Solved

Can someone advise how to config FortiGate to save 90 days logs history or to config limit for log size (up to 1GB log size)?the FortiGate logs history we need are Forward Traffic and System Events 

Hello,I have a #Fortigate 100F with v7.0.12 and I have a issue with VPNSSL + Azure SAMLI configured it in others Fortigate with no problem, but in the last i can't connect with Forticlient, it stops in 40% when i try to connect.I have enabled debug and i see this error:__samld_sp_login_resp [842]: Failed to process response message. ret=-111(Failed to verify signature.)samld_send_common_reply [114]: Code: 1, id: 576, data_len: 56samld_send_common_reply [122]: Attr: 21, 8,samld_send_common_reply [122]: Attr: 22, 32, Failed to verify signature. Can someone helps me to find the problem? Thanks, regards 

Is this possible... the only information I can find states "user groups".I have this part working by using FSSO for users and groups but cannot find a way of adding a policy for 1 user unless i create a new AD group on my domain and add that group to the policy.  

I want to check the current sttatic of disk-usage in fortigate VM. My Fortigate Vm running on VMWare have 2 disks: Disk SYSTEM (20.0GiB) and Disk Virtual-Disk(80.0GiB)I tried the deviceinfo command above, but the static is confuse. How can I check the total disk-usage?

Hello,when I login to fortigate using firefox from the same network as the FW then it works.When I try to login from a machine that is non another network ( also other port on the FW) then I get an authentication error. I even copied the firefox profile from the machine where it works to the other.There is another firewall inbetween, but 443 and 80 are open.Areother ports needed or does the default configuration limit the login from other networks? GreetingsAndreas 

Hi, Recently I upgraded FG401E firmware to 7.2.5.But i tried to connect SSH via FGT CLI, it had this error. FGT-FW1# exec ssh usercisco@192.168.0.234Unable to negotiate with 192.168.0.234: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1 Anyone had this issue before?

I download the FortiGate VM in FortiCloud - Download - FortiGate - KVM platform, but the file is .out format file. How to install once we download the .out format file? I am not sure how to convert .out format file to private image. This is for the purpose to install in Huawei Cloud.   

Hello, Hope you are doing great! I got stuck in my lab  with integrating fortinac and fortigate vm evaluation unlicensed mode, when i add fortigate device it does not show virtualized tab i suspect that because of modeling device type when i click on "set device mapping" it does show only Fortinet, and i can not make any change in it.Fortigate version 7.0.1FortiNAC version 9.2.6.0451   Regards! @ebilcari 

Hello, I would like to do the equivalent of# config vpn ssl settings(settings) # set servercert MyCert(settings) # endIn REST APIIn other terms, change the certificate via API I would like to know which API call to use. Right now I'm able to push MyCert on the Fortigate via API. Thank you 

I need to SPAN mirror all of my Fortigate 101F ports/VLANs out to a single interface for an IDS that works on passive network monitoring. I had seen that SPAN mirroring is supported, but I am horribly disappointed at its actual functionality. I have tried from both GUI and CLI, but it seems that the SPAN configurations only allow the monitoring of a single port at a time. Is there no way to mirror multiple source ports out of a single port? Or better yet, mirror entire VLANs out of a single port, as would be configurable on a standard Cisco switch? Thank you

Hello,   How to configure FortiAuthenticator to be RADIUS Client to the RADIUS Server running on AuthLogics ?   Thank you

This issue is similar to Article Id:261221.On FortiOS 7.2.4 ,SSL-vpn with vne-tunnel is worked.But after upgrade to 7.2.5(FortiOS v7.2.5 build1517), ssl-vpn port doesn't answer to any request.* FortiClient or Browser request was reached to FG,(the request packet caputerd on the vne.root ,But FortiGate doesn't answerd.)

I am trying to use the internal management interface on a standalone FortiSwitch. How would I configure this for a static IP?   The basic scenario is a FortiSwitch connected to a Cisco switch acting as the Core.  VLAN 1 is native on the uplinks, VLAN 15 is user, VLAN 20 is phone, and VLAN 10 for the management IP.  All of the gateways live on the Core.   As per the documentation, it looks like you need to add a VLAN interface and select the internal interface as the device. This would be done after setting the internal interface's IP. Not sure what the exact purpose of the VLAN interface is, except maybe to point a its IP as the next hop for a static route off the core.  When I try to create one without an ip (0.0.0.0 0.0.0.0) it gives an error. I am also given an error if I try to make the native VLAN of the internal interface the same as the VLAN interface.  I have attempted setting it up just like the physical mgmt interface would be, with an ip and sta

It is possible to monitor the number of active sessions through a specific policy using SNMP?   Like its shown in the fortiview.       I couldn't find the right OID in the MIB file.    The finaI result is to to take an alert if the session count falls in an specifict policy

I have OnPrem office enviroment with office laptops, a WiFi Router and a Fortigate 40F Firewall. I want the Firewall logs to be ingested into LimaCharlie.   I have figured out that I can send Syslog to a virtual machine running Ubuntu with a LimaCharlie Adapter installed, which then can foward the data to LimaCharlie. Is this the best method of doing it?The data from FortiGate 40F to the virtual machine is not encrypted, is it? How can I encrypt it?  

