Fortinet Community

Hi, I wanted to ask is there any configuration to setup for internal network and ports for accessing the cctv?Because I can view the cctv outside the local network (using mobile data or network outside the office) but I cannot view the cctv when im in the office using local network. Below is the VIPs I created, is there any other configurations need to be made? 

I have topology like below picture. Why azure see prefix 10.100.0.0/16 from AS65100-65103?In the hub i have prefix list only subnet 10.103.0.0/16 will be advertised to azure and in the spoke will advertise subnet 10.100.0.0/16 

Hi,I am trying to register for the FCP_FGT_AD-7.6 (FortiGate Administrator) exam via Pearson VUE in Japan.The exam language is fixed to Japanese, and I do not see an option to select English, while some other Fortinet exams appear in English by default.Could someone please confirm whether this exam is Japanese-only in Japan, or if there is any supported way to take it in English ? Thank you.    

Received complaints from one of our customers because they were unable to reach a service managed by a third party behind their separate FortiGate cluster. (Redirected via static route on lan).Turns out, after upgrading to 7.4.10 you now need to add lan-lan-policies, which wasn't the case before.Changing this sort of default behavior in existing configurations should at least be done with some sort of notification on the GUI.

FortiMail 3000FFirmware version: 7.4.2 I manage two FortiMail 3000F units.It has been just about a year since I purchased them.During that time, I have rebooted and turned off and then on FortiMail several times to work and check its operation.Normal startup time is about 5 minutes. However, four months ago, one of the two FortiMail systems was turned off and then on, and it took 30 minutes to boot up.We had our hardware vendor investigate but could not determine the cause.Today, we restarted a different FortiMail and it took 30 minutes to start up as in the previous incident. We are wondering if there is some structural defect in the hardware or software that is causing this, and would appreciate any information you may have on this.

Hello, we currently run FortiMail VM01 on‑prem and have purchased 110 FortiMail Cloud licenses.What’s the recommended way to transition—can existing settings, policies, and configurations be migrated to the cloud?Or does everything need to be rebuilt manually from scratch in FortiMail Cloud?Looking for best practices, steps, or guidance from anyone who has done this migration.

Hello.Within our proxmox environment we have several vlans.  The proxmox has several bonds with some of the interfaces configured as active/failover - such as the mgmt, and a separate bond for the vlan traffic. As it happens one of the vlans within the proxmox environment has the same vlan number as the switch.  By this I mean, the interface on bond0 is configured as the same vlan # that the servers have.  Obsivesily, the servers are 'tagged' within the proxmox environment to 'tag' traffic to/from other devices on that network.Here's a breakdown -Proxmox environment - native vlan is 10.  with an address of 10.0.1.xOn the switch network, which I'd like to configure the 'trunk', the default vlan is 10.The proxmox manages traffic in/out off of the 2nd bond or interfaces, but as the servers are also 'set' to use vlan 10, how will this work? It's almost like a 'nested' configuration with both interfaces using the same network - but not so as the proxmox handles

I think I have the answer, and it's yes - but wanted to confirm with everyone. new system running 7.4.8M 6484logged in and got a msg about upgrading to 7.4.9. since auto upgrade was turned off i have the option to upgrade.  trying thru clicking to upgrade doesn't work so the process should be manual, i presume.banner message says there's a (nother) issue with this firmware and i need to upgrade to 7.9M.  reviewing the document - Fortinet Document Library | Upgrade Path Toolit seems like there are 2 upgrades to get to this firmware, 7.4.8M2795 then 7.4.9M2829. Does this mean that i have to do 2 download/upload/reboots to 'jump' to the recommended level.  Again, i think the answer is yes - but wanted to confirm. 2 questions:1 - If this is the path and procedure for upgrades from 1 version to another, higher version? ie no 'jumping' to the latest version? trying to click on upgrade from my console didn't work as the gui seemed to indicate.2. since 7

Looking for some assistance on setting up GRE tunnels to Zscaler from our FortiGate 201F firmware version 7.4.9.  I found the following community post Configuring a failover scenario using a r... - Fortinet Community and used it as a guide but was advised I would need to use a policy route instead of static routes as I only want traffic coming in from a specific interface to go over this GRE tunnel, not all traffic on the FortiGate.  This is for some SSIDs available to teammates for personal WiFi.  Below is the config for the GRE tunnel and interface, policy route and firewall policy.  I do not see any logs on Zscaler to indicate any traffic is making it to that side.  I have tried modifying the policy route but any changes I make there cause no traffic to log on the FortiGate.  How it is set now at least shows DNS requests from devices in the FortiGate logs but nothing in Zscaler. GRE Tunnelconfig system gre-tunneledit "Zscaler"set interfac

