Fortinet Community

Where i can get for MacOS Tahoe (Apple, not intel)FortiClient Endpoint Management Server (EMS) I try this, but download a bin file that not open im MacOshttps://www.fortinet.com/br/support/product-downloads?tab=trials#ems

Hi all,I used to install all available host OS (Ubuntu 22.04) patches for my FortiClientEMS server(s). Especially as they have to be reachable via Internet. Last updates seem to have changed the login shell to emscli. How do I keep the OS patched?best regards

Hello everyone, I have three questions: - Switch throughput sizing : If a switch has a maximum achieved throughput of, for example, 4 Gbps, what is the best approach for sizing the firewall? How should this value be interpreted and used correctly during design? 2- Firewall replacement / sizing : When replacing an existing firewall due to new requirements (e.g. higher data volume), how should the current throughput be evaluated? From the HA / system throughput statistics, or By adding the traffic across all interfaces? 3- Throughput comparison with datasheets When comparing real traffic with the throughput values provided in datasheet, which metric should be used as a reference (e.g. firewall throughput, NGFW throughput, IMIX, with or without security services)? Thanks in advance for your help.

Greetings, we're trying to establish a subnet for testing and training purposes, including a dedicated firewall.Also, this is the first time setting this up. Please keep in mind, I might not understand everything right away. The issue:the fgt does not provide ip addresses on port1a test device is directly connected and can be seen via lldpthe config:wan1facing towards our regular networkconnected, reachable via ping/ https/ ssh/ fabricstatic route - 0.0.0.0 / 0.0.0.0gw ip 10.10.10.1port110.7.0.1/16facing towards subnetconnected, reachable via ping (responds)administrative access: ping/ https/ ssh/ fabrictried with dhcp enabled and disabled - same results: no ips givenrange 10.7.0.2 - 10.7.255.254also...the device is on firmware version 7.4.11, registereda firewall policy for those two interfaces has bee created, allowing trafficdefault settings, everything's allowed. I'm missing something, probably.Hope, you can help me out with this one. Kind regards! 

Hello Community, I am seeking assistance regarding an issue with our website, which has recently been flagged as malicious by Fortinet security services. After becoming aware of the detection, we conducted a full internal security review of the site, including: Scanning for malware and malicious scripts Checking server integrity and file changes Verifying SSL configuration Reviewing firewall and access logs We did not identify any malicious content, phishing elements, or suspicious behavior. The website is also protected by a firewall and anti-DDoS measures, which may potentially affect automated security scans How can we determine the exact detection category? What is the correct procedure to request a re-evaluation or removal from the block list? If there is a specific Fortinet portal, form, or process we should follow to submit our website for review, please let me know.

We migrated from Forticlient 7.2.13 to 7.4.4. ESXi VM appliance.I recently noticed that the Forticlient Endpoint Protected Process Service on our servers is set to automatic, but hasn't started.The service is started on our Windows 10/11 workstations.The SSL/IPSec VPN feature isn't installed on the servers.This was also the case in the previous version, but then the Forticlient Endpoint Protected Process Service was started.When I start the service manually on the servers, I get the following message:Forticlient 7.4.4 seems to be working properly on the servers, even though this service isn't started.What is the function of this service, and does it need to be started?

Hi Guys, I want to seek assistance on what does this portion of the SSL VPN debug means? SSL VPN debug:Matched policy (id = xxx) to add ipv4 split tunnel routing address ---> this is the SSL VPN traffic policyMatched a universal policy (id = xxx) to add split tunnel routing address ---> How about this portion? Where should I look on the configuration for the "universal policy"? Thank you! 

Hello community! I know variations of this question have been asked in the past, but it's been a little while so I was wondering if there was anything new on this topic. You can see below the network devices and that's what I need to work with. The network architects designed it this way, even if I read here that the best configuration would be with switches in between both clusters. Now it's too late, project funds are exhausted so we can't order extra hardware. A bit more context, first cluster will be used for SDWAN and IPSEC VPN and to take care of BYOD and other unsecured devices. First cluster will also have two VDOMs, one for guest network and the other for reaching the second cluster. Second cluster will be used to protect a process network. In some specific cases, process network might reach one VDOM or the other. In some specific cases, guest VDOM might reach the other VDOM to get to process network. How can we configure two directly connected FG81F cluste

Hello.I have read this article - Enable 'Device Detection' to allo... - Fortinet Communitywhich describes the method of locating device information, seemingly only for LAN,DMZ, and Untrusted.To fully be able to block non essential devices from accessing our wifi, or 'managing' those devices thru qos or restrictions I need to be able to determine what those devices are.  For example, occasionally we might have users try to bring in their own personal devices to work 'outside' our security parameters.  On the previous firewall I was able to determine those types of devices, like apple watches, ipads, other laptops, etc - and since i could determine their mac address, and knew their 'types' I could block those devices from our environment.I don't see how to do this using the fortigate, managed switches, and managed wifi devices.  I can see only their mac address - and technically, according to the article above - i shouldn't have 'device detection'

Good Afternoon ColleaguesI hope you are doing well . May i know if there is a model in Fortinet that has built-in Wireless controller , Call Manager and NVR to manage Forti Access points , Forti IP Phones & Forti IP Cameras ? Best Regards

Dear All,Please advise a solution for situation. I have upgraded my MacOs up to Monterey 12.7.6. After I am trying to connect VPN client and getting error 121 (VPN connection terminated unexpectedly). I'm not be able to update FortiClient at current time. Is these any solution for solving the problem like changing configurations or something like that? Before I can update the FortiClient.Thank you in advance for any help!

