Solved

Hi team,   I am developing some playbooks, which then will be useful when showing the solution to potential customers.   Firstlly I´ve created a playbook that calls https://icanhazdadjoke.com/api (RestFull API) and then shows the result joke to the customer.    Now, I am trying to modify the playbook to call the above API call X times (the variable X is configured inside the playbook). For each execution the API call returns a string (the joke). So, my purpose in this second test is to present to the cusromer X jokes together, like the following: "joke 1"+"\n"+joke 2"+"\n"+....+joke X"   The two playbooks are similar. The first one calls the API call just once.  The second playbook call the API many times (variable X) and return the outputs together (append or join could be used).   Could you help me on how to create loops (like the "for" or while commands in C), execute a code inside the loop and then show the results? Is there any example

Hello, I am new to the community but I really like Fortinet, could you please help me, I have 2 Fortiswitches, a 424E and a 448E, I would like to create an aggregation port to increase the bandwidth, I know I can do it with LAGBut I would like to understand the LACP mode, if what I want is an aggregation interface, which mode should I use? Static, active or passive?I tried static mode on both sides and the interfaces do not go up.The manual indicates Active on one side and Passive on the other side, but I would like to understand why? or better understand the modes of LACP.

Hi All,  Having some issues building SD-WAN in Eve-NG, or at least I think it's built correctly but traffic isn't routing, is anyone aware if there is an issue with Forti, SD-WAN and Eve? I can see hit counts in the SD-WAN rules section, but I'm getting a timeout on pings from my VPC. Pictures of the build below: - Thanks, Rich 

I have a problem getting a WAN connection through VIP to a virtual server (with Roundrobin).The virtual server works internally.If I point the VIP to one of the servers in the Virtual server it works.The policy for the Virtual server also includes the wan interface as the source. Could it be a flow/proxy base thing? 

Hi,I have a problem with the GeoIP block message after updating from 6.3 to 7.0.When GeoIP blocking is enabled in an inline web protection profile, FortiWeb just reset the connections instead of displaying a block message page related to Geo IP blocking!!!Does anybody know how we could handle this?Thanks.

Hi allI'm looking for a twinax cable to connect a fortigatte 600e with a Nexus 5672UP and, because is already planned to change the Nexus with a HP J9822A , if is it possible reuse this cable also for this ssecond kind of connection or I will have to buy a new one.   

Hi all, when I try to add a firmware template to a FG80F the Fortimanager Cloud returns me the following error: "[-9001] invalid template assignment - conflicting template assignment scope: device FG-BENIARJO, vdom root, firmware template object [(null)] and [Template_Upgrade_Beniarjo]" (attached screenshot). As you can see the template has no device assigned.  The FG does not have any firmware or provisioning template configured. On the other hand, another FG with the same characteristics, and being the template a clone, I have not had any problem. Any ideas? Best regards!

Good evening!   I've created the following policy to scan web traffic (test setup):   config firewall policyedit 2set name "Trust:Webzugriff"set uuid a7a53264-XXXXXXXXXXXXXXXXset srcintf "internal2"set dstintf "wan1"set action acceptset srcaddr "Trust address"set dstaddr "all"set schedule "always"set service "HTTPS" "PING" "HTTP"set utm-status enableset ssl-ssh-profile "certificate-inspection"set av-profile "AV-Web"set webfilter-profile "block some & monitor-all"set dnsfilter-profile "default"set file-filter-profile "default"set ips-sensor "all_default"set application-list "block-high-risk"set logtraffic allset nat enablenextend   The webfilter profile is configured to warn on specific categories. This works fine. Surfing to a corresponding web page triggers the webfilter. The Fortigate "warning-page" is shown. However, while the log says the web filter was triggered, the warning page says "FortiGuard Intrusion Prevention - Access Blocked". May be a cosmetic issue. &

Hello,   We purchased 200 mobile Fortitokens and I'm wondering if there is an alternative method instead of assigning them one by one manually. Any help would be well appreciated.   Thanks in advance!

Hi Support,I need to access my internal server machine through RDP with External pubic IP address . i created Virtual IP pool by selecting interface as my primary wan and mapped Internal machine IP with the external IP address and i enable port forwarding and map the port with TCP and in Port mapping type i selected one to one and i entered external server port to 3389 and map to IPv4 port to 3389.In Firewall Policy i selected incoming interface as SDWAN which i mention as Virtual WAN link and outgoing interface as my lan and source i selected all and destination as my internal server IP and server all and disabled the Nat and enabled this policy.now i cant able to connect remote desktop with my external IP address( public IP) can anyone help me

Dear support,I'm seeking guidance regarding my current network setup and the configuration required to enable internet access using the ISP-provided LAN IP pool (1.1.2.2/29 subnet) via our Fortinet firewall.Currently, our Fortinet firewall's WAN interface is configured with the WAN IP pool address (1.1.1.1/30), and it's functioning seamlessly. However, we now aim to utilize the ISP-provided LAN IP pool (1.1.2.2/29) to enable internet connectivity using IP addresses within this subnet.Any detailed instructions or guidelines you could provide regarding these configurations would be immensely helpful in achieving this setup.

Hello, what if admin from the same country that apply geoblocking?Will that be a problem?

