Fortinet Community

I would like to increase the default ARP timeout on my Fortigates.  The docs say that for version 7.2.7  The command is: config system global  set arp-timeout [value-seconds] However on my Fortigate there is no "set arp-timeout [value]" command on the CLI.  Why not?  Where is this command? Please, no one from Fortigate post with ANY questions about what I'm running, where I'm looking, how I'm connected.  If your docs say I can connect to the CLI and just run this command then I should just be able to connect to the CLI and run this command.  If there is more required to be ABLE to run this command THEN PUT THAT IN YOUR DOCUMENTATION!!!! If anyone knows a way ACTUALLY change the ARP timeout on a Fortigate, please help me out.  This should not be this hard or frustrating. 

Good night all, I tell you that I applied the firmware to the FortiAP FAPU231F and FAPU431F version PU231 and PU431F-v7.0.4-built0132 from the Fabric Management of the FW 600E but now the FortiAP of both models is disconnected to the clients every n seconds and cuts off their videoconferences Among other queries to the Internet and the local wired network, the Fortigate technical staff tells me that I have to downgrade to the previous version so that the Wi-Fi clients are established again and thus avoid disconnections, the issue is that I do not have with the previous firmware. Is there a configuration that helps me correct this error.If this situation happens to anyone, I would appreciate your comments. Greetings

Hi all,,, I have analyzer and can anyone help me to create a daily configuration change report for managed fortigates???? thanks  

HelloOur pair auf 100E is up for support renewal. Keep or replace?Dealer suggests 100F, its not that much of price difference if looking at price per year.What to look for when replacing the devices? just switch the cables plus the config-backup and -import?Dealer has a bit of personnel problem, knowlegeable person has fully booked calendar, other person can only talk the talk, but lacks the walk capabilities https://tutuapp.uno/ .How to prove that the 100E is a bottleneck? Is there a ready tool for hat?the 100E is used for lan-segmentation (company is on health-sector) and as vpn-gateway for about 50 users (RDP).I'm a database guy, other guys in my company are java-guys so not much knowledge here.Thanks & bye.

Hey! Can you help me to generate a report from this widget? Its the interface bandwidth from Fortigate and its for my ISP usage. We have FortiAnalyzer and couldn't find any chart for this. So we need this in FortiAnalyzer because to see when the port has reached saturation (peak) in the weekly reports we generate. 

Based on the following network structure below, I am unable to ping from the router to the VPC and vice versa.Fortinet firewall does not reply to the ARP request when I run the "diagnose sniffer packet" command. ARP table contains information of the router and the Virtual PC. FortiGate-2 # get system arp Address Age(min) Hardware Addr Interface 172.16.101.3 0 50:00:00:09:00:00 port2 11.1.1.2 0 00:50:79:66:68:08 port3 Sniffer output when I ping from Router to VPC: 2.4294596056 port2 out arp who-has 172.16.101.3 tell 172.16.101.1 2.4294597165 port2 in arp reply 172.16.101.3 is-at 50:00:00:09:00:00 10.4294304486 port2 in arp who-has 11.1.1.2 tell 172.16.101.3 12.4294304079 port2 in 172.16.101.3 -> 11.1.1.2: icmp: echo request 14.4294304828 port2 in arp who-has 11.1.1.2 tell 172.16.101.3 16.4294305817 port2 in 172.16.101.3 -> 11.1.1.2: icmp: echo request 18.4294305479 port2 in arp who-has 11.1.1.2 tell 172.16.101.3 36.4294756214 port2 out arp who-has 172.16.101.3

I am currently exploring the differences between IPS and APP, specifically in the context of securing HTTPS servers. Here is my rule for testing:   #For APP, working good at http, a lot of ip not blocking in https. F-SBID(--name "Http 403"; --pattern "403 forbidden"; --protocol tcp; --no_case; --flow from_server;) #For IPS, both http & https are working good. F-SBID(--name "Http 403"; --pattern "403 forbidden"; --protocol tcp; --no_case; --flow from_server,reversed;)    1. IPS and APP can use the same syntax. If I want to protect an HTTPS server, should I use IPS or APP?2. Have any more details about IPS and APP?3. Looks like App have issue for https traffic, maybe is bug?

