Fortinet Community

Hi all. Ive been setting up brand new Fortigate 100F.There is only one cable between them: HA port 1 to HA port 1. However it keep saying out of sync because of the table  ips.sensor.I have seen this before on 70F aswell. Im running v7.2.8 build1639 (Mature) I have tried to recalculate #diagnose sys ha checksum recalculate but no result.

Hi Guys,I have a question about Fortigate 6500F Clustering. Can I add 3 Unit of FG6500 to a same HA, FGCP, Cluster and then use Virtual Clustering to distribute traffic to all 3 units?Thanks

How am I able to access switches and https (faz..) through bookmark and i cannot access through vpn ssl I checked the policy and it's fine, but could be a proxy for whatever in the middle?

Hi, i have a small/big problem. We are using Fortigate 200E with Proxy Policy (web Proxy), and we have a problem with Cisco Webex, the Stream is not working and a Networktest from Cisco says that our UDP 5004 Port is blocked. The problem is, that in Services under Explicit Proxy only TCP avaible is and not UDP and Socks-UDP not working. We tested the stream with our WLAN, whitch working whithout Proxy and there is the stream working. How it's possible to actived or open the UDP Port under explicit proxy

I have FG61F, FSWicthes, and 4 FAAP's in the office when i move in the office to another location i will still be connected to the original AP which the signal in the new spot will become very low and it will take 4-5 mints to switch my connection to the closest FAP Can i control the switch time ? is there is parameter for that ? Thanks

I have created Fortlink with dedicate to Fortiswitch checked. I setup internal DHCP and connected POE switch with Access Point. I am getting DHCP management address to switches but not getting DHCP from downstream port where access point is plugged in. There is no way to tag Fortilink interface in any downstream switch port unless I create interface type vlan. My question is, is there any way to use Fortilink as management vlan to provide DHCP for switches and DHCP also for  access points only using Fortilink rather creating a separate interface type vlan under Fortilink and add downstream switchports to it. I would like to know if this is possible.   

My Setup:I have a IPSec tunnel setup with the right side (Strongswan) sharing the internet 0.0.0.0/0.0.0.0 and left side (Fortigate) sharing a specific subnet. What I want to do:dI want to route a specific set of domains from the subnet over this tunnel and out to the internet. How exactly do I do this? What I have tried: I have the tunnel up and am allowing all traffic to and from the tunnel to subnet and subnet to tunnel.Created an address group with static routing selected. The route is setup as destination being my address group, interface being tunnel interface and distance is 10 there is also a blackhole route for the tunnel interface with distance 250. Trying this out, it didn't work. As a test I redid this for amazon and tried accessing it from incognito to see if I get redirected to the correct region and that doesnt work either.  Am I missing something? What can I do to diagnose this?

I have a question regarding Radius Server with Dynamic Vlan Assignment for SSD profiles. Basically I would like to have Dynamic VLAN Assignment and VLAN pooling enabled. I am running 7.4.5 code version and whenever I enable Dynamic VLAN Assignment, it disabled the VLAN pooling. I did find a documentation that it is possible 7.4.1 version came that both dynamic vlan assignment and vlan pooling is possible, reference: https://docs.fortinet.com/document/fortigate/7.4.0/new-features/924614/support-dynamic-vlan-assignment-with-multiple-vlan-ids-per-name-tag-7-4-1However; this is not working in code 7.4.5 code version. I would really like to have this feature that support vlan pooling with Radius because this setting in Cisco called RADIUS Server Overwrite interface, Meru called Radius With VLAN Pooling, allows us to have restricted access and unrestricted access at the same time based on the Network Policy server rules. This makes it easier to have users in groups tied to authenti

Fortimanager version 7.4 and Fortigate version 7.4.3. Fortigate is 40F.While pushing any config to Fortigate below line automatically come sin the config preview. The installation faisl due to this config too.config web-proxy global set proxy-fqdn "default.fqdn" endbelow is the error getting. Any idea to fix this please.------ Start to retry -------- 40F-TEST $ config web-proxy global 40F-TEST (global) $ set proxy-fqdn "default.fqdn" 40F-TEST (global) $ end ---> generating verification report (vdom root: web-proxy global:proxy-fqdn) remote original: to be installed: "default.fqdn" <--- done generating verification report install failed 

Hi,Anyone knows if there is a way to export VPN User Connection Monitor Data to a report?

