Solved

Hi everyone,   Here is my use case :   I set up a Hub'n Spoke topology with Hub in azure and physical appliance in offices. In one of theses office, we share Internet acces with tenants.   So, I activate multi-vdom on this Fortigate but, I'm stuck on how to configure Internet acces, how to set up this FGW as a spoke.   At this time everything is in the root VDOM. I want to set up a VDOM for my Company and a VDOM for tenants. Tenants only need to access Internet. And Of course My company need to access Internal ressource throgh Hub'n Spoke topology.       So my questions are : - Where should be may hub'n Spoke logic (Tunnels and SDWan rules) in Root or MyCompany VDOM? - How do I share Internet access (VDOM Link, VLAN on NPU Vdom Link assigned to each VDOM)? - What are the best practices for this scenario.   PS.: FortiOS is 7.0.13   Thanks for your help, Frederic.

Hi all,couldn't find any information about the change of the order of the rules inside a route-map. I know that for firewall rules or sdwan rules, you have unique identifiers forevery logic, and you can move them up or down through the GUI or via CLI ('move x before|after y'). But can I do something similar with route-maps ? For example suppose I have the following: config router route-mapedit "RM_EXAMPLE" config rule  edit 10   set match-community "CL_32:3"  next  edit 100  next  edit 5   set action deny   set match-ip-address "PL_DENY_PREFIX"  nextendnext Something not nice: in this case the identifier of the rule is important, and is related to the order the rules are executed. So even though '5' appears after '100', it is processed first. Suppose now I have rules '1' and '2', and I want to insert something in between. Is there any simple way to do it ? in Cisco there is a 'resequence' command that

Hello, Can someone confirm if we build a new VM in Azure, and choose BYOL, can we then use a license from our existing FortiFlex licensing? Or can it only be a traditional license?

We are utilising the FSSO Agent to identify the logged in users and match them to traffic. In the traffic logs we have one user that seems to be matching to multiple IP addresses that are in different geographic locations. What's also interesting is the MAC that's showing is a Cisco router. The related device seems to be appearing in the fabric topology.I have no idea how it's relating the device and user.I'm only fairly new on Fortigates so a bit perplexed..Any thoughts?

Hi, I'm trying to determine whether FortiLink traffic can be sent out-of-band/over separate interfaces to my other traffic. I'm working on the topology below and would essentially like to send regular traffic and FortiLink traffic across different links. Is this possible?  

I is configuring site to site vpn.I no want to use wizard.I have to add in ALL the remote subnets in static route 1 by 1.Is it possible to have: REMOTE SUBNET -> next hop of virtual interfaceinstead of add subnet 1 by 1 for each rule

Hi   I’m testing the Sandbox integration with FortiOS7.2.6, but when I set it to “suspicious file Only”, no files are linked to the Sandbox at all. I’m having trouble because even when I use the test file provided at the following URL by Fortiguard lab, it is not linked to the Sandbox. https://www.fortiguard.com/sample-files Do you have any advice on how to test this? Also, is there anyone else with the same symptoms?    

Dear All,         I have downloaded FAZ_VM64-v7.4.1-build2308-FORTINET.out.ovf from the portal, and when i deployed on esxi and powered on, and its ask to enter password, i though this password is ask for new password i will be using, but its look like not, just wonder where i can obtain this password ? any help would be appreicated  keith   

hi,can't seem to aggregate port1 and port2 in a FG-201F.i already factory reset the device.i don't see port1 and port2 listed/available for the new aggregate interface (po1).ports1-4 are patched to our cisco switch and they're green/up. FW01 # config system interfaceFW01 (interface) # edit "po1"new entry 'po1' addedFW01 (po1) # set vdom "root"FW01 (po1) # set type aggregateFW01 (po1) # set member "port1" "port2"node_check_object fail! for interface-name port1value parse error before 'port1'Command fail. Return code -651 FW01 (po1) # set memberinterface-name Physical interface name.ha interfaceport17 interfaceport18 interfaceport19 interfaceport20 interfaceport21 interfaceport22 interfaceport23 interfaceport24 interfacex1 interfacex2 interfacex3 interfacex4 interface FW01 # show system interfacename Name.ha static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable physical disablel2t.root static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable tunnel disablelan static 0.0.0.0 0.0.0.0 1

