Support Forum

Is there a way to restrict LDAP authentication to FreeIPA based on ldap user group membership? Currently configured, as suggested in forum, with set cnid uidset dn "cn=accounts,dc=<suffix>,dc=<suffix> However this setup allows ANY ldap user to be successfully authenticated. I can't figure out a way to restrict it to only a specific ldap group in FreeIPA. Suspecting it has to do with one of setting either of the config option group-member-check, group-search-base and group-filter. Any help will be greatly appreciated!

Hello everyone, While reading this article "FortiSwitch FortiLink Integration" and to be more specific, the RADIUS/syslog/L2 MAC traps config, there is always a note saying to skip the step if you configured one of the three. I do understand that L2 MAC traps is the most recommended, but I wanna know why can't we use two together, is it to optimise performances ? Thanks in advance.BR,

Hi everyone. I'm a network engineering trainee. I previously worked with Fortigate devices for about a year, but I took a break. Now I'm starting a new project and will begin working on it. I'd like to hear about your experiences. Are there any YouTube channels or resources you can recommend? My goal is to refresh my knowledge and obtain the NSE4 certification within 3-6 months.

Hello everyone,  I'm trying to integrate FortiNAC with FortiMail. I managed to get it working after making some tweaks in FortiMail policilies, but I want to confirm something. In the Authentication section, which mailbox should be used? Should I create a dedicated mailbox in FortiMail for FortiNAC and use it for authentication there?  Thanks in advance.BR,

The customer stores .sqlaudit logs on the C:\ drive of a Windows machine where the Windows Agent is installed. Multiple log files are continuously updated, and once a file reaches its size threshold, a new .sqlaudit file is created.The customer wants to collect logs from all generated files, including their contents. They attempted to use Windows Agent Template → User Log, but the logs are not being fetched.Could someone please assist with this issue?

I ran into an issue here: I have a zone with several members.Now I need multicast forwarding for airprint between two members of that zone.intra-zone-traffic is blocked (per default) which is wanted that way.So any traffic has to be explicitely allowed by a policy. Now I cannot create a multicast policy for that because of the zone. In multicast policy only the zone is available  not its members. So even mlticast policies from interfaces that are not member of the zone can only have the zone as source or destination interface. I consider this a security risk. Does anyone have some tip how one can do intra-zone multicast forwarding then?I additionaly have openend a ticket with TAC on this too

I would like to independent IP addresses on my  "mgmt" interfaces in my cluster Active-Passive. Every time I configure an IP on one cluster "mgmt" interface, then the Passive unit inherits this IP addresses which is what I do not want. My aim is to have dedicated IP addresses for "mgmt" on each cluster and use port2 (mgmt) as the mgmt interfaces with the same IP address. How can I remove/unset a vdom from "mgmt" (unset vdom root)I have  been looking for dependencies to delete and have run out of ideas! Removed dedicated mgmt cmd, under config sys global removed unset mgmt-vdom which I don't think was going to help.Deleted config firewall address dependency as well. Thanks!

Hello All!On my FG 90 strange issue - after restart on some interfaces traffic partially dropped.For example - from my computer (VLAN 10) I am trying to ping server located in VLAN 22: C:\Windows\System32>ping 192.168.22.1Pinging 192.168.22.1 with 32 bytes of data:Reply from 192.168.22.1: bytes=32 time<1ms TTL=63Reply from 192.168.22.1: bytes=32 time=1ms TTL=63Request timed out.Request timed out.Ping statistics for 192.168.22.1:Packets: Sent = 4, Received = 2, Lost = 2 (50% loss),Approximate round trip times in milli-seconds:Minimum = 0ms, Maximum = 1ms, Average = 0ms In previous firmware one more restart was solve it. But after upgrade to 7.4.11 even after restart the issue stil exists on few interfaces. Here is an output of sniffer:diag sniffer packet any 'host 192.168.22.1 and host 192.168.10.51' 1 100interfaces=[any]filters=[host 192.168.22.1 and host 192.168.10.51]6.892452 192.168.10.51 -> 192.168.22.1: icmp: echo request6.892478 192.168.10.51 -> 192.168

In Load-balancer mode deployment, what happens if primary fac goes down? for an example , I have cluster(A-P) as a primary at HQ and load-balancer at two different geo location.what happens if my primary HQ is down? can load-balancer take over authentication function.if so which will be active.  

Hi What I mean is that I configured the lockout setting to lock the account after five failed attempts, but when my user enters the wrong password just once, FAC disables the account user, and it has to be manually enabled. FAC version 6.6.4 Thanks.   

Does anybody know the reason why it skipped 7.x.x and jumped from 6.6.x to 8.0.0?And, most importantly what is the major change with this new version in the software structure compared to any 6.6.xs? What's new section in the release notes doesn't indicate anything about it but just feature enhancements.Toshi 

I'm trying to design topology for a 2 FortiAuthenticator system (in geographically separate areas) with Active-Passive HA. Can multiple interfaces be configured for the heartbeat in case one pair of interfaces goes down (e.g. a cut cable)?Can an interface that is configured for authentication also be used for heartbeat? What happens if the heartbeat(s) go down but both FAC are still online? Will there be split brain? How is a split brain resolved?

