Solved

Hello, My Fortigate VM isn't syncing with FortiToken Cloud. When I try to synchronize using "exec fortitoken-cloud sync local," it fails :  "FGVMEV167DQDX5F5 # exec fortitoken-cloud sync localCannot retrieve user information from FortiToken Cloud!Command fail. Return code -1" After investigating, I found the issue lies in the SSL handshake not completing between the Fortigate and FortiToken Cloud. The SSL minimum protocol version is currently set to TLSv1: "FGVMEV167DQDX5F5 (global) # get | grep ssl-min-proto-versionssl-min-proto-version: TLSv1 " I need to change this to TLSv1.2, but the option isn't available : "FGVMEV167DQDX5F5 # config system globalFGVMEV167DQDX5F5 (global) # set ssl-min-proto-versionSSLv3 SSLv3.TLSv1 TLSv1.FGVMEV167DQDX5F5 (global) #"Any help or solution would be appreciated.   

Good morning friends, a question.I need to increase the disk space in the FortiAnalyzer VM, the reason is because we have 8 synchronized fortigates and the complete information is not displayed in the FAZ. Then the TAC recommended that the record disk be increased. https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Extending-disk-space-in-FortiAnalyzer-VM/ta-p/194365My problem is that I don't know how much space I should increase, is there some kind of formula? to calculate the space I need   

Fortigate is not sending icmp redirects."icmp-send-redirect" is setting enable.I would like to be able to send ICMP redirects using the case 2 pattern.If the PC is in the same segment as the FW,ICMP redirect responses are possible.However, if there is a router between the PC and the FW and they are on different segments,ICMP redirect responses will not be received. QAren't ICMP redirects sent to another segment?How does it work?Case 1In this case, the FW sent an ICMP redirect.PC①------[FW①]------PC②　　　|　　　----[FW②]------PC③settingPC①：192.168.1.1/24PC②：192.168.2.1/24PC③：192.168.3.1/24routingPC①: Default gateway is FW①FW①: Setting static route "Gateway of destination PC③ is FW②" Case 2PC①----[RT①]------[FW①]------PC②　　　　　　　　|　　　　　　　　----[FW②]------PC③settingPC①：192.168.1.1/24PC②：192.168.2.1/24PC③：192.168.3.1/24RT①：Do not use NATroutingPC①: Default gateway is RT①FW①: Setting static route "Gateway of destination PC③ is FW②"FW②: Setting static route "Gateway of destination PC① is

Hello, in a transition from another manufacturers router to Fortigate I have to transpose IKEv2 Dial-In Client configurations into FortiOS 7.2.8. Although the necessary parameters should match. The connections do not work. Therefore I tried to troubleshoot the IKE connections with the following CLI commands: diagnose debug application ike -1diagnose vpn ike log-filter src-addr4 <remote WAN-IP> alternatively: diagnose vpn ike log-filter dst-addr4 <local WAN-IP>diagnose debug console timestamp enablediagnose debug enable But there are only empty lines. I double-checked that the dial-up client could reach the Fortigate and successfully pcap´ed.Although I am new to FortiOS I would bet that there is a debug command to have a live view / monitor the setup negotiations of IKE phase 1 and IPSec phase 2 connections. But I have no clue how start these. Your hints would be appreciated. The Admin-Guide https://docs.fortinet.com/document/fortigate/7.2.8/administratio

I just got a FortiGate FG-40F-3G4G and I need to move the GSM antenna to the roof to get a proper signal (about 10 yards from where the router is located). Is there a readily available cable I can use? And if not, where can I find the specifications of the connectors I need in order to produce such a cable? Thx

I'm trying to work on some scenarios in my lab with KVM , but fortiOS 7.4.3 generates wrong serial number and i can't register virtual device on my account!does anyone have same issue o any solution to fix the problem?thanks

Hey guys, I'm starting to implement NAC-F on Google Cloud, but on the download portal, there is no ready-to-deploy template, would you have any suggestions? I found an implementation guide for GCP, which advises how to deploy using a tar.zg, but it still doesn't show objectively how to do it, if I use the .bin file to generate the tar.gz or some other procedure, follow the link below. FortiNAC Google Cloud Deployment Guide (fortinetweb.s3.amazonaws.com) FortiNAC Regards, Emerson   

I have multiple accounts with a fortigate vm in each region we use and I want to keep all us-east-1 traffic in us-east-1 unless it needs to leave the region.  I have setup a SDN Connector for the VPC where the the fortigate is.  Via that connector I can see all the instances, SGs ... in that VPC.  But do I only need the one connector for AWS or do I need multiples?  And by multiples I mean do I need a Connector for the other VPC (even if they cross accounts) in this region?

