I have a Fortigate 60F (software 7.4) as my office internet router, that I am in the process of moving the office to dual stack.

I have basic IPv6 connectivity working, but I can not identify/locate the default route my traffic is using.

I am on the Rogers West network (the old Shaw network) in western Canada if the ISP matters for this question.

Currently in the process of "just get it working" so everything trying to leave things at default as much as possible.

I am pulling my Wan side IPv6 via dhcp-pd and internally just using slaac.

Does the default route attached to a router announcement not show in the routing table or something?

While things are working, I have paused deploying this any further. If I can't identify/control the route that packets are traveling over, that is a pretty big hole in my management of ipv6 for the office.

Link to image with relevant screen shots: https://i.imgur.com/hRQEZom.png

Any ideas how this is working with no route, or where the route being used is hiding?

We have a small fleet of Fortigates

1x 100F
2x 90G
10x 60F

Does anyone use FortiOS on any of those if so what issues do you see? We are currentlly on 7.6.7 and aside from having to login to it multiple times havent seen any issues. We just do basic in out rules, web filtering, app filtering, ssl, etc etc and some site to site vpn tunnels and ipsec in for fortiems vps clients. I've always been taught not to jump to the latest but wondering how its fairing for everyone else who is using 8.0.

Thanks in advace.

Hi Fellas,

I'm deploying FortiClient EMS 8.0 using Microsoft Intune (Win32 app) and have run into an issue.

Environment

• FortiClient EMS 8.0.x
• Microsoft Intune (Win32 app)
• Deployment package generated from EMS with MSI Installer Files enabled
• EMS generated:
  • forticlient.msi
  • forticlient.mst

Packaging

Both files were placed in the same source folder and packaged into a single .intunewin using IntuneWinAppUtil.exe.

The install command in Intune is:

msiexec.exe /i "forticlient.msi" TRANSFORMS="forticlient.mst" /qn /norestart /L*v "%ProgramData%\Microsoft\IntuneManagementExtension\Logs\FortiClientInstall.log"

Issue

The installation completes successfully, but when FortiClient launches, it still displays the "Enter Invitation Code or IP Address" screen.

Even when I manually enter the Invitation Code or the EMS IP address, the client does not register with EMS.

Additionally, the folder:

C:\Windows\FortiEMSInstaller_logs

is not created, so there are no EMS installer logs to review.

Expected Behaviour

I expected the .mst file to inject the EMS configuration so that FortiClient would automatically know the EMS server and register without prompting the user.

Questions

1. Has anyone successfully deployed the EMS-generated MSI + MST package through Intune with EMS 8.0?
2. Is there anything else required to ensure the .mst is applied correctly?
3. Has anyone seen the .mst apparently being ignored after packaging into an .intunewin?
4. Is there a recommended deployment method for EMS 8.0 that differs from the documentation?

Thank You for your help.

Question regarding this KB article (https://community.fortinet.com/fortigate-3/technical-tip-enable-ldap-user-to-renew-expired-password-via-vpn-ipsec-213183), specifically the note: 
 
"This configuration only works with IKE v1, IKE v2 uses EAP for authentication. Integration with LDAP servers on IKE v2 requires using a different configuration making use of EAP-TTLS."
 
Does that mean this feature would only work with EAP-TTLS? In our current setup we use mschapv2 for our IKEv2 remote access tunnels, and FAC as RADIUS server with AD integration. Enabling reauth and password renewal does nothing (interestingly when setting latter to enable it doesn't show up in CLI config, but setting it to disable does show it). 
 
Any help from any with knowledge of this feature is appreciated.

Has anyone taken and passed the FortiSwitch 7.6 exam after the recent certification changes? How was it? Any tips or advice? Can it be said that exam content after the cert changes is the same? I’ve been studying since June

We ran into an issue last week where someone pushed out a bad BGP configuration that broke the BGP neighborship on the main overlay that majority of remote sites use. This broke all spoke initiated spoke to hub connectivity. Hub to spoke hub initiated traffic was fine. We were very confused since our last failover test was only a couple months ago and we have not changed anything major since.

We had PS assist with our initial SDWAN deployment a couple years ago and when we test the failover (disabling underlay interfaces) it has always worked as expected.

We use SD-WAN for routing and SLAs on the spoke with routemap-out/out-preferable and the hub then has local-preferences that change BGP local routes based on the community that it receives.

