Fortinet Community

I have some interesting home requirements which has me looking into smb ish products and i ran into the forti series.My Orbi with 5 AP is not functioning correctly.If i scooped up a FortiGate-80F-POE 8 X GE PoE ports, 2 x RJ45/SFP shared media WAN ports. Could i directly use it with the fortiAP access points? Or is there a separate wifi ap controller I’m missing?I have existing cable modem and unmanaged switches. Also planning on throwing away 5 netgear orbi rbs50 but if i could reuse them that would be neat.Do you all have any idea on licensing costs? If i needed 5 access points (also only 4 users)

How do I display a MAC Address on a port in CLI - Currently have OS 7.4.2.  This should be very simple but cannot find any documentation.   Also, in the GUI, how do I clear the MAC and IP info when a new device is plugged into the port.  It shows the old MAC and IP even if I bounce the port.

Hi, We are replacing a FG-80E with an FG-81F (7.2.8) and hit the following issue when changing the external IP address for our VIPs from test to live that the live DMZ machines are not contactable from the internet. We have setup the FG-81F with a temp external IP address A.A.A.100 and two VIPS A.A.A.101 and A.A.A.102, these are both mapped to 10.10.10.13 and 10.10.10.14 and a test Linux machine is sitting there and is quite happy, it can be contacted from the outside and ping to the outside world. So it seems that the firewall policies are happy. When we replace the IP addresses with the actual live ones A.A.A.50, and VIPS with A.A.A.51 and A.A.A.52 then our live Linux servers (10.10.10.13 and 10.10.10.14) can not be contacted externally and they can not ping out. They can be contacted from the LAN->DMZ though, if the machines on the LAN contact them via their external IP addressed they can, however external machines can not contact them. The only changes we mak

Is it possible to use Wildcard FQDN on SDWAN Rules? I am only seeing KBs related to firewall policy and wildcard FQDN:https://docs.fortinet.com/document/fortigate/6.4.8/administration-guide/217973https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-a-wildcard-FQDN/ta-p/196118 Is this the reason why the traffic is not working as expected because the wildcard FQDN cannot be used on SDWAN rules? I am currently in 6.4.x Thank you!     

Good evening,  I want to realize / convert a Cisco config into a Fortigate as follows and would like to receive advice for this:Currently I get the following static public subnet from my provider via PPPoE x.x.x.81 255.255.255.240The first IP-adres x.x.x.81 is used for our Cisco. The additional IP addresses are used for tenants within a multi-tenant business premises. x.x.x.81 /28 is assigned to a sub-interface as follows interface GigabitEthernet0/2.200description VLAN200encapsulation dot1Q 200ip address x.x.x.81 255.255.255.240ip tcp adjust-mss 1452 Then the PPPoE interface is configured with ip unnumbered as below: interface Dialer1mtu 1492bandwidth 100000ip unnumbered GigabitEthernet0/2.200ip nat outsideno ip virtual reassembly inencapsulation pppdial pool 1dialer group 1ppp pap sent-username xxxxxxxxxx password 7 xxxxxxxxxx The VLAN 200 is then forwarded, together with various other VLANs, via a trunk port to an access switch.Where necessary

We have a a Fortigate 60F in our possession which was supplied by our previous provider (a local council). They no longer exist as of 2 years ago and their IT services disbanded. I don't want to ewaste what is a decent bit of kit, and it's registered to the defunct organisation even after factory reset. We don't have receipts or anything other than confirmation that a Fortigate was provided, it doesn't even mention the model let alone anything like proof of purchase, serial numbers etc. what are th chances of Fortinet releasing it for us?

Hi,my macbook pro just has been set up for a vpn connection, for home office. As I tried to connect from home I allways get the Error code: 0x204.When connecting via iphone, everything is fine. Is there anything I should change in the settings of my modem router?Any help would be much appreciated.Wolf

Hi guys, I am trying to setup a hub and spoke topology using ADVPN with branches on VPN dial up. The Hub has 2 WAN interfaces with public IPs but on the other hand the branches sit behind 2 CPEs (2 different ISP connections). Saying that, the 2 wan interfaces of the branches get private IPs from the CPEs. I successfully get the branches to establish VPN dial up connections to the hub using their WAN interfaces and as a result, I have 4 VPN tunnels with the following structure. Tunnel 1 Hub WAN1 - Branch WAN1Tunnel 2 Hub WAN1 - Branch WAN2Tunnel 3 Hub WAN2 - Branch WAN1Tunnel 4 Hub WAN2 - Branch WAN2 The above scenario works ok but the problem starts when we want to add more wan connections to both Hub and branch. If the Hub and branch have 3 WANs then the tunnels become 9 and so on. I would like to make the branches to use a loopback interface as an initiator on the dial up VPN connection so I can minimize the number of the tunnels. So in the scenario with 2 WAN int

