Solved

Hi, i have a Fortigate 200D Firewall with FortiOS 6.0.16 and a Huawei 4G Webstick Modell 3372h. I can't bring the Connection to the LTE-Network up. I searched around and found this https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-Huawei-E3372-h-modem-stick/ta-p/193600 The Problem is, that i have the AT-Command Version of this Stick and this HowTo is for the Web-Interface Version. When i try to configure the Stick as lte-modemdiagnose sys lte-modem infosays, that the Modem is not connected.  So i tried to configure the Stick as "normal" Modem. The Modem itself seems to work properly: diagnose sys modem queryUSB status: Connectedmanufacturer: huaweimodel: E3372IMEI number: 868230032061123SIM state: Validservice status: Valid Servicesignal level: 3/4network name: E-Plusnetwork type: E-UTRANlocation area code:active profile(AT&V):COMMAND NOT SUPPORT^RSSI:18^HCSQ:"LTE",45,47,136,26 But in the Debug Messages a Timout occures (At

I was curious if anyone was already ingesting the Malicious IP and/or Domain Lists from their MS-ISAC membership?  Someone asked in another community thread if those were included in the Fortigate threat feeds somewhere, but didn't get a response.  I’ve gone through the steps in several documents from support, but keep running into an Internal Error on my Fortigate when I refresh the object.  I figured I would check and see if someone had already figured this out and would mind sharing the configuration settings they used to create their successful objects.  I’m running a case with support but it’s slow going.

How do I schedule a reboot in FortiGate firewall at a certain time from remote ?

Anyone know wbaout below error and how to fix this when try configure the eap-tls?failed continuing EAP TLS (13) session. EAP sub-module failed

Hi I want to have 1 single FortiGuard license for my 2x100F FortiGate.You have the doc if the devices are not yet registered, but i want to do this with already registerd device is this possible?FYI Doc, how to do if the devices are not registered.https://docs.fortinet.com/document/fortigate/7.4.11/administration-guide/246857     

Hi I’ve been using the FortiClient app for many years on my personal Surface Pro 7 device. Not had any issues, but recently we’ve taken part in a vulnerability audit and the app is flagging a few issues. The solution is to update, but I’m struggling to do so. I had version 7.4.3 installed but need 7.4.5 for the vulnerability to be cleared. When I download the latest software file it doesn’t show any version options. Instead, it I think it pulls down the latest version it can. I’ve tried to reinstall but still only getting to 7.4.3. I’ve seen a post regarding Snapdragon processors not being compliant, with newer versions of the Surface Pro. That may explain why my colleagues Pro 12 is not working at all with the app. But my older 7 model works fine, but I just need help updating. Many thanks 

hi,is there a way to send a weekly or monthly report to our registered email for the FortiFlex license points usage?it’s kinda tedious and manual looking at the points usage in the portal.or are we just going to receive an email if it’s already in a low point threshold?

I have recently opened a ticket with Fortinet and shared this information so that Fortinet can fix a problem that was recently introduced in some of the newer 7.4 versions (such as 7.4.10, 7.4.11 and possibly earlier and later versions).  It may affect many other versions, but I'm not sure, because I've been only having the issues with recent 7.4 versions.  I have tested this on models 40F, 60F, and 61F, but I am guessing it will not be model specific.The issue: When doing a system Format of the drive, and then doing a TFTP firmware recovery, the TFTP connection will repeatedly "Timeout" when it attempts to download the firmware.   On the TFTP server side, there will be a log entry when it connects, and it will result in a "Transfer Timed Out" message after it tries a number of times.I tested this using multiple TFTP servers:1) TFTPD32/TFTPD64.exe by Philippe Jounin on windows. 2) Fedora Linux's install of TFTP server3) The "Transfer" app for Mac by intuitbits4) Mac OS Native TFTP serv

Hi All, I want to ask about URL Filter in Webfilter Profile.I added a URL Filter Exempt(type:wildcard).Target url to use 8020 port, but Access block. I checked this KB: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Resolve-issue-web-filter-block-override-and/ta-p/193291?externalID=FD39997And set config: set ovrd-auth-port-warning 9020, and then the URL Filter takes effect.Does the official document mention that Fortiguard uses this port like the link below?I wonder my solution is correct. https://docs.fortinet.com/document/fortigate/6.4.0/ports-and-protocols/362392/fortiguard-open-portsMy Fortigate: 6.4.9 

Hello, I have a headquarters site with a FortiGate firewall.We also have multiple secondary sites across the country. Each remote site normally uses its primary ISP connection ( through MPLS) to access the corporate network. Our goal is the following:If a remote site loses its primary ISP link,We plug in a Starlink connection at that site,The site should automatically establish an IPsec tunnel (IKEv2) to the headquarters,All traffic (0.0.0.0/0) should be routed through the tunnel to HQ (full tunnel), so the site can continue to access the corporate network and internet through HQ.The tunnel requirements:IPsec with IKEv2Full tunnelStarlink uses dynamic public IPMy question:Is it possible to configure a single Phase 1 and Phase 2 configuration on the HQ FortiGate that can accept connections from all remote sites (with dynamic IP addresses), or do I need to create one Phase1/Phase2 pair per remote site ? What I find difficult to accept from a design perspective is the idea

Hello, Is there any known reason for the FortiClient taking upwards of 30 minutes to download or sometimes failing? Today, one download started, restarted after 40% then failed. This is the VPN only client downloading.    - Dan

Hi all, I have my own Fortigate and one Fortiswitch from ebay.The switch seems under that seller account. Might I know if I still can use Forti-link to manage that switch without any issue? Thank you!

