Solved

I am seeing this "Critical (Collector Buffer greater than 50MB)" on my Forticollector. Can this be resolved by increasing the buffer size and is there a formula for sizing it correctly?

Hello Fortinet experts, We have established a site-to-site VPN between Fortigate(7.0.12) and AWS, where the client runs on AWS and the server is located on the other end of the VPN (on-premise). client ip: 10.12.140.86 or 10.12.124.160server ip: 10.60.98.100 listen on port 8080fortigate port1 ip: 10.60.97.10 Fortigate interface:Fortigate routing table:  FGVM04 # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default Routing table for VRF=0 S* 0.0.0.0/0 [10/0] via 10.60.97.1, port1, [1/0] S 10.12.0.0/16 [10/0] via aws-vpn-1 tunnel 52.11.17.158, [1/2] [10/0] via aws-vpn-2 tunnel 52.43.39.105, [1/2] ... C

When looking at the forward traffic logs (for incoming connections), I see that some sources are from "known malicious sites" when I hover over the source IP. But when I add the column "source reputation", it's always empty. I'd like to ad some reputation filtering, but it would be nice to be able to see the reputation for each log line first, without having to hover over each line. Is there a way to show the source reputation in the table?  

Hi, I have a Fortigate 200F with FortiTokens initially assigned to RADIUS account for VPN MFA authentication.We had to rebuild our Active Directory and would like to assigned the Fortitokens to new RADIUS accounts in the new Active Directory.However the Fortitokens in the Fortigate 200F show with the "Assigned" status as they are linked with the old (and now inexistant) RADIUS accounts.How can I make the Fortitokens available again so that I can assigned them to new RADIUS accounts?Thank you in advance for your advice. 

Today I configured a FGT200E with an IPsec VPN with a PFsense. For the first time I used the DH32 (elliptic curve) in phase 1 (AES256, SHA256). no PFS in phase 2. Do you think we have problems with slow communication? If so, which protocols might it affect?Thank you.Regards.Marco SpadaW3 - Italy

Hi, We will onboard 850 users to FortiSASE, I know that we can import CSV file of email addresses to send link in bulk. Just want to ask if there is a way to install FortiClient in bulk, aside from manual installation.  Thanks,JL

I have removed two physical interfaces (internal2 and internal3) from the internal interface. I gave internal2 192.168.10.1/24 and internal3 192.168.20.1/24. I connected a device to port 2 and gave it the IP address 192.168.10.10/24. I plugged another device into internal3 and gave it 192.168.20.10. I made sure each device could ping it's own gateway .1 address. I then tried to ping the opposite IP gateway which as expected did not work. I then created a firewall policy called 10 to 20, Inc int: internal2, Out int: internal3, source: all, destination: all, service: all. Action: accept. Apart from disabling NAT and setting the logging to All Sessions (which doesn't seem to be logging anything by the way, but that's a separate issue) everything else was left as default. Yet I can't seem to ping one device from another. I can't even ping the opposite gateway. What am I doing wrong?

Hello, is it possible to configure a FortiAP with the RadSec protocol?I have only seen RadSec in the FortiGate config menu.

hello team, i have a question about phase 2 selector IPsec.It's possible use public ip on phase 2 remote subnet? And how configure it? thanksbr  

I have a WPA2 Enterprise network. Fortinac connects to the network by authenticating the user from the active directory with radius. But I want to make this role based. I want those in role A to get IP from vlan A and those in role B to get IP from vlan B. How can I do it?

I'm having the hardest time getting my getting my 40F Fortigate connected to IPv6. I am fairly versed in networking and Fortigate (two years now) but not having luck here.   So I have the Interface set to DHCP and its COX Communications.  I have obtained an IPv6 IP address and two IPv6 DNS servers.   For my LAN interface I'm using SLAAC, using fd00:6565::/64 as my prefix and all my devices have an IPv6 address. I even have enabled the DHCPv6 Server to give out my DNSv6 server addresses but mostly I use my DNSv4 which works also.  And I have Central NAT enabled. BUT I am just confused how to acquire delegated IPv6 addresses and how to pair them to my SLAAC IPv6 addresses in my devices. Should I be using a different addressing mode????  MANUAL allows you to set "Auto configure IPv6 address"Or "DELEGATED" mode.  I don't know my "prefix hint" I spend HOUR and HOURS trying to get setup info from COX, even pay for extra te

I attempted upgrading my 6.0.7 virtual fortiauthenticator server to 6.4.9 last night with no success. It simply hung when it reached the "Migrate Encoding - upgrading encoding of database fac to UTF8 succeeded portion" I waited roughly 45 minutes with no movement. I ended up shutting the server down and reverting to my snapshot. I also tried version 6.4.0 and 6.3.4 to see if there were any differences and they all simply hung as well. Anyone run into this type of issue that can shed any light on what to look for when this occurs so I can attempt this again during non production hours? Thanks in advance!!

In our FortiManager and FortiAnalyzer we have some weird behavior with the UI elements.Some hitboxed have a hitbox over the button. So we cant use these button without fiddling around with F12-DevMode. This happend on all browsers (Chrome, Edge, Firefox and even iExplorer) and on Phone and Desktop. Is there something im missing to fix this or need i to create a new VirtualAppliance for the FAZ and FMG? 

Can I delete or de-register the FortiCloud account from the Fortigate unit, so I can re-register with the same account.if possible how? and can a factory reset delete a Forticloud account?