Hi, I would like to add a customer header to all mails received from Internet. Originally, I thought to add this as an action to my Content Profile. However, this does not work. I assume this is because the action does not "fire". Another approach which works is to enable domain specific disclaimers and then use "advanced options" > disclaimer on the domain configuration to set the header for all incoming mails. An ugly side effect of this approach is, that in the logs the Classifier is set to Disclaimer and the Disposition is set to Disclaimer Header. Are there other options to add a header to all incoming mail? Any advice appreciated. Thanks.

Hi Everyone. I have a Fortigate 80E on v6.0.12. I'm using 4 interfaces, interface 1 is incoming traffic going to interfaces 2, 3, and 4. If i click create new interface and put all 4 interfaces in a software/hardware switch interface, traffic flows between them automatically. When i separate them out and try to route traffic from interface 1 to interface 2 or interface 1 to interface 3 or interface 1 to interface 4 it doesn't work which is weird. They are all on the same subnet using same gateway ip, just 3 different webservers interfaces 2,3,4. I made a policy to allow all traffic between interface 1 (incoming int./source) and interface 2 (outgoing int./destination) as a test and it doesn't show any traffic going through the policy at all. I've tried creating multiple policies and none of them get used no matter what i do and the implicit deny isn't blocking any traffic, yet connection to the web server sites through interfaces 2, 3, and 4 are still happening (if i put all 4 interface

how do i go in-depth to look at the bandwidth utilization to see what traffic is occupying the bandwidth ?this is the bandwidth widget in the dashboard

Hi, I create a software-switch and enabled DHCP server on it. I spesified the address range and created ip address assigment rules. I want to block unknown mac address. I added mac address - ip address reservetion. But implict rule action is assign ip. How can i change the ubknown mac address actionb to block?    

Good day, I was wondering if the FortiLink aggregation interface could be used as a trunk with a non-Fortinet switch. By default, ports x3 and x4 of the 200F are dedicated FortiLink ports. I would like to run ports x3 and x4 to an existing Cisco switch, soon to be replaced by two aggregate FortiSwitches. I was hoping to set up all of the VLANs on the FortiLink interface to have them ready for when we move the connections over to the FortiSwitches. I'm hoping that traffic will still route out over the trunk properly when using FortiLink connections connected to a non-Fortinet switch.  Thank you,FortiBagel #FortiSwitch#FortiLink

Hello team!!! We manage many Fortigates in different sites and recently upgraded all to 7.4.3After this, we have problem accessing to some fortigates through some wan interfacesFor example I can access through wan2 but not through wan1, or in other cases, I cant access from wan1 nor wan2.  The issue started after upgrading the firmware version to 7.4.3The issue is that the page remains loading and wont load, keep trying to access but after some seconds the browser shows me that the page cannot be displayedWe use the same port to access to fortigates, different of the default 9443 * We tried to change the port but the issue persists* We disabled and re-enabled https in each interface, with the same issue* SSH works well in any interface* We cannot connect to Fortigate with telnet, using the same port. Any idea?Thanks in advance.Regards,Damián

Hi, I am currently looking for the Security POP IP Address of known locations for provisioning purposes. Thank you in advance for your attention to this matter. I eagerly anticipate your response and look forward to provide the Security POP IP Address provided below. 1. Sydney - Australia2. Vancouver - Canada3. San Jose - California Thanks and Regards,Rakesh

