Solved

I am trying to configure the fortiportal with a secondary IP address and every time I do so, I get the error"Disabling interface eth1"after I enter the end commandhere is what I input:fortiportal # conf system interface(interface)# edit port2(port2)# set ip (ip address and subnet)The system already has a primary address and port1 configured with an ip which we use to access through ssh to configure the secondary ip.What we are trying to do is have a primary IP for one team to use for configuration and a secondary for another to access Fortiportal.Did anyone have any luck in configuring two IP addresses for Fortiportal?

Hello,For our customer who has a full forti-stack: Fortigate firewall, FortiSwitch and the FortiAPs, the WIFI guest users are not getting the IP addresses and the error DHCP-no-responseWarningDHCP server not responding for client (Client device Mac-address)The link to the Fortigate documentation which shows the Log ID:https://docs.fortinet.com/document/fortigate/7.2.7/fortios-log-message-reference/436581:) I have a question is there a separate document that advises the steps to troubleshoot this issue related to the log messages on the firewall not only for this issue but also for the other issues?2:) Lastly the issue started after the firmware upgrade from version 7.0.12 to 7.2.7 last week?3:) What are the steps to troubleshoot the issue?Many thanksFaisal

Dear Colleagues,we are facing issues with tcp forwarding on some MacOS mashines. On some Macs its working quite fine but some are not able to connect to ZTNA Destinations, while the normal ZTNA Web-Proxie stuff is working.The FortiClient logs are showing the following on these devices:2024-02-26T15:08:55.162 TZ=+0100 info ztna mergeCfg:{"enabled":0,"rules":[{"name":"replaced","mode":"transparent","enabled":0,"destination":"replaced","gateway":"replaced","encryption":0,"local_port":"7788","type":"private"}],"portals":null,"gateways":[{"redirect":"0","addr":"replaced","alias":"replaced","rules":[{"name":"replaced","mode":"transparent","enabled":1,"destination":"replaced","gateway":"","encryption":0,"local_port":"7788","type":"private"}]}],"notify_on_error":1,"portals_enabled":1,"gateways_enabled":1}2024-02-26T15:08:55.162 TZ=+0100 info ztna ztna disable I replaced the private data with "replaced".Every time you try to access a host, specified in the ZTNA Destinations, you will get t

Hi,I have a problem with a FAZ trial license. Some time ago I've been playing with a FAZ VM on Proxmox - restoring from backups and resizing data disk (of course within trial limits). After that I was getting errors about duplicated license.I've decided to decommission the old license, delete the VM and start fresh. Sadly, with the new license and new VM I was still getting the duplicate license error.With the support help, I was able to remove all old and decommissioned FAZ licenses from my account and once again deployed the new VM. Nothing has changed. I've even tried to create another Fortinet account, but no matter what I do, there is still an error.Does anyone have any idea what to do to deal with this?

When we configure this SSL VPN MAC address filtering, what system limit would dictate the max number of MAC addresses we can configure on an FGT (no vdom/muti-vdom)?https://community.fortinet.com/t5/FortiGate/Technical-Tip-MAC-address-check-on-SSL-VPN-connections/ta-p/194337The max value table doesn't seem to have the exact matching object.https://docs.fortinet.com/max-value-tableToshi

Hi, Our company has 6 x /24 IP blocks, and we want to create static ARP records for each IP address, consisting of different MAC addresses. We only want the specified MAC addresses to access the internet. We are using a Fortigate 3700D device. We don't want anyone else to use that ip other than the mac we paired with. Is it possible with without problem ?  My question this process can be offloaded by the NP6 processor and if there would be any issues with a 10Gbps active capacity. Thanks.

