LAN cloud and I have AP registered to Cloud I wan to do some radios setting on that AP using RESR API call but I unable to find any REST API that does that. So I want to test different radios setting like for 2.4GHZand 5GHZ I want to set different channels widths and different channels, different Phy modes,I am unable to find any API call from documentation that does that, so I need help with thatRest APIthis is my AP on FortiLan CLOUD

Hello,I have a test lab set up which will be going into production.  I have only 1 ISP circuit and that connects into each fortigate wan1 interface.  I created an IPSec tunnel between both fortigate 61f over the Internet.  In the future I plan to add 2 more vpn tunnels onto this single wan1 interface.  Today, I put the vpn tunnel interface as a single member of a single sd-wan zone.  I did not apply any sd-wan rules nor SLAs to this sd-wan on either  fortigates.  The vpn tunnel and sdwan are up.I have one laptop set up behind each fortigate.  The local and remote LAN laptops can communicate with each other from their respective encryption domains.  However, neither laptop can access the Internet.  Firewall policies are set up for the VPN traffic.  I also set up the firewall policy default route to go to the Internet, with the next hop gateway pointing the SDWAN, also tried pointing to wan1 interface, and neither rule worked from la

Hello Kindly i have a question which is I configured a VPN ipsec Custom between 2 site ,Dial UP but i discoved that i have to create Static Route on both FortiGate devices to reach them from each site so i have a concern why i need to create Static Route Why there is no reachability without static route although on the VPN setting there is a creation for Local Subnet and Remote subnetSo kindly advice

Every couple minutes I query a few endpoints to gather a list of ipv4 public addresses for all of our remote work employees. These employees often travel and have ISPs that issue dynamic addresses, so this list will be dynamic. I'm hesitant in creating a address group because this could be several thousand addresses. Not only that, address groups touch the firewall ssd/hdd drive so I worry that modifying addresses groups once a minute could be a heavy task on the firewall. I'm wanting to use the External Connector Threat IP Feed as a whitelist on our SSLVPN portal. In the event that the .txt file can't be retrieved, this would need to fail open (allow all). I've tried forcing it to fail (changing the endpoint so it'll time out), but the log doesn't indicate it failed, thus I'm not able to use the Automation feature. Any ideas on this?FortiGate 

Dear All,              I have an HA cluster working in active passive mode. Both fortigate firewalls are connected to one core switch. I just received another core switch and would like to implement VRRP on both core switches and still work in Forti Active passive HA. What are the options I have in this topology.For example:if I connect FW 1 to Core 1 and FW 2 to Core 2 and core 1 and 2 are connected.how will the traffic pass if FW 1 is active and core 1 is down?  Thanks,Sincerely,Hossam El-Din Roshdy

Hello Support,  I have purchased a used Fortigate 60E, I want to register it but i don't have any service contract. How can i get this any help ?

Can this be done, public Signed SSL certificate for SSL deep inspection on foritgate . Is this possible so that there is no import needed on client devices.