Fortinet Community

Hi, we use a bunch of FortiSwitch-448E-FPOE for different puposes. Two of them are used for management access to different devices - two of them being MikroTik CRS309-1G-8S+. The problem we face is, that those MikroTik switches can be powered by PoE but no matter what settings I apply to the FSW ports PoE-wise, the FSW won't deliver power to the MikroTik switches.When I use a HPE 2530 switch or any PoE+ capable power injector, the MikroTik switches get powered by PoE like a charm. Has anyone else experienced this phenomenon? I did not yet create a case with support, just asking the community first. Thanks for you input!

Hi, I'm translating the login page replacement message on a FortiGate 80F. How can I modify the "Please enter your username and password to continue" contained into %%QUESTION%% variable. Ok, I can delete the reference and insert a static text, but I'd like to find out some better solution. Thanks

I have implemented a sidecar container to forward my main application logs to splunk. Have used universalsplunkforwarder image. After I deploy both my main application and forwarder seems up and running. But anyway not recieving any logs in splunk index specified. To troubleshoot splunkd log or any specific splunk internal logs are not found in /var/log path. Can someone please help how we enable this splunk internal logs?

Hi everyone.. I'm new here to the forum.. So, my question could be an old one, but I didn't see it in the submitted messages..I have an issue concerning my protected domains that I need your help with.. I have a Fortimail 200F, with two protected domains. I can see the incoming and outgoing emails to each of the protected domains in the logs, but I can't see any emails that are sent between those domains (i.e. From protected domain1 to protected domain2, and vice versa), although the emails reach their destination successfully, but no logs for them at all.. Is this a common issue that can be modified in the configuration? If so, could you help me with the steps to resolve this issue..FortiMail 

Hello! Could you please help me find out where I can check the end-of-life and end-of-support dates for FortiGate Firewall devices? If you could guide me on how to do this or provide assistance, I would really appreciate it. Thank you!I am interested about FortiGate 90G and FortiGate 80F

Hello Fortinet Community. I hope you have ideas on how we can solve our problem. At the moment we have massive problems with BruteFrce attacks on our Fortigate 100F - V 7.2.9 - Our users connect to our company network via FortiClient VPN. The bruteforce attack uses frequently used names in our country, such as Smith, Meyer etc. and exactly these users are blocked daily. Now the question is whether a Mac address filter or the OS check can be used here or whether the whole thing is useless, as the credentials may be queried in AD beforehand and only then is the OS, Mac address etc. checked. We were unable to find this out from the documentation. Thanks in advance, Alex.

Hello,I hope everything everything good, im reaching out for help i've seen your solutions and that you have good knowledge in fortigate/forticlient we are having an isse with some forticlient on some windows laptops were we enter configs correct but its gets stuck on connecting or after i install the vs c++ redistributable it pops up but blank and after a while it shows to enter credentials for authentication and 2fa after that it disconnects on its own no error no nothing.do you have any idea on what can be the problem cause im starting to think its a windows problem maybe a network adpater problem or something else 

Basics for my config:FGT60Fx1 - Dynamic External Address (Comcast)FMG VM - Internal address behind the FGT60Fx1FGT60Fx2 - Dynamic External Address / CGNAT (T-Mobile Home Internet) I am using FMG to configure both devices. I am trying to configure a VIP for FGT60Fx1's external port to allow inbound FMG traffic (ports: TCP 541, 542, 53, 80, 8888, 8889, 8900, 8890, 443, UDP 53, 8888, 8889 per https://docs.fortinet.com/document/fortimanager/7.6.0/fortimanager-ports/465971/incoming-ports). However, FortiManager won't allow me to use 0.0.0.0 / 0.0.0.0 as the "External" address. Since the external address will change at my provider's whim, how do I get around this? I do have DDNS setup, but that also didn't work when setting up the FQDN option as it continually tells me I need a change note, even though I've entered one. I've tried using 1 character, 5 characters, 50 characters, but the field says I haven't added a change note. What is the trick to setting up VIPs in FortiManag

Hello, How could we solve the problem on FortiAnalyzer license that display license is duplicated in License Status. # get sys statusPlatform Type                   : FAZVM64Platform Full Name              : FortiAnalyzer-VM64Version                         : v7.2.1-build1215 220809 (GA)Serial Number                   :BIOS version                    : 04000002Hostname                        : Max Number of Admi

Hi everyone, I'm using FortiGate version 7.4.4 and have configured DDNS with FortiDDNS on three devices: two FortiGate 40F units and one FortiGate 60F. The WAN interfaces on all devices use IPv6, and each device has been configured with FortiDDNS using different domain names. Here’s the issue I'm facing:~The two FortiGate 40F units are successfully obtaining and resolving their IPv6 addresses using DDNS.~The FortiGate 60F, however, is not able to resolve its DDNS hostname, returning a "non-existent domain" error.~The strange thing is, when I use diagnose ipv6 address list on the 60F, I can see that the WAN interface has a proper IPv6 address, and it can be pinged successfully.~All three devices have the same DDNS configuration except for their unique domain names. Any ideas on what might be causing the 60F to fail while the 40F devices work fine? Any suggestions would be appreciated!Thanks in advance!