The  FAC 300F  in picture only  has  200 user but its  showing  license type i belief  FAC  300F  only hardware limited upto 1500 user right  ?? 

Hi All, I'm implementing SDWAN topology with Dial-Up Ipsec VPNs. I also want to implement traffic shaping for the relevant traffic. I plan to use Shaping profiles on interfaces but I'm a little bit confused about where to put the shaping profile. On the VPN interface, or on the physical WAN interface. Or Both? Never find a documentation about that. Thank you!

Hello everyone, I would like to know, will I have issues with the persistent agent if I use Fortinac’s Self signed certificate ?  BR,

This same question was asked over a year ago, but never found resolution. I send invites to users following the Technical Tip: How to send email notification which contains FortiClient installer package that embedded with invitation code post. Forticlient is installed and connects to the fabric as expected. If a user disconnects from the fabric they are unable to reconnect without using the invite code. The invite code is supposed to be short-lived and only used to register the endpoint. I thought FCEMS Cloud sent an identity cert to the client machine upon registration. I cannot find any settings for client certs or similar. How are users supposed to reconnect after the invite code expires?

Anyone know where i can download forti vpn client for mac?I try download from https://www.fortinet.com/support/product-downloads#vpn but after i fill the data then the page only showing submitting and back to download now again. 

Can someone from Fortinet indicate when Ubuntu 24.04 will be supported.Ubuntu 24.04 LTS was released on 25 April 2024

Hello, used products: FortiGate 80F/FortiGate 400F I have a simple Hub and Spoke Szenario, which works perfectly in 7.4.8 and less. If I upgrade my spoke to 7.4.9 I can't establish my VPN any more. Spoke says: ike V=root:0:vpn-pfi-hub: connection expiring due to mode-cfg client IPv4 error ike V=root:0:vpn-pfi-hub: going to be deleted ike V=root:0:vpn-pfi-hub: schedule auto-negotiateHub says:twin connection Spoke config: mode-cfg, but with manual assigned ip on the interfaceHub config: mode-cfg, no ip assignmentThere must have been a change in 7.4.9 - but I can't find it. If I downgrade, everything works.Kind regardsTwoSoulz

The documentation states you can define multiple certificates in an SSL profile in replace mode and it will compare the server name identification (SNI) and the common name (CN) with the certificate list in the SSL profile, and use the matched certificate as a replacement. If there is no matched server certificate in the list, then the first server certificate in the list is used as a replacement.However, this does not seem to work if you are using wildcard certificates. I have an SSL profile that has multiple separate wildcard certificates defined in the profile that is used to protect a highly available reverse proxy for several domains and subdomains.e.g. SSL Profile in replace mode has separate wildcard certificates for *.abc.net, *.abc.com, *.io.abc.com, *.abc.org, *.bbc.com, *.bbc.org. If a request comes in with an SNI of www.abc.com it will instead return the first certificate *.abc.net as the exact CN name matching does not match the wildcard.Has anyone else experienced this is

Hello everyone, After finalizing the bulk registration using the Persistent Agent, I’m wondering what’s considered the best practice to register a brand new device.The issue I’m seeing is kind of a chicken and egg problem:New devices can’t access the network because they get isolated (no Persistent Agent yet) But to deploy the Persistent Agent with GPO, the device first needs to join the domain And to join the domain, it needs network access first...How are you guys usually handling first time onboarding for new company devices after the first enrollement ?BR,

The issue:Clients connected to a vlan with Block intra-VLAN enabled can't reach the FortiGate for around 2 minutes and 30 seconds after failover. Clients connected to a vlan with no Block intra-VLAN enabled do not have this issue.All switches are managed by the Fortigate.Topology:2 X Fortigate 601F in HA A/P2 X Core switches FortiSwitch 1024E in MCLAG2 X FSR-216F-POE connected in a ring to the MCLAG switches. So, the first switch connects to the first 1024E switch and the second connects to the second 1024E switch with a link between the two FSR-216F-POE switches. (We can't change this because of the physical fibers)I have tested with two clients connected to the same switch. Client A connected to port 1 on a vlan with intra-vlan blocking enabled, and Client B connected to port 2 on a vlan with intra-vlan blocking disabled.Client A was having issues after the failover and could not reach the Fortigate for around 2 minutes and 30 seconds. Client B does not have any problems. It looses o

Hi, I am trying to migrate IKEv1 to IKEv2 Dial-UP VPN tunnels for devices that use Forticlient and that do not use Forticlient(e.g. MacOS).The configuration includes a split tunnel setup.When a Forticlient enabled client attempts an IPSec connection the client acquires a split tunnel VPN session. I can see the following few lines in the debug session that indicate routes will be installed in the routing table of the device. ike 2:QDIPS_0:10843292: processed INITIAL-CONTACTike 2:QDIPS_0:10843292: mode-cfg assigned (1) IPv4 address 172.28.12.1ike 2:QDIPS_0:10843292: mode-cfg assigned (2) IPv4 netmask 255.255.255.128ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:10.0.0.0/255.0.0.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:172.16.0.0/255.240.0.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:192.168.0.0/255.255.0.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:91.200.16.0/255.255.254.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:141.176.34.0/255.255.255.0:0ike 2:QDIPS_0:1

Hi,  Please, can you change my Fortinet Community Username to "FortiEng_345"?Bests,

Hello, I am trying to update FortiSIEM content version from 901 to 908, but I receive a “server unreachable” error during the update.For testing, I allowed all-all access on the firewall for FortiSIEM, but the issue still persists.Has anyone experienced a similar issue? Are there any specific URLs/FQDNs, ports, or log files that should be checked for FortiSIEM content updates? Best Regards,İsmail ÜREK