Fortinet Community

i try to test fortiems server,i have install it 2 times ON VM WARE ENVIRONNEMENT and the second time , i enter my forticloud credentail and , the messsage error is that a try licence WITH ANOTHER HARDWARE   already EXIST.I WANT TO USE ONLY THE SECOND FORTI EMS SERVER.PLEASE HELP

Hello FML admins, I am currently testing the Mail Migration feature in FortiMail to migrate email data from Gmail to FortiMail.I have followed the procedures outlined in the following documentation: https://docs.fortinet.com/document/fortimail/7.6.3/administration-guide/326016/migrating-email-from-other-mail-servers-server-mode-only#domain_user_1224406687_2752746https://community.fortinet.com/t5/FortiMail/Troubleshooting-Tip-FortiMail-migration-users-does-not-work/ta-p/306683 However, I consistently encounter an “Authentication failed” error during the migration process.Could you please confirm if there are any additional configurations or permissions that need to be set on the Gmail side to allow FortiMail to perform the migration successfully? Any tips would be much appreciated.Kind regards,

i am try ting to config 40F to 40F using site to site vpn when HQ has Static WAN ip and Branch use Dynamic , after config the tunnel is still down , even i try Hub - Spoke same issue , in HQ the 40F setup is behind the main Firewall ( 60F ) , does it required any Port forwarding . i have go through several video and documents , the config show ok ,still the VPN not coming online . 

Hi all,i've got an infrastructure of cluster fortigate running 7.4.5 managed by fortimanager. One of this cluster is in the headquarter all the others are branch offices. All of the clusters send logs to the fortianalyzer and all the branch offices send also syslog to a syslog collector behind the headquarter cluster. When looking in the fortianalyzer pointing the headquarter cluster i can see all the branch offices send the events via syslog, but if i point the branch offices to see the events exit from the firewall i can see them only from one branch office and all the others are not showed. I'll past the config from the one i can see and from the other that not. To me they seems the sameThis is the one not working:fw-xxxxx-xxxxxxxxxxxx-o~-01 (setting) # getresolve-ip : disableresolve-port : enablelog-user-in-upper : disablefwpolicy-implicit-log: enablefwpolicy6-implicit-log: disableextended-log : disablelocal-in-allow : disablelocal-in-deny-unicast: disablelocal-in-deny-broadca

Hello,I'm new here, i have installed forticlient 7.4 in ubuntu 24.04.I was connected to my VPN server. after a week when i tried to reconect i had this error "config DNS failed".these are the logs from the forticlient:20241212 13:01:50.744 TZ=+0200 [sslvpn:INFO] main:2168 Init20241212 13:01:50.744 TZ=+0200 [sslvpn:INFO] main:2186 VPN is running in restore DNS mode20241212 13:01:50.750 TZ=+0200 [sslvpn:INFO] nettools:1854 More than one device with index 2 can be found20241212 13:01:50.751 TZ=+0200 [sslvpn:INFO] nettools:1854 Device address details: local_address xx.xx.xx.xx, device_index 2, device name eth0 (read from netlink)20241212 13:01:50.751 TZ=+0200 [sslvpn:INFO] nettools:1854 Device address details: local_address xxxx::xxx:xxxx:xxxx:xxxx, device_index 2, device name eth0 (read from netlink)20241212 13:01:50.781 TZ=+0200 [sslvpn:DEBG] vpn_util:299 Get connection name: netplan-eth020241212 13:01:50.791 TZ=+0200 [sslvpn:INFO] nmtools:865 Network Manager settings backup file doesn't

