Solved

I have Thousands of IPs trying to access my fortigate using RDP, some china, russia, usa, how can i bulk block the IPS and only allow just a few that I know to access RDP.

Hi All,To give some context, I am having challenges running the two FGTs in HA due to WAN IP limitation with my cloud provider (I intended to run the two FGTs in 2 different datacenters to set up HA but my CSP requires i move the WAN IP manually between the DCs during HA failover which results to a downtime of close to 5 minutes or more which beats the logic of having the FGTs in HA).My main goal is to at least have two firewalls with different  WAN IPs running on different DCs both serving as gateways for the same resources/VMs and then set-up 2 SSL VPN gateways which I will deploy to users' FortiClient such that whenever one FGT is down, they can connect to the secondary VPN gateway and continue accessing internal resources.I know this is a **bleep**ty set-up but I just want a failover mechanism at least for SSL VPN. I don't care much about about IPsec VPN and I am willing to manually update the configurations? Do you think this is possible to achieve? I would appreciate yo

We have a multi site network with a central Fortigate wireless controller. The AP's are under a single AP profile. The SSID's are in tunnel mode. The Fortigate is on version 7.0.10 and the AP's are on v7.0-build0108. Some of the AP's randomly stop letting clients authenticate. The only way to get them working again is to remove the AP from the AP Group and then re-add it back in again. The clients can then instantly connect. I can see repeated authentication requests and responses in the AP logs: request from wireless station" sn="FP221E5519056432" ap="WHCW-AP-01" vap="WHL-Net" ssid="WHL-Network" radioid=1 user="N/A" stamac="7c:f6:66:8c:fa:b9" channel=1 security="WPA2 Personal" encryption="AES" action="auth-req" reason="Reserved 0" msg="AP received authentication request frame from client 7c:f6:66:8c:fa:b9" remotewtptime="3304.691751"response to wireless station" sn="FP221E5519056432" ap="WHCW-AP-01" vap="WHL-Net" ssid="WHL-Network" radioid=1 user="N/A" stamac="7c:f6:66:

HiI have big doubt.I don't know when I activate Fortigate Cloud on my Fortigate Firewall can I manage device via cli or via local LAN?Or, is it locked and I must manage it only by Cloud enviroment?Thank you

Hello, I have fortigate installed in Azure and Mikrotik on our On-prem datacenter. I would like to configure IPSec over GRE VPN between them. Phase 1 is establishing without problem, but Phase 2 doesn't go up. I use this article: https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/799752/gre-over-ipsec Here is Azure fortigate configuration: config vpn ipsec phase1-interfaceedit "gre-tunnel1"set interface "port1"set peertype anyset net-device disableset proposal aes256-sha512set dhgrp 14set remote-gw 178.54.*.*set psksecret ****** config vpn ipsec phase2-interfaceedit "gre-tunnel1"set phase1name "gre-tunnel1"set proposal aes256-sha512set dhgrp 14set protocol 47set keylifeseconds 28800 edit "gre-tunnel1"set vdom "root"set ip 10.225.252.1 255.255.255.255set type tunnelset remote-ip 10.225.252.2 255.255.255.252set snmp-index 7set interface "port1" config system gre-tunneledit "gre-to-rem"set interface "gre-tunnel1"set remote-gw 10.225.252.2s

Hi Community Members, Hope you are doing well. I have a question regarding data ingestion from RSA Netwitness SIEM, we have configured the connector upon running sample playbooks we can see the data of alerts/incident in output of playbook steps. But there is a confusion for taking these data on scheduled interval. As there is no any data ingestion available for this product. Can someone please guide how to retrieve this alerts in SOAR without having data ingestion.

HiFortigate F series is launched last year (2022).I have a project from today to next 5 years.Can Fortigate 80F be "live" in the next 5 years?I need to focus an Branch Office HardWare version that I will sell in the next years to my customer. Any suggestion? Thank you

Dear All, I need your small help today I have created rule to backup of the stack switch which is installed behind the FortiGate Firewall. Everything is correct as per my knowledge, tftp port is also enabled, still not able to establish connection between TFTP server & client. Can anyone has any suggestions on it for me. Thank you. 

I need to change the existing support portal ID to new email ID.I have found a KB article related to same.KB: https://community.fortinet.com/t5/Customer-Service/Customer-Service-Note-How-to-change-the-master-account-ID-email/ta-p/193733But if we do not have the credentials of the OLD email ID to login, how can we change/replace the Old ID to new email ID? Kindly suggest on this.

Dear TeamI would like to understand how to determine the appropriate "Username format" (username@realm or realm\username or realm/username) to use for each NAS (Radius Client).Is this adjustment of the "Username format" based on the Radius protocol or some other information? Please help me clarify what information or examples are needed to make the correct selection for the "Username format". Thank you.

Using Fortigate 6.4.13. I'm looking for the REST API reference but cannot fin it anywhere? Might someone be able to point me to it 

Hello everyone!Is that possible to use a FQDN Wildcard group and a FQDN Group in the same policy as destination? Or each policy needs to have just one of that types?

