Solved

Hi all, I am facing a challenge I am not sure Fortinet has taken into account. I am doing ZeroTouchProvisioning towards my FortiManager, both KVM and VMWare, same issue for both. The thing that is the issue is that the App Signatures in FortiOS are many years old, and once license is Valid, the FortiGate Auto-Links to FortiManager, and the process fails due to us using App IDs not existing on the local FortiGate VM until it has been updated... Is there a way to trigger or force execute update-now before Auto-Link happens? I have tried Automation scripts with no luck. I have also pre-made Disk images that had updated App signatures, but they wont Auto-Link because they are not "untouched" when it comes to the FortiGate configuration.. I can factoryreset-shutdown the Disk Image, but that also erases the App Signatures I loaded, ie back to square one..  Any ideas anyone??

Has anyone successfully created an IPSec VPN tunnel between a FG on a Sierra Wireless XR80/90? I've created a tunnel, routes, and policies successfully, but can't get communication across the tunnel.Tried Sierra Wireless's documentation too, with no success.https://source.sierrawireless.com/airlinkos/XR80-4.1/reference/networking/howto/vpn/Like I said, the tunnel is up, but can NOT get traffic to flow across.

Hello, we have the following constellation: Location 1 -> Fortigate 200Location 2 -> Fortigate 200IPSEC VPN between for routing traffic from vlan 72 location 1 to vlan 73 location 2  This works well.Now our colleagues want to use ssl vpn from home to get also access to vlan 72 in location one and vlan 73 in location two. I configured ssl vpn on location 1 fortigate and it works for getting access to vlan 72. I also setup a policy to vlan 73 but didn't worked so far.  Any idea or is this technically not possible and I need to configure a second ssl vpn on location 2 firewall? Thanks for you help :)

Hello, community.I need to get the actual number of analytics days displayed in these places. Can I get this value via CLI or JSON API? (no matter which form: days, hours, minutes or seconds)#Fortianalyzer

Hi guys, i set up SSL vpn from fortigate to our AWS setup. we have 2 AWS accounts and i am able to reach resources in one account without any issues but not the other one. All the config is the same across both accounts. on prem wifi is also going through fortigate and through that both AWS accounts are reachable and i am using the same LAN link as incoming interface for SSL vpn.  any ideas of what could be the problem? thanks

Friends, how about a question?This fortinet link indicates that it is at the top of the “magic quadrant of Network Firewalls” https://www.fortinet.com/lat/solutions/gartner-network-firewallsIs that information updated or is it current information from 2023? since it indicates 2022.or where I can find the current information, to know if it is still at the top.

Hi All,We have a Hardware Switch set up on our HA pair of 200F units on 7.0.12. We have Ports 1-8 assigned to the HS, but we only currently use Port 1. I would like to change the HS to only be assigned to Ports 1-4 so I can reuse 5-6 for a second HS.What I have not been able to find an answer to is, if I remove ports 5-8 from the existing HS, will it cause any outage to the connection on Port 1 when I click OK?Thanks!

Hello to all,I've configured a load balancing between 2 interfaces, by setting one to 62% and the other to 38% of the internet trafic. But it does not seem to work well, indeed I notice that the traffic is not shared as configured above.I use a Fortigate 200D, Firmware version: v5.4.1, build1064 (GA).I would like to know how to fix this problem please.Your help will be very appreciated.

How can I ensure that I also see notifications in FortiAnalyzer, such as blocked websites from the FortiClient connected to a FortiEMS?

If you forget the password into the firewall.Or if you forget the ip address to go inIs there any way to retrieve the running configuration without factory resetting it?

Suppose the jitter and latency is in the red but the packet loss is 0,under what circumstances will the firewall declare the link down and remove static route from the routing table?I configured the SLA by the way. My users are video streaming and the latency and jitter of wan 1 and wan 2 is high, although the packet loss is 0.Will the links be declared dead? 

Hey, How can I upload a custom connector to the content hub? Awni

Hi All, I am planning to enable heuristic scan option in antivirus setting. I have gone through document where it says I need to enable it like,configure antivirus heuristic set mode block For higher models,config antivirus quarantineset drop heuristic  But I don't find these options in my FortiGate firewall. We have 1100E and running 7.0.12 firmware. Do I need to enable something to configure antivirus heuristic scan?  

We have a setup where we connect to our Azure resources using a Site2site IPSec VPN connection, which works as expected.  However, once my clients connects from Forticlient using SSLVPN, traffic does not get routed to Azure.I have created Firewall rules that allow traffic from SSLVPN to Azure remote IP addresses.SSLVPN splitmode is disabled, as I want all traffic over my VPN. SSLVPN Clients can connect to LAN and WAN resources.SSLVPN clients cannot connect to Azure resources.   If someone can point me into any direction, it would be very appreciated.  

I am using FortiNAC Rest APIs to fetch list of hosts using endpoint "/api/v2/host" I am following this documentation https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/b0dca655-7aec-11ec-a0d0-fa163e15d75b/FortiNAC_REST_Schema_9.2_%281%29.pdf But i am not sure about how to use filter query param or what will be its format. My intention is to bring all the NOT ROGUE devices. Can someone help me with the same?

