Solved

Meaning he gets the local ip address but he has no internet access.What can be done to resolve this issue?

Hi Community Member, I have a requirement of 150 days data retention policy. 30 days should be online and 120 day on archive. I am getting little bit confuse in FortiSIEM documentation.There are two types of retention policy (archival retention policy and online retention policy), we have configured data storage (online and archive) on NFS server. If I set data retention to 30 days in online retention policy, what will fortiSIEM will do after 30 days ? will it move data to archive or it will delete the data ? Thanks in advance.

Hello, I just upgraded my Fortigate 60F to version 7.4.1 from 7.4.0 and my traffic shaping configuration disappeared, I tried to create a new one but after I click OK it is not saved, all the traffic shaping configuration including services and applications that I entered are not saved . Can you help me with this problem?

A client we help has a small office, one Windows Server, and a FortiGate. The server has some DNS Server problems. Would it be possible and wise to turn uninstall the Windows Server DNS and to instead use the FortiGate for DNS? What are the advantages and disadvantages of the Windows Server acting as DNS server vs. the FortiGate acting as DNS server?

Buen día,Necesito saber a nivel de fortigate cual es el Algoritmo utilizado para la encriptación de la información que viaja por la SSL VPN,dónde puedo sacar la información

I am currently provisioning a FortiGate 7.0 VM HA cluster in the Google Cloud (through the GCP image). Now our organizational policy requires OS Login to be enabled. This results in a high number of users managed by the Google IAM to be imported as "prof_admin" into the machine. Is there a possibility to disable the OS login feature on the Fortigate directly so that the GCP does not manage the users on the VM? I realized that I myself am "super_admin". Is that because I am the creator of the VM? In general, who gets the "super_admin" role? Is there some documentation on how the FortiGate VM image integrates into the GCP? Thanks in advance.

hello,I have this situation:I have two links from two diferent ISP (let's say ISP_A (fast) and ISP_B (slower)), and from ISP_A i have Public IP pool, we are using one IP from this pool to provide one application available from outside (by configuring VIP).Is SD-WAN we have rule in general saying that if ISP_A is down or bad SLA use ISP_B Our partenr is using VIP address to access to or resource from Their site. Question:):1.If ISP_A is  down , will be possible to access from Partner site using VIP(pool from ISP_A) but on link from ISP_B ??Thanks 

Hi all, I have an SSID using 802.1x authentication and would like to configure a secondary RADIUS server for redundancy. However it seems like I can only select one server. Any ideas how can I configure this? Thanks.  

We are using Web filtering in EMS. Is there a way to get a report of where someone click pass the warning about a bad site? 

Hi guys, How can I use the set variable value in a playbook I created in a different playbook?

if one of my sdwan links goes down, I want an alert sent to my email or phone.Can this be done?

Hi All,FortiGate 60E [FortiOS v7.2.5 build1517]I don't see VPN logs. Why isit so and where I can enable VPn logging. 

Hi team,    I am kind of a stuck in a situation. I was accessing the fortinet dashboard board the DDNS with Letsencrypt SSL. I had setup a port forwarding to one my server through port 443 and 22. I didn't realise the ports were also used for the web admin and ssh. Now when I am trying to access the web admin and SSH the requests are being forwarded to the server. Is there anyway I can change the port or there's no other way apart from resetting the device? I do have a backup file, but not sure how to even restore that.    Thanks!

Hi i need to configure two wan port on Fortinet 40 F , like a aggregation each wan port can see mac adress for each other  to build my failover Solution  Br Alain 

Hello.  I have some test switches (248E-FPOE).  I put them into standalone mode (factory reset and then reconfigured).  Some of the switches are on 7.2.1 and others on 7.2.4.  The switches are connected to each other, and only each other.  There are no redundant links.   The problem is that about every three or so hours the switches cpu load spikes to ~90% for 20 or 30 minutes and then goes back down.  I tried disconnecting on of the switches from the others, and it still is doing this.  Looking at the logs, they just seem to spike and them cpu utilization logs get generated.   Not sure what might be causing this?  I'll look into one more thing tomorrow, but I have my doubts.  Was curious if anyone has ran into anything similar.   **Note: Only having this issue after putting them in standalone mode.

Hello, sorry for my english, i use google trad Is it possible to have a SSL VPN with Azure SAML SSO authentication and at the same time a captive portal on a VLAN with Azure SAML SSO authentication ? With 2 different Azure groups for authentication.   material: Fortigate 100FFirmware: v7.0.12 build0523 (Mature)Best regards, 

Hi All! I have problem as title.Follows illustration is current situation and work fine.And unit test of addition network as follows illustration, (Reference: https://getlabsdone.com/how-to-configure-dmz-on-the-fortigate-firewall )Ping/FTP access from Client(20.0.2.118) to FTP Server(10.1.0.2) @ FileZilla work fine.Both merged as follows illustration..And I added static route @ EdgeRouter 4 as followsset protocols static route 10.1.0.0/24 next-hop 10.0.2.16 description 'Intranet to DMZ' set protocols static route 10.1.0.0/24 next-hop 10.0.2.16 distance 253 Ping from Client (20.0.2.118) to FTP Server(10.1.0.2) work fine.$ping 10.1.0.2 PING 10.1.0.2 (10.1.0.2) 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=127 time=0.770 ms 64 bytes from 10.1.0.2: icmp_seq=2 ttl=127 time=0.498 ms But FTP won't work @ FileZilla as follows.Status:   Connecting to 10.1.0.2:21... Status:   Connection established, waiting for welcome message...Netstat

