Solved

hello team, i have a question about phase 2 selector IPsec.It's possible use public ip on phase 2 remote subnet? And how configure it? thanksbr  

I have a WPA2 Enterprise network. Fortinac connects to the network by authenticating the user from the active directory with radius. But I want to make this role based. I want those in role A to get IP from vlan A and those in role B to get IP from vlan B. How can I do it?

I'm having the hardest time getting my getting my 40F Fortigate connected to IPv6. I am fairly versed in networking and Fortigate (two years now) but not having luck here.   So I have the Interface set to DHCP and its COX Communications.  I have obtained an IPv6 IP address and two IPv6 DNS servers.   For my LAN interface I'm using SLAAC, using fd00:6565::/64 as my prefix and all my devices have an IPv6 address. I even have enabled the DHCPv6 Server to give out my DNSv6 server addresses but mostly I use my DNSv4 which works also.  And I have Central NAT enabled. BUT I am just confused how to acquire delegated IPv6 addresses and how to pair them to my SLAAC IPv6 addresses in my devices. Should I be using a different addressing mode????  MANUAL allows you to set "Auto configure IPv6 address"Or "DELEGATED" mode.  I don't know my "prefix hint" I spend HOUR and HOURS trying to get setup info from COX, even pay for extra te

I attempted upgrading my 6.0.7 virtual fortiauthenticator server to 6.4.9 last night with no success. It simply hung when it reached the "Migrate Encoding - upgrading encoding of database fac to UTF8 succeeded portion" I waited roughly 45 minutes with no movement. I ended up shutting the server down and reverting to my snapshot. I also tried version 6.4.0 and 6.3.4 to see if there were any differences and they all simply hung as well. Anyone run into this type of issue that can shed any light on what to look for when this occurs so I can attempt this again during non production hours? Thanks in advance!!

In our FortiManager and FortiAnalyzer we have some weird behavior with the UI elements.Some hitboxed have a hitbox over the button. So we cant use these button without fiddling around with F12-DevMode. This happend on all browsers (Chrome, Edge, Firefox and even iExplorer) and on Phone and Desktop. Is there something im missing to fix this or need i to create a new VirtualAppliance for the FAZ and FMG? 

Can I delete or de-register the FortiCloud account from the Fortigate unit, so I can re-register with the same account.if possible how? and can a factory reset delete a Forticloud account?

Dear Community, I tried creating a new module and after creating and adding the module to the navigation pane in the application editor, I am not able to see the created module on the left-hand sidebar of the FortiSOAR windows to navigate across modules in the system.Please can anyone let me know if there is any additional step I am missing?Thanks

During a recent VAPT security scanning, TCP port 514 was flagged out to be have weak SSL cert.The recommendation was to get a propert SSL certificate for the appliance.Can we disable port 514 on the Analyzer ?my firmware version is 6.4.10. will upgrade to version 7.2 soon. Contact the Certificate Authority to have the certificate reissued.Purchase or generate a proper certificate for this service.

Hi Team, I currently have a FortiSIEM version 7.0.2, but I can’t find any official documentation stating that it supports log collection for TrendMicro VisionOne. However, I can see from the FortiSIEM External Systems Configuration Guide (7.1.1) that FortiSIEM does support TrendMicro VisionOne. In light of this, I would like to know whether it is necessary for me to upgrade my FortiSIEM from version 7.0.2 to 7.1.1 or a higher version in order to collect logs from TrendMicro Vision? Or, in fact, can version 7.0.2 support TrendMicro VisionOne as long as I obtain the normalization configuration file?"Regards,Bruce Liu#Fortisiem #VisionOne #TrendMicro

