Fortinet Community

Does anyone know the end-of-life date for the Fortigate 201E model? I can't find it in the Product Life Cycle.

I have created an IPsec Remote Access VPN tunnel. When I connect to the tunnel I am unable to ping any interfaces or devices on the LAN. I have firewall policies to allow all traffic to and from the VPN-to-LAN traffic. I am wondering if the issue has to do with my Phase 2 selectors being 0.0.0.0/0 for the local and remote addresses. I do have a static route of 0.0.0.0/0 to the WAN interface, and if it matters there is a site-to-site VPN tunnel set up as well that I would like to be able to ping across to the other site's LAN. Thank you all for your assistance in advance. 

My current 100F firewall is configured with 400 sdwan spoke members and each member with a health check SLA, but when health-check set interval is set to 1500 ms it affect my CPU process and reach 100% is there any range or limit suggested to avoid CPU increase ? 

hello, here is my problem. i have a vm that can switch off servers when there is a power outage, managing a ups. that vm can send ssh commands. it's easier to send exec shutdown instead scripting. if the firewall is master, no need to worry, failover will do its job. if the firewall is slave, no failover. so in order to easily switch off a firewall from a specif location, i need to need to connect to by its own IP address and not from the HA mgmt IP address. if i configure in band management ip address, the vm needs to be in the same vlan, and that is not possible. i can't add another network card. is there a solution for the vm to get a ssh connection to a specific firewall, i guess the solution can route the network flow. maybe out band management? i don't know. thank you  

Good afternoon!I have the following scenario and would like the community's help. I have a Fortigate VM with 2GB of disk space, only one disk. However, this same disk was expanded by VMware to 52GB. Fortigate continues to recognize only the initial 2GB. How do I expand just the main disk without having to add another disk?See the screenshot below:I saw in the lab that adding another disk and formatting it works, but how do I use the main disk that already has space?

Hey Everyone,  Is there an option FortiNDR be configured with the IP address of the AD server to detect AD attacks? I did see Device Enrichment | FortiNDR 7.6.2 | Fortinet Document Library but I was wondering not about enriching the other hosts but for FortiNDR to monitor the AD server IP address or FortiNDR to autodiscover it, so to detect Pass-the-Hash / Pass-the-Ticket, Kerberoasting, DC Shadow, DCSync or Golden/Silver Ticket attacks Active Directory Attacks ? For example by FortiNDR knowing that there are two AD servers on ip addresses 1.1.1.1 and 1.1.1.2 then if another host sends DCSync requests using MS-DRSR protocol to 1.1.1.1 or 1.1.1.2 this will suggest AD attack as only AD servers should use DCSync between them.  

Hi, I have a fex-40d which I would like to use to provide primary internet access for a remote fortigate 60dI initially configured the fex-40d to local mode, passthrough. This worked for a few weeks but then stopped working and I had to do a sim swap before the lte conection came live again. I am able to connect my laptop to the ethernet interface, I get a passthough dhcp address and I get access tot he intenet. However, when I connect it the fortigate 60d I have not internet access. The passthough adress is obtained by the 60d but no internet access. Change it back to my laptop and I can access the internet. What is happening to the 60d that stops internet access (it used to work and does on a fortigate 60e) Is there some blocking going on the 60d? As an alternative config, I'd like to use the fex-40d in local NAT mode so I can still access the management interface of the fex. Does anyone have a good config for this as an example?I set the management to local and n

Hello, I need some help in the following topic, I am note able to solve to mix external end internal vlans into Fortilink. There is a FortiGate connected to 8 FortiSwitches via FortiLink interfaces. VLANs and subnets created on the FortiLink can be used on the switches without any issues. However, I need to be able to forward a VLAN arriving in a VXLAN to a specific FortiSwitch port. I can pass the incoming VXLAN as a trunk through a software switch to a manually configured switch without FortiLink, and I can use the VLANs. However, in this case, I lose the switch controller functionality, or I have to establish a separate physical connection. I would like to request assistance on how to switch a VLAN within a VXLAN to VLANs defined on FortiLink, or how to forward all tagged VLANs existing within the VXLAN to the switches via FortiLink. Thank you fro your help in advance. Regards,Antal  

Hey all,3 branch business, maybe expanding to a 4-5 branch business in next two years.Company might want to switch to fortigates as branch routers/firewalls, and fortiswitches for layer 2.What would you recommend I do for a setup? Currently using Cisco site to site VPN tunnels, but if we want to expand I'm worried it's not feasible to continue site to site. Thinking of a bit of a network change when moving to fortinet hardware.Any suggestions? Any thinks I should look up to make the swap easier?

