Solved

hi,i managed to built HA active-passive between two 40F.i lost HTTPS/ping access to secondary since it sync'd with primary IP in lan1.i already remove FW policy and static route for lan1 but i'm still unable to add lan1 in HA MGMT interface reservation both in GUI (only 'a' is available, used in HA link) and CLI (code -23).can anyone advise or point me to the right direction? FW01_PRI # config system haFW01_PRI (ha) # set ha-mgmt-status enableFW01_PRI (ha) # config ha-mgmt-interfacesFW01_PRI (ha-mgmt-interfaces) # edit 1new entry '1' addedPRI (1) # set interface lan1node_check_object fail! for interface lan1value parse error before 'lan1'Command fail. Return code -23 

Hi gentles, Actually, I read an article that says there're use cases to run FortiClient in conjunction with Windows Defender. https://www.fortinet.com/content/dam/fortinet/assets/solution-guides/sb-leveraging-forticlient-w-microsoft-defender-6-use-cases.pdf If that possible technically, please share the material "How To" that describe the process, if any. Thanks in advance 

Can someone explain why this mac address appears every 5 seconds. It is source ip always different. It stopped appearing after I disabled “Device Detection” on LAN interface.

I am having issue getting the free trial tokens. Serial Number: FAC-VM0000000000 I just deployed FortiAuthenticator on AWS using the marketplace image version 6.2.1. After everything setup. I thought my company firewall may have blocked some urls. After checking in another post, I have requested all those urls to be opened. I am still having issues, this seems to be a old issue that has been resolved on another thread. But it is now happening again. On the status page, I see this issue: FortiToken Cloud - Status - Service unreachable  When I go to the token page (Authentication->User Management->FortiTokens->Create new FortiToken->FortiTokenMobile), I see this issue: FortiToken Mobile activation is disabled because this VM is unlicensed or license is disabled. When I try the "Get FortiTokenMobile free trial tokens", I get this issue: Error : FortiAuthenticator VM license not found This is really frustrating and making m

I'm attempting to try out FortiAuthenticator + FortiToken Mobile at the same time.  I have a trial VM of FA running, but when I attempt to execute the "Get FortiToken Mobile free trial tokens", i get an error message: "FortiAuthenticator VM license not found"... Has anyone else had any luck? I don't want to have to buy FA in order to test our an end-to-end solution... Thanks!!! **UPDATE**: If you come across this, for FAZ 6.x, you'll need to have an evaluation license of FAZ installed on the device in order for the trial tokens to be generated/available.

Hi, I am testing out fortiauthenticator and realized that it requires accessing external addresses. The licensing status indicated server unreacheable. I need to know the url as my company implement strict whitelisting.Also, does anyone know what other urls the product needs to work? Thanks.

Longer story short. Looking to setup additional group access in these for read access etc etc.(Using existing RADIUS setup that gates and other network devices are using)Group claims are not being seen on the FAC by these two platforms. On gates you can assign a user group and then add the group attribute on the gate. On the manager etc there are no groups set themselves... Rather setting up of remote users. When adding multiple RADIUS policies to the FAC for these devices it basically errors out and doesn't select any group, rather the first group within the FAC. Thanks

Hi,Is any way from Fortigate to check at what ethernet interface speed is connected FortiAP?

hello guys I need to know the matching Product Model of Sophos XGS 2100 with FortiGate

Hello All, I have a serious security issue and need your help to solve it.I have a Fortigate 60E securing Internet access, I'm using Security profile to block unwanted websites and applications and it's working fine except for Chrome extensions. I found that some users are using Hoxx and Windscribe extensions for chrome.They are able to bypass our security rules and connect to some sites that are blocked by Company's policy.Could you please help me finding a solution for that. Thanks and kind regards,Gr1n3

HiIn many tutorials when configuring ipsec vpn via sd wan that the tunnel interface must have an IP address, so my question is what is the purpose of this IP address and if the sd wan can work without ?  THANKS

I have a WWAN  backup link that is not ipv6 capable. Clients get GUAs from the primary link. In case this link goes down and SD-WAN switches to the backup link the outbound IPv6 traffic needs NAT64.edit: realized that NAT64 is not the right solution for this scenario. See below.So I need NAT64 for all the IPv6 traffic that leaves through the backup link interface of my FortiGate.NAT64 is configured on a policy level, but I can't do policies on member interfaces once they joined an SD-WAN zone.How can I achieve this? Or did I oversee something? I could add another router that does the NAT64 for this link.  But I'd prefer a solution without an additional device. Slightly offtopic: if I had a IPv6 capable backup link, is there  really no NPTv6 on FortiGates?TIA,Oliver