I passed my exam 7 days ago. I made mistakes with the registered email on PearsonVUE. I know know that was the problem. I should have used my company's email when I registered. I contacted Fortinet support to associate my FortiID but no response.https://ftnt.freshdesk.com/support/solutions/articles/73000524133 I contacted PearsonVUE, but they asked me to contact Fortinet. How? How can I reach Fortinet training support?They said I can create a ticket with them on the above link. But nobody is monitoring that ticketing system. Just wait for another 2-3 weeks? I need to provide it to my company. :( 

Hello, 2 wees ago we replaced a FG100D cluster for FG100F. We copied all VoiP rules for the external Voip provider. Now we get some feedback from the local users that "sometimes" it takes lie 1-2 seconds before they can take the call and they did not have this issues lie 2 wees before. the policies are the same, we deleted the session session helper so I think we should have the same situation. Any ideas? Thanks

Could someone kindly assist me with the FortiSOAR uninstallation/reinstall procedure via the command line interface? (Tried and Tested)

Trying to get a trunk built between a Cisco Catalyst switch and a Forigate 100F using two 10G links in an LCAP link-aggregation configuration.  The LACP link comes up but the VLAN communication does not work.  I swear I've used this same configuration in the past and it worked, but it isn't working now. Here is the configuration on the Fortigate:config system interface    edit "x1"        set vdom "root"        set type physical        set trunk enable        set snmp-index 7    next    edit "x2"        set vdom "root"        set type physical        set trunk enable        set snmp-index 8     next     edit "po1"        set vdom "root"        set allowaccess ping https ssh snmp http fgfm radius-acct fabric ftm&nbsp

Hi guys, I wanna upgrade my SOAR to the latest version but i get a response disc error. How can i fix this?  Error: There is insufficient disk space to complete this operation.Make sure you have enough space on the following locationsand then retry the operation.Details: Available Free Space on /: 1.33GBRequired Free Space on /: 2 GBRerun the script post addressing above error(s).Exiting.

I have a strange issue with FortiManager, I have two sites that have radius configured for VPN authentication. Each site has a local server and a remote server as a backup that connects over IPSEC. I set a source IP in FortiManager and push the system config. Both sites then can contact the servers using the test connectivity, but as soon as the system config is pushed, the policy package goes out of sync. When I go to push the policy package, it unsets the source-ip and the test connectivty fails. I have tried it directly on the firewall and retrieve the config, but ultimately get the same issue where FortiManager wants to unset the source-ip. Anybody ever run into this or have any suggestions?

Hello!after installing FAZ-VM-KVM 7.2.4 (with Trial License, if it matters), I was not getting "Top Sources" and "Top Destinations" for Last 4 hours, 1 hour, 30 minutes or 5 minutes. To fix, I rebuild'ed the database (using "execute sql-local rebuild-db") and now, I'm seeing "Server error: ERROR: relation "app_mdata" does not exist LINE 1: ... ON t1.dvid=t2.dvid) t WHERE (1=1))) t1 left join app_mdata ... ^" in graph and table.Suggestions on how to fix, most appreciated.R's, FerenX  

Hello everyone, Our #Fortigate v7.0.14 detected a Heartbleed attack, but it did not block it, so it reached an inner service (luckly not vulnerable)  To my understanding, the default action should be blocking such malicious connections. Why did it detect but not block? How should I configure Fortigate to block it? Thanks for your help,

Hi there , we are using Fortinet 60F and it was working all good and I can login via Https , but suddenly its stop working , i cannot access it , I have tried rebooting but no luck , the only way i can access is TELNET and I am not good on CLI , i have check some basic commands , i have tried already killing the Https daemon , and check the ports (http , https) for connectivity but I am still not getting any luck , I have also checked the storage which is all good, I am not sure what the Issue is , could this be a trusted IP issue ? i don't know as i was using the same IP address to access the console before. Any help will be much appreciated :) , Thanks in Advance

Hey all, my on Prem Data Gateway connects to Office 365 via 443(no inspection), but after few minutes it looses connection. The issue is definitely the forti. With a direct uplink the connection is persistent. How can i debug? What kind of trace can i perform to find the issue? Any direct ideas? Thanks and best regards

Hello, do you know why the path for the update from version 6.4.13 to 7.0.14 is not shown?I have a 300E device and I need to update to version 7.0.14 but when I enter the following link to see the update path https://docs.fortinet.com/upgrade-tool/fortigate I cannot find the version  

HelloI have FortiAP 220B/221B at v5.2.7 build0265, which I know is very old.I need some info but I can't find documentation on it.What is the last firmware version that was released for this AP?How can I find the upgrade path for this AP from v5.2.7 to its latest firmware version?

