Fortinet Community

Hi, Would like to know if the conflicts displayed when we are trying to import configuration the FortiGate device config FortiManager Cloud may affect the overall function of the FortiGate device itself? We plan to use the FortiManager default config. 

Both the FortiGate Firewall content processor（CP） and the network processor（NP） have IPsec encryption and decryption functions, and there is overlap in their functions. How are the two processors divided in IPsec encryption and decryption?

HI, I have experienced a very interesting problem.I had a network device that was working fine when connected to using a computer or when connected via the FortiGate, however, when connecting via the FortiSwitch it would not work and the FortiSwitch would not even learn the MAC address (The interface was showing up and STP was changed to forwarding state properly).After long time of troubleshooting i found that the MAC address on that network device could not be found in any OUI database. The manufacture created a new Firmware that corrected the MAC address and i was able to then use it via the FortiSwitch.I'm trying to understand why the FortiSwitch was blocking it and if there is a log or something i could've seen it getting blocked. I was unable to find any relevant documentation. I'm not using any special security (No NAC, 802.1x authentication etc)Using fortiswitch 148f-f with firmware 7.6.0

I have been using the proxy based UTM profiles for all our students firewall profiles and have had no issues until last week. We started getting Certificate issues on client devices. such as Err_Cert_date_invalid.  The certificate in question is issued by FortiGate but on inspection it is expired even though the certificate in the Manager is not expired. Im not even sure where to begin with this but it is causing issues as I have had to change to Fow based but this is allowing students to access sites that they shouldn't be despite rules being setup to prevent this. Regards

I have a Fortigate 90G with 5 S148F-FPOE switches connected in a line. All the uplink ports show high Oversized packet counts. I am seeing this from the gate to switch one, 1145975344 and from switch 1 to switch 2 885605148. But all uplink ports are showing these high numbers. I am getting reports of disconnects and speed issues. I have checked all ports on all switches for CRC errors. I see a few ports, but the count is 9 or less. Fortigate is running 7.4.7 and switches are running 7.6.1. This is a recommendation on the matrix, just trying to figure out what is going on. 

I am trying to get a IPsec dialup VPN accessible from two interfaces WAN and LAN3. Currently the IPSec VPN listens on WAN and that works well. I have added a virtual ip on the LAN3 interface mapping from the public IP to WAN IP and created a firewall policy using this VIP. With this in place the IPSec VPN will connect from LAN3 however no traffic flows across the tunnel. Any idea what I am missing?

Hi there,Understood that we are able to call commands in CLI to execute the collection of logs residing on disk in the Foritgate FW Admin Panel. Is there a similar command to collect all logs residing on cloud too? I'm trying to simplify the collection of all logs using CLI. This is on the assumption that I only have access to the admin panel in Foritgate. Thank you! 

Hello -  We are migrating to 2x new FortiGate appliances in the AWS cloud, in a single VPC.These devices only serve 16 VPNs, half of which are DR VPNs.There is no public traffic, and no firewall rules to manage.Can someone recommend a Fortinet Partner that can help us?Thank you!

Hi all,I'm doing a trial setup of some FortiExtender FEX-202Fs with my existing Fortigate 91Gs which are managed via a FortiManager VM. I plan on using these as LAN extenders for remote microsites. I've managed to get the FEX units working well with the FGTs on their own, but the trouble comes when I try to use FMG to create firewall policies involving the FEX interfaces.  In the FGT UI, I can see the FEX units correctly appearing under the "LAN Extension" category. Firewall polices work fine when configured directly on the gates. However, when the FGT configs are imported into FMG these same interfaces appear as the "VLAN" type. I am then not able to select these interfaces when making firewall polices. I'm assuming this is because the "role" variable on the erroneous VLAN page for these interfaces is set to "Undefined". Unfortuantely I am not able to change the interface role, as an error message appears notfying that "VLAN ID must be between 1-4096", but the option to set

Good morning! How does static mode work in LACP on Fortigate?As far as I know, Fortigate don't send lacp messages in static mode,so how can I communicate in a static-static configuration? Thank you

Hello, I tried to export the system configuration file from my FortiGate with FortiOS v7.2.7 build1577, today the first time in YAML. When exporting using the WebUI I chose: Scope: Global, Backup to: LocalPC, File format: YAML, Password mask: enabled, Encryption: disabled. When I then tried to load the yaml file with the PyYAML python library v6.0… without the expected success:  import yaml with open("[…].conf.yaml", encoding='utf-8') as fd: yconf = yaml.safe_load(fd) File "[…]\Python311\site-packages\yaml\parser.py", line 438, in parse_block_mapping_key raise ParserError("while parsing a block mapping", self.marks[-1], yaml.parser.ParserError: while parsing a block mapping in "[…].conf.yaml", line 2407, column 9 expected <block end>, but found '<scalar>' in "[…].conf.yaml", line 2408, column 50  When examining with a text-editor, I found the following at the guilty part of the YAML-file (starting at line 2405):  firewal

Is it possible to do link monitor for two fortigates in active/passive HA pair in transparent mode? If so how? What are the limitations?

Hello there, Trying to move away from SSL and one of the last issues we're having in the setup is we are not able to ping users on the IPsec VPN via their FQDN. IP works fine but this makes me think the IPsec setup isn't communicating with our DNS server correctly. Any ideas what could be causing this or anything I can check? Our DNS server works just fine with our SSL VPN and is able to resolve FQDN but for some reason our IPsec VPN isn't.  I have both our DNS server IP and domain listed on our IPsec settings. 

