Support Forum

Hey Guys,I am new to FortiGate and Aroba. I wanted to implement a network segmentation on our network this side but i am seeing problems, I created vlans both on the aroba switch and the FortiGate and trunked the port from the switch to the firewall. I even gave on policies for every vlan to show what directions each vlan should take, but there's no communication between the vlans or the vlans to the internet (for the ones having outgoing interface as wan) End devices are able to acquire addresses as per the addressing table. I even did a trace route on the device which was connected to the CORP and Pent vlans and all of them end at their gateways (the ones specified on the firewalls). I carried on doing a debug on the cli on FortiGate to see if at all packets arrive to their designated policies (by doing pin 8.8.8.8 on CORP since it has The Internet policy enabled) nothing popped up from the cliThings verifiedDHCP of the corresponding vlan issues the correct address as par the ad

One User is currently experiencing:1. All sent emails are deleted2. Received emails are double in inbox How to fix? Please help

The status does not move from here after Windows update.

Hello Fortinet community, We are facing a problem right now, trying to connect our FortiDeceptor physical appliance (v6.1.0) to FortiGuard web filtering Server through our proxy. Specifically: Failed to verify web filter server: Error happened when verifying FDN/WF server (154.52.24.78:443) certificate: 'NoneType' object has no attribute 'splitlines' As far as I understand, there seems to be a problem with SSL certificate. How could I proceed further? Thanks in advance.

A company is using SAML Credentials and Azure as IdP for wireless authentication. The configuration works fine for devices other than Apple. On Apple devices, users open up settings > Wi-Fi and then select the SSID. Upon doing so, a captive portal comes up where the user inputs their credentials. In order to proceed, the user needs to input their one-time password from the Authenticator app. Since the user is in the captive portal at this time, they need to back out of it & open up the Authenticator app to get the code. Once they get the code and re-open their settings, the process starts all over again. Please see the following video.Troubleshooting steps taken: exempt captive.apple.com to prevent the captive portal from opening up in settings so users have to open Safari in order to go through the authentication process. Although this resolves the initial issue of not being able to input their OTP, the users never get connected even after going through the entire process.

Hi guys, New to forum, want to check with the community senior of Fortinet whether FortiSASE is a real cloud solution that managed (Backend) by Fortinet or a cloud solution that require customer to managed? As we being request to call Fortinet when hit FSASE bug (1213936) everytime it occur and need to start the troubleshooting from scratch (Took around at least 45minutes everytime) to validate the issue even though we had told them we do hit the bug (1213936). Seems like become the one to maintain FSASE infra instead of Fortinet themselves. Do any of you encounter such experiences before, how would you suggest to speed up whole troubleshooting? Challenges: 1) FSASE not managed by us and require call in to Fortinet support for manually reboot/restart the service/instance2) The troubleshooting most of the time need start from scratch even being told it hit the known issue (1213936)3) The known issue (1213936) can be happen few times on same day (Updated by Fortinet s

We are going to be joining a lot of our devices to InTune. I wonder whether anyone has any hints on getting details of the logged in user from these devices to be used by the Fortigate.  Particularly in a 'shared device scenario' - we have cabinets full of laptops and iPads that are handed out to students. Cheers Jon

I'm a long time Palo Alto user and just transferred to a new organization and we utilize the FortiGate 401F. We utilize GeoBlocking for both incoming and outgoing however it is implemented using an Access Control List.  I've seen posts using a Firewall Policy to implement Geo Blocking. Obviously F/W policies give an in-depth look using security policies but would like to hear from the community what is a best practice for Geo Blocking, ACL or F/W policy?  Also is there an online document on recommended best practices for the FortiGate?Much thanks!

 Hello,  I am testing an IKEv2 IPsec dial-up VPN on a FortiGate 81F (FortiOS 7.6.6) and I would like to confirm if my use case is fully supported.SetupFortiGate 81F – FortiOS 7.6.6IPsec dial-up VPN (IKEv2)Authentication: LDAP (Active Directory)No RADIUS, no FortiAuthenticator, no EMSClient: FortiClient VPN Only (free)IssueThe tunnel establishes correctly (IKE + Child SA).The client receives an IP address and traffic is allowed.A few seconds later, the VPN is disconnected immediately.IKE debug shows repeated EAP challenges:  FNBAM_CHALLENGE until the client sends an IKE DELETE.ObservationsEAP-TTLS fails (expected, since no RADIUS/FAC is present).EAP-MSCHAPv2 seems required for LDAP auth, but on FortiOS 7.6.6 there is no option to force the EAP method on the FortiGate.The EAP method appears to be fully client-driven.QuestionIs IKEv2 IPsec with LDAP authentication (without RADIUS/FAC/EMS) officially supported with FortiClient VPN Only?If yes, is EAP-MSCHAPv2

Hello FNAC admins, I'm trying to add my fortigate to FNAC inventory, I'm getting this error. SNMP is configured on my Fortigate, I'm able to ping Fortigate from FNAC and vice versa. Any ideas ?   BR,

Hello, we use a split sslvpn tunnel to connect.I know there is a filter filter implemented in the Fortigate. We currently test the FortiClient EMS. Is there a function to block file types with the FortiClient?

I have the possibility of deploying approx 5 or 6 Meru AP832i Access points at my home as a slight upgrade to my current Wi-Fi setup. They are units that were deployed at the school I work at and were taken out a couple of years back and left in a cupboard doing nothing. I understand I will need some sort of controller software to run these as they won't work as a standalone set, which I can deploy in a Proxmox VM system.My question is: will I need or can I get a licence to run this system, given that the Ap's are now legacy and no longer supported. Or am I basically on a hiding to nothing here?

