r/fortinet

I got 1 fake AP appeared in 2 different FortiGates, MS Coplilot thinks it was a port scan fro outside and asked if CapWap is not allowed on WAN-ports and it's not allowed, so I'm not sure, both Public IPs are in the US - Michigan and NY. (2 pics attached).

https://preview.redd.it/82j1qeoc4pth1.png?width=318&format=png&auto=webp&s=c07da8e60fa4ee6e543383e32943edb70334c13a

https://preview.redd.it/e4kdceoc4pth1.png?width=518&format=png&auto=webp&s=4c77283c9791f8b52ceefb023fa7eec40e6a4d12

• 1st FGT is 60F with 7.6.7 - this one got 1 fake AP exactly the same as the 1st
• 2nd FGT is 600E with 7.4.12 - this one got 2 fake APs

I have a Fortigate that recently upgraded from 7.2.13 to 7.4.12, according to Fortinet this is a valid upgrade path. After the upgrade SSLVPN which was working before no longer works. Forticlient gets to 45 percent and then disconnects. Connection from the Fortigate to the server works. Rolled back to 7.2.13 and SSLVPN works again. Any ideas?

Anyone else a FortiSASE customer? Wondering if there's another community or place to discuss (Discord/Slack) with other customers the product (configuration, issues, troubleshooting, best practices, etc).

We have our TAM but they aren't super strong in SASE. Sometimes it's nice to bounce things off other engineers who are using it in production.

How are people handling web filtering on FortiGate for completely unmanaged/BYOD devices?

Our filtering works fine, but blocked HTTPS sites result in a certificate warning because the client doesn’t trust the FortiGate CA. Fortinet TAC says this is expected. Disabling the HTTPS replacement message avoids the certificate warning, but then users just get a generic connection failure.

What I really want is a human-readable “This website has been blocked by your organisation” page without needing to install a CA certificate on the byod endpoint.

Has anyone achieved this with FortiGate/DNS Filter, or are you using another filtering solution for BYOD?

I was adding a test VLAN, and accidentally set the network address of the VLAN to the ip address of the switch. Yeah, major stupid. I knew better, but did it anyway.

Fortiswitch 148F, running 7.4.x

I've tried to console in via IP address and direct connection, but can't get PuTTY to connect. Is there anything else I need to try before I reset the switch?

I have multiple vlan (e.g.vlan 2, vlan 3)logical interfaces configured under an interface software switch. Let's call it T1.

So when I do firewall rule implementation, do I select the vlan or T1 for the incoming and outgoing interface? Physical interface or logical interface?

If I configure it wrongly what will happen?

Currently, I have a FortiGate configured with two ISPs, with WAN1 as the primary connection and WAN2 as the secondary connection.
For the LAN-to-Internet policy, I have a fixed IP pool NAT configured using the usable IP provided by WAN1. When I introduced an additional IP pool NAT on the LAN-to-Internet policies using the WAN2 Interface IP, users reported that they were unable to access the internet.
After reverting the change and removing the WAN2 IP pool, internet connectivity was immediately restored for the users.

My question would be:
- What is the recommended NAT design for a FortiGate with DUAL ISP connectivity when an existing IP pool nat is already in use?
- Are there known considerations or limitations when using fixed IP pool NAT address in a multi-WAN deployent?
- Are there any FortiGate best practices for maintaining internet connectivity while introducing NAT rules in a dual ISP environment?

We are thinking of doing slow migration testing moving from Meraki to FortiAPs by buildings. Can Meraki and FortiAPs coexist and share the same SSIDs and same security? Will devices be able to roam from one to the other?

I have an issue going on with Forticlient 7.4.X push upgrades. We are trying to push updates to our user machines. About 1 in 5 will hang on the actual installation part of the client upgrade. The green progress bar on the machine update console will just sit there hung and in EMS I can see a status of "InstallStarted" and it never changes to "Installing". One these machines the only fix seems to be to reboot them and do the installation again then it works on the second attempt. The other 4 out of 5 machines work as they should, they install on the first attempt and then reboot at the end and come back up with no issues. I've opened a ticket with Fortinet TAC and they as usual have been clueless and not helpful at all. They think I am talking about the reboot at the end of the installation and this is happening at the very beginning of the installation not allowing the install to actually start. Has anybody seen anything like this before? Thanks in advance.

I realise that I am able to configure multiple vlan on the interface belonging to a software switch. Is this an error? Will it lead to any future mishaps? Rightfully interface should be a vlan switch?