Fortinet Community

I have some unused FortiTokens in one of my FortiGate devices, and I want to transfer them to another FortiGate device. How can I do that?

Hello Everyone  I am using 2 x Fortigate Firewall 100F firewall in HA Active-Standby with latest firmware. Both the devices are sync with each other. I have configured both the firewall with Dedicate Management Interface and also enabled SNMP service on it, so Can access both the firewall at the same time. I configured SNMP V1,2,3 and trying to add that device in NMS tool WhatsUp Gold, but always saying credentials failed, I have verified the NMS credentials with FIREWALL and checked with Multiple Auth and Priv and with no Auth-Priv as well, without luck. What might be the issue. 

Was just running through some clean up and auditing some processes and wanted to get some thoughts of what others might be doing in regards of having both ISDB (https://community.fortinet.com/t5/FortiGate/Technical-Tip-Blocking-Potential-threats-over-Internet-service/ta-p/249760?lightbox-message-images-249760=19852iE55DA05DD8C258A4) and Threat Feeds applied to policies and profiles? As inferred by the link provided, I have deny policy tied to those ISDB services but I also have Threat Feeds to my local ISAC (https://www.cisecurity.org/) I am a member of as well as Cisco Talos, for example, that I tie to policies and profiles.  So in a nutshell, do you think FortiGuard is enough for you or do you "cover your bases" with 3rd parties... just in case? (and this is assuming you don't have any resource concerns).   

I have followed the steps from the video tutorial https://youtu.be/YKKKlChsVVY?si=Zn7R65ElK76dbgkkHowever, despite having followed all the steps I get the following error when trying to update time from Internet Time Settings: An error occurred while Windows was synchronizing with X.X.X.X. This operation returned because the timeout period expired. The clock was most recently synchronized on 9/19/2024 at 12:02PM. Every time I click on Update now, I get the same message and the part where it says the clock was most recently synchonized on X day at Y time gets updated to the current date and time. Could somebody tell me what have I done wrong or what do I have to change?

Hi,Are there any way to set it up so that specific users can only log in to the VPN at specific time range?

Is FortiGate 7.2 stable enough for production environment?  Any known major bugs?  I have a simple 4 site implementation using FortiAnalizer, FortiManager, WebFiltering, FortiAP, and FortSwitches.

I feel like I've checked every guide, but not having success.  I'm trying to have DHCP via tunnel interface so I can assign a static IP to a user.  Users are connecting via native iOS client on iPhone/iPad.  When I have phase1 give out the IP, it works fine, I just can't find a way to reserve them.  Any insight would be great!config system interface    edit "MobileVPN"        set vdom "root"        set ip 192.168.50.1 255.255.255.255        set allowaccess ping        set type tunnel        set remote-ip 192.168.50.1 255.255.255.255        set snmp-index 25        set interface "wan1"    nextendconfig system dhcp server   edit 4        set dns-service

I have FortiGates in HA (A-P) but recently when a failover happened, I noticed on the the vdom didnt failover also noticed when looking at the route monitoring on the secondary FG that the connected routes were deleted. only two or three were left.  Not sure what the reason is for this because the FGs are in sync.#fortigate #ha #failover

I've upgraded to FortiGate Cloud Premium and seem to have lost the ability to manage firmware profiles. Is this a 'coming soon' feature or do I need to manage this differently now that I've upgraded?

I am looking for Fortinet documentation on installation and maintenance in a non-persistent multi-session (RDS) VDI environment of Forticlient EMS. Any help would be greatly appreciated!

