Solved

do i need to enable FMG-Access on my fortigate interface is i do not have forti manager in my environment ?is it good practice to enable FMG-Access ?

We configured notifications for Firewall policy expiry alerts.The alerts are operating well.The issue is that we are receiving notifications from both the primary and secondary firewalls.Please supply the necessary "Kb" so that we can receive notifications from the primary firewall only. #FortiOSv7.2.7 build1577 (Mature) 

Good morning friends, I have created a report in the fortianalyzer about which countries access or try to access my publications that I have created in the firewall.In the report I have noticed the following information (image):  When you say "reserved" what does it mean?Reviewing the logs, I see that the source IP is the private IP of my LAN network (users) and that the signature has LOW criticality with the signature "traceroute" and others have the signature "IP.LAND". It is worth mentioning that the IPS profile detects it. Do you recommend blocking the IP.LAND signature?

Hi Fortinet Community! I've been researching around but figured I'd drop a quick post here to see what others think. Working on implementing FortiSwitches into an environment with an existing FortiGate. To be clear, the current switches are not FortiSwitches. Layer 3 is handled by the FortiGate, and there are several VLAN sub interfaces on say the internal1 port. It looks like for this implementation, we will need to use FortiSwitch VLANs, which are bound to the FortiLink interface. It seems like we will need to recreate the existing VLANs as FortiSwitch VLANs to utilize them in the WiFi & Switch Controller in the FortiGate as if we create them as-is I believe VLANs and subnets will conflict. I've found some clever ways to speed this process up by exporting a config backup, modifying the interface lines, and restoring. Either way this seems like it'll be intrusive and was hoping to see if anyone in the community had experience with an implementation such as this.&nbs

Hi, does anyone know if possible, to put multiple /32 IP in system proxy arp in Fortigate? I been searching for inputs but most of the time the guide only put one IP in system proxy-arp? Is it possible to have multiple IP or not? Hope someone can guide me here!

Hi all, When using the Virus Total connector action "Get Analysis Details", the execution output shows the API request is 'queued'. Does anyone have any experience building in steps to keep checking when the status becomes complete?Using google.ca just as a test in the screenshot. Thanks in advance, Nelson

Hello, I have two firewalls Fortigate model 60E in HA.I have 2 tokens each, 4 tokens in total.I would like to know if I can use all 4 tokens I read to do this I have to delete the tokens on secondary FW, and then reimport them on the primary, in this way I can see all my 4 tokens on primary firewall, is it right? Thank you!

I am running fortigate vm in AWS ver 7.2.4.  I am starting to look at setting up client VPNs for our users.  After reading the documentation I noticed we could do this in 2 phases.  Phase 1 move all existing users to forticlient VPN.  Phase 2 move the users to ZTNA. While going through the SSL-VPN Settings on the Fortigate I see the message "For increased security, scalability, and flexibility, use ZTNA or IPsec VPN as an alternative to SSL-VPN tunnel modes."  So does that mean I should be doing IPsec VPNs for normal users rather then using the old SSL-VPN?  Are there any gotchas if I do Client IPsec VPN when the fortigate is running in AWS?

Hi everyone, I got a issue since yesterday on my FAZ : i cannot connect to webGUI anymore. When I try to connect to https://192.168.1.16 I get an ERR_CONNECTION_REFUSED in any web browser on any computer. It was working earlier. I did not make any changes on the interfaces. Rebooting the FAZ has no effect. No host filtering on the interface or on admin account. SSH and PING keep on going on. allowaccess is set on https, ping, ssh, snmp, webservice and fgfm. Where could the problem be spotted ?

For my FortiCloud subscriptions (FAZ, FMG, Sandbox, EMS) - Our compliance team needs documentation that our data is kept in US datacenters only. How is this handled and is there any documentation that proves it ?  Thanks, Don

I have a Fortinac Guest network. I want the Citizenship number from the user in the guest network. There is an API where I can query this number. I want to include the user's name and surname in the network when it matches the citizenship number. how can I do this?  

Greetings, I have users on a internal network with Internet access blocked. We have MS Office installed on their workstations and I authorized them on a different vlan *with* internet access. (They're the per-machine perpetual licenses that ship with Dells, so should be fine forever offline.) After replacing a juniper with a fortigate when the no-internet users launch Word or Excel it hangs for roughly 26 seconds and then starts normally. Before installing the fortigate this didn't happen. When I make a rule for these machines that gives them access to the internet the problem goes away, so I'm fairly convinced the problem has to do with Word/Excel phoning home and some kind of keep-alive or time-out issue. The migration was fairly painless and this is one of the only quirks that have come up. Any advice on how to solve this without putting these machines on the Internet?

HelloI wonder why FortiGate's active portal is somehow not as active as FortiNAC's active portal.In FortiNAC when you are isolated there is always a popup message in OS and in browser telling you that there is an active portal and asking you to click to authenticate.However in FortiGate when you enable active portal there is no popup message in OS neither in browser, and you need to open the browser and access some site in order to get activate the active portal.If someone successfully managed to make it more proactive thanks to share.

Hi, is there a way to disable nat on ipv6 when using combined policies (ipv4 & ipv6).There is only 1 checkbox to enable/disable nat. This implies to both ipv4 & ipv6.For ipv6 of course you don't want nat. Fortios is 7.4.3 thx

Hi All,There is a FortiGate 60E.I set up MFA the way shown on the screenshot.   The drawback of this method is that it requires FortiToken Mobile.It means if I'm not available nobody can access the router.Is it possible to set up MFA for admin access in some other way that wouldn't be linked to someone mobile device?  

