Fortinet Community

Hi, i'm experiencing something strange...  Fortigate 1800F clustered running 6.4.12 (planned to be upgraded in October to 7.0.15)I'll narrow it down to it's most simplistic form...Two user vlans A and BOne server vlan CWhen running iperf between user vlans and server vlan C i see a considerable downgrade in download performance from vlan A.  Upload is perfect and saturates the 1 GBit interface.I don't see this issue from vlan B.  Both download and upload saturate the 1 GBit interface.All vlans go into one single trunk which is aggregated.  I ruled out switching.Strangely i see the issue dissapear after working hours.  Both upload and download saturate the 1 GBit interface from vlan A. Did a wireshark today during business hours in vlan A while running iperf.  Saw a lot of fast retransmissions, dup ack, tcp previous segment not captured, tcp out of order...   Reviewed the complete Fortigate vlan config.  Did not see anything wr

Hi, I noticed that in the most recent firmwares of Fortigate (I think from 7.0 or 7.2 onwards) many screens of the FortiExplorer program for Android do not load. The interfaces, for example, load correctly because they are displayed by the software itself: Ok interfaceswhile most of the other screens that are "rendered" by an internal browser of the program, do not load: problemThese screens that do not work are for example all those of Fortiview and Monitor.I tried more smartphones and more Fortigates by connecting to the local network and the problem is the same.

"Hello everyone,Currently, my company is using a Cisco 5525x FMC firewall system. In the near future, I am considering migrating to a Fortigate firewall system. However, I’ve encountered an issue that I haven't been able to resolve: when standing on the Fortigate firewall, I can't see the MAC address, domain users, or the OS of the devices. I know that using the firewall as the gateway could resolve this issue, and since the company’s system is relatively small, I have configured it this way—allowing the firewall to manage and detect all devices it scans. But that setup only works for smaller systems.For larger systems, I’m not sure if the firewall would be more powerful than the core switch. Therefore, I’ve set the core switch to handle IP address assignment, with the gateway being provided by the core. As a result, my internal users don't pass through the firewall when accessing the server for work, making the process faster. However, when users browse the internet or when I want to

hello guys i have this challenge on BGP neighbor for sdwan 

I am new to VOIP and FortiVoice setup, and I have been tasked with configuring a FortiVoice 50E6 survivability device.Is it possible to use any carrier with the FXO/FXS ports, such as a landline from a different carrier?Thank you.

Hi, We have an in-house web-based workspace that host our applications (iframe). So, our employees open the workspace and choose the relevant application from the applications list -and the application will open. Some of the applications are only available from office network – we need to create some VPN proxy so an employee working from home will be able to request access to a specific application and we will validate it and give him a temp URL that loads this application under a session created for him without him needs to connect his computer to the VPN. The process we are expecting is as follows:User request access to application AOur workspace application authenticates against the VPN serverapp_id, app_secretgot token in responseOur workspace application request for VPN session in the name of the initiator user.token, user email, URL (origin URL of application A)VPN server sends MFA (if defined)Our workspace application will allow user to enter the code and send it

Are there any specific commands that I can run on a FortiGate to check the following parameters of the FortiAPs associated with the FG:Number of APs associatedNumber of SSIDsNumber of Users/devices connected per SSIDTotal Number of Clients

I have been struggling with Forticlient for a few hours, It just hangs on "connecting"I have tried uninstalling and reinstalling but still doesn't work.my credentials are correct and triple checked.Please can someone help me

I have a core switch that acts as gateway for all the users.  10.10.10.254 Gateway (coreswtich) 1. I am seeing traffic from User IP but with core switch MACaddress.2.I am seeing DNS queries from host with core switch MACaddress to DNS Address that is not configured on the host. 3.I am seeing wrong IP address associated with this MAC (screen shot)4.I cannot delete it in devices (delete option is dimmed)how can i resolve this issue? 

Hi all,I would like you appreciate if you can share URL where only update the google chrome nothing else. Thanks in advance.

I have a simple word of protest. I have been perusing the security rating report and following those advices I find useful. However one thing needs to be said. Fortinet absolutely should not be using the security rating report to scold customers for not purchasing other licenses and devices. If those licenses are so essential, they should be included in what is already a very expensive system. Also scolding the customer for having devices that are not fortinet ("replace this device with a fortigate") smacks of anti-trust behaviour. Protest registered. Please pass it along. (I suppose I could have started a ticket, but this seemed a more appropriate way to say this. Of course if there was a general mailbox published I'd have sent this there.)

Hello Team,  I am configuring a new switch and I need to configure some interfaces as L3. This would a standalone switch so no fortilink whatsoever.  I know in cisco all I need to do is " No switchport"  on switch for it to work as a L3. However, I am not seeing that on Fortiswitch. Is there a way to do this? I have tried reading the docummentation but this is not clear for me. Thanks in advance!  Fortiswitch version is 7.2.4

Hello team, I successfully configured phase 1 and phase 2 ipsec vpn having private ip's as peers (WAN).On one side I have fortigate, on the other side Palo Alto.Both VPN phases go up but when I try to generate traffic I never get the return responses, either way.Fortegate side I see correctly routed traffic to the ipsec tunnel but I never see the replies. Palo Alto side is the same, I see traffic is routed correctly but I never see the replies.The strange thing is that seeing traffic routed correctly to the ipsec tunnel I would expect to see traffic on both sides. Following screenshot from either sides Any suggestions for troubleshooting?It occurred to me to try as a test to modify phase two by specifying 0.0.0.0/0/0 for both remote and local to see if maybe some NAT is present that I am not aware of. Thanks in advance for the supportBR 

