Fortinet Community

My plan is to restart my firewall, test the disk, and monitor if issue will still reoccur. Moreover, I wanted to know if there is a way for the firewall to stop monitoring the status of a USB flash disk partition. The USB flash disk partition contains config file and firmware which we would use to restore the firewall. To give you a background, our HA has failed over because of this SSD failure. Thank you!

Hello,Normally when a packet comes to FortiGate, firewall follows the way https://docs.fortinet.com/document/fortigate/6.4.0/parallel-path-processing-life-of-a-packet/86811/packet-flow-ingress-and-egress-fortigates-without-network-processor-offloading What about the answer packet that comes to same session ? Here is the scenario1- I sent a FTP Put Request to a server, that packets goes over the firewall 2- Firewall process the first packet based on the the parallel path processing like in the link that i have shared. Create a session and sent packet out to FTP Server based on routing table3- Then server response with FTP Put Response, paket goes over firewall to FTP client again--> at this third step how does firewall process packet ? I believe it checks the session first and when there is a session how is the next steps ? do we have a link that fortigate shows that? Because i believe that packet will be forwarded out of interface that packet comes to firewall and doe

My company uses forticlient vpn (usually for windows). I use Ubuntu and have installed version 7.4.0.1636. When creating the ipsec connection I can't find the advanced options that are in the windows client (I have to add localid to phase1). So the Linux version is limited? I also tried with network manager, but I have the same problems here too :) Has anyone had something similar happen? Thank you.

Bandwidth utilization alert it is possible to configure in the Forti Analyzer , 

Hello All, Need help on below points  1. purchased an fortianalyzer license of 500gb/day whose part code name-VM-GB500, but when i checked it shows vm10k-ug. is it correct/same license what i purchase or differs. PFA snapshot 2. Mistakenly i have register fortianalyzer vm on incorrect portal account and now needs to move to another portal account. Can i do it without any production impact 

Hi Team, We are wanting to Block Artificial Intelligence Category in our Webfilters but every time we mark this Category as blocked and save webfilter and again open this so that category always mark as Allow, This is a some king of bug in Webfilter.Product :- FortiGate 60FVersion :- v7.2.8 Build 1639(Mature). Pls help us to get rid of this bug.

The CF card in my MC1550 got corrupt.  I managed to salvage some of the contents, but I was not able to salvage the consistency of the filesystems.  Hence, the controller does not boot.  Could someone (@jbattam_FTNT ?) please help me with the necessary image file(s)?  My current installation ran on 7.0-8.Regards, -Frode 

I own a Fortigate 60F. I'm a contract worker, operating from home. The company I'm working with demands that I'm behind a firewall which is set to reject ALL TRAFFIC except only needed services and web sites, just so there is maximum rejection of anything from the outside. I have also purchased the package which has IPS so that I'm in compliance, as they are most concerned with asset egress. It's Draconian, I know. My question is, what is the most efficient way to configure for this, using the fewest policies? To simplify, let's assume I need the following 3 "essential" things: 1. The company's Okta site, we'll call it "company.okta.com"2. Ability to sync with the Dropbox service3. An Apple file server, let's call it "afp://server.company.com For example, I can't tell whether using the Web Filtering is better than an individual policies which specify FQDNs, etc.Is it best to create a policy just specifying Dropbox's "Internet Service" services? Or some other method?Thank

we are settinng up our own networking monitoring tools using Opmanager.what is the proper way to configure snmpv3 for our fortigate firewall so that the Opmanager can recognize our firewalls ?

Hello, wonderful people.It intends to register the license of FAZ/FMG (VM64)It will be conducted in a closed network, so I will work on it after opening only the services I need to register a license.I'm trying to communicate with the license server, please let me know the information such as ip, port, etc. you need.We will also proceed with the firmware OS upgrade.What should I do with the order of license and OS upgrade?Thank you for your interest.

I'm new to fortiswitch stacking and just looking fort some clarity around the redundancy of the cabling .  If we have a pair of 448E switch in our Distribution layer (configuration of MCLAG) and I then want to connect 4 access layer switches (148F Series) - How would I stack these / Cable them? would this be correct?Do the 4 access layer switch need to daisy chained + switch 1 and 4 connect to disti layer?    

Hi Everyone. VPN to VPN IP is not pingable, we use forticlient as vpn. We tested to create an inbound and outbound policy in fortigate(VPN to WAN, WAN to VPN), but doesn't resolve the issue. Can someone guide me how to solve this issue? Looking forward from your responses, thanks.

