Solved

Hello. We have two FAP-432F's setup as a MESH at one of our construction sites. One of the AP's is connected to the FortiSwitch and configured as the ROOT, the other is configured as a LEAF.- Both APs have the same 3 SSIDs assigned; "Corp", "Guest", and the "MESH" SSIDs.- Both APs are configured to use the same channels in the 2.4 GHz (1,6,11) and 5 GHz bands (all).- Both APs show online under Managed FortiAPs. SOMETIMES I will see clients on the LEAF AP, while other times I will see an interference error. I'm assuming this because both APs may be using the same channel at the same time. I've tried to manually set the channels on each, but the configuration does not persist. I've learned the "same channel vs different channel" argument seems to vary by vendor and hardware. What is the best/correct configuration for Fortinet devices? I also have power set to 50% for the 2.4GHz channel, and 100% for the 5GHz channel (it's a big construction site). Should I set these both t

Hello team, I would like to know what is the difference in having the firewall use Fortinet DNS or local internal network DNS, for example Windows Server DNS.Thanks for the supportBR

Hi,I am doing a lab setup where I have hit a problem with ebgp routes disappearing from the routing-database when ibgp routes shows up. I have not done any route manipulation on my BGP session at the moment. I would have thought that even if the route is not active it would appear in the routing-database (get router info routing-table database). I can see the routes being advertised and also received (get router info routing-table bgp neigh received-routes). The BGP sessions are over the tunnel and I am assuming that there would not be any difference.Any help is appreciated.  San

In the Admin > Device > Parsers many (all) are enabled but many are for devices we do not have in our environment. Does having unused parsers enabled affect the SIEM performance? Would it make sense to disable them?

Hi All, I need the official ebook FCA

PROBLEM:  Customer reports FortiClient Console launches at random intervals throughout the day interrupting work flow. BACKGROUND:  I had a customer who complained that FortiClient continued to pop-up at random intervals and was disrupting conference calls, Zoom meetings, YouTube videos, web surfing, etc.  We could reproduce the issue but not trigger the behavior with any repeatability. SOLUTION:  Disable the option in the Endpoint Profiles => System Settings => User Identity Settings for "Notify Users to Submit User Identity"  

I'm referring two KBs below for this issue:https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-alt-primary-alt-secondary-DNS-server/ta-p/275269https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuration-per-VDOM-DNS/ta-p/190815But in reality with 7.0.13, the vdom-dns config accepts only alt-primary/alt-secondary unlike the 2nd KB describes.With this, how is the DNS decided at the vdom (test-vdom)? Always ask global primary/secondary first? Then only when they're unreachable vdom-dns is used? Or only vdom-dns is used? I prefer the latter behavior but not sure. Also, what protocol would be used if alt-primary/alt-secondary was chosen? Same as the primary/secondary?   fg40f-utm (global) # config sys dns   fg40f-utm (dns) # get primary  : 96.45.45.45 secondary  : 96.45.46.46 protocol  : dot ssl-certificate  : Fortinet_Factory server-hostname  : "globalsdns.fortinet.net" domain &nb

My current ssl portal I have set up for my users doesnt have host check or split tunneling enabled.I created an ssl portal with hostcheking and split tunneling enabled, and created corresponding policies for it.Then I added the same users to the new portal. When trying to hit the policy its going over the old policy and and ssl portal. is there a way to prioritize the new portal with hostcheck/split tunneling. Or is reusing the same exact users on both portals creating an issue? Thank you.

Hello,I'm using policy-based mode on FortiGate and I have a problem with URL filtering. I have set up the rules as described here https://docs.fortinet.com/document/fortigate/7.2.0/new-features/472314/allow-web-filter-category-groups-to-be-selected-in-ngfw-policies and I have the rule targeting a user group. In the log, I see a deny rule that says the page is Unrated, but on the https://www.fortiguard.com/webfilter site, I can see that the page has a category. I am sending log: date=2023-12-16 time=16:33:02 eventtime=1702740782183012282 tz="+0100" logid="0316013056" type="utm" subtype="webfilter" eventtype="ftgd_blk" level="warning" vd="root" policyid=74 poluuid="7b975724-9285-51ee-f073-60f6db8bd24e" policytype="security-policy" sessionid=180151 user="Domain_user" authserver="FSSO_server" srcip=10.1.1.1 srcport=50104 srccountry="Reserved" srcintf="VLAN" srcintfrole="lan" srcuuid="efa45e5a-56d5-51ee-ff05-d73441199146" dstip=85.207.58.49 dstport=443 dstcountry="Czech Republic"

Hi,I just set up SSL VPN on a 60F. I know the process and have done it before, nothing new, but not today. VPN client stops at 10% with the error visible. But I see traffic when sniffing (diagnose sniffer packet wan1 none 1 100)? (Connecting to a different site is working fine!)     This is my current config. There is only one local user in vpn_grp. HTTPS port (administration) is set to 8443.Its my personal box which I am using at home. There is no license, even no FortiCare.Laptop I am trying to connect with is online via 5G internet. Any hint is highly appreciated! Desperately trying since 2 hours now. Thanks!

