Solved

Hi Everyone My firewall's installed zone cannot connect to the internet, causing a system event log entry with the message 'FortiGate update now failed' every 2 minutes. And Licenses information status Pending always.Is there a way to solve this problem?   Firewall OS ver. 7.2.2 Thank You FortiGate  

Good morning friends, a question. Could you please help me with this query, because that message appears "Unable to connect to fortiguard servers" In firewall v7.0.12 we are using the DNS of the ISP provider and no drops are observed. There is no latency The licenses are in UP and expire in 2024.   What could be happening? thanks for your comments  

Hello, I have deployed Fortimanager in Azure Infrastructure. As I see it automatically applied 1TB disk. What is the purpose of this disk? Just for logs?  Because right now my Fortimanager has 2 disk:1 - OS disk - Size is 4gb2 - Data disk - Size iz 1TB 

We have upgraded our EMS server to 7.2.2 build 0879.After that we upgraded few of our FortiClient to 7.2.2.0864. The result:- all our FortiClient endpoints with 7.0.9 receive the ZTNA destinations and create successfully the virtual hosts in the Windows \drivers\etc\hosts file.- all our FortiClient endpoints with 7.2.2 did not change anything in the hosts file. Also the features status in the EMS console for that clients says: "ZTNA enabled (hidden)", although there is no such setting in the assigned profile. The user do not see the "ZTNA destinations" tab on the client side. How may I change the behavior of the 7.2.2 client, so it can use the ZTNA as intended?

Hi All I'm planning on creating a Aggregate Link for WAN on my Forti 200E.Would i need to create a trunk/LACP on my switch to accomplish same? (Aruba switch)

 I have two routers connected using ipsec site to site.The remote user connects to router A  (192.168.1.0/24) and has access to the network. The remote user does not have access to network B ( 192.168.2.0/24) How to make it have access to network B

Hi, I need to open a ticket with my Fortinet account on behalf of a customer. The device is registered under my customer's account. Is there a way for my customer to associate my account with the device or his organisation so I can open the ticket on his behalf? Thanks.

On FortiADC I tried to configure a NAT Source Pool with an IP-address of an existing VS, but seems to be not possible, as I get an error message saying that this IP-address is a duplicate to an existing VS.Is this really a normal behavior and if so, why is there such a restriction?!?!?!Background: we are currently planning a platform migration from F5-LTM to FortiADC and in F5 world we are using SNAT with the same IP-address as the VS itself.How can this be configured with FortiADC?Thank you!Regards Stefan :)

What feature is supported for One-armed Sniffer?  Is SSL certificate inspection supported? Is SSL deep inspection supported?

Is One-Armed Sniffer supported under HA configurations?  Can I connect SPAN port on the switch to a small switch and connect my one-armed sniffer ports from each of HA Fortigate member to the switch?

Seem to not be able to install FSSO agent 5.0.0311 on Windows Server 2019 (Standard).Seems fine on 2016 and 2022.. Any help much appreciated... 

Fortigate-200Fおよび400FのMAC address tableの動的に学習可能な上限値を教えて下さい。スペック一覧等にも見当たらず、掲載場所があれば教えて下さい。

Hello Expert,   One cisco I am able to create vlan and assign respective port to vlan    example  ------------------   interface Vlan31description Switchware Vlanip address 10.118.133 .33 255.255.255.240   interface GigabitEthernet3description CCTV Interfaceswitchport access vlan 31no ip address!interface GigabitEthernet4no ip addressshutdown!interface GigabitEthernet5switchport access vlan 31no ip address   On the fortigate  i would like to able to create a similar vlan and assigned different interfaces unsure how to do this. thank you  Regards

We're in the process of upgrading our AnyConnect to FortiClient. What we're trying to accomplish is tie authentiation into our SAML SSO with MFA. We want to be able to provide segmentation  to the VPN users, that is, we want to control which systems the VPN users have access to. It appears we can accomplish this with FortiClient EMS, which we'll be purchasing soon, but I'm getting a bit wrapped around the axle in understanding the entire process. I believe I'm good in configuring the SAML SSO with MFA a the firewall, but outside of the FortiClient EMS, is there anything else we need to purchase or provision? I'll continue to look for the documentation, but I'm getting a bit behind on the schedule. Thank you.

