Solved

Hi guys, I am trying to configure the automatic tftp backup on our new 100F Forti. I followed a guide how to do the configuration but according to the syslog the process always gets somehow stopped and deleted by the autoscript. When I execute the command manual the backup works. We have two VDOMs, root for MGMT and 1 for production traffic. The configuration is done in the global level (I also tried with adding config global in the cli script).Anyone has an idea where the issue can be? I am absolute cluesless :\ The Eventlogs I have says:1. Automation stitch triggeredstitch:backup-stitch is triggered.2. Autoscript stop automaticallyscript autod.6 stopped automatically3. Autoscript delete resultUser delete the result of script autod.6 from autod The Config looks like this: Trigger:config system automation-triggeredit "TFTP-Daily-Backup"set description ''set trigger-type scheduledset trigger-frequency dailyset trigger-hour 16set trigger-minute 54nextAction:edit "backup-ac

There is no drop down menu. no choices.When I try "unhandled" or "open", won't kick off. 

Hello,i want to change some things on our guest wifi.Currently i am using the Guest Management on my FortiGate with Random User and PW. I would like to have one AD-User for all Guests. So they all log in with the same credentials.They should also accept an Agreement and type in there Email. I found the replacement messages and tried to combine "Login Page" and "Email Collection". I don't know if that really works because i don't know where the adresses are getting stored. Does anyone know where the email adresses getting stored? Or if that is even possible.Should look like this: (Short explanation why i want to use one AD-User: i want to display the credentials (PW changes every day) on screens for the guests)Currently the guest wifi is just an interface on my FW and configured there.

Dear Community support, I've had a custom avatar image a while (think, I've set this two-three years ago) and tried to update it recently. But my finger was too fast, so I got one of the "community avatars" now.Now, my question is: How can set a custom image? Following the FAQ, this seems a little bit outdated:https://community.fortinet.com/t5/help/faqpage/title/images_changeiconThe gallery is now called "photos" and uploading a public photo does not enable an additional tab in the settings area. Is this simply not possible anymore or am I missing something? Thanks,Christian

My Fortigate environment for wifi guest user is a external authentication portal by FortiAuthentication; i replace the Fortinet certicate SSL with my own CA ( Sectigo ) to avoid warning certificate from browser.The workflow begin with the external page of FortiAth " https://fac.xxzxzxzxx.YY/portal"; authentication is processed by Fortiauth but the browser goes redirect at internal page in this url "10.12.0.1:1000/fortiauth.... " without also the HTTPS form... This is the IP internal interface of Fortigate for the specific SSID. The browser warning that it's insecure because it's not in HTTPS and show the warning to trasmit the credential in a non secure channel...How do I avoid this warning and continue the protected session?

Brand new to Fortinac. Discovered several hundred infrastructure devices. Need to change the CLI (ssh) creds Fortinac uses to connect to these devices. Looking for a way to do this in bulk from the GUI vs. changing every device individually. Any help is appreciated.

Community,I have the following configured on the fortigate Service, Object configurations. s-udp-1433      Custom Service    TCP/0:0, UDP/1433 What does TCP/0:0 mean in this case? Regards, Willem K.

Hi everyone, I'm having an issue with my Fortigate FG 60E. It hasn't updated to the latest firmware and is currently on version 7.2.6. When I check the 'latest' section under fabric management firmware update, it indicates that the firmware is up to date. However, if I select 'all updates,' it shows that versions 7.4.0, 7.4.1, and 7.4.2 are available. Should I manually update from 7.2.6 to 7.4.2, or is it better to wait until these updates appear under 'latest'?

Hello, I´ve configured an LDAP Server, Connectivitiy test is successful (Windows2022 Srv) Also I created a UserGroup with the LDAP Server and chosen the desired Group from LDAP I cannot figure out how to login with an account which is member of the group Domain\Username username@domain does not work. Password is known, Account is not locked in AD. Any help is appreciated!  

