Support Forum

Hello Expert, I have a FortiGate 400e that is been configured for remote access.I have two telco (GTT AND DIGICEL) and was assigned three public ip address from each.To seamlessly failover from one telco to the other telco during line disruption I  am using “SDWAN”.On the client workstation  I configured the client to use an ip address from GTT (telco) to access the network via remote access.  If the GTT link goes down and DIGICEL becomes the primary link how can I  still remote into network using GTT ip address ?Unsure what is my next steps                                                                       &n

Hi FG adminsI thought at one point that it can be a good substitute to FSSO. I didn't try it yet but if I'm not misunderstanding the Kerberos authentication doesn't work in flow based mode. Can anyone explain why?

Helloi want to use a script to deploy the offline version of FortiClientVPN (the one without support).If the /quiet flag seems to work, when i try to deploy, the software install, good, but then reboot my computer, bad. do you know i a flag exist to deploy le exe without the reboot at the end ? Like /noreboot ou /reboot:0 ?Thank in advanceMikael

fgt

Are my FortiAP231-F UTM models or not?

Hello Days ago I received a notification of 2FA enforcing for forticloud accounts. Following the suggestions in this link, it says that starting today the 2FA option by email is enabled for all users.I enter forticloud but the only option enabled is still fortitoken. The truth is I'm confused as to how to continue, because I need 2FA to be by email because other users find it more practical.From already thank you very much Greetings from Argentina PS: sorry for my poor English language.

We have deployed Forticlient EMS to all Windows/MacOS/Linux machines and only Linux Forticlient are generating warning message flooding the system log. OS : Ubuntu 22.04.4 and 22.04.3FortiClient: 7.2.4.0809FortiEMS version: 7.2.4.0983Forticlient is connected to EMS.Installation of following the steps described in the documentation below.https://docs.fortinet.com/document/forticlient/7.2.4/linux-release-notes/213138/install-forticlient-linux-from-repo-fortinet-comWarning message below is generated every 20~30 seconds and flooding the Linux machine system log.fctsched[895528]: certutil: could not find certificate named "FortiClient ZTNA": SEC_ERROR_INVALID_ARGS: security library: invalid arguments.fctsched[895530]: certutil: could not find certificate named "FortiClient ZTNA": SEC_ERROR_INVALID_ARGS: security library: invalid arguments.fctsched[895531]: certutil: could not find certificate named "FortiClient ZTNA": SEC_ERROR_INVALID_ARGS: security library: invalid arguments.fct

Dears,I am deploying PA on a windows domain machine.The connection to FortiNAC is successful, I can run scans and send messages.But the agent is not returning the logged in domain user to FortiNAC. The user field is empty in the host view.

I did the following: - upgraded FMG to 7.0.11 while the FGT still were on 7.0.13 => everything still worked fine afterwards- upgraded the FGT to 7.0.14 during the next night (scheduled) => since then FGT keep losing the connection to FMG when I deploy policy package or device config. Results in the deployment timing out after some time. During a TAC session it helped to reboot FMG (and perform fsck on it with that) and then retrieving config of FGT and then deploy it. After this deploying of policy package worked fine until now.Now just deployed the device config only on a FGT and it got disconnected from FMG again... However they come back after some time...

hi guysI have a FortiGate device that shows a message  on console  after turning it on. Does anyone know why? <_>: FG1500D SMC (v1.0.4)<_>: Build Number: 71<_>: Build Date: 18:51-10.06.2015<_>: Pigeon Point Systems (c) Copyright 2004-2009.<_>: Reset type: hard, reset cause: power failure<_>: Operating mode: standalone<_>: RTC M41T81S time: 2024/6/9 16:20:41<_>: LAN iface 0: MAC shared, IP = 192.168.0.1<_>: Disabling chassis sensors.<_>: Hardware address: 0x10<_>: NC-SI channel 1: NC-SI version 1.0.0, f/w name: NCSI01.00.22, f/w version: F1.F0.22.00<_>: Chassis: Power Activating<_>: PSU 1 Mfr. ID: DELTA Model: DPS-450AB-8 C<_>: PMBus AC Power Supply in Slot 1<_>: PSU 2 Mfr. ID: DELTA Model: DPS-450AB-8 C<_>: PMBus AC Power Supply in Slot 2<L>: EEPROM write error, I2C bus: 03, I2C address: A6, data address: 4100<_>: Chassis: Main Power OK<_>: Enabling PS s

