The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Recently active
have implemented ztna with onpremise fortiems 7.2.12 . and its working fine apart from few users who when they come to office, they are unable to access some resources till i disconnect their forticlient and connect back. there seems to be leftover configs of ztna which don't clear when they come to office. any suggestion to resolve this?. the pc are correctly tagged as onnet thus all ztna configs are supposed to clear. From the affected endusers forticlient, the ztna destination are cleared but still they cannot access resources till i disconnect them from ems. all pcs are windows 11 laptops nslookup of a resource resolves to a ztna temp IP > webservwe1.contoso.comServer: dc1.contoso.comAddress: 10.0.1.1Non-authoritative answer:Name: webservwe1.contoso.comAddress: 10.235.0.2after disconnecting fortclient from ems, the pc resolves to correct IP > webservwe1.contoso.comServer: dc1.contoso.comAddress: 10.0.1.1Name: webservwe1.contoso.comAddres
good night, i have a fortinet 100din which I have a vpn with fixed public ipmy production network is the following 192.168.0.XThis network is configured with another office that handles 172.18.1.xon my wired network 192.168.0.x I don't handle dhcp, all my machines handle it with fixed ip and they have access to the remote subnet 172.18.1.xI have configured a port in the fortinet for wifi, with the subnet of 192.168.100.XIt gives me access to the local network, but I can not access the VPN wirelessly, I do not know that I need to configure it. i drive an ap unifi pro
Morning guru's.I have a small customer with a Zxyel USG-200. We are replacing with Fortigate 101F.Transparency: I am not a FW guy - dabble I can do! Anyone moved or copied configs from a Zyxel device to Fortigate successfully? Looking for advice, best practices.Thanks in advanceTerry
Hello,I have posted before regarding our FortiExtenders not working but that didn't go anywhere so will try again (If this doesn't work they are going in the bin !!!).So we have a Fortigate pair (100F in HA) running 7.4.7 and 3 x FortiExtenders (311F) running 7.6.2.The FortiExtenders are "authorised" and in LAN Extension mode.The IPSEC tunnel is up.(according to VPN -IPSEC Tunnels on the Fortigate)I have security policies allowing the FEX's to our "trust" network as well as Central SNAT configured allowing the FEX's to out trust network.I have remote admin access to the FEX's.The FEX's are being "powered" from Port4 (no network just POE) - they are connecting over LTE.Any device connected to Port 1,2 or 3 on the FEX never gets a DHCP address and therefore cannot communicate with our "trust" network.So the FEXs are connected to the 100F but a device attached to the FEX cannot communicate with anything upstream as it is not getting a dhcp address.Would really appreciate some help f
Hello,We'd like to set up Windows ThinClients as multi-app kiosks with Assigned Access. (https://learn.microsoft.com/en-us/windows/configuration/assigned-access/configure-multi-app-kiosk?tabs=intune)We want to allow the use of FortiClient VPN and Remote Desktop. The FortiClient needs the Visual C++ runtimes installed to run, but a regular user without admin rights can't open the FortiClient within the kiosk mode. We get the error "Uncaught Exception in Main Process - Error: spawn UNKNOWN." We narrowed it down to the runtimes not being able to run with the FortiClient in that kiosk mode without admin rights. An admin account can open the FortiClient in kiosk mode with no issues. We tried setting the FortiClient to auto launch, but then we get the usual JavaScript Error because of the Visual C++ runtimes not being able to load. We allowed FortiClient to run like this in our XML for the Assigned Access:<App DesktopAppPath="C:\Program Files\Fortinet\FortiClient\FortiClient.exe"/>Is i
Okay so long story short. We have a WAN interface with multiple VLANs running to different ISP. I figured it would be simple to just convert the VLAN interface to SD-WAN but no.When labbing the change I found that if the interface type is physical I can not integrate the interface to SD-WAN and also I am not able to do it via the SD-WAN GUI by adding members and also not via CLI. The VLAN interface doesn’t show up.When the interface is set to type aggregate then I am able to change the VLAN interface to SD-WAN interface.Running 7.2.11 - is there something I am missing here? This feels so stupid.
Hello,We are preparing to upgrade our FortiGate firewall fleet. However, when checking the upgrade path on Fortinet’s website, we noticed that different upgrade paths are suggested for the same firewall model.When using the following tool: https://docs.fortinet.com/upgrade-tool/fortigate The suggested upgrade path is: 7.0.14 M (Current version)7.2.10 M7.4.8 M7.4.9 M (Target version) However, when using the upgrade path tool available at: https://support.fortinet.com/support/#/downloads/firmware The suggested upgrade path is:7.0.14 M (Current version)7.2.9 M7.4.7 M7.4.9 M (Target version)Could you please clarify which upgrade path should be followed and the reason for this discrepancy?
