Solved

Hello All, Do we have an option to limit the TCP/UDP connections limit on FortiGate? likewise of Cisco ASA Firewalls. 

Hello I currently have a Fortigate managed through Fortimanager with 1 Uplink ISP router (let's call it OLD router), I use it for outgoing traffic to have my servers reach internet, and I also use Virtual IPs to NAT incoming trafic to some web servers on a public-ip basis.default route 0.0.0.0 -> interface going from forti to the OLD ISP routerFor bandwidth reasons, I Need to add another Router (NEW router) with the same specs and needs, to my fortigate.So I can have 3 specific LAN servers use the NEW router and not the OLD one.  I wonder what is the best course of action to do so (I'm ok about the ports/vlans/creating the interface) : - Should I just add another default route 0.0.0.0 -> interface going from forti to the NEW ISP routerand create policies using this interface ? - Or would I also need to create some policy routing (which I never did ever) ? What would these policy have to look like to make sure using my new isp router does'nt break the

Hello, is there any way to suspend the transport mail delivery and keep mail in queue on my fortimail ? Indeed, i need to stop mail delivery to my mail server to be able to make some maintenance operation. My mail server is in the cloud and can't be stop or suspend. Thanks by advance for your answers !

There is no problem with the web filter, but it still cannot be connected, and the query finds that there is a problem with the DNSDomain Name 「donate2.ncku.com.tw」 dns response blockBut this site is a university in Taiwan, how do I apply for a re-evaluationv7.4.3

I'm seeing the eap-proxy daemon utilizes high CPU usage. Suspecting that this may cause of the flapping on the IPSec tunnel phase 1. # diagnose sys top-all 1 100 1Run Time: 235 days, 16 hours and 28 minutes4U, 0N, 10S, 83I, 0WA, 0HI, 3SI, 0ST; 7979T, 3432Feap_proxy 1218 R 99.9 0.1 7 the killed daemon is /bin/eap_proxy: status=0x0 the killed daemon is /bin/eap_proxy: status=0x0 the killed daemon is /bin/eap_proxy: status=0x0 the killed daemon is /bin/eap_proxy: status=0x0 the killed daemon is /bin/eap_proxy: status=0x0 My question is we only have issue with one tunnel that also flaps once or twice in an hour. Rest of the tunnels are fine. What impact this command "fnsysctl killall eap_proxy" will have on the firewall ? WIll it kill all the VPN tunnels ? TIA. :)     

Hi, I noticed i unable to access the FortiSandbox at my office. Previously it working fine and the hardware is up and running. The network port is blinking, but the LED status no light & HDD status blinking red. I already restart the hardware but still same. Any idea ?  TQ

How can I access the database and examine various tables? I require this information for configuring osquery. I have installed FortiSIEM 7.1.3 with ClickHouse.  Detail steps along with creds (if any default) would be helpful.

Trying to move my Fortigate VM, from a old machine, to a newer one. How do i activate the same trial license that was in use on the old, onto the new ?

I want some opinions on this. I have a customer who has multiple remote sites that connect to a central site for Active Directory. The remote sites do not need to have connectivity to each other nor does the customer want them to have connectivity to each other. Given these circumstances, should I configure a hub and spoke topology or just do a site to site tunnel between each remote site and the hub? If I configure a hub and spoke topology, should I just create policies that Deny the spokes from speaking to each other?

hello everybody, I changed the account on my fortigate 60F (fortios 7.0.15), now when I want to change the forticloud account on the forti I get the previous email without the possibility of changing it, if I go to system/fortiguard and choose "transfer fortigate to another account" I get an error origin mail (username or password).How do I send the forticloud logs to the new email? Best regards

Hello everyone! I will soon be doing a deployment around 20 firewalls for a customer and they are wanting a hub and spoke configuration. They will have dual ISP connections at each of the locations for SDWAN. I also plan to implement ADVPN so the spokes can have shortcuts to talk to each other. I would like to us iBGP to advertise the local routes as well. My question is when I configure SDWAN for the ISP connections, do I put the ADVPN interfaces in the same zone? Or would I create a separate zone for the ADVPN interfaces? Also, I'm finding tons of documentation on configuration guides for 7.0 but not too many guides on 7.2. If anyone could link some my way that would be very much appreciated! **NOTE: I will not be using FortiManager for this deployment. Configurations will happen locally on the FortiGate's themselves. **

Is there a multi-tenancy option for FortiEMS Cloud? I know there is for the on-premises version, but i'm not seeing the option for it in the cloud version. 

I would like to do some upgrades on the server. I need to know which components I should shut down first and which should be shut down last, as well as the order for booting them up. This includes the supervisor, worker, collectors, and NFS.Thanks.

Hi guys, Windows 11, I connect to vpn FortiClient 7.0.7.0345 but the route print output is apipa.  

Hi, I have noticed that the "conf_file_ver=xxxxxxxxxxxxxxxx" in configuration has changed to a different number without doing anything recently. Is there any reason for that?