Hi Fortinet teamIs it planed to add credential stuffing defense to FortiAuthenticator?I see it is already in FWB and FAD, but I think it should be definitely a natural feature in FortiAuthenticator.

Hello everyone,I'm experiencing an issue with MSCHAPv2 authentication on FortiAuthenticator (FAC) when using Windows AD domain authentication.My FAC is joined to Active Directory, shows as fully connected to the domain controllers, and I have a RADIUS policy configured with “Windows AD domain authentication” enabled.Problem DescriptionWhen domain-joined Windows PCs attempt 802.1X authentication, they automatically send the logged-in user’s credentials.However, FAC rejects these attempts with the following log message: "Windows AD user authentication from (null) (mschap) with no token failed: AD auth error: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)" interestingly, this issue does not occur on non-domain (workgroup) PCs.When a user manually enters the same domain username and password, authentication succeeds without any problem.I have also tested different username formats, including: realm\username and username

Is it possible to create an address object on a FGT using logs from a FAC via an event handler on a FAZ? We  setup several automation stitches on the FAZ and FGT to add address objects based on failed VPN attempts.  What I'm also looking to do, if possible, is create an object from a failed login attempt.  Basically, there are hosts out there throwing names and passwords at us.  Since the accounts don't exist any more and don't have an MFA token, they fail.  So, I setup an event handler on the FAZ to get the source IP when a user without a token tries to login.  However, it won't let me configure this as an automation stitch so I can use it on the FGT. And yes...I'm already in the process of moving away from SSL VPN to IPSEC, but need SSL for a while yet during the migration. 

Hello.My account was created upon request to FortiCloud technical support. I log into my account via email, go to the support[.]fortinet[.]com menu, and when I go to Support > Training > www[.]fortinet[.]com/training-certificationWhen I select NSE Certification Levels > Learn More > Get StartedI get an error " Sorry this user not authorised to access this portal... Code: FTIx0002". I found that this can be solved by creating another account. I created an account not from my corporate email, and everything works and goes through.Please advise how to solve the problem with corporate email. Thank you in advance!

Hello everyone,I want to set up Let's Encrypt and ACME for Fortigate, but I keep getting an error. What could be the reason?I'm getting the error “Unable to create ce

I have a Fortios 7.6.4 Fortigate 60F device, so I want to use NPU hardware in the IPsec configuration, which has 2 RAM limitations. I manage it with my Fortilink VLANs.I want to establish an IPsec connection. How can I establish an NPU-compatible IPsec connection? Are MTU and MSS values important? They are very important to me.Please help me with IPsec NPU offload.

Hello everyoneI have a DNS configuration plan and want to evaluate it separately for local and internet access.When the central DNS company.xxxxx performs a DNS query, I want my local users to use the DNS I specify when accessing the internet. I don't want them to go to company.xxxxx DNS when accessing the internet, and at the same timeWhen SD-WAN connects to the internet, I want it to route to whichever xxxxx - xxxxx DNS has the best jitter, packet loss, and ping values.Is there anyone who can help?

Hello, we have an account registered in forticloud using this email : pablot@colegioheidelberg.com and if we try to use , the website say "user is disabled", please enabled this account again. Thanks

I am not getting any audio on new 380B when making or receiving calls (new system).The volume is all the way up, I disable bluetooth for now still no ringing, and no audio when playing voicemail. Thanks

I am working with a FortiPAM product and attempting to apply a Windows application filter on a Windows secret. I created the filter, verified that WinRM is running, added an account as a privileged account, and applied the filter to another account. Despite these steps, the filter is still not functioning as expected. Could anyone provide a tip or solution to help me resolve this issue?

I'm trying to get our new mobile routers setup with our FortiGate 80F (7.4.11) but I'm having troubles figuring out if the connection setup needs to be site-to-site or dialup. The mobile routers are from Nextivity running OpenWRT and there is a custom page in the web Gui for setting up a VPN that looks like this: The Nextivity documentation only says that you need to choose IKE version and any of the three authentication methods. I pulled a backup of the router config and found the swanctl.conf file which is what the VPN client is using to attempt to connect to the FortiGate and it looks like this:  connections { myvpn { version = 2 remote_addrs = vips = 0.0.0.0 rekey_time = 0s dpd_delay = 30s dpd_timeout = 120s proposals = aes256-sha256-ecp384,aes256-sha384-modp2048,aes128-sha256-ecp256 local { auth = eap-mschapv2 id = eap_id = } remote { auth = pubkey id = } children { myvpn-child { local_ts = 0.0.0.0/0 remote_ts = 0.0.0.0/0 mode = tunnel start_action = start c

Hi All, I am unable to select Current Version and Target Upgrade Version in Upgrade Path Tool , Did anyone facing this issue..  tried with differnet browser and from diffrent PC .. But no luck#fortigate #upgrade path tool #FotiOS

 I have tried many times to activate the evaluation license but the screen shows the following error.I am able to ping google.com and all other domains. I am using eve ng for learning purpose and after logging in the firewall does not allow me to move forward without subscription. Your quick help is required.  Regards,Aneeq Ahmed