Hi all We configured a DialUp IPSec tunnel (udp) on Fortigate 7.4.9. The users are authenticated via RADIUS on a Fortiauthenticator and MFA (Fortitoken on same FAC). The user in question is my own - which works for SSL VPN on the same Fortigate and as login on the Fortigate itself as well - using the same FAC (just a different user group). When using (free) FortiClient 7.4.3 with my user can connect to the Fortigate, but doesn't get the Token-Challenge due to a EAP failure. The ike debug says it fails due to a EAP failure (see below), the correct username is being used/seen in the logs.The fnbam log says code 3, after two code 11 (see below).The FAC tells me that my user failed to login via EAP-GTC (see below).The timestamps are off as I had to pull data from different tests, the logs are current and valid. Unfortunately, there is not muc I can test - the password is in a password-tool and the same password is being successfuly used to login into FMG, FAZ, FAC
Hello,I would like to know just now what is the recommended version or mature version to FortiNAC. In our case, we have a pair 500F in HA mode (Version 7.4.0)Thanks in advance
Hello, I need your help.Briefly, I have the following problem. I have two WAN links, WAN1 and WAN2. Both of them are added as SD-WAN members. They do not have costs configured, but they do have priorities set: WAN1 has priority 1, and WAN2 has priority 3.Today, the following issue occurred: when WAN1 was unable to resolve various websites and DNS, the traffic did not switch to the required provider. The main problem is that the system must switch to the secondary provider when the primary provider is not working, and when the primary provider becomes healthy again, it should automatically switch back.How can this be configured?Please help me resolve this issue.FortiGate
Dear, May I know the default OpenSSH version of FortiNAC?My current FortiNAC version is 7.2.9.0166. May I know the OpenSSH version is following FortiNAC version?Since the auditor said we need to upgrade the OpenSSH version to higher. Thank you.#NAC #FortiNAC #SSH #OpenSSH
I currently have one Fortigate 60F, which is about 5 years old. In the future, I want to implement a HA cluster.Is it a good idea to go with the 60F again? Performance wise, it’s been fine so far, but I can’t find any information about when it will go EOS, and I’m worried about how well it will work with future version releases. At the same time, I don’t want to go for the G-series yet, as I’ve heard some negatives about that.Also, I like the new “Single FortiGuard license for FortiGate A-P HA cluster”-model, where you only need to purchase one license for the HA cluster. And as far as I understand, this is not supported for the G-series models yet.
I have created 1 Hub with 2 branch office ( No forti manager ) , HUB having 2 ISP with static IP , branch having 2 ISP with dialup. created tunnels and created aggrigate tunnel. but fail over not hapening. some time 1 tunnel will work. routing also not working. can anybody help for the best practice / document for the config
Hi everyoneI’ll be taking over a firewall at work soon, even though I haven’t worked with one hands-on before. Right now, I have read-only access to get familiar with the system before officially starting.My course starts next week, and I’m planning to go for NSE5 after that, so I want to make sure I’m on the right track from the beginning. How was your experience with the course and the exam? What should I focus on?Any advice from real experience would be really appreciated!
I would like to better understand the FortiNDR logs and all of their metadata because I’m planning to integrate the logs into a SIEM.I’ve reviewed the official Fortinet documentation, but it only includes a few samples. I’m looking for a more comprehensive guide that explains every log field, all possible metadata attributes, all log types, and attack/malware/AV event examples : basically all types of logs that could be sent to a SIEM, along with detailed explanations of each field and what it means.If there is any reference, whitepaper, or guide that thoroughly explains the FortiNDR log structure and samples (including detection logs, malware logs, AV logs, etc.) in detail, it would really help me understand each type and how to parse them properly.Thank you in advance !!!