Hello!In my network I have a separate VRF 20, and I need to push traffic from certain users in it. VRF 20 has connectivity to internet via interface vlan96-14:  gw (root) # show system interface vlan96-14 config system interface edit "vlan96-14" set vdom "root" set vrf 20 set ip XX.XX.136.238 255.255.255.248 set allowaccess ping set type emac-vlan set src-check disable set role wan set snmp-index 51 set interface "vlan96" next end   VRF 20 is connected to main VRF 0 via NPU vlink:  gw (root) # show system interface vrf-main-to-20 config system interface edit "vrf-main-to-20" set vdom "root" set ip 172.16.255.1 255.255.255.252 set allowaccess ping set snmp-index 53 set interface "npu0_vlink0" set vlanid 4020 next end gw (root) # show system interface vrf-20-to-main config system interface edit "vrf-20-to-main"

Hello Team I created 6 VLANs on an interface, I want to configure a rule to communicate 5 VLANs to one, but I can't find how to do it. The single way is set one by one rule. Does anyone know how I can do this? Regards

TCP port 514 in FortiAnalyzer >> custom certificateDuring a recent vulnerability security scanning, TCP port 514 has been flagged out to be have weak SSL cert.The recommendation was to get a propert SSL certificate for the appliance.. but there is no option to do this..Under the FA admin console we can upload only custom ssl for web access on port 443, but I can't find the option for ssl on port 514..I will be grateful for any advice how to set ssl from internal CA for this service on port 514. Thx,

I have a serie of tunnels IPsec VPN stablished from the Fortigate FortiGate-200F (On-prem) toward AWS console over a Direct connect, during a maintenance window of my provider, the Direct connect had a slight flapping and it recovered , but all tunnels kept down as if they could not negotiate the IKE singnaling.  After throubleshooting the virtual interface had to be reset to reestablish the tunnels. My doubt is why the tunnels could not be restablished by themself. The current version is v7.0.14

Hi People I need to create an automation to save all the malicious addresses that the FortiAnalizer collects/analyzes and automatically save them in a group of addresses for me to block them from the firewall. I want to know if Fortigate and FortiAnalizer can do something like this. I have the FortiSOC version available if it is necessary to do it with Playbooks. The truth is that I did not find anything like that. 

from time to time FortiManager 7.4.3 tries to "modify" my CLI template from "config system global" to "config 1 system global" when pushing to FortiGate Firewall 60F/100F/200F. I can force this error by "retrieve config" and pushing "policy package AND device settings" afterwards. Pushing ONLY device settings works and does not have this issue and once only device settings are pushed policy also works :) Does anyone else have this issue or maybe a solution?  Thanks...

Hello everyone!I was wondering why is not possible to assign named address to SD-Wan, or I'm missing some option/configuration that enables it.For example:I have this static routesAnd I want them in a single static route with named address I'm using a Fortigate 100E with FotiOS 7.0.12 Thank you for taking the time to read my question and for any help you can give me.

Hi,large environment...Fortinet Firewalls and Proxy in top of the structure...I do not manage or access them, but definitely can report about problem or the solution found to my issue. The situation:1. Outlook 365 in place. Most of the users accessing e-mail through Outlook web.There are no problem when accessing e-mail using web browser. However, the users (including myself) who do use Outlook 2016 client experiencing the certificate error pop up on each Outlook opening and sometimes during the day even when it is opened.Clicking Yes or No doesn't change the ability to use Outlook 2016.Sure it is not a solution, but just to be sure I tried to install the Certificate for Current user and Local machine manually. If I had a certificate in hand, may be deploying by GPO could be a solution.But with all being said, I have a feeling that the issue could be simply fixed on Fortinet proxy.  2.  The info I am getting in the message is a bit

