Solved

I want to manage multiple fortigate devices.So i try to enable "Show Add Multiple Button".But i can't see the "Add Multiple Devices" button on  Device & Groups.I watch the video on youtube, it could be like this My FortiManager version is 7.2.4Has anyone else had this problem? Thanks.  

Friends, a question, I have a fortianalyzer VM. I have several Fortigate devices synchronized with the FAZ for reporting purposes.Previously, Total records for analysis were displayed: 60 days. Little by little it has been reducing and now I see Total logs for analytics: 20 days.Could you help me by indicating what this is due to?"Daily Log Limit Exceeded" alerts are also displayed.Will this be related to the reduction of Total logs for analytics: 20 day?I have 9 fortigates teams synchronized with the FAZ. 

Hi!I am trying to upgrade FortiClient 7.2.2.0864 to FortiClient 7.2.3.0929. I have never encountered any problems upgrading FortiClient before, but in this case I am unable to do this on Windows Server 2019. It works fine on Windows Server 2022. I am able to upgrade if I run the installation as an admin, but not as system. And I must admit, I would prefer to not upgrade FortiClient manually on 50+ servers. The error I get is the msi 1723 error.Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action CA_InstallFCTServices, entry: MSI_InstallFCService, library: C:\Windows\Installer\MSIFAAA.tmp Do you guys have any idea? I am puzzled as to why this is only a problem when upgrading as system, and on a Windows Server 2019.

Community Following issue showed a wrong connection to Fortiguard-log server, password is correct and worked properly with another Fortigate device, diagnose log is activate:  FORTI-40F # execute fortiguard-log login xxxMAILxxx xxxPWDxxx2024-03-13 12:52:46 [643] fds_https_stop_server: 173.243.143.6:4432024-03-13 12:52:46 [205] __ssl_data_ctx_free: Done2024-03-13 12:52:46 [1047] ssl_free: Done2024-03-13 12:52:46 [197] __ssl_cert_ctx_free: Done2024-03-13 12:52:46 [1057] ssl_ctx_free: Done2024-03-13 12:52:46 [1038] ssl_disconnect: Shutdown2024-03-13 12:52:46 [554] fds_https_timeout: Connection timed out, svr=Forticlient-svr2024-03-13 12:52:46 [246] fds_svr_default_on_error: Forticlient-svr: ip=173.243.143.6:443, reason=42024-03-13 12:52:46 [263] fds_svr_default_on_error: Forticlient-svr: Conn failes 1/22024-03-13 12:52:46 [145] fds_svr_default_pickup_server: Forticlient-svr: [2620:101:9000:143:173:243:143:6]:443Failed: FGT internal error(-1)Command fail. Return code 5FORTI-

I have a fortigate vm in aws.  I have setup a ssl vpn to a host on the local subnet of the inside interface and that works.  Now I want to expand it to a host in a different VPC in AWS.  For this it will need to route over a transit gateway to the other VPC.  The transit gateway routing works and can be verified.  I can ping and even telnet to port 22 from the fortigate to the endpoint in the other VPC. I am using browser based ssl vpn for testing. I tried to setup the following policy based routing:Incoming interface = ssl.rootOutgoing interface = port2 (private lan)Source = ALL and SSLVPNDestination = 10.0.0.0/8   (this CIDR will be routed over the transit gateway because of the attached tgw route)Schedule = alwaysService = ALLAction = Accept However, when I test this policy has no hits.  What am I doing wrong???

Is if possible to Create Multiple SSL VPN Groups that have limited access to different Networks AdminVPN Users able to get to systems and managementStandardVPN Users able to get to what systems they need but limitedand so on Thanks

Hello, everyone!I hope everyone is doing great. Recently, we upgraded our 100F firewall from 6.4.6 all the way up to 7.4.3.Unfortunately, SD-WAN Rules page doesn't load anything at all.Is there a new version to be released soon? How can I access it through GUI using another approach if possible? Best,Sagvan Saleem

I have many corporate Fortinet firewalls in play, but finally just went and bought one for myself (a 60e, great for home internet and labs) so am posting with my personal acct - and am seeing the following weird issue.   I have created an address group blocking a number of countries (Russia and China primarily, seeing attempted connectoin attempts from various IP's). While I do 'allow' SSH on wan1, the administrator super_admin and my acct profile_admin are only allowed from certain IP ranges (my inside subnets and the VPN DHCP range I hand out when I connect to my own network from outside) so that's already fairly locked down.I am seeing logs denying 'admin' by blocked IP because it falls outside trustedhosts range, but if the bots try any other account (that does NOT exist on the Fortinet) it allows the connection to try passwords and then of course fails because there's no such account.  I have created a deny policy referencing the regions and put wan1/

After updating various Fortigate models from version 7.0.13 to 7.0.14 the Kiwi Cattools Backup (Device Backup TFTP) brakes. Errorlog: Connection failed (30011) Invalid data received from remote server. Protocol error.We are using the latest version of Kiwi Cattools (3.12.3.3257).Maybe someone has the same problem and already found out what the problem is and how to fix it.Thanks in advance for any help! 

I want to open a different fortinac portal in front of a user joining a guest wireless network and a user joining a guest wired network. How can I do this?

