Solved

How can I add a second server if the first fails.And I tried to add another server but it tells me that it has the same domain and I cannot validate it through the CLI.I appreciate your helpI have the server virtualized 

HiI have trial fortianalyzer vm and it has 500 GB disk size in esxi but in dashboard I see only 50 GB disk quota. How can i use all 500 GB space?

 I am looking for some tips or advice on performing firmware upgrades through FortiManager. This tool, https://docs.fortinet.com/compatibility-tool/fortimanager has been helpful but I want to make sure I understand what's its telling me. When it refers to fortiOS family, is that for all devices in direct relation to Fortimanager? Because there seems to be a second layer of compatibility between when its going from the FortiGate to a FortiSwitch. https://docs.fortinet.com/document/fortiswitch/7.4.2/fortilink-compatibility I just want to make sure the firmware I upgrade some of these devices to doesn't exceed what's supported by our FMG or directly connected devices. Any clarification or information on this process is appreciated. Also I am fairly new to Fortigate products so be gentle.

We have an egress policy to allow traffic to a (partner) service hosted in AWS - thus the IP address of the remote server is dynamic.In these scenarios, is there a way to create a policy object that can represent a dynamic lookup? Or how else might this be addressed on a Fortinet firewall... aside from a "looser" policy that only specifies source and protocol? TIA!

HelloI found nothing documented regarding ZTNA server path regular expression.Anyone knows how to use it? 

I have a FortiMail FE-60D operating in transparent mode. In my LAN, I have an Exchange server, and everything is configured and functioning correctly. There are some clients within the local network who have, in addition to our corporate email, another email configured with a POP3 connection to retrieve their emails. My question is whether the FortiMail can be configured to filter incoming emails from a different domain that come through the POP3 protocol.

Hi,I was hoping that running the command "psql -U phoenix phoenixdb -c "select * from ph_device;"" would give me, besides the device list, the consumed EPS per device. It doesn't, so I'm asking if there is such a command/GUI menu to show/export such information. Thanks

Hi all,I have a question about the logging in FortiAnalyzer when the FortiGates are part of the Security Fabric. So, FortiGate A has servers connected to it and a client behind FortiGate B sends traffic to one of these servers. Will there be 2 logging records in the FortiAnalyzer, one for each FortiGate? Or will there be only one logging of this traffic?  Thank you in advance!

Hi all,We use the Fortclient SSL VPNs on users laptops that work from home and this works well however we have a single user that uses a softphone program on her laptop to connect to a voip cloud platform (gamma horizon) but the VPN is causing a delay in this (it works fine without the VPN on). I know in older versions of Windows there was a tick box in the IPV4 settings on the NIC to not use the default gateway on the remote machine which would then let the local internet (at the users house) be the breakout point for everything that wasn't needing to go across the VPN but that option is no longer there so someone has said to setup split tunneling on the Fortinet Router (100F) but is this the correct way to do this as i thought if it's having to hit the router to pick this up in the first place then it kind of misses the point of the breakout being at the users house ?Hope that makes sense but if anyone can advise ?Thanks

I am running FortiGate in AWS.  I have users who will be using SSL VPN (no natting).   I have many hosts I need to reach over SSL-VPN in AWS that are accessed via a TransitGateway.  The TransitGateway has the route of 10.0.0.0/8.  However, when I am trying to access some of the servers the packets are not making it back to the FortiGate Firewall. Does anyone know if I should create a route for the TransitGateway propagating the SSL-VPN pool IPs?

I have split tunnel and split dns set up.  When I vpn in I can see that my dns servers are set to what is defined in the split tunnel configuration.  However, when I try to do a dns lookup the response shows me the dns server from the split tunnel but then gives me "Request timed out".   If I change the Firewall rule to do NATing of the SSL VPN connection DNS lookups work fine. Does this mean I need a firewall rule allowing ssl.root to access the dns servers?

hi, guys do you have any idea how can i know the date of End of support fortigate  80F. 

HI there,I am adding 3rd party threat feeds using external connecter in fortigate and then i am calling threat feed name in outbound deny policy.my question is that does it requires any downtime or other service effect in fortigate?

HiI am using faz trial license and it says you logs exceeda your limit. So my question is, what happens to logs send to faz after that?

I'm experiencing issues with FortiClient for the last 2 months. There are no problems connecting the the vpn however once connected if i open up certain applications like my developer IDE or outlook then it'll disconnect. I have checked the logs and noticed the following entries when this happens.info sslvpn FortiSslvpn: 22716: Ras: connection to fortissl terminatedinfo sslvpn FortiSslvpn: 8872: Did not find interface for local_gwy Also, i use docker desktop in windows. Docker Desktop refuses to start if i'm already connected to the vpn. To get this working I have to start docker desktop before trying to connect via FortiClient Any help on this will be appreciated. Thanks

Hello everyone,I have a problem where i cannot ping PC from fortiGate, I already set the Static Routing inside fortiGate for the PC network Segment, but I can ping the router IP with same segment as PC. Here's the topology below.   