We have deployed NagiosXI for monitoring and our server team is trying to use the Nagios Agent (NCPA) to monitor a domain controller. We have app control configured on the firewall policy for accessing the domain controllers blocking everything except what is permitted through Application and Filter Overrides. NCPA, which uses TCP/5693, is being blocked by app control and the only thing I can think of is creating a custom application signature to add as an override. The problem is when I follow the documentation to create the custom signature the FortiGate just keeps returning an error. The config I entered is listed below, any suggestions would be appreciated.FortiOS 7.4.7  # conf application custom(custom) # edit "NagiosXI_5693"new entry 'NagiosXI_5693' added(NagiosXI_5693) # set protocol TCP(NagiosXI_5693) # set signature "F-SBID( --name \"NagiosXI_5693\"; --protocol tcp; --dst-port 5693; )"(NagiosXI_5693) # set category 15(NagiosXI_5693) # nextload custom rule errorobject

I downloaded Fortinet Firewall VM version 7.6.4. I want to use it for testing purpose.Although I started the VM and accessed the management console, I see the message "VM is not licensed or license is invalid for current VM configuration. Upload a new license or reconfigure the VM. I want to get just trial license.I checked following past post. But it does not solve the issue. I also contacted support, they requested me to post my issue in this community site.https://community.fortinet.com/t5/Support-Forum/Requesting-Forticare-Trial-license-proxy-null/td-p/357387Can somebody help to get a trial license?My serial number is FFVMEVWJXNQCX3FE.

Hi I have a weird behavior and can't find the reason.I have FGT 300E and FAPs 432FR and even if AP got IP address and all wireless controller settings are ok, FortiGate not showing FAP in GUI. If I add it manually then after few sec is onlineThe same with 432G on 200E. ( FAP os 7.6.2)On both devices FortiOS is 7.2.10. I made sniffer and I see 59.674415 199_MGMT -- 10.24.64.29.15246 -> 10.24.64.1.5246: udp 37561.565662 199_MGMT -- 10.24.64.29.15246 -> 10.24.64.1.5246: udp 37562.195526 199_MGMT -- 10.24.64.29.15246 -> 10.24.64.1.5246: udp 37572.230574 199_MGMT -- 10.24.64.29.15246 -> 224.0.1.140.5246: udp 37575.612002 199_MGMT -- 10.24.64.29.15246 -> 224.0.1.140.5246: udp 37578.233103 199_MGMT -- 10.24.64.29.15246 -> 224.0.1.140.5246: udp 37580.253982 199_MGMT -- 10.24.64.29.15246 -> 255.255.255.255.5246: udp 37583.655548 199_MGMT -- 10.24.64.29.15246 -> 255.255.255.255.5246: udp 37586.236722 199_MGMT -- 10.24.64.29.15246 -> 255.255.255.255.5246:

We recently upgraded our Comcast coax server to their fiber service. We are paying for a 2gig connection. They terminate their side of things to a Ciena 3924 and provide a fiber SFP handoff for us to connect. We have FortiGate 60F's deployed currently at our various sites. So it runs from the Ciena to a 10G media converter, to Cat6A to the FortiGate WAN2 port. Our 3rd party tech support provider copied the config from WAN1 (the coax) to WAN2. When we run speedtests on the new connection our 2gig service drops to 4Mbps. One person on-site said they tested as low as 0.19Mbps. Comcast has verified 2gig to their demarc. I have replaced the fiber, media converter, and ethernet cables. We purchased a ethernet SFP module to replace Comcast's fiber SFP, however that SFP module was only a 1gig and Comcast said because we are paying for 2gig, the config won't let them downgrade the connection. We are not able to figure out what is going on with this. Does anybody have any ideas?

Hi, since I've recently acquired a 10G fiber home connection. I'm kicking around an idea of how to go about getting the most out of the connection.If I recalled correctly, its possible to define any interface to perform any roles. Is that still correct?I'm thinking of getting a 90F, and refining WAN2 as the primary LAN interface, and not use the 1GE ports at all or just redefine it as DMZ. Also, throw in dumb 10GE switch behind LAN (WAN2) that so my primary / higher priority computers and devices they would benefit from maximum available speed https://9apps.ooo/ .Does this configuration seem reasonable and possible?Preemptively thank you for the inputs

i have server in my network and i have make virtual ip to access server from outdoor network with static ip and from indoor network with internal ip and it work fine  how can i access server from internal network with static ip

we're trying to do RMA and when i access the ADOM and navigate to Managed Fortigate (1) tab in device&groups section the page appears blank.   