Hi I have added a specific website to an allow group in a new policy with no security profiles.Additionally added wildcard/exempt in the Web Filter profile for other policies and yet am still getting the 'Fortiguard SDNS Blocked Page' when trying to access. Further nothing appears in the logs for it being blocked? I am at my wits end not sure where its going wrong FortiOS v7.41 Forti 200E

After upgrade Forticlient to 7.2.2, Firefox can't connect to any secure side (google.com, etc), because of: "Software is Preventing Firefox From Safely Connecting to This Sitewww.google.com is most likely a safe site, but a secure connection could not be established. This issue is caused by FortiClient Webfilter Root, which is either software on your computer or your network. What can you do about it?www.google.com has a security policy called HTTP Strict Transport Security (HSTS), which means that Firefox can only connect to it securely. You can’t add an exception to visit this site." Have you experienced this?

Hi, We created the vxlan according to the document below. We can carry vlan50 or etc. but it didn't work it for vlan1.  https://community.fortinet.com/t5/FortiGate/Technical-Tip-VXLAN-over-IPsec-for-multiple-VLANs-using-software/ta-p/195488

Hi.I wanted to ask you about the following problem I am encountering:I have a Fortigate 80E device with one of the internet outputs via fiber (Wan1). The second is WiMax and it is what we use to give our company's clients free Wifi (Wan2). To access this internet we use an access point connected to port 11 lan.At the same time, we have enabled the VPN connection to the Fortigate through the public IP and a port. If we connect a laptop from which we share the mobile phone's Wi-Fi, we have no problem accessing the VPN, but if we try to use the free internal Wi-Fi internet, access is impossible.The questions are the following: Is it viable to connect via internal open Wi-Fi to the VPN?If so, what additional policies or configuration would we need to create in Fortigate to make this possible?I am waiting for a response. Thanks in advance. All the best. Thank you.

Hi,Version 7.2.6, Events section missing from Log and Report.

HI  Anyone have experience and idea how to configure and process generate CSR at FGT and sign by FAC for internal access in order the webpage won't show warning and address bar show "not secure" ? I did try generate CSR in fortigate and signed by FAC. I did import the local CA from FAC to the end user devices. However, still see the warning and address bar show "not secure"  Appreciate anyone could share the idea and the step i missing I did refer link below as wellhttps://docs.fortinet.com/document/fortiauthenticator/6.5.0/cookbook/628126/fortiauthenticator-as-a-certificate-authority    

Hello https://docs.fortinet.com/document/fortimanager/7.2.0/new-features/47777/fortimanager-supports-authentication-token-for-api-administrators-7-2-2 I'm following above link to configure token authen for api admin in my fortimanager . I 'm trying but always get same  message "{ "id": 2, "result": [ { "status": { "code": -11, "message": "No permission for the resource" }, "url": "\/sys\/status" } ], "session": 48079 }"

Why is tcp port 179 open in firewall even though BGP is not used?Because it is scanned as being open.Is there any way to disable it?

 Hi, I have a FortiGate 30E and connect to a D-Link GS1900 Switch on Port 4 of FortiGate.The default subnet is "lan"(192.168.0.x).I have created two VLANs(192.168.2.x and 192.168.3.x) and both works now (seel below screen shots). I would like to know:1. Interface: For both VLANs, I can choose "lan" or "wan"(connect to the WAN physical port) as the interface.  Can anyone advice me the differences of choosing "lan" or "wan" as interface?2. Any additional routing(static or policy) is required to make sure the two VLANs can go to internet? Thank you.     

Hi Community Members, I am facing issue in generating authorization code for office365 application in azure. I am following official fortisoar documents for O365 connector but their is something wrong with the provided URL, upon providing tenant id and client id its showing error. Can someone pass me the correct URL for generating the code. thanks in advance. FortiSOAR 

My setup is one FortiGate 80F with latest firmware (7.4.1) and lots of services and hosts behind it. I have multiple VLANs that i use for VPN clients. VPN server is separate host and it assigns VLAN to the client. FG acts as DHCP server for VPN clients. Also i use DHCP option 121 to push routes to internal resources depending on VLAN. What i want to achieve is to remove default route from DHCP server or make its metric higher so vpn clients will have only option 121 pushed routes.Now i`m using blackhole route but it doesn`t fullfill my requirements as i still have clients with problems. I use softether as VPN server and clients are windows, linux, mac users using softether protocol and openvpn protocol.Any ideas?