Solved

Q: Which FortiDoc guides do you use for setting up FortiGate VPNs based on digital certificates?

Hello,I have a policy that allows trafic to microsoft related ports (attached image of the policy configured).On the FortiAnalyzer, the logs show that this policy matches with an accept action for ports TCP 49152-65535 that are not allowed on the said policy (attached image of the log on FortiAnalyzer and the Policy Lookup done to verify that the ports are not allowed). Is this a bug on the FortiGate or is this an intended behaviour from the FortiGate?Thanks,Policy LookupFAZ LogFirewall Policy

We have an FG-100F and a 48-port POE switch. We use Fortilink to our 48-port switch, and we create/manage the VLANs through switch under the WiFi & Switch Controller ==> FortiSwitch VLANs on the GUI. Is it possible to group VLANs created on the FortiSwitch into a single Zone in the same way you can group VLANs created on the firewall?

Setup: 2x PAYGO Fortigate in Azure.Front LBA and Back LBA from Azure.Fortianalyzer VM in a VNET Behind the Back LBA.Problem im not able to communicate with the Anayzer. i.E. 192.168.1.100The Fortis have the Adresses 192.168.10.69 and 192.168.10.70The LBA Backend IP 192.168.10.68The VNET of all is 192.168.0.0/16The Route Tables are showing to 192.168.10.69 on the VNet and Subnets.If i do a debug on the forti i can see that SYSLOG Sessions are incomming on the 192.168.10.69 for the Forti 192.168.10.70 and they are not send through the IPSEC Autoscale Tunnel and will be dropped.I have a Fortigate Connected to the FortiAnalyser throught a Azure VPN Gateway. So the Fortianalyzer is basicly working.Any Suggestions?Your help is appriciated

HelloI observe in the GUI version v7.4.0-build2223 (VM FAZ) a problem with the correct handling of CSS. The issue affects browsers with the Chromium engine (Chrome, Edge). I've tried on different computers and the problem persists on all of them. Everything is fine in Firefox.The problem manifests itself in the display of a thick border around the drop-down list controls. It is not possible to expand such a list. Clearing the browser cache doesn't help.I also observed the problem in VM FAZ 7.2.x versionsAnyone have similar? 

want to update my fortigates this evening to latest patch due to the VPN issue we have read about.but my fortimanager only seems to show the previous version of firmware available to push down to the different fortigates, not the most current version with the patch. do we have to manually download the firmware, or is there a way to force fortimanager to updates its firmware list?

Hello everybody,I have trouble configuring the nat46 on the forti 6.4.12I followed the documentation but the problem is not solved.Your help will be very valuable to me.THANKS

Using FortiGate 80F with Fortinet OS 7.4.0. I am configuring dual WAN. I want my primary (WAN1) to be used whenever the health link is alive. My secondary (WAN2) should only be used while WAN1 is down (dead). As soon as WAN1 comes back alive, I want my traffic to be rerouted immediately through WAN1. Again, I always want to use WAN1 when its health is alive. Here is my configuration. Can someone verify it and let me know if something needs to be changed?  config system link-monitor edit "wan1 failover" set addr-mode ipv4 set srcintf "wan1" set server-config default set server-type static set server "8.8.8.8" set protocol ping set gateway-ip 0.0.0.0 set source-ip 0.0.0.0 set interval 3000 set probe-timeout 500 set failtime 3 set recoverytime 3 set probe-count 30 set ha-priority 1 set update-cascade-interface enable se

Community,I have the below:2 fortigate 200F ( HA cluster active active 1st is primary and 2nd is secondary) connected to a core switch with 2 connection each firewall ( 4 connection in total).the issue is when i try to test the HA active active and I remove the forti primary connection with the core switch, I have no access to the secondary forti ( cannot ping over the ip address that I gave for the both 200F).The configuration in the core switch is with port channel (channel group) mode active and in the forti is 802.3ad aggregate.Please Help.Kind regards 

Anyone had try using this sequence group in the firewall policy via numbering order but the number we rearrange from the initial of 1,2,3,4,5,6 to become 1,2,3,5,4,6.Does it follow the top-down approach or sequence id approach in sequence grouping once we rearrange the ID order? 