Hi guys, i'm new user using fortigate, I want to know if we implement fortigate on transparent mode, what limitation we can get ?or any documentation so i can read before i implement fortigate transparent mode. Appreciate your feedback,Thank you.#Fortigate #Transparent Mode

Hello, Can someone help me to configure dhcp server on windows server for ssl vpn clients. I have fortigate 100f with version 7.2.5 which I configured according to the instructions https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-with-external-DHCP-Server/ta-p/215644When configured for vlan everything is easy and works fine. For ssl vpn clients where there is no default gateway the configuration looks different. On wireshark you can see that when trying to connect vpn request to dhcp server is sent. However, the connection does not happen because the client does not receive an ip address. Do you know how the configuration should look like on the dhcp server side of the windows server ?

Hello there,I have a question about applying a golden template for our customers. Our company (we are a MSP) has multiple customers who are switching to FortiGate firewalls. I was thinking, is it perhaps possible to create a template that we can apply/upload to all the new FortiGates? After that we specify the settings to the customer ofcourse, but is a base template (for settings that are the same for all of our customers) possible to create? Thanks in advance!

When I'm trying to download Forticlient VPN linux version (.deb), it's returning this message for me when I click the Linux .deb download button: 

Hello everyone, I'm trying to delete a certificate that I misplaced but I don't know how to do it. The delete button is not available on the options, only import, view or Download. I have a certificate that expired yesterday and the point was to replace it for the new one. When I try to reload it, appears the following message: "Certificate file is duplicate for CA/LOCAL/REMOTE/CRL cert.". I'm running the fw 6.4.5 @ 60F units. Thank you

Hello all Members.I would like to say hello for all .I'm starting my adventure with Forti Switches  and need some tips or example how to make configuration.My case is: like below. I need to create/configure additional pair of fiber switches connected by ICL-MCLAG and directly connected to stack of switches which are connected to FortiGate's. I already created one pair which is working fine but when I want to activate ICL-MCLAG between switch on top and red rectangle, both are going offline and only factory reset for both help. I found article about three-tier MCLAG config https://community.fortinet.com/t5/FortiGate/Technical-Tip-Three-tier-MCLAG-configuration-on-managed/ta-p/195452 but the question is, how to configure on the same level the second pair.Already prepared config switch auto-isl-port-groupfor this new pair but exist one is without this config. Is it possible to create new group and setup member ports for already connected and configured pair withou

I couldn't find any article clearly saying either "not possible" or "how to do it" online so far. But most of our FortiToken Mobile users who tried migrating from an old phone to a new phone told me a migration didn't work. So we always reactivate a token again.Recently one iPhone user who tried to migrate to a new iPhone told me the migration itself worked and she could use the 6-digit token code to get connected from the new phone. However, she never be able to get a push-notification. I found one discussion at Stackoverflow saying it involves a certificate and the "transfer" option at the app doesn't transfer it. But again, I couldn't find any from FTNT backing up the claim. Is it possible transfering FTM app w/ assigned tokens to a new phone with ability to get a notification? And if so, how should we do it? Thanks,  Toshi  

I've been at this for a couple days so I'm hoping someone can help.  This used to work until I did a factory reset.  I just updated my licence.  LAN/WAN is working just fine, I'm on it right now.    Model: FortiGate 40F Firmware: v7.0.13 build0566 (Mature)   I just want a basic WIFI AP Bridge - All of the docs and video say to enable the Managed FortiAPs but I don't have any listed.  When I try to add one using my 40F serial number is says Invalid Serial Number   I go through the setup where I:  Wifi & Switch Controller -> SSIDs -> New SSID Bridge Mode with SSID name and password Wifi & Switch Controller -> FortAP Profiles -> New Profile -> Use Defaults and I just add SSIDs manually and add the above SSID to both channels. Everything seems to be up I just can't see or join the network from a wifi devices.     I don't remember having to do more than this the first time I set it up. 

hi guys  What do these two errors meancmd_commit_cmdb: cmf_query_commit() errorrestore_pcontext:825 cmf_query_table_delete() error first one,did it mean that my configuration commit failedsecond one,did it mean that I failed to delete the table What puzzles me is what restore_pcontext and cmf mean hope someone can help methank you   

We have 2 FortiAuthenticators in seperate locations in an HA load balance. If the site that is listed in our fortigates as the primary server experiences an outage, Wifi connection is unsuccessful. I can see in the debug logs for the remaining FAC that the authentication is processed successfully but the fortigate/fortiAP is unable to successfully connect. Sites that have the remaining FortiAuth as primary instead of secondary connect successfully.   My working theory is that the remote auth failure time is too long to fail over to the secondary server for the WPA authentication to process successfully and establish a successful connection. Has anybody run in to anything similar?

I just need to confirm that the FWF-40F has a single radio and that if I want to have multiple SSIDs using different bands 2.4GZ or 5.0GHZ, you have to do one or the other BUT NOT both?  To do both, the next product available is the FWF-80F-2R or is this some other router/firewall/ap product I am not finding?

Hi,We have a Fortigate 601E on ver 6.4.13 manged by a FortiManager on ver 7.4.1. There is a discrepancy between what Webfilter categories are on each device and when I select to block on a category that is not on the Fortigate it gives me the following message:- post commit check fail: filters - 26 - invalid category id: Is there any way to manually create this category on the Fortigate? It stops me pushing policy whilst this issue exists.Thanks.

How is SD-WAN enabled on a FG device?Is there an explicit switch somewhere to turn it on?Or is it implicitly turned on by creating one or more SD-WAN zones and SD-WAN rules?Thanks.....