Solved

My setup is one FortiGate 80F with latest firmware (7.4.1) and lots of services and hosts behind it. I have multiple VLANs that i use for VPN clients. VPN server is separate host and it assigns VLAN to the client. FG acts as DHCP server for VPN clients. Also i use DHCP option 121 to push routes to internal resources depending on VLAN. What i want to achieve is to remove default route from DHCP server or make its metric higher so vpn clients will have only option 121 pushed routes.Now i`m using blackhole route but it doesn`t fullfill my requirements as i still have clients with problems. I use softether as VPN server and clients are windows, linux, mac users using softether protocol and openvpn protocol.Any ideas?

I have purcashed a Fortigate 40F firewall that I have onprem.I want the log to be stored in a Google Cloud PostgreSQL database. What is the best method of doing this?  |----------------------|                |-------------------------------------|                      |------------------|| FortiGate F40F | --- ?? --> | Google Cloud  Functions? | ----- SQL ---> | PostgreSQL ||----------------------|                |-------------------------------------|                      |------------------| 

HelloFGT 1801F with FOS 7.0.12.Please see the below output and confirm if this is a conserve/extreme mode condition, knowing that at the same time my FGT started to reject sessions.In case the below is conserve mode condition, what can be the reasons for which a FortiGate doesn''t log that the system has entered conserve mode? # get system performance status...Memory: 24719900k total, 12677632k used (51.3%), 1229868k free (5.0%), 10812400k freeable (43.7%)... # diagnose hardware sysinfo memoryMemTotal: 24719900 kBMemFree: 1228440 kBMemAvailable: 14488404 kBBuffers: 821188 kBCached: 12821328 kBSwapCached: 0 kBActive: 14187032 kBInactive: 1372760 kBActive(anon): 2216820 kBInactive(anon): 58332 kBActive(file): 11970212 kBInactive(file): 1314428 kBUnevictable: 241912 kBMlocked: 0 kBSwapTotal: 0 kBSwapFree: 0 kBDirty: 2720 kBWriteback: 0 kBAnonPages: 2160024 kBMapped: 252804 kBShmem: 124376 kBSlab: 3250364 kBSReclaimable: 428828 kBSUnreclaim: 2821536 kBKernelStack: 6768 kBPageTabl

Hi,since i updated to 7.4.0 the "Interface Pair View" isn't ordered by the source "interface", it is now very hard to find something. Do i missed something? How can i change the order in that view? Kind regardsStefan 

Hello, I'm new to FG. I have a problem:I have a Fg 60F router. My client set up an SSL VPN connection for me. He also has some FG. Unfortunately, when you try to run it, the following message appears in the appendix. Error appearing at 10% load. solution in another network where the router is Mikrotik and it works.Please advise what I need to set in my FG to make it work. 

Hello everyone,Due to running out of addresses in the old subnet allocated for the server farm, I have created a new subnet in the same VLAN and placed it on the same port as the old subnet.I am encountering an issue where I can't ping or connect from subnet A to subnet B and vice versa.When I run a tracert from a server in the old subnet A to a server in the new subnet B, the packets are going out to the internet via the WAN interface.  Please help me . Thank you very much !

Hello,We're dealing with a significant spam issue, and we're considering implementing more strict AntiSpam profile settings like SPF, DKIM, and DMARC. However, I'm concerned that these changes might have a substantial impact by potentially sending legitimate emails to quarantine.I'm wondering if there's a way for us to assess how well incoming emails align with these rules before we make any changes. For example, if FortiMAIL processed 10,000 messages today and SPF Fail was activated, resulting in all 10,000 messages being sent to quarantine, I'd like to know how many messages would be affected if SPF SoftFail were activated too.Is there a way to generate a statistics report that can help us gauge the potential impact of implementing these AntiSpam profile changes before we actually go ahead with them?Thank you for your assistance.

