Fortinet Community

I wanted to share a method I discovered for migrating configuration files from the old hardware platform to the new hardware platform without using the Forti converter tool. You can achieve this by copying the initial lines from the new configuration files and pasting them into the old configuration files. Once this is done, you can import the modified old configuration files into the new hardware platform, and it should work perfectly. Best of luck with the migration process. 

Hello everybody,I'm the Fortigate 60F (v7.2.10) admin, and I log into it at: https://vpn.xxx.com:40443/ or https://10.1.0.1:40443/ I defined a local-in policy to momentaneously deny the access to this page to all the users. All the policy above this one are disabled: edit 5set uuid d5c73f7a-eae5-51ef-8ecd-4cb99f22bef3set intf "any"set srcaddr "all"set dstaddr "login"set service "HTTPS-40443"set schedule "always"next The dstaddr is:   while the service is:  I should access the login page from everywhere. Why? What I am doing wrong? vpn.xxx.com is a DNS entry:    

Hello.Below is my understanding of the conditions for SD-WAN rule processing. Is this correct?The interface must be configured as an SD-WAN member.An SD-WAN policy must exist, and the traffic must match that policy’s conditions.The FIB is used to determine the next hop. FIB entries come from the RIB , which updates the FIB automatically. To add information to the FIB, routes must first be added to the RIB.

How my product is locked why I can't registered Please help urgently   

I am hitting the correct NAC policy which should send a COA to my Fortigate Wifi controller to change the vlan. Logical Network portion working correctly. PCAPs on gate and NAC not showing any traffic being initiated. Other policies are properly sending the COA. Are there any known bugs with 7.2? Here is the final lines from the Policy Details debug log.Looking up LogicalNetworkConfiguration for LogicalNetwork prod-wifiUsing SSID Name:root:corp_wifi, id: 439Returning LogicalNetworkConfiguration: AccessConfiguration- Task ID:[null]- Network:[prod-wifi]- Access Value:[VLAN_230]- Access Action:[2]- Alias:[false]- Send Groups To Firewall:[false]- RadiusAttributeGroupId:[1]- Version:[11]- Tags: []- Firewall Groups: []Don

Hi all, I and my colleagues have tried to upgrade a FortNAC-CA-700F appliance to a newer firmwar by following this guide https://docs.fortinet.com/document/fortinac-f/7.2.3/release-notes/195805/system-update-settings After reseting the appliance to factory default we are presented this screen: If we press 'DEL' nothing happens, though if we press 'TAB' we get shown this and are required to enter a password (and we actually don't know which passwordto enter): Else, if no button is pressed, then this is shown: Not sure how to preceed.Can anybody help with this? Thanks

We are looking for an experienced FortiNAC Engineer to assist with the installation, configuration, testing, and commissioning of a Fortinet NAC Virtual Server in our network infrastructure.

Hello, I would like to upgrade a Fortigate VM on Azure.I registered the license on Fortinet but cannot add the license to my fortigate "Manual license upload failed". Is there another way to add the license? Will it allow me to download the firmware images on fortinet.support? (I don't have the "support" license). Can I recreate a VM (in the target version), put my new license on it and import the configuration of the old one? Without "causing damage"

what is this i delete all logs but after few time they show me again error how to fix it please help memory traffic log is 95% full" - Fortigateapp-ctrl memory log is 95% full

Hello everybody, I'm working on a Fortigate 60F (v7.2.10) and I manage my Fortigate at the address: https://vpn.xxx.com:40443orhttps://79.x.x.x:40443  (for externals)https://10.1.0.1:40443  (for internals) because 79.x.x.x is the wan1 interface, I defined two local-in-policy:  login_group is an address group:     HTTPS-40443 is:    The policy n.1 works fine, if I try to access (10.1.0.1:40443 or vpn.xxx.com:40443) I correctly see the login page.From the same network (10.1.10.0/24), another device, can't (correctly).If I use an external device (for example my phone), connected to a different external network, it can access vpn.xxx.com:40443 and also 79.x.x.x:40443. The policy n.2 doesn't generate any log. What am I missing?    

I have a Fortigate 80E. We want to move away from local users on the firewall for VPN and to using LDAP sync, so that we can simply add/remove people to the VPN Access security group on the AD. We also want to force 2FA/MFA when those users sign in to the VPN.  I have been unable to determine how to do this for the 30 users that use the VPN from time to time.  Can anyone point me in the right direction? I am running 7.0.5. Thank you. 

Hello,New fortigate-40f user (v7.2.10 build1706 (Mature)) here trying to struggle a port forward from WAN to LAN web server.I checked the guides for virtual ip & firewall policy, but for some reason the internal ip/ service stays unreachable.The rules i created are.1. virtual ip2.firewall policy(tested with nat enabled & disabled with same result)  Any idea what is the issue here? yoursEtep 

Hello,We are a small MSP currently thinking of migrating from Checkpoint VSX on OpenServers) to a pair of Fortigates.For now there is one feature present in Checkpoint Gaïa Os that I don't know any equivalent in Fortigate world : Inline-layers.Appart for the performance gain inherent of inline-layers (equivalent to the jump action in the iptables world), this allows us to maintain a subset of rules in one place and publish it to multiple firewall policies without having to copy/paste the modified rules inside each policies.Is there a similar feature in Fortigates?