I`m trying to get the certificate NSE4, but in the training (CBT Nuggets) have a NGFW option in the last version 7.0.10 I made this change without problemsSystem > Settings > NGFW Mode Now, in version 7.0.11 I didnt find this options in the same section, print attached Version 7.0.11Version 7.0.10 Someone can help me? 

Hi all, We've got a user with a mobile token and their phone is no longer working so we've setup another phone for them and thought we could just re-send the activation email for the QR code to activate it on the new mobile but when we go into the user on the router there is no option ? If we edit his account it just shows the serial number of the existing token in grey. We've tried to delete the user off to re-add it but then we get the error above but i cannot find what "other entry" it's linked to ?There is a DRIFT column next to his name that shows a -1 in there but no sure if that's relevant but how do we either get the QR code re-sent so we can activate it on the new phone or delete him off to re-add him?Thanks in advance

Hello friends, I am facing a problem with FortiWeb Cloud because it blocks my ports at the time of DNS record change, I need to allow ports 80, 8081 and 9090 (the latter with HTTPS certificate)The problem is that in the Endpoints module, the option to add more ports is not shownGreetings

Hello- Yesterday we updated our HA 501E pair from 6.0.5 to 6.0.7.  All seemed to be fine, but today, users connected to our SSL VPN tunnel are having Outlook 2016 Connectivity issues.  We have Outlook on-prem and only clients coming in over the SSL VPN full tunnel are having the issue. Outlook sync log keeps generating errors similar to:14:58:32 Synchronizer Version 16.0.11328 14:58:32 Synchronizing Mailbox 'Joe User' 14:58:32 Synchronizing Hierarchy 14:58:33 Synchronizing server changes in folder 'Inbox' 14:58:33 Downloading from server 'd10db7e0-492a-4521-8c0a-fe49225ad443@company.com' 14:58:34 Downloading from server 'd10db7e0-492a-4521-8c0a-fe49225ad443@company.com' 14:58:34 Error synchronizing folder [size="2"]14:58:34 [80040115-514-80040115-0][/size] 14:58:34 Network problems are preventing connection to Microsoft Exchange. 14:58:34 Microsoft Exchange Information Store 14:58:34 For more information on this failure, click the URL below: 14:58:34 https://www.mic

Hello, SITE A : Mikrotik HAP AX2SITE B: Fortigate 60F I successed to create an IPsec tunnel between a Mikrotik HAP AX2 and a Fortigate 60F.I configured the Site A to be in full remote browsing through the Fortigate. Site A connects to internet through Site B Site A have a 600 Mb/s bandwith and Site B 1Gb/s. My issue is: I cannot reach more than 29 Mb/s of download and 5 of Upload with bandwith test from Site A with the Mikrotik. I tried to change/quit encryption methods to see any improvements, without success.I tried to up another tunnel with another AX2 from my house and my 40Mb/s, and I have the exact same bandwith, who made me think of that there is something limitating the bandwith at some point. Anyone could help me to see what would be the issue here?Many thanks !

NULL

Hello: In virtual ip I can see the mappings to the local network devices, the problem is that I see connections from a few hours ago but some devices are not turned on, why could it be? Attached image.Greetings

Hello,I'm still new to FortiNAC,I did configure endpoint compliance schedule rescan each two 2 minutes(For testing), when i disable a specific service on the machine the rescan does not mark the host as At Risk and the verse versa with safe state even in the event it does trigger the scan, when i do a scan host manually it detect the service down or up. My Endpoint Compliance policies as bellow:ECP-AtRisk Host:Security Status:At-Risk And Type : Registered Host or DeviceECP-Rescan-Safe Host:Security Status:Safe And Type : Registered Host or Devicethe Scheduled rescan: Thank you!Regards!

Hi There, When I run the following command :#get log fortianalyzer setting It's return :Status:disable So how to turn it to enable ? On FortiOs v7.0.11 Thanks for the helpKader

how do i removed the resigned staff email from the fortinet renewal notification?