Hi,We are using FortiGate firerwall(v7.2.5 build1517) and the FortiClient SSL VPN(v7.0.70345) on all our laptops, the problem is that the FortiClient VPN keeps on disconnecting even though the internet connection is available on the laptops. This is happening intermediately.Can you please advise what could be the cause of this issue?Thank you in advanceKind Regards,Abel 

Hi All,I've configured a Fortigate to Fortigate VPN, created a Loopback Address and assigned a Public IP.The VPN uses BGP to advertise the Public IP and and receive the default route from the Hub. The Spoke isn't able to connect to Central Management with this config (I've got Fortiguard connected and have also changed the source IP for DNS and confirmed DNS lookups are working) I see there is supposed to be a command under config system central-management that would allow me to set a source IP, but this doesn't exist on my Firewall. Is this something that has been removed in v7.4 and is there another method I need to use for this? Or an I missing something that I need to enable for this? These are the only options that I see: (central-management) # setmode Central management mode.type Central management type.schedule-config-restore Enable/disable allowing the central management server to restore the configuration of this FortiGate.schedule-script-restore Enable/dis

One of our user always get error that "URL blocked by Forticlient" and he has to refresh few time to make it working, please details error message screenshot. I already added all the website in exclusion list under web filter, but it still blocks. When he disconnects from telemetry or work offsite, it loads all the website without errors.  I am working from the same location and I never had any issue. Forclient ver. 7.2.2Forticlient EMS: 7.2.2

Hi About to deploy FGSP between 2 existing clusters, both clusters in a new environment with only test networks connected to them I have 2 things I'm not clear on 1. I will be syncing a couple of VDOMS, is there any issue using the root VDOM for the sync link? Other options I have are create a new one for just this purpose, or finally use the test VDOM which has very little going on, and will be the least busy once the real network is connected.  2. In each cluster, the 2 firewalls are connected in usual fashion, 2 direct links. The FGSP link will be a lot higher bandwidth port. Do you normally leave it like that? Is session pickup on HA failover still running over the direct ports? thanks

I am seeing this "Critical (Collector Buffer greater than 50MB)" on my Forticollector. Can this be resolved by increasing the buffer size and is there a formula for sizing it correctly?

Hello Fortinet experts, We have established a site-to-site VPN between Fortigate(7.0.12) and AWS, where the client runs on AWS and the server is located on the other end of the VPN (on-premise). client ip: 10.12.140.86 or 10.12.124.160server ip: 10.60.98.100 listen on port 8080fortigate port1 ip: 10.60.97.10 Fortigate interface:Fortigate routing table:  FGVM04 # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default Routing table for VRF=0 S* 0.0.0.0/0 [10/0] via 10.60.97.1, port1, [1/0] S 10.12.0.0/16 [10/0] via aws-vpn-1 tunnel 52.11.17.158, [1/2] [10/0] via aws-vpn-2 tunnel 52.43.39.105, [1/2] ... C

When looking at the forward traffic logs (for incoming connections), I see that some sources are from "known malicious sites" when I hover over the source IP. But when I add the column "source reputation", it's always empty. I'd like to ad some reputation filtering, but it would be nice to be able to see the reputation for each log line first, without having to hover over each line. Is there a way to show the source reputation in the table?  

Hi, I have a Fortigate 200F with FortiTokens initially assigned to RADIUS account for VPN MFA authentication.We had to rebuild our Active Directory and would like to assigned the Fortitokens to new RADIUS accounts in the new Active Directory.However the Fortitokens in the Fortigate 200F show with the "Assigned" status as they are linked with the old (and now inexistant) RADIUS accounts.How can I make the Fortitokens available again so that I can assigned them to new RADIUS accounts?Thank you in advance for your advice. 

Today I configured a FGT200E with an IPsec VPN with a PFsense. For the first time I used the DH32 (elliptic curve) in phase 1 (AES256, SHA256). no PFS in phase 2. Do you think we have problems with slow communication? If so, which protocols might it affect?Thank you.Regards.Marco SpadaW3 - Italy

Hi, We will onboard 850 users to FortiSASE, I know that we can import CSV file of email addresses to send link in bulk. Just want to ask if there is a way to install FortiClient in bulk, aside from manual installation.  Thanks,JL