Solved

Assume that I configure firewall without any qos policy, what is the qos default policy like? Does qos implement need license? I have a video server on a lan port and I want to give it priority. How can I do it? Can I give it a static IP and prioritize it? If yes, pls guide me for the steps. Can I give a general qos policy to faster video traffic? If yes, please guide me for the steps.

curl -X POST \https://1.2.3.4.5/jsonrpc \-H 'Accept: application/json' \-H 'cache-control: no-cache' \-k \-H 'content-type: application/json' \-H 'postman-token: 593987-1324' \-d '{"method": "exec","params": [{"url": "/sys/login/user/","data": [{"user":"username","passwd":"PASS"}]}],"session":"1111111111111","id": 1,"ver": "2.0"}'if [[ $? -eq 0 ]]; thenecho "API call successful. Response:"elseecho "API call failed."fi I keep receiving an Invalid Request Response "code" 10 in the API response. Does anyone have any suggestions? Some of the other API requests such as the session request work fine so it leads me to believe there is some issue with the given parameters in the request. Any help would be greatly appreciated. Thank you.

Hello, We are planning to manage many FortiClient and the company policy is to use SaaS as much as possible, that's the reason why we'd like to integrate FortiClient Cloud with our AzureAD instance. Integrating with an on premise active directory seems possible (albeit complex and not well documented) : https://www.reddit.com/r/fortinet/comments/l6sgxz/moving_from_ems_to_forticlient_cloud/ However I cannot see any information about a link with AzureAD, do someone know if it is even possible ? Thanks

Dear Fortinet community. I have a question regarding the updatefunction of a FortiSwitch 448.When I open the Firmware upgrade page via GUI it is just blank. It does not look like this: It is just blank.The current firmware is: v7.2.3 build0434 221212 (GA)It is connected to a Fortigate but the mode is standalone.Does anyone of you know why the website stays just blank instead giving me the website like shown in the picture above?Any help and suggestions are highly appreciated :) With kindest regardsFortiLover

We have many logs on FortiAuthenticator as below:Still keep remote LDAP user xxx though it has ceased existing remotelyAndCannot assign an FTM token to…..? Or   Failed to sync remote LDAP userPlease let me know what does this means of these logsThanks

Hi,We are going to deploy FortiAnalyzer VM and not sure how much HDD size we should use.As per the link below we can calculate the estimate HDD size using the formula HDD=LR*(RA/5+3*RR)*1.1. https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-estimate-disk-space-needed-for-Archive-and/ta-p/207552We've purchased 100 gb/day license and if we want to calculate based on Maximum license size the HDD size will be HDD=100*(365/5 + 3*90)*1.1 = 37 TB and it's a very big storage size.We understand we should calculate based on log/day but right now only one pair of FortiGate is sending the log to FortiAnalyzer , so we cannot make estimation.Later there will be more than 20 FortiGate sent to the same FortiAnalyzer.What should we consider estimating the VM HDD sizing in this case? And as per below link, the Storage can be calculated based on log/sec. How many log/sec will need to use up 100Gb per day license each day.How is 100Gb per day license calculated? Is i

Dear team, Is true that regardless of policy type (flow / proxy), when enabling deep inspection, the traffic is handled in a proxy manner because two connections are open (one from client to Fortigate where Fortigate signs a certificate and present it to the client , and the other session is from Fortigate to the destination internet server? I have tried to debug a connection using diagnose debug wad, but no output is presented on the console until I changed the policy type to proxy. So what is the application/process debug that can be turned on in case if troubleshooting ssl deep inspection?

I have having a switching/routing problem where the standalone Fortiswitch thinks the MAC for the VRRP gateway is pointed to the wrong port.  I dont have a sticky turned on but I cant remove the address. MAC Entries is empty.  Copied config from port.  The vlan 2 MAC should be pointed to the same TRK_MPLS as the rest.  edit "MCLAG-ICL"set native-vlan 4094set allowed-vlans 1-4094set dhcp-snooping trustedset igmp-snooping-flood-reports enableset mcast-snooping-flood-traffic enableset snmp-index 76 So my question is how do I remove something that doesn't exist anywhere?  Support ticket opened for a month now with no resolution.    Adding switch model 1048E 

Hello team!!! When I configure a new "Performance SLA", in the "Packet Loss threshold" option I can set the maximum packet loss to consider a link as "Up" but I dont know how many time or cheks are used to get the value.I mean, with a low value, it is more likely to fail if the amount of time or cheks is little, so I need to know this, but I did not find any relative document. Could you help me?Thanks in advance.Regards,Damián  

Hello, I encountering an issue while applying policy on Mac devices.The policy is to block devices that don't have FileVault enabled when connecting whether from VPN or internal network.My issue is that I can connect to the VPN and internal network while the device tag is non compliant.Note that I can apply policies on Windows devices.Please I appreciate your help.Thanks.FortiClient  

