Solved

Hello, I have a problem with ssl-vpn, it is very slow, I don't know whyCan anyone guide me?

We're using the script below to backup our FortiGates, but it creates only one backup file name. We'd like to keep the last 5 backups, which we can manage with a cron job. How do we append the time date/timestamp to the script? We'd like to ensure the backup files are encrypted, so is there a way to encrypt the files? We'd also like to be notified if the backups were successful or not, so is there a way to incorporate this? Thank you. Step 1:config system automation-triggeredit "Backup"set trigger-type scheduledset trigger-frequency daily <----- Frequency of the action.set trigger-hour 23 <----- Hour of the triggered action.set trigger-minute 58 <----- Minute of the triggered action.nextendStep 2:config system automation-actionedit "Backup"set action-type cli-scriptset minimum-interval 0 <----- Limit execution to no more than once in this interval (in seconds).! set delay 0 <-----Delay before execution (in seconds).! set required enableset script "execute backu

Hi,  I need to monitor fortiguard licenses through zabbix, is there any way?

Can someone advise how to config FortiGate to save 90 days logs history or to config limit for log size (up to 1GB log size)?the FortiGate logs history we need are Forward Traffic and System Events 

Hello,I have a #Fortigate 100F with v7.0.12 and I have a issue with VPNSSL + Azure SAMLI configured it in others Fortigate with no problem, but in the last i can't connect with Forticlient, it stops in 40% when i try to connect.I have enabled debug and i see this error:__samld_sp_login_resp [842]: Failed to process response message. ret=-111(Failed to verify signature.)samld_send_common_reply [114]: Code: 1, id: 576, data_len: 56samld_send_common_reply [122]: Attr: 21, 8,samld_send_common_reply [122]: Attr: 22, 32, Failed to verify signature. Can someone helps me to find the problem? Thanks, regards 

Is this possible... the only information I can find states "user groups".I have this part working by using FSSO for users and groups but cannot find a way of adding a policy for 1 user unless i create a new AD group on my domain and add that group to the policy.  

I want to check the current sttatic of disk-usage in fortigate VM. My Fortigate Vm running on VMWare have 2 disks: Disk SYSTEM (20.0GiB) and Disk Virtual-Disk(80.0GiB)I tried the deviceinfo command above, but the static is confuse. How can I check the total disk-usage?

Hello,when I login to fortigate using firefox from the same network as the FW then it works.When I try to login from a machine that is non another network ( also other port on the FW) then I get an authentication error. I even copied the firefox profile from the machine where it works to the other.There is another firewall inbetween, but 443 and 80 are open.Areother ports needed or does the default configuration limit the login from other networks? GreetingsAndreas 

Hi, Recently I upgraded FG401E firmware to 7.2.5.But i tried to connect SSH via FGT CLI, it had this error. FGT-FW1# exec ssh usercisco@192.168.0.234Unable to negotiate with 192.168.0.234: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1 Anyone had this issue before?

I download the FortiGate VM in FortiCloud - Download - FortiGate - KVM platform, but the file is .out format file. How to install once we download the .out format file? I am not sure how to convert .out format file to private image. This is for the purpose to install in Huawei Cloud.   

Hello, Hope you are doing great! I got stuck in my lab  with integrating fortinac and fortigate vm evaluation unlicensed mode, when i add fortigate device it does not show virtualized tab i suspect that because of modeling device type when i click on "set device mapping" it does show only Fortinet, and i can not make any change in it.Fortigate version 7.0.1FortiNAC version 9.2.6.0451   Regards! @ebilcari 

Hello, I would like to do the equivalent of# config vpn ssl settings(settings) # set servercert MyCert(settings) # endIn REST APIIn other terms, change the certificate via API I would like to know which API call to use. Right now I'm able to push MyCert on the Fortigate via API. Thank you 

I need to SPAN mirror all of my Fortigate 101F ports/VLANs out to a single interface for an IDS that works on passive network monitoring. I had seen that SPAN mirroring is supported, but I am horribly disappointed at its actual functionality. I have tried from both GUI and CLI, but it seems that the SPAN configurations only allow the monitoring of a single port at a time. Is there no way to mirror multiple source ports out of a single port? Or better yet, mirror entire VLANs out of a single port, as would be configurable on a standard Cisco switch? Thank you

Hello,   How to configure FortiAuthenticator to be RADIUS Client to the RADIUS Server running on AuthLogics ?   Thank you

This issue is similar to Article Id:261221.On FortiOS 7.2.4 ,SSL-vpn with vne-tunnel is worked.But after upgrade to 7.2.5(FortiOS v7.2.5 build1517), ssl-vpn port doesn't answer to any request.* FortiClient or Browser request was reached to FG,(the request packet caputerd on the vne.root ,But FortiGate doesn't answerd.)

