Solved

Can i upgrade my fortiAnalyzer 300G from version 6.4.13 to version 7.2.xx? i dont see any upgrade path to 7.2.xx.

Hi All, my Fortigate 900D, After one power outage is not working any more, but power led is bright. When I plugged the console cable into the computer, it sent logs continuously without stopping. Could you please tell me what's wrong with this? handle it.Thank you guys.-> this is a log that the Fortigate sends continuously....Buffer I/O error on device sda3, logical block 2525481Buffer I/O error on device sda3, logical block 2525482Buffer I/O error on device sda3, logical block 2525483Buffer I/O error on device sda3, logical block 2525484Buffer I/O error on device sda3, logical block 2525485Buffer I/O error on device sda3, logical block 2525486Buffer I/O error on device sda3, logical block 2525487ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0ata1.00: irq_stat 0x40000001ata1.00: cmd ca/00:08:01:8b:36/00:00:00:00:00/e0 tag 0 dma 4096 outres 51/40:00:01:8b:36/00:00:00:00:00/e0 Emask 0x9 (media error)end_request: I/O error, dev sda, sector 3574529Buffer I/O error on device sd

hi,i got a FW policy which includes blocking ISDB address group/objects, i.e. botnet, cnc, phishing, spam, etc.the FW policy install from FGM failed after i tried 3x times. FW01 (16) $ set internet-service-name "Blockchain-Crypto.Mining.Pool" "Botnet-C&C.Server" "Malicious-Malicious.Server" "Phishing-Phishing.Server" "Spam-Spamming.Server" "Tor-Relay.Node" "VPN-Anonymous.VPN"entry not found in datasourcevalue parse error before 'VPN-Anonymous.VPN'Command fail. Return code -3FW01 (16) $ nextMust set internet service, internet service group, dynamicnetwork service, custom internet service or custom internet service group for destination.object check operator error, -56, discard the setting per checking forticloud, the fortiguard service/feature entitlement are down/red. my questions are:1.do you need a valid warrantly/entitilment for ISDB to work?2.do you need to have a count under the 'number of entries' for the ISDB IP reputation DB.3.does 1 and 2 above need to be working

Hey guys, I'm facing an issue that I'm not sure if is my mistake or what, I hope you can give me an hand on this.So I'm installing a new FG with version 7.2.6 using fortimanager and I'm getting a error that I didn't saw last time we installed a FG (was in version 7.0.x) also using fortimanager.We use address objects and groups for the RFC1918 and now with it seems that we can't have the 0.0.0.0-9.255.255.255 range anymore since the FG says that "start-ip can not be 0", well sure let's change the address object, but I can't because "Could not change assigned objs"...Well that object is part of a group, and that group is being used, but if I try to remove the group from the address object nothing happens, I mean, the group is still there.I changed the IP on the global ADOM but didn't help.So I'm left with a catch 22.Can someone tell me what I'm doing wrong here? EDIT: I forgot to mention that the address object is a global one, that's why I though updating the global one would

Hello Fortinet Community!I have implemented in the past policys to allow my servers and VMs to reach microsoft and AVs(bitdefender) servers for update only. Recently the Internet Service Policy stopped working. The VMs wont update. Any ideas? Have the Internet Service Database stopped working?Is there a correct order for them to be adjusted?Is there a default internet service required in all policys to be able to reach the required destination?  Thanks in advance

Hi Everyone,Is there any way to limit users to only be able to Login Authentication using the Chrome browser?My device is FortiGate 80F and Firmware v7.4.1 build2463 Many Thanks! 

Hi everyone,   Here is my use case :   I set up a Hub'n Spoke topology with Hub in azure and physical appliance in offices. In one of theses office, we share Internet acces with tenants.   So, I activate multi-vdom on this Fortigate but, I'm stuck on how to configure Internet acces, how to set up this FGW as a spoke.   At this time everything is in the root VDOM. I want to set up a VDOM for my Company and a VDOM for tenants. Tenants only need to access Internet. And Of course My company need to access Internal ressource throgh Hub'n Spoke topology.       So my questions are : - Where should be may hub'n Spoke logic (Tunnels and SDWan rules) in Root or MyCompany VDOM? - How do I share Internet access (VDOM Link, VLAN on NPU Vdom Link assigned to each VDOM)? - What are the best practices for this scenario.   PS.: FortiOS is 7.0.13   Thanks for your help, Frederic.

