Solved

I newly implemented sd wan. My sdwan has only 1 WAN interface. I remove the previous static route configured on the wan interface. I put a new static route for the sdwan interface. Now i cannot ping or https from the wan interface. Why? 

I am just playing with a 40F and have only console access…I have followed various suggestions on how to configure lan2 with an ip address and mask/gateway but constantly get errors….  should I be editing lan2 or port2… any help appreciated…

I am looking to migrate from Palo Alto 3020-HA to Forti 600f-HA. we currently use Panorama and will now be using FortiManager.We only use Panorama for objects and polices, no device templates...This is my plan... remove 3020 from Panorama and import all objects and policies.(already done)export config to xml. (already done)send xml for conversion,load returned config onto 600Fcreate HA pair.join to fortimanager with required settings... also.. is this a one off..   as in if it goes a bit wrong we are scuppered...do we get more than one attempt???any advice would be greatly appreciated. 

Hello Experts, I'm interested in RFC 2544 testing as it pertains to Fortigate VMs. Specifically, I'd like to understand Fortigate's approach to throughput testing. They provide online throughput figures for their VMs and mention details like server specifications, memory, CPU, and SRIOV enablement.  My inquiry is whether Fortigate employs a tool like FortiTester to determine these throughput numbers. If they do, I'd like to know their recommendations for conducting RFC 2544 tests for throughput. For instance, should there be a delay between each iteration? For example, when testing different frame sizes like 64, 128, 512, and 1528 bytes, should there be a pause between each frame size, such as waiting for a few seconds after the 64-byte test before proceeding to the next frame size? If such delays are recommended, what is the suggested duration for these pauses?

Meaning he gets the local ip address but he has no internet access.What can be done to resolve this issue?

Hi Community Member, I have a requirement of 150 days data retention policy. 30 days should be online and 120 day on archive. I am getting little bit confuse in FortiSIEM documentation.There are two types of retention policy (archival retention policy and online retention policy), we have configured data storage (online and archive) on NFS server. If I set data retention to 30 days in online retention policy, what will fortiSIEM will do after 30 days ? will it move data to archive or it will delete the data ? Thanks in advance.

Hello, I just upgraded my Fortigate 60F to version 7.4.1 from 7.4.0 and my traffic shaping configuration disappeared, I tried to create a new one but after I click OK it is not saved, all the traffic shaping configuration including services and applications that I entered are not saved . Can you help me with this problem?

A client we help has a small office, one Windows Server, and a FortiGate. The server has some DNS Server problems. Would it be possible and wise to turn uninstall the Windows Server DNS and to instead use the FortiGate for DNS? What are the advantages and disadvantages of the Windows Server acting as DNS server vs. the FortiGate acting as DNS server?

Buen día,Necesito saber a nivel de fortigate cual es el Algoritmo utilizado para la encriptación de la información que viaja por la SSL VPN,dónde puedo sacar la información

I am currently provisioning a FortiGate 7.0 VM HA cluster in the Google Cloud (through the GCP image). Now our organizational policy requires OS Login to be enabled. This results in a high number of users managed by the Google IAM to be imported as "prof_admin" into the machine. Is there a possibility to disable the OS login feature on the Fortigate directly so that the GCP does not manage the users on the VM? I realized that I myself am "super_admin". Is that because I am the creator of the VM? In general, who gets the "super_admin" role? Is there some documentation on how the FortiGate VM image integrates into the GCP? Thanks in advance.

hello,I have this situation:I have two links from two diferent ISP (let's say ISP_A (fast) and ISP_B (slower)), and from ISP_A i have Public IP pool, we are using one IP from this pool to provide one application available from outside (by configuring VIP).Is SD-WAN we have rule in general saying that if ISP_A is down or bad SLA use ISP_B Our partenr is using VIP address to access to or resource from Their site. Question:):1.If ISP_A is  down , will be possible to access from Partner site using VIP(pool from ISP_A) but on link from ISP_B ??Thanks 

Hi all, I have an SSID using 802.1x authentication and would like to configure a secondary RADIUS server for redundancy. However it seems like I can only select one server. Any ideas how can I configure this? Thanks.  

We are using Web filtering in EMS. Is there a way to get a report of where someone click pass the warning about a bad site? 

Hi guys, How can I use the set variable value in a playbook I created in a different playbook?

if one of my sdwan links goes down, I want an alert sent to my email or phone.Can this be done?

Hi All,FortiGate 60E [FortiOS v7.2.5 build1517]I don't see VPN logs. Why isit so and where I can enable VPn logging. 

Hi team,    I am kind of a stuck in a situation. I was accessing the fortinet dashboard board the DDNS with Letsencrypt SSL. I had setup a port forwarding to one my server through port 443 and 22. I didn't realise the ports were also used for the web admin and ssh. Now when I am trying to access the web admin and SSH the requests are being forwarded to the server. Is there anyway I can change the port or there's no other way apart from resetting the device? I do have a backup file, but not sure how to even restore that.    Thanks!