I have a site to site VPN between an on-prem FortiGate 500E and a vFortiGate in Azure.Due to the distance between the FortiGates geographically, I’m trying out Forward Error Correction (FEC) ingress and egress on both FortiGates to see if it can improve on lost UDP traffic (main issue, missing RADIUS packages). To use FEC on VPN, Fortinets dokumentation note that NPU acceleration has to be disabled on the Phase1.This has been done on the FGT500E as it can use NPU. The vFGT in Azure does not.  I’m seeing ESP errors in my VPN event log.As FEC re-transmit some packeges, this makes sence to me, as an ESP packet with a sequence number could be re-transmitted.  Ofcause, I could deaktivere anti-replay on phase2 and the events would go away.The official documentation that I have looket at, at docs.fortinet.com does not say anything about that ESP errors is a side-effect of enabling the feature.  I guess my question is, am I missing something? I find it a bit

Just wondering, as I did not want to just assume things, but had 2 questions as it relates to new threats/vulnerabilities and using IPS to mitigate against.1. If an IPS profile is created via filter, will any new signature, updated from the subscription, that matches to said filter, automatically also apply? eg... if I have a filter based on macOS, is a new signature that is macOS applicable, dynamically applied as well since it is a dynamic filter (again, sounds logical, but don't want to assume)?2. What is the normal turn-around for new vulnerabilities to then be turned around into IPS signatures from FortiGuard for the database to be updated? eg... Apple has some new vulnerabilities (CVE-2023-41064, CVE-2023-41061) that was disclosed yesterday (but CVE was created back on the 22nd of last month). FortiGuard has nothing about those on their website as of yet.

in a typical network with 500 workstations. I configured my FG 401F to work with my LDAP for authentication and at the same time explored the FSSO functionality while LDAP is still present. Now, if the workstation will authenticate which method it will use LDAP or FSSO? Which method will take precedence first?    

Good Evening,I was hoping to get some advice on how to best complete a project. Being pointed to KBAs and resources would be incredibly helpful as well. This is what I have outlined so far. Summary of RequirementsI have a website hosted on Amazon Web Services (AWS), and would like to protect its admin panel by placing it behind a Fortinet FortiGate firewall. I want to restrict access to the admin panel so that it is only accessible via a FortiClient VPN. I specifically want the full feature set that a FortiGate firewall can offer.I was thinking of spinning up a Fortigate EC2 instance that will let me use all the features of a normal fortigate, specifically so I can set up VPN access from machines to be able to access the site's admin panel. High-level Steps:Deploy FortiGate VM on AWSConfigure FortiGate Firewall RulesSet up FortiClient VPNRoute Admin Panel Traffic through FortiGate VM This was my plan:1. Deploy FortiGate VM on AWS(For this is there a Fortigate Product alr

What would be the best way to connect a fortigate behind another fortigate? I have the ISP coming into the wan port on fortigate 1. I need to setup a sub tenant in that space with their own fortiagate that is going to share the isp connection. DMZ port? or proxy a public IP though the first fortigate? Or just do a switch on the ISP side and do IP block a to fortigate 1 WAN and IP block 2 to fortigate 2 WAN? Firewall 1 needs to be completely isolated form firewall 2 but share the ISP connection coming into Firewall 1

Forticlient 7.2.1Windows 10JetBrains/DataGrip SSH clientPutty 0.76When setting up a ZTNA destination I can connect to devices using putty/ssh and everything works. When using JetBrains/DataGrip database IDE that uses the openSSH library, the application never connects.I was under the impression that ZTNA would intercept and proxy traffic based on destination address/port but the forticlient seems to not try to proxy the openSSH client at all. Traffic from the IDE application is still trying to use regular routing for the ZTNA Destination.https://www.jetbrains.com/help/datagrip/configuring-ssh-and-ssl.html#ssl 

Hi,I'm currently testing HA switching.Please tell me, are HA uptime and system uptime two different things?Also, is there a command to check HA uptime?

Hi I'm using a Teltonika RUT240 in passthrough mode to add 4G to a Fortigate 60E running 7.0.12. It seems to work well enough, and the Forti interface connected to the Teltonika gets its public IP. The idea is to create a second IPsec tunnel on the 4G interface and aggregate it with the main IPsec tunnel on the main WAN interface for  redundancy. I can only get a tunnel up on the 4G interface if I set the 200e at the other end to expect dial-up. If I try it using the dynamic DNS FQDN of the 60E,   I get "no SA proposal chosen" and it fails. It appears you can't add a dial-up IPSec tunnel to an aggregate - set type dynamic and set aggregate enable appear to be mutually exclusive - so I want to get it working using dynamic DNS. Does anyone have any idea why IPSec is failing when I try to use dynamic DNS at the 200E end? Error reads "ike Negotiate ISAKMP SA Error: ike 0:b822f87e5d0c811d/0000000000000000:17474: no SA proposal chosen"