Hi, I set up a szenario as decribed here:HA-mode FortiGate units managing a stack of several FortiSwitch units | FortiSwitch 7.6.4 | Fortinet Document Library - i have two FortiGates in Active/Passive Mode- 5 FS-124G-FPOE switches in a ring config- Active Fortigate connects X1 to switch 1 und X2 to switch 5- Passive Fortigate connect X1 to Switch 1 and X2 to switch 5- X1 and X2 defined as Fortlink Split interface It's all working fine if on both firewalls X1 is active. However, after a reboot or HA failover, I sometimes encounter the following situation:- Active Fortigate - X1 is active on the Fortlink- passiv Fortigate - X2 is active on the Fortilink In this situation several clients are not reachable until I manual unplugg passive fortigate X2 so that it switches to X1 Fortigates are an 7.4.9 and FortiSwitch 7.6.6
Hello team,What is the benefit of the active probing feature while Fortigae can just wait for the server certificate in response to the original client hello.What is the need of actively probe the certificate in a new connection originating from Fortigate? https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-FortiGate-does-TLS-Active-Probe/ta-p/393239
Post Content:Hello Fortinet Team,I am using FortiNAC posture assessment to check for Sophos Endpoint on client devices.Expected behavior:If Sophos is installed → posture scan should pass and device should be allowed on the network.Actual behavior:Even though Sophos Endpoint is installed and running on the client, the posture scan fails when using the dissolvable agent. FortiNAC reports Sophos as not detected.Environment details:FortiNAC version: [your version]Endpoint OS: Windows [10/11]Sophos product: [Sophos Endpoint / Intercept X / Central]Posture method: Dissolvable AgentTroubleshooting done:Verified Sophos service is runningConfirmed Sophos is visible in Programs & FeaturesPosture policy configured for Sophos AVIssue persists on multiple devicesQuestions:Is the dissolvable agent fully supported for detecting Sophos Endpoint?Are there known limitations with Sophos Tamper Protection?Is persistent agent required for reliable Sophos detection?Are custom registry checks recommended
I am experiencing an issue while trying to add a FortiGate (v7.0.12) to FortiManager (v7.4.8) in an EVE-NG lab environment using trial VMs.The FortiGate fails during the registration/enrollment process with FortiManager (certificate authentication / connection issue).Thank you for your support.
Does anyone know if the Maximize Bandwidth SLA option is supported in the SD-WAN rules when connecting across tunnels to Zscaler Internet Access (ZIA) Cloud on-ramp? The documentation I've found recommends using Link-Cost for failover between a primary vpn tunnel across ISP1 and a secondary vpn across ISP2. Each to a separate Zscaler Public Edge. I'm trying to build 4 tunnels, 2 from each ISP to each Public Edge, and load balance across all 4. Has anyone attempted this?
Hi allIm trying to find a way to get connection count to a real machine within the loadbalancer pool.My platform is FortiADC v8.0.1The closest method listed in the guides is /slb/all_vs_status_last_2but this gives 404 page not found Any suggestions?
I am installing Standalone Fortiswitch FS-648F using MCLAG-ICL topology, critical issues were observed with VRRP and inter-VLAN routing functionality.FS-SW-1 & FS-SW-2 connected through Port 55 & 56 as MCLAG-ICL link and all vlans allowed. L2 Vlans are 10,20,30,40,50STP enabled and priority assigned as default. L3 vlan created and assigned IP's with VRIP FS-SW-1 is Master & FS-SW-2 Backup vrrp statefrom FS-SW-1 Cli I am able to ping vrip for example 172.16.10.1 . (vlan 10)When I ping from FS-SW-2 cli, i unable to ping vrip 172.16.10.1 (vlan10)In sw-2 mclag-icl diag command output , it shows dormant role is SW-2. 2nd switch is not responding for vrip 172.16.10.1 arp in MCLAG-ICLAny solution for the issue ?Is there any limitations with Fortiswitch VRRP with MCLAG-ICL ?
Hello FortiCommunity, We currently are using FortiClient with an EMS server and noticed when we connect to the VPN we received our specified internal DNS on both our physical adapter (wifi/lan) and our vpn adapter. Our specified internal DNS are our domain controllers that run DNS services. The issue we are having with this is that sometimes the FortiClient software disconnects or something in windows causes the application to crash. My assumption is when you hit the disconnect button on the FortiClient it removes routes and/or the static DNS entry. With that process not taking place the end result is that the static DNS that was not cleared, thus leaving the PC unable to connect to the internet. Our users working from home do not get admin access to their network adapters as well. The combination leaves the end user unable to connect to the internet and our remote tool useless. Do you guys know why the static DNS is set- can we set this to obtain automatically? I d
Hi, I've a problem of loss of the liceense in my FortiAnalyzer. I've set a proxy and it's used to login the the cloud account. The FortiAnalyzer reboots and everything seems to be OK. But a few minutes / hours later, I get this alert message:License validation state changes from Trial License Init to Found disconnecting because of Server No ResponseI checked the proxy log and there is no entry of any kind of access. If I check the firewall logs, I can see that the FortiAnalyzer tries to communicate directly with some servers in the internet - I guess some license servers!? Afterwards I get a "duplicate license" error (but there is only one license in my account) and instead of the analyzer login a could login dialog is shown. I can login with my cloud account, the analyzer reboots, everyhting seems to be fine... for at least some hours. So, has anyone an idea, why the proxy isn't used to contact the license servers for validation? Regards,Dennis
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