Following issue shows a wrong connection to Fortiguard-log server, password is correct and worked properly with another Fortigate device, diagnose log is activate but I can't connect to Forticloud:  FORTI-40F # execute fortiguard-log login xxxMAILxxx xxxPWDxxx2024-03-13 12:52:46 [643] fds_https_stop_server: 173.243.143.6:4432024-03-13 12:52:46 [205] __ssl_data_ctx_free: Done2024-03-13 12:52:46 [1047] ssl_free: Done2024-03-13 12:52:46 [197] __ssl_cert_ctx_free: Done2024-03-13 12:52:46 [1057] ssl_ctx_free: Done2024-03-13 12:52:46 [1038] ssl_disconnect: Shutdown2024-03-13 12:52:46 [554] fds_https_timeout: Connection timed out, svr=Forticlient-svr2024-03-13 12:52:46 [246] fds_svr_default_on_error: Forticlient-svr: ip=173.243.143.6:443, reason=42024-03-13 12:52:46 [263] fds_svr_default_on_error: Forticlient-svr: Conn failes 1/22024-03-13 12:52:46 [145] fds_svr_default_pickup_server: Forticlient-svr: [2620:101:9000:143:173:243:143:6]:443Failed: FGT internal error(-1)Command fail. R

Hello, we are trying to deploy fortiweb-image docker image according following instructions: https://docs.fortinet.com/document/fortiweb-private-cloud/6.4.0/fortiweb-vm-on-docker/794267/deploying-fortiweb-vm-on-docker and our container is running but with no web server/GUI accessible and getting following error on docker logs:System is started!!!Program (sysinit) exitCaused by receive signal(9) can you please advise how overcome this error and expose the fortiweb GUI?  adding some info:1. docker image built and run as follows: (per above documentation instructions)cd ~/fwb/image-docker-64docker build -t fortiweb-image .cd script/./docker-fwb.sh -i fortiweb-image -n fortiweb-docker -e ChangeMe123 -g 7180 -m 81. we selected 7180 port for our testing for http server 2. docker psCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES4075ec69f969 fortiweb-image "/bin/docker_init" 3 minutes ago Up 3 minutes 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp,

Hi,I've deployed a Fortinet Nextgen Firewall in AWS. Initially, the WAN interface IP is set to a local IP within the public subnet. However, when I attempt to change it to the actual public IP, I lose connection to the firewall entirely. As a result, I can no longer access it via HTTPS or SSH. Can anyone assist me in resolving this issue? My objective is to utilize the static public IP assigned by AWS for the WAN interface.Thanks

Hello, I noticed that my 60F 's Status LED not being "On"  after upgrade FortiOS to 7.2.8M.It was on while the FW is on 7.0.14MWhile the LED is off, everything seems working as expected.I am not sure if it is because of the design/feature change, or if it is a BUG?Anyone else faced the same issue? Thanks 

I'm seeking guidance on consolidating multiple policies into a single policy on my FortiGate device. Specifically, I have a scenario where I have numerous VLAN interfaces (approximately 100) under a single physical interface. Instead of creating individual policies for each VLAN interface, I'm interested in exploring the possibility of configuring a single policy that covers all VLAN interfaces associated with the physical interface.

Right now we have the inbound to our on premises Exchange server (hybrid - no mailboxes) set to 'All'. I need to use the ISD(s) to restrict to only MS. I have a Fortigate 100F with version 7. Anyone know which ones to use? 

We have a number of FGT devices running on 7.0.14 and all part of FortiManager, with the basic configurations being pretty much the same. One of those configurations is to setup AD users as admins based on LDAP. This process works great for all but 1 of our devices that's out in the field. I tested my "useradmin" account via the LDAP configuration page and got a return of successful. I am in our fw_admins group, which is assigned in the Administrators list for the FGT. However, when I try to login via the GUI with that same username and password, it tells me that my user cannot be found. I can test it all day via the LDAP settings or via CLI, and it consistently tells me that it's successful in hitting the LDAP server and authenticating me. It's just trying to login as an admin where it fails. I can log into any of the other 90 devices we have with that same username/password to admin them with zero issues, it's just the one. We are connected to that site via MPLS and/or VPN

I have the Fortigate VM in AWS and I am trying to setup Single Sign On connected to ADFS for my VPN users.  I am very new to ADFS.  The setup requires you to put in the SP info and then the IdP info.  I am very new to the whole ADFS thing but still in other places on the fortigate I have only had to setup the IdP pointing at my ADFS server and things worked fine.  Why is it asking for the SP too and who is the SP in this case?