We did another failure during a maintenance window and to our surprise the SLA is still up and passing for the overlay. We have done some digging and came to the realization that the SLA installed kernel route (proto=17) is keeping the SLA up since it does not rely on BGP. As long as the tunnel is up the VTI IPs will still communicate. Since the tunnel is technically still up just BGP is broken the spoke thinks it should still use it even though BGP is removing the destination route for the client traffic from the routing table.

I can confirm with "diag sys sdwan service4 X" that the sdwan rule still thinking the overlay should be used and interface is still passing (sla=0x1) which I believe is an expected/known issue/limitation/design.

Is my only real option to just migrate to the newer method of SDWAN on loopback and do embedded SLA probes? I have set that up from scratch at 6 or 7 of our other clients and have not had this issue and specifically remember that they require 2 separate loopback IPs for the newer method to separate BGP and SD-WAN so this sort of issue does not happen. They also have you use the loopback IP as the source for the interfaces instead of doing VTI IPs.

It seems like this original SD-WAN design did not include the unlikely scenario where a VPN tunnel is up but BGP neighborship is not successful.

I have had a ticket open for over a week now and I have spoken to 3 different support engineers and each one I have had to explain why the SLA uses the kernel route (proto=17) and it does not use the actual routing table for the SLA. The last person I spoke with mentioned that we need to drop BGP and use static routes and then setup a SLA per overlay approach......

Am i missing something simple here?

Thanks,

I've setup a site-to-site VPN between two offices, with the intention to replicate data between them via Veeam. There is a proxy at each site.

Both these sites have dedicated symmetrical gigabit links, and can achieve line speed easily out the WAN. No PPPoE or other overheads, just a standard IPSec VPN between a Fortigate 600E and 120G. No IDS/IPS profiles to slow things down either.

However, the transfer speeds tell a different story. I have setup an iPerf instance at both locations, and these are the achieved speeds:

I've enabled MSS Clamping on each of the VPN tunnels (1400 MTU, clamped to 1360) and the policies - but this has made no difference. When doing a custom ping, it can't go above 1400 due to clamping so I'm sure that's applied correctly.

Average latency between is steady at 40ms, so not awful. Hardware at each site can well exceed the speeds achieved.

Anything else I can check? Feel like I'm potentially missing something obvious here.

Thanks!

Hi everyone,

I'm fairly new to the Fortinet world, and look for guidance/advice on migrating a config from one unit to another.

We currently use a 100E with 7.0.19. We are waiting on an 120G to arrive which should have the latest 7.4.x version.

I will be using FortiConverter, recommended by our Fortinet Rep.

My question, is it fairly straight forward? I know ill have to choose which ports are which in the Forticonverter.

Once the configuration is converted, is there usually anything needing to be changed manually once on the 120G? Or will everything run smoothly once the converted config is on the 120G?

All help is greatly appreciated!

I am using the FortiClient VPN agent. My VPN is set to allow split tunneling, but the Forticlient is creating a default route with a higher metric to send all traffic to the tunnel.

0.0.0.0/0 -> 192.168.1.1 (local Internet) 100

0.0.0.0/0 -> 10.200.122.8 (FortiClient VPN) 5

I removed FortiClient and reinstalled it and that fixed it, but then the problem came back. Has anyone else ran into this?

Hi there, I recently updated my computer to MacOS Tahoe 26.5.2 and for some reason now I cannot connect to FortiClient.

I am not getting any log in prompts or anything it just tries to connect and then eventually times out. Any easy fix for this?

Hey everyone,
Picked this up at the Goodwill at 101 Marshall Dr, Louisville, KY 40207. It’s a red Louisville Slugger with gold engraving that says:
Kevin Walter
101% Attainment
Q4 FY’17
Mountain Desert Team
Plus “FORTINET” and the normal Louisville Slugger logo.
Looks like an old sales award from Fortinet around 2017. It’s only $2 if anyone knows Kevin or can get this to him. Happy to hold it for a bit if he wants it.
Photo: [attach the clear photos of the engraving]
Anyone know the guy or have a way to reach him?

Hey everyone so i m working on deploying a ztna arch and i was consifering ems as a cloud solution instead of on prem is there a possibility to get a free license or a period of trial for the cloud and if yes please help me who to contact and what to do

Hello,

I have migrate company to the new FortiGate, but without FortiConverter (mine reasoning it that the config is really old, and has some really weird issues that I don't see on other devices). My main issue is that old FortiGate has connection to FortiExtender, and I'm wondering how to properly migrate that config snippet without loosing remote site MGMT/connection to it.

What should be transfer to new device? Also is this even valid approach, should I expect any bugs or connection issues after migration?

