Solved

How can I upgrade from version FP221C-v5.2-build490 to version v6.0.6?Is there an upgrade path available?

Hi,On Vmware ESXi platform is present a FAZ with version 7.2.4 Premise, on the vcenter where I am operating the cpu and ram resources are available I have performed similar operations on other Fortinet vm's (Fortigate, ect) Under edit settings -> cpuThis is the situation             Has anyone had a similar problem is it possible to have to have 2 cores each with 8 sockets ?I don't think it's a fortinet license issue or the vm image installed on the vm. I thank you for your attention and look forward to your opinion.Best Regards 

Hi, recently i started an application on linux that i need to use a database on another network, so, i have to use a VPN to connect in this database.  When i run the command 'fortclient vpn view' i got the following message: Client Certificate: NoneAuthentication: DisabledSingle Sign On (SSO) for VPN Tunnel: DisabledAuto Connect: DisabledAlways Up: DisabledSave Password: Disabled  How do i enable the option Always Up and Auto Connect? the command 'forticlient vpn edit' don't give me this options. Sorry for my bad english    

Hello,I´d like to setup #FortiClient FortiEMS Cloud AD-connector. But the documentation lacks the information where to find the Where to find the Connector UIDhttps://docs.fortinet.com/document/forticlient/7.2.2/ems-administration-guide/787816/ad-connectorbest regardsMartin Haneke

Hi everyone,  Can you guide me how can I allow Whatsapp voice and text only and deny video calls and file transfers?  The firewalls we are using are on the version 7.2.6, Fortigate 100F.  Thanks in advance for any guidelines.  Regards Mihail

what is serial no. of firewall which we use to create service ticket?

is there a settings in fortigate that limit the SSLVPN connection duration ?we have users reporting to us that SSLVPN connection will disconnect after 8 hrs.how do i extend the hours beyond 8 ?

Hi community Can someone kindly assisting in guiding me how to enter banned words in Fortimail via CLI - in a batch? Is it possible? I have over 300 of them, clearly not to be entered one by one in the gui.

Guys, I have two 40F in AH A-A. I configured the load balance using the command set load-balance-all enable . But that the load is not balancing. Has anyone been through this that can help me??

Hello! I have few questions regarding FortiGate license. Product is 60F v6.4.6 build 6083 GA. I am providing a screen shot below: Qs1: Is creating a FortiCloud account a must for adding license/ renewal?QS2: If there is no forticare support license, will I still have to create the account in forticloud?QS3: from the picture, 4 entitlement is expired and 1 is for register. Which is the most important to do licensing/ renewal first and why?QS4: How much time will it take for (New license and renewal) the licenses to be added to the fortigate product? (can see it in the fortigate interface) 

Hello, Could someone give me one help? Made this request to my fortinet, gives 200 but looking at console, not works. curl -k -X PUT --location "https://*****/api/v2/cmdb/firewall/addrgrp/OFF" \--insecure \-H "Authorization: Bearer ****" \--header 'Content-Type: application/json' \--request PUT \--data-raw '{"method": "PUT","url": "/api/v2/cmdb/firewall/addrgrp/OFF","params": {"datasource": true,"with_meta": true,"vdom": "root"},"data": {"member": [{"name": "X.X.X.1"}]}}'{"http_method":"PUT","revision":"519**","revision_changed":false,"mkey":"TAOFF","status":"success","http_status":200,"vdom":"root","path":"firewall","name":"addrgrp","serial":"FG*","version":"v7.4.3","build":2573}%

Hi, I am trying to figure out Traffic Shaping on my FortiGate FGT200F running Firmware 7.4.3, I can see that you can create Traffic Shaping profiles in Policies & Objects and assign based on criteria but also can see that you can assign to Firewall policies. Which should you use or recommend to use? I have taken over the FortiGate's from another person and they appear to be using both but think they must be clashing with each other. Thanks   

Lets say I have the following portal config:config vpn ssl web portaledit "VPN_Contractors_General"set tunnel-mode enableset forticlient-download disableset auto-connect enableset keep-alive enableset save-password enableset ip-pools "VPN_Contractors_General"config split-dnsedit 1set domains "louis.net,louis.com,louisgod.com"set dns-server1 10.100.74.21set dns-server2 10.100.90.21nextendnextend Here I have defined the IP-Pool I want these users to use as VPN_Contractors_General.  Now in my VPN SSL Settings I have the following:config vpn ssl settingsset banned-cipher SHA1 SHA256 SHA384set https-redirect enableset servercert "star_louis_com_20250306"set idle-timeout 900set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"set dns-server1 10.100.74.21set dns-server2 10.100.90.21set source-interface "port1"set source-address "all"set source-address6 "all"set default-portal "full-access"config authentication-ruleedit 2set groups "TDS_FirewallSSO

Hello, I have several questions on FortiToken (e.g. to Login to FortiCloud: 1. How to create a second FortiToken on another smartphone?2. How to find and backup the recovery phrase / masterkey for an already created Token?3. How to use 3rd party OTP for FortiCloud login? best regardsMartin Haneke

Hi, Can I still connect to VPN even if I am connected to office WIFi/LAN? Is there a settings on FortiClient EMS for that?

