Fortinet Community

Hello.My account was created upon request to FortiCloud technical support. I log into my account via email, go to the support[.]fortinet[.]com menu, and when I go to Support > Training > www[.]fortinet[.]com/training-certificationWhen I select NSE Certification Levels > Learn More > Get StartedI get an error " Sorry this user not authorised to access this portal... Code: FTIx0002". I found that this can be solved by creating another account. I created an account not from my corporate email, and everything works and goes through.Please advise how to solve the problem with corporate email. Thank you in advance!

Hello everyone,I want to set up Let's Encrypt and ACME for Fortigate, but I keep getting an error. What could be the reason?I'm getting the error “Unable to create ce

I have a Fortios 7.6.4 Fortigate 60F device, so I want to use NPU hardware in the IPsec configuration, which has 2 RAM limitations. I manage it with my Fortilink VLANs.I want to establish an IPsec connection. How can I establish an NPU-compatible IPsec connection? Are MTU and MSS values important? They are very important to me.Please help me with IPsec NPU offload.

Hello everyoneI have a DNS configuration plan and want to evaluate it separately for local and internet access.When the central DNS company.xxxxx performs a DNS query, I want my local users to use the DNS I specify when accessing the internet. I don't want them to go to company.xxxxx DNS when accessing the internet, and at the same timeWhen SD-WAN connects to the internet, I want it to route to whichever xxxxx - xxxxx DNS has the best jitter, packet loss, and ping values.Is there anyone who can help?

Hello, we have an account registered in forticloud using this email : pablot@colegioheidelberg.com and if we try to use , the website say "user is disabled", please enabled this account again. Thanks

I am not getting any audio on new 380B when making or receiving calls (new system).The volume is all the way up, I disable bluetooth for now still no ringing, and no audio when playing voicemail. Thanks

I am working with a FortiPAM product and attempting to apply a Windows application filter on a Windows secret. I created the filter, verified that WinRM is running, added an account as a privileged account, and applied the filter to another account. Despite these steps, the filter is still not functioning as expected. Could anyone provide a tip or solution to help me resolve this issue?

I'm trying to get our new mobile routers setup with our FortiGate 80F (7.4.11) but I'm having troubles figuring out if the connection setup needs to be site-to-site or dialup. The mobile routers are from Nextivity running OpenWRT and there is a custom page in the web Gui for setting up a VPN that looks like this: The Nextivity documentation only says that you need to choose IKE version and any of the three authentication methods. I pulled a backup of the router config and found the swanctl.conf file which is what the VPN client is using to attempt to connect to the FortiGate and it looks like this:  connections { myvpn { version = 2 remote_addrs = vips = 0.0.0.0 rekey_time = 0s dpd_delay = 30s dpd_timeout = 120s proposals = aes256-sha256-ecp384,aes256-sha384-modp2048,aes128-sha256-ecp256 local { auth = eap-mschapv2 id = eap_id = } remote { auth = pubkey id = } children { myvpn-child { local_ts = 0.0.0.0/0 remote_ts = 0.0.0.0/0 mode = tunnel start_action = start c

Hi All, I am unable to select Current Version and Target Upgrade Version in Upgrade Path Tool , Did anyone facing this issue..  tried with differnet browser and from diffrent PC .. But no luck#fortigate #upgrade path tool #FotiOS

 I have tried many times to activate the evaluation license but the screen shows the following error.I am able to ping google.com and all other domains. I am using eve ng for learning purpose and after logging in the firewall does not allow me to move forward without subscription. Your quick help is required.  Regards,Aneeq Ahmed

Hi everyone,I noticed Multicast policy to control Multicast stream does not allow granular control for applications. For example, we want only UDP 1781 multicast stream should be allowed through FW. I do not see any command within Multicast Security policies, that will allow me to restrict flow based on UDP port numbers.  VERSION INFO:FortiGate-VM64 # get system status Version: FortiGate-VM64 v6.2.0,build0866,190328 (GA)Hostname: FortiGate-VM64 Operation Mode: NAT Current virtual domain: root Max number of virtual domains: 1 Virtual domains status: 1 in NAT mode, 0 in TP mode Virtual domain configuration: disable FIPS-CC mode: disable Current HA mode: standalone Branch point: 0866 Release Version Information: GA FortiOS x86-64: Yes System time: Sun Jan 26 04:23:32 2020 EXAMPLE:config firewall multicast-policy edit 1 set srcintf "EXT" set dstintf "INT" set srcaddr "A" set dstaddr "all" next end FortiGate-VM64 (1) # set protocol <integer> please input int

Good day,  I'm looking everywhere, but I dont find any answer.. Does the Fortigate 100D support IGMP Proxy ? I'm looking to configure my 100D for use with my IPTV provider, but I need to use IGMP Proxy for it to work. Thanks Frank

Hi, another question about Guest Management! When I create a Guest Pass with an email, if I send the email it uses that email address as the FROM and TO email.  This obviously won't work as we aren't going to be able to spoof guests email addresses. Is there somewhere to specify what FROM address to use for sending the guest credential email? thanks

Hello, i create a new poliy directly on fortigate CLI with: config firewall policyDescription: "My Policy"edit 0set name "MyPolicy"set action acceptset dstintf IFACE_01set dstaddr MyDstServerset srcintf IFACE_02set srcaddr MySrcServerset service HTTPset schedule alwaysset schedule-timeout disableset status enableset logtraffic allend The command does not return the newly created policyid, since i want to create some batch operation where i have to place the policy before a specific other policy, is there an easy way to return the created policyid, i only know the command get firewall policy  where i have to use the last ID.