Hi Community, So I have a question whether this LACP will work or not. I need your views on this also is there any other way on how I can improve this redundancy. I have 2 Cisco Switches (Stacked) acting as a link switch.FGT is in HA (Active and Passive).Here there are 4 ports that are members of a single port-channel in Cisco switch.And whereas in FortiGate there are 2 ports each in LACP.Will it work? Regards,Shailesh 

Hello everyone,I have FortiGate 60D with no firmware installed, I'm trying to load the firmware image using TFTP, but it's failed.Find Bellow the screenshot.Can you help me solve this issue.Best RegardsYounes

Hi,When I run "diag sys flash list" on the firewall, it only shows version 7.0.x.However my current firewall firmware version is 7.2.x.Why is the current firewall firmware version not stored in the harddisk partition?So where has it disappeared to?

Hi Fortinet Gurus,                What are the reasons/use cases Fortimanager need to access LDAP server? If I need to manage user definition and user group management, do i need to allow Fortimanager to access LDAP first? THank you.

In a HA environment, how do I select the secondary firewall and make changes to it (in the GUI)?I dont see any options to control the secondary firewall in the GUI. If the first firewall is active and the second firewall is passive, how to switch it so that first is passive and second is active? In palo alto you can do a switchover. (weather in gui or cli)

Hello All! I am new to Fortinet and was am looking for assistance. My Director would like me to segment our HQ Network so that it is more secure.He wants the following to have their own VLAN:- Accounting (10.8.10.x)-Operations (10.8.20.x)-IT (10.8.30.x)-Executives(10.8.40.x)-"General Data" (10.8.50.x)- Server (10.8.60.x)-Wifi (Easy enough)-VOIP VlanNow,  he wants every VLAN to be segmented from the other with the IT team and an executive (we will call him BOB) to have access to only their own VLAN. Basically he wants BOB to have access to both the accounting and executive VLANs. He also wants a way for everyone in the IT team to be able to access all the other VLANs (to do "IT stuff". Is there any way that we can use the fortigate to limit the internal permissions? Any help is appreciated! 

when i upgrade fortigate ha firewall, the default is that primary fw gets upgraded.How do i change it so that by default the secondary gets upgraded instead?

I know I will lose the config.But will it lose the firmware in which it was recently upgraded?

Hello,some questions, please  1 ) I need know  use case between (limitation, advantage/inconvenience) :                       use GLOBAL ADOM (push to many devices or vdom)                       have many device in ADOM and push same policy package What it is your opinion ?  2 ) maximum number of managed devices for each ADOM, (it is depend  : hardware, license or unlimited) 3 ) What you did think to use fortigate with nat and transparent mode in HA (problem / complexy / limitation)  thank you in advance. 

Hi guys,I'm having an issue with a snat+dnat configuration to an ipsec tunnell on a Fortigate with SD-WAN enabled. Let me explain... that's what I have: an interface, let's call it "PROJECT" with address 10.238.157.1/29an host on that network with IP address 10.238.157.3an ipsec vpn tunnell called "VPN_CUSTOMER"on the other side of the tunnel, this IP: 10.128.0.4/32an IP Pool of type One-to-One and range 172.31.100.3-172.31.100.3 called SNAT-CLIENTa VIP with external IP 10.238.157.204 and IPv4 address 10.128.0.4 called NAT-DC1a policy that allows any service from from the host 10.238.157.3 to the VIP NAT-DC1 using SNAT-CLIENT as NAT IP Poola static route for 10.238.157.128/25 pointing to the VPN tunnel VPN_CUSTOMERSD-WAN enabled on my Fortigate the goal is to snat my host 10.238.157.3 as 172.31.100.3 when communicating with a custiomer's host that has a real ip of 10.128.0.4 without having that particular destination in my rou

I'm a newbie to the Fortinet community.  We have an EMS server that requires the SSL certificate to be renewed.  What would be the pros/cons of using a certificate from our CA vs Let's Encrypt?  If we use the certificate from our CA, does this mean the EMS server cannot receive updates? - JoeyTwinkleToes

Is there any official report on this that comes from Fortinet?I see a lot of people patching but so far no report from Fortinet. Thank you in advance, Evert

Hi everyone, I recently discovered (I must be a newb) that it is possible with two Windows servers to have one be the primary DHCP server and have the second one as a failover in case the primary server goes down so I configured a secondary DC to be the failover DHCP server.  We have multiple VLANs that uses the same DHCP server and the Fortigate is set to relay to the Windows DHCP server. Now that I added a failover, how do I add the address of that new server to also be a relay on the Fortigate's VLAN Interface configuration page? As an example (with fake names and IP addresses):Good old Windows server called: DC1  on IP 10.10.50.1  currently has DHCP role so the relay for every VLAN configured in the Fortigate points to that server.New Windows server called: DC2 on IP 10.10.50.2  has been configured as failover for DC1.  Now if the primary fails, the computers/devices on the different VLANs who would need a IP address need to be able to reach