Solved

Hello, we just changed our FG81 cluster (because of the prof_admin problem). The first 81E resetted, loading config file and it is up and running (7.4.3). The second I did the same but I have problems. The status LED is fixed, it is not blinking. I hace access via Console and access via web is strange, suddenly I loose contact, etc.  Is there a hardware issue? What can i do? Thanks

Hello, does anyone know how to unhook clients with a bad signal from the fortiap since I have clients that connect from areas that do not have good coverage

Hi, I have configured pool with pool member, used default http monitor, but I see the pool member availability is "init", it's in this state for more than 20 minutes, anyone knows the reason for this? Thanks

Hi, we have a HA config where sometime ago we backup them up with the wrong prof-admin. So now we dont have any super_admin accounts and the FGs have 7.4.3 so no maintainer option, right? I was thinking of changing the cnfig file, restore a new master config with super_admin instead of prof_admin in the admin accounts and change slave to master, reset master and set up new HA. Now I found out that I cant execute factoryreset, I connected via console and I guess again admin rights. What can I do? Thanks

HelloI have two questions regarding FortiSIEM 6.7 content update.Which ports are used by FSM to download content updates from FortiGuard (can't find it on admin guide)Any advice when it connects to FortiGuard behind a proxy?

In continuation with my last posts,I have configured the second ip address on port2 of the Fortiportal and Port2 has been enabled.I have also configured another static route to the gateway of the VLAN of the IP address being assigned to port2.The Fortiportal has two static routes now one for port1 device and second for port2 device. I can ping the gateway for the VLAN ip address on port2 from the fortiportal.For some reason, I cannot ping the fortportal secondary ip from my pc or another network device and hence not the GUI as well on the secondary ip.Is there a service that I have to enable for the port2 ip address so that I can access the GUI through the secondary IP as well?I am trying to have two IP address on two VLANs so that it can be accessed by two teams

HelloI'm hesitating between FortiWeb 7.4.2 and 7.2.8 in a new production environment.The 7.2.8 seems much more mature as it has an high patch number, while I see some very interesting new features on 7.4.2.On both release notes I can see only 1 or 2 known issues, which is so few that I feel the known issues section is not up to date.My concern is to have a stable and bug free appliance, so if someone has 7.4.2 in production your advice would be appreciated. Also if only some features are not so stable thanks to mention them.

do i need to enable FMG-Access on my fortigate interface is i do not have forti manager in my environment ?is it good practice to enable FMG-Access ?

We configured notifications for Firewall policy expiry alerts.The alerts are operating well.The issue is that we are receiving notifications from both the primary and secondary firewalls.Please supply the necessary "Kb" so that we can receive notifications from the primary firewall only. #FortiOSv7.2.7 build1577 (Mature) 

Good morning friends, I have created a report in the fortianalyzer about which countries access or try to access my publications that I have created in the firewall.In the report I have noticed the following information (image):  When you say "reserved" what does it mean?Reviewing the logs, I see that the source IP is the private IP of my LAN network (users) and that the signature has LOW criticality with the signature "traceroute" and others have the signature "IP.LAND". It is worth mentioning that the IPS profile detects it. Do you recommend blocking the IP.LAND signature?

Hi Fortinet Community! I've been researching around but figured I'd drop a quick post here to see what others think. Working on implementing FortiSwitches into an environment with an existing FortiGate. To be clear, the current switches are not FortiSwitches. Layer 3 is handled by the FortiGate, and there are several VLAN sub interfaces on say the internal1 port. It looks like for this implementation, we will need to use FortiSwitch VLANs, which are bound to the FortiLink interface. It seems like we will need to recreate the existing VLANs as FortiSwitch VLANs to utilize them in the WiFi & Switch Controller in the FortiGate as if we create them as-is I believe VLANs and subnets will conflict. I've found some clever ways to speed this process up by exporting a config backup, modifying the interface lines, and restoring. Either way this seems like it'll be intrusive and was hoping to see if anyone in the community had experience with an implementation such as this.&nbs

Hi, does anyone know if possible, to put multiple /32 IP in system proxy arp in Fortigate? I been searching for inputs but most of the time the guide only put one IP in system proxy-arp? Is it possible to have multiple IP or not? Hope someone can guide me here!

Hi all, When using the Virus Total connector action "Get Analysis Details", the execution output shows the API request is 'queued'. Does anyone have any experience building in steps to keep checking when the status becomes complete?Using google.ca just as a test in the screenshot. Thanks in advance, Nelson

Hello, I have two firewalls Fortigate model 60E in HA.I have 2 tokens each, 4 tokens in total.I would like to know if I can use all 4 tokens I read to do this I have to delete the tokens on secondary FW, and then reimport them on the primary, in this way I can see all my 4 tokens on primary firewall, is it right? Thank you!