Hi ,We have encountered an issue with FortiGate devices running version 7.4.7, which we recently upgraded to from 7.2.7. When establishing an OSPF session, the OSPF adjacency fails to come up if the required local-in policy is not present. However, even after creating the local-in policy, the adjacency does not establish until we run the command diagnose firewall iprope flush.  The OSPF process and interface configuration appear correct.OSPF Hello packets are being sent, but no neighbors are learned.From the debug flow logs, I can see multiple OSPF Hello packets being dropped with the message:iprope_in_check() check failed on policy 6, dropChecked known issues for 7.4.7 and can't find any related on this issue.https://docs.fortinet.com/document/fortigate/7.4.7/fortios-release-notes/236526%E0%A4%95%E0%A5%8B For your advise. TIA :) 

Hi Community,I am managing a FortiGate 100E via FortiGate Cloud (Management Tunnel). The device is behind a NAT network.I need to change the Interface Role from "Undefined" to "WAN". However, the Cloud GUI does not allow editing this field.When I tried using the CLI Console on FortiGate Cloud to run the command config system interface, I immediately received the error: "Unknown action 0"Has anyone encountered this issue? Is there any workaround to change the Interface Role remotely without using the CLI Console?Thank you.

Hello team!!! I need create a tutorial for limited users with no Fortigate knoledge to modifý easily the IP address in many VIPs.  This is for manually redirect traffic to another computer (Different IP)If I guide the users to modify manually all VIPs in "Policy & Objects -> Virtual IPs", there are to much posibilities to the user to make a mistake, so I need for example, to create an script to modify the VIPs and guide to the users to execute this script.These is a Fortigate 100F, which I think that have not hard driveActually could be better to create something to be executed from the gui Automation stitch seems not be working to change the Fortigate settings.I have not knoledge about APIs and I have not enough time to learn. Any idea will be apreciated!!Thanks in advance.Regards,Damián

Hi everyone, did anybody here migrate their F5 load balancer layer to FortiADC?If so, can you do everything you were doing with the LTM module? Or did you find anything that can't be replicated?Thanks in advance.

Hello,I’m experiencing an issue with serial console access on FortiGate 80F appliances, where the console displays continuous garbled and unreadable characters.This issue has occurred on more than one FortiGate 80F. EnvironmentModel: FortiGate 80FFortiOS version: 7.4.8Access method: Serial console (RJ45)Terminal software: PuTTY (Windows)Serial settings testedAll combinations below were tested, including during cold boot:9600, 57600 and 115200 baudData bits: 8Parity: NoneStop bits: 1Flow control: None In all cases, the console outputs unreadable characters continuously. Troubleshooting already performed:Tested multiple baud ratesTested different serial cablesTested different USB-to-Serial adaptersTested on different computersIssue reproduced on multiple FortiGate 80F unitsTested console access during boot sequence  

Hello everybody. New to Fortigate NGFW solutions and need some help. I'm running Fortigate 120G HA Active-Passive cluster as a hub and a 70G HA Active-Passive cluster as a spoke. There are two WAN links connecting hub and spoke which are in the SDWAN Global zone + two IPSec tunnels over these underlays which are in the SDWAN Local zone. BGP on loopbacks is the routing protocol I'm using. Point is, I expect RDP between hub and spoke to failover seamlessly when the primary link fails, but each time I try I see session drop, as if conn-reset was sent, although we have quite moderate reconnect timings. As far as I read from fortinet community, when there's a link fail, existing sessions first are being flagged as dirty, then re-evaluated and then considered may-dirty again, no asymmetric traffic issue. How to even approach this problem and where to start debugging? Any suggestions?

I'm trying to find a DLP solution that stores tags within the metadata of individual files, rather than in a separate database. I haven't been able to find an answer for FortiDLP, so I wanted to check here to see if anyone knew the answer.

I can connect without any problem to our FortiGate FG‑60F using FortiClient 7.2.0864 on an Intel / Windows 11 device.However, this older version is not supported on ARM / Windows 11, so I upgraded to FortiClient 7.4.3 hotfix 1.8758 (ARM64) on a Surface Pro with Windows 11 ARM.The installation succeeds, but when starting the IPsec VPN I immediately get:“FortiClient – IPsec connection is down”I also noticed that the FortiClient VPN Service / SSLVPNDaemon services are missing on the ARM device, which suggests that the VPN engine is not being installed correctly.It seems other ARM users resolved this by installing the MSI version of FortiClient (instead of the EXE), but the MSI installer is not available for download in the normal Product Downloads section.Where can I obtain the MSI installer for FortiClient 7.4.x ARM64?Do I need to request it through Fortinet Support, or is it available somewhere in the download portal?Thanks for any guidance.

Please recommend troubleshooting for this problem

Hi all, I've got the opportunity to purchase a new sealed Fortinet FG-3700D from a liquidation sale and wanted to get an idea on its value, looking on eBay some are listed for $8k and others sold for $50-900 so is it purely a licence thing?Roughly what would you pay for one of these?Sorry for this being a first post. Any pointers appreciated, thanks.