Hello, has anyone already integrated IDP with keycloack?I made several attempts, but without success.Fortigate side:User & Authentication > Single Sign-OnI performed all configurations like IDP remote cert, IDP configKeycloack Version 25

I have FortiClient EMS Cloud and so far I have been sending out invitations to my users so they can download the client and use the CODE from the invite to register to the EMS. However, support has told me that to manage auto updates I need to create an installer for all my users some how deploy the installer to the users.  Yet, it seems to me that Manage Deployments is really for auto installing on AD Servers/ Clients.  But this probably will not work for MACs.  Nor would this work for users who's machines are not port of the Domain. So that seems to mean I need to create FortiClient Installers for users.  And give them the download link.  Only 2 problems with this method that I see.  I do not have an updated Client yet.  (Not sure its been released yet.). So if I give them the link now they will just end up re-installing the same thing they have now. Am I going down the correct path?  Are there any better docs on this then FortiC

Helo all.I have issue after reinstalling my computer to latest Windows 11. I've installed Forticlient 7.2.4.0972. I has two profiles that uses personal certificates and username an password. I has also two certificates with private kyes in Windows Key store in Presonal Certificates folder. When i try to connect to VPN in drop box i only see one certificate, even if i have installed two personal certifiactes. When i try to create new connection, i see both certificates, but after saving new connection i can't see one of the certificates in drop box again. I've tested this on two independent computers. My college also try to import my certificate on his computer (Windows 10 and older Forticlient version) and he see certifacate and is able to connect to VPN. I appreciate any help.Thank You

Hello, following this configuration scenario, what I configured is a redundant that looks towards the primary router and the secondary router and put the monitor of this redundant under it, in case a link of this redundant goes out it automatically switches it to the secondary or does the primary remain active?PRIMARYconfig system haset group-id 2set group-name "FGT-HA"set mode a-pset hbdev "ha1" 50 "ha2" 60set session-pickup enableset override enableset priority 250set monitor "Redundant"endSECONDARYconfig system haset group-id 2set group-name "FGT-HA"set mode a-pset hbdev "ha1" 50 "ha2" 60set session-pickup enableset override enableset priority 150set monitor "Redundant"end BR, Giuseppe

Hello, everyone! I am facing a question regarding custom scans on FortiNAC.Currently I have a scan to check for my AV service. Every once in a while the network agent gets updated and the syntax for the service name changes. After that, all my hosts start to fail the scans.Is there anyway to turn the service name into a regular expression? Let's say, instead of checking for a service "ABC.20.17", am I able to check for "ABC.20.*" for any patch version of the given service? Tried on my lab environment but did't work. Appreciate the help! FortiNAC 

I have been watching Rumble on my network for years.  Suddenly, midmorning today, I could no longer watch videos on Rumble.  Most of the images on the home page are blocked.  When I try to start a video on my PC, I get no video feed just the html page. When I attempt to watch videos on my Apple devices with access through my Fortigate, I get the video for the ads, but the main video will not run. I also get a message in the video box which says, "The certificate for this server is invalid".  When I access Rumble on my Apple devices using cellular data, everything works perfectly. There is no issue viewing YouTube, or any other sites I have tested. There have been ZERO changes to the configuration on the Fortigate.  The bios is up to date, and last update was several weeks ago.  Rumble video was working for most of the morning, then suddenly stopped midday with the issue describe above. Has this happened to anyone else? 

Hy @ all, I am dealing with a stupid problem on forticlient. I have 2 PCs, both are running the same forticlient version (7.2.3). One pc is located in austria and one pc is located in china. Both PCs have the same config-file. The firewall is located in china.the clients gets authenticated over ldap integrated certificate authentication. The Fortigate is an 80F, with Firmware 7.2.8 When i connect the forticlient from the pc, which is located in austria, it works fine but when i do the same thing from the pc, which is located in china, the connection fails. This is the debug applicaton output from the pc from austria: fg1-nan2 # diagnose debug application sslvpn -1 Debug messages will be on for 30 minutes. fg1-nan2 # diagnose debug application fnbamd -1 Debug messages will be on for 30 minutes. fg1-nan2 # diagnose debug console timestamp enable fg1-nan2 # diagnose debug enable fg1-nan2 # 2024-07-11 13:00:05 [208] __fnbamd_remote_ca_refresh- 2024-07-11 1

version : 7.2.3.0929 when i put ID/PASSWORD, i can see status : connecting... forever.. and no raise up percentage. just connecting.im sure connection setting. whats the problem? 

I am using jazz internet in my home. But the speed is very terrible. How can I boost the speed?

Discord is a professional messaging app that is clean and swift that I use daily during work and I need it very much. I am tired of your filter blocking it.

helloI have two FG 30eI CONNECT between fg1 and fg2 (connected by SD-wan) site to site no NAT1...when i connected site to site it is working but clients cannot open any URL by SD-wan( I put routing to SD-wan and put IP policy to allow  traffic but no work)2...i can ping from client that connected from fg1 to clients connected to fg2 but fg2 can not ping to any IP in fg2 whycan help me please

HelloI have FotrtiGate100FI have 3 building in my company each building has connection to MY FortiGate Building A - connect to port 17   ( I create VLAN 10 for LAN and  VLAN 11 for AP )Building B - connect to port 18   ( I create VLAN 12 for LAN and  VLAN 13 for AP)Building C - connect to port 19    ( I create VLAN 14 for LAN and  VLAN 15 for AP)I need All AP  in all Building to take IP Address from same range anyone can help me thanks for allbest regards.

Hi, When setting up a new ipv6 policy, i'm unable to select  "sd-wan" as outgoing interface, getting error "Failed to save some changes: Input value is invalid." What could be the cause of this?No other ipv6 policies are configuredOnly "Any" as Outgoing Interface is accepted. for ipv4 policies can be configured with sd-wan as outgoing interface. running FGT-90D v6.0.14SD-WAN ipv6 should be available as of 6.0 Anyone who can point me to the right direction where to look at? thx