Solved

Hey guys, so this looks like a bug but maybe someone has an idea... :)We have a FortiGate-1500D version 7.2.7 with VDOMs enabled. I created an automation task to do a backup via tftp. The backup executes the following CLI script:config globalexecute backup full-config tftp foldername/%%devname%%-%%date%%.conf 1.2.3.4The task and export itself works, however I just noticed that the content of the backup is not correct. It contains only all the interfaces from the root VDOM and their whole default config, no firewalls rules from the production vdoms, no objects etc.Now the super weird part: When I execute the CLI script manually with my hand in the CLI, it creates a correct backup full with all the necessary configurations and VDOMs etc.The exact same backup automation stitch with the same CLI script (copy+paste) also works on other Firewall, a 100F with also 7.2.7. The only visible difference for me is in the fourth line in each of the correct and incorrect backup files:Correct bac

Hello fellow Fortinet people. We have a new Fortigate Cluster (AP) with VDOMs enabled (our first Cluster with VDOM config). Now of course we want to monitore both firewalls seperately. Until now we always used the IP addresses of the dedicated management interfaces. However I just learned the following two limitations of Fortigates:«To get SNMP working with VDOM enabled: Make sure that the interface where the SNMP collector connects to is part of the management VDOM.»«Note: Dedicated management ports on a HA Cluster will not be part of any VDOM.»Now from my understanding this means we cannot use the dedicated management interfaces (which are excluded from the HA). Does anyone of you has the same config and if yes, how do you monitor both firewall seperate?

Hi All, I am trying to have Dual Hubs for my spoke. I just set up Hub A using the built-in Wizard of Fortigate.All branches and Hub A are working well on day one. We are going to have a new Firewall at DataCenter as DR second Hub now. All traffic will only go through Hub A and only use Hub B if my Hub A goes offline. To achieve this, we set up the route-map-out for both Hub A and B BGP settings. The metric for Site A is 5, and Hub B is 100. We tested the connection, Both Hubs VPN up and seem good for traffic. We tried to shut down Hub A VPN then, all traffic was routed to Hub B. When Hub A resumed, we found that the Branch learned BGP from A again and the Metric is 5. However, the route with Metric 100 from B is still the best path for the branch and does not go through the Hub A.  Please advise.

We are looking for the power draw for the 401E, for the DC.

Good morning friends, a question:In fortigate I have two tokens available, the ones that come by default. I need to assign those tokens to two users, but when I assign the token I get an error message (image).The FG version is 7.2.8, could it be a bug in the version?   

I am getting lost with all the certs so can someone please help me.  While I have System SAML SSO logins working I noticed that one of the certs involved I have no clue where it came from.  So I am trying to understand which cert is needed where. On the FortiGate:SAML SSO SP Cert: I am guessing this should be the cert of the SP.  If the SP Address is john.com the cert should be the cert+key of john.com.SAML SSO IdP cert: This should be the cert of the IdP (imported as a remote cert).  In my case the ADFS server. On the ADFS Server:Matching Relaying party trust Encryption: ADFS CertMatching Relaying party trust Signature: ADFS Cert Does this sound correct?

Hi,I want to know what are the impacts to existing dial-up clients when I extend/expand the netmask (say from 255.255.255.0 to 255.255.252.0) in dynamic Dial-Up VPN IPSec on the Hub?Maybe someone can give insight about this. Thank youAri

Hi, I have a FortiGate SSL VPN setup in full tunnel which is working but when a remote user is connected via the VPN I am unable to access the remote computer via its VPN DHCP IP for the local Lan. Do I just need to setup a firewall policy from the local lan -> ssl.root or is there more to it?   

Hi Today I upgraded my fgt to 7.4.2 version but on sdwan rules page it does not show anything. In cli i can see my sdwan rules. What is wrong?

Hello! Currently we are looking to create an API with the support portal (device inventory).To setup the correct API we need some documentation but the are behind the Developer Network.Is there any way to access the link from the following documentation? We are not able to access the developer network. It's about the FortiOS REST API documentation. https://docs.fortinet.com/document/fortigate-cloud/24.1.0/administration-guide/557024/api-accesshttps://fndn.fortinet.net/index.php?/fortiapi/1-fortios/ Best regards,Tim

 Hi GuysI've been planning an outdoor network, and I have a doubt about the installation of 432F. Is this AP designed to be built on ceiling or on wall/pole? The radiation pattern on Fortinet docs seems this AP in a ceiling position. Do you think in terms of outdoor environments, this pattern will change in case of installing this AP on pole at 4/5 meters high?  I appreciate your time in advance. RegardsEstéfano A.  

Install & configure step by step:Install FortiClient VPN 7.x (7.0.9 and 7.2.4) onto macOS CatalAllow fctservctl2 and FortiClient with Full Disk Access permission in Security & PrivacyLaunch FortiClient for the first time and accept the termsAdd a new IPSec VPN profileEnter username and passwordConnectThe dashboard show status "VPN Connected" but there is no connection actually. On the other hand, the version 6.4.9 works perfectly. Any idea that it is a bug or FortiClient 7 has dropped support for Catalina?

 Greetings,I should configure a WiFi SSID on a UniFi Controller that performs redirects to a Captive Portal on a FortiGate so that the users are picked up by a FortiAuthenticator. In particular:Users connect to an SSID issued by the Unifi Controller.As soon as the user connects, a FortiGate Captive Portal should appear and read the users from the FortiAuthenticator.After user login, he can go Online.It can be done?If that's not possible, I was thinking about:SSID without passwordCaptive Portal on the FortiGate interface (which would also be the gw of the users connected via WiFi)Authentication on the FortiGate Captive Portal with users drawn from the FortiAuthenticator.Thank you very much for helping.