UPDATE: I developed a solution that allows a TCL script to send an email. See article here. I have a customer that would like to run CLI/TCL scripts from FortiManager that validate the status of firewall policy and security profiles and report back the results to users. There are two ways that this might be done.1) Run the CLI/TCL script and email the script output to an email address.2) Write the results of the script output to a HTML file which is published as a custom web page and is available to users via a special URL that is hosted by FMG. (I mention this option because it is indeed possible to write to files using TCL scripts in FMG. So there is nothing to stop a TCL script from creating HTML files with script results contained therein. But there is no link to the files that makes them available to the FMG web service. So this option would need a soft link from the user space file storage area to a URL path in the FMG web server. That would be a pretty easy feature to add t

Good afternoon I upgraded the firmware of a FortiGate 60E from version 7.2.8 to 7.4.4 and once in the new version, the APs stopped working. In fact I don't see them in the "Managed FortiAPs" section, but I do see them in Dashboard -> Assets & Identities.It's a fairly old FortiAp, but up to version 7.2.8 it worked just fine. Is there any way to fix this problem? Thank you very much in advance.

Hi Team,I hope this message finds you well.I need clarification regarding the configuration of SAML authentication with a user-based policy for a customer. Here is the situation:We have successfully configured SAML authentication, and it works when users are directly connected to the LAN.However, the customer has now deployed TP-Link wireless access points (AP), and users are unable to see the authentication page.Based on my research in the community portal, it seems that to configure SSO with a user-based policy for wireless users, the Forti-AP SSID needs to have the Captive Portal enabled and mapped to the Azure portal.  Could you please confirm if enabling the Captive Portal for wireless users is indeed necessary in this case? Additionally, if the customer is not using Forti-AP, what alternative solution can be provided to ensure that wireless users can successfully authenticate? I would appreciate your prompt response as we need to implement a solution as soon a

Dears, Does anyone have threat intelligence feed connector configuration with FortiEDR? Like  URL: Collection ID: Authentication:     BR, 

Hey!I need some advice from you guys on where to look for the problem.The network diagram looks like thisWORLD -> FG30E ->2x MikroTik -> 3xESXI 1xNASTesting the link from FG -> WAN Using the command diag traffictest run -R -c 45.147.210.189 port 5200 I am getting speeds from 600 to 900 Mbits/sec so let's say its OKThen I test the connection speed between the FG30E nad Debian Server. I set up iperf3 on a debian server and connect to it from FG30E In this case I get speeds from 916Mb/s to 950Mb/s, so MikroTik switches don't slow down the linkIn the last step I make iperf3 from the Debian server to the same address as the test with FG30I have speeds between 4 and 6 Mbps....I also tested the speed from a NAS server which is not virtual, the same thing happens...Where to look for the problem because I have no idea anymore....

Dear Team,After installing FortiClient Version 7.4.0.1645, I am getting this error and couldn't connect to my Fortigate 81E with firmware v7.4.4 build2662 (Feature). It used to work fine before without any issues but I feel it was cased either by firmware upgrade or FortiClient upgrade.   

I have searched high and low, but cannot get a clear answer on this, created a CSR last year for a Fortigate, got it signed by ROOT CA, installed cert and used it for SSL VPN, no problem at all. Now its renewal time, got the new cert from the signing authority GODADDY, and I cant install it?  I have the ROOT CA cert on there, so I goto Certificates > import > Certificate > Local certificate, select my .cer file and I get this "Certificate file is duplicated for CA/LOCAL/REMOTE/CRL.cert"  I assumed I would delete the old one and replace with this one, same issue? any help please? the troubleshooting link for this error is not helpful, I really dont understand why it doesnt work Thanks

Hi Everyone, I'm facing a strange problem, I have 2 usernames which are working fine on different machines but on some specific machines as soon i hit connect it got stuck on connecting with no progress. I'm facing this issue on windows 10 pro machines. personally i have tested it on windows11 and it's working fine on them. I'm unable to see any logs when the user is stuck on the connecting stage.   

Recently I have upgraded two clients to the newest firmware released for Fortigates, 5.0.5. Both clients heavily utilize iOS in their environments and somewhere along the upgrade path to 5.0.5, iOS traffic seems be down right blocked or they start downloads but the downloads are never successful. By blocked, the user will attempt to download iOS updates, iBooks, applications, etc and either the download never starts and eventually times out or the download does start but only gets a few Mb in before it stops. One client has even reported this extends to Mac users attempting to use iTunes. Besides the firmware upgrade to 5.0.5, nothing about these clients networks have changed. Each are using different wireless setups, different switching, etc. One client has a Fortigate 100D and the other 2x300C in an Active-Active HA cluster. During testing with each client, I have disabled everything down to the web filter. With the web filter active, the problems exists but with the web