Solved

Hi, Assistance with a network configuration. We have two internet modems in our current setup: 1. A fiber connection linked to the Forti WAN port.2. A DIA with a static IP connected to Forti port number 4. The internet is functioning correctly from the WAN port, now we need the user login to specified sites accessed exclusively through port number 4. Modem: FortiWiFi 30EFirmware: v6.2.15 build1378 (GA)

When the Fortimanager was loaded, it was done after loading the Network, so they were left in a single address group, several mappings per device, they asked to add a new address, I wanted to know what would happen if per-mapping was disabled.

Hi,I am trying to create "Overlapping subnets for a VPN tunnel" The VPN is UP, but there is no traffic flowing through Tunnel.I have create Policies but when I checked the Route table, there was no Static Route created by the Wizard, I tried recreating the Tunnel still no Route... Created "Custom", "The remote Site behind NAT" etc. etc. Its not creating Static route.I tried manually creating static routes still no traffic flow.Remote LAN: 10.20.30.0/24Nated IP: 100.100.100.100Gateway : 70.70.70.70Local LAN, 192.168.45.0/24Any help/pointers will be appreciatedThank you

What filters need to be enabled to transfer the source IP address devname = "device_fortigate" on log forwarding? logver = 604145463 timestamp = 1705406294 devname = "device_fortigate" devid = "FG" vd = "root" date = 2024 - 01 - 16 time = 14: 58: 14 eventtime = 1705406295007253541 tz = "" logid = "15010500" type = "utm" subtype = "dns" eventtype = "dns-response" level = "warning" policyid = 459 sessionid = 1734461551 srcip = IP srcport =  srcintf = "DMZ01" srcintfrole = "dmz" dstip = IP dstport =  dstintf = "DC-Transport" dstintfrole = "lan" proto = 17 profile = "DNS-Log" xid = 25739 qname = "" qtype = "A" qtypeval = 1 qclass = "IN" ipaddr = "127.0.0.1" msg = "A rating error occurs" action = "pass" cat = 255 catdesc = "Unknown" error = "no available Fortiguard SDNS servers" 

HiWe're currently trying FortiNAC v7.2.5.0101, everything runs smoothly for most of our devices except for Meraki AP. We follow this guide for configuring/adding the AP https://docs.fortinet.com/document/fortinac-f/7.2.0/network-device-modeling/785561/cisco-meraki-ms-switch Indeed, even though SNMPv3 is enabled on our Meraki oraganization and so AP ( snmpwalk -v3 is ok) FortiNAC always throws an error while trying to add it using S/N as UserName and API Key as Password as you can see below: From a firewall perspective we got not deny or any filtering, proof is we can add the same AP using SNMPv2c for instance. From a FortiNAC perspective, there's no such log or information that may helps to troubleshoot this. Any of you guys succeed to use SNMPv3 between FortiNAC and Meraki ?Thanks a lot for your help & advices FortiNAC     

test

I want to use ADOM Global Database create firewall policy, then assigned to multiple root ADOM device's policy package.So first step, I want to normalize interface on the global database, then I create firewall policy could easily identify multiple devices physical interface name mapping.But I can't normalized interface on the ADOM global databaseOr have any suggestions? Thanks.

Hello FG adminsCould there be any kind of problem if FortiGate in NAT mode sees the same MAC addresses through two independent interfaces?This is not common at all but can happen when you have for some reason one host with one NIC connected to a L2 switch connected to 2 different interfaces on FG.

I have 3 Site A B C using FortiGate-VM (7.0 & 7.2). Three Site using 3 Ip Public for VPN gateway.IPsec Tunnel between A <-> B is Up and running.And I create another Tunnel A <-> C, But the Wizard show "Unable to setup VPN. The rollback process has encountered an error. Orphaned objects may still exist in the configuration database".

We recently acquired Next-Generation Security Licenses.  I have a couple of questions:1.  How do I assign the licenses to my endpoints2.  In the Feature Select tab, everything is grayed out and says "some features below are disabled because they are unlicensed. . . "  How will I enable these since I already have the licenses? Thanks!

