Solved

We have had a few issues with connections to FortiGuard. Recently we had to revert to default HTTPS/443 communication, after the UDP/53 we used as a workaround for previous issues became broken for unknown reason.    We have now activated the 'Allow websites when a rating error occurs' option, and would like to add the FortiGuard status of all of our FGT's in our monitoring tool. I can't seem to find any related OID though, does somebody have suggestions how to tackle this?   (ticket ongoing concerning the issue with TAC, but I'm not very confident in a permanent solution)

Hi guys I'm experiencing this kind of issue with FortiSIEM agent on Windows 2022 Server, the agent is not able to send logs related to Sysmon or any other kind of logs, even with different windows agent template associations.When SNMP is configured to send info, the Supervisor is able to show this on performance and analytic real-time dashboards, but when the filter is like "Event type  NOT CONTAIN PH", I can't see any logs, is supposed to be the event, system events, etc... The CMDB show the server with agent status "Running active", the method "snmp, agent, ping", so no connectivity problem here. How can I get some tips to solve this??  Thank you!

HiI installed Forti-Analyzer VM64. When I attempt to login with: admin and no password, the message is "Authentication failure. Please try again..."When I registered virtual machine I set private IP address, is it wrong? Does it need Public IP Address? Thank youMarco 

Hi, I want to know if it is possible to bypass VPN when you are in internal network without using public IP addresses as reference because we have multiple branches using different public IP addresses.

Hi Everyone, I am being tested at work for my networking skills with a huge lab and I dont have any experience in firewalls, I have a ccna routing and switching only and I am being asked to design a 2 site network(site one> fortigate, core switch and access switch, site 2 is a single switch). I think I found a (Second) mistake in the lab(the first was an IP that made no sense and I found in like 15 min of looking). The scenario is that we have a snmp server in our server subnet that is getting attacked and I must block the relevant ports, I only have one fw policy that allows anything from the internet at all that isnt a vpn client(really its 2 because of a redundant backup ISP connect but doesnt affect this), this uses 2 a virtual ips I have for a webserver in a dmz. Internal users and the webserver have internet access. There are no other allowed policies from either internet port, just the ones from the isp to the webserver dmz. Does the implicit deny already cover this attack?&n

Hi, I have been working on a demo project and am trying to configure IPS on my fortigate. I had to turn the feature on and I can configure a fw policy with the profiles. I am very new to firewalls and I have not placed the ips sensors on all the correct policies. I want to modify those policies but when i go into them they no longer have options to change the security stuff(av, webfiltering, ips, ect) do I have to delete the rule and recreate it every time or is there a way to edit? 

Hello! As an MSP we wish to manage the firmware and maintenance for our Fortigates from the Cloud in a central portal.I know there is a way to manage the Fortigates through a VM with a license but we do not wish to setup infrastructure for it. We are looking for a Cloud service so we probably need to have the correct licenses for the Fortigates. I've read about the FortiManager Cloud, but does anyone have some good information about what we need?Like FortiManager licensing or FortiCare per firewall? Many thanks! Best regards,Tim

Hey guys, sorry if this has been answered before, I searched the forums and couldn’t find my case. I’m about to purchase a used fortigate 61e for a very atractive price. The owner is willing to transfer account to me. Current subscription expired in june 2023. My question is whether I can purchase a new subscription now? Would I have to pay for the gap  of 8 months?

Is there an archive with older VM images?In the support -> VM Images the oldest images that are available for download are:7.0.136.4.14 Is there an official or unofficial place where older VM images can be downloaded?