I have a site-to-site link between two offices and I need to force one VLAN from site A to use site B as it's gateway for internet access. Currently the site-to-site link allows for devices from either network (including other VLANs) to communicate with each other, but they use their home firewall for internet access. I need this one site A VLAN to go out site B's firewall for internet access. 

Hi Support Forum! Could you please provide me on more information about this bug in 7.0.13 When configuring an 802.3ad aggregate interface with a 1 Gbps speed, the port's LED light is off and traffic cannot pass through. We have configured 802.3ad 1 Gbit Interfaces and i am afraid to update the Fortigate. Or is it okay to make an update without interruptions.  BR

Hi all,I would like to configure  ACL for FortiGate and FortiManager connection. The devices are deployed in a closed network and FortiManager is acting as Local FDS FortiGuard server.For licensing update , FortiGate will get update from FortiManager. As per the document , we need to allow TCP/443 and TCP/8890 for FortiGuard override service. I'm confused what incoming and outing ports means by the document FortiGate to FortiManager ( Is it incoming port?)FortiManager to FortiGate ( Is it Outgoing port?) https://docs.fortinet.com/document/fortimanager/7.2.0/fortimanager-ports/465971/incoming-ports As per the document , TCP 8890 need to allow for incoming ports . Does that means  from FortiGate to FortiManager IP?Or is it 443 and 8890 need to allow for both direction  : FG > FMG and FMG > FG ? Please help me, thank you

Hi, I am new to using Fortigate and looking to update the source IP for local out routing\system DNS but the manual option is greyed out. It is on latest firmware. We have few more exact model firewalls but no issues. ,

Hey everyone! I have a site-to-site VPN between two locations. Is there a way I can pass only one IP address through for remote browsing. For example, I have a subnet of 10.0.0.0/24 on FW A that can access all internal resources on FW B (example subnet of 10.1.1.0/24). I have one workstation (10.0.0.50) on FW A that would need to access the internet through FW B. The rest of the network would still access the internet through FW A. I tried using this KB https://community.fortinet.com/t5/FortiGate/Technical-Tip-Remote-browsing-over-IPSec-VPN-tunnel/ta-p/190719 but am unable to get what I need to work. Any help with this would be greatly appreciated!

Hi Forum! Is in Version 7.0.13 also this Problem?Solved: Re: Fortios 7.0.x memory leak? - Page 2 - Fortinet Community Could you give me an answer on this problem. BRValentin

I'm using Fortinac-F version 7.2. We have the following problem. When I install the agent on a machine in the domain, we can see it as active in the management interface. But when I install it on a machine outside the domain, the agent appears as deactive even though it is properly installed, what could be the reason for this?

Hello, I am trying from an external script in python to create an indicator in FortiSOAR 7.4.2, and I am bit stuck on how to define the indicator type which is basically a picklist.How would I formulate in the payload the reference to the item in the picklist? So far, I have tried the following payloads (and various variations) unsuccessfully; it looks like the API call tries to create (in some cases successfully) both the indicator but also a new IndicatorType (if I omit the uuid)payload = {"typeofindicator": "Domain","value": indicator_value,"recordTags" : [ "mytag" ],"description" : ioc_descr,"lastSeen" : lastseen,"firstseen" : firstseen,"expiryDate" : expirydate} payload = {"typeofindicator": {"itemValue" : "Domain","listName": "/api/3/picklist_names/50ee5bfa-e18f-49ba-8af9-dcca25b0f9c0","uuid" : "5a5a7d42-be27-4903-858a-19909ebfa1eb"},"value": indicator_value,"recordTags" : [ "mytag" ],"description" : ioc_descr,"lastSeen" : lastseen,"firstseen" : firstseen,"expiryDa

Hello guys, I'm new here.I have a doubt about default value for hb-lost-threshold, from experience I notice that virtual FortiOS has 20 and physical ones 6, but I don't find any documentation about that difference.I compared the values of some clients that I manage, but I need an official document to support me in making a change recommendation on cluster hosted on Azure. I'm confused because even the Admin and CLI Guide in the same FortiOS version 7.2.5 diverge about the default values, informing 20 and 6, respectively.Admin Guide on page 2346CLI Guide on page 1255Can anyone clarify or have any documentation on this?Roni MatosFCSS - Network Security

Hi   Currently, all interface vlans are on cisco 3750 switch and I want to move all interface vlans to fortigate. I have created all sub-interfaces on fortigate but do not know how to move them all to fortigate. Also what should i do about switches vlan ? All access switches's default gateway is the interface vlan on 3750.

Hello. I'm inquiring because I found something strange while setting up the product.The model is 101f.I test in IDS mode  (license retention) , I used 4 sfp ports and set up 4 spins.But the power (state) LED doesn't turn on. The product UI all works normally!! The version 7.2.6. I tested the LED with HQIP and the LED turns on normally. When it reboots, it turns off again.Is this a bug? Or does it turn off when it's IDS mode operation? This version also has bugs where HA LED doesn't turn on (randomly).Does the LED work differently depending on the license?

Hello to you I want to set my WAN port to be accessible for the firewall management interface, so that I can access the firewall with its external address, but only from a specific external address. How can I do this?I thought using acl but the rule there only says to block and not to open to a specific address Thank you

Hello, what is the best way to search all ADOMs in FortiManager for a particular device e.g. you have a Fortigate's serial number, but no idea of what ADOM it belongs to ?is there any way apart from changing system settings to enable global search ?

FortiToken Mobile Push (ftm-push) is no longer working after updating from Forticlient 7.0.7 to 7.2.  We are in an all Windows 11 22H2 environment.   When connecting to an SSL VPN, the FortiToken Mobile approval request appears on the phone, but after approving the connection from the phone, the client just stays at the “A FortiToken code is required for SSL-VPN login authentication” prompt.   Oddly enough, after approving the request from the phone, if you then click on Cancel to cancel the connection attempt in FortiClient itself, you get a VPN Connection failed message, BUT it then connects successfully right after.   Because the client thinks it failed, after disconnecting from the VPN, it clears the username and password.   Alternatively, instead of using the ftm-push approval you can manually enter the FortiToken code when prompted and all works as normal.   Additionally, the mobile push authentication does work correctly if using the connect to VPN

I have been trying to create a local IPSec VPN connection (no connection through internet) as my previous attempts at getting it to work over the internet have not worked. I wanted to prove first that i can get it working without introducing the complexities of opening up ports on my edge firewall or contacting my ISP to troubleshoot. I configured the VPN to use Internal2 (port 2) as a WAN interface and i have connected an (offline, Windows Firewalls off) Windows machine (A) to this port with FC (FortiClient) installed. Having followed this video FortiGate Remote Access IPsec VPN (youtube.com) to create the IPSec tunnel, I tried to initiate a VPN connection to the Fortigate with no joy. I can ping the IP address i have given to internal2 from the machine A to prove connection. I have checked that both Phase 1 and 2 of the VPN config match on FW (version 7.4.1) and FC agent (version 7.2.2.0864).   I installed Wireshark on machine A and can see the pings appearing in the w

Hello team, anyone help me resolve this issue i have loaded the VM license but it can not be validated  FGVM01TM24000015 # get system statusVersion: FortiFirewall-VM64-KVM v7.2.6,build1575,230926 (GA.F)Security Level: 1Serial-Number: FGVM00UNLICENSEDLicense Status: No LicenseLicense Expiration Date: 2024-03-04VM Resources: 1 CPU/0 allowed, 985 MB RAM/0 MB allowedLog hard disk: Not availableHostname: FGVM01TM24000015Private Encryption: DisableOperation Mode: NATCurrent virtual domain: rootMax number of virtual domains: 10Virtual domains status: 1 in NAT mode, 0 in TP modeVirtual domain configuration: disableFIPS-CC mode: disableCurrent HA mode: standaloneBranch point: 1575Release Version Information: GAFortiOS x86-64: YesSystem time: Wed Jan 3 23:45:17 2024Last reboot reason: power cycle