Hi All, I'm using Fortigate80E v6.0.9 build0335. We have two different internet connection. One is radiolink and second one is VDSL. I've already setup VDSL modem as bridge and on fortigate i choose pppoe and wrote down username and password. when i enable VDSL in interfaces; my connection is lost. i want to use both wan connection and i'll set policy like clients would use wan1 (radiolink) and servers use wan2(vdsl). I searched forum and couldn't find the answer. Can you help me? Thanks

I am trying to get a template created in FortiManager to integrate my FortiAnalyzer and when I try to select my FAZ, it does not show up in the list. How do I go about adding it? I do have my FAZ listed in Device Manager, so I am not sure what I am missing. I pretty much followed this KB:https://docs.fortinet.com/document/fortimanager/7.2.0/examples/480770/centrally-configuring-fortigate-to-send-logs-to-managed-fortianalyzerBut stuck on step 2e.v7.2.2-build1334 230201 (GA) When trying to select something I just see a crossed out red circle. Also, does anyone recall on how to add a button shortcut on FortiManager home page for FortiAnalyzer? 

Hi All, Yes I know, 'use the Manager'.. but some things are just not possible from Manager, so we need to login to the FortiGates & Switches directly.Why does the FG prompt the user loggin in, to do a FW upgrade, when the FG is Managed, and we even have Firmware Templates defined, that clearly state, it should NOT be upgraded! It would be great, if this prompt could be hidden... 

I've installed forticlient VPN client and opened the app and got white blank screenmac mini 2012macos 10.14.6

Hello, Fortigate 60f v7.2.4   Policy-based NGFW. I am trying to set VIP port forwarding (https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configuration/ta-p/198143)  but the VIP object is not listed in Destination ? Any ideas ? Thanks ,T

Hello all,  FortiOS 7.2.4EMS Server 7.0.7Forticlient Enterprise on Android 7.0.7.0068 I have configured an IPSEC dial up connection in EMS server. This works perfectly but not "auto connect, Save password and Always UP.  After the IPSEC config was rolled out over EMS it works once, after disconnect alle 3 options are gone away and i must reenter my password on every connection. The strange thing... i see that user and "password" are saved in the forticlient.  The next strange thing... the options:https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-activate-Save-Password-Auto-Connect-and/ta-p/197543 are not availabel anymore to configure... so were they are??? Only on EMS they are available, and yes i checked all boxes :)

 I have a 201F that I am using to replace an old SonicWall. I have a LAN and a DMZ setup. The only server in the DMZ is an SMTP server that I relay application mail off of. The SMTP server has a software firewall that controls access to only the IP's I want relaying mail. The software firewall reads the incoming source IP to check if the incoming request is allowed to send. When connected to the current SonicWall, all the traffic comes in to the SMTP server with it's source IP. So if a request is from a server at 1.2.3.4 for example, the SMTP server sees IP 1.2.3.4. When connected to the 201F, all the traffic is coming in not with the source IP, but with the IP of the port from the 201F that the SMTP server is connected to. So all traffic - good and bad - has the same IP. Obviously my SMTP software firewall can't filter what's good and bad when all the IP's are the same.How can I retain the original IP for the traffic like my SonicWall does? 

Since March 2nd, we have detected the following alerts on several fortigates. Moxa.SDS-3008.CVE-2022-40224.DoShttp://www.fortinet.com/ids/VID52664 However, the alerts are only for 5.2.x and not for other versions.Also, in the alert, it is trying to dos attack from LAN to WAN, and the destination of the attack is trendmicro and eset.Trying to attack a company that has DOS countermeasures is also unnatural.Is it a bug that occurs only in 5.2.x?

Followed the Special Notice Docs but still keep getting prompted that "FortiClientAgent" wants to update the certificate trust. Along with this the entire Forticlient - nothing is clickable - like it's all greyed out. Seems like i can force a scan through EMS... Anyone?

Hi guys, Just want to know how many links we can configure in sdwan..

Hi, newbie here. Bought a 2nd hand 60D for studying. Set all my interface to interface mode. My port 6 is assigned to VLAN 60 with an IP range of 172.16.60.1/29. Whenever I plugin my laptop, I'm not able to get any IP on the said port. Firmware on v6.0.16 build0505 (GA). Can someone help? Thank you in advance.

How can you change the SSL certificate presented by the SSO SP on port 7831? Changing it under the following places does not seem to work. -User & Auth > SSO-User & Auth > Auth Settings >  I'm using this though an explicit proxy and it just continues to present the factory SSL cert with the FG serial number. 

I want to allow only specific users to access the internal server through RDP access and block others using RDP port (3389) as we are getting alerts of attempts of attacks on RDP port 3389. I am getting alerts of attempts of attacks on RDP port 3389.How can I achieve this.