Fortinet Community

Hi everyoneI have a problem when pushing configuration from Fortimanager to Fortinet firewallI used Fortimanager version v7.2.5-build1574 with evaluation license and pushed the sd-wan overlay template and it noticed the error but I do not see the error on the installation logI tried to upgrade the firmware on FMG from 7.0.3 to 7.2.5 and the Fortigate from 7.0.5 to 7.2.0 but it did not resolve the problem. I also tried to install each part of the sd-wan overlay template but it had the same problem. Do you have any idea how we can fix it?Please help me! Install log: Starting log (Run on device) Start installing Site-30 $ config vpn ipsec phase1-interface Site-30 (phase1-interface) $ edit "HUB1-VPN1" Site-30 (HUB1-VPN1) $ set interface "WAN1" Site-30 (HUB1-VPN1) $ set ike-version 2 Site-30 (HUB1-VPN1) $ set comments "VPN: HUB1-VPN1 [Created by IPSEC Template]" Site-30 (HUB1-VPN1) $ set peertype any Site-30 (HUB1-VPN1) $ set mode-cfg enable Site-30 (HUB1-VPN1) $ set localid "B

Helly everyone, i have 3 Vlans (Server, Clients, Other).The traffic prioritization should look like this:Server - highClients - mediumOther - low All of the 3 Vlans should use the full bandwidth of my Wan Interface (inbound and outbound), but if "Clients" or "Other" use the the full bandwidth and now a "Server" want to communicate over the Wan interface it should get the full bandwidth and Clients and Other only a minimum guaranteed bandwidth. What is the best way to configure this scenario with traffic shapping? Regards Stefan    

Customer not listed on the FortiCloud account   A mandatory requirement for CS to create a TAC ticket is that you are listed on the account as an auth user and can verify the account information.   CS will always verify email address, phone number and product entitlement on the account.   In addition, users who are not authorized will be unable to see ticket updates or respond via email.      The following information will assist Customer Service with completing your request.     Are you a Fortinet partner? If yes, please provide your partner email and phone number and inform the Customer Service Representative (CSR) that you would like to open a partner ticket. If no, go to next step.   Can the CSR call the organizational administrator on your behalf and explain  how to add you to the account?  Customer service will use the admin information on file. Once you are added we can open the case for you.   If the ab

Running latest build of 7.2 on a 200E Have a web server in the DMZ that needs to communicate with an internal LAN box solely for https traffic I have several boxes in similar config, none with issues.  This is perhaps the first new rule I've had to make since upgrading to 7.2, and wonder if that's the issue As soon as the rule is made, internet traffic on the internal box is killed.  It can get anywhere internally.  If I run a non stop ping to an external address and disable the firewall policy, internet access is restored.   I'm at a complete loss and since the firewall is in production 24x7 rebooting is something that will have to wait Anyone seen this or have an idea?   When the policy is active and I run a trace route the traffic dies at the firewall, i have no idea what its trying to do internally to cause this issue.  A rule allowing https traffic from one host to another shouldn't be killing its ability to get

I ran into a conundrum this morning.  I want to prevent remote users from accessing their home resources while connected to SSL VPN, but I also want them to be able to run VMs on their workstation that can access resources through the tunnel.  Enabling exclusive-routing on the portal solves the first part but prevents the second.  Are there any ways around this in a full tunnel required environment?

Hello FCT EMS adminsFCT EMS v7.2.4.Is it recommended to install FCT (client) on FCT EMS server so it can manage itself?Does it have any negative impact?The aim is to have AV and vulnerability scan on EMS server as well.

Hi,  Can FortiGate block what Trend Micro XDR detects? What I mean is, does FortiGate can only received logs from Trend Micro XDR or it can manage the blockings from the XDR?

Hello FortinetWhen are FortiPAM videos coming out on video.fortinet.com?