Hi All,  CCTV Company is attempting to gain access to their equipment on port 10000 on a public IP on site, however they are telling me port 10000 is blocked. I have an allow any any with no services specified on the Fortigate so it should be passing through. It does work on port 554 however, and I can telnet on port 554 from the Fortigate which shows as open, but not on 10000, and the CCTV company have informed me their device is 100% listening on port 10000 etc.When I ran a debug I got the below: - Elite_Brenntag_Lutte~4JA # execute telnet 88.202.173.10 10000Trying 88.202.173.10...id=65308 trace_id=1 func=print_pkt_detail line=5868 msg="vd-root:1 received a packet(proto=6, 88.202.173.9:18559->88.202.173.10:10000) tun_id=0.0.0.0 from local. flag [S], seq 168818775, ack 0, win 65535"id=65308 trace_id=1 func=init_ip_session_common line=6049 msg="allocate a new session-017937de, tun_id=0.0.0.0"id=65308 trace_id=2 func=print_pkt_detail line=5868 msg="vd-root:1 recei

Hi there, bit of a noob here, thanks for your understanding in advance :) The hardware: Fortiwifi 60f, FS148OE Switch. The switch is connected via FortiLink and has been authorizes and is showing as online. I have the gate with a few rules, a VLAN for the switch ports on 10.2.2.0/24 I have setup a IPSEC remote vpn (split). The VPN can connect no problem and is getting IP and DNS from VPN (using Forti client).My issue is that I can access network resources - cannot ping either way.Let me know if more info is needed.... Policy as follows:config firewall policyedit 13set name "vpn_IPSEC_VPN_remote_0"set srcintf "IPSEC_VPN"set dstintf "INSIDE_FortiSwitch"   --->(10.2.2.0/24)set action acceptset srcaddr "IPSEC_VPN_range"set dstaddr "all"set schedule "always"set service "ALL"set logtraffic allset nat enableset comments "VPN: IPSEC_VPN (Created by VPN wizard)"nextend THE VPN:IP Version IP v4Incoming Interface: VOIP_HQ_WAN (WAN-UFB)Use

Hi,In our previous NG-Firewall solution we had an option to create firewall rules filtering based on a user or a group from Active Directory. We simply had an agent that transmited the user and group membership data to the firewall so the firewall could decide based on logged user from the workstation, its group membership and application proccess trying to access the destination. FortiGate has this functionality, but we are considering potencial licensing issues. I know that FortiAuthenticator provides this functionality as well as a lot more, but it is licensed per user or device on top of FortiGuard and FortiCare. Can we use menctioned functionality as its base without FortiAuthenticator and avoid aditional cost or it is required to buy FortiAuthenticator to be able to place AD user or group as source or destination firewall rule? Also, will those AD and App based rules work with Free FortiClient when a user is authenticated to the VPN?

Hey guys, so this looks like a bug but maybe someone has an idea... :)We have a FortiGate-1500D version 7.2.7 with VDOMs enabled. I created an automation task to do a backup via tftp. The backup executes the following CLI script:config globalexecute backup full-config tftp foldername/%%devname%%-%%date%%.conf 1.2.3.4The task and export itself works, however I just noticed that the content of the backup is not correct. It contains only all the interfaces from the root VDOM and their whole default config, no firewalls rules from the production vdoms, no objects etc.Now the super weird part: When I execute the CLI script manually with my hand in the CLI, it creates a correct backup full with all the necessary configurations and VDOMs etc.The exact same backup automation stitch with the same CLI script (copy+paste) also works on other Firewall, a 100F with also 7.2.7. The only visible difference for me is in the fourth line in each of the correct and incorrect backup files:Correct bac

Hello fellow Fortinet people. We have a new Fortigate Cluster (AP) with VDOMs enabled (our first Cluster with VDOM config). Now of course we want to monitore both firewalls seperately. Until now we always used the IP addresses of the dedicated management interfaces. However I just learned the following two limitations of Fortigates:«To get SNMP working with VDOM enabled: Make sure that the interface where the SNMP collector connects to is part of the management VDOM.»«Note: Dedicated management ports on a HA Cluster will not be part of any VDOM.»Now from my understanding this means we cannot use the dedicated management interfaces (which are excluded from the HA). Does anyone of you has the same config and if yes, how do you monitor both firewall seperate?