I have a loopback 10.222.80.1 configured (1) I have advertised the same prefix in BGP. (2) The BGP neighbor 10.4.10.1 in question is healthy with 159 routes received (3) Why is this prefix not advertised via BGP? (4)     

Hello,I'm using policy-based mode on FortiGate and I have a problem with URL filtering. I have set up the rules as described here https://docs.fortinet.com/document/fortigate/7.2.0/new-features/472314/allow-web-filter-category-gro... and I have the rule targeting a user group. In the log, I see a deny rule that says the page is Unrated, but on the https://www.fortiguard.com/webfilter site, I can see that the page has a category.I am sending log:date=2023-12-16 time=16:33:02 eventtime=1702740782183012282 tz="+0100" logid="0316013056" type="utm" subtype="webfilter" eventtype="ftgd_blk" level="warning" vd="root" policyid=74 poluuid="7b975724-9285-51ee-f073-60f6db8bd24e" policytype="security-policy" sessionid=180151 user="Domain_user" authserver="FSSO_server" srcip=10.1.1.1 srcport=50104 srccountry="Reserved" srcintf="VLAN" srcintfrole="lan" srcuuid="efa45e5a-56d5-51ee-ff05-d73441199146" dstip=85.207.58.49 dstport=443 dstcountry="Czech Republic" dstintf="wan1"

Hi, We have a Fortigate cluster deployed in Azure. The design includes an internal and external Azure load balancer. We cannot connect from a server behind the cluster using the FileZilla client outbound to the Internet (client > internal load balancer > fortigate > ext lb > ftp server). The external FTP server is configured to use passive mode and the client is also configured to use passive. We have tried enabling all ports outbound to the target and have deleted the FTP session helper - it doesn't help. The FTP server is configured to request a conn on 5000-5100 FileZilla responds withStatus: Connection established, waiting for welcome message...Trace: CRealControlSocket::OnSocketError(106)Trace: CRealControlSocket::DoClose(66)Trace: CControlSocket::DoClose(66)Trace: CFtpControlSocket::ResetOperation(66)Trace: CControlSocket::ResetOperation(66)Trace: CFtpLogonOpData::Reset(66) in state 1Error: Could not connect to serverTrace: CFileZillaEnginePrivate:

Hi All,I've created a VLAN for 2 IoT devices.I have not received any network requirements for them.I want to create a policy which locks them down to only the essential required outbound ports and destinations.How can I achieve this? Is it using debug flow? I find it hard to get the information I need from it?Any help will be appreciated.Many thanks,

Dear All,              I have an ugent issue, after the 2 fortigate 201F configured in HA Active Active, the secondary devices stop to have network connectivity, not even the mgmt interface, i can not ping and access to the secondary devices, i have tried to factory reset the secondary device and form the HA again, and issue still exist, and i followed below video to do the HA, any help would be appreicated  https://www.youtube.com/watch?v=j25SwFGa76M piaakit

Hi All,    FortiLink was working fine, with a FortiSwitch connected on port A of a 60f. All kit lost power, and now port A is still showing up and green but the FortiLink doesn't and is down.    If I add port B to the FortiLink it momentarily comes back up but then drops again.    Switch is up and working, uplink port is up and connected. I have checked NTP on the FortiLink but not sure what else to do from here pending a reboot etc? Any thoughts?   Thanks, 

Hi, I would like to ask where I can edit the emails that I receive thanks to the Interface status changed notification. The default email is not easy to read. date=2023-12-15 time=05:17:13 devid="XXXXXXXXXXX" devname="Device name" eventtime=1702613832734597809 tz="+0100" logid="0100020099" type="event" subtype="system" level="warning" vd="root" logdesc="Interface status changed" action="interface-stat-change" status="DOWN" msg="Link monitor: Interface internal1 was turned down" Thank you very much.

Hello,I'm trying to get started in FortiAnalyzer # and I'm running into a problem. I have added all the Fortigates that I manage to FortiAnalyzer and now when I look at the logs I only see a column with the Device ID, which is the serial number of the firewalls. However, I don't have all the serial numbers in my head, so I would have liked to have a Device Name column there. I don't see that optioCould someone please advise me?

Hi everybody,After upgrading our #FortiNAC and #Fortinac Manager fro 9.2 to 9.4 I'm not able to access some configuration such as guest and contractors and portal configuratioThe users and their privileges are the same, with the 9.2 version I was able to everything (admin profile) but after the upgrade I cannot.I created also a new user with all the privileges but when I try to access to the guest and contractor section i have the following message: You do not have the permission to access this page.How can I fix this issue??? Thaks Fabio

Hi I want give my users internet based on their AD credential. In firewall policy if i select users or users group i should choose a address or something else. If i choose all+user group is that going to give internet only to specified users or all of them?

I have been asked to explore captive portal as an option for guests wireless, I see in the docs its OPEN (ie no encryption) for the initial connection. Does it ever flip to an encrypted channel post validation?

I have a question regarding auto-negotiate and keepalive as it relates to the IPSEC configuration. I understand the functionality from reading the following article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-the-IPSec-auto-negotiate-and-keepalive/ta-p/189536. My question is fairly simple but have not been able to find a definitive answer. Do these settings get applied to both Fortigate appliances or only on one side? My end goal is to have the tunnels always up unless the circuit is down on either side.   

Hi,If i create a policy from wan to lan with security profiles enabled, is that going to protect the inbound traffic to my lan? And also do i need to enable nat for this traffic direction?

Hi, My 200F FGT does not have hard disk. So which software is best to have logs with a great user friendly interface? Free or paid ones.

Hi How can i block internet access when remote users connect to fgt with foriclient vpn app?