Dear Community, I tried creating a new module and after creating and adding the module to the navigation pane in the application editor, I am not able to see the created module on the left-hand sidebar of the FortiSOAR windows to navigate across modules in the system.Please can anyone let me know if there is any additional step I am missing?Thanks

During a recent VAPT security scanning, TCP port 514 was flagged out to be have weak SSL cert.The recommendation was to get a propert SSL certificate for the appliance.Can we disable port 514 on the Analyzer ?my firmware version is 6.4.10. will upgrade to version 7.2 soon. Contact the Certificate Authority to have the certificate reissued.Purchase or generate a proper certificate for this service.

Hi Team, I currently have a FortiSIEM version 7.0.2, but I can’t find any official documentation stating that it supports log collection for TrendMicro VisionOne. However, I can see from the FortiSIEM External Systems Configuration Guide (7.1.1) that FortiSIEM does support TrendMicro VisionOne. In light of this, I would like to know whether it is necessary for me to upgrade my FortiSIEM from version 7.0.2 to 7.1.1 or a higher version in order to collect logs from TrendMicro Vision? Or, in fact, can version 7.0.2 support TrendMicro VisionOne as long as I obtain the normalization configuration file?"Regards,Bruce Liu#Fortisiem #VisionOne #TrendMicro

Following issue shows a wrong connection to Fortiguard-log server, password is correct and worked properly with another Fortigate device, diagnose log is activate but I can't connect to Forticloud:  FORTI-40F # execute fortiguard-log login xxxMAILxxx xxxPWDxxx2024-03-13 12:52:46 [643] fds_https_stop_server: 173.243.143.6:4432024-03-13 12:52:46 [205] __ssl_data_ctx_free: Done2024-03-13 12:52:46 [1047] ssl_free: Done2024-03-13 12:52:46 [197] __ssl_cert_ctx_free: Done2024-03-13 12:52:46 [1057] ssl_ctx_free: Done2024-03-13 12:52:46 [1038] ssl_disconnect: Shutdown2024-03-13 12:52:46 [554] fds_https_timeout: Connection timed out, svr=Forticlient-svr2024-03-13 12:52:46 [246] fds_svr_default_on_error: Forticlient-svr: ip=173.243.143.6:443, reason=42024-03-13 12:52:46 [263] fds_svr_default_on_error: Forticlient-svr: Conn failes 1/22024-03-13 12:52:46 [145] fds_svr_default_pickup_server: Forticlient-svr: [2620:101:9000:143:173:243:143:6]:443Failed: FGT internal error(-1)Command fail. R

Hello, we are trying to deploy fortiweb-image docker image according following instructions: https://docs.fortinet.com/document/fortiweb-private-cloud/6.4.0/fortiweb-vm-on-docker/794267/deploying-fortiweb-vm-on-docker and our container is running but with no web server/GUI accessible and getting following error on docker logs:System is started!!!Program (sysinit) exitCaused by receive signal(9) can you please advise how overcome this error and expose the fortiweb GUI?  adding some info:1. docker image built and run as follows: (per above documentation instructions)cd ~/fwb/image-docker-64docker build -t fortiweb-image .cd script/./docker-fwb.sh -i fortiweb-image -n fortiweb-docker -e ChangeMe123 -g 7180 -m 81. we selected 7180 port for our testing for http server 2. docker psCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES4075ec69f969 fortiweb-image "/bin/docker_init" 3 minutes ago Up 3 minutes 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp,

Hi,I've deployed a Fortinet Nextgen Firewall in AWS. Initially, the WAN interface IP is set to a local IP within the public subnet. However, when I attempt to change it to the actual public IP, I lose connection to the firewall entirely. As a result, I can no longer access it via HTTPS or SSH. Can anyone assist me in resolving this issue? My objective is to utilize the static public IP assigned by AWS for the WAN interface.Thanks

Hello, I noticed that my 60F 's Status LED not being "On"  after upgrade FortiOS to 7.2.8M.It was on while the FW is on 7.0.14MWhile the LED is off, everything seems working as expected.I am not sure if it is because of the design/feature change, or if it is a BUG?Anyone else faced the same issue? Thanks 

I'm seeking guidance on consolidating multiple policies into a single policy on my FortiGate device. Specifically, I have a scenario where I have numerous VLAN interfaces (approximately 100) under a single physical interface. Instead of creating individual policies for each VLAN interface, I'm interested in exploring the possibility of configuring a single policy that covers all VLAN interfaces associated with the physical interface.

Right now we have the inbound to our on premises Exchange server (hybrid - no mailboxes) set to 'All'. I need to use the ISD(s) to restrict to only MS. I have a Fortigate 100F with version 7. Anyone know which ones to use? 

We have a number of FGT devices running on 7.0.14 and all part of FortiManager, with the basic configurations being pretty much the same. One of those configurations is to setup AD users as admins based on LDAP. This process works great for all but 1 of our devices that's out in the field. I tested my "useradmin" account via the LDAP configuration page and got a return of successful. I am in our fw_admins group, which is assigned in the Administrators list for the FGT. However, when I try to login via the GUI with that same username and password, it tells me that my user cannot be found. I can test it all day via the LDAP settings or via CLI, and it consistently tells me that it's successful in hitting the LDAP server and authenticating me. It's just trying to login as an admin where it fails. I can log into any of the other 90 devices we have with that same username/password to admin them with zero issues, it's just the one. We are connected to that site via MPLS and/or VPN

I have the Fortigate VM in AWS and I am trying to setup Single Sign On connected to ADFS for my VPN users.  I am very new to ADFS.  The setup requires you to put in the SP info and then the IdP info.  I am very new to the whole ADFS thing but still in other places on the fortigate I have only had to setup the IdP pointing at my ADFS server and things worked fine.  Why is it asking for the SP too and who is the SP in this case?