Fortinet Community

Hi, I have an issue where I create an IPSEC Tunnel to a Cloud server, the tunnel is up but local LAN cannot reach and ping to remote site. After checking the traffic, somehow the traffic is going through the DMZ interface which we currently not using and down. After we add the DMZ IP segment to local address on FortiGate, and add to remote on the Remote cloud, we can reach and ping between the sites. I want to know why it still going through DMZ IP segment even though we are not using the DMZ port and it currently down? Our device is Fortigate 100F, version 7.4.4

I recently bought a Fortigate 60F, two FortiSwitches and a number of FortiAPs to upgrade a small Dell/Sophos network at a small campus. While setting up the devices in the lab, I found that I can't use both A and B ports (with the Foritlink symbol) on the Fortigate at the same time. Regardless of which port (A or B) and which switch you connect first, the second port will not light up. Therefore  Fortigate System - Fabric Management can only see one switch at a time.  I was using port 24 of the switch to connect to the firewall per instruction label on the switch. I also tried just connecting to any port on the Fortigate and changing the port mode. I don't have the firmware versions at hand but they should be fairly recent. What's going on? Can't image  something this simple to not work. Can someone help?

Hello Experts, This may be a basic item.Why is Loopback Address necessary at SD-WAN?Is it used for SLA? If SLA is not important, can we omit it? Thanks in advance, 

Currently we are having Fortigate VM deployed in AWS in different regions.We have only one port configured for HA-SYNC between two fortigate VM as shown in this diagram. https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/aws-administration-guide/229470/deploying-fortigate-vm-active-passive-ha-aws-between-multiple-zones On the diagram it was given with 10.0.2.11 to primaryand 10.0.12.11 to secondary Question :Can we configure another HA-SYNC interface (for eg: port6) on the same subnet range as Port4 as shown in diagram above. Below will be the configuration 10.0.2.12 to primary with port 610.0.12.12 to secondary with port6  

Hi,I'm trying to use: "Diagnose debug traffic interface" to see which interface got monitor-bandwidth enabled.it gave me 25 interfaces(the limit numbers bandwidth monitor can enable) but some of the interfaces that don't exist on the Firewall. 

In this post, we attempted to create, collect, and integrate all aspects related to FortiGate and FortiWeb equipment updates. We explored which databases are used in which modules, how updates are performed, what logs are generated during updates, how to check for the latest update version, and the associated risks of these updates. High resolution file in this link:https://www.linkedin.com/posts/nadiamirhossein_fortigate-fortiweb-update-activity-7250886613818392576-ULj9?utm_source=share&utm_medium=member_desktop   

Hi all,  I am having issues syncing configuration to my managed FortiSwitch devices. Currently, I am running FortiOS 7.4.4 and FortiSwitchOS 7.4.2 and when issuing a execute switch-controller get-sync-status all I get the below status, MAC and REST API login error.  FGT01 # execute switch-controller get-sync-status allManaged-devices in current vdom root:FortiLink interface : fortilinkSWITCH-ID (SERIAL) STATUS CONFIG MAC-SYNC HTTP-UPGRADESwitch-A (SN12345667785654) Up Error Error -[1] command: https://10.10.10.1:443/api/v2/login payload: result : REST API login failed with error 60Switch-B (SN41233434554657) Up Error Error -[1] command: https://10.10.10.2:443/api/v2/login payload: result : REST API login failed with error 60 I have another setup in a different location running the same version except the only different is that the tunnel-mode is set to com

I'm trying to set up one-to-one source NAT policies in Fortigate 7.0.12. Unfortunately, I'm unable to use the interface IP Address or dynamic pool. It specifically needs Stay Updated on the Latest Development: At GBGenie, https://www.gbgenie.com/ we keep a keen eye on the latest advancements in the world of WhatsApp mods. Our dedicated team ensures that you have access to the most up-to-date and feature-rich versions available. Stay ahead of the curve with our regular updates and news on WhatsApp mod development. to be a one-to-one NAT as per the destination network policy.Could someone provide guidance on how to achieve this? Your insights would be much appreciated!

I run a small MSP, I have about 15 FortiGates out in the field, a mixture of 40F's and 80F's. Since upgrading to 7.4.5, I've seen 3 of the 40F's go into conserve mode and stop routing traffic until they're rebooted.Any confirmation from others?May have to back these down to 7.2.10.

Hey guys, I'm in the process of creating a new website for my agency. I'm using Framer to do that, the website is hosted on porkbun. I've just sent the draft to my friend to get his feedback and he's told me, that he cannot access the website, because it is being blocked by Fortinet.  The whole message is as follows:"the domain is in the category Newly Observed Domain. Your FortiGate Administrator has blocked this category". And then another pop-up, saying: "You have tried to access a web page that is in violation of your Internet usage policy".Since we are just building a marketing agency web page, it's important to me as a business owner that all of my potential clients can access our website. Please help me to fix this issue.