Hi All, Just a quick question as I couldn't find an answer either on here or generally across the web. Is it possible to set up High Availability using two different Forti models? We have a 100F as our primary FW but would like to use a 100E model we have spare and set up HA in a active-passive mode. I have been advised by our external IT company that it is not possible but just wanted to double check. I have matched the Firmware on the two devices but not sure on how the physical cabling would work, being that they are different models with different port arrangements? Just to add some information about our set up; we have two VDOM's set up; WAN wise, we have two leased lines connected - one running using built-in WAN1 & WAN2 ports and the other using an SFP port (#13) as their uplinks. Happy to provide more information. Thanks in advance.Chris 

Hi,I created a DENY policy (see. picture below). I tried to enable log violation traffic, but after click OK, and than reedit the policy it is switched off again. This is a normal behaviour?  

Hello all! I have some questions regarding some basics of the Fortinet ZTNA setup. I did go through the ZTNA and FortiEMS training but just wanted some things clarified if possible. 1st Dumb Question - Is the ZTNA Server just one of my Fortigate Firewalls? (It's not another physical box/server I have to setup right?) It seems like if I have two locations, each Fortigate could be a ZTNA server for access to the resources that are located there. Both would have to be joined via the Fabric connectors and one of those would have to serve as the "Fabric Root". If the above is true, when I'm setting up my ZTNA Server on one of the Fortigates, for the external IP, can I just choose any IP that's associated with my assigned block, and would I then connect via that IP address for access resources externally? (Let's say I have 123.123.123.1-50 for my external IPs, can I just set that external IP to 123.123.123.5, then if I setup rules to access SMB let's say, when I map a network

I have 2 VPN servers. I configure them in the list when setting up the VPN client. If the first server is unavailable, the client does not connect to the second server. Am I doing something wrong?

Hi, I'm trying to add ip addresses to my Fortigate but I'm getting an HTTP Forbidden.Here are the commands I run:curl -k -i -X POST https://X.X.X.X/logincheck -d "username=apiuser&secretkey=apiuser" --dump-header header.txt -c cookies.txtcurl -k -i -X POST https://X.X.X.X/api/v2/cmdb/firewall/address -d "{'name':'test','subnet':'1.1.1.1/32' }" -b header.txt My user apiuser has the profile super_admin. Do you know why I'm getting an HTTP/1.1 403 Forbidden? Thank you in advance. All the best,Hyjaal

Hey all, Have a Fortigate 81F.  Came with firmware 6.4.? (can't remember) and I ran the update process via the web GUI to update it to 7.0.15. It is now stuck with a static orange power led and the 3 green bars on the left, no other leds are lit.  I am getting no response via console cable. I have logged a ticket with Fortinet.  I didn't want to power cycle it just in case.  Has anyone had this before and resolved it? thanks j

Hello, everyone,but is it possible to configure the HA of two FGTs when they synchronize the configuration with a delay ?I read something about a hw-session-sync-dev command but my two FGTs (200F) with release 7.2.3 do not have it. Has anyone ever tried this ? Thanks in advance

I have a FortiGate 60F running firmware v7.4.3 build 2573. It is connected to the Internet via the Wan1 interface. Wan1 is configured with a static IP address that I rent from my ISP. My firewall is configured to let the internal network go out to the Internet.  I followed the documentation to add a split tunnel VPN so that I can RDP into my servers. It has worked great for a couple of years.  Lat week, I added a Virtual IP and a policy to point to my NGINX Proxy Manager. To expose an HTTP site with an NPM cert to make it HTTPS. But when I activate the policy, it breaks the VPN. Obviously, my knowledge is minimal at best. I would like to be able to expose a couple of web apps through NGINX and be able to continue to use RDP from the outside. My goal is to learn, and to solve my problem: 1. Should I be looking at using the FortiGate as the reverse proxy? If so, where is the documentation for setting that up and how to have it generate certs the wa

I've got an IPsec tunnel to a VM running StrongSwan. When I bring the tunnel up, everything works as expected for about 1 hour, after which the tunnel seems to stop working as it show's as Down on the Fortigate side. If I restart the ipsec tunnel on the strongswan side, it works again for about 1 hour.I followed this guide to set this up originally https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-Site-to-Site-VPN-with-Strongswan-on/ta-p/275092Output of "ipsec statusall"My ipsec.confOn the fortigate side of things I got the following as my tunnel settingsI've omitted the firewall rules and routes as these are working fine as far as I can tell. Any idea what could be causing this and how to fix it? Would appreciate any pointers!