Solved

I got a wonderful suggestion (kudos to the Fortinet community, excellent place) from previous post which I have not tried as yet, where i can turn off "check sender domain" to resolve the session domain(classifier) error where a particular mail is being rejected. Before doing this change though, after doing some reading, I tried using the block/safe list domain wide under security->block/safe list, but mails from that specific sender still being blocked. I need these mails as they are financial in nature. Is there any other way to exclude selected mail domains/senders from being blocked rather than turning off "Check sender domain"? Community member is experiencing the same issue, but received no response 

Our customer is using 100F  firewall with os version of  v7.0.14,build0601,240206 (GA.M).  Recently, we noticed that memory consumption is spiked up to  71.5% of the total memory. Upon checking  the processes, we noticed that fnbamd process is consuming 12.2 % of the total memory. What should I  do to solve this issue.  Your assistance would be greatly appreciated. 

Is there a way to geo lock access to Windows IKEv2 native VPN on Fortigate (same as one can do with SSL VPN)? Seb

Good morning at all, I have a problem using the captive portal on MACos.The login and password page pops up, I enter them and the page times out. I'm wondering if anyone has had this problem and if they have any advice for me. Same user with windows and android everything ok.in the past I remember having this problem and they asked me to open some Apple links for everyone but I don't remember and I don't want to remember them badly. please help. Fortios 7.2.8 

Hello,  I'm running Juniper MiST solution and all users are authenticated using Aruba ClearPass Radius against Active Directory.  Recently, I implemented FortiGate F1801 and wanted to see the authenticated user accounts/names instead of the IP Address.  Any guide in doing this config? I have followed multiple KB articles, but still not able to see the Authenticated Users in Clearpass to appear in FortiGate.  Any help on this please? Regards,  

When I Scheduled Playbook where its input come from,I mean for example i want to schedule daily reputation check on the Indicator and change the status depend on it,thanks on advance, 

Hello, everyoneI hope you are all doing great. Since upgrading our Fortigate to 7.4.3, we have been missing "SD-WAN Rules" page from loading. It was said to be a bug that was going to be fixed in future releases. This morning, I saw that 7.4.4 is available.Does anyone know if the problem has been addressed in this release or not? Best regards,

Hello Expert, We have two 400E fortigates in a HA cluster.This afternoon we temporary shutdown the secondary member in facilitate changing a defective patch cable which was connected to the respective HA ports on the active and passive device.The defective cable was remove ad replace with new one.When the secondary FortiGate was repowered during checking the system status it was discovered HA was out of sync.I humbly request you assistance to fix same.

I need to get full configuration from fortigate 600E with REST API. I want to know how send cli command with rest api. Maybe I can use post method for send cli command? Or u tell me other ways to do it with rest api. Thanks 

Hi all, We have web application fire wall latest version (7.4.3) i have a few sites under it.when some one attacks using tools and what not , how can i block his ip Address automatically when the system detects that he is triggering the deny rules?right now it just block every attempts he tries , it should just block him why wait until he passesThanks

Just inherited a site with Fortigate 60E. Old firmware 5.4.5 will be updated but now just need to get remote access using OpenVPN. All indications are port forwarding not working. Have read lots of docs and viewed numerous videos and tried assorted combinations but none work. (I use OpenVPN to other server sites, and similar routers (sonicwall)). Here are some of the address objects and policy combinations I've tried. Thanks. T  

Duplicate the configurationI often have to configure fortigate 40f or 60f in HAI was wondering is it possible to download the configuration of a fortigate online and upload it to a new fortigate (during this activity the fortigate will be offline) where I would then go and change just a few things about the configuration?Is it possible to copy a 40 f configuration onto a 60 f?Or is it better to do this activity on identical models? Thanks in advance

This is a FortiSwitch 248E-FPOE. I have replicated the issue with another switch.  The switches were on 7.2.1 and I tried to upgrade one to 7.2.4.  After I noticed the issue, I upgraded another to 7.2.3 with no issue, and then to 7.2.4 where the issue was there again.  I can ssh to the device using putty, but SolarWinds cannot anymore (I believe solarwinds ncm uses 'We only do' ssh client). SolarWinds gives an error about not being able to negotiate encryption.   On the switch's logs I see that the negotiation failed due to 'no matching MAC found. Their offer: hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5-none'. I have 'Strong Cyphers' enabled on the switch, but it was previously enabled on 7.2.1 and 7.2.3 (and I'd prefer to keep it on).  I disabled 'Strong Cyphers' just to test and was met with a different log along the lines of 'no matching host key type found. Their offer: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss'.   Did the defaults chan