How integrate AD with FortiClient CLOUD EMS

I'm planning a deployment to migrate stateless router ACLs centrally managed by Ansible to FortiGates/FortiManager. I'm experienced with FortiOS but new to FortiManager and I'm trying to solve a policy management problem. We have multiple sites and we'll have one FortiGate at each site. Each FortiGate will have about 70 rules in common, but most of the sites additionally have between five and a dozen site-specific rules.To manage this, I'd hoped to be able to layer multiple policy packages accordingly on each FortiGate. For example:Rules 1-70 - Shared policy packageRules 71-85 - Site-specific policy packageImplicit denyThis is trivial with Juniper's Security Director, which allows you to apply as many "group policies" to a firewall as you want and commingle them with device-specific policies. I was expecting similar functionality from FortiManager, but, as I learn the platform, I find that it doesn't really work that way, and you're not supposed to apply multiple policy packages to a s

Hi, We're going to be changing our EMS registration to invitation only. I cannot find clarity on whether this disables existing registrations that didn't have an invite originally, or if existing registrations stay enabled and the change only affects new endpoints. Any insight appreciated!

Dear Fortinet Community. First of all the infos:Firewall model: Fortigate 100Fversion: 7.4.5 We have a thing I cannot explain to myself. I think the behaviour to handle it like this is since we have updated from 7.4.4 to 7.4.5. But I am not sure. We see a WebFilter violation when opening a http (not https) website. This website is in the category Phishing. We encountered it when installing a program that wants to download a executable file from this http source. Category Phishing is set to block in the WebFilter. Just to let you know. I made a ssl expection exception for the website. This helps to open the webpage when using SSL (https) but not without SSL, so http. The installer wants to reach the website by http. Probably I am wrong now but in the past we have added websites to the static URL Filter in the webfilter settings in order to reach them and to override a category filter. I have understood the static web filter as something like an override for categorie

Hello, We are encountering an issue when  EMS creates FortiClient packages that are not signed by a certificate and blocked by the Microsoft Defender smart screen on Windows 10 only but it works on Windows 11. However, EMS was creating packages with CA.The last changes on the EMS server are renewing that certificate and upgrading the EMS to 7.2.5 build 1061. Please advise. FortiClient Thanks,Alaa Elrayes

Hi, I need to connect the FG-80F via multimode fiber at 100Mbps (the remote end supports 100BaseFX only). Does the FG-80F support the Fortinet FS-TRANS-FX? https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/Fortinet_Transceivers.pdf 

Where is the problem? tunnel up no ping

I have did the format in Forti ManagerNow I can't boot the device without the firmwareAs I have the limited devices am not planning to purchase the license nowSo Kindly anyone ADVICE to get the Firmware of Forti Manager 200GI want to test the device and then I want to purchase the licenseIt is the new deviceFortiManager   

Hi All ,  We trying to figure out if we can use ubikeys with FortiGate SSL VPN for 2FA without the Forti authenticator?Ubikeys supports fido ,ooauth ..  Now we do need Forti authenticator can we use the cloud version ? thank you :)   

 Hi everyone, I have a WiFi system managed by a controller "8.4-0build-7 | MC1550." Most of the access points (APs) are all aligned with the version "8.4-0build-7." The model of the APs is AP822e. They are quite old, but they work perfectly. However, a few of them are still running a very old version, "6.1-1-3," and I can’t use them as they are disabled at the operational level.These are old devices, and I can no longer get commercial support for them. I’ve tried several distributors, but none of them can sell me commercial support for these devices.I kindly ask if anyone can share the necessary updates to bring the APs from version "6.1-1-3" to version "8.4-0build-7." I imagine it will be necessary to first upgrade to version 7.I’m desperate and don’t know what else to do. I’ve tried everything. Thank you in advance to anyone who can help me. 

Hi Team,We are using these apis for Registering license on fortinet portal license file etc. https://Support.Fortinet.COM/ES/FCWS_RegistrationService.svc/REST/REST_RegisterLicenseRegister license response status is :: 200 But api call is giving below resonse which were working earlier.I have validated token and its proper {"Build":"1.0.0","Error":null,"Message":"Invalid input parameters, invalid security token","Status":-1,"Token":"xxxx-xxxx-xxxx-xxxx","Version":"1.0","AssetDetails":null}

Hi,i'm wondering if there is a way to script for example deregistering endpoint in EMS?

Good day, I am working on a project to move from Domain Joined Windows 11 computers to Microsoft Entra Only Joined computers, I have a FortiGate FGT200F with Firmware 7.X which currently authenticates users via FSSO in the local Windows Domain via LDAP to determine which Web Filter Policies to apply based on their Active Directory group membership. My test Entra Only joined Windows 11 computers are having issues getting the correct Web Filter Policies from the FortiGate and are ending up going to the Catch-All policies, does anyone have any experience with how to do authentication with Entra Only Joined computers on a FortiGate? I have Microsoft Entra Connect Sync Pass-through authentication setup and it is working to authenticate Entra Only computers to the local Active Directory so users can gain access to network resources. Would I need to create groups in Entra the same as the local Domain groups and authenticate to them? And if so, how is this done? Thanks

This is a fix for your FortiClient VPN being stuck at "Connecting".I was having this issue with multiple users and final found a fix. Cause:FortiClient is trying to start the FortiTray.exe in your c:\program files\Fortinet\ folder, but  it is missing a .dll file (mfc140u.dll). This is part of Visual Studio. Fix:Download and isntall this Visual Studio Redistributable: https://aka.ms/vs/17/release/vc_redist.x64.exe After this your FortiClient VPN app should be working as normal (might require a restart) . 

Hi, Is there a way of getting a free limited version FortiAuthenticator VM so I do a proof of concept before purchasing? ThanksJulian