Fortinet Community

Hi,  We have configured password policy for both admin and ipsec preshared key as below conf system password-policyset apply-to admin-password ipsec-preshared-keyset expire-day 90set expire-status enable Now the strange behaviour is, after 90 days we really didnt get any notification about ipsec preshared key expired neither IPSEC tunnel went down. We tried shutting down the ipsec tunnel and still the old key was working. There is no clear documentation about this in fortinet public document..This is working fine for admin-password where after 90 days, its prompting to change the password. With this scenario, can we assume that this password expiration is applicable only for admin password and not for ipsec preshared key??.. Please clarify it.. RegardsRaja 

  Dear Team Fortinet Comunity  I have issue this VPN IP Sec anomaly error status negotiate and failure and this issue looping errot stat , do you have any suggestion for the resolve this issue or manual to fix this problemThank you for support and cooperation  

Hi,I manage several firewalls using FortiManager, and I’d like to automate the regular backup of each firewall’s configuration. So, how can I set up this automation within FortiManager to export all managed firewall configurations to SFTP?  FortiGate FortiManager 

Hello and sorry for my english, In fortiauthenticator i created captive portal. All works very well ! But now i want to change logo on portal but when i go to 'administration' -> 'images' the button 'create new' is gray out. So i can't do nothing ! I can edit or delete images but not create. I am connect with admin account, i tried with other administratror account : same problem.thanks for help

Hi All, We have x2 Fortiswitch424E configured MCLAG using x2 10G fortinet DAC Cable.I encountered an issue where one of the MCLAG interface (port 25) keep coming up and down every few minutes.  Anyone got any idea what's happening?  Below is the error message that I found, 

 I have a virtual IP configured on Fortigate, and I can access the server via the virtual IP from any network, even from my cell phone.From the local network that goes through Fortigate, I also need to access the virtual IP via the browser, but nothing appears on the page.The interface IP address is in the same segment as the virtual IP, and all segments use the same link to navigate.I hope you can help me identify a possible problem.

Hi Community, If you have ever used FortiAP 23JF (Inroom, wall mounted) and used an Operation Profile to configure the LAN ports to specific VLAN's, like a VoIP or IPTV connection, you might get puzzled if you try the same on FAP231F or FortiAP 431F.The GUI in the Operation Profile has the same options as the OP for FAP23JF, but for some (strange) reason, on those models, you need to either A) use the CLI on the AP to actually enable the Bridge Mode, or B) create a configuration profile that does it on the AP's you assign that OP too. Why the FortiGate can do this all by itself on FAP23JF, but not on FAP321F or FAP431F is left out in the open.. For option A, a description is mentioned here.In short, SSH to the AP, after you have set the Bridge-To-SSID values on the AP/OP Profile, and then use these commands: cfg -a WANLAN_MODE=WAN-LAN cfg -c  For option B:1: On the Operation Profile, enable the option: FortiAP configuration profile.2: In the Popup, cl

Hello, Is there any way of determining whether there will be a FortiAP v 7.4.x release that fixes bug ID 1060165: The FAP-231G/233G/234G 2.4GHz radio would stop SSID beaconing? I know there is a 7.6.2 fix for this, however it requires FortiOS 7.6.3 to ensure compatibility and I'm not confortable to push that FortiOS release out yet to production FortiGates. Thanks,

Hi,I have 40F, I understand that the recommended version to use is the latest 7.2 - let me know if I'm wrong.We have 7 units of 831F.I understand that it is recommended to work with the same version on the firewall and the APs.yet - I see that I miss new features that exist on version 7.6 such as 802.11mc (Wi-Fi RTT) Support.would it even be possible to use the new features while using old version over the 40F ?what happens if I use newer version over the APs ?

Hello,My account manager has told me that since we have replaced our Fortigate via RMA, that we can't renew support for the replacement device when the contract expires. This doesn't seem right. It's a 101E and is still a supported device.  Any thoughts?

I can't install Dissolvable Agent on my Android phone. What is the latest version of dissolvable agent support?Mine android OS is 15.. 

 this error message coming when i am creating vlan  version : fortinet 7.2.1 plotform: vm ware workstation , eve-ng  

I have a question about FG-200F-BDL-811, this hardware is End of Life?When? What is the replacement?Thank in advance.

 Hi ForumI'm writing about migrating from SSLVPN to IPSecVPN Dial Up as the SSLVPN is deprecated in version 7.4.3.I have looked online and found alot of resources regarding building the IPSec Dailup but nothing about what client one should use.My question is, what client does the end user use with the IPSec Dialup - is it the same as the SSLVPN client or is a different one?If it is the same, does the client need to be configured to use IPSec Dialup?Thanks!John

HelloI have fortigate firewall and i have 2 vlan. Let say vlan100 for NAS and vlan200 for cctv.The cctv can connect to the nas only if cctv and nas located in same subnet, the cctv can't discover the nas if the nas located in different subnet. Can we make some forward broadcast to enable the cctv can discover nas even in different subnet?