Working on some FortiOS firmware upgrades and have come to reckon with the FortiAP and FortiSwitch compatibility. I am running a FortiGate-100F and trying to upgrade to FortiOS 7.x, but the FortiAP's I'm running areFortiAP-221E and FortiAP-222E.I looked at the FortiAP compatibility matrix , but it does not list the 221E or the 222E that I'm using.Currently the FortiAP's are running 6.4, so based on what I see in the matrix I should be safe to upgrade the FortiGate.

Hello Everyone Our customer has a FortiGate network that only contains 1 FortiGate FG-200E firewall. Now they want to purchased another FG-200E firewall and make an HA build.  But to reduce failure points, we are thinking if we don't need Switches for this HA build. Then I'm wondering, is it possible to enable HA for two FortiGate firewalls without any switches and hosts under two firewalls can all work fine? For example, like below topology. VLAN 101 was there on both FortiGate firewalls with private IP address 10.1.1.1/24. This VLAN is used to connect with each other and to the hosts under them. Then, when the Secondary FortiGate works in Spare mode, will its LAN ports in the same VLAN still be functioning as a L2 switch and make Server 2 be able to access Internet via Primary FortiGate? Thanks a lot.

 FYI:Seems like the latest FortAP release has put ModelName in the SystemName LLDP object, so in a switch you get a lot of 'FortiAP-NNN' names, not the actual hostname of the AP's:Port:     SystemName: The Cisco AP still active on the switch, correctly shows the hostname.Earlier FortiAP's listed the System Name corretly, but currently I can't downgrade any AP's, so can't verify at what version it 'broke'. TAC: 9287117

Hello,where can i find download link for FortiWeb VM deployment docker image package?in following installation doc it mentioned to look it at https://support.fortinet.com but couldn't found any download sectionhttps://docs.fortinet.com/document/fortiweb-private-cloud/6.4.0/fortiweb-vm-on-docker/794267/deploying-fortiweb-vm-on-docker 

Hi Team,I have encountering an issue with devices while updating their records.This issue occurs after installing FortiClient ZTNA.I monitored the traffic by Wireshark and I observed that the connection refused as shown:Our DNZ zone security configuration is to allow secure connection onlyBut after changing it to unsecure, machines can update their records.This issue without connecting to VPN just the FortiClient installed and connected to EMS server.FortiClient Appreciate your support.Thanks,Alaa Elrayes

I am trying to figure out the best way to setup ZTNA for our environment.  We create a lot of server that server up our SaaS application via https.  Each server has its own unique URL.  If I had to create a ZTNA server for each one I would have a new full time job.  Even setting up a single ZTNA Server and then managing webservers as they are added/removed from our environment would be a full time job.  All of our webservers do live on a handful of subnets that never change. What would be the best way to setup ZTNA for this?

I am trying to configure trusthost for the user ADMIN on my fortigate with the following:config system adminedit adminset trustedhost1 172.25.176.23 255.255.255.255set trustedhost2 172.25.177.0 255.255.255.0end My other users use ADFS SSO login with 2FA so I am ok with them accessing the FortiGate from the internet.  I just want to block the default admin account (and any other non 2FA backed account) from logging in via the internet.  I do want to allow the admin user to be able to login from our internal AD domain servers. When I set this up though I found that ALL users were blocked from accessing the FortiGate unless they came from our AD servers.  Support is trying to tell me that setting up the trusthost effects ALL users and not individual users.  I find this very hard to believe that Fortinet would prevent people from controlling where a user logs in from on an account by account basis.  Linux has been doing this for MANY MANY years.  And

Hi all,I've got an incident based on traffic from an internal IP to Malware IP 192.143.59.12. FortiGuard is not showing anything regarding 192.143.59.12. Neither the Malware IP list under FortiSIEM -> Resources.I know that Malware IP's are based on services such as Emerging Threat.Why is FortiSIEM classifying  IP 192.143.59.12 as a malware? Thank you,Norberth  

I am trying to configure the fortiportal with a secondary IP address and every time I do so, I get the error"Disabling interface eth1"after I enter the end commandhere is what I input:fortiportal # conf system interface(interface)# edit port2(port2)# set ip (ip address and subnet)The system already has a primary address and port1 configured with an ip which we use to access through ssh to configure the secondary ip.What we are trying to do is have a primary IP for one team to use for configuration and a secondary for another to access Fortiportal.Did anyone have any luck in configuring two IP addresses for Fortiportal?

Hello,For our customer who has a full forti-stack: Fortigate firewall, FortiSwitch and the FortiAPs, the WIFI guest users are not getting the IP addresses and the error DHCP-no-responseWarningDHCP server not responding for client (Client device Mac-address)The link to the Fortigate documentation which shows the Log ID:https://docs.fortinet.com/document/fortigate/7.2.7/fortios-log-message-reference/436581:) I have a question is there a separate document that advises the steps to troubleshoot this issue related to the log messages on the firewall not only for this issue but also for the other issues?2:) Lastly the issue started after the firmware upgrade from version 7.0.12 to 7.2.7 last week?3:) What are the steps to troubleshoot the issue?Many thanksFaisal