Hi, I've inherited a client that has a Fortigate 61E firewall and have to set up a VPN user. I've been trying to follow the below document but get a little lost by the time it gets to the IPv4 Policy.https://blog.vpntracker.com/how-to-configure-vpn-for-a-fortinet-fortigate-firewall/ The really weird thing is, they have one VPN user already setup who can successfully dial in to the LAN using Forticlient from his home computer.. I can find no trace of a VPN, a user or any settings related to a configuration that allows this user to VPN through it. Any help appreciated.

Hi Guys, I have 100D firewall the SSL VPN was working fine, But for Some reason I removed it and connected the other firewall 60D for few days, and kept 100D aside for few days without making any changes.  Now when I am trying to connect the 100D firewall the SSL VPN From Outside is Not working I am not able to Connect to the VPN with Forticlient it stops at 10% and I am getting Error " Unable to Establish the VPN Connection. The VPN server may be Unreachable"   however I am able to browse the web Access from internal Network and I am able to login. 1)I have reinstalled and installed the Forticlient.2) Not Made any Changes to VPN settings as I Said Earlier. 3)Note The Public IP is DHCP and it is changed.4) I also tried to connect with Remote gateway IP which the Public IP of the Firewall and hostname still same issue it doesn't connect and stops at 10% and gives error. Can anyone please help  

IPSec VPN on forticlient mobile app on IOS ?Hello I would like to ask you, when Fortinet is  planning to add IPSec VPN on forticlient mobile app on IOS ?Best regards

Hi,I have 2 Fortigate setup as below, and the issue as follows.FW1 cannot ping anything on FW2. network, but FW2 can ping FW1's 10.11.30 and 10.11.40 network.BGP is setup between the 2 and is working fine, with RouteMap and Prefix List, so traffic from 10.11.30.0 flows through port1 (192.168.9.181) and 10.11.40.0 through port2 (192.168.9.182), smae configuration is on FW2 for 10.21 network. FW1 Routing table for VRF=0 C 10.11.30.0/24 is directly connected, VLAN30 C 10.11.40.0/24 is directly connected, VLAN40 B 10.21.30.0/24 [20/0] via 192.168.9.182 (recursive is directly connected, port1), 00:18:07, [1/0] B 10.21.40.0/24 [20/0] via 192.168.10.182 (recursive is directly connected, port2), 00:17:40, [1/0] C 192.168.9.0/24 is directly connected, port1 C 192.168.10.0/24 is directly connected, port2  FW2 Routing table for VRF=0 B 10.11.30.0/24 [20/0] via 192.168.9.181 (recursive is directly connected, port1), 00:18:47, [1/0] B 10.11.40.0/24 [20/0] via 192.168.10.181

I want to connect a virtual machine on a host-system outside the internal network via SSL-VPN to the internal network. My configuration: Fortigate: FGT 80D (v. 5.2.3) The host of the virtual machine: Windows 10 Professional - machine connected to the internal network via Forticlient (v. 5.4.0.0780) SSL-VPN This connection is ok. I'am able to reach the internal network, ping the server,... The virtual machine: Windows 7 Enterprise running in Hyper-V Is it possible to connect the virtual machine to the internal network behind the Fortigate via the SSL-VPN-connection? Thank you for your advice and best regards

I need to integrate my Forti-EMS server with cisco ISE to retrieve users and device info is that possible?note : my AD integrated with cisco ISE but EMS can't integrate with AD due to security restriction on my environment  

Hi,I am struggeling with API requests to a Fortigate (Version 7.0.15). I used instructions from FNDN and got curl requests working as expected but the same request in python just throws a 401.The python code: url = 'https://fortigate/api/v2/cmdb/firewall/policy/?vdom=vdom‘ request_headers = {'Content-Type': 'application/json', 'Authorization': 'Bearer <apikey>‘ } response = requests.get(url, headers=request_headers) The same (working) request in curl: curl -s -H "Accept: application/json" -H "Authorization: Bearer <apikey>“ https://fortigate/api/v2/cmdb/firewall/policy/?vdom=vdom  Anyone has an idea what's wrong with the python request?