I have configured a File Filter on a FortiGate 40F running FortiOS 7.6.3. The filter is applied to the LAN -> WAN policy and set to Both (two-way). However, the problem is that it only blocks files being uploaded from LAN to WAN, while downloads are not blocked.Additionally, the antivirus on the same policy correctly blocks infected downloaded files, so the issue doesn’t seem to be with the policy or antivirus itself. I don’t want to create a WAN -> LAN policy because I don’t want external users to have access to the LAN network.Also, I can’t find the PROXY feature in the configuration — it seems like it might have been removed or is unavailable in this version.Does anyone know if this is expected behavior for the file filter in FortiOS 7.6.3? Am I missing some configuration to actually make it work two-way? Any advice would be much appreciated.

Hello Team,I am deploying forticlient EMS and stuck at few things and would appreciate if some one guide:1. I had installed the forticlient EMS and created a remote VPN profile. This profile is pushed once the remote laptop is connected with the forticlient EMS.2. Lets say a user is working from home and I need to pushed the VPN profile on his laptop, if its not pushed, a user will not be able to connect to the VPN. So what will be work out of this, how a remote user gets connected to the EMS server and how this all will work?3. Also if there are two ISPs (Internet Service Provider) running, and we want to connect the remote users on both of them. Then what configurations we need to do on the forigate firewall and on the Forticlient EMS? Appreciate if someone could help on this.Thanks

I have a somewhat working setup on a 91G running 7.4.8, that I am struggling with. Sometimes it works fine, now it doesn't. I have IA-PD from my ISP, and it seems to be correct. I have three interfaces on LAN side that gets each their own /64: lan (shortened)    ip6-mode            :     nd-mode             : basic     ip6-address         : 2a01:xxxx:161f:670a::1/64    ip6-allowaccess     : ping https ssh     ip6-prefix-mode     : dhcp6     dhcp6-prefix-delegation: disable    dhcp6-information-request: disable     ip6-delegated-prefix-iaid: 1    ip6-upstream-interface: Vlan102     ip6-subnet          : ::a:0:0:0:1/64 The other interfaces have :b: and :c: respectively. Now, when it doesn't work I see that the FortiGate claims

Hello, i need to delete a test ipsec dialup vpn, this vpn has no reference but i'm unable to delete neither in cli nor in gui.It was firstly created via the vpn wizard and then changed to custom vpn.I also create a loopback and associated it instead of the wan1 interface but nothing changed.How can i fix it? Following the configuration: FW-VPN-A (ipsec_dialup_vpn) # showconfig vpn ipsec phase1-interfaceedit "ipsec_dialup_vpn"set type dynamicset interface "wan1"set mode aggressiveset peertype anyset net-device disableset proposal aes256-sha1set add-route disableset dpd disableset nattraversal disableset psksecret ENC jd2XioYxP9J8q0kk2kkqW11BE3YteLWRNpehZ1k6B0Ccmn1lmMjY3dkVAnextendFW-VPN-A # config vpn ipsec phase1-interfaceFW-VPN-A (phase1-interface) # delete ipsec_dialup_vpn This phase1-interface is currently usedcommand_cli_delete:6989 delete table entry ipsec_dialup_vpn unset oper error ret=-23Command fail. Return code -23Thank youRegards

Hello, some users in the domain can access the internet when they enter their own users in the agent after logging into the local admin account. I want to quarantine users who log in with local admin, how can I do this.