I have two Fortiweb VMs running on Hyper-V, configured in HA mode. I no longer have acess to the local admin account. I can only log in to the primary VM using a regular RADIUS-based user account.Could you please advice on how to recover or regain admin acess in this situation ?

Hi there, is there a roadmap for supporting FortiEDR under macOS tahoe?We are currently using a 6.0.1.1022 version on macOS 15 but want to go forward to 26. Are there any plans on supporting it any time?Best regards

Hello everyone, I need help creating a site-to-site VPN on Oracle Cloud Infra (OCI), I'm having several problems and difficulties, can anyone help me??

GreetingsWe start FORTISASE v25.3.139Trying to connect the on premise AD with Fortisase ** Access & Authentication >> Domain >> Create >> Active Directory AD connection  Server Address Must by Public IP, and enter credentialsit it secure to make VIP and enter the credentials, or there is another way thanksNader

Hello there,maybe some of you already experienced this issue and help me out.We have a FortiGate on Version 7.4.8 and want to use ZTNA Tags trough SSL-VPN to allow access to specific ressources.The Tags get assigned to the endpoints and under GUI Policy&Objects -> ZTNA -> Tags the endpoint is listed under the tag with the correct SSL-VPN Tunnel IP, but using "diag firewall dynamic list" the IP is not listed anywhere.This of course leads to the User not using the right policies.diagnose test application fcnacd 2 and diagnose test application fcnacd 5 do not change anything, diagnose endpoint fctems test-connectivity is fine as well.I already rebuilt the connector and we just updated the EMS to 7.4.4 (It did not work in 7.4.3 as well).I don't know what else to try, the support is looking at it as well but could not find anything yet.Any help would be appreciated!

Hi everyone,I’m using **FortiWeb 600F (reverse proxy mode)** and need to implement **request rate limiting based on a custom HTTP header**, not on the client IP.Limit requests to specific endpoints:/order/buy/order/sellEach request includes a header `x-user-trace`, which identifies the user.I want FortiWeb to **allow only one request per 300 milliseconds per unique `x-user-trace` value.**If the same user (same header value) sends another request within 300 ms, it should be **blocked or responded with HTTP 429 (Too Many Requests).**if request.path in ["/order/buy", "/order/sell"]:if "x-user-trace" in request.headers:key = request.headers["x-user-trace"]allow 1 request / 300 ms per keyelse:block or respond with 4291. Can FortiWeb natively perform rate limiting using a **custom header** (like `x-user-trace`) instead of the client IP?* I know that **DoS Protection**, **Bot Mitigation**, and **Rate Limiting** features exist, but they appear to use **source IP** as the identifier.2. Is there

Olá pessoal, estou fazendo uma pós em redes e cibersegurança que envolve muito o fortigate e cisco. Queria ideia de labs e cenários para implementar no eve-ng, um cenário que possa envolver principalmente FSSO, IPSEC e SD-WAN, pois são temas que precisam ficar muito claros para que eu possa ter sucesso na minha certificação NSE4. Teriam ideia de cenários reais que eu possa estar implementando para praticar? se for cenários que vocês mesmos já implementaram na vida real seria melhor ainda. Topologias e diagramas também são bem vindos hehe.

