Solved

Hi Community Members, Hope you are doing well. I have a question regarding data ingestion from RSA Netwitness SIEM, we have configured the connector upon running sample playbooks we can see the data of alerts/incident in output of playbook steps. But there is a confusion for taking these data on scheduled interval. As there is no any data ingestion available for this product. Can someone please guide how to retrieve this alerts in SOAR without having data ingestion.

HiFortigate F series is launched last year (2022).I have a project from today to next 5 years.Can Fortigate 80F be "live" in the next 5 years?I need to focus an Branch Office HardWare version that I will sell in the next years to my customer. Any suggestion? Thank you

Dear All, I need your small help today I have created rule to backup of the stack switch which is installed behind the FortiGate Firewall. Everything is correct as per my knowledge, tftp port is also enabled, still not able to establish connection between TFTP server & client. Can anyone has any suggestions on it for me. Thank you. 

I need to change the existing support portal ID to new email ID.I have found a KB article related to same.KB: https://community.fortinet.com/t5/Customer-Service/Customer-Service-Note-How-to-change-the-master-account-ID-email/ta-p/193733But if we do not have the credentials of the OLD email ID to login, how can we change/replace the Old ID to new email ID? Kindly suggest on this.

Dear TeamI would like to understand how to determine the appropriate "Username format" (username@realm or realm\username or realm/username) to use for each NAS (Radius Client).Is this adjustment of the "Username format" based on the Radius protocol or some other information? Please help me clarify what information or examples are needed to make the correct selection for the "Username format". Thank you.

Using Fortigate 6.4.13. I'm looking for the REST API reference but cannot fin it anywhere? Might someone be able to point me to it 

Hello everyone!Is that possible to use a FQDN Wildcard group and a FQDN Group in the same policy as destination? Or each policy needs to have just one of that types?

Hi Community, So I have a question whether this LACP will work or not. I need your views on this also is there any other way on how I can improve this redundancy. I have 2 Cisco Switches (Stacked) acting as a link switch.FGT is in HA (Active and Passive).Here there are 4 ports that are members of a single port-channel in Cisco switch.And whereas in FortiGate there are 2 ports each in LACP.Will it work? Regards,Shailesh 

Hello everyone,I have FortiGate 60D with no firmware installed, I'm trying to load the firmware image using TFTP, but it's failed.Find Bellow the screenshot.Can you help me solve this issue.Best RegardsYounes

Hi,When I run "diag sys flash list" on the firewall, it only shows version 7.0.x.However my current firewall firmware version is 7.2.x.Why is the current firewall firmware version not stored in the harddisk partition?So where has it disappeared to?

Hi Fortinet Gurus,                What are the reasons/use cases Fortimanager need to access LDAP server? If I need to manage user definition and user group management, do i need to allow Fortimanager to access LDAP first? THank you.

In a HA environment, how do I select the secondary firewall and make changes to it (in the GUI)?I dont see any options to control the secondary firewall in the GUI. If the first firewall is active and the second firewall is passive, how to switch it so that first is passive and second is active? In palo alto you can do a switchover. (weather in gui or cli)

Hello All! I am new to Fortinet and was am looking for assistance. My Director would like me to segment our HQ Network so that it is more secure.He wants the following to have their own VLAN:- Accounting (10.8.10.x)-Operations (10.8.20.x)-IT (10.8.30.x)-Executives(10.8.40.x)-"General Data" (10.8.50.x)- Server (10.8.60.x)-Wifi (Easy enough)-VOIP VlanNow,  he wants every VLAN to be segmented from the other with the IT team and an executive (we will call him BOB) to have access to only their own VLAN. Basically he wants BOB to have access to both the accounting and executive VLANs. He also wants a way for everyone in the IT team to be able to access all the other VLANs (to do "IT stuff". Is there any way that we can use the fortigate to limit the internal permissions? Any help is appreciated! 

when i upgrade fortigate ha firewall, the default is that primary fw gets upgraded.How do i change it so that by default the secondary gets upgraded instead?

I know I will lose the config.But will it lose the firmware in which it was recently upgraded?

Hello,some questions, please  1 ) I need know  use case between (limitation, advantage/inconvenience) :                       use GLOBAL ADOM (push to many devices or vdom)                       have many device in ADOM and push same policy package What it is your opinion ?  2 ) maximum number of managed devices for each ADOM, (it is depend  : hardware, license or unlimited) 3 ) What you did think to use fortigate with nat and transparent mode in HA (problem / complexy / limitation)  thank you in advance. 

Hi guys,I'm having an issue with a snat+dnat configuration to an ipsec tunnell on a Fortigate with SD-WAN enabled. Let me explain... that's what I have: an interface, let's call it "PROJECT" with address 10.238.157.1/29an host on that network with IP address 10.238.157.3an ipsec vpn tunnell called "VPN_CUSTOMER"on the other side of the tunnel, this IP: 10.128.0.4/32an IP Pool of type One-to-One and range 172.31.100.3-172.31.100.3 called SNAT-CLIENTa VIP with external IP 10.238.157.204 and IPv4 address 10.128.0.4 called NAT-DC1a policy that allows any service from from the host 10.238.157.3 to the VIP NAT-DC1 using SNAT-CLIENT as NAT IP Poola static route for 10.238.157.128/25 pointing to the VPN tunnel VPN_CUSTOMERSD-WAN enabled on my Fortigate the goal is to snat my host 10.238.157.3 as 172.31.100.3 when communicating with a custiomer's host that has a real ip of 10.128.0.4 without having that particular destination in my rou