I am running fortigate vm in AWS ver 7.2.4.  I am starting to look at setting up client VPNs for our users.  After reading the documentation I noticed we could do this in 2 phases.  Phase 1 move all existing users to forticlient VPN.  Phase 2 move the users to ZTNA. While going through the SSL-VPN Settings on the Fortigate I see the message "For increased security, scalability, and flexibility, use ZTNA or IPsec VPN as an alternative to SSL-VPN tunnel modes."  So does that mean I should be doing IPsec VPNs for normal users rather then using the old SSL-VPN?  Are there any gotchas if I do Client IPsec VPN when the fortigate is running in AWS?

Hi everyone, I got a issue since yesterday on my FAZ : i cannot connect to webGUI anymore. When I try to connect to https://192.168.1.16 I get an ERR_CONNECTION_REFUSED in any web browser on any computer. It was working earlier. I did not make any changes on the interfaces. Rebooting the FAZ has no effect. No host filtering on the interface or on admin account. SSH and PING keep on going on. allowaccess is set on https, ping, ssh, snmp, webservice and fgfm. Where could the problem be spotted ?

For my FortiCloud subscriptions (FAZ, FMG, Sandbox, EMS) - Our compliance team needs documentation that our data is kept in US datacenters only. How is this handled and is there any documentation that proves it ?  Thanks, Don

I have a Fortinac Guest network. I want the Citizenship number from the user in the guest network. There is an API where I can query this number. I want to include the user's name and surname in the network when it matches the citizenship number. how can I do this?  

Greetings, I have users on a internal network with Internet access blocked. We have MS Office installed on their workstations and I authorized them on a different vlan *with* internet access. (They're the per-machine perpetual licenses that ship with Dells, so should be fine forever offline.) After replacing a juniper with a fortigate when the no-internet users launch Word or Excel it hangs for roughly 26 seconds and then starts normally. Before installing the fortigate this didn't happen. When I make a rule for these machines that gives them access to the internet the problem goes away, so I'm fairly convinced the problem has to do with Word/Excel phoning home and some kind of keep-alive or time-out issue. The migration was fairly painless and this is one of the only quirks that have come up. Any advice on how to solve this without putting these machines on the Internet?

HelloI wonder why FortiGate's active portal is somehow not as active as FortiNAC's active portal.In FortiNAC when you are isolated there is always a popup message in OS and in browser telling you that there is an active portal and asking you to click to authenticate.However in FortiGate when you enable active portal there is no popup message in OS neither in browser, and you need to open the browser and access some site in order to get activate the active portal.If someone successfully managed to make it more proactive thanks to share.

Hi, is there a way to disable nat on ipv6 when using combined policies (ipv4 & ipv6).There is only 1 checkbox to enable/disable nat. This implies to both ipv4 & ipv6.For ipv6 of course you don't want nat. Fortios is 7.4.3 thx

Hi All,There is a FortiGate 60E.I set up MFA the way shown on the screenshot.   The drawback of this method is that it requires FortiToken Mobile.It means if I'm not available nobody can access the router.Is it possible to set up MFA for admin access in some other way that wouldn't be linked to someone mobile device?  

Working on some FortiOS firmware upgrades and have come to reckon with the FortiAP and FortiSwitch compatibility. I am running a FortiGate-100F and trying to upgrade to FortiOS 7.x, but the FortiAP's I'm running areFortiAP-221E and FortiAP-222E.I looked at the FortiAP compatibility matrix , but it does not list the 221E or the 222E that I'm using.Currently the FortiAP's are running 6.4, so based on what I see in the matrix I should be safe to upgrade the FortiGate.

Hello Everyone Our customer has a FortiGate network that only contains 1 FortiGate FG-200E firewall. Now they want to purchased another FG-200E firewall and make an HA build.  But to reduce failure points, we are thinking if we don't need Switches for this HA build. Then I'm wondering, is it possible to enable HA for two FortiGate firewalls without any switches and hosts under two firewalls can all work fine? For example, like below topology. VLAN 101 was there on both FortiGate firewalls with private IP address 10.1.1.1/24. This VLAN is used to connect with each other and to the hosts under them. Then, when the Secondary FortiGate works in Spare mode, will its LAN ports in the same VLAN still be functioning as a L2 switch and make Server 2 be able to access Internet via Primary FortiGate? Thanks a lot.

 FYI:Seems like the latest FortAP release has put ModelName in the SystemName LLDP object, so in a switch you get a lot of 'FortiAP-NNN' names, not the actual hostname of the AP's:Port:     SystemName: The Cisco AP still active on the switch, correctly shows the hostname.Earlier FortiAP's listed the System Name corretly, but currently I can't downgrade any AP's, so can't verify at what version it 'broke'. TAC: 9287117