Solved

We have two old devices: Fortigate 111C and FortiAnalyzer 100B. They are currently offline (as they have been replaced by other models). We are going to try sell them via auction (being a public organization we have such rules). But we need to safely remove our data and yet have it still usable, so it is worth a purchase for someone. I have read about Factory reset command, but i'm not sure it will wipe all the data. Is it only resetting a configuration? Should i still wipe the logs and other stuff somehow? I have also read in the forums about running format on FortiAnalyzer to get rid of logs, but won't it render the device unusable after that? With personal computers we are just wiping out HDDs securely as installing OS is a trivial task. Probably not so trivial with Fortigate. Or is it possible to completely wipe its memory and then install fresh FortiOS?

I am seeing some strange ARP requests from our Fortigate using Wireshark. I'm not sure the best way to describe it. It's as if the Fortigate has a cooldown of 1 second in between ARP requests. So when a device doesn't respond, it keeps sending requests exactly every 1 second. The IPs that it's trying to contact appear to be random DHCP devices that joined the network and then left. The IPs that it's trying to contact do change some over time. It's like it has a list of the last 10 devices that it can't find and just keeps repeating those until other devices leave the network. I've checked the ARP table on the Fortigate while it's sending these ARP requests and the IPs it's sending the requests to are not in the ARP table. It's not a network loop. No other devices are showing this kind of behavior. The amount of traffic generated by this isn't causing network disruptions, but I don't want the Fortigate to be this noisy. Any thoughts?  

Hi all!Maybe a simple question, but I don't see it: Why is the traffic to Cloudflare-Web implicitly denied while the traffic to Xbox is allowed?   Both connections use port 443...Policy 44: config firewall policyedit 44set srcintf "Name1"set dstintf "wan1"set action acceptset srcaddr "Name1 address"set dstaddr "all"set schedule "always"set service "HTTPS" "HTTP"set utm-status enableset ssl-ssh-profile "deep-inspection"set av-profile "default"set webfilter-profile "block some & monitor-all"set dnsfilter-profile "default"set ips-sensor "high_security"set application-list "block-high-risk"set logtraffic allset nat enablenextend  I guess, that it has something to do with the item "Action" and "Security" below:  What engine performs this deny? Why is the security log empty? Thanks for your help! Oliver 

Generally from a given vdom it is possible to issue the following to get the config including ALL DEFAULT settings:show full-configurationI know also that I can get what I would understand to be NON DEFAULT settings for given sections of the config from commands such as the following (this is by no means of course an exhaustive list):show system interfaceshow vpn ipsec phase1-interfaceshow vpn ipsec phase2-interfaceshow router bgpEtcMy question is there a command equivalent to show full-configuration above that will give just the NON DEFAULT settings i.e. all that has changed since the last factory-reset?Hope this makes senseThanks

Hi All ,  As a new guy on Fortigate appliances, I need your help. I have a customer with internal AD DNS servers. All endpoints are configured to use the AD DNS servers.   The issue that I'm facing is that in Fortiview, I can only see the IP Address of the endpoints I'm wondering how to setup the fortigate to get the FQDNs of those IP addresses from the internal AD DNS. ThanksPadelis  

Hi team,   I am developing some playbooks, which then will be useful when showing the solution to potential customers.   Firstlly I´ve created a playbook that calls https://icanhazdadjoke.com/api (RestFull API) and then shows the result joke to the customer.    Now, I am trying to modify the playbook to call the above API call X times (the variable X is configured inside the playbook). For each execution the API call returns a string (the joke). So, my purpose in this second test is to present to the cusromer X jokes together, like the following: "joke 1"+"\n"+joke 2"+"\n"+....+joke X"   The two playbooks are similar. The first one calls the API call just once.  The second playbook call the API many times (variable X) and return the outputs together (append or join could be used).   Could you help me on how to create loops (like the "for" or while commands in C), execute a code inside the loop and then show the results? Is there any example

Hello, I am new to the community but I really like Fortinet, could you please help me, I have 2 Fortiswitches, a 424E and a 448E, I would like to create an aggregation port to increase the bandwidth, I know I can do it with LAGBut I would like to understand the LACP mode, if what I want is an aggregation interface, which mode should I use? Static, active or passive?I tried static mode on both sides and the interfaces do not go up.The manual indicates Active on one side and Passive on the other side, but I would like to understand why? or better understand the modes of LACP.

Hi All,  Having some issues building SD-WAN in Eve-NG, or at least I think it's built correctly but traffic isn't routing, is anyone aware if there is an issue with Forti, SD-WAN and Eve? I can see hit counts in the SD-WAN rules section, but I'm getting a timeout on pings from my VPC. Pictures of the build below: - Thanks, Rich 

I have a problem getting a WAN connection through VIP to a virtual server (with Roundrobin).The virtual server works internally.If I point the VIP to one of the servers in the Virtual server it works.The policy for the Virtual server also includes the wan interface as the source. Could it be a flow/proxy base thing? 

Hi,I have a problem with the GeoIP block message after updating from 6.3 to 7.0.When GeoIP blocking is enabled in an inline web protection profile, FortiWeb just reset the connections instead of displaying a block message page related to Geo IP blocking!!!Does anybody know how we could handle this?Thanks.

Hi allI'm looking for a twinax cable to connect a fortigatte 600e with a Nexus 5672UP and, because is already planned to change the Nexus with a HP J9822A , if is it possible reuse this cable also for this ssecond kind of connection or I will have to buy a new one.   

Good evening!   I've created the following policy to scan web traffic (test setup):   config firewall policyedit 2set name "Trust:Webzugriff"set uuid a7a53264-XXXXXXXXXXXXXXXXset srcintf "internal2"set dstintf "wan1"set action acceptset srcaddr "Trust address"set dstaddr "all"set schedule "always"set service "HTTPS" "PING" "HTTP"set utm-status enableset ssl-ssh-profile "certificate-inspection"set av-profile "AV-Web"set webfilter-profile "block some & monitor-all"set dnsfilter-profile "default"set file-filter-profile "default"set ips-sensor "all_default"set application-list "block-high-risk"set logtraffic allset nat enablenextend   The webfilter profile is configured to warn on specific categories. This works fine. Surfing to a corresponding web page triggers the webfilter. The Fortigate "warning-page" is shown. However, while the log says the web filter was triggered, the warning page says "FortiGuard Intrusion Prevention - Access Blocked". May be a cosmetic issue. &

Hello,   We purchased 200 mobile Fortitokens and I'm wondering if there is an alternative method instead of assigning them one by one manually. Any help would be well appreciated.   Thanks in advance!

Hi Support,I need to access my internal server machine through RDP with External pubic IP address . i created Virtual IP pool by selecting interface as my primary wan and mapped Internal machine IP with the external IP address and i enable port forwarding and map the port with TCP and in Port mapping type i selected one to one and i entered external server port to 3389 and map to IPv4 port to 3389.In Firewall Policy i selected incoming interface as SDWAN which i mention as Virtual WAN link and outgoing interface as my lan and source i selected all and destination as my internal server IP and server all and disabled the Nat and enabled this policy.now i cant able to connect remote desktop with my external IP address( public IP) can anyone help me

Dear support,I'm seeking guidance regarding my current network setup and the configuration required to enable internet access using the ISP-provided LAN IP pool (1.1.2.2/29 subnet) via our Fortinet firewall.Currently, our Fortinet firewall's WAN interface is configured with the WAN IP pool address (1.1.1.1/30), and it's functioning seamlessly. However, we now aim to utilize the ISP-provided LAN IP pool (1.1.2.2/29) to enable internet connectivity using IP addresses within this subnet.Any detailed instructions or guidelines you could provide regarding these configurations would be immensely helpful in achieving this setup.

Hello, what if admin from the same country that apply geoblocking?Will that be a problem?