A customer-facing FAQ is available in the FortiSASE Admin Guide for existing FortiClient EMS customers interested in shifting from FortiClient EMS to FortiSASE for endpoint management:https://docs.fortinet.com/document/fortisase/latest/administration-guide/90443/shifting-from-forticlient-ems-to-fortisase   This FAQ provides guidance about licensing and FortiSASE configuration for endpoint management for these cases: 1. Existing FortiClient EMS on-premise deployments2. Existing FortiClient Cloud deployments   As part of this shift to a FortiSASE deployment, new configuration of endpoint management features must be performed in FortiSASE: Existing FortiClient EMS or FortiClient Cloud configuration is not preserved because FortiSASE uses its own EMS instance. FortiSASE does not support some FortiClient EMS features. To assist customers with new deployments requiring endpoint management features, see the 4-D FortiSASE endpoint management deployment guide:https://docs.fortinet.c

In today's fast-paced digital landscape, the network edge has become a critical battleground for businesses. It's where users connect, data flows, and opportunities arise. But managing this dynamic environment can be a complex and time-consuming task, especially for organizations with distributed networks. That's where FortiEdge Cloud comes in, offering a powerful and intuitive cloud-based management platform that simplifies network operations and empowers businesses to thrive at the edge.   Single Pane of Glass Management FortiEdge Cloud provides a centralized platform for managing your entire LAN and WAN edge infrastructure, including FortiSwitch, FortiAP, and FortiExtender devices. With its intuitive interface and powerful tools, you can easily configure, monitor, and troubleshoot your network from anywhere, at any time. The platform's single pane of glass view eliminates the need to juggle multiple management consoles, streamlining operations and saving valuable time and resou

Hello all, I'm trying to setup one of my FG's to use iperf3 and the FG I'm trying to use is using port x1 for the WAN connection but I can't pick this port using the command diagnose traffictest client-intf portx1 If I pick any other port it will select that port, but that doesn't help since my fiber is on x1. The port is setup as SD-WAN zone. Thanks  

Hi! On one hand, Fortinet warns "Packet capture can be very resource intensive. To minimize the performance impact .. use packet capture only during periods of minimal traffic ... and be sure to stop the command when you are finished." But, on the other hand, (in 7.0) FortiOS allows almost indefinite execution (only limited by maximum packet count which can take indefinite time to meet.) Using CLI, is it possible to show currently active packet captures on the device (ie. both - those provisioned under "firewall sniffer" or activated using "diagnose sniffer packet")? Thanks, Feren

I want it to work with remote gateway for PS Suite EMR from Telus Health.My laptop is the latest copilot Samsung.I contacted their customer support but they have no answer. ThanksRad

Hi!FortiGate / FortiOS 7.0.0 FortiOS Release Notes introduces:677784Add commands to debug traffic statistics for traffic monitor interfaces (interface), interface traffic in real-time data (peek), and to dump interface traffic history data (history):# diagnose debug traffic {interface | peek | history}without further elucidation. Anyone (esp. Fortinet) can provide clues on use-case and usage? Thanks, Feren.

How to get email alerts of for lost internet connectivity Fortigate 120GI have Two ISP.Pls guide Procedure to configure 

Dear Friends, I am facing the connectivity issue from 172.28.140.10 to 172.47.7.1 w.r.t port 6712.Can you please help  e understand the issue from below debug logs ? 2024-09-18 09:44:15 id=65308 trace_id=35526 func=print_pkt_detail line=5836 msg="vd-root:0 received a packet(proto=6, 172.28.140.10:19311->172.47.7.1:6712) tun_id=0.0.0.0 from Lan-Zone. flag [S], seq 1197133717, ack 0, win 64240"2024-09-18 09:44:15 id=65308 trace_id=35526 func=init_ip_session_common line=6020 msg="allocate a new session-2e378527"2024-09-18 09:44:15 id=65308 trace_id=35526 func=vf_ip_route_input_common line=2612 msg="find a route: flag=00000000 gw-172.28.254.2via wan2"2024-09-18 09:44:15 id=65308 trace_id=35526 func=__iprope_tree_check line=528 msg="gnum-100004, use int hash, slot=35, len=13"2024-09-18 09:44:15 id=65308 trace_id=35526 func=fw_forward_handler line=985 msg="Allowed by Policy-345:"2024-09-18 09:44:15 id=65308 trace_id=35526 func=np6_hif_nturbo_build_vtag line=1227 msg="vtag-&