Hello Forti experts,I’m currently migrating from Stormshield to FortiGate.Is there any tool or script that could help me migrate the firewall rules (around 1000 rules) from Stormshield to FortiGate?Note: I’m able to export all the rules from #Stormshield into a CSV file Thank you 

For many days I have a big problems with manage unwanted traffic, connected with multicast on Fortiswitch. The all of packets come from LG tv screens and caused switch hanging what is not registered on other vendor like DCN or TP Link. According to your firt suggestion, our switch has been upgreaded to the newest SW but it did not have positive impact on transmission (IGMP traffic has been turned on as well). Let me know if you have similar problems and how to solve this problem.

 Hi Fortinet Community, I'm currently using FortiClient EMS 7.4 and FortiGate running FortiOS 7.4. When I try to access a server located in the DMZ using ZTNA access policies with ZTNA tags, I receive the following error:  Despite this, everything seems fine on the FortiGate side:The ZTNA tags are successfully synced from EMS.The relevant endpoint appears under the correct tag in the FortiGate.Running diagnostics shows that the endpoint is recognized and tagged appropriately."diagnose endpoint ec-shm list" command correctly shows the endpoint info.I can't identify where the issue is happening—whether it's on the client, EMS, or FortiGate. Has anyone encountered this issue or have suggestions on what else I should check? Appreciate any help or guidance from the community! Thanks.

Hello, we have to update a FG80E to a new FG90G cluster. We need SSL VPN, mayber later on we can change from SSL VPN to IPSec, but not now in the process of installing the new FG. After reading x posts about the SSL functionality and FG90G someone can tell me 100% with what FortiOS I have the functionality. I updated both of them directly to 7.4.8 without thinking about the SSL (they have 8MB RAM, what the hell????) and now without registering the FGs I cant even downgrade the FortiOS. Thanks,Roland

Hello, we are changing in one of our offices from FG80E to FG90G. In the FG80E we used Hardware Switch to use for our 2 segmentions in our newtwork. We dont use VLans in our network. Any suggestions to use VLan Switch or Software Switch. The normal LAN was configured as Vlan Switch and checking some KBs I saw that the VLan Switch is compared to the old Hardware Switch and using Software Switch there might be some memory issues. Any suggestions, I dont want to get to problems later on. Thanks!

FortiNAC-F - How to Configure FortiNAC as a Local RADIUS Server for 802.1X Authentication (Part 1) In this video, we walk you through the step-by-step process of configuring FortiNAC as a local RADIUS server to enable 802.1X authentication.  This is a vital setup for ensuring secure network access control by validating user and device credentials before granting access to your network. :pushpin: Key Highlights: Understanding the role of FortiNAC in 802.1X authentication Setting up FortiNAC as a local RADIUS server Configuring user credentials and policies for secure access Integrating with switches Testing and troubleshooting the configuration  Whether you're a network administrator or a cybersecurity enthusiast, this tutorial will give you the knowledge you need to enhance your network security with FortiNAC. https://youtu.be/KqkxFoYvG2w

Hi Fortinet Community, I have set up a Fortigate Captive Portal, and I'm having a problem with regards to its Authentication Timeout, already set it to 1440mins. after auth-timeout, my device is force to disconnect, then when reconnecting need to do re-authenticate.I've read somewhere here, to extend the timeout, instead of idle timeout use hard timeout to extend for at least a month. is there any way to do this with out any timeout? Thanks...

We have experienced an issue with specific in-house built applications that worked when not behind our Fortigate 7.x firewall but started to fail when we placed behind it. Turns out the application does not send keep-alive or heartbeats and so the session-ttl kicks on the FortiGate and kills the application. We worked around it by creating a specific rule on the Fortigate to increase the TTL for that application but we are wondering if it is possible to log these events and send to the FortiAnalyzer so we have visibility of this condition going forward as we move more applications behind our firewall? 

I logged in with an admin account to monitor the Fortigate interface, but after 10 minutes the account automatically logged out ( if not in use ). i created a secondary account but after using it for a few months, the same error occurred again.is there any way to guite me to fix it?  

How to configure the FortiSwitch Fiber 424E as line command interface to connect commutators.