Hi all,    I hope you're well.    I have a question surrounding importing previous configurations from an existing FortiGate to a new device. For example, if I have a FortiGate already configured with FortiLink and a number of managed FortiSwitches is it possible to import the switch-controller/FortiLink configuration from this device and have it apply to the new switches once they're connected and authorized on the new FortiGate?    I already have a configuration of a deployed network and rather than build the new devices from scratch if there is a way to import this and make the required changes for the new devices this would be much faster and efficient.    Not sure if this is possible or not, if anyone has any tips or tricks regarding this it would be greatly appreciated.    Regards,  Dan_Eng52

Hi, Having a little difficulty with this, I have a FortiAP plugged into a CISCO 3750, port is trunked with native VLAN 50 , LLDP is enabled. Cisco is connected to another Cisco 9K , vlan 50 trunked and LLDP enabled there also. Fortigate (7.0.14) has a Layer 3 Aggregate inteface connected to the Cisco 9K, no issues there. In order to get the AP MGMT, I created an SVI 50, with DHCP etc, and put it behind the Agg Layer 3, this is where I think there is a problem, I allow ALL traffic for now, but the AP will not come online, simply says "no LLDP neighbours found" if I do "diagnose lldprx neighhour" you can see the Cisco 9K, and the Cisco 9K can see the 3750 as an LLDP neighbour, so not sure why the AP cannot get to the SVI on the Fortigate, I did notice on the SVI you cannot set "recieve LLDP" or "Transmit LLDP" the option isnt there.. I have enabled security fabric, you can see the AP MAC on the cisco switches on VLAN 152..any suggestions where I have made a silly mistake??

Hello, I connect to the VPN with the command below usually and it works fine but when I am disconnected because for example connection problems and the last connection persisted on the server and server allows have only one connection at time I am not able to use the same way how to connect. Why? Because displayed popup: You already have an open SSL VPN connection. Opening multiple connections is not permitted. Do you want to proceed and disconnect your other connection? is displayed for like second and immediately is hidden. Command log: ```$ /opt/forticlient/forticlient-cli vpn connect MyVPNNameConnect VPN: MyVPNNameStatus: Connecting...=====================Authentication Required---------------------An email message containing a Token Code will be sent to <luxxx.xxxxxxx@xxxxxxx.cz> in a moment.=====================FortiToken:=====================Confirmation Required---------------------You already have an open SSL VPN connection. Opening multiple conn

Hi, I have set up a Ipsec VPN Site to Site between a 40F and a 40C via Internet. I have enable the NAT Translation in both side. But, I have added a static route on the 40F to route the traffic tag with the subnet where is the 40C behind a router.I don't know why I have to do that. regards.

Is there any recommended OS Version for Fortiauthenticator? Thanks

 Hi,After successfully installing the wrong version, I uninstalled it and downloaded the required FortiClient VPN 7.2.3, which seems to fail to install. The install wizard rolls back every time it gets close to finish. My colleague has it installed so it cannot be firewalled nor security block. After several attempts including deleting  FortiNet resedue files from RegEditor, clearing old cache, restating laptop - I have only received the message below.Would be great to know if you have any idea how to pass that please. Thank you. Thal.    

I am running some tests trying to connect a client workstation to another client that sits behind my Fortigate. The trouble is, the Fortigate connects out to the internet via an existing firewall (edge). Therefore the Fortigate is receiving a Private IP from the edge firewall on it's WAN interface. I have proven that I can establish a VPN connection to WANs private IP when connecting the client to the LAN of the edge firewall but now I want to prove that I can create a VPN connection from anywhere in the world. When I enter the public IP address of the edge firewall into Forticlient, I get an error saying VPN down. What must I do to be able to connect from a client in a different location over the internet, through the edge router, into the fortigate and to the "accessible LAN"?

