Solved

On FortiADC I tried to configure a NAT Source Pool with an IP-address of an existing VS, but seems to be not possible, as I get an error message saying that this IP-address is a duplicate to an existing VS.Is this really a normal behavior and if so, why is there such a restriction?!?!?!Background: we are currently planning a platform migration from F5-LTM to FortiADC and in F5 world we are using SNAT with the same IP-address as the VS itself.How can this be configured with FortiADC?Thank you!Regards Stefan :)

What feature is supported for One-armed Sniffer?  Is SSL certificate inspection supported? Is SSL deep inspection supported?

Is One-Armed Sniffer supported under HA configurations?  Can I connect SPAN port on the switch to a small switch and connect my one-armed sniffer ports from each of HA Fortigate member to the switch?

Seem to not be able to install FSSO agent 5.0.0311 on Windows Server 2019 (Standard).Seems fine on 2016 and 2022.. Any help much appreciated... 

Fortigate-200Fおよび400FのMAC address tableの動的に学習可能な上限値を教えて下さい。スペック一覧等にも見当たらず、掲載場所があれば教えて下さい。

Hello Expert,   One cisco I am able to create vlan and assign respective port to vlan    example  ------------------   interface Vlan31description Switchware Vlanip address 10.118.133 .33 255.255.255.240   interface GigabitEthernet3description CCTV Interfaceswitchport access vlan 31no ip address!interface GigabitEthernet4no ip addressshutdown!interface GigabitEthernet5switchport access vlan 31no ip address   On the fortigate  i would like to able to create a similar vlan and assigned different interfaces unsure how to do this. thank you  Regards

We're in the process of upgrading our AnyConnect to FortiClient. What we're trying to accomplish is tie authentiation into our SAML SSO with MFA. We want to be able to provide segmentation  to the VPN users, that is, we want to control which systems the VPN users have access to. It appears we can accomplish this with FortiClient EMS, which we'll be purchasing soon, but I'm getting a bit wrapped around the axle in understanding the entire process. I believe I'm good in configuring the SAML SSO with MFA a the firewall, but outside of the FortiClient EMS, is there anything else we need to purchase or provision? I'll continue to look for the documentation, but I'm getting a bit behind on the schedule. Thank you.

Hi I have added a specific website to an allow group in a new policy with no security profiles.Additionally added wildcard/exempt in the Web Filter profile for other policies and yet am still getting the 'Fortiguard SDNS Blocked Page' when trying to access. Further nothing appears in the logs for it being blocked? I am at my wits end not sure where its going wrong FortiOS v7.41 Forti 200E

After upgrade Forticlient to 7.2.2, Firefox can't connect to any secure side (google.com, etc), because of: "Software is Preventing Firefox From Safely Connecting to This Sitewww.google.com is most likely a safe site, but a secure connection could not be established. This issue is caused by FortiClient Webfilter Root, which is either software on your computer or your network. What can you do about it?www.google.com has a security policy called HTTP Strict Transport Security (HSTS), which means that Firefox can only connect to it securely. You can’t add an exception to visit this site." Have you experienced this?

Hi, We created the vxlan according to the document below. We can carry vlan50 or etc. but it didn't work it for vlan1.  https://community.fortinet.com/t5/FortiGate/Technical-Tip-VXLAN-over-IPsec-for-multiple-VLANs-using-software/ta-p/195488

Hi.I wanted to ask you about the following problem I am encountering:I have a Fortigate 80E device with one of the internet outputs via fiber (Wan1). The second is WiMax and it is what we use to give our company's clients free Wifi (Wan2). To access this internet we use an access point connected to port 11 lan.At the same time, we have enabled the VPN connection to the Fortigate through the public IP and a port. If we connect a laptop from which we share the mobile phone's Wi-Fi, we have no problem accessing the VPN, but if we try to use the free internal Wi-Fi internet, access is impossible.The questions are the following: Is it viable to connect via internal open Wi-Fi to the VPN?If so, what additional policies or configuration would we need to create in Fortigate to make this possible?I am waiting for a response. Thanks in advance. All the best. Thank you.

Hi,Version 7.2.6, Events section missing from Log and Report.

HI  Anyone have experience and idea how to configure and process generate CSR at FGT and sign by FAC for internal access in order the webpage won't show warning and address bar show "not secure" ? I did try generate CSR in fortigate and signed by FAC. I did import the local CA from FAC to the end user devices. However, still see the warning and address bar show "not secure"  Appreciate anyone could share the idea and the step i missing I did refer link below as wellhttps://docs.fortinet.com/document/fortiauthenticator/6.5.0/cookbook/628126/fortiauthenticator-as-a-certificate-authority    

Hello https://docs.fortinet.com/document/fortimanager/7.2.0/new-features/47777/fortimanager-supports-authentication-token-for-api-administrators-7-2-2 I'm following above link to configure token authen for api admin in my fortimanager . I 'm trying but always get same  message "{ "id": 2, "result": [ { "status": { "code": -11, "message": "No permission for the resource" }, "url": "\/sys\/status" } ], "session": 48079 }"

Why is tcp port 179 open in firewall even though BGP is not used?Because it is scanned as being open.Is there any way to disable it?

 Hi, I have a FortiGate 30E and connect to a D-Link GS1900 Switch on Port 4 of FortiGate.The default subnet is "lan"(192.168.0.x).I have created two VLANs(192.168.2.x and 192.168.3.x) and both works now (seel below screen shots). I would like to know:1. Interface: For both VLANs, I can choose "lan" or "wan"(connect to the WAN physical port) as the interface.  Can anyone advice me the differences of choosing "lan" or "wan" as interface?2. Any additional routing(static or policy) is required to make sure the two VLANs can go to internet? Thank you.     

Hi Community Members, I am facing issue in generating authorization code for office365 application in azure. I am following official fortisoar documents for O365 connector but their is something wrong with the provided URL, upon providing tenant id and client id its showing error. Can someone pass me the correct URL for generating the code. thanks in advance. FortiSOAR 

My setup is one FortiGate 80F with latest firmware (7.4.1) and lots of services and hosts behind it. I have multiple VLANs that i use for VPN clients. VPN server is separate host and it assigns VLAN to the client. FG acts as DHCP server for VPN clients. Also i use DHCP option 121 to push routes to internal resources depending on VLAN. What i want to achieve is to remove default route from DHCP server or make its metric higher so vpn clients will have only option 121 pushed routes.Now i`m using blackhole route but it doesn`t fullfill my requirements as i still have clients with problems. I use softether as VPN server and clients are windows, linux, mac users using softether protocol and openvpn protocol.Any ideas?

I have purcashed a Fortigate 40F firewall that I have onprem.I want the log to be stored in a Google Cloud PostgreSQL database. What is the best method of doing this?  |----------------------|                |-------------------------------------|                      |------------------|| FortiGate F40F | --- ?? --> | Google Cloud  Functions? | ----- SQL ---> | PostgreSQL ||----------------------|                |-------------------------------------|                      |------------------| 

HelloFGT 1801F with FOS 7.0.12.Please see the below output and confirm if this is a conserve/extreme mode condition, knowing that at the same time my FGT started to reject sessions.In case the below is conserve mode condition, what can be the reasons for which a FortiGate doesn''t log that the system has entered conserve mode? # get system performance status...Memory: 24719900k total, 12677632k used (51.3%), 1229868k free (5.0%), 10812400k freeable (43.7%)... # diagnose hardware sysinfo memoryMemTotal: 24719900 kBMemFree: 1228440 kBMemAvailable: 14488404 kBBuffers: 821188 kBCached: 12821328 kBSwapCached: 0 kBActive: 14187032 kBInactive: 1372760 kBActive(anon): 2216820 kBInactive(anon): 58332 kBActive(file): 11970212 kBInactive(file): 1314428 kBUnevictable: 241912 kBMlocked: 0 kBSwapTotal: 0 kBSwapFree: 0 kBDirty: 2720 kBWriteback: 0 kBAnonPages: 2160024 kBMapped: 252804 kBShmem: 124376 kBSlab: 3250364 kBSReclaimable: 428828 kBSUnreclaim: 2821536 kBKernelStack: 6768 kBPageTabl

Hi,since i updated to 7.4.0 the "Interface Pair View" isn't ordered by the source "interface", it is now very hard to find something. Do i missed something? How can i change the order in that view? Kind regardsStefan 

Hello, I'm new to FG. I have a problem:I have a Fg 60F router. My client set up an SSL VPN connection for me. He also has some FG. Unfortunately, when you try to run it, the following message appears in the appendix. Error appearing at 10% load. solution in another network where the router is Mikrotik and it works.Please advise what I need to set in my FG to make it work. 

Hello everyone,Due to running out of addresses in the old subnet allocated for the server farm, I have created a new subnet in the same VLAN and placed it on the same port as the old subnet.I am encountering an issue where I can't ping or connect from subnet A to subnet B and vice versa.When I run a tracert from a server in the old subnet A to a server in the new subnet B, the packets are going out to the internet via the WAN interface.  Please help me . Thank you very much !

Hello,We're dealing with a significant spam issue, and we're considering implementing more strict AntiSpam profile settings like SPF, DKIM, and DMARC. However, I'm concerned that these changes might have a substantial impact by potentially sending legitimate emails to quarantine.I'm wondering if there's a way for us to assess how well incoming emails align with these rules before we make any changes. For example, if FortiMAIL processed 10,000 messages today and SPF Fail was activated, resulting in all 10,000 messages being sent to quarantine, I'd like to know how many messages would be affected if SPF SoftFail were activated too.Is there a way to generate a statistics report that can help us gauge the potential impact of implementing these AntiSpam profile changes before we actually go ahead with them?Thank you for your assistance.

Hello team!!! Recently a Fortinet engineer told me that performance SLA are not considered if there are not explicit rule including them, so I wonder how to create a Load balance, using both WANs in the SD-WAN, taking care about the bandwith of each wan.For example, I have the following:WAN1: 100 Mbps / 100 Mbps of bandwithWAN2: 50 Mbps / 50 Mbps of bandwithIn this case I would like to have about the double amount of sessions in WAN1 than in WAN2, and also I would like that if some link has about 3% of packet loss or more, this link will not be used.Is this possible? Thanks in advance.Regards,Damián