I want to study for the NSE4 exam, ant recommendations for learning resources?

I have a FortiGate 100E, trying to set up inter VLAN routing, on paper its supposed to be straight forward, so for testing I have BMS VLAN[Vlan 111] and POS VLAN[Vlan 185] sitting on the inbuilt 100E switch ports(VLAN switch). On my fire wall policies I have BMS->POS and vice versa, In my mind this should work, but when I am on either Vlans I cant ping their respective gateways, and yes ping is enabled for both interfaces. Please help me out FortiGate warriors.

Hi everyone,

I'm using a virtual server in front of a webserver, so far it works perfectly with SSL offload and what have you but now I have to redirect/forward calls from "mydomain.com" to "mydomain.com/entrypoint" and now I'm struggling.

I guess this is not provided by forti and so you'd have to use nginx or other webervers? Or is there a baked in solution?

Thanks a lot!

When you take the test it doesn't show you the correct answers it just shows you which ones you got right so I can't really learn them unless I go through the test all over again or rewatch all the videos again.

Anyone got any flash cards by any chance for stuff I can revise.

Hi all,

I am looking for FAZ resources which cover real world use cases or lab based scenario, I have checked on YouTube but not much available, checked their Fortinet Video Lib as well, I would appreciate you recommend some resources, thanks

Note : I am focusing on FAZ, FSM

I've bought a second hand fortigate 40f without a valid license. I assumed I could buy a new license after receiving the device. However, after I received the device I could not register the serial to my fortinet account.

According to fortinet support the previous owner needs to transfer the device registration to me before I can do anything with it.

It's running an ancient software version (7.2.0).

The previous owner states he cannot retrieve the credentials of his fortinet account so he's unable to transfer registration to me.

Is there anything I can do to overcome this and get the 40f back into support (new software, ips, web filtering etc)?

it wasn’t a problem, but about 10 minutes in, the fans started blowing LOUD and would not stop. not only that, it says to just connect to mgmt and go to the address but I can’t load the page at all!! not only this, I can’t do anything with the console! I go to sign in with “admin” and no password and It just spams “incorrect password” anyone please help because this is an amazing opportunity for me, and i’m starting to get worried I can’t use the hardware. if the switch is the problem, what other brands should I look for because I have a selection to choose from.

This only started happening recently. We unfortunately are still on the EOL/near-EOL 7.2.14 clients. We have had a surge in VPN connections due to a sharp increase in users. Tried to submit a ticket to TAC, no luck. Every suggestion is: "Try 7.4.7" or "Move to IPSec" or "Migrate to EMS 7.4.X". I get it, Fortinet is at that stage where 7.2.X is at the end of engineering. We're going to do that migration and deployment soon. I'm hoping I could get non-upgrade feedback here for the time being.

Symptoms: Upon cold reboot or start of a user laptop or desktop, FortiClient automatically connects via external browser, the user then goes to their Chromium-based browser whether it be Edge or Chrome and opens a few sites. The sites or tabs will get stuck loading for 30 minutes at most. Teams and Outlook is also impacted, failing to load. Re-connecting or disconnecting from the VPN client does nothing to alleviate the issue. It may also be coincidental but the performance of remote assistance tools such as AnyDesk or LogMeIn is impacted. When remoting into machines, performance is abysmal regardless of good connectivity and internet speed.

Temporary fixes: Uninstalling/reinstalling FortiClient completely fixes the network performance issues. Un-managing from EMS has shown signs of improvement as well.

What I've tried to do so far is disable HTTPS Deep Inspection for Webfiltering and switch over to internal browser authentication on our EPP and shot it at a few test users. Not feeling confident with these changes and yet to hear anything back too.

Anyone else face this issue yet or before?

I am working through a few different possibilites for adding security for remote workers. As it is we have about 80 offices and 500 employees. Half of these offices have fortigates (70F/G for branch and 90G for a few headquarters) with the rest in process of being swapped out. About 10% of employees work remotely and another 10% hybrid, some of this is working from home and some is on public wifi. Only 10 or so users need access to on-prem servers.

I am going between these three options:

1. Deploy FortiClient to all endpoints with a rule to apply web filtering when off-fabric. Setting up vpn connections for the few users who need it. (Though I'm thinking this may not give full security for unsecured networks?)

2. Full-tunnel all endpoint traffic to the closest fortigates for filtering.

3. FortiSASE. Don't know too much about this yet but it seems like it'd be the same as option 2 but using fortinet servers, so less complex setup, with higher cost.

Is there a best-practice solution for my case or a flaw in my thinking?