Hi there, I'm encountering problems with the newest FortiClient VPN application. The primary problem is that after hitting the connect button, it displays "Disconnect," yet when I verify the IP, I'm aware that it's not connected.

Hello,I would like to export, for internal audit, all administrators configured on all Fortigate managed by our Fortimanager and have the output on a single file. How I can do that?  

Hi! For the FortiADC cluster design is it possible to do cross-connect for HA of the uplinks towards FW? If so, what would be the configuration on the virtual server port assignment since you can assign only single port?

Hi All, I've just configured link-monitor to allow failover to WAN2 when internet access through WAN1 is unavailable.I've applied this config without any errors, but it doesn't appear to display all the settings.config system link-monitor (link-monitor) # edit "WAN_Failover" (link-monitor) # set srcintf wan1 (link-monitor) # set server "8.8.8.8" "4.2.2.1" (link-monitor) # set protocol ping (link-monitor) # set gateway-ip xxx.xxx.xx9.17 (link-monitor) # set interval 500 (link-monitor) # set failtime 5 (link-monitor) # set recoverytime 5 (link-monitor) # set update-static-route enable (link-monitor) # set status enable The resulting config is displayed below.FW1 # show system link-monitor config system link-monitor edit "WAN1_Failover" set srcintf "wan1" set server "8.8.8.8" "4.2.2.1" set gateway-ip xxx.xxx.xx9.17 next endAs you can see, the following parameters are missing.(link-monitor) # set protocol ping (link-monitor) # set interval 500

Hi All,I'm trying to configure a WAN2 failover but I'm getting stuck on NAT.I have a primary leased line internet circuit on WAN1.I have a secondary FTTC internet circuit on WAN2Both WAN interfaces are in a WAN-ZONE.All firewall policies currently have a specific outbound NAT address with a dynamic ip pool address.This outbound NAT address is different to the public IP assigned to the firewall.The IP Pool addresses are Overload addresses.I have several IP Pool addresses with incremented public ip addresses assigned.Some firewall policies will have different outbound NAT IP Pool address.It is a single public IP from the range allocated to the internet circuit on WAN1. I plan to configure link-monitor to detect when there is problem with WAN1, override the current static routes and send all outbound traffic via WAN2. The problem. When testing, If a client hits a policy like this below, it cannot get to the internet.This is due to the option, "Use Dynamic IP Pool"

Hi ,I have a problem with the DHCP server when reserving ip addresses.the problem is that I have several access points that are not fortiapwhen I move from one place to another I'm obliged to connect to another access point.at each access point it gives me a new ip address, even though I've reserved an ip address in the fortigate.thank you for your reply!!!

Hello Expert, I configured a Stitch to backup our Fortigates firewall to an solarwinds tftp server. But I notice once the backups are completed for a week it is not running automatically for the next week. I did some troubleshooting and found that last trigger date and next scheduled trigger is same.Unsure if this is preventing the backup from running at the next appointed time.I humbly request some help . Please results before for guidance .  Guy-Head-Office-1 # diagnose test application autod 3alert mail log count: 0 stitch: Weekly_backups_to_TFTP (scheduled)local hit: 0 relayed to: 564 relayed from: 564last trigger: last relay:Sun Feb 9 14:08:41 2025next scheduled trigger:Sun Feb 9 14:30:00 2025actions:Upload Backup config to Tftp Server:done: 564 relayed to: 564 relayed from: 564last trigger: last relay:Sun Feb 9 14:08:41 2025 Thank youRegards  

Hi,I have 40F as Wireless Controller, with 831F APs connected to it via POE switch.How can I see which clients were connected via WPA3 PAE and which with WPA2 PSK ? I'm running the SSID in transition mode.

Hi,I'm using 40F as Wifi Controller, and using 831F APs.I have 2 SSIDs - Guests and Employees.I want to prioritize the employees over the Guests Radio wise and Bandwidth (QoS) wise.recommendations ?

Hello Expert, I am seeking some assistance to setup and Automatic Stitch to generate an email when FortiGate HA becomes out of sync. Thank  Regards

https://docs.fortinet.com/document/fortiedr/6.2.0/administration-guide/49640/working-with-fortiedr-on-vdi-environments"FortiEDR Collector should only be installed on VMware Horizon or Citrix XenDesktop master images (not on clones) to ensure protection of virtual environments." So the number of licenses consumed at the time of installation is likely to be 1, but it seems to be displayed per virtual desktop on the EDR console screen. Please tell me how to think about the number of licenses consumed for VMware Horizon (current name: Omnissa Horizon, I think) in EDR.  Thank you for your cooperation.