Solved

Hi Fortinet Community,Would like to ask if we can do FortiSIEM installation in Oracle Cloud Infrastructure.I wasn't able to find documentation for this, like AWS (cloud) installation. 

For seven hours in my logs I have entries "Fortigate idsurldb signature is missing or invalid."Does anyone have a similar problem ?The rest of the updates download correctlyFortigate 60F on 7.2 fw

I am trying to create new static routes in my FG100F, but it seems like I cannot select some addresses eg subnets i have already created in my Address list.seems like they are hidden.firmware for the FG100F is 7.2.5 subnets in addresses

Hello,  I just set up my first Foritgate unit, a Fortigate 40F running firmware v6.4.6 build 6083, a few days ago, and was poking around the GUI today to change settings to better suit the best practices shown in the documentation. I changed some settings on a firewall policy I made, and clicked "OK" to save, then I noticed that the policy I had edited was showing a peach highlight around it. I tried searching the forum but could not find anybody who had asked the same question. What does a peach or peach orange highlight mean for a firewall policy in the GUI?  Here is a screenshot showing what I experienced: 

How can I set up a DMZ for the Fortigate VM we are running in Azure?Currently we only have 2 ports (LAN and WAN). 

Does anyone have ldaps working with windows server 2019?  I'm running version 6.4.12 and had LDAPS working with windows 2016 without any issues and my server admin upgraded our DC to server 2019 and broke the ldaps connection from the fortigate.  I have unsecured port 389 working but can't get 636 to work.  With the previous configuration we we're using certificates we just had the secure option checked and it was working but now it won't work at all the the option.  I've tried using certificates by downloaded our CA from our certificate store to the gates and selecting the certificates on the configuration and still nothing. 

HelloIs it possible to change the default Fortinet-Factory Cert to my company wildcard cert?Some browsers can not process to portal it said "Your connection is not private" 

Hello everyone,When I upgrade my Ha clusters "fortigate appliance" I have downtime twice for about 40/30 sec.The ha is configured as active-passive.I am using gui to start the upgrade process from fortimanager.Is that normal behaviour? Kind regards,Homan

Hello everyone  I hope you can support me: I added a page in the web filter menu, in the static url filter-enable url filter section, only that people can still see the web page, what should I do so that they do not really have access to that site? The appliance that I have is a Fortigate 60D. Thank you very much for your support

We are using FortiClient ZTNA 7.0.8 with FortiClient EMS. We have experienced sometimes bugs were FortiClient gets unresponsive and only a restart of FortiClient or the notebook works.In the FortiClient EMS System Profile users are allowed to shutdown the client. But when trying to shutdown the client on windows, the users are asked for adminstrator credentials. Is there any possibility to shutdown or restart the FortClient ZTNA without administrative privileges? Kind regards

I have fortiauthenticator 7.2.1.It is setup with with an ldap server and using SAML as an IDP.  When I go to the portal page to test my authentication from the moment I enter my username/password and press enter I only get 5 seconds to respond to my MFA prompt. Is there some way I can adjust this setting?At least with fortigate I set remoteauthtimeout in the system global settings.

Hi allI have three scenarios I need to figure out with prefix lists...and I just need someone to confirm that I am not totally wrong about my approach :) Scenario 1:I receive about 1'000 prefixes (including the default gateway of 0.0.0.0/0) and I want a route-map as preparation if I need to configure something special down the road.In order to accept everything from my neighbor I would have used the following prefix-list:config router prefix-list edit "accepteverything" config rule edit 1 set prefix any unset ge unset le next end next endWould I be wrong with that? Scenario 2:Now that I have those 1'000 prefixes including the default gateway of 0.0.0.0/0 I would like to forward everything BUT the default route to another neighbor.To achieve that I would have used the following prefix-list:config router prefix-list edit "blockrule" config rule edit 1

Recently FortiAnalyzer menu stopped working, I tried to use different browser/computers restart the fortianalyzer.  nothing working, it seems it's a new update or something that broke it.  Cannot also log out because the profile menu is not working. anyone facing the same issue?

We need to migrate our VMs from Hyper-V to VMware.To do this, I have already downloaded the VMware image and created new VMs for it (which now have a trial licence).I can download the configuration as a backup and import it into the new VMs.However, I would have to shut down the existing VMs before importing the backup into the new VMs (because of the IPs).What I haven't quite understood yet is the issue of the licence.How do I transfer the licence from the existing VMs to the new ones?

Hi all I have three scenarios I need to figure out with prefix lists...and I just need someone to confirm that I am not totally wrong about my approach :) Scenario 1:I receive about 1'000 prefixes (including the default gateway of 0.0.0.0/0) and I want a route-map as preparation if I need to configure something special down the road.In order to accept everything from my neighbor I would have used the following prefix-list:config router prefix-list edit "accepteverything" config rule edit 1 set prefix any unset ge unset le next end next endWould I be wrong with that? Scenario 2:Now that I have those 1'000 prefixes including the default gateway of 0.0.0.0/0. I would like to forward everything BUT the default route to another neighbor.To achieve that I would have used the following prefix-list:config router prefix-list edit "blockrule" config rule edit 1

Hello DearsI am trying to imeplemnt that , when user try to reach server the traffic would forward based on url rather than IP address as show in exmple : www.FG1.com ->> 192.168.1.1www.FG2.com ->> 192.168.1.2 both domains FG1 and FG2 would use the same public ip for exmple 1.1.1.1 and tcp port 443any advise about that ?