Hi everyone, I’m trying to drop all CrowdStrike logs except those that contain the tag SensorGroupingTags/ABC.I’ve configured an event-dropping rule as shown in the screenshot, but I’m still receiving all CrowdStrike logs instead of only the ones with the specified tag.Has anyone encountered this issue or can point out what might be wrong with the rule logic? Regex: ^(?!.*SensorGroupingTags/ABC).*@Gabe_FTNT  @Secusaurus @AEH     

Hi everyone, I’m currently testing automation-based configuration backups to my SFTP server.This setup works correctly on FortiSwitch 7.4.8,but after upgrading to 7.6.6, the automation no longer completes successfully — with the same configuration and the same SFTP server.Below are the configuration and logs for reference. Config:config system automation-triggeredit "backup"set trigger-type scheduledset trigger-hour 10set trigger-minute 40nextend config system automation-actionedit "backup"set action-type cli-scriptset script "execute backup config sftp %%log.date%%_FSW-124F_Backup.conf [my sftp server ip] [account] [password]"set accprofile "super_admin"nextend config system automation-stitchedit "backup"set trigger "backup"set action "backup"nextend Logs: 7.4.8:FSW-124F # execute log display1: 2026-01-20 10:40:23 log_id=0103030515 tz=+0800 type=event subtype=system pri=notice vd=root user="unknown" ui=auto-script action=backup msg="User unknown backed up

I have a setting with a (cluster of) 1801F, all internal networks are vlan interfaces is on a 2x10G LACP. I have network A which does mostly webRTC to network B. When there is an important traffic between some other vlans (let's say C and D, but not always the same), latency between A and B grows, such that clients see the latency. What should I look for in the configuration ?. The policy for traffic from A to B has full logging, may it cause some latency ? Fortigate 7.0.17

Received complaints from one of our customers because they were unable to reach a service managed by a third party behind their separate FortiGate cluster. (Redirected via static route on lan).Turns out, after upgrading to 7.4.10 you now need to add lan-lan-policies, which wasn't the case before.Changing this sort of default behavior in existing configurations should at least be done with some sort of notification on the GUI.

Dear colleagues, I need help with URL rewriting (fw 8.0.3 if it's important). We have a "bad-coded" local site (let it be site.domain.local. suffix is .local, it's important). A lot of pages of this site contain hardcoded absolute URLs for file download (e.g. https://site.domain.local/storage/filename).Also site has a builtin user authentication form. When user opens https://site.domain.local/ page the site engine checks that user isn's authenticated, calculates special hash and send 302 redirect message with Location: https://site.domain.local/loginform?hash=XXXX header. Now we need to publish this site to internet via Fortiweb. We use public name site.company.com for publishing.  I created HTTP content routing policy for site.company.com -> site.domain.local. I also created web protection profile with URL rewriting policy. Policy contains 3 rules:1. Rewrite request Host header site.domain.com -> site.domain.local (action Stop)2. Rewrite respon

Hello everyone, This might be a basic question, but what is the purpose on integrating FortiNAC with an LDAP server BR,

Received a notice that 7.4.10 firmware is ready for installation. Release notes for 7.4.10 indicate ssl-vpn is being dropped from entry level 50,70,90 series, but does not mention 60 What about 60 series? 7.6+ firmware for 60 series also drops ssl-vpn So what's going on? Is ssl-vpn going to be dropped from other models also? We were considering upgrading, but need ssl-vpn with saml authentication.  

Good day! For monitoring purposes, we set up a custom integration with the Fortigate Cloud API. A couple of months ago, our custom integrations stopped working. Authentication still succeeds so it's not a credential/auth issue. We noticed that the following endpoint does not return any data anymore: https://euapi.fortigate.forticloud.com/forticloudapi/v1/devices  Instead we are hit with the following error:{"error":"invalid_client","error_description":"Authentication failed","error_code":-1} This error indicated invalid_client (we used fortigatecloud as per the docs). Even stranger is the fact that we can query the API enpoints for individual devices by specifying the gate's SN. https://euapi.fortigate.forticloud.com/forticloudapi/v1/devices/FGT40FXXXXXX This proves that my access_token is valid and can authenticate against the API endpoints (again: with client_id: fortigatecloud). The fact we get a valid response also confirms to me that it's not a n

We have a FortiGate 40F with two WAN lines.I know there are knowledge base articles on how to configure fail over without load balancing.However how do I check how it is configured at this time?What I want is fail over without load balancing.

