Fortinet Community

I need assistance updating my FortiWeb with. We do not have support for downloading the firmware.

FortiAP 431F Deployment without using FortiGate: i want to deploy fortiAP 431 Usibg forticloud (FortiEdge) without use of FortiGate . i was able to incoperate the AP into my network by giving it an IP. But the AP is not contacting forticloud. What could be the issue . I am missing something.I was able to enter ther AP in config mode. I need help deploying the AP and managing the AP online.  #FortiAP #FortiCloud 

Dear Fortinet Support Team,We kindly request your assistance in reviewing the current “Phishing” classification applied to our domain horecathanglong.com .This domain belongs to Horeca Thang Long, a legitimate business operating in the commercial kitchen equipment sector in Vietnam. Our website contains no Phishing, or deceptive content, and we believe this classification is a false positive.We respectfully ask your team to re-evaluate the domain and update its status accordingly.Please let us know if any additional information is required from our side.Thank you for your attention and support.Best regards,Pham Van DoanhHoreca Thang Long CompanyAdd: B1.1-BT101-08, Thanh Ha B, Phu Lương Ward, Hanoi, Vietnam

Hello, I am trying to configure 802.1x authentication on FortiSwitch 148F (firmware 7.6.4) connected to a Fortigate-80F (firmware 7.4.9) using FortiLink but it looks like the FortiSwitch doesn't send any authentication requests to a FreeRADIUS server. I created a firewall policy using CLI as fortilink is not available in GUI, selected "fortilink" interface as source and enabled NAT, policy is also set to allow traffic.I configured RADIUS server on FortiGate, created User Group with RADIUS as a mameber and FortiGate is able to connect to a RADIUS server. Unfortunately when I assign security policy to a FortiSwitch port, the client is not authenticated because FortiSwitch does not send any packets.I thought maybe there is a problem with 802.1x supplicant, so I enabled MAB and still no packets going to RADIUS. I tried to run sniffer in CLI and it doesn't capture any packets.Diagnosed NTP and Fortigate and FortiSwitch say NTP is reachable.  I tested sync status and

SNMPv3 Not able to discover device in BMC application.I have enable on Interface SNMP, Username password created and SNMPv3 enabled . SNMP walk is not able to get the output.

Hi EMS adminsStarting from 7.4.4, in addition to the EMS binary installation method on Linux VM, Fortinet introduced a new installation mode which is VM image: a customized/hardened Linux with pre-installed EMS software, where we can't access the Linux shell, and only the new EMS shell is available.My questions are:As there are now 2 installation modes, is there one specific mode that is recommended?As this is the first release with the VM image install mode, is it recommended to install it in production? I mean is it enough stable? Will I find all the commands I need for all kinds of configuration and troubleshooting that I may need? E.g.: Can I check OS and DB log files? Can run tcpdump or similar sniffer command for traffic troubleshooting?I guess the standalone installation mode (with binary file) will be discontinued and the VM image install will be the unique available mode, right? So if I have now a standalone installation in my current prod and want to anticipate by moving to V

I have found out recently that if i create new user profile on Windows and start Forticlient there it carries over settings of another Windows user using this machine. It is weird approach first of all. Most Windows applications have unique per user settings for every windows profile. Now i have to find a way to delete settings when i prepare same PC for another user by creating a new profile. So, i need to find a location of user settings to be able to wipe them.

i have an urgent situation ans i need your expertise, i have implemented a vdom on my network, i had issues with one of my segments or ip blocks, i configured another root interface, but unfortunately, this new root interface is not able to communicate with some of the existing vdom's, Kindly share a guide or your support shall be appreciated.Thanks 

Is it possible to retrieve metadata on scheduled cli or tcl script.i create meta variable $(ip)I tried on script cli variable $(ip) "$(ip)" '$(ip)' $ip 

I am planning to start my Fortinet certification journey, and I would like to gain some clarity on the Fortinet certification costs. I have checked the official resources, but I would appreciate hearing from those who have recently taken the exams. Could anyone share their experience with the cost of the Fortinet certification exam? 

Hi everyone!  Good day and greetings! I know that there could be a topic on this somewhere and this is a general question but please bear with my st*pidity and ignorance. My FMG_VM64_AZURE is running v7.2.10-build1682 250211 (GA). Our managed fortigates (Both Hardware and VM) are running 7.2.11,build1740 (GA) (Mature).  Now we've been planning on upgrading because our current firmware versions are affected by these  vulnerabilitieshttps://www.fortiguard.com/psirt/FG-IR-25-647 Multiple Fortinet Products' FortiCloud SSO Login Authentication Bypass We need to upgrade to atleast 7.2.12 or above version. We're planning on going to 7.4.x 1. I don't see any 7.2.12 version for Fortimanager VM. Am I seeing it correctly?2. I know this is a st*pid question, but if I upgrade my managed Fortigates to 7.4.8, should I upgrade my Fortimanager to 7.4.7? FMG is still lower than the FG if this is the case.3. Does anybody had any major issues to share

Hello everyone,I’m currently working with FortiGate and FortiWeb, I'm new to Fortinet, and I’m looking for a step-by-step PDF or guide that shows how to configure and set them up properly.If anyone has a detailed guide, tutorial, or official documentation in PDF format, I would really appreciate it if you could share it.Thank you very much for your help!