Hello, I fail in connecting a FG-200F v7.2.4 to FortiClient EMS cloud. In "Fabric Connectors" -> "Connection status" it reads: FortiGate not authorized, but in FortiClient EMS cloud neither the Authorization pop-up is displayed nor occurs the device in EMS cloud Administration -> Fabric Devices.Does some know how to debug this?I am also searching for a how-to on registering a Fortigate by using a EMS cloud-generated Fortigate key by GUI or CLI. best regardsMartin Haneke

HiWe have some remote users with windows 7 and forticlient vpn app does not install on windows 7. I created a native l2tp vpn tunnel, it created 2 firewall policies automatically. I also want to have split tunneling enabled. When they connect via this tunnel, they can not connect to our internal network nor internet. What should i do to have access to internal networks and internet at the same time? Thanks.

good morning friends.Could you help me with this query.I have a virtual fortianalyzer and I notice that the ADOM License option indicates "unlicensed".Could you tell me what that option is for?On my Faz I have a synchronized FG. 

Hello teams,I have new installation of FortiSIEM Supervisor All in One, and my request is it's possible to configure NFS storage for event database and how to do this?best regards

Hello everyone, I'm somewhat new to FortiGate setup. I work in IT Security, and I'm currently creating a new policy on my FortiGate. This policy aims to limit social media usage within my company. I would like to know if it's possible to make an exception for guest devices when they connect to our network. In this case, I've configured a different segment IP from our office segment IP ?Note : This is my current setting

Hello Peoples,I am not a computer person, so type slowly so I can understand.In other words - please treat me with respect as I may not understand terminology.I have been through all my available IT resources and they have washed their hands with my problem which leaves me stuck.Last week, for no apparent reason (perhaps windows update?), my VPN connection to my university for my course stopped working. Being an external student in a remote area this is a problem.  On my PC workstation, over the course of the last week, I have now completely reimaged my machine with a clean win10 64 install.  I have updated all drivers - everything from motherboard chipset, PCI and network drivers.  I am running windows defender in standard config but no other security such as nortons.The symptoms are:1. Send connection request2. Receive MFA challenge3. Forticlient says connecting after MFA challenge4. Says connected, with bits received and correct IP address to host shown.5. No bits rec

Hello,  I have a problem with Forticlient VPN connection. When i try connect to server i got massage "Network error. Can not connect to VPN server". I'm using domain name in Remote Gateway. If I use the IP address everything is ok. Mac OS 13.3.1 (but it already happened to me in previous versions)FortiClient VPN for Mac 7.0.7.0245 (but it already happened to me in previous versions)FortiGate 60F 7.0.11 (but it already happened to me in previous versions) Ping by domain name works ok, access by web browser by domain name works ok. A Windows computer on the same network as the Mac connects perfectly by domain name.  Anyone know how to fix it? Thank you,

Hi I'm trying to allow multiple IPSec dial-up connections from the same source IP, and I found help here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Allowing-multiple-IPSec-dial-up-connection-from/ta-p/198550My problem is, that I get an error, when I try to set the "route-overlap allow" command. It just says "unknown action 0" I have a Fortigate 60F with firmware v7.4.3 Regards Thomas Barnes

In this topic I will show how it is possible to communicate between fortigate and mikrotik using IPSec. For this occasion, only Mikrotik has a public IP. Step1;VPN>IPSec Wizard> choose the custom tunnel. Give him a name select your network interface, put the IP address of your mikrotik in the IP ADDRESSES field Following this configuration Generate a strong password  Because I'm using a fortgate trial license, I don't have many options for encryption and authentication, so I adapted mikrotik to the reality of my fortigate on this occasion.But it is recommended that you always use more complex algorithms.  phase1,   for phase 2, I increased the strength of the authentication algorithm a little. It is extremely important that you keep in mind the networks of Site A and Site B that you want to communicate, in this case my local network (Fortigate) that I will share with my mikrotik is 192.168.72.0/24, and the network f

Hi Guys,  Good day, Please help to solve my problem on my 60D Forigate Firewall device.I currently avail a 1 Static IP addresss from my ISP Provider, they provide Static IP, Subnet Mask and Gateway.But I cant access the internet using my PC that connected on the Fortigate.May Setup on my home lab is (  ISP Router >> Fortigate 60D >> MY PC )I tried also execute ping on the Fortigate CMD but its always says unable to resolve the hostname.When I tried to change the IP on my WAN1 port from Static to DHCP, the internet access was working but when I tried the setup the static the problem will exist. Thank you!

I am trying to upload a Fortimail image to VMWorstation ( to practice), I have configured the IP and ports but when I open the browser, it does not load the Fortimail IP. Can you help me, please? I always have these problems, I don't know if I have to configure in the vmware workstation (settings) or in the fortimail (cli). I share the commands that I entered in the CLI#conf sys interface(interface)#edit port1(port1)# unset ip(port1)#set mode static(port1)#set ip 192.168.17.15/24(port1)#set allowaccess http https ssh ping(port1)#endWhen I do an execute ping 8.8.8.8, I get this message.#execute ping 8.8.8.8PING 8.8.8.8 (8.8.8.8): 56 data bytessendto: network is unreachablesendto: network is unreachablesendto: network is unreachablesendto: network is unreachabletimeout . . .timeout . . .timeout . . .  

Hello! About FortiEDR,1) What are the dependencies before installation?2) Any compatibility issues for devices where FortiEDR will be installed?3) Any guide/ step by step setup for FortiEDR?4) Any integration with other Fortinet devices/ service for FortiEDR to work?5) Where can I download a image file of FortiEDR for Hyper-V/VMware for a demo environment?