Good day, IKEv2 Dial-In Clients [198.18.25.0/24] connect successfully via FortiGate to the Intranet 192.168.0.0/16.But they cannot connect to a branch office network [172.16.0.0/16] which is also connected as a Site-2-Site VPN on that FortiGate The firewall policies are set to "allow" accordingly for these IKEv2 clients.The Intranet 192.168.0.0/16 can reach the destinations in 172.16.0.0/16 over that Site-2-Site VPN. Phase 2 is up:name=Site2Site ver=2 serial=1 XXXXXXXXXXXX:0->YYYYYYYYY:0 tun_id=YYYYYYYYYYY tun_id6=::YYYYYYYYYYY dst_mtu=1500 dpd-link=on weight=1bound_if=16 lgwy=static/1 tun=intf mode=auto/1 encap=none/552 options[0228]=npu frag-rfc run_state=0 role=primary accept_traffic=0 overlay_id=0proxyid_num=4 child_num=0 refcnt=7 ilast=1 olast=1 ad=/0stat: rxp=10256 txp=6843 rxb=12044848 txb=1178486dpd: mode=on-demand on=1 idle=30000ms retry=3 count=0 seqno=6natt: mode=none draft=0 interval=0 remote_port=0fec: egress=0 ingress=0proxyid=Site2Site proto=0 sa=1

Hi all, I'm having some issues with port forwarding. I'm running fortinet v7.0.5. I have a Windows Server running Tomcat 8.5 which is running my website. I've succesfully managed to import my SSL certificates into tomcat (on my windows server, going into https://localhost:8443/ i can see the certificate (shows as error, because the domain doesnt match, but all of the information about the CA etc is there, so its working okay). But when i go through https://domain.com:8443/ i get Unable to connect - An error occurred during a connection to domain.com. If i go to https://domain.com (without the port) i get The connection has timed out - An error occurred during a connection to  Now i have a public ip on my fortinet wan, which is used mostly just for ssl-vpn to remote into my workspace when im at home. I've added 2 VIP's one for port 80 and one for port 8443(https) - port 8443 seems to get hits, but cant load, and port 8443 reports as closed when using tools to ch

Hi, I am trying to add ips signature and I want to know rate based settings default value. Does anyone know what the default value is? 

Greetings.I have a FortiGate-80F router and a website with domain somedomain.comNow I need to set it up, so that whenever a user from WAN loads the website (port 443, https), he will be forwarded to a webserver on my internal network. Also, if the user loads some subdomain, but with same 443 port, his request will be forwarded to another webserver.In the routers UI > Policy & Objects > VIPs there is a configuration type FQDN, but setting it doesn't do anything, internal websites are still inaccessible from outside.Please, help solving this problem.

Hello  I have to change an HA password for security reasons and is it best to change from the GUI or the CLI?Is the only place that needs to be changed is on System > HA > Primary device and change it there - then that should populate it to the Secondary HA2? Thank you. I know it is kind of basic but just making sure there is no gotcha's.

Hello, is there an opportunity to bind a VLAN (subnet) to one specific physical port which is not in an SW/HW switch on a FortiGate ? My problem is, that I actually have configured a hardware switch containing one pyhsical port within the FortiGate and also have created a VLAN on that switch. So, that I would have a tagged VLAN on that port.That would have been alright, if the FortiGate would not force me to assign an IP address to that hardware switch (but not the VLAN). I also do not understand why an IP address is necessary for a L2 switch. Is there any documentation how FortiGates understand the concept of VLAN (Access, Trunk, Hybrid)? best regardsMartin Haneke

Hello, how can one aggregate many IKEv1 and IKEv2 dial-in peers in one Firewall policy ruleset? I have approx. 80 IPSec dial-in tunnels defined. Each of which would need an own firewall rule to access the IP-Pool "IPSecClient_IP-range" which is dedicated to IKE-Config mode. See sample below: config firewall policyedit NNset name "IPSec Client"set uuid 3da34a02-nnn-nnn-8f09-f6ef3d7ennnnset srcintf "IPSec Tunnel Client"set dstintf "INTRANET"set action acceptset srcaddr "IPSecClient_IP-range"set dstaddr "all"set schedule "always"set service "ALL"nextend Is there an opportunity to create such a rule for a number of IPSec clients?Or do You have an idea to bulk create the necessary rulesets? best regardsMartin Haneke   

I have a 1101e firewall. After the 7.0.14 update, ram usage increased from 41 to 70 in a meaningless way. It switches to conserve once a week. Do you have any idea? 

Hello, My Fortigate VM isn't syncing with FortiToken Cloud. When I try to synchronize using "exec fortitoken-cloud sync local," it fails :  "FGVMEV167DQDX5F5 # exec fortitoken-cloud sync localCannot retrieve user information from FortiToken Cloud!Command fail. Return code -1" After investigating, I found the issue lies in the SSL handshake not completing between the Fortigate and FortiToken Cloud. The SSL minimum protocol version is currently set to TLSv1: "FGVMEV167DQDX5F5 (global) # get | grep ssl-min-proto-versionssl-min-proto-version: TLSv1 " I need to change this to TLSv1.2, but the option isn't available : "FGVMEV167DQDX5F5 # config system globalFGVMEV167DQDX5F5 (global) # set ssl-min-proto-versionSSLv3 SSLv3.TLSv1 TLSv1.FGVMEV167DQDX5F5 (global) #"Any help or solution would be appreciated.   

Good morning friends, a question.I need to increase the disk space in the FortiAnalyzer VM, the reason is because we have 8 synchronized fortigates and the complete information is not displayed in the FAZ. Then the TAC recommended that the record disk be increased. https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Extending-disk-space-in-FortiAnalyzer-VM/ta-p/194365My problem is that I don't know how much space I should increase, is there some kind of formula? to calculate the space I need