Hello. There are 2 firewall, FortiGate 60F (firmware 6.4.6 build 6083 GA) and FortiGate 200E (firmware 7.0.12 build 0523 Mature). Will there be any problem configuring IPSec VPN between these two firewall?

I just got finished setting up FortiMail Cloud for Office 365 (setup as gateway for inbound traffic only) and had a question I am having trouble getting definitive answers on. I am sending and receiving email just fine; however, I know I have some tuning and tweaking still to do. Also, I know I am asking this question from a O365 guidance side of things, but as it relates to the new integration with FortiMail, I'm hoping someone can share some guidance on what worked best for them advice. One setting I put into place was defining the IPs of my FortiMail Cloud instance into the Anti-Spam Connection Filter Policy at O365. I did this as it seemed O365 was declaring an inordinate amount of SPAM from FortiMail Cloud. According to Microsoft, the IP Allow List skips spam filtering but still scans for malware and high-confidence phishing. I am getting more email alerts from O365 about "Phish delivered due to an IP allow policy" (I assume due to the Connection Filter Policy and since it's

Hi,I would like to know, where to find the function "SMTPUTF8" in Fortimail Version V6.4.6 ?In Version V7.4 you find it under System -  MailSetting - MailServerSettings.https://community.fortinet.com/t5/FortiMail/Technical-Tip-How-to-avoid-email-with-UTF-8-encoding-being/ta-p/292948This parameter doesn´t exist in the older version at that place.

Hello! In a normal connection (like internet - router - firewall - LAN device) the destination is the default route 0.0.0.0/0.0.0.0.1) what does it mean by named address?2) In which case we do not use the default route? 3) for what purpose we select internet service option?4) for IPSec VPN, is it mandatory to use blackhole as the interface?

Hello, I hope you are well, I want to update my two Fortigate 201F but I don't know which is the most stable version: 7.4.1 or 7.4.2 or 7.4.3 Regards.   

I've upgrade by gui a 40F Fortigate from 07.4.0 to 07.4.2 and readonly view is the only access I have by gui. By cli all permissions are granted, until now according troubleshooting there is no chance to roll back from 07.4.2 to 07.4.0 by gui or cli, cli error output shows: "Firmware update license is expired. Please update to a valid license" similar output showed by GUI. Community, do you have any feedback?

Hello team, this is the scenario:IPSec peers are both public ip so I left NAT-T disabled and enabled DPD Peer detection on demand for both firewalls.As authentication I set PSK, IKEv1 Main (id protection) for both firewalls.For the Phase1 Proposal part I configured AES256-SHA1 and DH 21 and 2 for both firewalls.After that I configured the relevant policies and static route for both firewalls.The problem is that phase1 does not go up. Running some debugging I see this in the logs:I also ran a packet capture and I see traffic on port 500 for both firewalls:   Thanks in advance for the supportBR

Hello! I have a question regarding IPSec VPN. There are 2 firewall, FortiGate 60F (site A) and 200F (Site B). The question is, do I need to configure IPSec VPN for routers in Site A and Site B if the router is either before or after the FortiGate firewall?

Hello AllCan I deploya FortiNAC "Subscription Visibility+Control (PLUS) license for 25 concurrent endpoints. MOQ 500" withFortiNAC "Subscription Visibility (BASE) license for 25 concurrent endpoints. MOQ 500" for the same device or I can't combine two licenses.

 Hello, I searched it in this forum, and finally found a similar topic below. https://community.fortinet.com/t5/Support-Forum/IPSec-VPN-restricted-by-source-IP-address/m-p/129749?m=51069 But the topic is unresolved. I already found a way to solve it by using 'Local in Policy'. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restrict-VPN-access-to-certain-countries/ta-p/192328 However, I don't want to use it because of system operation and maintenance considerations, as 'Local in Policy' is supported only through CLI setting.If you have another idea, could you tell me how to set it? FortiGate 

Hello, we just changed our FG81 cluster (because of the prof_admin problem). The first 81E resetted, loading config file and it is up and running (7.4.3). The second I did the same but I have problems. The status LED is fixed, it is not blinking. I hace access via Console and access via web is strange, suddenly I loose contact, etc.  Is there a hardware issue? What can i do? Thanks

Hello, does anyone know how to unhook clients with a bad signal from the fortiap since I have clients that connect from areas that do not have good coverage

Hi, I have configured pool with pool member, used default http monitor, but I see the pool member availability is "init", it's in this state for more than 20 minutes, anyone knows the reason for this? Thanks

Hi, we have a HA config where sometime ago we backup them up with the wrong prof-admin. So now we dont have any super_admin accounts and the FGs have 7.4.3 so no maintainer option, right? I was thinking of changing the cnfig file, restore a new master config with super_admin instead of prof_admin in the admin accounts and change slave to master, reset master and set up new HA. Now I found out that I cant execute factoryreset, I connected via console and I guess again admin rights. What can I do? Thanks

HelloI have two questions regarding FortiSIEM 6.7 content update.Which ports are used by FSM to download content updates from FortiGuard (can't find it on admin guide)Any advice when it connects to FortiGuard behind a proxy?