Hello team!!! Recently a Fortinet engineer told me that performance SLA are not considered if there are not explicit rule including them, so I wonder how to create a Load balance, using both WANs in the SD-WAN, taking care about the bandwith of each wan.For example, I have the following:WAN1: 100 Mbps / 100 Mbps of bandwithWAN2: 50 Mbps / 50 Mbps of bandwithIn this case I would like to have about the double amount of sessions in WAN1 than in WAN2, and also I would like that if some link has about 3% of packet loss or more, this link will not be used.Is this possible? Thanks in advance.Regards,Damián

Hello all,we have a /28 subnet which is provided to us by our ISP. From this we can use 11 addresses.I have created this network as a physical interface with the "secondary IP Address" option.The first address as IP/Netmask in the interface and the others in the table below. But now I want to use VPN only on the first address. This blocks me now on all other addresses the port. Or am I not following best practice for the WAN connection with multiple fixed IP addresses?We are currently moving from an Sophos UTM to Fortinet and many things have been implemented differently here.

Hello Team, when the client tries to reach a specific url "http://fqdn:9999", in the log I see that the FQDN is resolved with the ip 208.91.112.55 (fortinet block page).If I try to ping the FQDN from the fortigate cli, the ip that is resolved is correct but from the client it is 208.91.112.55. Any suggestion? Thanks for the support

Hello,   I'm noticing a strange behavior of the firewall, and therefore also from the windows machine behind, when I try to resolve the FQDN that is published on my connection. let me explain better:   1)if I try to resolve the FQDN from the firewall the resolution is not the public ip but 192.168.178.101 which is the IP of the firewall point towards the router 2)if I run an nslookup of the same FQDN from the windows machine behind the firewall the resolution is the ip of the windows machine3)if I ping from the router on the same FQDN I finally have the public IP as the resolution, which is the same as the WAN router interface as it is it that sends the updates to the dynamic DNS The dns configured on both firewall,router and windows is 8.8.8.8 and 8.8.4.4 Anyone knows why i have this behavior and how to figure it out? BR, G

We recently re-implemented alerting for admin logins and logouts on a FortiGate that currently isn't deployed - the firewall is mostsly for testing a few capabilities and features before rolling them out to the other firewalls. The problem is that localhost is logging into the firewall, and in the past 8 hours, it's logged in 18 times - anywhere from a few minutes to 45 minutes. This makes the admin login alerting useless.   FortiGates are running 7.2.5 and FortiManager is running 7.2.4. Is there a way to prevent alerts from going out when being logged in from 127.0.0.1?   Thanks

What and how to configure for default gateway if wan uses Dynamic ip? I cannot use a static IP address. Any help is appreciated. 

Is this possible?The end user is changing firewall of a different model.He wants to retain the same fortidyndns name in the new firewall - also fortigate.He does not want the user to change the vpn login because the fortidyndns changes.

Hello FortiExperts,  Is there any table or rule to know for a FortiGate appliance or virtual machine, How many DNS Zones and Domains entries can we fit in? Can FortiGate work as a datacenter DNS with hundreds of thousands of entries?  Is there a reference documentation we can check?      

Hello, We have a fortigate 60D Rugged. https://support.fortinet.com/Information/DownloadProductPDF.ashx?pid=980&name=FortiGate-Rugged-60D Product is in version 6.0.17 and affected by vulnerabity : PSIRT Advisories | FortiGuard Will be there any security update to correct this vulnerability and vulnerabity to come until  15 jully 2026 ? Product Life Cycle MilestonesEnd of Orders (EOO) 15Jul2021Last date to purchase new maintenance contract 15Jul2021Last date to extend an existing maintenance contract 15Jul2025Product support expires 15Jul2026 Regards,Damien

i'm trying to download system events logs using bash curl and getting authentication errorcurl -u 'fortigate_user:fortigate_pass'  'https://<fortigate ip address>/api/v2/log/memory/event/system/raw' --compressed --insecure and getting following authentication error:<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>401 Unauthorized</title></head><body><h1>Unauthorized</h1><p>This server could not verify that youare authorized to access the documentrequested. Either you supplied the wrongcredentials (e.g., bad password), or yourbrowser doesn't understand how to supplythe credentials required.</p><p>Additionally, a 401 Unauthorizederror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html> how can we passthrough the API login for curl command (-u 'fortigate_user:fortigate_pass' ) in order to download the log? no