Hi all,couldn't find any information about the change of the order of the rules inside a route-map. I know that for firewall rules or sdwan rules, you have unique identifiers forevery logic, and you can move them up or down through the GUI or via CLI ('move x before|after y'). But can I do something similar with route-maps ? For example suppose I have the following: config router route-mapedit "RM_EXAMPLE" config rule  edit 10   set match-community "CL_32:3"  next  edit 100  next  edit 5   set action deny   set match-ip-address "PL_DENY_PREFIX"  nextendnext Something not nice: in this case the identifier of the rule is important, and is related to the order the rules are executed. So even though '5' appears after '100', it is processed first. Suppose now I have rules '1' and '2', and I want to insert something in between. Is there any simple way to do it ? in Cisco there is a 'resequence' command that

Hello, Can someone confirm if we build a new VM in Azure, and choose BYOL, can we then use a license from our existing FortiFlex licensing? Or can it only be a traditional license?

We are utilising the FSSO Agent to identify the logged in users and match them to traffic. In the traffic logs we have one user that seems to be matching to multiple IP addresses that are in different geographic locations. What's also interesting is the MAC that's showing is a Cisco router. The related device seems to be appearing in the fabric topology.I have no idea how it's relating the device and user.I'm only fairly new on Fortigates so a bit perplexed..Any thoughts?

Hi, I'm trying to determine whether FortiLink traffic can be sent out-of-band/over separate interfaces to my other traffic. I'm working on the topology below and would essentially like to send regular traffic and FortiLink traffic across different links. Is this possible?  

I is configuring site to site vpn.I no want to use wizard.I have to add in ALL the remote subnets in static route 1 by 1.Is it possible to have: REMOTE SUBNET -> next hop of virtual interfaceinstead of add subnet 1 by 1 for each rule

Hi   I’m testing the Sandbox integration with FortiOS7.2.6, but when I set it to “suspicious file Only”, no files are linked to the Sandbox at all. I’m having trouble because even when I use the test file provided at the following URL by Fortiguard lab, it is not linked to the Sandbox. https://www.fortiguard.com/sample-files Do you have any advice on how to test this? Also, is there anyone else with the same symptoms?    

Dear All,         I have downloaded FAZ_VM64-v7.4.1-build2308-FORTINET.out.ovf from the portal, and when i deployed on esxi and powered on, and its ask to enter password, i though this password is ask for new password i will be using, but its look like not, just wonder where i can obtain this password ? any help would be appreicated  keith   

hi,can't seem to aggregate port1 and port2 in a FG-201F.i already factory reset the device.i don't see port1 and port2 listed/available for the new aggregate interface (po1).ports1-4 are patched to our cisco switch and they're green/up. FW01 # config system interfaceFW01 (interface) # edit "po1"new entry 'po1' addedFW01 (po1) # set vdom "root"FW01 (po1) # set type aggregateFW01 (po1) # set member "port1" "port2"node_check_object fail! for interface-name port1value parse error before 'port1'Command fail. Return code -651 FW01 (po1) # set memberinterface-name Physical interface name.ha interfaceport17 interfaceport18 interfaceport19 interfaceport20 interfaceport21 interfaceport22 interfaceport23 interfaceport24 interfacex1 interfacex2 interfacex3 interfacex4 interface FW01 # show system interfacename Name.ha static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable physical disablel2t.root static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable tunnel disablelan static 0.0.0.0 0.0.0.0 1

Hi all,    I hope you're well.    I have a question surrounding importing previous configurations from an existing FortiGate to a new device. For example, if I have a FortiGate already configured with FortiLink and a number of managed FortiSwitches is it possible to import the switch-controller/FortiLink configuration from this device and have it apply to the new switches once they're connected and authorized on the new FortiGate?    I already have a configuration of a deployed network and rather than build the new devices from scratch if there is a way to import this and make the required changes for the new devices this would be much faster and efficient.    Not sure if this is possible or not, if anyone has any tips or tricks regarding this it would be greatly appreciated.    Regards,  Dan_Eng52

