Solved

Hello all, I migrated FortiGate 300D to 201F. After migration, I cannot create Email based two-factor authentication for new user from GUI, but I can create from command line.  There is only 2 authentication type: Forti Token Cloud and Forti Token.Someone #FGT201F 

Or... it feels like they are always at 100% full blast and that makes noices ... At that price point, I am flabergasted that we can't control these... or I have missed an option somewhere? Firmware 7.2.3, but I remember it was at 100% also with the 6.x firmware. Ambient temperature is about 22 Celsius (71.6F).  execute sensor lis1 PSU [1] OK2 PSU [2] OK3 FAN 1 CPU FAN 9121 RPM4 FAN 2 SYS FAN 9574 RPM5 FAN 3 AUX2 FAN 9375 RPM6 VOL 1 VCORE 1.81 V7 VOL 2 P1V05_VCCSCUS 1.06 V8 VOL 3 P1V2_VDDQ 1.21 V9 VOL 4 P1V0_CORE_SW 0.99 V10 VOL 5 P1V0_SOC4 1.02 V11 VOL 6 P1V05 1.06 V12 VOL 7 P3V3_STBY_A 3.30 V13 VOL 8 P3V3_STBY 3.30 V14 VOL 9 P3V3_PCH 3.30 V15 VOL 10 VBAT 3.33 V16 TMP 1 CPUTIN 41.50 C17 TMP 2 PECI 60.00 C18 MV1680 1 48.00 C19 MV1680 2 36.00 C FortiGate #fortios#fanspeed#hardware 

I configured these 2 firewall rules: Rule 1From: wan1 , To: Any Interfacessrc: <malicious ip> , destination: allSchedule: always , Protocol: AllAction: deny Rule 2From: Any Interfaces, To: wan1 src: all, destination: <malicious ip> Schedule: always, Protocol: AllAction: deny Now I cannot ping or go to the wan interface from internet. Can anyone tell me what is wrong?I also enabled multiple interfaces under the advanced feature.    

hi,i'm trying to configure a VDOM link between 'root' and a separate VDOM 'internet' which provides public/internet access. i tried to configure first a plain VDOM link but when i try to edit, i can't add it to an 'npu_vlink' interface.but when i tried to create the reverse, i.e. i created npu0_vlink0 for 'root' with a /30 IP address, and npu0_vlunk1 for 'internet', i cant' add the inter VDOM link. see attached photos.my questions:1. can FG 40F support NPU enabled VDOM link?2. do i just create a "plain" VDOM link without NPU acceleration?3. what are the correct step/sequence to create VDOM link with NPU acceleration in a 40F? 

Hi  Actually, we are deploying FortiClient EMS 7.2 we are frequently facing "out of sync" issue between endpoints and EMS server, e.g. when restart ems server, also when editing profiles like webfilter and so on any idea what's the reason and how we can troubleshoot and track this issue? Thanks in advance

Hello,Hope you are doing well. I'm trying to change to vlan from authentication vlan which is the default with id 150 to Vlan 25 for the production access when the scan is successful without using dot1x on the switch port on Cisco switch.So far only for testing the Operating system windows 10 pass and the right network access policy is granted, but when it comes to cli change it keeps adding vlan 25 and undo it to 150 back and fourth.The port is a member of "Forced Registration" "Reset Forced Registration" and "Role Based Access"  My enforcement Access: Cli template :config tinterface %port%description Network Securityswitchport access vlan %vlan% do wrUndo :config tinterface %port%description Authenticationswitchport access vlan 105do wrFortiNAC version 9.2Cisco Switch 3750 IOS 12.2 Thank you!Best Regards!

Hi all,I configured out of the box a 148F layer 2 fortiswitch and connected it to a Cisco 2960X layer 2 switch. From the Fortiswitch I can ping anywhere in the LAN, but if connect my computer or IP phone to the switch - nothing. The computer and phone are on separate ports and in the correct vlan. The ports connecting the two switches are up and no errors. The switch has a L3 interface and it can ping its default gateway and as mention anywhere on the LAN. I just cant figure out why I'm not able to get anything on the computer and phone.I'm new to Fortinet and have experience only with Cisco switches.Thank you. 