Hi AllI have manged to setup a windows native VPN connection to my FortiGate and also gain internet access via the VPN which is all great. However I was hoping by unticking  "use default gateway on remote network" on the windows VPN interface it would then allow me to browse the internet and access local resources on the LAN I am connecting from. Unfortunately this does give me local internet and resource access back but I lose connection to the remote LAN behind the FortiGate VPN. Is it possible to have access to both via the windows VPN client? I hope that makes sense and many thanks for your help Kind Regards Speedy

According to this thread https://www.wmlcloud.com/internet-protocols/problem-can-fortigate-automatically-update-dns-records/   .....it doesn't, and explains the problems I'm having. I have a thread below in which I complain about devices not being able to resolve via hostname with a fortigate 200D handling DHCP and DNS. We were blaming it initially on the devices, but since this is the same behavior as the thread linked above.....well.... I downloaded a freeware DHCP / DNS server and had no problems resolving local DNS hostnames via DHCP. So, the problem isn't the devices.   I would appreciate some confirmation on this, because if our 200D doesn't support a basic DHCP / DNS functionality like this then we will be looking for an alternate product. Note our 200D is still on 5.4.1.....possible this issue has been patched?

Hey guys!I'm new to FortiGate with Central SNAT and I'm administering a FortiGate 500E firewall - FortiOS v6.4.13 build2092 (GA) - which today has a private network 10.xxx.0.0/22 accessing the Internet with a public IP address of 200.xxx.xxx .37 all working fine. But a new demand came up for me to create a subnet 10.xxx.3.0/24 to use as a guest network and access the internet with another public IP address like 200.xxx.xxx.38/28. I am not able to create the necessary rules in Central SNAT to allow this, at the moment all subnets are accessing the internet only with the firewall interface IP which is 200.xxx.xxx.37/28. Can anyone help me with some tips? Or would anyone know how to indicate a document that addresses a solution for this for me to study?Thank you very much in advance.

Configured IPSEc vpn on fortiagte 100(v6.0.3 build0200). When user connects using forticlient, i am able to access the lan resources behing fortigate but i am unable to use local LAN and also want local internet traffic should not go through the tunnel.

Hi:I have a Fortigate 40F setup in office  with its WAN conencted to the interent on a public IP  , LAN connect to office LAN network 10.61.x.x network I and followed this guide, https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-establish-VPN-connection-between-Windows-10/ta-p/200001 I created a VPN: dialup - Windows (Native L2TP/IPsec) using VPN wizard， which the connection is working on my laptop from home. I am able to ping LAN devices in office, however, there is no internet . I would like access internet thru office LAN network via the ipsec tunnel, is that possible ? Thanks

Hi allI have the following configuration:site A and site B, both with 2 wan connections, connected to each other via 4 ipsec tunnels (A1<->B1, A2<->B1, A1<->B2, A2<->B2)on each tunnel I have the same phases2 and the same routes, the latter with different distances.the 4 VPN interfaces are grouped in one zone on both sides.Now I need to rotate all the traffic coming from a specific IP from office B and directed towards a specific IP in office A through a specific IPsec tunnel (for example A1<->B2)in addition to the fw rules to allow traffic, I also created a route policy, but the traffic continues to pass through the tunnel with the minimum distance routeany hint to improve and/or debug the issue? is there I'd be aware of and that I'm clearly ignoring?Thank you in advance

FortiGate 200B v5.0 GA Patch 2 Previous version you could right click a policy and select move above or below and you could enter a existing policy to move it where you wanted. Any idea on how to this now in version 5 Patch 2??? Trying to get a new policy in place for our new phone system so any help with this would greatly appreciated.

After upgrading to FortiOS 7.4, I am getting a notification to migrate the configuration when logging in with GUI. Is it necessary? What does it affect?

Hi Team, We have deployed fortigate in Active/Active in GCP between 2 load balancers (external & internal).We are facing issue in ingress traffic, in External LB both Forti-VM is healthy.When user from the internet try to hit external IP of External LB, traffic is not hitting to FOrti-VMs.

hello,I have questions regarding SD-WAN Config. I have two WAN interface from two different ISP (ISP1 (as main, subnet 176.x.x.x) and ISP2 (as backup, 96.x.x.x subnet). They are combined in SDWAN, ant there is SLA which check if ISP1 is OK, if not switch to ISP2.Question 1When ISP1 is down, all incomming connections to our services will be down  quickly, or sessions must expire to allow new sessions to be  up again using ISP2 ??  If yes, how long it takes in default ?  From ISP1 we bought IP public pool (88.x.x.x), and this pool is regitered in RIPE for us, and our partners can use these IPs to access to our services in DMZ, but when ISP1 is down, no possible for our partners to connect. Question 2.If his pool is registerd for us shouldn't be possible to connect from outside by ISP2 to our resoures???  Thanks