Hi, I just changed from SSL VPN to IPSec with for all remote users and now they tell me that one host on Linux had no problem before with SSL VPN (I dont know how he did it - it is an external user) and now with IPSec it is not working. I dont know if he uses the Linux Forticlient but I sent him all the info of the setup and it is not working. Since I dont have any experience with remote access via Linux Forticlient (I dont even know if it works) and since we aperently cant setup up a IPSec with the other site (it has to be remote) I am not sure what I can do. My setup was for Forticlient and he asked me if I can do it as Cisco Client but I dont want to change all my setup and all my access rules....but maybe this is the easiest way, just to set up a new remote IPSec with Cisco and if his sides works. Any ideas or suggestions? Thanks 

Hi everyone, I want to design a setup that uses two FortiGate firewalls for around 200 users.One device will work as the edge & Fabric root firewall for VPN, DPI, etc.The second device will act as an internal firewall for segmentation, VLAN routing, and inter-VLAN policies.My questions are:What is the recommended deployment mode for this setup? Am I going in the right direction with this topology?Is there any official Fortinet documentation or example for this design?In the next phase, I’m planning to use two devices in an HA setup. Does that make sense?Finally, I’m considering the FG-121G (Edge) and FG-91G (Internal) models — are these suitable?

Dear All, I have an issue with the following product we are having:We have an FG200F where I want to forward user-generated traffic to two different locations for  analysis and reporting. As you all know we can only configure one syslog server on the FG200F using the GUI so the only solution is possibly the CLI, now I know and found the commands to enable syslog and setup the syslog server IP Address and port numer. But I am not sure how to use the CLI to enable it to forward user-generated traffic. Can you all help me on how to configure two different syslog server IP Addresses with different port numbers using the CLI.Thank you all. Looking forward to hearing from you soon.

I am trying to determine the best design for VDOMs in a FortiGate that will be used to connect to multiple different customer sites via IPsec tunnels.  Customers must be isolated from each other and I have more customers than the max 10 vdom limit, so a dedicated vdom for each customer is not an option.  My plan is to have:root vdom (Global shell)mgmt-vdom (Fortigate mgmt functions and administration - type "Admin" vdom - has internet access via traffic-vdom)traffic-vdom (has wan interface, function is to provide other vdoms wan/internet access)customers-vdom (customers shared vdom, vpn tunnels for each customer)vendor-vdom (third-party vendor for monitoring customer sites and providing access to vendors cloud applications - vpn tunnel to vendors cloud) No LAN resources for customers, I am only handling traffic from customers to vendor via the IPsec tunnels.What is the best and most secure way to configure vdoms and IPsec tunnels.Inter vdom links from other vdoms to traf

 I am following the guide below to configure gmail as my email server in Fortianalyser.I am using this command to test the connection :  diag test connection mailserver gmail <simonhenderson611@gmail.com> <sihenderson@hotmail.com> It seems to be connecting to the mail server ok but fails later in the process, here are my results below : I would appreciate any help towards getting this working.Thanks Simon https://community.fortinet.com/t5/FortiManager/Technical-Tip-Configuring-FortiManager-and-FortiAnalyzer-to-use/ta-p/213771  diag test connection mailserver gmail <simonhenderson611@gmail.com> <sihenderson@hotmail.com>Testing SMTP server gmail, please wait...* Host smtp.gmail.com:587 was resolved.* IPv6: 2a00:1450:400c:c04::6c* IPv4: 74.125.206.108*   Trying 74.125.206.108:587...* Connected to smtp.gmail.com (74.125.206.108) port 587< 220 smtp.gmail.com ESMTP 5b1f17b1804b1-4710f29da7fsm17475225e9.9 - gsmtp>

Simple question.  Should I be concerned that one FortiGate 101F consistently runs at 60% - 75% memory used, while a like 101F with a significantly larger network and hardware load uses 25% - 35% of memory on a daily average.Both 101s share the same OS version, internal hardware configuration, and basic firewall and SD-WAN configurations.  They differ in that the high-memory use 101 has three 4- port FortiSwitches serviced by FortiLink, roughly 14,000 entries in the routing table, and roughly 500 sessions.  The 101 using less memory hosts 10 48-port FortiSwitches, a 21,000 entry routing table, and roughly 4500 sessions.Neither 101 exhibits anomalous behavior at the moment.  Still, I wonder if I should expect trouble in the future.Thanks.