HowdyI'm asking for your help with a problem with the infrastructure I'm implementing. I have a FortiGate with a fortilink interface configured.The infrastructure requires one, or more, not fortinet switches between FortiGate and FortiSwitch. For example:The third-party switch is configured as follows:int 1 (connected to the FortiGate fortilink)Native VLAN 1allowed VLAN 400,401...int 2 and int 3 (both connected to interfaces 24 of the two Fortiswitches)Native VLAN 1allowed vlan 400,401....Fortiswitches take IP directly from the fortilink physical interface. The problem I'm having is that every once in a while fortiswitches go offline.If I go to enable the Fortilink Split interface and turn it off again, the fortiswitches come back up.Do you know how I can fix it?  

Friends a question:I have a Fortimail device, according to the logs it appears that the Fortimail let a SPAM email through.Reviewing the AntiSpam Profile, it appears that the action selected is "Dafault", my question is what action does the "default" take?What configurations do you recommend to prevent Fortimail from letting spam emails through?   

Hello Group, I am having trouble with my FortiClient software. As soon as I connect to our VPN, the software says connected and then immediately says disconnected. My credentials are correct and others are able to access from other laptops without issues. My Environment Info: Client PC OS: Windows 8 FortiClient Version: 4.3.5.472 FortiNet Hardware: 200B Firmware Version: 5.0 SP3 I have tried to uninstall FortiClient and re-install with a system reboot in between without any luck. Has anyone seen this behavior before? Thank you very much,

Does anyone have experience configuring 2 FortiADC Virtual Devices in Active-Passive HA mode within a VMware environment? We are having a problem when the 2 VM's are on different hosts.

Hi all, I would like to clean up Custom Categories created in Rating Overrides Section. In CLI I enter ' config webfilter ftgd-local-cat' and then ' purge' command, but every time I get error: Local Category ID is used by protection profile WEB_FILTER_NAME. I checked WEB_FILTER_NAME and try all options (Allow, Block, Disable...) to this Category, but always errors appears, when I try to remove this Category. Thanks for help. Best regards, Michał S.

Hi Team,I went through the below linkhttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Access-to-Specific-FQDN-using-Split-Tunnel-SSL-VPN/ta-p/190062 As per the link we dont need to call the FQDN object in the split tunnel config but just creating the ACL with FQDN will create a route in the routing table? Is my understanding right? Regards,Sanjay S

Hi, FG-60F instead inter-vlan routing sends packet to wantraceroute 10.102.9.3traceroute to 10.102.9.3 (10.102.9.3), 30 hops max, 60 byte packets1 _gateway (192.168.1.99) 0.404 ms 0.382 ms 0.373 ms2 customer.abc.net (X.X.0.0) 83.877 ms 73.327 ms 83.850 ms...Routing table looks well:get router info routing-table allCodes: K - kernel, C - connected, S - static, R - RIP, B - BGPO - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter areaV - BGP VPNv4* - candidate defaultRouting table for VRF=0S* 0.0.0.0/0 [10/0] via X.X.0.1, wan2, [10/0][10/0] via X.X.0.1, wan1, [15/0]C 10.0.2.0/30 is directly connected, Wireless-BC 10.0.3.0/30 is directly connected, Wireless-CC 10.102.1.0/24 is directly connected, vlan-10C 10.102.2.0/24 is directly connected, vlan-20C 10.102.3.0/24 is directly connected, vlan-30C 10.102.6.0/24 is directly connected, v

Is it possible to disable the web portal login for SSLVPN if SSLVPN is configured on a Fortigate firewall, as I manage some devices for which this would be desirable.  For various reasons, for the Fortigates in question, it is not practical to limit the hosts that are allowed to connect to SSLVPN to specific addresses / subnets.  I have deleted content on the login pages through  System -> Replacement Messages to lockdown these devices somewhat.  Was just wondering if there is any way to overall disable this page from appearing on the firewall when accessing through web browser using https://<ip address of fortigate>:<port of SSLVPN> .  It is my understanding that Forticlient access to this configured port, as well as web portal access, both are enabled together, and one cannot be disabled without disabling the other.  Is that correct? Also, if I needed to whitelist a specific subnet for inbound traffic for port 541 for Fortiguard,

HelloWhile installing FortiClient EMS 7.0.13 on Windows Server 2019 I got this error. However when I clicked OK the installation seemed to have finished successfully and EMS GUI started.I did the same before on Windows Server 2016 and there were no such error. Can the error be safely ignored? Do I have to do something and redo the installation?