Hi, Having a little difficulty with this, I have a FortiAP plugged into a CISCO 3750, port is trunked with native VLAN 50 , LLDP is enabled. Cisco is connected to another Cisco 9K , vlan 50 trunked and LLDP enabled there also. Fortigate (7.0.14) has a Layer 3 Aggregate inteface connected to the Cisco 9K, no issues there. In order to get the AP MGMT, I created an SVI 50, with DHCP etc, and put it behind the Agg Layer 3, this is where I think there is a problem, I allow ALL traffic for now, but the AP will not come online, simply says "no LLDP neighbours found" if I do "diagnose lldprx neighhour" you can see the Cisco 9K, and the Cisco 9K can see the 3750 as an LLDP neighbour, so not sure why the AP cannot get to the SVI on the Fortigate, I did notice on the SVI you cannot set "recieve LLDP" or "Transmit LLDP" the option isnt there.. I have enabled security fabric, you can see the AP MAC on the cisco switches on VLAN 152..any suggestions where I have made a silly mistake??

Hello, I connect to the VPN with the command below usually and it works fine but when I am disconnected because for example connection problems and the last connection persisted on the server and server allows have only one connection at time I am not able to use the same way how to connect. Why? Because displayed popup: You already have an open SSL VPN connection. Opening multiple connections is not permitted. Do you want to proceed and disconnect your other connection? is displayed for like second and immediately is hidden. Command log: ```$ /opt/forticlient/forticlient-cli vpn connect MyVPNNameConnect VPN: MyVPNNameStatus: Connecting...=====================Authentication Required---------------------An email message containing a Token Code will be sent to <luxxx.xxxxxxx@xxxxxxx.cz> in a moment.=====================FortiToken:=====================Confirmation Required---------------------You already have an open SSL VPN connection. Opening multiple conn

Hi, I have set up a Ipsec VPN Site to Site between a 40F and a 40C via Internet. I have enable the NAT Translation in both side. But, I have added a static route on the 40F to route the traffic tag with the subnet where is the 40C behind a router.I don't know why I have to do that. regards.

Is there any recommended OS Version for Fortiauthenticator? Thanks

 Hi,After successfully installing the wrong version, I uninstalled it and downloaded the required FortiClient VPN 7.2.3, which seems to fail to install. The install wizard rolls back every time it gets close to finish. My colleague has it installed so it cannot be firewalled nor security block. After several attempts including deleting  FortiNet resedue files from RegEditor, clearing old cache, restating laptop - I have only received the message below.Would be great to know if you have any idea how to pass that please. Thank you. Thal.    

I am running some tests trying to connect a client workstation to another client that sits behind my Fortigate. The trouble is, the Fortigate connects out to the internet via an existing firewall (edge). Therefore the Fortigate is receiving a Private IP from the edge firewall on it's WAN interface. I have proven that I can establish a VPN connection to WANs private IP when connecting the client to the LAN of the edge firewall but now I want to prove that I can create a VPN connection from anywhere in the world. When I enter the public IP address of the edge firewall into Forticlient, I get an error saying VPN down. What must I do to be able to connect from a client in a different location over the internet, through the edge router, into the fortigate and to the "accessible LAN"?

Dear all, For my upcoming wifi project I have to use azure entra as authentication server while I will using the fortigate fw and forti AP. Does anyone knows what feature or/and license are need for the forti ?  Thanks in advance

Hello, I'm wordering if I setup a client with best pratice. Three months ago I setup an SDWAN with two IPSec VPN on Fortigate with another vendor (Forcepoint), It works well as far as I know. (We did some faiolver tests). Forcepoint do support active/aclive VPN (all route is active at same time on FIB), so I just think "that is possible". Today someone told me "There is no SDWAN within different vendor".  Someone here did this type of deployment before? 

Thanks for the help!When firewall receives traffic, it will match the firewall policy by Source_interfaces/Protocol/Source_Address/Destination_Address. I'd like to know why destination interface or outgoing interface is NOT used in policy matching? and if so, why it is to be specified when creating a firewall policy,  is it used for NAT or something other than policy lookup?Thanks again.