Solved

We are trying to figure out how to backup several FortiGates over an IPsec S2S tunnel, but I can't figure out how to source the backup alerts from the inside interface. Can someone provide some pointers on how to accomplish this? Thanks

Hello,Is there way to upgrade or downgrade a firmware on 124E Model network switch without having the switch configured on the network/internet? Like via serial or usb cables, TeraTerm or PuTTY etc…? If yes, please share a procedure or steps ASAP? Any help is greatly appreciated.

Hello Community, i need help with double nat please. Fortigate 100F SSL VPN Our Costumer cannot access our network through his Forti VPN client. The connection stops at 10%. After investigations, the ISP informed us that they are using a double nat. My question, what do I need to set on the Forticlient or Fortigate so that the VPN connection works. I had never had such a case.Thank you for your help

Hello.Regarding:https://community.fortinet.com/t5/FortiWeb/Outbreak-Alert-HTTP-2-Rapid-Reset-Attack-and-Mitigation/ta-p/278958 Topic is about "HTTP/2", so question is, if some service isnt using HTTP/2 scheme, then is it vuln?Please see attached screenshot example? 

Hi Guys, I have a problem after update my FGT 200E to 7.4.1, my SAML auth was operating normally, now I can't loggin to administrate firewall, I already did a new configuration on FGT and Azure but I receive the same error. "AADSTS7500525: There was an XML error in the SAML message at line 1, position 503. Verify that the XML content of the SAML messages conforms to the SAML protocol specifications." Someone also had this error and know how to fix it ? Tks

Hello,I'm trying to collect (through the json-rpc api) the firewall service objects that match     ["tcp-portrange", "==", ["443", "80"]]     and     ["udp-portrange", "==",["53"]]    . How can I use the "&&" operator to combine those two filtering conditions. The doc isn't so clear to me. I tried many things including this   { "method": "get", "params": [ { "filter": [ ["tcp-portrange", "==",["443", "80"]], "&&", ["udp-portrange", "==",["53"]] ], "url": "/pm/config/adom/ADOM-DC-FR-1/obj/firewall/service/custom" } ], "session": "{{session}}", "id": "1" }​   still having code -11 @ohole

Hello, guys! Some few weeks after upgrading my 80F to fortiOS 7.4 the web gui page for firewall policy stopped loading. Any ideas?  Thanks!

New to Fortinet, so please bear with me. I have a new Forti network environment managed by a FortiGate (7.0.12) and have trouble setting up a standalone switch (7.4). I do not want this switch managed by the FG at all. When I initially set up this switch, I set it up as managed, but when I realized that configuration wouldn't work I set it up as a standalone. This switch does appear in in FG managed Fortiswitches. Each time I connect this switch to its uplink, that port goes from displaying my native vlan to displaying the name of the switch. (The native vlan is not set to data.fortilink.) When I hover over the name it shows "Dedicated to connect to peer FortiSwitch." I can't ping the switch once connected to the network. After disconnecting the uplink and waiting for a few minutes, the native vlan changes from switch name back to my original native vlan. I've tried resetting via the recessed button several times, all to no avail. When I configure as standalone, the swit

Is packet capture COMPLETELY unavailable on the fortigate unless you purchase the model that embeds an SSD? Such as the 60F vs 61F. This is a native feature available on practically all other firewalls and switches, whether or not they have dedicated storage. And when I refer to packet capture, it's where you choose the filter and logging parameters to log packets for troubleshooting etc. In my experience, it's usually a couple hundred rows that you really need, not GBs.   If not, can you add a USB stick to say the 60F and enable logging? This would be in reference to the later firmware v7.

I have a Fortigate for a customer where the appliance DNS is configured to external servers and a DNS Database pointing to the internal domain servers The problem I'm running into is I want to point the firewall LDAP to an internal server using its hostname (not IP), but the firewall's internal DNS resolution seems to bypass the DNS database, so it can't resolve the internal names correctly. (i.e. hostname.domain.internal fails to resolve) [not the real domain] Is there a way around this that doesn't involve pointing DNS directly to the internal servers?  I want to be able to keep using the firewall as a DNS Proxy to external server in case internal DNS is down THanks in advance for you replies 

Hi All,   I am suffering by the trunk port crash when two trunk ports plugged between Forigate and Fortiswitch   Environment: I am using 1x Fortigate 80F, 1x Fortiswitch 124F-POE and 6x FortiAP 431F.   The cable connections are below: a. 6x FortiAPs are connected with 124F (Port 1 - 6) with PoE enabled b. 80F is connecting with 124F as below:      i) Fortilink Ports: 80F dedicate Ports (a and b) connect to 124F (23 and 24 Ports)      ii) Trunk Ports: 80F (Port 5 and 6 ) connect to 124F (21 and 22 Ports)   The trunk port configured as:      i) MC-LAG: disabled      ii) Mode: Static      iii) Enabled Features: Edge Port and Spanning Tree Protocol   When I configured the trunk port and plug two cables to the port, all the port in the switch crashed, because I cannot ping the gateway in 80F as well as the FortiAP will lost the configuration and failed connect with wireless devices (no S

Hi, i'm using a 100E in my homeoffice and for the children i have created a few proxy policies with URL filter whitelists with different schedules. For example: 19:00 - 16:00 minimal internet access16:00 - 18:00 allowed web pages and youtube18:00 - 19:00 allowed internet access without youtube All had woked perfect with 7.2.3 and now it seems that the scheduling has stopped working. Now after updating to 7.2.4, it was 16:05 and youtube should work, but in the log i see that youtube was blocked because of a policy which had a schedule from 18:00 to 19:00. I disabled all other policies except the one for youtube access and then the policy was used. Has here something changed in the design or is this a bug?  