I opened a TAC case and they said my VPN was working fine but I cannot get it to work with my iPhone.   I am thinking of starting over and deleting the VPN configurations.    I appreciate anyone's help as to where do I delete everything on my iPhone and start over and where is the iPhone guide? Thanks, Patrick

Hi, I recently bought a Fortigate 100E via eBay and only to find out that it is still registered to a previous owner.I thought I can just reach out to the previous owner email and connect with him in transfgerring the license over to my email but only to find out that it shows FortiCloud and instead of showing up email, it shows 'Confidential'I reached out to Fortinet support but they don't recognize 3rd party vendors like eBay. If I subscribe to FortiGuard, can this be transferred over to my email? or it will still be the same where I don't get it to transfer to my email? Jeff

I'm brand new to Fortinet and am looking for recommendations for our new Fortigate 80Fs. Planning to open the boxes later this week.Looks like 7.2.9, 7.2.10, and 7.4.5 are stable, and are my most likely firmware candidates. We're not a large shop so we just have the two FGs in HA. We also need VPN stuff and NAT. I don't think we have any fancy feature requirements.I'm leery of rolling with firmware that released so recently. Browsed the sub a bit but still not really sure what one we should go with. This is going to practically be a new install. We have existing Fortigates that are not on 7.x.x firmware. The 80Fs will replace these. I have heard tell of configs needing to be converted, and our current config may be quite a mess. So this will practically be a new rollout.Any recommendations?

HiYesterday I had to disable full SSL inspection in our proxy policies due to poor browsing performance. Fortigate 200E running 7.0.15 No policy changes were made, and user numbers, session numbers and interface throughput are average for daily use. This is an edge firewall. I tested early this morning before most users were in, and still had slow performance. I tried restarting the WAD processes, to no avail. CPU and memory are both fine, with no change when DPI is disabled/enabled. I notice no change in CPU/SPU ratio when turning DPI on/off either. Any ideas where I should look to diagnose this, and has anyone else experienced a similar problem?  

 Hi All,I am new to Forticlient VPN GUI, there is no option for users to configure split Tunnel details when user select's Options as "Mode config".The Same is available for the "Manual Set/ DHCP Over IPSec.Please let me know how to configure the same.Once again thanks for your support.Best regards,Chandra.   

Hello , I run into this issues, internet -> fortigate -> fortiauthenticator (with reset password service)everithing working correctly also fortytoken service , but i would like to restrict the access only for request addressed to https://urlfortigate/portal/selfservice/reset_passwordthis url open a web page on 443 for reset password service.I wish to block every others web page that coming from internet to fortiauthenticator.i though a webfilter that permit only urlfortigate/portal/selfservice/reset_password -- simple -- allow* -- wildcard -- blockbut another configuration is put the firewall policy using a certificate inspection.If i use this config when the internet user can try to reach the fortiauthenticator web page to reset own password obtain that " you are not allowed to access this resource" ... i think is a fortiauthenticator message but i do not understand where this message born ... someone has tried to experience this issues ....thank you

Hi, The Fortigate 50G-SFP documentation does not specify whether the SFP port can function as a secondary WAN. Does anyone have information about this? Thanks!

many accept : DNS error 

Hello, I need to restore the Forticlient configuration in a new brand PC. I can restore all the value but the username for all connection is empty! Why? How can I do a full restore? Without user name do not make sense. 

Hi AllI am looking to migrate an interface on some Fortigate 100D devices from a 1Gig LAN with vlans to a 10G X1 interface.When I click migrate to interface and click "select and existing interface", the target appears to be blank, why is this?

Our health check has come back that our login pages are viewable over the internet.I have disabled HTTPS/HTTP over the WAN but page still shows.Any quick fix please?Thanks

Hi,I've looked on Broadcomm's (nee, VMware) support site, but I was hoping someone here has already delt with this and might share the port list to successfully connect 1 vCenter server to 1 host and 2 VMs over a site to sire IPSec tunnel. I'm looking to limit access of the whole remote network to the vSphere infrastructure.TIA 

We have some hyper-v VMs that we upgraded from 7.2.3 to 7.2.5 forticlient. SSL VPN no longer works after upgrading.We can repeat the problem by downgrading to 7.2.3 and then successfully connecting then upgrading to 7.2.5 and breaking it again.we need to run 7.2.5 to fix a wild card FQDN issue with ztna destinations that we were experiencing on 7.2.3.

Hi everyone. I have installed EMS on the same server that a File Server. (Windows enviroment)One day, the app was working fine but on the next day just didn't and shows this error when i try to execute.The Apache service isn't working and i cant run it.Event Viewer show the next errors: The Apache service named reported the following error:AH00015: Unable to open logs . The Apache service named reported the following error:(OS 10013)Intento de acceso a un socket no permitido por sus permisos de acceso. : AH00072: make_sock: could not bind to address 0.0.0.0:443 Have PID 4 that SYSTEM is running on that port, when i'm trying to change the port from httpd.conf nothing happens Failed to load URL https://localhost/ with error ERR_CONNECTION_RESET (-101). 

Hello ,  i have  old device 800c with  Firmware Version v4.0,build0656,130211 (MR3 Patch 12)I want to ask1.  how to set Gateway Failure (Recovery) Actions for Link Health Monitor  ( 2 isp , wan 1  & wan 2 )2.  is it possible upgrade firmware  to  v5 or v6 ?  please suggest   regard