This video provides the steps necessary to design and configure interfaces that will be used for enabling enforcement. These are necessary for implementing network control for the wired and wireless network infrastructure (switches and Access Points)https://youtu.be/IWCDKmhP-oE

Hello community, I am attempting to change the wifi region / country code on the FortiWifi 80F. The SKU on the device is Region A. I am following the CLI steps here in KB https://community.fortinet.com/t5/FortiAP/Technical-Note-Changing-country-setting-on-a-wireless-controller/ta-p/192751 When I do 'set country IN' it gives me this error: command parse error before 'IN'Command fail. Return code -61 If I use the GUI to update the Wireless Settings, FortiAP Profile it gives this error: The name is a reserved keyword by the system.Value out of range.Table name 'FWF80F-WIFI0' can't be added or edited because of duplication or reservation.Any idea on when is happening? Appreciate it 

Login To Fortigate Firewall Disconnects In Less Than A MinuteI am using a public internet to login as administrator through the wan interface.Although wan interface is using a dynamic ip, I dont think the ip changes so fast.After I login to the firewall, after less than 1 minute, it will jump back out to the login page.What can be the cause of this issue?

good morning friends.Based on your experience in this fortinet world, do you think that scripts are a good practice to mitigate attacks?Those scripts could be used in automation stitch

wanting to setup two firewalls with same access on two different isp's etc. How can i setup in the forticlient firewall1 then if its down go to firewall2 without using dns? any idea's?Thanks, 

Hello, Is it recommended to setup 802.1x with persistent agent for authentication&registration with dot1x and scan safe/at risk/rogue with persistent agent ? Regards!FortiNAC 

Hello,I monitor my Windows active directory which is also my DNS server through the Fortisiem Windows agent, How can I detect the change made on the DNS side ( record deleting or changing)?What types of Windows events ID should I look for when searching for those kinds of modifications made on the DNS server side? FortiSIEM 

I have firewalls in HA and have recieved new contract registration codes, adding this to my primary is easy enough in the GUI, but the secondary I'm told to do it via CLI. What are the commands to do so?I know I could fail over to the secondary but that seems a bit overkill.Currently on v7.0.12 build0523 I can enter the secondary from the CLI with, but once inside? Can't find any documentation.# execute ha manage [ID] [username] 

Hello, i am trying to route some ssl vpn traffic to a specific server over our firewall. the server i am trying to reach is a hyperforce infrastructure with frequently changing ip addresses. so it is no option to add a route for an ipv4 address. instead the option would be to add a FQDN instead of an ipv4 address. but it is not available to add an FQDN to the split tunneling tunnel mode routing address override. Is there a option i can do this. (perhaps a cronscript witch performs a lookup an adds the ipv4 addresses to an address group?) thanks a lot

Hello, I successfully integrated the FMC from Cisco with the fortisiem platform, but all the logs I received are unkown.Any suggestion to resolve this issue?

I need to perform all configuration of a VPN Site-to-site "External Gateway" through Fortimanager.But, in the last step of the configuration I didn't find the option "Selectors of Phase 2". There is an option "Create Phase2 by Protected Subnet Pair" , but I didn't identify where I define the remote and local networks that browsed this VPN.When I add an object in "Protected Subnet" will it be enough or should I create them through the firewall policy?

Dear Fortinet Community. We start to upgrade our network infrastructure with FortiSwitches. Now we have ordered several devices (400 series) and the SFP & SFP+ Transceivers. We can see that the SFP+ Transceivers have a label stating that this Transceiver is a original Fortinet Transceiver. The other SFP Transceivers seem to be from Finisar. My question to you community. Is this normal or the standard, that Fortinet ships OEM compatible Transceivers from Finisar? I am wondering about the difference. For any answer from your experience would be very helpful :)Have a great day. FortiLover

Good morning, Has anyone every seen a Fortiswitch with dead ports?  I have a standalone 448E (7.2.3) that has 3 adjacent ethernet ports that are dead.  When you plug anything into them you get no link lights.  All the ports are administratively up so thats not it either. If anyone has an diagnostic or otherwise suggestions or comments, I'd really appreciate it.  This units support contract has expired so I can't contact Fortinet about it.

My FortiGate 100F, has been damaged by lightning. We have purchased a new FortiGate 100F. We want to transfer the license (2 years subscription) from the damaged FortiGate 100F to a new one FortiGate 100F. I wanted to transfer the license directly, but unfortunately I have already registered the new FortiGate 100F on my account, so I can't transfer the license.Can anyone help me?Many thanks.

Hi I understood that in the Fortinet training video that the Antivirus check is done by ISP engine.   Now the the test practice exam the selection of Antivirus wasn't correct according to the result provided by Fortinet.  I'would like to know what I missed. Thank you ,