Hi!Cannot update application signatures (apdb) via ftp and tftpISDB and IPS signatures update successfully. FortiOS versions 6.0.6 and 6.0.12. Fortigate 501E(global) # execute restore other-objects ftp ffdb.pkgThis operation will overwrite the current other objects!Do you want to continue? (y/n)yPlease wait...Connect to ftp server ...Get other objects from ftp server OK.(global) # execute restore other-objects ftp apdb.pkgThis operation will overwrite the current other objects!Do you want to continue? (y/n)yPlease wait...Connect to ftp server ...Get other objects from ftp server OK.(global) # diagnose autoupdate versions | grep -A 7 InternetInternet-service Database Apps---------Version: 7.03208Contract Expiry Date: n/aLast Updated using manual update on Tue May 23 12:55:18 2023Last Update Attempt: Fri Mar 18 16:53:14 2022Result: UnauthorizedInternet-service Database Maps---------Version: 7.03208Contract Expiry Date: n/aLast Updated using manual update on Tue May 23 12:55:18 2023L

hii have a network with mikrotik. we are planning to replace mikrotik with fortigate 100F (v7.4.0)now i have:switchtag vlans: 32, 33 to mikrotiktag vlans: 32, 33 to fortigateuntag vlans: 32 to two hoststwo hosts: vlan 32, untag192.168.5.251/24 (gw: 192.168.5.1 - mikrotik) ,192.168.5.252/24 (gw 192.168.5.2 - fortigate) mikrotiktrunk vlans: 32 (192.168.5.1/24), 33 (192.168.20.1/24)fortigate:config system interfaceedit "vlan0032"set vdom "root"set ip 192.168.5.2 255.255.255.0set allowaccess ping https ssh snmp httpset device-identification enableset role lanset snmp-index 38set interface "x2"set vlanid 32next edit "vlan0033"set vdom "root"set ip 192.168.20.2 255.255.255.0set allowaccess ping https ssh snmp http fgfmset device-identification enableset role lanset snmp-index 35set interface "x2"set vlanid 33nextendconfig firewall policyedit 7set name "all"set srcintf "any"set dstintf "any"set action acceptset srcaddr "all"set dstaddr "all"set schedule "always"set service "ALL"set

Hi guys,can someone suggest me how to retrieve device inventory from Fortigate with API ? I am using :https://<IP:port>/api/v2/monitor/user/device/detected-device/?access_token=my token but i's giving me http_status:404 When i try https://<IP:port>/api/v2/monitor/user/?access_token=my token   is showing me the entire directory and it seems working.Fortios version is 7.2.3

In v7.0.7 FortiNet seems to have changed an option: config system antivirus quarantaine FMG now defaults the destination option to disk. Due to this policy package deployment will error out on every device that does support FortiGuard Antivirus but does not have a disk.Come on Fortinet. At least YOU should know that you sell FGT without disks that do not support that. Why then default that option to "disk"?Alas the other available options are "FortiAnalyzer" or "NULL".  In my case I could reset it to FortiAnalyzer since we have one running and all FGT are connected to it.Not sure if "NULL" woud be accepted by the FGT. I did not test it. Thus I had to change that on 20 FGT since its a cli only option in device manger... Just thought I let you know - just if anyone else runs into this issue...

Hi please i have a huge problem.I have an EC2 instance on AWS with IP address 172.31.X.X that I want to communicate with another remote instance of a customer always on AWS with IP address 172.33.X.X through a fortigate IPsec VPN tunnel on both sides else.For the fortigate 1 we have LAN: 172.31.X.Y, WAN: 172.31.Y.Z and the pubilc IPFor the fortigate 2 we have LAN: 172.33.X.Y, WAN: 172.33.Y.Z and the public IPthe vpn tunnel is UP but when I ping from the ec2 172.31.X.X to the remote ec2 172.33.X.X the ping does not go through and when I try to get out of the network I cannot. From the servers we can't ping the internet. Apparently it's a routing problem but I don't know which side.Here is the architecture EC2 ===> Fortigate 1 ===> tunnel ===> Fortigate 2 ===> EC2 But the traffic is blocked internally (between EC2 and Fortigate) and does not go out Please i want some help