Hello FNAC admins, I'm trying to access the CLI console on my FortiNAC's GUI, but I can't find it... Is there a feature I have to enable to access the CLI ? BR,

Hi Everyone, I am deploying Fortisase and trying to deploy ZTNA Agent based & Agent less  We are currently experiencing an issue with Fortinet SASE ZTNA agentless access. Despite having completed the following configurations, the bookmark portal is not accessible unless the ZTNA agent is connected: Proxy has been enabled Proxy SSO is configured and active Application and corresponding application policy have been created Bookmark portal has been set up and published the bookmark portal link works as expected when the ZTNA agent is connected but fails to load or authenticate when accessed in agentless mode—despite all prerequisites appearing to be correctly configured. Can anyone please assist us in troubleshooting this issue? We would appreciate your guidance on whether potential bug affecting agentless access in our PORTAL  

I am trying to configure ISDB Policy on fortigate 7.4.11.. for Inbound it worked fine i mapped several internet service objects in Source field and the rule was created. However, when i am trying to configure an Outbound rule for these where malicious internet service objects are defined in destination , i am unable to create the rule and service field also vanishes as soon as i select internet service as objects .. is this feature only supported for inbound and not outbound >? 

I have a simple topology with three FortiGate devices connected in a line. The first device is connected to the middle device through an IPsec tunnel, and the middle device is directly connected to the third device. All three devices are running BGP in the same autonomous system (iBGP). All BGP sessions are established successfully, and the middle device learns routes from both edge devices. However, the edge devices do not learn routes from each other. The routing information reaches the middle device but is not propagated to the opposite side.What is the correct way to configure this setup

Dears , We have configured a SIP trunk on the Fortivoice. Everything is OK; the system is receiving and making calls over the SIP trunk. There is a problem in outbound calls where the system overrides the DID number with the SIP trunk main number. I have checked with SIP provider they informed me that there is nothing to do from their side and it's Fortivoice problem. Fortivoice Firmware version:6.4.8 and 7.0.1 Any help?  

Hello Experts I am Facing an issue with new FOrtigate WAN port DHCP IP not getting the device is unboxed need to register the product  the connection scenario the PC cable (already internet available )  connected to Wan port of Fortigate and one cable connect from lan port to PC ( Normaly nat will be enable ) my pc will get internet ( Policy already done Lan to Wan -all )static route note done because DHCP ip not getting to wan Port  

Hi,Has someone been able to configure and use ZTNA for the AD services ? The scenario i'm trying to make use of is a remote user that needs to join his computer which for whatever reason it got removed/deleted from it. I've created 2 ZTNA servers, 1 for TCP traffic and 1 for UDP traffic ( as per below ) , the domain name is resolvable locally in the internal 10.235.0.X IP and in the logs i can see enable_udp:1 flag for UDP services and also all the ZTNA destinations in FortiClient. The proxy-policy uses the security tag of all_registered_clients which is assigned to the computer in question and has destination all and ZTNA servers the ones below. relevant FGT config:config firewall vip edit "LAB-AD_UDP" set type access-proxy set server-type https set extip PUB-IP set h3-support enable set extintf "wan1" set extport 11101 set ssl-certificate "wild-demo.lab" next edit "LAB-AD_TCP" set type acc

 fortigate V7.4.11 Could not connect to the FortiManager V7.4.11.M to retrieve its serial numberfortigate V7.4.11 Could not connect to the FortiManager V7.4.11.M to retrieve its serial numberfortigate V7.4.11 Could not connect to the FortiManager V7.4.11.M to retrieve its serial numberfortigate V7.4.11 Could not connect to the FortiManager V7.4.11.M to retrieve its serial numberproblem

Hello, we have an application which uses a HTTP method in a way which is known to be a threat as of FortiGuard https://fortiguard.fortinet.com/encyclopedia/ips/12351 I´d like to workaround this an although still blocking threats with severity medium high critical, I´d like to allow that special "HTTP.Server.Authorization.Buffer.Overflow" method, which is know as IPS rule 12351. The rules severity is high and the default action is "block". I tried to override this.But the following rule does not work. Has anybody a suggestion why or what I could have done better? config ips sensoredit "protect-workararound"set block-malicious-url enableset scan-botnet-connections blockconfig entriesedit 1set rule 12351set status enableset log disableset action passendnextedit 2set severity medium high criticalnextendnextend best regardsMartin 

Hi, i have two FG600F with version 7.4.11 and we use two MCLAG Switch ITER1 2048F connected with 25G GBIC interfate of FORTIGATE in port 7 and 8. We change the speed port and configure in 600F the port 5 to 8 in 25Gb speed setting. If we use in the ITER1 switch 2048F a version 7.2.x the fortilink is green and job. Any new software installed on the 2048F (7.4.7,7.4.8 or 7.4.9) from the GUI of FORTIGATE is completed but the fortilink going down and the interface used on FORTIGATE (7 and 8 in AGGREGATE CONFIGURATION and SPLIT disabled) and in the switch are down (but is present the light of laser in the port) What is for you the problem?

Hello Everyone,I have a Fortios 7.6.4 Fortigate60F device. Even though I enabled the policy and IPsec NPU offloading settings for my IPsec connection, it shows npu_flag=00. Could this be related to the policy rules or the IPsec encryption algorithm?If you could help me,

I tried 23646 and 123123 neither works

Hi,After installing FortiClient (FortiClientVPNSetup_7.4.3.1790_ARM64), it worked great.After a week, I can no longer start FortiClient.I've already uninstalled it and tried FCRemover.exe.Nothing helped.What's the problem, what can I do?Regards, Martin