Fortinet Community

Hi,how is it possible to bypass the AntiSpam scanner when email subject or body contains specific keywords defined in the dictionary? Thank you

Anyone have an issue setting up an active-passive HA on FortiADC where both devices want to be Primary?Neither see any peers.Mac address spoofing is enabled on our virtual switches.The thing that's weird is a 169.x.x.x IP is being assigned.The devices cannot ping the other 169.x.x.x IP.   (P) FORTIADCP001 # get system ha mode : active-passive hbdev : port4 datadev : group-id : 14 group-name : group1 mgmt-status : disable priority : 1 config-priority : 10 override : enable hb-interval : 2 arps : 5 hb-lost-threshold : 6 arps-interval : 6 l7-persistence-pickup : enable l4-persistence-pickup : enable l4-session-pickup : enable auto-config-sync : enable monitor

Message " Error downloading licence"3 interfaces , 1 cpu, 1gig ram others seem to have this issue also, questions un-answered. 

Hi I've changed my location from Ecuador to UK and now I cant connect the VPN. The alert says  "Unable to establish the VPN connection. The VPN server may be unreachable". I've reinstalled the product but without any result. Some advice please?

Geting the below error message when using forticlient. I have confirmed the settings are correct and I checked her TLS settings for internet explorer as mentioned in a previous post but I'm still not able to connect. This user is located in London and not able to connect to the firewall in New York. However my coworker and myself are located in the states and have no issues connecting to the firewall vpn with her credentials.  any suggestions?

Please advise if the vulnerability affects forwarded traffic or only local traffic to the fortigate.Any advice on workarounds would be appreciated as well.Thank you.

Hello, I need to provide Managed Wan Connectivity + Wireless Failover to a customer who is managing their own network, their Edge device is a Meraki MX firewall. They need Public static IP addresses on the MX.  I use ISPs to provide the last mile connectivity which,  in most cases is Off-Net Braodband Cable or FTTP (this is not dedicated fibre).  I would like to use FG40Fs to terminate the WAN connectivy (so I can manage it ), then hand-off the Public IP to the MX over a switchport. Then setup GRE tunnels back to my core network so I can route and advertise the Public IPs. One Primary tunnel and one Failover tunnel.  I've been told that this has many disadvantages:  A) the GRE tunnel overhead, B) the Cable (DOCSIS) variable latency & potential packet loss, and C)  and tunneling already tunneled and encrypted traffic.  I've also been told that, despite the specs in its datasheet, a FG40F wil not be able to deliver more than 100-

Hello @All,we're using transparent proxy for some update servers.On Windows with browser, a download of files is possible.On Linux shell with curl like (curl https://the.earth.li/~sgtatham/putty/latest/putty-0.77.tar.gz) it is not possible.Message:curl: (60) SSL certificate problem: self signed certificate in certificate chainMore details here: https://curl.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentioned above. Also, we have one other problem on Windows also with transparent proxy to get updates from Virus scanner software over the internet. The site for updates are visible from the Browser, but not from the application. both on same machine. Many thanks for helpingTBC  

Hi (New to Fortinet )I am hoping i can get some feedback regarding a project that i am currently working on, In our data center, we are replacing the switches with a managed fortiswiches 2048s. The firewall is a 3rd party appliance and will not be replaced at this moment. Proposed topology  I would like to manage the switches via the firewall as the controller. is this even possible?  Is this a best practice? are there any potential issue with routing/config that i should be aware of ? Thanks in advance!

I would like to know the possibility of comparing multiple Fortigate configurations (branches). The objective is to identify if any of the devices are missing important configurations. Currently, the branches are not using a CLI template, so we do not know how many branches have missing any important configurations. Is there something we can do using Fortianalyzer or Fortimanager to get this data?

hi there, i am willing to upgrade my fortigate firwall from  7.4.2 to 7.4.4 but i am confused on this known issue of 7.4.4 because i dint want to enable automatic upgrade of fortigate firmware 1) scheduled update are ips signatures and antivirus signatures or scheduled upgrades are firmware upgrade 2)If scheduled upgrades are firmware upgrades then according to this attached known issue does it can be resolved by exec federated-upgrade? kindly confirm  

HelloI have FortiGate 40F , I applied Alerts for login ,Token ,Configuration change, interface change , FortiClient VPN  connected and FortiClient VPN  disconnectedall alerts working fine except when I connect VPN by forticlient i did not receive any alerts can anyone to help me thanks

Hi,I need same help, after system upgrade fortianalyzer to 7.4.3 gui not work.I have available disk space, the settings are all correct according to the previous version.   