I am trying to use the internal management interface on a standalone FortiSwitch. How would I configure this for a static IP?   The basic scenario is a FortiSwitch connected to a Cisco switch acting as the Core.  VLAN 1 is native on the uplinks, VLAN 15 is user, VLAN 20 is phone, and VLAN 10 for the management IP.  All of the gateways live on the Core.   As per the documentation, it looks like you need to add a VLAN interface and select the internal interface as the device. This would be done after setting the internal interface's IP. Not sure what the exact purpose of the VLAN interface is, except maybe to point a its IP as the next hop for a static route off the core.  When I try to create one without an ip (0.0.0.0 0.0.0.0) it gives an error. I am also given an error if I try to make the native VLAN of the internal interface the same as the VLAN interface.  I have attempted setting it up just like the physical mgmt interface would be, with an ip and sta

It is possible to monitor the number of active sessions through a specific policy using SNMP?   Like its shown in the fortiview.       I couldn't find the right OID in the MIB file.    The finaI result is to to take an alert if the session count falls in an specifict policy

I have OnPrem office enviroment with office laptops, a WiFi Router and a Fortigate 40F Firewall. I want the Firewall logs to be ingested into LimaCharlie.   I have figured out that I can send Syslog to a virtual machine running Ubuntu with a LimaCharlie Adapter installed, which then can foward the data to LimaCharlie. Is this the best method of doing it?The data from FortiGate 40F to the virtual machine is not encrypted, is it? How can I encrypt it?  

Can I foward Syslog with the FortiGate 40F firewall?

Dear All, I have few queries which are as follows:- 1. Why do we assign WAN IP Pool instead of exit WAN interface to our email server.2. Let say we have two ISP1 & ISP2 .ISP1 range is (192.168.99.0/28) and ISP2 range is (193.168.99.0/29)ISP1 exit interface IPs are - 192.168.99.2 (customer end) and 192.168.99.1 is ISP1 end similarly ISP2 exit interface IPs are - 193.168.99.2 (customer end) and 193.168.99.1 is ISP2 end My concern is why do we not use exit interface for email communication. please refer the attached snapshot.  Thank you   

I am looking to configure 2 GRE Tunnels with Zscaler for my internet traffic on a forti 7.4 cluster. If i understand this correctly i have to configure a GRE Interface , assign tunnel end IPs , add route towards GRE Tunnel. But how do i setup 2 GRE Tunnels in Active/Passive mode ? does both of them are setup with Port1 and different remote end endpoints ? how is the switchover handled in case say GRE1 tunnel fails ?  any help is appreciated.

I realize that in some other brands of firewall, you have to press commit or save before changes are deployed.Can fortigate NOT deploy its changes unless a commit or save button is pressed?I think it is better to safeguard and preview changes. 

I have a user who is trying to run 3D CAD sessions over the SSLVPN. Yes, I know this is a terrible idea, and yes, he's been told. However. He is insisting that sessions initiated with SAML are slower and less responsive than are sessions authorized with a RADIUS connection to a NPS server that uses the Azure MFA plugin. I don't understand how this is possible. Is it possible? If so, how should I proceed, seeing as how we're using the free SSLVPN client?

I have an active-passive cluster of FG-201Fs running 7.2.5. On each member I have a Aggregate interface composed of two 10G X interfaces, with VLAN interfaces defined on the Aggregat When I look at SNMP counters for one particular interface, it is not accumulating any counts for any of the parameters. I've manually pulled the SNMP values for this interface and they remain at zero. If I create a Traffic graph for the interface on a Dashboard, the graph remains at zero over time. Meanwhile an apparently identically defined VLAN interface on the same aggregate is showing traffic accumulations and generating traffic graphs in a credible way. I am 99.999% sure traffic is passing across this VLAN, if I do a "di sniff packet any..." it will show packets traversing the VLAN, Aggregate, and physical X interfaces. I've tried manually changing the snmp-id of the interface, but that hasn't worked. Any idea what I've done wrong?

Dear all, I hope ur doing well, i need your help for understand something. I have a Windows server Forti EMS 7.2.1, and i used a fortimanager for download signature AV, vulnerabilty...My fortiguard signature information is update. I have forticlient EMS 7.0.9 deployed on endpoint, and i would like to know if Forticlient on endpoint can download signature from Forti EMS or there is only 2 ways (from internet or from fortimanager).If its possible i would like to know where can i configure it. Thanks for your help !