Hello,I am trying to implement unsuccessful login attempts policy for local users.So if the user puts 5 times wrong password then he will be locked for some time.There are two local admin accounts.I have setup this, but the problem is that it will lockout whole firewall for login and not only userconfig system global    set admin-lockout-duration 300    set admin-lockout-threshold 10endSo I have tried this setting, but it seems that it is not triggered. Is this setting even relevant for local administrators ?config user setting    set auth-lockout-threshold 5    set auth-lockout-duration 900endThank youBR.D

Hello, I have a question with setting up an IPSec tunnel using IKEv2. In the FortiGate only one PSK needs to be specified. But in the Cisco ASA wizard I need to specify two PSK's. One from the local Cisco ASA and from the remote (FortiGate). How do I need to configure this, do I need to only add one PSK to the Cisco ASA, or is there an other solution?kind regards, Geert

Hello there, I need to make new connection with 4 FortiSwitches 448E FPoE and FortiGate 100F in HA cluster.Because distance between FortiGates and FortiSwitches is over 400 meters (different buildings) and I got 8 optic fibers for this connection.My question is what is best recommendation for connecting FortiSwitches with FortiGate to make it redundant and maximize speed of given ports.In FortiGate I was thinking of use X1 and X2.Also want to use FortiLink for management.Nice if both links will be used.In attachment network connection plan I was thinking off.Any suggestion or good practice will be nice to read.

i am trying to enable snmp to management engine opmanager.but it does not seems to work.what are the proper steps to configure the fortigate

I want to manage multiple fortigate devices.So i try to enable "Show Add Multiple Button".But i can't see the "Add Multiple Devices" button on  Device & Groups.I watch the video on youtube, it could be like this My FortiManager version is 7.2.4Has anyone else had this problem? Thanks.  

Friends, a question, I have a fortianalyzer VM. I have several Fortigate devices synchronized with the FAZ for reporting purposes.Previously, Total records for analysis were displayed: 60 days. Little by little it has been reducing and now I see Total logs for analytics: 20 days.Could you help me by indicating what this is due to?"Daily Log Limit Exceeded" alerts are also displayed.Will this be related to the reduction of Total logs for analytics: 20 day?I have 9 fortigates teams synchronized with the FAZ. 

Hi!I am trying to upgrade FortiClient 7.2.2.0864 to FortiClient 7.2.3.0929. I have never encountered any problems upgrading FortiClient before, but in this case I am unable to do this on Windows Server 2019. It works fine on Windows Server 2022. I am able to upgrade if I run the installation as an admin, but not as system. And I must admit, I would prefer to not upgrade FortiClient manually on 50+ servers. The error I get is the msi 1723 error.Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action CA_InstallFCTServices, entry: MSI_InstallFCService, library: C:\Windows\Installer\MSIFAAA.tmp Do you guys have any idea? I am puzzled as to why this is only a problem when upgrading as system, and on a Windows Server 2019.

Community Following issue showed a wrong connection to Fortiguard-log server, password is correct and worked properly with another Fortigate device, diagnose log is activate:  FORTI-40F # execute fortiguard-log login xxxMAILxxx xxxPWDxxx2024-03-13 12:52:46 [643] fds_https_stop_server: 173.243.143.6:4432024-03-13 12:52:46 [205] __ssl_data_ctx_free: Done2024-03-13 12:52:46 [1047] ssl_free: Done2024-03-13 12:52:46 [197] __ssl_cert_ctx_free: Done2024-03-13 12:52:46 [1057] ssl_ctx_free: Done2024-03-13 12:52:46 [1038] ssl_disconnect: Shutdown2024-03-13 12:52:46 [554] fds_https_timeout: Connection timed out, svr=Forticlient-svr2024-03-13 12:52:46 [246] fds_svr_default_on_error: Forticlient-svr: ip=173.243.143.6:443, reason=42024-03-13 12:52:46 [263] fds_svr_default_on_error: Forticlient-svr: Conn failes 1/22024-03-13 12:52:46 [145] fds_svr_default_pickup_server: Forticlient-svr: [2620:101:9000:143:173:243:143:6]:443Failed: FGT internal error(-1)Command fail. Return code 5FORTI-