When I connect to a wifi as a fortinac configuration redirect to registration portal and then I fill the requirement when the processing done faceing issue  in a attachment photo. What is the error and how can i solved to this issue.Farther I want do know nac guest registration process. What now I know is first when i connect to a wifi I will be got a isolation assign ip righ? then I success the registration process I will got a respective assign vlan right? If that correct how can i do to got a isolation ip first? Further more  , if i don't use coa message i do not got a multivlan assign ?Thanks for ur helping.

Can anybody please share all the extra security features you get when using FortiEDR on an iOS/iPadOS device? With iOS already being locked down pretty tight, is it basically just URL and Web Security scanning? Does it scan files/links clicked in an email prior to opening? Just looking for all the "extra" or "added" security features you get when putting this product on an iPhone or iPad. Thanks for the information. 

Dear Fortinet Community,We are a small team of 15 people using a FortiGate 30E firewall and a D-Link DIR-2680 Wi-Fi router. We have two SSIDs. Lately, Wi-Fi speeds on both networks have been slow. The ISP technician confirmed the wired LAN speed is good, but Wi-Fi speeds are much lower. They suspect the FortiGate 30E might be affecting the throughput.When I tested the Wi-Fi, I got 364 Mbps download but only 12 Mbps upload, which seems low for our 500 Mbps plan.Could the firewall be limiting the speed? How can we check and fix this? AlsoHow do I see the actual output speed the firewall is providing right now?If the speed is low, what could be the possible reasons for this?If the speed cannot be improved, what is stopping it from being faster?If the speed can be improved, what changes ?Thank you in advance for your support.

I created a VIP to map (forward) external port to internal port on the server inside (e.g. 8080 to 80). When I create a firewall policy for this incoming connection, should I specify external or internal port or both in the "Service"?If only one is enough (for example, 8080) how another (80) is managed in that case (explicitly opened or whatever...)?

Hi,I have FortiSwitch 108 POE connected to 40F and being managed by the 40F.I didn't configure any password for the fortiswitch - and connected to the FortiLink.yet - I understand that it is needed for manual configuration.is there a way to configure it ? or do I need to reset it ?

I have a new 200g replacing a 100f. Due to the number of ports I need, I need to use the 5g ports on the 200G. Can these 5g ports operate at 1g speed? I cannot test it at the moment, I can set the speed to 1000full or auto in the CLI config but I do not want to run into any surprises during the cutover

Device Unresponsive After Firmware Upgrade to v7.2.9The FortiGate 400E has become completely unresponsive. The unit exhibits the following behavior:Power LED: Solid greenStatus LED: Flashing rapidly (continuously)Console Access (PuTTY or Tera): No output observed during boot-upUSB Recovery: No response when using a properly formatted USB drive with valid firmware imageTFTP Recovery: No firmware request or activity detected from the device; unable to initiate recovery due to lack of console accessMultiple recovery attempts—including use of different cables, terminal software, USB drives, and TFTP configurations—the unit does not respond or enter bootloader mode.seems bootloader failure triggered during the upgrade process. 

 Hi,  I have Fortegate 100F with OS 7.4.x I configured SSO with EntraID successfully and login was working.  I have a questions.Q) Can I use more than one entra id group for separate vpn portal and policy. A user member of group A and assigned the portal A and apply policy A, and B user member of group B and assigned the portal B and apply policy B And I have in troubleT) User can login was successfully with Entra ID, and connected.But SSL VPN client didn't receive internal routing table, only DMZ routing table was received.It add routing table in manually 'route -Add xxx -mask...' then it can be communicated.Anyone have solution like issue, please help me. Thank You. 

So we have been running Forticlient and EMS cloud for 18 months. We have had many issues with the following: Split tunnel for Webex and MS teams not workingZTNA tags not syncing to FortigatesLocal LAN Access not workingEach and every one of these things we find that do not work lead us to log tickets and we end up having to upgrade versions of Forticlient or worse wait for EMS cloud upgrades to become available which can take months.  Furthermore, we have seen numerous regressions in Bugs around split tunnel for example. Our latest is as follows:- MS teams and Webex are not split-tunnelling even though configured. Support have indicated these are due to internal Bug IDs 966971 and 1045328 - They say these are fixed in Forticlient 7.4.1 but there is no mention of this in the public release notes Resolved issues | FortiClient 7.4.1 | Fortinet Document Library as far as I can see- The 'fix' also requires EMS cloud 7.4.x which has not ETA for release!So a

I was wondering as for SQL or XSS attacks fortiweb has 3 options for detections what is the order of operations ? Is it first signatures then Syntax Detection and  then attack ML models that are build on the appliance itself after time from the passed traffic? Also what happens it an attack matches all 3 options? My final question is for SQL injection and XSS attacks shouldn't signatures be stopped and just Syntax Detection and attack ML models to be used as I have read that they have less false positives ?