Hello everyone,I have a question regarding DHCP relay configuration in a FortiGate + FortiSwitch environment.Currently, I have VLAN 2 configured on my FortiSwitch, and this VLAN requires DHCP relay toward a DHCP server located over an MPLS link.My question is the following:If VLAN 2 has DHCP relay enabled, is it sufficient to configure the DHCP relay only on the VLAN 2 interface (where the clients are located), or is it also necessary to configure anything related to DHCP relay on the physical interface connected to the MPLS network?Thank you in advance for your support.

Dears, Kindly need your support as i have a new ZTNA deployment on Nutanix VM server. But i see no guidlines how to start my deployment. Should be KVM? OVA? or what. Thanks

After updating some firewalls to FortiOS 7.4.4 I am no longer able to log onto them using LDAP authentication. Local accounts are not affected. I have tested my credentials on the LDAP server screen and confirmed that I can authenticate, so this looks like a bug in 7.4.4. Anyone else experiencing this issue?

Hello AllWe have a new deployment and have created TACACS+ servers and Group  When I try and push, it doesnt say theres a change pending, doesnt even detect a change.  The TACACS are referenced to a group and an account too that Ive created. Is there a way to force these changes to be deployed? 

Dear forum-members, our virtual infra-structure was renewed from VMWare to Nutanix Prism. We are actually moving the machine from the old to the new environment. To migrate the Linux server my colleagues  use a migration assistant, this assistant logs on to the Linux Server with root credentials,  uninstalls the vmware-tools, adds some drivers and installs prism-tools. After that the machine is copied and can be started. This is running fine so far.  In the near future we need to migrate our Forti-Peoducts: one FortiADC-cluster (2 nodes AP), one FortiManager and one FortiAnalyzer.  I understand that is not possible to get root access to these machines for the migration assistant. Are there migration parts for the products ? Or do I need to install new machines on the Nutanix and backup and restore the data?  For vmware I installed OVAs - is there a Nutanix Prism equivalent to download for this environment? Best regards,Volker

Hello everybody!Has anyone already done this? I need to monitor the expiration date on CA and local certificates in Zabbix, but this information isn't available via SNMP. I’m trying to retrieve it through the API, but it doesn’t work either.Has anyone faced this issue?

I'm having an odd situation were we're getting DDoS'd with UDP floods, only during the school day. It hasn't been enough to take us down, but was enough to get the attention of our ISP and show up in our FortiGate. The ISP couldn't seem to provide much info about why this was happening, but they seem to think it's "excessive VPN use" by our students. I've done a lot of digging through our FortiAnalyzer and really can't see much out of the ordinary other than the incoming flood that is being dropped. Any thoughts about what might trigger this or where else to look?

Using Fortimanager, what would be the best way to replace a managed Fortigate with another model (60G to 70G) which would cause the least amount of downtime?

Hello,I am looking for FortiClient VPN version 7.0.8.0427.Can someone please help me with the information about where I can get the software.Thanks in advance  

Hi community, I am trying to figure out what is causing these weird symbols showing here. Any way to fix this?

 We are currently experiencing an “Invalid LDAP Server” error while trying to browse LDAP users on our FortiGate.Fortinet Support has confirmed that this is a known bug and the case has been escalated to the Development Team. However, there is no confirmed timeline or ETA for the fix, and no hotfix is currently available. Before waiting for the official fix, I would like to check:Has anyone else faced this issue?Were you able to find any temporary workaround?Did upgrading/downgrading firmware resolve it?Any CLI workaround or configuration adjustment that helped? Environment details:FortiGate model: 601FFirmware version: 7.4.9LDAP type: Active DirectoryError occurs while browsing users from GUIAny suggestions or shared experience would be greatly appreciated.Thanks in advance.

We have a FortiGate FGT60E 7.4.11 build2878 controlling three FortiAP’s FP221E 7.2-build 0337. Two of the three AP’s appear to be working fine. One of the AP’s seems to always have 0 Clients. This AP's Last Failure Reason is: 80211 WLAN ADD error. This AP also has other errors including:oper-txpowerconfig-txpowerPhysical AP joinPhysical AP radio operation countryI ran the following but the name is blank and no country is listed:get wireless-controller globalname :location :acd-process-count : 0wpad-process-count : 0image-download : enablerolling-wtp-upgrade : disablerolling-wtp-upgrade-threshold: -80max-retransmit : 3control-message-offload: ebp-frame aeroscout-tag ap-list sta-list sta-cap-list stats aeroscout-mu sta-health spectral-analysisdata-ethernet-II : enablelink-aggregation : disablemesh-eth-type : 8755fiapp-eth-type : 5252discovery-mc-addr : 224.0.1.140max-clients : 0rogue-scan-mac-adjacency: 7ipsec-base-ip : 169.254.0.1wtp-share : disabletunnel-mode : compatiblenac-interval :

I'm working on merging Root from my 100F firewall into a third VDOM on my 3400E firewall. That new VDOM will maintain its own peering connection that it had on the 100F. When I log into the 3400 Global, I see that the "System WAN" is X.X.X.X/31. I don't want the new VDOM routing through that due to necessary network segmentation because of contract requirements and such, so I would like some guidance on how to proceed with the configurations.