Good evening everyone,i am unable to correctly configure the integration of an fgt100e on active directory... in particular i am referring to DNS filtering.With my current configuration in the DNS filter logs i don't see the origin of the requests from the clients connected to the domain, i always see that all dns requests come from the domain controller.The domain is still old type like mycompany.local and we recently introduced 365 and added a mycompany.com upn, a detail not to be underestimated (iI think).the fortigate is gateway of the main network with the ip address 192.168.1.254, the main domain controller is 192.168.1.1. and the secondary 1.2, both Windows Server 2022.the connected PCs (w10/w11) use two DNS 1.1, 1.2. I've tried everything now, here's the first doubt.dns forwarders on domain controllers, do i have to enter the IP address of the fortigate?use root hints checked or not? (i think no).my goal, if it is easily manageable, would be to block the use of public DNS

Hello, everyone!I hope everyone is doing great. In our company, we have a Fortigate-100F and multiple FortiAP-231F. Many of our employees have old Android phones that do not support WPA2-Enterprise, so I had to share a password, which got out of hands, and many unauthorized users are now using the Wi-Fi. I have done my research, asked on Fortinet community, and asked a professional, and the results say for this can, I can either user mac address filtering or a RADIUS server, which requires hardware and software plus a more complex configuration. I don't want to add to the headache I already have. The professional mentioned dynamic mac address filtering (or something like that). I looked on the web, but could not find what this guy told me. He will charge me if he helps me, so I want to avoid that. He said something like, when a new user connects to the Wi-Fi, their address will show up somewhere, and I can add the user's name, so I know who each user is on the

Dear allafter upgrading the device 70f it restart and never open again only i can see the Fortinet logo light and power light nothing else even the firewall 70f i got it from RMA  also it had same problem after upgrade it wont boot or work so now i have 2 devices 70f same issue i tried to connect to console but seems not connecting .tried power off or reset nothing make the device work again . I want to know if this common issue before i send them to RMA.

Hi Everyone,I have the problem with configure SNMP. I use a pair fortigates model: 201F, version 7.2.7. I config HA mode Active-Passive. So I want to monitor 2 fortigates, I have enable snmp agent and config community snmp v2, config interface administrator access service: snmp, ping, https. Test ping from NMS to Fortigate is successful but when NMS send SNMP get but not receive response packet from Fortigate. Can you help me ? Thanks a lot.local traffic

After we Enable password expiry and define "Maximum password age", is there a way we can obtain local user password expiration time information? Tks

Current Configuration: We have Radius Server configured in our Active Directory machine, which is also used in FortiGate as Radius Server, where users are authenticated in FortiClient.  In Cisco Duo, All computers are configured to use MFA for windows login via Active directory sync. Issue: I want to integrate MFA in SSL VPN, while user's login in FortiClient. I'm using Radius client as my primary authenticator.  While validating the config in Duo Proxy, I have this message: warn: We cannot confirm that the Auth Proxy was able to establish a RADIUS connection to 10.10.10.6:1812. In the case of an actual failure this may be due to a misconfigured secret or network issues. This may also happen if the upstream RADIUS Server does not support the Status-Server message error: Connectivity validation was not successful   

Hi,we are using a Fortigate 60F with a FEX101 Extender. We have the problem that the IPSec tunnel over the extender constantly disconnects and reconnects. We are experiencing this issue at two different locations. Does anyone know what might be causing this?Thanks for Help!Marvin

hello I need the forticlient vpn version 7 msi installer to deploy via GPO in my domain, do you know where I can find it?