I've reserved specific IP addresses for our company machines based on their MAC addresses in FortiGate's Network > Interfaces > LAN > DHCP > Advanced > Reservations. However, these reserved entries aren't showing up in the DHCP Monitor tool.Key Points:Reservations made for company machines (not smartphones)Machines have connectivity from PC and Server via LANReservations confirmed in LAN DHCP settingsPC reservation on LAN visible in DHCP MonitorSmartphone reservation on Wi-Fi visible in DHCP MonitorWhy are reserved IPs for company machines not showing up in the FortiGate DHCP Monitor? Any suggestions for troubleshooting? Does it even matter when they have connectivity? What does it mean?I appreciate any insights and assistance you can offer. Thank you in advance for your time and expertise!Sincerely,

Is it possible to add wildcards when creating a web rating override? Im trying to make new categories for easier administration of some requirements but I cant add a wildcard when setting a domain for a rating override, for example if I were to try to block amazon.com without a wildcard other sites like amazon.co.uk or amazon.co.jp will still load. Is it only possible to add wildcards on the url filter section? If its only possible here then can I make categories on the url filter so I can groups different filters like you can do on the web rating override? Thanks

Hello, I havent seen such weird behavior on FGT before. I have S2S VPN with another location where there is some Local network - all is working good with s2s, but the problem is with local asset. After sometime one of IP is unreachable.Debug commands says:.."id=20085 trace_id=161 func=init_ip_session_common line=6043 msg="allocate a new session-00bf3a66, tun_id=0.0.0.0"id=20085 trace_id=161 func=vf_ip_route_input_common line=2611 msg="find a route: flag=80000000 gw-10.0.201.2 via root".."id=20085 trace_id=161 func=fw_local_in_handler line=500 msg="iprope_in_check() check failed on policy 0, drop" I do have enabled "snat-route-change enable" - for SDWanI dont know why there is some problem with routing, where all is done as I used to do it regarding IPsec. Ive notice it after upgrade to 7.0.13(Mature)Ive got a temporary workaround, I must flush iprobe routing with "diagnose firewall iprope flush".Can someone point out what the hack? :)

I am curious about the status value of "diagnose sys ha dump-by group". "diagnose sys ha dump-by group"state/o/chg_time=3(waiting)/2(working)/1706239048I understand status and chg_time.What does "/o/" mean?FortiGate 

Hello team,   I configured snmp. I enabled snmp in the management interface, after which I went under "System > SNMP" and configured as follows:   When test with snmpwalk command via cli from my monitoring system, Fortigate side capture this traffic:     it is as if the fortigate is not responding to snmp traffic. Maybe some policy is missing? Thanks for the support   BR

Currently, it looks like the unit (3001F on 7.2.6) will use a different seed or other value when outputting configuration in a 'show' or 'show full-configuration'. This makes it different to watch for changes/etc. if tracking the configuration in an external system. Is there any way to get a consistent seed/encryption so that they aren't different values on every invocation? I'm open to retrieving the configuration using some other mechanism/api endpoint/etc. if needed.

When I enter the auxiliary-session command on the fortigate 50e device, it does not work. I would like to know if the auxiliary-session command is not set on the fortigate 50e device or if it is a version issue.

Hi all, I'min the process of replacing hardware for a customer. Right now their netwerk is based on Aruba CX switches (see diagram below), the have 2 core switches opering VSX with MCLAG to the access switch layer. The access switches are Aruba CX6200 stacks with lik 3/4/5 switches network closet.The Aruba switches are stacked and have an LACP trunk o the MCLAG on the core switches. The customer  recently switched their firewall to a Fortigate cluster and they are considering replacing their swithing network to Fortinet as well. So far I have found a decent replacement for the core switch but for access layer switches I can't quit grasp the concepts that fortnet is using. From what I understood so far is that I should use MCLAG on the access switches as well. If there are more than 2 switches in a network closet, how would include these in this network?Should I just create a ring network and have Spanning-tree take care of the loop?Are there other alternatives to co

Hi Experts, In FrotiSOAR (FSR version 7.2.2) GUI, in System Health Dashboard, under the "Playbook Execution Monitoring", I see Queued Workflows and Active Workflows. The Active Workflows count remains quite high above 200K and Queued Workflows count ascends up when I perform any bulk operation. It goes up to 400 to 450 and comes back to 0 when Bulk operation is finished.  I just want to know what are the typical values for these parameters in a mid sized enterprise environment, and can we see these workflows running, through CLI (if possible)?  BR,MBF #FortiSOAR