Can I foward Syslog with the FortiGate 40F firewall?

Dear All, I have few queries which are as follows:- 1. Why do we assign WAN IP Pool instead of exit WAN interface to our email server.2. Let say we have two ISP1 & ISP2 .ISP1 range is (192.168.99.0/28) and ISP2 range is (193.168.99.0/29)ISP1 exit interface IPs are - 192.168.99.2 (customer end) and 192.168.99.1 is ISP1 end similarly ISP2 exit interface IPs are - 193.168.99.2 (customer end) and 193.168.99.1 is ISP2 end My concern is why do we not use exit interface for email communication. please refer the attached snapshot.  Thank you   

I am looking to configure 2 GRE Tunnels with Zscaler for my internet traffic on a forti 7.4 cluster. If i understand this correctly i have to configure a GRE Interface , assign tunnel end IPs , add route towards GRE Tunnel. But how do i setup 2 GRE Tunnels in Active/Passive mode ? does both of them are setup with Port1 and different remote end endpoints ? how is the switchover handled in case say GRE1 tunnel fails ?  any help is appreciated.

I realize that in some other brands of firewall, you have to press commit or save before changes are deployed.Can fortigate NOT deploy its changes unless a commit or save button is pressed?I think it is better to safeguard and preview changes. 

I have a user who is trying to run 3D CAD sessions over the SSLVPN. Yes, I know this is a terrible idea, and yes, he's been told. However. He is insisting that sessions initiated with SAML are slower and less responsive than are sessions authorized with a RADIUS connection to a NPS server that uses the Azure MFA plugin. I don't understand how this is possible. Is it possible? If so, how should I proceed, seeing as how we're using the free SSLVPN client?

I have an active-passive cluster of FG-201Fs running 7.2.5. On each member I have a Aggregate interface composed of two 10G X interfaces, with VLAN interfaces defined on the Aggregat When I look at SNMP counters for one particular interface, it is not accumulating any counts for any of the parameters. I've manually pulled the SNMP values for this interface and they remain at zero. If I create a Traffic graph for the interface on a Dashboard, the graph remains at zero over time. Meanwhile an apparently identically defined VLAN interface on the same aggregate is showing traffic accumulations and generating traffic graphs in a credible way. I am 99.999% sure traffic is passing across this VLAN, if I do a "di sniff packet any..." it will show packets traversing the VLAN, Aggregate, and physical X interfaces. I've tried manually changing the snmp-id of the interface, but that hasn't worked. Any idea what I've done wrong?

Dear all, I hope ur doing well, i need your help for understand something. I have a Windows server Forti EMS 7.2.1, and i used a fortimanager for download signature AV, vulnerabilty...My fortiguard signature information is update. I have forticlient EMS 7.0.9 deployed on endpoint, and i would like to know if Forticlient on endpoint can download signature from Forti EMS or there is only 2 ways (from internet or from fortimanager).If its possible i would like to know where can i configure it. Thanks for your help ! 

Hi all, I am facing a challenge I am not sure Fortinet has taken into account. I am doing ZeroTouchProvisioning towards my FortiManager, both KVM and VMWare, same issue for both. The thing that is the issue is that the App Signatures in FortiOS are many years old, and once license is Valid, the FortiGate Auto-Links to FortiManager, and the process fails due to us using App IDs not existing on the local FortiGate VM until it has been updated... Is there a way to trigger or force execute update-now before Auto-Link happens? I have tried Automation scripts with no luck. I have also pre-made Disk images that had updated App signatures, but they wont Auto-Link because they are not "untouched" when it comes to the FortiGate configuration.. I can factoryreset-shutdown the Disk Image, but that also erases the App Signatures I loaded, ie back to square one..  Any ideas anyone??

Has anyone successfully created an IPSec VPN tunnel between a FG on a Sierra Wireless XR80/90? I've created a tunnel, routes, and policies successfully, but can't get communication across the tunnel.Tried Sierra Wireless's documentation too, with no success.https://source.sierrawireless.com/airlinkos/XR80-4.1/reference/networking/howto/vpn/Like I said, the tunnel is up, but can NOT get traffic to flow across.

Hello, we have the following constellation: Location 1 -> Fortigate 200Location 2 -> Fortigate 200IPSEC VPN between for routing traffic from vlan 72 location 1 to vlan 73 location 2  This works well.Now our colleagues want to use ssl vpn from home to get also access to vlan 72 in location one and vlan 73 in location two. I configured ssl vpn on location 1 fortigate and it works for getting access to vlan 72. I also setup a policy to vlan 73 but didn't worked so far.  Any idea or is this technically not possible and I need to configure a second ssl vpn on location 2 firewall? Thanks for you help :)