Fortinet Community

Dear, please help me in this case: I have a Fortigate 100F which was return to the factory and configured as an edge in another datacenter.The internet provider gave us a private WAN IP x.x.x.x; but to go out to the internet, we must do it through a secundary WAN IP y.y.y.y.The Firewall was already registered in FortiCloud before the factory reset. Currently it appears registered in FortiCloud.The system information on the dashboard confirms the WAN IP y.y.y.y; but when trying to connected to FortiCloud it gives us "FortiGate Cloud Internal Error".When generating a PING using the CLI witch the source-ip y.y.y.y to the service.fortiguard.net URL, I do manage to reach it, but when I connected to the internet, it gives me the aforementioned error.When reviewing the traffic I see that in the rule Implicit Deny the origin y.y.y.y with destination to the Fortinet DNS, port TCP/853 es accepted. 

Hello,I have a customer that wishes to deploy the FAP-433G access point in a facility which requires replacing the dipole 2.4/5 GHz antennas and using patch antenna similar to the FANT-04ABGN-0606-P-R and a omnidirectional antenna similar to FANT-04ABGN-0606-O-R.When I search documentation on the 433G is states that the 433G supports third-party antennas.My question is will a patch antenna from Hubbell/AccelTex  (AATS-01110 former catalog number ATS-OP-245-6-4RPSP-36) and theM6060060MO1D43620 omni-directional antenna work?   

Hello Everyone I have set up FortiClient VPN via Intune to deploy to company portal for our users in the company to grab but I want to have the pre existing config to be set up but no matter what way I set it up via script as no errors are showing, I am stumped. I have tried everything. Any help would be greatly appreciated as to where I might be going wrong or need to adjust?My config in xml. I have left blank in the spaces FortiClientConfiguration>    <VPN>        <Connection>            <Name></Name>            <Server></Server>            <Port></Port>            <Username></Username>          &n

Hello,I have a requirement, only 5Ghz and 6Ghz  need to be available for an office.Actually, only 5Ghz is available for users and it works well.I checked this link https://docs.fortinet.com/document/fortigate/7.2.0/new-features/169732 but I need more explications.I created a 6Ghz SSID, select WPA3 SAE et activate H2E.Then for the Operation profile, I'm not sure according to my requirements. I understand, all the bands needs to be ON for the wifi6E, but I don't want 2.4Ghz, so I created a profile where Radio 1 is disabled, and link it to the new 6Ghz SSID. I can't made a real test until next month. Another question, if on the 6Ghz SSID, I keep active the 2.4Ghz, it's only for 6Ghz use or a user can connect to this frequence ?I want to know if the configuration is correct or if you have some tips. Thank you  

Dear community, I have fortigate firewall, today I thought can I check which user connecting Dialup vpn frequently and until when user was connected. It is possible to check ?? Remote authentication server for vpn user -  I am using - Raidus for authentication. The information which I am not able to see as follows - Group name - ??XAUTH USER - ??XAUTH GROUP - ?? Can anyone tell me where Can I see these information with respect to vpn user activity.  Thank you.  

Hi team,I have configured to disable access http and https on the interfaces, configured trust host on the admin account but still reported brute force log     

We have FGT in HA which is connected to two core(1024E) switches using fortilink with 04 access switches hanging out of the core switches.We have LAN and WIFI VLANs configured on the fabric which work through FW. We have configured the policy for intervlan also. In Access Switches in native vlan we have configured the respected vlans and in allowed vlan we have putted all.While sniff the traffic getting below output, Any extra configuration needs to be done for intervlan?    

Hello Team, Practically when configuring Fortigate as SSL vpn clients, users behind the client Fortigate can reach hosts behind the server Fortigate, but the other direction is not working. Moreover, the client to server direction does not work unless NAT is enabled in the corresponding firewall policies.Even when configuring a static route on the server Fortigate to direct traffic to the client subnet throught the ssl vpn interface the scenario is not working.Packet capture and debug flows on the server Fortigate shows that traffic is entering the tunnel, but nothing shows on the client Foritigate.

Hello, I have an ipsec tunnel running between teltonika rutx14 and fortigate. The devices see each other, ping each other, but how do I make all the traffic from rutx14 go through fortigate? Site to site tunnel. Teltonika is a dialup user because I don’t have a static ip

Hello everyone,We're having problems with our connection profiles on Mac. The Mac computers are running the latest version of Forticlient VPN.No matter if we enter the remote gateway with a port number (:443) or in the customize port. When we click save and reopen the connection profile the port number in the URL is gone or the check box for customize port is unchecked - without it it's unusable.  

I have 400F device and on this device we have configured around 1000 site to site VPN tunnels in active passive mode. We need to configure 330 link monitoring entries. I am able to configure 256 entries after that getting an error reached maximum entries. How can we increase the limit of link monitoring entries.  

Hello Everyone,   I have a production device that has already had our template that is for 1 MPLS -1 internet connection ran on it. I want to add another internet connection to that device. I already have a template for 1 MPLS- 2 internet connections which would be perfect. Would I be able to just add the variables for the 2nd internet connection and run the 1 MPLS-2 internet template even though it will have all the same variables from when I used the 1 MPLS- 1 internet except for the additional 2nd internet connection, or will it fail since there will essentially be duplicate variables? I thought I remember hearing or reading somewhere that it will just skip them, but maybe I made that up.  Thanks!

Hi everyone,I want to block my client's uploads (files, documents, images, etc.) to all applications and websites using Fortigate.I'm using FortiOS 7.2.6 on a Fortigate 60F.What should I configure to achieve this? Should I use Web Filter, Application Control, or adjust specific policies?Any advice or detailed steps would be greatly appreciated.Thank you!      