Dear Support,Please kindly advise me here.I have Fortigate firewall version 7.2.8 configured with FortiClient VPN to Onpremise network and all is working fine, but now I want to add a connection(IPsec tunnel) to Microsoft Azure in the Cloud, we are in the process of migrating to cloud. Is it possible to run a local connection to (Onpremise) and then another connection again into Microsoft Azure Cloud simultaneously without conflict and will that work properly?And will I be able to connect two FortiClient VPN's one to Ompremise network and the other to Microsoft Azure Cloud network on my laptop?I look forward to your response.Thank you in advance.Kind regards,Abel

Good day Fortinet Family, I am use to Symantec Endpoint Protection (SEPM) and other security management endpoint applications where i can block USB/removable storage media excluding mouse, keyboard etc as it was easier, especially with SEPM.  How can achieve this with Forticlient EMS 7.2? In my Forticlient admin portal, I am at the section under MALWARE PROTECTION where you can block removable media, but some scary stuff here, when i select "block" it says that keyboard and mouse will be blocked as well LOL. I am also seeing some simple/regular expression fields to fill out some exclusions, I guess. Then i came upon this post.https://www.reddit.com/r/fortinet/comments/mpdtcq/forticlient_ems_never_ever_block_default/ I created a test environment with a test policy, profile and OU, adding only one laptop to this and trust me, i applied the block option and NOTHING works on the laptop.  Can someone tell me how to only block removable stage while all

Hello please tell me what can be done on windows x32bit information is not displayed in the window FortiClient VPN 

I have 2 fortigate clusters on my network. One is for sslvpn and the other one is for the internet(rest of the traffic other than sslvpn). They are connected to the internet router via a switch in between. They both have different public IP addresses, however, when i ping sslvpn firewall from outside, packets arrive to both internet and sslvpn firewalls as if there is a load balance (I sniff the trafic using sniffer command). It is very confusing bcs the IP addresses are different and there is no load balance at all. What can be the reason behind? Or do you have any other recommendations for tshoot? Thx in advance sslvpn -> 400F (active passive ha)Internet -> 600E (active passive ha)

Hi mates,I want to transfer one of my devices to another account but there's a question, what happens to my currently activated subscription?I mean the device have 2 years subscription (Antivirus, IPS, ...) when i transfer device to new account, are the license/subscription gonna transfers to the new account?Or it is bundled to the device's serial number and not depends on account?

Hi there,I am accessing my FortiGate web GUI using a public IP address.My question is, whenever I access the web GUI using the domain name, it does not show any error regarding an unsecured connection. However, whenever I try to access it using the IP address, it shows an unsecured connection error.I want the FortiGate to only be accessible via the domain name with a secured, encrypted connection, and not via the IP address

Hi All, I have taken then backup FG configuration by using the scp client command which i used to take the backup as below. Sftp server -- > scp admin@<FortiGate_IP>:sys_config <location> Question 1 : sys_config  ( is it full configuration file as like what we are taking the normal backup config from GUI -- > admin --> configuration -- > backup -- > downloaded with xxxxxx.conf Question 2 : Can we use the "sys_config"  scp client backup file to restore the firewall configuration in the Manual GUI method  admin --- > configuration -- > restore -- > upload -- > "sys_config" Does it work or any problem with this restore proceedure ?

Greetings  Hello guys, please give me some tip to solve this. We deployed FortiSIEM supervisor and a collector for Windows Agents that are remotely on branch sites, they reach collector and supervisor with FQDN using public ip (port 443) no IPSec can be established. Internally the Supervisor and Collector communicate each other with private IP, we noted that Windows Agents can register normally, but when template is applied, they (agents) try to reach the collector through private IP, not the fqdn or public IP, for us this is reasonable because collector health on supervisor shows the private IP for collector. On windows Agent we run Wireshark, and effectively note that SYN packets are constantly sent to collector private IP. How this can be solved? there are a way to say that Windows Agents must send data to collector public IP instead of private?, we try to re-register the agent using collector as a proxy but once the template is applied, they start to s

I have a site to site VPN, i want to apply a traffic shapping to specific traffic (sourc IP), but in the shaping policy it is not matching the traffic through the IPSEC tunnel. There are some configuration that works different for interface like wan and not for IPSEC tunnel ? FortiGate 

Unable to load SD-WAN rules with firmware 7.4.3. This error is already in the list of errors in firmware 7.4.3 but there is no update to fix it

hi everybody i want to limit bandwith of sentinel one packet antivirus in my lan.i don't see the signature of this application on my fortigate 100 D THANKS FOR HELP 

Buenas,Cambie mi Forti AP de oficina,por ende, cambio su IP. Ya tengo acceso al Forti AP sin embargo, mi Fortigate no lo detecta y aparece como Offline. Recalco que los segmentos entre el Forti AP y el Fortigate si tienen comunicación, sin embargo, mi FTG sigue sin tomar nuevamente el Forti AP. Ya lo reinstalé de fábrica y sigue el mismo problema