Hi All, We are deploying a full-forti-site, with FortiAP's.We have a VirtualFG installed and configured, AP's signing in (Thanks DHCP Option config!) and are now starting to make WiFi Floor Maps.1: Maps from FortiGate does not sync to ManagerIf I create Floor Maps in FortiGate WLC, they do not sync back to FortiManager - why? 2: Maps created in Manager does not puch to FG.If I create WiFi Floor Maps in Manager, there does not seem to be any link to what FortiGate the maps are for, so they does not sync from FGM to FG.Even after putting AP's on the maps, there is no 'link' from that map to the FG that manage the AP's..  Can anyone tell me what the thoughs about this is?!?Do I really have to create maps on both platforms, that I need to manage two places?!? 3: AP Placement on FGM Google Maps?That is only the 'general location' from the FortiGate, not by AP.. it seems..?

does anyone know any documentation which explains about these interfaces (a bit more)? when i search i find the acceleration guides / pages on these devices, but nothing specific on their usage. i assume they point to sniffing and virtual wires, but is there something special associated or is it just a name like dmz or ha?

I have 2 - FG 200F's. I have HA configured. I have 1 FG WAN connected to a modem going to fiber internet. My 2nd FG WAN is connected to a modem going to COAX internet. So, 2 different internet pipes. "FG1" is primary, "FG2" is secondary. While in this configuration, I can access and ping the internet from each firewall. When I force an HA failover, "FG2" becomes primary as expected, however, once it does, I lose internet access and can no longer ping anything on the internet (from "FG2" via CLI). I am not sure what I am missing. FW: v7.4.4 build2662 (Feature)Active-Passive

Hello community, I have a FortiGate 80F with a serial number, but when I try to send it to the manager, the serial number presented for accepting the input in the manager is different. How can I fix this?

I only can edit a Windows App filter, but when trying to apply it to a secret, there is no option to enable it in Secrets settings

Hello,I'm looking for helpI have a point to point connection between two sites: the first sote i have fortigate 100E  with two internet lines and load valancing also multiple vlan... the other site is connected with one port of my switch the port use vlan id 240 in the other site the connection is bad so i decided to take second internet line  so i want to combine my connection with the second line i used my old fortigate 60d to do this is that possible to have same vlan in the second site with dhcp  and the site still accessible  because it didn't work for me

SHORT ANSWER AS PER SOLUTION - DONT USE CHROME OR EDGE WITH FORTIANALYZER :D Original post:I have a weird/odd problem around the FAZ web GUI where anything on the UI that has a drop down arrow option is non-responsive. The buttons have black boxes around them but when you click on them, nothing happens, no response, no additional options.All of the normal options and functionality works within the FAZ but it means I cant change date ranges when searching logs or even open the alert bell in the top right corner.I get the same behaviour in Edge and ChromeEdge - Version 114.0.1823.82 (Official build) (64-bit)Chrome - Version 115.0.5790.99 (Official Build) (64-bit) FAZ - v7.4.0-build2223 230514 (GA)Platform - FAZVM64-KVM I even went to the effort of installing the latest version of Java because you just never know... Example one: Example two: 

Hello.I have a FAZ-300G and an FMG-410G, both are on the same version 7.6.0When I try to add the fortianalyzer to my fortimanager it never manages to integrate, it generates errors, I have followed the instructions and created the same ADOMs and nothing. Something that I could notice is that the fortimanager detects the Analyzer with a version that it does not have, which is 7.4.0. I don't know if this would be the problem.What can you tell me?FAZFMGWhy does FortiManager detect FortiAnalyzer with version 7.4.0?

Good day,The logging disk on our Fortigate 101E has failed. We've received a replacement device via RMA. We do not have HA, so I chose to not transfer the license upon shipping of the replacement.  I've installed the FortiOS version we are currently running and restored the latest configuration. How quick is a license transfer when I'm ready to move to the replacement device? Is there any way to expedite the process? I've contacted Fortinet support and they haven't given me much information other than to say it could be up to 4 hours. Thanks for any advice/assistance. 

Hi, We need to update Fortimail which is in an Active-Passive HA architecture, but we don't know if we should upload the firmware image to the Primary Device and this Primary Device is automatically updated itself and the Secondary unit likewise similar to FortiGate with this architecture. Or on the contrary, we must update the Secondary Unit manually, set this unit as Primary and update the unit that was previously primary. Could you please resolve this doubt?  Thank you all.  Best regards.

Hi, i'm trying to use the cli in Forti Manager 7.0.12 to script a policy. config firewall policyedit 0set name "test-policy"set srcintf ZONE_LANset dstintf ZONE_LANset srcaddr test-1set dstaddr TESTGRPset service TCP_5000-6000set action acceptset profile-protocol-options PROXY_FILTERset ssl-ssh-profile SSL_FILTER_CERTset ips-sensor IPS_FILTERset application-list APP_FILTERset inspection-mode flowset internet-service disableset nat disableset logtraffic allset schedule alwaysnextend I can run this script successfully.  No errors.  However in the gui the policy does not contain the APP and IPS filters?Any hint? 

Hello, everyone. I'd like to know how to block specific app that appear on the FortiClient EMS software inventory in the following image: