Solved

Hi,I have an IPsec connection set up from AWS to Fortigate.In AWS, there's a private subnet containing various services, including EC2 instances.Within my Fortinet, there are two networks - a DMZ network and an internal network, and they can communicate with the EC2 instances without any issues.However, I'm currently facing a challenge: I want to enable internet access for the EC2 instances through the IPsec connection, following this path:EC2 ===> Fortigate 1 ===> InternetTo achieve this, I've configured the AWS route table to have a route with destination 0.0.0.0/0 pointing to the virtual private gateway (VGW) to handle internet-bound traffic.On the Fortigate side, I've implemented two policies. The first policy is to allow traffic from the WAN to AWS IPsec, and the second policy is to allow traffic from AWS IPsec to the WAN.Unfortunately, despite these configurations, the setup isn't functioning as expected. When capturing traffic on the Fortigate, the results show:1 0.000000

We are having issues with the file name(length) in our FTP server is there a way to rename or modify the config file so that we can enable auto-backups. Thank you.   

Hello,  I want to allow push updates for my Fortimail. Problem is i cannot add FortiGuard servers as a Source for incomming direction. Has anyone encountered this? Am i getting it wrong? Thank you. 

Yesterday I've updated my LAB FortiAP (W2, 223E) to Version 7.0.6.First Update to 7.0.5 -> FortiManager shows FP223E-v7.0-build0078 -> expectedSecond Update to 7.0.6 -> FortiManager shows FP223E-v7.0-build0068 -> quiet unexpected? I thought I've made a mistake during updating, downloaded Image "FAP_223E-v700-build0108-FORTINET.out" and tried to update directly by the AP GUI -> same issue? Double Check:I've edited Firmware Image by an Editor and the file header shows "FP223E-7.00-AP-build0108-230329-patch06-protver02". Anybody updated to the new Firmware and can agree with the right Build No. after updating a FAP Wave2?

Hi Fortinet Community,Would like to ask if we can do FortiSIEM installation in Oracle Cloud Infrastructure.I wasn't able to find documentation for this, like AWS (cloud) installation. 

For seven hours in my logs I have entries "Fortigate idsurldb signature is missing or invalid."Does anyone have a similar problem ?The rest of the updates download correctlyFortigate 60F on 7.2 fw

I am trying to create new static routes in my FG100F, but it seems like I cannot select some addresses eg subnets i have already created in my Address list.seems like they are hidden.firmware for the FG100F is 7.2.5 subnets in addresses

Hello,  I just set up my first Foritgate unit, a Fortigate 40F running firmware v6.4.6 build 6083, a few days ago, and was poking around the GUI today to change settings to better suit the best practices shown in the documentation. I changed some settings on a firewall policy I made, and clicked "OK" to save, then I noticed that the policy I had edited was showing a peach highlight around it. I tried searching the forum but could not find anybody who had asked the same question. What does a peach or peach orange highlight mean for a firewall policy in the GUI?  Here is a screenshot showing what I experienced: 

How can I set up a DMZ for the Fortigate VM we are running in Azure?Currently we only have 2 ports (LAN and WAN). 

Does anyone have ldaps working with windows server 2019?  I'm running version 6.4.12 and had LDAPS working with windows 2016 without any issues and my server admin upgraded our DC to server 2019 and broke the ldaps connection from the fortigate.  I have unsecured port 389 working but can't get 636 to work.  With the previous configuration we we're using certificates we just had the secure option checked and it was working but now it won't work at all the the option.  I've tried using certificates by downloaded our CA from our certificate store to the gates and selecting the certificates on the configuration and still nothing. 

HelloIs it possible to change the default Fortinet-Factory Cert to my company wildcard cert?Some browsers can not process to portal it said "Your connection is not private" 

Hello everyone,When I upgrade my Ha clusters "fortigate appliance" I have downtime twice for about 40/30 sec.The ha is configured as active-passive.I am using gui to start the upgrade process from fortimanager.Is that normal behaviour? Kind regards,Homan

Hello everyone  I hope you can support me: I added a page in the web filter menu, in the static url filter-enable url filter section, only that people can still see the web page, what should I do so that they do not really have access to that site? The appliance that I have is a Fortigate 60D. Thank you very much for your support

We are using FortiClient ZTNA 7.0.8 with FortiClient EMS. We have experienced sometimes bugs were FortiClient gets unresponsive and only a restart of FortiClient or the notebook works.In the FortiClient EMS System Profile users are allowed to shutdown the client. But when trying to shutdown the client on windows, the users are asked for adminstrator credentials. Is there any possibility to shutdown or restart the FortClient ZTNA without administrative privileges? Kind regards

I have fortiauthenticator 7.2.1.It is setup with with an ldap server and using SAML as an IDP.  When I go to the portal page to test my authentication from the moment I enter my username/password and press enter I only get 5 seconds to respond to my MFA prompt. Is there some way I can adjust this setting?At least with fortigate I set remoteauthtimeout in the system global settings.

Hi allI have three scenarios I need to figure out with prefix lists...and I just need someone to confirm that I am not totally wrong about my approach :) Scenario 1:I receive about 1'000 prefixes (including the default gateway of 0.0.0.0/0) and I want a route-map as preparation if I need to configure something special down the road.In order to accept everything from my neighbor I would have used the following prefix-list:config router prefix-list edit "accepteverything" config rule edit 1 set prefix any unset ge unset le next end next endWould I be wrong with that? Scenario 2:Now that I have those 1'000 prefixes including the default gateway of 0.0.0.0/0 I would like to forward everything BUT the default route to another neighbor.To achieve that I would have used the following prefix-list:config router prefix-list edit "blockrule" config rule edit 1

Recently FortiAnalyzer menu stopped working, I tried to use different browser/computers restart the fortianalyzer.  nothing working, it seems it's a new update or something that broke it.  Cannot also log out because the profile menu is not working. anyone facing the same issue?

We need to migrate our VMs from Hyper-V to VMware.To do this, I have already downloaded the VMware image and created new VMs for it (which now have a trial licence).I can download the configuration as a backup and import it into the new VMs.However, I would have to shut down the existing VMs before importing the backup into the new VMs (because of the IPs).What I haven't quite understood yet is the issue of the licence.How do I transfer the licence from the existing VMs to the new ones?

Hi all I have three scenarios I need to figure out with prefix lists...and I just need someone to confirm that I am not totally wrong about my approach :) Scenario 1:I receive about 1'000 prefixes (including the default gateway of 0.0.0.0/0) and I want a route-map as preparation if I need to configure something special down the road.In order to accept everything from my neighbor I would have used the following prefix-list:config router prefix-list edit "accepteverything" config rule edit 1 set prefix any unset ge unset le next end next endWould I be wrong with that? Scenario 2:Now that I have those 1'000 prefixes including the default gateway of 0.0.0.0/0. I would like to forward everything BUT the default route to another neighbor.To achieve that I would have used the following prefix-list:config router prefix-list edit "blockrule" config rule edit 1

Hello DearsI am trying to imeplemnt that , when user try to reach server the traffic would forward based on url rather than IP address as show in exmple : www.FG1.com ->> 192.168.1.1www.FG2.com ->> 192.168.1.2 both domains FG1 and FG2 would use the same public ip for exmple 1.1.1.1 and tcp port 443any advise about that ?

Hi, I'm trying to configure Forticlient with multiple remote gateways for redundancy but when I add a second remote gateway the custom port option dissapear... This is the example with one remote gateway and a custom port 4443, no problem here, it works:  But when I add a second one:It seems ok, format is https://x.x.x.x:portbut if I click save and connect, not work. If I edit this, the port automatically changed to 443.If I try to change the port and save not works, always save 443 as custom port after :I updated the Forticlient to latest 6.4.10 and not work. Anyone has this issue? Can you help me to configure two remote gateways in Forticlient? Thanks in advance.        

Hi, wonder anyone had encountered this before? I had checked everywhere for solutions or help, but not much information. Fortigate firmware is 7.0.6We had configured the Tacacs+ in fgt but could not communicate with the Tacacs+ server.We follow the guide, FGT 7.0.6 > Administration Guide > TACACS+ servers.

Good morning friends, do you know why the fortigate does not show logs of the AV?For the other security profiles it shows me logs but for the AV it does not show anything, as in the image:In addition, my policies have the AV profile enabled  Currently my device fortigate has version 7.2.5 In the FAZ I cannot find the AV option since the AV is not found within the security events option.

friends,is it necessary in the vpn ssl policies to add the IPS profiles y full inspection? Since currently I only have certificate inspection enabled and AV MONITOR mode. Should IPS, WEB FILTER or APP CONTROL also be added in IPSEC tunnels?Since currently I only have certificate inspection enabled and AV MONITOR mode. I do not want my equipment to enter conservation mode, it is better to be safe.

I have Thousands of IPs trying to access my fortigate using RDP, some china, russia, usa, how can i bulk block the IPS and only allow just a few that I know to access RDP.