Hello fellows! In a FGT-61F I created a local DNS service for domain "local.tld" with some A records in it.All clients using the fgt as their primary DNS server and can resolve all hosts in "local.tld" with their FQDN.Fine. Now I want to use this working FQDN resolution for some firewall policies, so I added some addresses.When I try to use the same FQDN for an address object, fgt says "Unresolved FQDN: host.local.tld". What am I doing wrong? Any suggestions? Working on FGT-61F with FortiOS 7.2.6. Any help welcome. Thank you in advance! Regards, Michael.

Hello, Is it possible to block the change of the expiry time of a guest account? For example, I set 4 hours and the administrator who creates the account cannot change this or no longer than 4 hours. How can this be done? Zaq

I am trying to see the commands in CLI to display the network interfaces configured for the fortiportal but the show commands donot work.I am using the Fortiportal 7.2.2.Is there a specific command to see the configuration?

I have two LAN networks: the first one is 192.168.1.0/24, and the second one is 10.0.0.0/24. Each LAN is directly connected to a FortiGate firewall. I have set up a site-to-site VPN using two FortiGate virtual machines running version 7.2.0. The VPN configuration was done using the wizard.However, when I try to ping a host in the other subnet (for example, from 192.168.1.1 to 10.0.0.2), I don't receive any response. The ping requests seem to be unsuccessful.I researched this issue and discovered that it might be related to the black hole route created by the VPN wizard template. If anyone has experienced this problem before, I would appreciate any suggestions or solutions for resolving it. If anyone has knowledge of how to fix this, please provide guidance.

Hi all, I am able to connect to a Fortinet VPN server from Windows 10 using Fortinet Client v6.0.9.0277. My configuration is displayed in the following 2 pictures: But, from linux mint, using strongswan I am unable to connect. Here is my configuration: # ipsec.conf - strongSwan IPsec configuration file conn FortinetVPN keyexchange=ikev1 aggressive=yes authby=secret left=%defaultroute leftauth=psk leftid=My_User_name right=VPN_IP_HERE rightauth=psk rightid=%any rightsubnet=0.0.0.0/0 ike=aes256-sha256-modp1536,aes128-sha1-modp1536! esp=aes256-sha1-modp1536,aes128-sha1-modp1536! dpdaction=clear dpddelay=30s dpdtimeout=150s ikelifetime=86400s lifetime=43200s keylife=43200s rekeymargin=3m keyingtries=1 auto=add type=tunnel replay_window=32 mobike=no forceencaps=yes   #ipsec.secrets My_User_name : PSK "My_Preshared_key" My_User_name : XAUTH "My_Password" &nb

Hello family! I am asked to enhance a Fortimail VM with recommended features located in the dashboard for Fortimail 7.4( and believe me, I do not understand MOST of the features in Fortimail - as someone said in a  video, features are TOO vast/plenty):1. Policy (Access control, ip policy, recipient policy etc)2. Profile (session, antispam, antivirus, content, replacement message, resource, auth, ldap, dictionary, security, ip pool, group, notification)3. Security(url filter, quarantine, greylist etc)4. Encryption ( IBE etc)5. Log & Report Could I kindly get a set template/industry standard for a good Fortimail Deployment( a step by step guide) so that i can use on my fortimail? I know many admins have their options tweaked to their environment, but I will use anyone's recommended options, take time tweak mine accordingly.I already know my LAN/WAN net configs. The only thing i would do is just use my IP details, replacing what e

Hi Guys,   Is it possible to directly integrate the on-premise FortiGate with SSL VPN use case to my Microsoft Authenticator to be my 2FA mechanism? Or, should I use a RADIUS server like FortiAuthenticator where the FortiAuthenticator will be the integration point of my FGT, AD, and Microsoft Authenticator? Thank you.   Thanks