Hello, I'm trying to create a VTI VPN Tunnel between Stormshield and Fortigate. My VPN is up but I can send other traffic than my trafic selectors. I have attached a schema which explain the architecture and network traffic capture in forti's port1 and ipsec vpn tunnel. I see echo request and echo reply in tunnel but the echo reply don't appear in outgoing ESP traffic Thank you for your help ! AhmedT

Hi, I have an HTTPS virtual server using HTTP load balancing. I have 2 addresses directing to 2 different web servers on the same port, pass.domain.com to 192.168.1.1 and ssl.domain.com to 192.168.1.2 .Each server has its own certificate but under virtual server I can only choose 1. Is there a way to add multiple certificates? Or any other way?

Hi, is there any way to edit or make a copy of the Default Incident Email Template? and secondd question about it, this Default Incident Email Template dissappear form the list on Settings->System->Email and i am finding a way to restore, maybe is a file but i dont know where is and the name.Any suggestion??

I have two fortigate , one of them is managed by a company and the other is now acquired by a company and we are installing it. I need to configure it like the other Security Fabric Settings , I'm looking at several links but I can't get it to work. would you have any videos I can watch to solve this ? Imprimir Firewall configurando the current firewall  

Hello everyone. We get the latest setup on 17th Agust 2020 for Forticlient VPN. We get an error message like "forticlient unable to access image servers" while installing this app on windows 10 pro machine. Couldy you please help us what we should do next ?  Thanks. a few hours later ...We switched off local home network and switched on 5G mobile network as hostspot. We connected to the net via hotspot and the forticlient vpn setup progress continued. Do you have any ideas for that situations ? Thank you very much 

Hi, Is there a way that the Forticlient VPN client on MacOS will notify the user when they are disconnected? Like for Windows, there is a popup message when Forticlient is down. Thanks!

Hi everyone!Can't install FortiClient. I had this message: "Unable to access image servers".Thanks.

I have installed FortiClient VPN 7.4.01658 (no license) on Windows 10 22H2 and configure an IPSec VPN with password+OTP (hardware) using FortiGate 7.4.4 (RADIUS client) and FortiAuthenticator 6.6.2 (RADIUSe server and LDAPS) .For users without FortiToken assigned the FortiClient is working as expected.For the users that have FortiToken enabled, the FortiAuthenticator is requesting the token but the FortiClient does not pop-up the windows to insert the OTP code.This setup worked before, for 10-15 times, popping-up a small window to insert OTP code but suddenly stopped working.No changes were done during this time on the Windows level.The Microsoft Visual C++ 2017 Redistributable, found on the FortiClient Tools package was installed.   

Dear Community Members, we are facing the internet slowness issue with SDWAN-VPN users. we have created the IPsec tunnel with remote PF sense but to load balance and achieve the failover scenario, we made VPN part of SDWAN. However after making the part to SDWAN internet browsing is to slow. i have changed the Weights in SDWAN rules but nothing works.  

Hello, do you have a video I can follow to close a VPN between two fortigate? What would be the best practice?

 Hello everyone, I want to set up the "Push Notification" option for FortiToken mobile. I followed the technical tip here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiToken-mobile-push-notification/ta-p/195578It works very well, but I would like to know if I can configure it for my two WAN lines?FTMThank you, 

Anyone experiencing similar issue since yesterday  ?  It happened suddenly, with no modification on web filtering rules from our side, nor any updates done on Zoom app nor Forticlient.  Forticlient 7.0.9Zoom 6.2.2 and 6.2.3MacOSX Sequoia 15.0.1  

If our EMS server still is a Windows server, therefore using 7.2.4Am I right to assume we can't use FortiAuthenticator 6.6.0 with EMS 7.2.4?https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/afec3249-ed3f-11ea-96b9-00505692583a/FortiClient_ems-compatibility-matrix.pdf

 Hello everyone,I recently upgraded from FortiClient VPN 7.2 to FortiClient VPN 7.4 on macOS Sonoma. However, I'm encountering a persistent issue where the application crashes immediately after briefly displaying the console screen. I've attempted reinstalling and deleting the /Library/Application Support/Fortinet/ directory, but the problem persists.Below is an excerpt from the crash report:     Process: FortiClient [1711] Path: /Applications/FortiClient.app/Contents/MacOS/FortiClient Identifier: com.fortinet.FortiClient Version: 7.4.0.1645 (???) Code Type: ARM-64 (Native) Parent Process: launchd [1] User ID: 501 Date/Time: 2024-06-21 17:08:15.2847 +0900 OS Version: macOS 14.5 (23F79) Report Version: 12 Anonymous UUID: 211D612A-2605-BAE2-689D-2447A5CCDB76 ... Termination Reason: Namespace SIGNAL, Code 5 Trace/BPT trap: 5 Term

Hi, I've just implemented the automated stitch on Fortigate to auto block the attacker's IP that are trying to connect IP Sec VPN and it is working perfectly fine. The problem is that, since we are using FortiManager Cloud where all the policies and objects are synced and we are managing the configuration from it, at every new creation of IP object in Fortigate the Fortimanager becomes out of sync and need to re import the policy. Is it possible to automate it? OR Can we exclude some address objects, groups and policies from sync?