Hi , can someone pls advise whether can translate source port "Any" to a specific tcp port on fortinet central SNAT? thanks in advance ! 

Hi, how can we configure this situation. We have a SD Wan with normal internet access A (1GB/1GB) with NAT router before the FG. The other interface is B MPLS and we dont have NAT. Today A failed and users didnt have access to the internet but dod have access to the MPLS network. The SASE policy had NAT activated and so the access via B MPLS access dondt work. Cloning the same policy without NAT and pushing above solved the problem. Now with access A working again (preferred by SD WAN rule for internet access), users again could not access to the internet because of the policy above with NAT. What can we do? I would like both options to work without having to change the policies. Thanks!

We migrated from Forticlient 7.2.13 to 7.4.4. ESXi VM applianceWe backup our VMs with Veaam.We have the following settings for most backup jobs.But I'm getting the following error with the Forticlient EMS 7.4.4 server.If the "Enable application-aware processing" option is deselected, the backup completes successfully.Regarding Postgres, I thought it wise to check the "Enable application-aware processing" option.Is a VM backup without this option a reliable restore?

I have setup a A-P HA cluster with VDOMs enabled.  the root VDOM works as the router between the other VDOMs. The routes of the networks of each VDOMs are being distributed over OSPF.After a HA failover, it takes around 30 seconds (default value for OSPF), so there is no seamless failover. Would the OSPF graceful restart (https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-FortiGate-HA-and-OSPF-graceful-restart/ta-p/189556 ) work in this scenario, as there is not really an external peer? Has anyone done a similar setup? 

I ssh into a jumphost in order to access my firewall fleet web interfaces.I am utilizing the "local port forwarding" option in putty in order to acheive this.I have been using this option for years without issue.I recently upgraded 2 of my firewalls from 7.4.7 to 7.4.9. After doing so, I am able to log into the web interface of each of the two firewalls, but I am no longer able to use the GUI based CLI. I get the follwoing:Login refused. (err=-121)Connection lost. Press Enter to start a new session.Is anyone also seeing this?

Want to route traffic from a Spoke2 (Site2) which is connected to Spoke1 via point to point link. Spoke1 connect to Hub via ISP link. Currently Spoke 2 uses dynamic routing on the underlay to exchange networks with spoke1. Is there a way to create a overlay tunnel using SDWAN on  this scenario from Spoke2 towards hub? any reference material is appreciated.  

using Administration login via SAML, custom keycloak  serverconfig system saml set status enable set default-profile "no-permission" set entity-id "http://xxxxxx:8443/metadata/" set idp-entity-id "https://yyyyy/realms/realm_a" set idp-single-sign-on-url "https://yyyyy/realms/realm_a/protocol/saml" set idp-single-logout-url "https://yyyyy/realms/realm_a/protocol/saml" set idp-cert "keycloak-IDP" set server-address "xxxxxx:8443"endThis always worked, but suddenly fortigate introduced `http_authd` in 7.6.4 and since then SAML admin login is broken.just tested in 7.6.5 but same problem, had to downgrade to 7.6.3 which works fine, though it has a bug where SAML admin sso login session can't open the web terminal.

Hi everyone,I'm currently working with the following setup:We have a FortiGate 100FPort X1 on the FortiGate connects via 10G to a stack of 2x Cisco CBS350X (on the Ground Floor).From there, there's an uplink via 10G to another stack of 2x Cisco CBS350X (on the Upper Floor).The reason for using the stack is to expand port availability, not for redundancy.Now, I want to replace the Cisco stack on the Ground Floor with 2x FortiSwitch 448E but leave the stack in the Upper floor. What would be the most sensible and correct way here?Can the 448E also be operated in a stack?Does it make sense to connect X1 and X2 to a 448E each? And to connect both 448E to the respective CBS350X on the upper floor?Thanks in advance for your help!

There is a vulnerability on 7.4.3 and the remediation is to upgrade to 7.4.4, however 7.4.4 does not include the free version.The release notes state that it does not include the free version as no feature updates were made between the versions but i've heard rumours that 7.4.3 will be the last free version ever.Will the 7.4.4 free version be released, or do those client need to be vulnerable until 7.4.5 is released and hope this includes the free version? Does anyone have any idea when this will be released?

Hi!I assume, that fortinac supports multiple AD directories.I have connected NAC to two separate AD domains(directories).Let's say(for example):Domain 1  is "domain1.local"Domain 2 is "something.domain2.local" Auhtentication is done with EAP (TLS) host certificates, so hosts are for example: host1.domain1.localandhost2.something.domain2.local dNSHostName is used as identifier, because we use only machine certificates Directories are synced normally and groups can be selected from Directory settings.Seems that Fortinac can search LDAP data only for domain1.local. (Group membeship etc) BUT for domain something.domain2.local LDAP queries don't work.(getLdapHost(), found ldapHost: false ) Is there a limitation, that only domains with 2 parts work?so:a.b domain works, but c.d.e not, because it has three parts? BR, A

Of course, "scanunitd" does not use 16 petabytes of RAM...

Hi,We have a fortimanager which connects to a fortigate. Whats the best way to create a read only account for the fortigate? Is there a way? If there's a best practices for this, happy to review it.We have an ADOM in fortimanager which manages all the firewalls. Thank you!TIA :)