Hi i need to configure two wan port on Fortinet 40 F , like a aggregation each wan port can see mac adress for each other  to build my failover Solution  Br Alain 

Hello.  I have some test switches (248E-FPOE).  I put them into standalone mode (factory reset and then reconfigured).  Some of the switches are on 7.2.1 and others on 7.2.4.  The switches are connected to each other, and only each other.  There are no redundant links.   The problem is that about every three or so hours the switches cpu load spikes to ~90% for 20 or 30 minutes and then goes back down.  I tried disconnecting on of the switches from the others, and it still is doing this.  Looking at the logs, they just seem to spike and them cpu utilization logs get generated.   Not sure what might be causing this?  I'll look into one more thing tomorrow, but I have my doubts.  Was curious if anyone has ran into anything similar.   **Note: Only having this issue after putting them in standalone mode.

Hello, sorry for my english, i use google trad Is it possible to have a SSL VPN with Azure SAML SSO authentication and at the same time a captive portal on a VLAN with Azure SAML SSO authentication ? With 2 different Azure groups for authentication.   material: Fortigate 100FFirmware: v7.0.12 build0523 (Mature)Best regards, 

Hi All! I have problem as title.Follows illustration is current situation and work fine.And unit test of addition network as follows illustration, (Reference: https://getlabsdone.com/how-to-configure-dmz-on-the-fortigate-firewall )Ping/FTP access from Client(20.0.2.118) to FTP Server(10.1.0.2) @ FileZilla work fine.Both merged as follows illustration..And I added static route @ EdgeRouter 4 as followsset protocols static route 10.1.0.0/24 next-hop 10.0.2.16 description 'Intranet to DMZ' set protocols static route 10.1.0.0/24 next-hop 10.0.2.16 distance 253 Ping from Client (20.0.2.118) to FTP Server(10.1.0.2) work fine.$ping 10.1.0.2 PING 10.1.0.2 (10.1.0.2) 56(84) bytes of data. 64 bytes from 10.1.0.2: icmp_seq=1 ttl=127 time=0.770 ms 64 bytes from 10.1.0.2: icmp_seq=2 ttl=127 time=0.498 ms But FTP won't work @ FileZilla as follows.Status:   Connecting to 10.1.0.2:21... Status:   Connection established, waiting for welcome message...Netstat

I have a site to site VPN between an on-prem FortiGate 500E and a vFortiGate in Azure.Due to the distance between the FortiGates geographically, I’m trying out Forward Error Correction (FEC) ingress and egress on both FortiGates to see if it can improve on lost UDP traffic (main issue, missing RADIUS packages). To use FEC on VPN, Fortinets dokumentation note that NPU acceleration has to be disabled on the Phase1.This has been done on the FGT500E as it can use NPU. The vFGT in Azure does not.  I’m seeing ESP errors in my VPN event log.As FEC re-transmit some packeges, this makes sence to me, as an ESP packet with a sequence number could be re-transmitted.  Ofcause, I could deaktivere anti-replay on phase2 and the events would go away.The official documentation that I have looket at, at docs.fortinet.com does not say anything about that ESP errors is a side-effect of enabling the feature.  I guess my question is, am I missing something? I find it a bit

Just wondering, as I did not want to just assume things, but had 2 questions as it relates to new threats/vulnerabilities and using IPS to mitigate against.1. If an IPS profile is created via filter, will any new signature, updated from the subscription, that matches to said filter, automatically also apply? eg... if I have a filter based on macOS, is a new signature that is macOS applicable, dynamically applied as well since it is a dynamic filter (again, sounds logical, but don't want to assume)?2. What is the normal turn-around for new vulnerabilities to then be turned around into IPS signatures from FortiGuard for the database to be updated? eg... Apple has some new vulnerabilities (CVE-2023-41064, CVE-2023-41061) that was disclosed yesterday (but CVE was created back on the 22nd of last month). FortiGuard has nothing about those on their website as of yet.

in a typical network with 500 workstations. I configured my FG 401F to work with my LDAP for authentication and at the same time explored the FSSO functionality while LDAP is still present. Now, if the workstation will authenticate which method it will use LDAP or FSSO? Which method will take precedence first?    

Good Evening,I was hoping to get some advice on how to best complete a project. Being pointed to KBAs and resources would be incredibly helpful as well. This is what I have outlined so far. Summary of RequirementsI have a website hosted on Amazon Web Services (AWS), and would like to protect its admin panel by placing it behind a Fortinet FortiGate firewall. I want to restrict access to the admin panel so that it is only accessible via a FortiClient VPN. I specifically want the full feature set that a FortiGate firewall can offer.I was thinking of spinning up a Fortigate EC2 instance that will let me use all the features of a normal fortigate, specifically so I can set up VPN access from machines to be able to access the site's admin panel. High-level Steps:Deploy FortiGate VM on AWSConfigure FortiGate Firewall RulesSet up FortiClient VPNRoute Admin Panel Traffic through FortiGate VM This was my plan:1. Deploy FortiGate VM on AWS(For this is there a Fortigate Product alr