Dear all, For my upcoming wifi project I have to use azure entra as authentication server while I will using the fortigate fw and forti AP. Does anyone knows what feature or/and license are need for the forti ?  Thanks in advance

Hello, I'm wordering if I setup a client with best pratice. Three months ago I setup an SDWAN with two IPSec VPN on Fortigate with another vendor (Forcepoint), It works well as far as I know. (We did some faiolver tests). Forcepoint do support active/aclive VPN (all route is active at same time on FIB), so I just think "that is possible". Today someone told me "There is no SDWAN within different vendor".  Someone here did this type of deployment before? 

Thanks for the help!When firewall receives traffic, it will match the firewall policy by Source_interfaces/Protocol/Source_Address/Destination_Address. I'd like to know why destination interface or outgoing interface is NOT used in policy matching? and if so, why it is to be specified when creating a firewall policy,  is it used for NAT or something other than policy lookup?Thanks again.

Hello team, I wanted to know what is the best method to manage fqdn to be blacklisted. Basically, is it better to use an ad hoc web filter profile or to create fqnd groups with wildcards?My goal is to block specific fqdn for everyone globally. Thanks for the supportBR

Hi Community Member, We have cisco Iron Port on cloud and Fortisiem on prem there is not connectivity between them. How can we get logs from Iron port.

i have one laptop with VPN connection issue.after connecting to SSLVPN, the user will lose Internet connection.What i realize is that on the Ethernet settings for the SSL virtual connection ip address is 169.254.x.x instead of our usual ip address range 172.15.x.x. once i disconnect forticlient, the Internet connection resume.I tested forticlient 7.0.8 and 7.2.6. both version have the same error.removed and re-installed forticlient also do not work.

My company has an R&D facility in one of the southern US "desert" states. The facility is 20 minutes outside of the nearest town and any significant Wifi interference sources, yet we started experiencing poor Wifi performance. I've been troubleshooting and cannot identify the root cause. Let me explain our configuration. We have 2 FortiAP-432F outdoor AP's, the first is the ROOT AP, it is mounted to a post on the side of the office trailer and connected to the main switch. The other AP is the LEAF AP, and it is mounted on a telephone pole across the site near some other trailers. It is connected in a MESH configuration with the ROOT AP. I am using the 2.4 GHz channel as the backhaul, and the 5 GHz channel for the devices. We have three Wifi networks, corporate, guest, and the MESH network. the MESH network is assigned to the 2.4 GHz radio, and the corp and guest networks are assigned to the 5GHz radio. The channels and power are set to auto.  The firewall sees both APs an

Hi, I'm relatively new to FortSwitch and come from Cisco land - so please forgive my ignorance in advance :smiling_face_with_smiling_eyes:   We’re looking into purchasing some Fortinet switches and have a requirement to send traffic in different VLANs across separate physical links. My question is, would it be possible to create different trunks and then isolate specific VLANs to specific trunks?   For example, VLANs 10 and 20 on Trunk 1 only, while VLANs 30 and 40 would be allowed over Trunk 2 only.   For some additional context, the switches would likely be managed using FortiOS via FortiLink as our existing firewalls are FortiGates. We’d also be looking to include access and distribution level switches in the architecture.   Thanks!

Hello everyone,   I am new to the forum and Fortinet in general, so bare with me if this is an obvious mistake.   On a Fortigate firewall with updated firmware I have configured two WAN interfaces to work with SD-WAN rules that leave WAN1 as the main one and WAN2 as backup. This works fine.   However, I want to be able to ping WAN2 and redirect some of it's ports to internal clients, which is only working if WAN1 is down or if I switch the priorities around (otherwise the WAN2 ports are closed from the outside). I tried disabling all the port redirection policies and only try ping and ssh, but the problem persists.   The only relevant post I found is this unsolved one. Looking at the answers, I checked my default routes and I have two with destination 0.0.0.0, both of them with "Gateway Address" corresponding to the correct one of their interfaces (WAN1 and WAN2). Is this correct? Or should I have one with Interface as SD-WAN? What else should I check?   Thanks