Hi, Was hoping someone may have seen this or knows what is happening, I will do my best to explain: I am in the process of converting legacy firewalls to a VDOM 400F, all has gone successful  except for one conversion from a palo to an Internal VDOM. I used Forti convertor for all the conversions of objects policies etc and put the VDOM into Central NAT to make it easier, (I did some ASA conversions and it converted better this way) My last conversion Palo  > FGT, all worked except, 1 very important traffic flow, so had to "backout" and reintroduce the Palo, so I cant even do live troubleshooting untill I attempt it again. Traffic flow is: Azure Cloud Exchange (51.x.x.x) > External VDOM Firewall destination Public Firewall address (60.60.60.1 as an example) DNAT on External firewall changes 60.60.60.1 to 192.168.1.1 which is located off the INTERNAL VDOM, This all works fine, and at the moment the traffic passed to the PALO and goes on its merry way.

Hello Fortinet Community,I am working on a lab / design scenario and would like to ask for guidance on whether this setup is technically supported or if there is a recommended workaround.A FortiGate External is deployed at the edge (Internet-facing)A FortiGate Internal is deployed behind itThe Internal FortiGate is intended to terminate IPsec Remote Access VPN (FortiClient)The External FortiGate acts only as a border firewall (NAT / routing)So i wanna ask you whether my topology working normally, if yes, can you guide me how to deploy, thanks very much

I have prefix list to filter which prefix will be send to azure.Previously ID no 4 is not exist and i can see in the advertise route only showig 10.103.0.0/16 and 172.30.30.0/24 FW01 (Internet) # get router info bgp neighbors 10.201.0.4 advertised-routesVRF 0 BGP table version is 43362, local router ID is 10.103.103.103Status codes: s suppressed, d damped, h history, * valid, > best, i - internalOrigin codes: i - IGP, e - EGP, ? - incompleteNetwork Next Hop Metric LocPrf Weight RouteTag Path*> 10.103.0.0/16 10.210.0.103 100 32768 0 i <-/->*> 172.30.30.0/24 10.210.0.103 100 32768 0 i <-/->Total number of prefixes 2 But when i add ID number 4 above why the fgt still advertise 2 prefix and not advertise 10.105.0.0/16?

Hello Fortimail admins,  I created a user alias that forwards to multiple people including me.When I send/reply with that alias in CC, I also receive the email.Is there a way to prevent that? Kind regards,

Hi everyone, I'm having a problem with one of my 431F APs.We have a 600F firewall on 7.2.12 and a 431F AP on 7.2.6. At one site, the AP randomly stops sending out SSIDs, so clients can't connect. The strange thing is that the firewall can still ping the AP's IP without any issues.

I have a second-hand FortiGate-110C, but it seems that the firmware is damaged and it can't start normally. Since it's a second-hand device, I can't download the firmware from the Internet now. Could anyone provide me with the firmware? Thank you very much. Email: 404000768。@。163.。com#FortiGate-110C

I have started to set up FortiAP 23JF devices on our network using Fortigate 3200D as the Controller. They are working fine but what I am trying to do is make the POE port LAN3 on the FortiAP to only accept the Avaya Phones on that port so Guests cant unplug the phone and plug their laptop in and get on the Voice network. I have created a Firewall Object Address called "Avaya" with a list of all the MAC addresses of the Phones in each room. Then under SSID's created a SSID called "AvayaVOIP" with the Address Group Policy set to "allow" and chosen the object created above. Then I created a FortiAP Profile called "AvayaFAP23JF" and assigned it to one of the FortiAP's which all worked fine but when testing and plugging in my laptop to Port3 I still get assigned an IP on that port. The Cisco AP's that I am replacing with the FortiAP's were VLAN aware so I could untag the Guest VLAN (2201) and Tag the VOIP network (2065) so if a client unplugged the phone and plugged in they would be put on