Hi All,Our conference sites are starting to look into upgrading older equipment and move towards new, modern, protocols for audio and video. We actually just got 4x 1024E & 2x 1048E with 100G backbone to replace the core switches in one location.In this location, they have Meyer Sound equipoment that use AVNU's Milan/AVB protocols, and they say the switched need special - certified - support for this.I can't seem to find details for this for FortiSwitches, can anyone help with information about this?IEEE 802.1BA-2011 – Audio Video BridgingIEEE 802.1Q-2014 – Bridge and Bridged NetworksIEEE 802.1AS-2011 – Timing and Synchronization for Time Sensitive ApplicationsIEEE 1722-2016 – Transport Protocol for Time-Sensitive Applications in Bridged Local Area NetworksIEEE 1722.1-2021 – Device Discovery, Connection Management, and Control Protocol for IEEE 1722(TM) Based DevicesHope we don't need to buy Netgear.. ;) 

Hi there,I have updated the Fortigate 101F to version 7.4.X. Since then there have been problems with the homeoffice access points FAP-C24JE.Whenever the routers get a new WAN IP, all devices on the LAN ports of the APs are offline or cannot connect to the Internet or the Fortigate.The AP is displayed as online in the FGT and the WLAN clients can also connect and are online.It seems as if the AP has forgotten the configuration for the LAN ports.After restarting the AP, everything works again.

Hi All, We are setting up a new Virtual FortiGate for use as WLC, and I have enabled Advanced Wireless Features. 1: The GUI in FG 7.0.n - 7.4.2 has a time-display bug:When running on 24-h system, editing a schedule still show time as 12-h am/pm input in the schedule editor.Time shown in Schedule List: Time shown in Editor: Time shown in CLI, when editing Schedules there, is in 24h format..  2: Time Schedules does not seem to manage the FortiAP LED's?First off: The schedule seems to control when the LED's are ON - right?Second: When I enable LED Enable and set a schedule, it seems that the LED's does not turn on/off within the minute of the time set. If I set a schedule, that turn off the LED's, they turn off instantly, same if I remove the schedule so the LED's turn on.When the schedule then hit the target time to tunr on/off the LED's, it's not happening.. at least not within the same minute..So, to understand this:Is this schedule pushed to the AP's

Hi!   I have got a fairly simple question, the situation is as following.   We have two core server/network-rooms inside the same building. Each room has a FortiGate Firewall and a MikroTik or HPE core-switch. Between these two switches we ran a 10Gbit fiber.   Can I setup HA (Active/Passive) on a Fortigate 70F or 80F over a VLAN between these two sever/network-rooms over the core-switches instead of directly interconnecting the heartbeat interfaces?   The last thing we want is issues like a split brain. How stable is a solution like this?   Best regards, Tim   

Hey All Has anyone come across the issues with pushing templates to the latest firmware. Looks like there are settings required in the new up date (7.4.2) but are not set on the Forti manager   Copy device global objects Post vdom failed: error dot quic- inspect:-999 - invalid value - prop[quic]: binary option(inspect) Copy objects for vdom root This make sense that it is to do with the ssl profile but cannot find what setting it is pointing too

Hi,     I am new to the fortigae 100F. I am trying to setup my laptop to access the internet. My issue is that from my laptop, i can ping 8.8.8.8 but i cannot surf any of the webpage.    Does anyone have any idea what could be the most possible issue?     Secondly, i discovered this firewall rule that cannot be deleted. Will this rule does anything?    Really hope someone can enlighten me, Thanks 

Hi Guys I've a problems with vDOM on FortiGate 60E 1. I did not see Virtual Domain option in System Operation Settings" section but I can enable vDOM on CLI.    I tried to enable on CLI with the command below, it's not working. config system global set edit-vdom-prompt enable end 2. I did not see vDOM type option (Admin and traffic), how can I enable it?3. I got a message when I try to enable it. FortiWiFi (settings) # set vdom-type adminadmin type cannot be set on the FortiWiFi.node_check_object fail! for vdom-type admin value parse error before 'admin'Command fail. Return code -651