Anybody knows where the API reference for fortiproxy is buried at? I need to do some investigation on some uses or capabilities.

Running a Fortgate 60E running firmware 7.4.5 with a Fortilink connection to a Fortiswitch 124E PoE switch running firmware 7.6.0.  I have created an active trunk using two ports (15 and 17) on the switch controller and trying to change the vlan from the default to another VLAN I have created. When I do this in the GUI I get a red banner in the upper right that says "Failed to Save Changes". I get no other information that I can find in the logs or documentation on why this would happen or how to resolve it.

Is there a Forti solution available to deploy an old FortiGate configuration to a new NGFW Fortigate version? 

Hi guys, I'm stuck with something,  Once enabled SOAR MEA on FAZ 7.4.4, because "execute shell is no longer supported", I can't get in into the CLI for install some connectors. I appreciate some tip. Regards.

Hello.I searched forum, google and reddit and still can't do it. Our ISP manage our switches in lan. He have his router connected to our FG WAN and his switch connected via trunk on our FG aggregate (HA1+HA2). I have 2 VLANs on WAN interface - VLAN 99 (internet) and VLAN 6 (switch management).On LAN side (aggregate port) I have a few vlans in trunk included VLAN 6. Fortigate run in NAT mode, internet on all VLANs working fine. However i need do transparent config for VLAN 6 - between connection on WAN side and connection on LAN (HA) side. How can i do this? I read this - https://community.fortinet.com/t5/FortiGate/Technical-Note-Configure-a-FortiGate-unit-in-Transparent-mode/ta-p/194458 and this https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/402940/vlanIt's the same, based on informations in articles it should work but not working for me, I don't know why. Next I want to try Virtual pairs - https://docs.for

Dears, Recently I configured SSL-VPN in our Fortigate 40F.The connection is successfull in my iPhone but it doesn't on my MacBook Pro with MacOS 15.I have read this: https://community.fortinet.com/t5/Support-Forum/MacOs-Sequoia-15-0-support-for-FortiClient-VPN-7-4/td-p/342309 and tried.However, I don't have FortiClientNetwork.app in the 'Network Extensions' tab of 'Login items an extensions' within System Settings.  And eachtime when trying to open Forticlient in my MacBook.  It always crash with the following messages. Can anyone advises me how to solve the problem?  Thank you.

Hi,i tried with Image v7.4.3.F on VM Ware Workstation 17.6.1 Pro and FortiGate-VM64.ovf as an import.I could register for a trial license. With this Image i was not able to create a Site2Site Tunnel to Sophos XG 20.0 Trial Version, because of Encryption limitations. So i tried FGT_VM64-v7.6.0.F-build3401 with FortiGate-VM64.hw17.ovf, but this Release give me a trial license error, because fo 0 CPU and 0 GB Memory Bug. If i check hardware Settings i get 1 CPU and 2GB Memory. Can someone help and tell me if the 7.6.0 would support 3DES encryption?Sophos week encryption starts at 3DES ...

I need to have load balancing between two servers, so I have created a virtual IP and linked it to the virtual sever I have created on Fortigate, of course the virtual server is linked to the two real servers. The issue is that the VIP is getting hit counts normally (even if I link a real server to it, I have access), but the virtual server is not getting any hit counts, So, I want to ask if it is possible to do this configuration? If yes, what may be the issue with it?

Hi Everyone, i have a problem when i try to connect the EMS 7.2.5 to my LDAP server the same parameters work well in version 6.4.9 and 7.0.13 but since the update to version 7.2.5 impossible to reconnect the LDAP server i have the error message: unable to read LDAP response packet: unexpected EOF does anyone have an idea about this error Thanks for your help 

Hi Fortigate 101FVersion 7.6.0 I'm trying to reduce the TTL for a number of fqdn addresses by setting the cache-ttl on the address object itself. When the default cache-ttl is set to 0, and also the global setting for fqdn-cache-ttl is set to 0, it is using 2400 seconds - which I assume is from the DNS query response. (The Fortigate is configured to use our DCs for DNS). To overcome this, I have set the cache-ttl to 60 under the FQDN type address object, but it continues to use the 2400 timer?. I am checking this by using command - diag test app dnsproxy 6  Any help much appreciated FortiGate 

Hi. Got some Q about forticlient EMS.We are using windows allways on vpn right now (not my choise) and would like Forticlient because of the VPN and ZTNA thing.So can the Forticlient vpn in IPSEC mode use the computer certificate before login so the user can reset password (with a policies only allowing the things needed for that) and when the user logs in uses the user certificate to get more access? mayby with the ztna tags? like EAP-TEAP where you have the outher and inner methode.if yes, does the client reset the first ipsec tunnel og makes another for the "inner" methode?if its possible, then ill proberly make the samme setup from the outside and inside, so we are full ztna.I'm about to do a poc so i can test it, done a lot of traditional ssl vpn remote access on fortigates, but would like the advance mode this time and ipsec other than ssl.We got about 2200 clients and a 900g so the FGT can handle 50k ipsec tunnels.Morten

Hello everybody, We are facing an issue where the Application control isn't showing in the security profile in our FortiGate firewall we are using 60f we noticed this problem since we updated the firewall to the latest version 7.6.0, also note that when I go to certain policy it doesn't show when I edit the policy ,but strangely when I point my mouse on the security profile part in the policy it shows the application control and i can edit it.can anybody tell if this is a bug or something else. Thanks in advance