hello,I tried to find why my app (classic client-server SQL app, SQL Server on Server, application installed on clients) is working slow over Local network (between two VLANs). Fotigate has policy between VLAN 10(client) and VLAN 20 (server) but no security profile set, no inspection and so one.Application running directly from the server generate reports in 1:30 min, the application running on the client generate raports in ~3min. (so issue is on network side) I have checked:- ping  from client to server, mostly 1ms, no packet lost-iperf from client to server, around 850Mbps-in whireshark is saw from time to time TCP reassembed from server to client - could be a reason ???-ping -f -l 1472 from client to serve is OK Something more to check ??maybe on switch side (switches are manageg by FGT) ??  Thank You     

We will replace FAZ 400E (7.4.1) by FAZ 810G (7.4.3) What s the best way to do it, if we want to migrate logs too, as we will have to shutdown the old FAZ 400E. For sure i think i will  have to upgrade 400E to 7.4.3 as 7.4.1 is not supported on 810G. Right ? We found these topicshttps://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-migrate-a-FortiAnalyzer-log-and-config-to-a/ta-p/196888 https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Using-exec-migrate-to-migrate-to-a-new/ta-p/193414 But during the migration, both FAZ will be available and joinable. -Does Log Aggregation permit to migrate all real time and old logs ?-Does Log Fetching permit to move all type of logs ?-Should i just exe backup/restore logs ?  What is the best way to do miragte completely all logs between both FAZ ?

Anyone know what might be causing this issue and how to correct? Within the web GUI, clicking on the >_ to open a CLI Console window, the window opens but immediatelydrops the connection with this message"Connection lost.  Press Enter to start a new session."Pressing Enter, I immediately receive the same message, pressing Enter again, repeat. Last week this worked without issues.Only change I made this week was an update to an existing security policy. Fortigate 201FFortiOS 7.0.1250% memory usage - 50% usage from initial startup.CPU usage less than 1% I checked on my other Fortigate firewalls (3) that haven't had any changes in multiple months and received the same failure. 

After an update to my Windows Server 2022, Fortinet Single Sing On Agent Configutation stopped retrieving Show Logon Users information, is there any way to find out how to solve this?

Hello Derasi am setup Virvual server on Fortgate fireall 201F to working on round robin methood but it seems that it is not doing load balance the session is kpet on one server rather than the others  any feedback ? Bests

hello team i am getting probe failed when i adding fortiAnalyzer to FortiManger, i have configured the FortiAnalyzer interface to be managed with fortimanager

We currently have ZTNA deployed. Is there a way to use Thales MFA when authenticating ZTNA connections.Does fortinet EMS supports SAML with 3rd party IAM ?

HI support, I hope all's well on your side of the world. So here’s a bit of background;In order for our users to connect to the company vpn:1) They need to be added to a vpn member on Active Directory ( Synced changes thereafter)2) Have SSL-VPN configured with the remote gateway and custom port 10447a. VPN Version 7.4.0.1658 for all at the moment3) Authentication: Prompt on login4) Client certificate: prompt on connect5) Nothing furtherFor some strange reason, on one laptop, my creds work just fine, but on another laptop, it does prompt to accept the certificate BUT it fails with an error message: Permission Denied -455. Any advice on what I can check would be appreciated Thank you. Kind Regards.

Hello team We have configured the SD-WAN network, now the FGT 70 is at brach and FGT 200F at HQ, now all Underlay Network is reached through ISP means 70F at branch can ping 200F at HQ ,but LAN network is not reached trough Overlay what is the issue?

Hello everyone!I am Sattarov Jasur representing the Unicom company. I am from Uzbekistan, Central Asia. In our country, prices for Fortinet products and firewalls are greatly inflated, I have proof that prices for similar products are 6-7 times higher than in other countries. This terribly spoils the reputation of Fortinet in our country, I called the head office in America many times but never got through. Contact me urgently +998994354858 WhatsApp available

 Hi Team,The customer is experiencing communication issues between the BAN LAN and CHE LAN. After reviewing the policy and routing for both firewalls, it appears that the BAN FW is not forwarding traffic to the Chennai FW.Issue Summary:Source: port 10Destination: port 7Source IP: 10.80.151.185Destination IP: 10.44.6.31Findings:Debug Logs:Traffic is incoming on port 10 (LAN).No outgoing traffic on port 7 (MPLS).Sniffer Logs:Requests are captured on port 10.No output seen on port 7.Session Traffic:No traffic is seen in the session.Attached are the debug logs, sniffer logs, session information, routing information, kernel logs, and configuration files for your reference. Team Kindly share any idea about this issue. @nithish.k@snsin.com FortiGate 

Hello friends, I would like to know if there is a way to set up 2FA for logging into Fortigate. I understand that it can be done for VPN-SSL and I have done it, but is it possible to set it up for Fortigate administration via email or any other method? Thanks in advance.