Hi guys, i'm new user using fortigate, I want to know if we implement fortigate on transparent mode, what limitation we can get ?or any documentation so i can read before i implement fortigate transparent mode. Appreciate your feedback,Thank you.#Fortigate #Transparent Mode

Hello, Can someone help me to configure dhcp server on windows server for ssl vpn clients. I have fortigate 100f with version 7.2.5 which I configured according to the instructions https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-with-external-DHCP-Server/ta-p/215644When configured for vlan everything is easy and works fine. For ssl vpn clients where there is no default gateway the configuration looks different. On wireshark you can see that when trying to connect vpn request to dhcp server is sent. However, the connection does not happen because the client does not receive an ip address. Do you know how the configuration should look like on the dhcp server side of the windows server ?

Hello there,I have a question about applying a golden template for our customers. Our company (we are a MSP) has multiple customers who are switching to FortiGate firewalls. I was thinking, is it perhaps possible to create a template that we can apply/upload to all the new FortiGates? After that we specify the settings to the customer ofcourse, but is a base template (for settings that are the same for all of our customers) possible to create? Thanks in advance!

When I'm trying to download Forticlient VPN linux version (.deb), it's returning this message for me when I click the Linux .deb download button: 

Hello everyone, I'm trying to delete a certificate that I misplaced but I don't know how to do it. The delete button is not available on the options, only import, view or Download. I have a certificate that expired yesterday and the point was to replace it for the new one. When I try to reload it, appears the following message: "Certificate file is duplicate for CA/LOCAL/REMOTE/CRL cert.". I'm running the fw 6.4.5 @ 60F units. Thank you

Hello all Members.I would like to say hello for all .I'm starting my adventure with Forti Switches  and need some tips or example how to make configuration.My case is: like below. I need to create/configure additional pair of fiber switches connected by ICL-MCLAG and directly connected to stack of switches which are connected to FortiGate's. I already created one pair which is working fine but when I want to activate ICL-MCLAG between switch on top and red rectangle, both are going offline and only factory reset for both help. I found article about three-tier MCLAG config https://community.fortinet.com/t5/FortiGate/Technical-Tip-Three-tier-MCLAG-configuration-on-managed/ta-p/195452 but the question is, how to configure on the same level the second pair.Already prepared config switch auto-isl-port-groupfor this new pair but exist one is without this config. Is it possible to create new group and setup member ports for already connected and configured pair withou

I couldn't find any article clearly saying either "not possible" or "how to do it" online so far. But most of our FortiToken Mobile users who tried migrating from an old phone to a new phone told me a migration didn't work. So we always reactivate a token again.Recently one iPhone user who tried to migrate to a new iPhone told me the migration itself worked and she could use the 6-digit token code to get connected from the new phone. However, she never be able to get a push-notification. I found one discussion at Stackoverflow saying it involves a certificate and the "transfer" option at the app doesn't transfer it. But again, I couldn't find any from FTNT backing up the claim. Is it possible transfering FTM app w/ assigned tokens to a new phone with ability to get a notification? And if so, how should we do it? Thanks,  Toshi  

I've been at this for a couple days so I'm hoping someone can help.  This used to work until I did a factory reset.  I just updated my licence.  LAN/WAN is working just fine, I'm on it right now.    Model: FortiGate 40F Firmware: v7.0.13 build0566 (Mature)   I just want a basic WIFI AP Bridge - All of the docs and video say to enable the Managed FortiAPs but I don't have any listed.  When I try to add one using my 40F serial number is says Invalid Serial Number   I go through the setup where I:  Wifi & Switch Controller -> SSIDs -> New SSID Bridge Mode with SSID name and password Wifi & Switch Controller -> FortAP Profiles -> New Profile -> Use Defaults and I just add SSIDs manually and add the above SSID to both channels. Everything seems to be up I just can't see or join the network from a wifi devices.     I don't remember having to do more than this the first time I set it up. 

hi guys  What do these two errors meancmd_commit_cmdb: cmf_query_commit() errorrestore_pcontext:825 cmf_query_table_delete() error first one,did it mean that my configuration commit failedsecond one,did it mean that I failed to delete the table What puzzles me is what restore_pcontext and cmf mean hope someone can help methank you