Hi,although I had a talk to tech support, It has developed, that I still have questions to this, while reading  How to control Automatic Upgrades/Firmwar... - Fortinet Community As it says that all FGTs with the free tier forticloudsubscription will get automatic firmwareupdates and you cannot turn this off. You only can set the time, when the firmware will be installed. So in my words: All my FGTs running 7.0.x to 7.2.x with no active but free-tier forticloud-subscription will begin to get firmwareupdates to the latest patchrelease of the installed FortiOS. Atm this would mean I will get the 7.0.15 at my 7.0.x FGTs for example, starting with Nov 2024. (if not installed). They will not do a major  to 7.2.x or 7.4.x (coming from 7.0.x) but will autoinstall 7.0.15, or the latest Patchrelease of the 7.2.x or 7.4.x. I have no option to opt out of this (with the free tier forticloud). Thanks!

I have a foritgate 600E with fortios 7.4.4 used as a proxy, and I created a new proxy policy with web filter security porfile to blocked the webmail and instant message websites. It block the websites with the broswer's block message instead of the replacemnt message (Blocked Page) of the FortiOS for all https website.Below is the case i have try:1.  Web Filter Profile (Flow-Base) + SSL Certificate Inspeaction2.  Web Filter Profile (Flow-Base) + Full SSL Inspeaction3.  Web Filter Profile (Proxy-Base) + SSL Certificate Inspeaction4.  Web Filter Profile (Proxy-Base) + Full SSL Inspeaction the CA cert of foritnet is installed in my computer and the replacement message of Application Control is wokring fine.

Hello, I have a problem with establishing SSL VPN connection and I had the same error in var/log/forticlient/sslvpn.log for few versions of forticlient (latest, this one i.e. 7.2.3.0790 and some other 7.4.x versions) [sslvpn:DEBG] vpn_connection:307 SSL error: error:0308010C:digital envelope routines::unsupported[sslvpn:EROR] vpn_connection:463 Failed parse PKCS#12 file[sslvpn:EROR] vpn_connection:1528 Failed create SSL I found this article https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-verify-the-ciphers-used-in-a-PKCS-12/ta-p/327734 but i can not apply the suggested workaround since i can not import public an private part of the p12 separately in forticlient vpn ( the article explains similar problem for fortianalyzer) I would isolate these errors as the most important, but i would like to mention another one appearing, also which is:ns:203 Failed to open /etc/nm_resolv.forticlient.backupI tried installation from repo and dpkg also. The

Hello Fortinet Community,I’m currently looking for a solution that can manage multiple firewall vendors, including Fortinet, and others. My goal is to streamline firewall policy management across different platforms from a single console. Unfortunately, I can't purchase FortiManager or Panorama as I don't have the budget for either of them. Does anyone have any recommendations or insights on tools or platforms that can handle this multi-vendor management effectively?Thank you in advance for your suggestions!

Hello, I have an odd problem.  A user (and SSLVPN users generally) were able to access a network segment which they are no longer able to while using a split tunnel.  All of a sudden, traffic appears to be timing out when trying to access certain addresses on a portion of the exported subnet that should be accessible. Shown above in the 1st 4 are the configuration on the fortigate for the SSLVPN.  shown below in the last 3 are the route table on the user's device, as well as the output of their ipconfig /all showing both their Forticlient virtual adapter, and their physical wifi adapter.the user can ping 10.55.4.* addresses, but not 10.55.5.* addresses Thank you,Matt

Hello team, This is a stack with 2 Fortigates 100F (A-P)We found in "FortiView - Sources", a machine with "30" in the column "Threat score", all the others had 0When I drill down, I found the followingThis was: biserka.xyz (phishing).I have tried to find any log with more information about this but without luck.¿Do you know where can I find more information? Thanks in advance.Regards,Damián