My client company has various types of smartphones and OS for testing in app development.The client company said that since yesterday, they can't access the company's internal network with the FortiClient app on their iPhone. It's not that all iPhones are not working, but there are problems with 3 devices. FortiClient app installation, various basic settings, and ID/PW input are all possible, but the UI for OTP authentication is not displayed. They can receive an email containing the OTP value to the email address set as FortiToken. However, the UI for entering the OTP value is not displayed. I accessed FortiGate and checked various debug logs, but there are no problems confirmed in the device, and a timeout occurs because the OTP value is not entered. I opened a ticket and contacted TAC, but there is no problem confirmed in the FortiGate logs, and FortiClient also said there are no known issues. The iPhones that are having problems are as follows. 1. iPhone 16

Hi,We are working on customizing the quarantine report for our users and would like to include additional information. Specifically, we’re trying to add the classification or reason why an email was quarantined.However, we’re unsure which variables are required to include this information in the report.Could you please advise?

FortiNAC self-registration Guest Management with wireless dynamic Vlan management .During the registration process without doing nothing . I got a native vlan ip.In NAC's Network>Inventory>Device>Virtualized Devices>root I haven't add native Vlan id . What is the fault ? 

 Good day,Please note that we have successfully replaced the FortiGate Firewall 60E with a FortiGate Firewall 100F using FortiConverter. While most services are functioning correctly, we are currently experiencing issues with VPN connectivity. We cant connect to VPN seems like the SSL-VPN configurations on E60 was never converted to  FortiGate Firewall 100F.  Thank you @ Anthony_E

HI, Can the Auto-Script backup be configured to use the LAN IP as the source IP? If so, could you provide guidance on how to accomplish this? FortiGate 

One of our customer planning to integrate Forcepoint DLP with our FortiGate firewall using ICAP profile and require information regarding SSL inspection, specifically whether deep SSL inspection is necessary for this integration. As deep inspection enables the firewall to decrypt, inspect, and re-encrypt encrypted traffic by acting as an intermediary, which requires distributing FortiGate’s CA certificate to all endpoints to avoid certificate warnings. Could you please confirm if deep SSL deep inspection is mandatory for Forcepoint DLP integration with FortiGate?   

Hi there, We enhance our SSL/TLS configuration with the config below but this does not affect the ACME interface.How can we (due to an audit) harden the ACME interface?config system globalset admin-https-ssl-banned-cipher RSA DHE SHA1 SHA256 SHA384 ARIAend The ACME interface still supports the following chipers:TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 2048)TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048)TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 2048)TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1)TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1)TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1)TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1)

Hi I have updated my FGT 200F to 7.6.3 version. from now on, full ssl inspection has many problems. it shows certificate error for some websites which was working well before and some times it bypasses all websites automatically. here is the error message for chatgpt :   please help net::ERR_CERT_DATE_INVALID Subject: chatgpt.com Issuer: FG200FT9044229 Expires on: Apr 30, 2025 Current date: Apr 30, 2025 PEM encoded chain: -----BEGIN CERTIFICATE----- MIIEIDCCAwigAwIBAgIUdrj1VYAKb+FPzB4q2HANTQTfVcIwDQYJKoZIhvcNAQEL BQAwgakxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRIwEAYDVQQH DAlTdW5ueXZhbGUxETAPBgNVBAoMCEZvcnRpbmV0MR4wHAYDVQQLDBVDZXJ0aWZp Y2F0ZSBBdXRob3JpdHkxGTAXBgNVBAMMEEZHMjAwRlQ5MjI5MjA1ODExIzAhBgkq hkiG9w0BCQEWFHN1cHBvcnRAZm9ydGluZXQuY29tMB4XDTI1MDQwMzAwMTYwNFoX DTI1MDQzMDA1NDY1MVowFjEUMBIGA1UEAxMLY2hhdGdwdC5jb20wWTATBgcqhkjO PQIBBggqhkjOPQMBBwNCAARSTlz4/3zd7PcHph2Iwh0IgKNBtZHPkGl1IovCE4Qq BDlfa9Kx3S++x0WXdGBCPmx8bh9xp4/SlgeWq8kMUl0So4IBmzCCAZcwDgYDVR0P AQH/BA

Dears, I try to connect to my Fortigate but i cannot. When i check the logs i can see : reverse path check fail, drop. I can join it from another WAN IP btw. In the Administrators, the IP is correctly added. What' s wrong? Thank you in advance, Vincent.

Does anyone know how I can use ansible to update Forticlient EMS Cloud?  I specifically want to update the ZTNA Application Catalogs and Endpoint profiles ZTNA Destinations.

Hello! Our fortianalyzer stopped displaying logs 2 days ago. I am using fortigate with version 7.0.13 build0566 and fortianalyzer with version 7.6.3.From the fortigate graphical interface I can successfully run a connection test with fortianalyzer. However, through the CLI command "execute log fortianalyzer test-connectivity" I see the output "Log: Tx & Rx (log not received)": execute log fortianalyzer test-connectivity FortiAnalyzer Host Name: FAZ-MINUANO FortiAnalyzer Adom Name: FortiGate Device ID: FGT40FTK21099EV4 Registration: registered Connection: allow Adom Disk Space (Used/Allocated): 0B/Unlimited Analytics Usage (Used/Allocated): 0B/Unlimited Analytics Usage (Data Policy Days Actual/Configured): 0/0 Days Archive Usage (Used/Allocated): 0B/Unlimited Archive Usage (Data Policy Days Actual/Configured): 0/0 Days Log: Tx & Rx (log not received) IPS Packet Log: Tx & Rx Content Archive: Tx & Rx Quarantine: Tx & Rx Certificate of Fortianalyzer valid and ser

Hi, Would like to know if I can backup a FortiGate device through FortiManager?