Hi All, I had found the CPU threshold and its alert but for the memory.I had found a few but did not understand this trigger event in the automation for memory. Automation > Triggermemory conserve mode entered memory conserve mode exitedWhat is this 2 event log and what does it do? And for the below threshold percentage, once we had configured it. How do we set the email alert under the automation for IF the memory threshold hit 50% and email alert.I using this guide: https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/194558 config system global set memory-use-threshold-extreme <integer> set memory-use-threshold-green <integer> set memory-use-threshold-red <integer> end   

Good DayI have a Fortigate 40F and I wish to understand a few elements as shown in the screenshot.I have executed an execute factoryreset and no other changes.I can see in the output below interfaces that correspond to the physical interfaces I see on the box.These are the lan1, lan2, lan3, a and wan interfaces. These all are physical copper ports on the device.the wan interface has DHCP in by default and has gained an IP address as the port is connected to a Starlink unit.Q1 What is the "lan" interface? I see that type = hard-switch. Maybe this represents an internal L3 interface?Q2 What is the relation between the "lan" "hard-switch" and the physical ports mentioned above i.e. lan1, lan2, lan3, a? Can it be these are by default L2 ports in the same L2 domain on the hard-switch? Presumably if so the static address 192.168.1.99/24 is part of the default config? Any comments to disambiguate appreciatedThanks

Hello, Does FortiNAC support ldap group based authentication for fortigate without using the tag for remote access vpn?. Only Radius simple authentication. Thank you.Regards!@ebilcari FortiNAC 

Hi all,I have a FortiGate-VM version 7.4.0 running on VMware and there are two disks are allocated to this vm 20560MB/sda and 81920MB/sdb as show below:The virtual disk is 80GiB, but the actual size used for log currently only "30107" as show below:Now I want to set the storage size from 30GiB to full disk allocated size is 80GiB. I have seen some article related but in my version 7.4.0 those command is unavailable. Please show me some guide or command line to set the storage size.Thanks!*Related article: Technical Note: How to extend the disk space for l... - Fortinet CommunityFortigate - Show Current disk usage static. - Fortinet Community -> staff gave me this but the links not available 

Hello, One of our customers migrate from 5.2.10 to 5.4.4.After this migration, packets with SYN+ECN+CWR flags set were silently drops by the Firewall.In order to solve this issue, we had to disable ECN congestion on the client.https://ask.wireshark.org/questions/32067/many-many-tcp-out-of-order-dup-acks-and-retransmissionsNetsh interface tcp set global ecncapability=disabled Is it a known issue with Fortigate FW ??Any command to disable this check ?? Regards, HA   

Hello, Is it advisable to use MGMT port as one of the heartbeat interfaces for HA (on FGT-200F, for example)? I remember reading somewhere Fortinet recommending NOT to use MGMT interface for general traffic, but what about HA?Cheers,Slavko

Hello Guys,We are experiencing an issue with the SMTP connector.When we deployed FortiSOAR, we encountered an error stating "failed to install python libraries". This situation occurs because we did not provide an internet connection to the machine. We have also attached an image for same. To install the required Python libraries, we executed the following command: "sudo -u nginx /opt/cyops-workflow/.env/bin/pip install ansible --extra-index-url https://repo.fortisoar.fortinet.com/prod/connectors/deps/simple." After running this command, we received the following message:  After completing the deployment, we searched for the SMTP connector in the Content Hub but were unable to locate it in either the Manage tab or the Discover tab. Please advise on how to resolve this issue?

Good morning, I have a forti 60F and for a few days I have been experiencing problems with the firewall policies, they worked well and now I have to create groups without any security profile so that they can access the internet, the problems are permanent, could you help me try to discover what's going on? Firmware: v7.0.12 build0523 (Mature) Another thing I noticed is that even though dhcp assigned me an IP to a machine, on devices it still shows me the old IP. An the CLi Console shows me connection lost. Thank you so much