Hey all, Fortigate 81f with 7.0.14 Attempting to get SSLVPN SSO working with Microsoft Entra ID.  The process is failing before getting any type of login prompt. Testing from the FortiClient I get "The response from https://vpn.domain.com was invalid."Testing from the Test option within Entra ID I get - Access Denied (from https://vpn.domain.com page) I've double checked all the URL's between the Entra ID application and the saml config.  The SSO group on the Fortigate is in the firewall policy. Sanitised config:config user saml edit "Entra ID VPN" set entity-id "http://vpn.domain.com/remote/saml/metadata/" set single-sign-on-url "https://vpn.domain.com/remote/saml/?acs" set single-logout-url "https://vpn.domain.com/remote/saml/?sls" set idp-entity-id "https://sts.windows.net/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxx/" set idp-single-sign-on-url "https://login.microsoftonline.com/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxx/saml2" set idp-single-logout-url

Hi all,Wondering if anyone has any suggestions for dealing with 429 Rate Limit exceeded messages when using the Crowdstrike connector. I run multiple enrichment automations using different Crowdstrike actions and they often trigger the rate limiting error below:{"Error message": "HTTP Status Code 429: Too Many Requests Details:API rate limit exceeded. Connector :: crowd-strike-falconV2.3.1","failed_step_id": 530078,"failed_workflow_id": 68102,"status": "failed","execution_time": "42 seconds 480 ms"}I'm wondering how to approach this, perhaps using a "do until" loop to check to make sure status is not failed?Any help would be greatly appreciated, thanks!

Hi All.I have a 100F device (6.2.8) setup for SSL VPN for remote connections using the VPN-only forticlient.  Windows works perfectly.  MacOS does not!  The VPN shows "Connecting" and then simply goes back to no message.  There are no errors.  The VPN does not connect.  Mac = Big Sur 11.4Forticlient = 7.0.1.0060 Facts:- the VPN actually connects and authenticates.  Logs show this.  Also, putting in fake login details generates an client error for the wrong user/pass.  The correct user/pass generates no messages.  It connects but then for reasons unknown gets disconnected. Fortigate Logs:[263:root:42]got SNI server name: vpn.ourdomain.systems realm (null) [263:root:42]client cert requirement: no [263:root:42]SSL state:SSLv3/TLS read client hello (49.178.7.112) [263:root:42]SSL state:SSLv3/TLS write server hello (49.178.7.112) [263:root:42]SSL state:TLSv1.3 write encrypted extensions (49.178.7.112) [263:root:42]SSL state:S

Hi Support, Got a question regarding the Android ForticlientEMS 7.2.2. On 12 march we saw a message regarding ForticlientEMS 7.2.2 having a vulnerability. (See link under)All of our EMS client have been updated to the latest version 7.2.4. Now is my question, when will the Android app be updated to the latest version because from what i can see is that this version on the App store is 7.2.2.0127.And second question, does this vulnerability also apply to the Android FortiEMS? Link:PSIRT | FortiGuard LabsFortiClient - Apps on Google Play Kind regards, Dennis Zaan

Dear Team  Im having issues with RDP Firewall Policies and accessing the Web Gui of Fortigate. This is my WAN to LAN network from the Host Machine to Guest. Im accessing the Firewall from the Host Machine (DMZ network).I have created a Firewall policy for my Windows RDP Server as follows :          From: WAN(192.168.2.47) To: LAN(10.10.10.1) Source: All Destination: RDP Server Virtual IP External Network: 0.0.0.0 mapped to 10.10.10.22 (Windows Server) External Port: 3389 MappedtoPort: 3389 SERVICE: RDP NAT : ENABLED AV: default SSL: deep-inspection            The Issue with it is once i enable the policy and Remote access to the Server, I loose access to the Firewall

Hello ,my fortiADC does not schow any traffic log in Log & Report -> Traffic Log., I already selected all the different filter but no log appears. I selected also all options in Log & Report -> Log Setting -> Local Log, but it also did not help. For now i can only see the Event Log. is that normal?

Hello,  I have a problem with disabling usernames that register on the Captive Portal create on my FortiAuthenticator.After the registration but before approval by an Administrator, if the user tries to authenticate with the credentials they registered with, the FortiAuth disables the user and the link that comes (with email) to Administrator or sponsor generates an error and cannot be approved.I have to go into management and reenable the user manualy.Any ideas to avoid this? Thank's

Hi allI am scratching my head for past days and would appreciate fellow community if anyone of you had similar experience.  I am trying to test multicast over Fortigate IPSec.Fortigate version 7.4.3 using EVE-NG VM Cisco IOL using EVE-NG   Diagram and configuration file is like this:https://drive.google.com/drive/folders/1vKQwaPGqhGTgDzZmf8rGQZHmeRi9vST5?usp=drive_link  R6 join IGMP 224.5.5.5 using Lo0 (192.168.11.1)R7 try to send ping 224.5.5.5 from Lo1 (192.168.22.1) Fortigate configuration follow this:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Multicast-traffic-over-site-to-site-IPsec-VPN-with/ta-p/194209#:~:text=set%20multicast-forward%20disable%20set%20multicast-ttl-notchange%20enable%20set%20gui-multicast-policy,mode%3A%20%23%20config%20router%20multicast%20set%20multicast-routing%20enable with addition that I found out that I need to enable PIM at port 3 (connecting to cisco router). By doing this, the router and t

Hi all. Odd issue. When connecting on one of my laptops, the VPN won't connect. Password is accepted and token is requested. When token is entered, the login screen resets as if nothing happened. No error message and the connection fails. Intel MacBook air running latest version of Foritclient on Monterey.  Thanks!

I'm working with a FortiGate 100F and attempting to migrate 10 VLANs from port5 to a newly created virtual switch. My goal is to preserve all existing configurations, including policies and routing tied to these VLANs, during the migration. I've tried editing the backup configuration file to replace port5 with the virtual switch's name and re-upload it, but after doing so, all my VLANs vanished from the configuration. I ensured that syntax and references were correctly maintained in the edit.Has anyone successfully completed a similar migration, or can provide insights on how to retain VLAN configurations when moving to a virtual switch? Are there specific steps or considerations in the FortiGate setup to prevent the loss of VLAN configurations during such a process?