Hi, I'm trying to configure Forticlient with multiple remote gateways for redundancy but when I add a second remote gateway the custom port option dissapear... This is the example with one remote gateway and a custom port 4443, no problem here, it works:  But when I add a second one:It seems ok, format is https://x.x.x.x:portbut if I click save and connect, not work. If I edit this, the port automatically changed to 443.If I try to change the port and save not works, always save 443 as custom port after :I updated the Forticlient to latest 6.4.10 and not work. Anyone has this issue? Can you help me to configure two remote gateways in Forticlient? Thanks in advance.        

Hi, wonder anyone had encountered this before? I had checked everywhere for solutions or help, but not much information. Fortigate firmware is 7.0.6We had configured the Tacacs+ in fgt but could not communicate with the Tacacs+ server.We follow the guide, FGT 7.0.6 > Administration Guide > TACACS+ servers.

Good morning friends, do you know why the fortigate does not show logs of the AV?For the other security profiles it shows me logs but for the AV it does not show anything, as in the image:In addition, my policies have the AV profile enabled  Currently my device fortigate has version 7.2.5 In the FAZ I cannot find the AV option since the AV is not found within the security events option.

friends,is it necessary in the vpn ssl policies to add the IPS profiles y full inspection? Since currently I only have certificate inspection enabled and AV MONITOR mode. Should IPS, WEB FILTER or APP CONTROL also be added in IPSEC tunnels?Since currently I only have certificate inspection enabled and AV MONITOR mode. I do not want my equipment to enter conservation mode, it is better to be safe.

I have Thousands of IPs trying to access my fortigate using RDP, some china, russia, usa, how can i bulk block the IPS and only allow just a few that I know to access RDP.

Hi All,To give some context, I am having challenges running the two FGTs in HA due to WAN IP limitation with my cloud provider (I intended to run the two FGTs in 2 different datacenters to set up HA but my CSP requires i move the WAN IP manually between the DCs during HA failover which results to a downtime of close to 5 minutes or more which beats the logic of having the FGTs in HA).My main goal is to at least have two firewalls with different  WAN IPs running on different DCs both serving as gateways for the same resources/VMs and then set-up 2 SSL VPN gateways which I will deploy to users' FortiClient such that whenever one FGT is down, they can connect to the secondary VPN gateway and continue accessing internal resources.I know this is a **bleep**ty set-up but I just want a failover mechanism at least for SSL VPN. I don't care much about about IPsec VPN and I am willing to manually update the configurations? Do you think this is possible to achieve? I would appreciate yo

We have a multi site network with a central Fortigate wireless controller. The AP's are under a single AP profile. The SSID's are in tunnel mode. The Fortigate is on version 7.0.10 and the AP's are on v7.0-build0108. Some of the AP's randomly stop letting clients authenticate. The only way to get them working again is to remove the AP from the AP Group and then re-add it back in again. The clients can then instantly connect. I can see repeated authentication requests and responses in the AP logs: request from wireless station" sn="FP221E5519056432" ap="WHCW-AP-01" vap="WHL-Net" ssid="WHL-Network" radioid=1 user="N/A" stamac="7c:f6:66:8c:fa:b9" channel=1 security="WPA2 Personal" encryption="AES" action="auth-req" reason="Reserved 0" msg="AP received authentication request frame from client 7c:f6:66:8c:fa:b9" remotewtptime="3304.691751"response to wireless station" sn="FP221E5519056432" ap="WHCW-AP-01" vap="WHL-Net" ssid="WHL-Network" radioid=1 user="N/A" stamac="7c:f6:66:

HiI have big doubt.I don't know when I activate Fortigate Cloud on my Fortigate Firewall can I manage device via cli or via local LAN?Or, is it locked and I must manage it only by Cloud enviroment?Thank you

Hello, I have fortigate installed in Azure and Mikrotik on our On-prem datacenter. I would like to configure IPSec over GRE VPN between them. Phase 1 is establishing without problem, but Phase 2 doesn't go up. I use this article: https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/799752/gre-over-ipsec Here is Azure fortigate configuration: config vpn ipsec phase1-interfaceedit "gre-tunnel1"set interface "port1"set peertype anyset net-device disableset proposal aes256-sha512set dhgrp 14set remote-gw 178.54.*.*set psksecret ****** config vpn ipsec phase2-interfaceedit "gre-tunnel1"set phase1name "gre-tunnel1"set proposal aes256-sha512set dhgrp 14set protocol 47set keylifeseconds 28800 edit "gre-tunnel1"set vdom "root"set ip 10.225.252.1 255.255.255.255set type tunnelset remote-ip 10.225.252.2 255.255.255.252set snmp-index 7set interface "port1" config system gre-tunneledit "gre-to-rem"set interface "gre-tunnel1"set remote-gw 10.225.252.2s