Fortinet Community

Hi , trying to update fortiweb running in an esxi host when i go to the Fortinet support portal , i see so many different versions , which one i need to download ?mine is v7.4.3 build 638(GA)  thank  you

Hello, we are having trouble with wifi clients clinging on to APs too far away.We are unable to modify the local Windows roaming aggressiveness settings.What options do we have via ForitWifi to force clients to disassociate with an AP if they are connecting at too low RSSI signal strength?

Hello,How can i activate HA failure email alert on fortigate ?I have already a CLI rules and i would like to add this to deploy on every fortigate.Ty for your help.

Hello All,I'm new to Fortigate, so be gentle :)I have a Fortigate 400F that's set up and working, connected to the internet through a cellular router (temporary for now) that gives the fw a dynamic IP on the WAN port.  I want to route https traffic from the WAN port to an internal IP address.  I've followed the admin guide (FortOS 7.2.10), followed multiple online articles and youtube tutorials, and although the setup seems very simple and easy to understand but I cannot seem to get it to work. My basic understanding of the process is:1) Create virtual IP with source address of 0.0.0.0 mapped to my internal ip 10.35.1.11 and select port forwarding of 443.2) Create firewall policy to accept traffice from WAN interface to Internal Interface, source = any, destination = internal IP, service = https. To rule out my ISP being the problem, I tried to just connect directly to the WAN port with my laptop, set the IP of the WAN interface to a static address, set my laptop to

Good morning friends, I have the following problem, I have a 1801 computer which when updating it to version 7.4.3 or later generates problems in the connection between servers and units mapped by nfs, they disconnect or do not allow writing on the mapped units. Has anyone experienced this situation?

Hi, Has anyone encountered the situation where a user disconnects from idle-timeout ( 300s ) and the Reconnecting just keep happening after a good couple of seconds ( about 60s ) and lots of logs with SSL web application blocked ?FGT : 7.0.15 and FCT 7.2.4 ( other FCT versions also have this issue )The sslvpn configuration looks like this ( some lines have been left out ) : config vpn ssl settings set ssl-min-proto-ver tls1-1 set banned-cipher CAMELLIA 3DES SHA1 STATIC set ssl-client-renegotiation enable set auth-timeout 43200 set login-attempt-limit 3 set login-block-time 300 set idle-timeout 300 set login-timeout 120 set dtls-hello-timeout 30 set default-portal "no-access" config authentication-rule edit 1 set groups "SSLVPN" set portal "tunnel-access" next end set tunnel-connect-without-reauth enable set tunnel-user-session-timeout 60 end   config vpn ssl web

Hello! Please, help me. We use FortiGate 200E in our company.I have difficulty using the VPN. The speed when connecting to VPN is only 1-2 mbps. How can I fix this? The channel at both ends of 50 mbps

Hello I have 3 links on my Fortigate 60F v7.0.13:- 2 WAN interfaces with manual mode- 1 WAN interface with PPPoE modeI also have an SDWAN rule in "maximize bandwidth (SLA)" mode with the three links.On my local network there is a Zabbix server that pings 3 IPs on the internet and each ping to a specific IP must go out through a specific link, thus validating connectivity on that link. I then created a Policy Routes to specify the outgoing interface, where I specify the source address as the Zabbix server and the destination address as a specific IP on the internet. However, when the PPPOE interface link goes down, the ping continues to respond and is routed to another interface. When the link on the other interfaces (manual mode) goes down, the behavior occurs as planned and the ping is interrupted. Is there any special configuration that needs to be made in the policy routes when it comes to a PPPoE interface?

HiWe have noticed a large amount of attempts hitting our SSL VPN from 1 particular country. The attempts are coming from a variety of IP addresses but are listed as this one country. We want to block these attempts but our issue is that we have an office in that country. The users are in a shared office but use SSL VPN to connect to us. The shared office has a static IP.  Is there a way in Fortinet to create a group to block all IP addresses from this country except the 1 that we one that our users connect from? Many thanksRoy

 Hello,I’m using FortiClient Console on macOS with FortiToken for 2FA, and I have a small suggestion that could improve the user experience. When the Token window opens for entering the FortiToken code, it would be a significant improvement if the input field were automatically focused. At present, the user has to manually click the input field with the mouse, which, while minor, becomes frustrating when repeated multiple times a day. It’s also somewhat redundant, as I’ve already selected to connect to the VPN and am ready to enter the token—why should another action like manually focusing the input field be necessary?

New FortiAnalyzer installation continually restarts the Setup Wizard (FortiAnalyzer Setup) after every reboot. VM Trial License Serial Number FAZ-VMTMXXXX4303 Description N/A Partner FORTINET Product Model FortiAnalyzer VM License Number FLVMSXXXXX91497 GB Logs/Day:1 Registration Date 2024-10-10 IP Address 10.202.10.52   The license number above doesn't match any license number that I have received from Fortinet. When I try to add a Contract Registration Code for the FortiAnalyzer provided to me in Asset Management, it indicates "Contract cannot be applied to this product.", although it is  valid FortiAnalyzer VM Security Automation license.   The FortiAnalyzer Setup continually asks for registering. I will say that the Configure Backup step, I am turning off Automatic System Backup.

Hello everyone, I'm currently optimizing my FortiGate VM02 setup and I'm considering two options to improve network performance. I can have a dedicated physical network card for my VM02 and I'm debating whether it's better to:Use PCI pass-through for the network card.Implement SR-IOV.Currently, my VM02 is using virtual Xen Server interfaces, but I believe one of these two options could provide better performance. Does anyone have recommendations or experiences with either configuration in a similar environment? Thanks in advance for your advice!