Dear All, I need to allow only below Websites and Mobile applications, Also need to block everything else on Fortigate 60F Gmail, yahoo and outlook emails websites and company websiteGmail, outlook, Appstore and Playstore mobile Applications. Block other sites and applications kindly support to implement these rules.@fortigate @Fort @FortiD FortiGate 

I have a Fortigate 501e (FotiOS v7.2.7) with SSL-VPN where local users authenticate via LDAP. This LDAP has a password policy and it is configured in SSL-VPN that users change their password on the first login.The password change occurs correctly and is reflected in LDAP, but we have noticed that when making this password change, in LDAP it is saved as plain text instead of SSHA as it was originally. The procedure is as follows: - We create the user in LDAP and assign it a temporary SSHA password.- We create the SSL-VPN user (LDAP type) in Fortinet.- On the first login, FortiClient (or Web Portal) asks the user to change the password. At this time, the password is updated in LDAP, but in plain text instead of SSHA, with the security problem that this entails. In Fortinet, the LDAP connection has this related setting:set secure ldapsset ca-cert "USERTrust_RSA_Certification_Authority" set port 636 set password-expiry-warning enable set password-renewal enable  We have

hi all,Suddenly i got the issue that FortiClient vpn on my company laptop can only work with my mobile hotspot, but if I try with home wifi it gives me the error message as below screenshot when the progress bar reaches 20%. I am not the single one having the issue. FortiClient version is 7.0.11.0569.But if i browse to https://company-vpn-name.company.com:8443 under home wifi (yeah the service port is 8443 in my company), the page can be loaded, and if i do telnet company-vpn-name.company.com 8443， it also succeeded.please help to advice! Thanks a lot!

Hello Team, I'm implementing Fortiswitch topology with McLAG on core side, and I never found an exact document about best practises for Spanning-tree for that type of topology. Both mclag peer should have the same stp priority? Is there anything which I have to configure for STP when I use MCLAG? I know that I have to enable mclag-stp-aware, but nothing else for that. Thank you for your experience!  

We can manage the Forti-APs in fortigate Transparent Mode ?  @nithish.k@snsin.com,@sanjeevi.s@snsin.com

We manage several Fortigates that are utilizing the SD-Wan features to control failover between a primary(WAN1) and secondary(WAN2) internet connection. We have also allowed management on these interfaces, but limited the access to only from our office IP.  While WAN1 is the active internet connection, we have no issues connecting to it for management or sending pings to that interface. This same goes for when WAN2 is active. However, when WAN1 is active, we cannot ping the WAN2 interface, or connect to the management GUI. Again this is also true for WAN1 if WAN2 is active. We have tried to resolve this with several ways including policy routes and SD-WAN rules, but no joy. The inability to ping the inactive interface is particularly frustrating for our monitoring as WAN2 always shows down, unless it becomes the active SD-WAN interface. Any thoughts on how to resolve this?

Hi All, I am having an issue with the SD-WAN performance SLA. The server is pingable from WAN1 and the VPN tunnels, latency is below 10ms.  execute ping 192.168.100.PING 192.168.100.1 (192.168.100.1): 56 data bytes64 bytes from 192.168.100.1: icmp_seq=0 ttl=255 time=0.4 ms64 bytes from 192.168.100.1: icmp_seq=1 ttl=255 time=0.1 ms64 bytes from 192.168.100.1: icmp_seq=2 ttl=255 time=0.0 ms64 bytes from 192.168.100.1: icmp_seq=3 ttl=255 time=0.0 ms64 bytes from 192.168.100.1: icmp_seq=4 ttl=255 time=0.0 ms But it is still showing a dead state.   

Hi All, Please help how to allow only Company URL and Appstore and Playstore apps for mobile devices on Fortigate 60F, Also i need to block everything else. I used webfilter profile and DNS profile for allow company website and *.apple.com for allow only appstore and compnay site.Now via browser I can access only company website but cannot access appstore application from mobile devices. Any assistance is greatly appreciated.

Dears, could you please provide me with destination URL’s and ports required for the fortisandox  and if it bidirectional or not