Adding a new 600F v7.2.5 to FortiManager v7.2.0 gets Probe Failed when using Add Device.Ran debug on both 600F and ForitManger.Only evidence of any error in either debug is the following on the 600F. FGFMs: SSLv3/TLS read server certificate requestFGFMs: SSLv3/TLS read server certificateFGFMs: Remote issuer is /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=support/emailAddress=support@fortinet.com.FGFMs: issuer matching...try next if not match... localissuer(fortinet-subca2001), remoteissuer(support)FGFMs: need change local cert to ISSUER[support]FGFMs: reload cert at client sideISSUER [/C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=support/emailAddress=support@fortinet.com]FGFMs: TLSv1.3 read server certificate verifyFGFMs: SSLv3/TLS read finishedFGFMs: SSLv3/TLS write change cipher specFGFMs: SSLv3/TLS write client certificate The debug shows that the FortiManager attempts three times before giving up.

Currently our Fortigate is connected to an Access Port on our Core Switch tagged with VLAN 4000. The Core Switch has all our Virtual Interferfaces configured on it with no restrictions on what VLANs can see/access other VLANs. The core switch has a static route "ip route-static 0.0.0.0 0.0.0.0 10.255.254.254" where 10.255.254.254 is the IP Address of the Fortgate port (Port 4) connected to the Access Port on the Core Switch The ultimate goal is to move all Virtual Interfaces to the Fortigate se we can start doing segementation. For now I just want to add a new VLAN/VLAN Interface to the Fortigate so I can segment that.     - I created the new VLAN / VLAN Interface under Port 4 on the Fortigate (VLAN 210)      - I created a new trunk port on the Core Switch that looks like this          interface GigabitEthernet4/0/24            port link-mode bridge      &nb

Hello I want to connect to fortiguard using ha-mgmt-interface. Is it possible?? When I tested it, it went to the interface set to default routing rather than ha-mgmt-interface.(I also enabled ha-direct.) Please let me know if this is possible.And if possible, please tell me how. Thanks.

Hi,Any tips or documentation for fine tuning the fortiSIEM rules/incident alert?Trying to improve or add fine tuned rules / incident alerts we are getting from the fortiSIEM. Thank you.

Hello team, I have a problem with matching a policy.The policy in question is:the policy logs (one is an example of a correct match and the 'other of a wrong match)I can't figure out why they don't both match the same policy.Thanks for the support

On one laptop everything is working fine. But on a service laptop we have the following issue:Connection is working fine but the bytes send and received stay on 0.When I check the "Fortinet SSL VPN" adapter under IPv4 config the static IP address remains empty.On the working computer this gets filled in automatically. Only debug and info lines in the log, already removed and reinstalled the software couple of times.

hello experts! i want to configure a site-to-site VPN between 2 sites. Site "A" has 2 ISP links and here I want to create 2 redundant IPSec tunnels with site "B".so the problem is that site "B" has only 1 wan link and site "A" has 2 wan links. As shown above image. so how can i configure any help would be appreciated thanks. ipsec

When create users from LDAP server (in my case, Microsoft AD server), the ID (username on Fortigate) of created user is actually "display name" of this user in AD. The request is to change the username on Fortigate from this display name to "sAMAccountName" or "userPrincipalName". Is it possible? And how?  

Hello team,   I would like to know whether sample-rate is supported by NetFlow or only by sFlow.   Thanks in advance

Hi Everyone My firewall's installed zone cannot connect to the internet, causing a system event log entry with the message 'FortiGate update now failed' every 2 minutes. And Licenses information status Pending always.Is there a way to solve this problem?   Firewall OS ver. 7.2.2 Thank You FortiGate  

Good morning friends, a question. Could you please help me with this query, because that message appears "Unable to connect to fortiguard servers" In firewall v7.0.12 we are using the DNS of the ISP provider and no drops are observed. There is no latency The licenses are in UP and expire in 2024.   What could be happening? thanks for your comments  

Hello, I have deployed Fortimanager in Azure Infrastructure. As I see it automatically applied 1TB disk. What is the purpose of this disk? Just for logs?  Because right now my Fortimanager has 2 disk:1 - OS disk - Size is 4gb2 - Data disk - Size iz 1TB 

We have upgraded our EMS server to 7.2.2 build 0879.After that we upgraded few of our FortiClient to 7.2.2.0864. The result:- all our FortiClient endpoints with 7.0.9 receive the ZTNA destinations and create successfully the virtual hosts in the Windows \drivers\etc\hosts file.- all our FortiClient endpoints with 7.2.2 did not change anything in the hosts file. Also the features status in the EMS console for that clients says: "ZTNA enabled (hidden)", although there is no such setting in the assigned profile. The user do not see the "ZTNA destinations" tab on the client side. How may I change the behavior of the 7.2.2 client, so it can use the ZTNA as intended?