Hi All, I am trying to have Dual Hubs for my spoke. I just set up Hub A using the built-in Wizard of Fortigate.All branches and Hub A are working well on day one. We are going to have a new Firewall at DataCenter as DR second Hub now. All traffic will only go through Hub A and only use Hub B if my Hub A goes offline. To achieve this, we set up the route-map-out for both Hub A and B BGP settings. The metric for Site A is 5, and Hub B is 100. We tested the connection, Both Hubs VPN up and seem good for traffic. We tried to shut down Hub A VPN then, all traffic was routed to Hub B. When Hub A resumed, we found that the Branch learned BGP from A again and the Metric is 5. However, the route with Metric 100 from B is still the best path for the branch and does not go through the Hub A.  Please advise.

We are looking for the power draw for the 401E, for the DC.

Good morning friends, a question:In fortigate I have two tokens available, the ones that come by default. I need to assign those tokens to two users, but when I assign the token I get an error message (image).The FG version is 7.2.8, could it be a bug in the version?   

I am getting lost with all the certs so can someone please help me.  While I have System SAML SSO logins working I noticed that one of the certs involved I have no clue where it came from.  So I am trying to understand which cert is needed where. On the FortiGate:SAML SSO SP Cert: I am guessing this should be the cert of the SP.  If the SP Address is john.com the cert should be the cert+key of john.com.SAML SSO IdP cert: This should be the cert of the IdP (imported as a remote cert).  In my case the ADFS server. On the ADFS Server:Matching Relaying party trust Encryption: ADFS CertMatching Relaying party trust Signature: ADFS Cert Does this sound correct?

Hi,I want to know what are the impacts to existing dial-up clients when I extend/expand the netmask (say from 255.255.255.0 to 255.255.252.0) in dynamic Dial-Up VPN IPSec on the Hub?Maybe someone can give insight about this. Thank youAri

Hi, I have a FortiGate SSL VPN setup in full tunnel which is working but when a remote user is connected via the VPN I am unable to access the remote computer via its VPN DHCP IP for the local Lan. Do I just need to setup a firewall policy from the local lan -> ssl.root or is there more to it?   

Hi Today I upgraded my fgt to 7.4.2 version but on sdwan rules page it does not show anything. In cli i can see my sdwan rules. What is wrong?

Hello! Currently we are looking to create an API with the support portal (device inventory).To setup the correct API we need some documentation but the are behind the Developer Network.Is there any way to access the link from the following documentation? We are not able to access the developer network. It's about the FortiOS REST API documentation. https://docs.fortinet.com/document/fortigate-cloud/24.1.0/administration-guide/557024/api-accesshttps://fndn.fortinet.net/index.php?/fortiapi/1-fortios/ Best regards,Tim

 Hi GuysI've been planning an outdoor network, and I have a doubt about the installation of 432F. Is this AP designed to be built on ceiling or on wall/pole? The radiation pattern on Fortinet docs seems this AP in a ceiling position. Do you think in terms of outdoor environments, this pattern will change in case of installing this AP on pole at 4/5 meters high?  I appreciate your time in advance. RegardsEstéfano A.  

Install & configure step by step:Install FortiClient VPN 7.x (7.0.9 and 7.2.4) onto macOS CatalAllow fctservctl2 and FortiClient with Full Disk Access permission in Security & PrivacyLaunch FortiClient for the first time and accept the termsAdd a new IPSec VPN profileEnter username and passwordConnectThe dashboard show status "VPN Connected" but there is no connection actually. On the other hand, the version 6.4.9 works perfectly. Any idea that it is a bug or FortiClient 7 has dropped support for Catalina?