We are deploying 120 switches and want to use L2 FortiLink for the convenience of not having to configure all the VLANs and trunking manually, also we want to use the NAC lite on FortiGates for some basic NAC features. Now a small Fortigate cannot manage such a number of switches, thus we have been recommended the FortiSwitchManager.Now that it's deployed, we have noticed it only does L3 Fortilink (only management, no NAC or VLANs).Any ideas of how to manage all those 120 switches according to our needs? The only solution we found was to buy a 1000F or higher because they can manage up to 196 switches or a VM08 since it can manage up to 300 switches according to the max value table.Thank you for any ideas

Hello,For each firewall rule we can see the Current Bandwidth like pic below.Is the current bandwidth can be monitored by SNMP manager? What OID for getting this value?  

I have two offices, head office has FortiGate firewall or branch has foregate firewall.There is an ISP in the branch, through it I have made an IPSec Tunnel, if the ISP is down then the IPSec tunnel also goes down. Or my P2P connectivity is also from head office to branch office, can I configure P2P in such a way that when my ISP is down, internet or server of head office can be accessed through P2P?

Maybe this is knowledge already out there but I just wanted to hopefully save someone else the trouble. I recently setup Azure/Entra SAML SSO for our VPN users on our FG 200F. The setup isn’t hard and there are tons of guides already out there. One thing the guides often skip that I also missed was the default authentication timeout of something like 5 seconds. With MFA enabled this is not enough time. In the FortiGate documentation it recommends setting this to 60 (seconds). This gives the MFA and the user enough time to complete the MFA steps.config system globalset remoteauthtimeout 60Hope this information helps someone!

We are a software service company and we use Fortinet for securing our machines. Recently we started working for a client that is also using Fortinet. We are required to install their Forticlient in order to connect to their VPN because of the licensing of the Zero Trust Telemetry. The only reason we need their Forticlient is to use the VPN.If we want to use their Forticlient we need to uninstall ours which might put is in a situation that we compromise with our security. Is there an option to connect to VPN network managed by FortiGate/Fortinet without using Forticlient?

When viewing the "Source" tab under "Fortiview" I can only go as far back as 24hrs. I can see the options for "7 days" is grayed out.  How can I see logs more then 24hrs old? Thanks, 

Good day, We are currently experiencing VPN issues in our Office. We are using Perimeter81, OpenVPN and Global Protect in our office set to Split tunneling. We can connect to the VPN's successfully but are unable to access anything when connected. Please note that this only happens on certain access points. We have 12 x FortiAP 431G Version 7.2.2 Build 5072. After rebooting the access points then it works for a while maybe 3 hours then it does that again. This is the error message that we are getting on the Guest WiFi with DNS set to 1.1.1.1 and 8.8.8.8:Log Description: "Wireless station DNS process failed with no server response".Action: DNS-no-respEvent Message: "DNS server not responding for client". Users connected to the Company Network (Locally Hosted Windows DNS Server) is getting the following:Log Description: Wireless station DNS process failed due to non-existing domainAction: DNS-no-domainEvent Message: DNS lookup of wpad.tscpt.local from client b4:6

HelloI'm trying to configure Radius/Tacacs authentication for admin/user access to the FortiADC. Version: 7.4.4 Build0347 (Mature)I've created the radius server and a user account with the wildcard flag enabled.Authentication is via Cisco ISE This all works fine for super_admin access, users can authenticate and given full privilege's to all vdoms.However, I'd like to have certain user only have read-only access to all vdoms.I've created a read-only access-profile and an associated ISE policy-set sending the read-only group attributes, however, when a read-only user logs on, they are still given full super_admin access. The usual command on something like a Fortigate 'set accprofile-override enable' is missing from the ADC CLI so I cannot add this to the wildcard user.I'm assuming the user account with the wildcard flag cannot change the access profile without this. Can anyone advise if what I'm attempting to do is available on the ADC?And if not, is there a workaround o

Dear Concern, I need to configure an IPsec VPN between two FortiGate, in which the traffic coming from SITE-B should be NATed only. That means when I configure the IPv4 policy on SITE-B, I should enable NAT in the policy and define an IP Pool so that the traffic from SITE-B is NATed and reaches SITE-A. I need to do this configuration because there is a server located at SITE-A, and I only want to give access to this server to users at SITE-B. The reason for enabling NAT is that SITE-B is using a subnet that is also being used by SITE-C, and I want to avoid any conflicts. Can anyone to helpme for this configuration.