Hi We have a few FortiGate appliances managed by 1 FortiManager. i need to create a large number of IP subnet objects, which will be shared by more than 1 of the FortiGate appliances. Is there a way to import objects? I know on a Fortigate itself, I could cut/paste the commands in the CLI. So, is there a way of doing this in the FortiManager cli?Many thanksRoy

Hello everyone, First time posting here, and I did try searching but didn't get any hits on this issue. My agency is preparing to migrate from a primarily Cisco environment to Fortinet. My section, our jail, will be the first of our larger areas to do this, and we are moving our wifi from a virtual Cisco controller first. Our new access points are 431G's and require bt POE power. Due to this and having our Cisco switches still in place, we are setting up some temporary switches in standalone mode to run those. It was either that or having to run a second network cable or install separate power supplies. We have got everything sorted out to do this, but I found a curious issue once that was done. I have a Fluke Link IQ for some time, and love it since it can provide VLAN info along with all of its other benefits. Well, it did anyway. When I read a port on the Fortinet switch, it does not report back a few different things that it did before. It will not provide the IP address of th

I am currently using Railwire internet with a Syrotech router, and when connecting to the VPN through FortiClient, I am encountering an error message that says "Backup Routing Table Failed."Could you please help me understand what this error means and how I can resolve this issue?Looking forward to your assistance.

Hi, I am currently working on SAML authentication using OKTA for our fortigate admin accounts and following this KB:Configuring SAML SSO login for FortiGate ... - Fortinet Community At the bottom part of it, it mentions:If a test is performed via Okta Application directly, it will fail with a 'Bad request' error message. That occurs because the SAML assertion does not have the proper payload. Is there a workaround for this?We want to directly access the FortiGate via Okta application. Thank you!  

Dear all, I have a firewall where I configured SD-WAN on WAN1 and LAN3(WAN2), I was asked to configure the firewall so that it would send an email notification if either of the WAN is down, i tried from the security fabric -> Automation but it didnt work. Any advice?

Good morning , guys I have fortigate in my headquarters , and now I'm going to close a VPN between this headquarters and branch , the question and I believe not but it does not hurt to ask with this tunnel I can use Fortinet Singles Sing On agent configuration that is in my AD . Or will I have to create Webfilter and application Control separately for this firewall ?

Hi, We need to be able to allow connectivity from devices on a Guest network (subnet 192.168.50.0/24) to a server hosted internally on the LAN (subnet 192.168.5.0/24 - server IP 192.168.5.245 port TCP/48082) but it needs to be able to be connected from via. the external IP address (125.x.x.x)How can we set up policies and objects to allow this? We already have a VIP in place to allow connectivity to the server from the Internet and this works well. Appreciate your insights :)  Thank you!

Hi,Could you please provide advice on how to setup an email alert if a local client device on LAN goes offline using automation stitch or similar? Is this possible?Articles that Im looking into.https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creating-automation-stitches/ta-p/190594https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/351998TIA :) 

Dear Team, Anyone can help me the command which I have written here and description is correct. Please guide me. I am writing this post for the sake of knowledge, As I was trying to access https://www.fortinet.com from LAN machine. I just want to check which policy is using.diagnose debug enable (to enable debug)diagnose debug flow filter (addr,clear,daddr,dport,negate,port,proto,saddr,sport) (to filter source/destination address)diagnose debug flow show function-name enable (not aware of this command)diagnose debug console timestamp enable (not aware of this command)diagnose debug flow trace start 100 (it will start capturing 100 packets)diagnose debug flow trace stop (to stop capturing the packets)diagnose debug disable (to disable debug)diagnose debug flow console enable (not aware of this command)diagnose debug reset (to reset debug, may ealier debug command used)Go to LAN machine and try to access - https://www.fortinet.com 

Hi, I have an issue where I create an IPSEC Tunnel to a Cloud server, the tunnel is up but local LAN cannot reach and ping to remote site. After checking the traffic, somehow the traffic is going through the DMZ interface which we currently not using and down. After we add the DMZ IP segment to local address on FortiGate, and add to remote on the Remote cloud, we can reach and ping between the sites. I want to know why it still going through DMZ IP segment even though we are not using the DMZ port and it currently down? Our device is Fortigate 100F, version 7.4.4

I recently bought a Fortigate 60F, two FortiSwitches and a number of FortiAPs to upgrade a small Dell/Sophos network at a small campus. While setting up the devices in the lab, I found that I can't use both A and B ports (with the Foritlink symbol) on the Fortigate at the same time. Regardless of which port (A or B) and which switch you connect first, the second port will not light up. Therefore  Fortigate System - Fabric Management can only see one switch at a time.  I was using port 24 of the switch to connect to the firewall per instruction label on the switch. I also tried just connecting to any port on the Fortigate and changing the port mode. I don't have the firmware versions at hand but they should be fairly recent. What's going on? Can't image  something this simple to not work. Can someone help?

Hello Experts, This may be a basic item.Why is Loopback Address necessary at SD-WAN?Is it used for SLA? If SLA is not important, can we omit it? Thanks in advance, 

Currently we are having Fortigate VM deployed in AWS in different regions.We have only one port configured for HA-SYNC between two fortigate VM as shown in this diagram. https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/aws-administration-guide/229470/deploying-fortigate-vm-active-passive-ha-aws-between-multiple-zones On the diagram it was given with 10.0.2.11 to primaryand 10.0.12.11 to secondary Question :Can we configure another HA-SYNC interface (for eg: port6) on the same subnet range as Port4 as shown in diagram above. Below will be the configuration 10.0.2.12 to primary with port 610.0.12.12 to secondary with port6