I'm a newbie to the Fortinet community.  We have an EMS server that requires the SSL certificate to be renewed.  What would be the pros/cons of using a certificate from our CA vs Let's Encrypt?  If we use the certificate from our CA, does this mean the EMS server cannot receive updates? - JoeyTwinkleToes

Is there any official report on this that comes from Fortinet?I see a lot of people patching but so far no report from Fortinet. Thank you in advance, Evert

Hi everyone, I recently discovered (I must be a newb) that it is possible with two Windows servers to have one be the primary DHCP server and have the second one as a failover in case the primary server goes down so I configured a secondary DC to be the failover DHCP server.  We have multiple VLANs that uses the same DHCP server and the Fortigate is set to relay to the Windows DHCP server. Now that I added a failover, how do I add the address of that new server to also be a relay on the Fortigate's VLAN Interface configuration page? As an example (with fake names and IP addresses):Good old Windows server called: DC1  on IP 10.10.50.1  currently has DHCP role so the relay for every VLAN configured in the Fortigate points to that server.New Windows server called: DC2 on IP 10.10.50.2  has been configured as failover for DC1.  Now if the primary fails, the computers/devices on the different VLANs who would need a IP address need to be able to reach

Hi, I'm trying to configure a LAG on a FortiGate 40F (running on version 6.4.14 at this time (if an upgrade is required that's ok)) for connection to a FortiSwitch S124FP.  I've already configured a LAG on the switch, I just need to get it on the firewall, too. I found a YouTube video showing how to configure a LAG (https://www.youtube.com/watch?v=SGCSu5iXID4), but I seem to run into the immediate problem that all of my numbered ports on the firewall are already configured into a "Hardware switch" and are not available for configuring into the LAG.  The "Hardware switch" will not allow for deletion or removal of all ports, and removing any of the ports from it results in immediate loss of internet connection through the firewall (though I remain able to connect to the web interface). The firewall has 3 normal numbered ports (1-3), a lettered port (A), and a WAN port.  I'm assuming the lettered port is not available for a normal LAG, or at the least not if I als

I added policy routing to FortiGate, but it couldn't enable sla. FortiGate couldn't sense when the network of the next hop changedPOP1 # 配置路由器策略 POP1（策略） # 编辑 1POP1 （1） # 设置输入设备 传入接口名称。输入设备否定 启用/禁用对输入设备匹配的否定。src 源 IP 和掩码 （x.x.x.x/x）。srcaddr 源地址名称。src-negate 启用/禁用否定源地址匹配。dst 目标 IP 和掩码 （x.x.x.x/x）。dstaddr 目标地址名称。dst 否定 启用/禁用否定目标地址匹配。操作 策略路由的操作。协议协议编号 （0 - 255）。网关的网关 IP 地址。输出设备 传出接口名称。tos 服务位模式的类型。tos掩码 服务类型计算位。状态 启用/禁用此策略路由。注释 可选注释。互联网服务标识 目标因特网服务 ID.因特网服务自定义目标因特网服务名称。POP1 （1） # 结束POP1 # 获取系统状态版本： FortiGate-VM64 v7.2.3，build1262，221109 （GA.F)

The client had a single IP from Google Fiber before my company took over support. We installed an 80F, and the "static" is issued by DHCP from Google Fiber on the WAN interface. We have upgraded their Google Fiber account to add 5 static IPs. The statics are in a different subnet.  I am unsure what to do. Very important - if I create VLAN(s) for the static IP(s), what will change for the static IP issued by DHCP over the WAN? All traffic is currently using that DHCP static IP, including VPN. Will that render that IP unusable since it becomes a gateway for the block of static IPs? If the statics require VLAN, what interface? the main LAN or the WAN? What is the Role that I select: LAN? WAN? DMZ? Undefined? Can this be done with VIPs or IP Pools? If IP Pools, what type do I use? One-to-One, Fixed-Port Range, or something else? Here is Google's depiction of the necessary layout for using static IPs.   

Hey guys, I'm trying to make a connection to a VPN via the forticlient CLI in Ubuntu, but I'm not able to make it work, can someone point me to the right direction. I'm running the following command:/opt/forticlient/forticlient-cli epctrl register destination_ip -p portAs stated here CLI support for FortiClient (Linux) | FortiClient 6.2.0 (fortinet.com).But it always gives me the following output in the logs: I would appreciate any help! Thanks! FortiClient

HowdyI have to deal with a very mysterious problem of FortiAP U231F. To start with, I plan to move my U221EV and U231F from WLC to FortiGate. With the U221EV it's no problem at all and with brand new U231F, that were never connected to the WLC will work like a charmBut now there is the point, I have multiple U231F that got to know WLC, when I do the same like with my U221EV, then it "should" work and welcome me in my FortiGate, but sadly it never happens. My procedure is the following:1. WLC CLI to AP2. bootimg imageid 33. When AP is rebooting and for a moment offline, I switch the VLAN (only difference is the DHCP that is linking to FortiGate and not WLC)4. AP boots up and I can authorize it at FortiGate5. Firmware update6. Profit :) This works with all U221EV perfectly, with the brand new U231F it starts from point 4. so no problem at all, too.But with U231F that were once connected to WLC I tried the bootimg, reset-default command via WLC CLI, hard reset via rese