Hi, I am trying to debug the SSL VPN using the commands below but they only last 30 minutes, is there a way of making debug last longer or turn on at a certain point?  diagnose debug application sslvpn -1

Recently, I have faced a challenge in creating the address objects in the Fortigate 2201E as the limitation is over 65000 firewall address objects. Since we are using multiple VDOMs the address object resource got exhausted.  The object creations are mainly contributed by the IOC blocks at the firewall itself. Now we are left with the option of having the IOC blocks via external threat feed. But I would like to know if the Fortimanager integration would help in holding the address objects at the Fortimanager itself and cached at Fortigate, such a watch the objects wouldn't consume the fortigate resources.Kindly let me know the feasibility of the same.

LAB_FW_A (root) # config system interfaceLAB_FW_A (interface) # edit "port1.2"LAB_FW_A (port1.2) # set vlanid 66LAB_FW_A (port1.2) # endVLAN ID, VLAN protocol, or physical interface cannot be changed once a VLAN has been created.object set operator error, -522 discard the settingCommand fail. Return code -522LAB_FW_A (root) # LAB_FW_A (root) # TimeoutVLAN ID, VLAN protocol, or physical interface cannot be changed once a VLAN has been created.But Why ?I have a VM I'm playing around with in the lab, but why can these things not be changed? it's a networking product; I'm lost as to the logic here. Is it a licence issue because I am just about to relicense this but as it stands, I cannot change the interface to get web/ ssh access so catch 22/.Simon

Hi Team, We would like to seek for your advice, on below.The requirement is to NAT a single source IP to a dynamic IP pool for accessing a single host for each session. Is this feasible with FortiGate? If so, please provide the configuration steps.  

Hello FortiGate Community,I’m currently working on configuring two FortiGate 200E firewalls in HA(High Availability) mode and need some guidance. Specifically, I want to understand how the HA setup behaves in a situation where the WAN interface shows as up, indicating a physical connection, but traffic cannot pass through due to an issue with the ISP. Can anyone provide insight into whether the HA failover will still function properly under these conditions?Thank you for your assistance!

Hello all, At the moment, I'm currently confused as to how I should configure this. I have been given some IP address information to set up in our Firewall so that we are able to acess the external server from our internal network through an NWI. We have been given the Source NAT IP, DNS IP, URL, Destination IP and Port number. I'm positive that I have to key in some new Address entries and Interface entries to attach to the firewall policy when creating it but I'm not sure where to begin. Your help is appreciated. Thank you.

The security team picked up the below scan on the external firewall which the IP is the SSL vpn used by us.The ASV scans shows the web directory is accessible via this URL https://x.x.x.x/images/. when I tried to access it from a public network, it redirects me to SSL VPN web portal login page. https://x.x.x.x/remote/login?lang=en Previously article that I looked atSSL-VPN Connection Attempts - Fortinet Community We want this vulnerabilities to be removed regardless of locations, is there any way we can to disable this file directory/subfolder without impacting the SSL VPN? Appreciate your feedback. TIA :)  

rebooted my switch yesterday due to having to relocate it.  It is connected to another Fortinet POE, FG-80EPOE.  when it boots up it no longer provides power to my fortinet u431F AP's.  It previously worked in the same config just fine.    Now via the cli it shows POE errors on all ports: Fault 4 Error Type 17 (Port is yet undefined). at the interface level it shows similar:Power Fault: Error Type 17 (Port is yet undefined). I have followed all of the poe related post here including the poe debug, error 36,38, 4, and 17.  None of the recommended actions seem to work.  I have upgraded this switch to the latest FortiOS code as well 7.2.2. I have also done the poe reset, switch factory reset, still nothing.  Any suggestions?