Recently I upgraded a FortiGate 100E from FortiOS 6.4.X to 7.0.X. Since then, I am no longer able to backup the configuration automatically. Here is a basic topology of my network.    when running the "execute backup config" command from CLI I get the error "Send config file to ftp server via vdom root failed.Command fail. Return code 5"From CLI, when running "exec ping 192.168.2.10" I do not get a response. However, when I set the source of the ping to "192.168.1.2" I DO get a response. I assume I need to source the exec backup config command as well. How do I route this properly?

Hello, I used AD-VPN to Spoke to spoke communication (FortiOS 7.0.7), it works perfectly excepted when I used SD-WAN. I tried to reach 10.5.5.0/24 via ADVPN and here my bgp routing table, as you can see, I have 2 path to reach this subnet but onw with is "directly connected" -> This way tunnel is the best 10.5.5.0/24  [200/0] via 172.0.0.1 (recursive via ADVPN0 tunnel 1.2.3.4), 00:18:39                      [200/0] via 172.0.1.0 (recursive is directly connected, ADVPN1_0), 00:18:39 Now I added SD-WAN with sla with "lowest cost SLAN" and fib best match : config service   edit 1      set name "ADVPN"      [...]      set tie-break fib-best-match   nextend With a diagnose sys sdwan service I have this resultMembers(3):1: Seq_num(2 ADVPN0), alive, sla(0x1), gid(0), cfg_order(0), cost(0), selected2: Seq_num(3 ADVPN1_0), alive, sla(

Hi,I would like to know whether it is possible to create a custom plugin class for threat feed integration. According to the documentation, where we should put the custom class?3887997b48764aafa50beff503f168b9.pngI tried locating the default one and was unable to. Is it under "/opt/glassfish5/glassfish/domains/domain1/applications/phoenix/phoenix-domain-1.0_jar/com/ph/phoenix/service/integration/ioc/" ?------------------------------Cheers,Isuru------------------------------

hi,i just enabled Multi-VDOM in my FGT with HA.i plan to create an Internet access VDOM topology per link below and created a new "Internet" VDOM.https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/597696/vdom-overview#Topologies i just followed this link/blog, but i can't seem to move my physical/logical inside LAN and physical WAN to this new "Internet" VDOM.https://networkinterview.com/fortigate-vdom-configuration/ i just plan to leave MGMT(lan1) in root VDOM.please advise if there's any additional step or CLI command that i need to issue/enable?  

I all. I would like to obtain information about my network, mainly related to bandwitch usage. I go to install to obtain this information a netflow collector.I have read about some problems with some third party Netflow collectors and I would like to answer about your experience to install a good Collector to work with Fortigate Firewall.  Please, could you recommend me a netflow network analyzer, free if its possible and it works well with fortigate, to can monitorice the bandwitch of my network in a way that I can get more information  than the information that a widget or fortiview gives me?Thanks ¡¡¡

Hi people on the community. Can I exchange the license of FortiGate VM, PAYG to BYOL, after deploying as PAYG? Regards,FortiGate

Hi, guys, It has been frustrated about this configuration; the sslvpn idle-timer is still not working. I configured all related parameters/attributes as the following weblink:Technical Tip: SSL-VPN Idle-timeout not working  My network configuration as below:1.  Fortigate 100E with FortiOS v7.2.4.1.1. SSLVPN Client DNS same as Client1.2. SSLVPN idle-timeout 3002. FortiClient VPN v7.0.8.xxx3. Windows 10 home3.1. "SSDP Discovery" is disabled3.2  "LLMNR" is disabled  But the SSLPVN idle-timer is still working, any recommendation, many thanks ? With regardsBenson

Is there a way to increase the time between a pause during dialing and the phone automatically dialing the numbers already entered? For example, I want to dial a phone number, I start dialing XXX-XXX then pause to look at the last 4 digits, if I pause too long the phone attempts to dial the first 6 digits I entered instead of waiting just a few more seconds for me to enter the last 4 digits.

Good day everyone, was wondering - I am reading Fortinet documentation a lot (here in community "Tips", admin guides etc.) and sometimes stumble on incorrect/outdated or plain typo/incorrect info. Is there a way to alert someone on that?Thanks E.g. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Usage-of-IP-Addresses-in-Technical-Documentation/ta-p/195597 "IPv6 addressesRFC 3849: IPv6 Address Prefix Reserved for Documentation(http://www.ietf.org/rfc/rfc3849.txt?number=3849) states that the IPv6 address prefix 2001:DB8::/323 is reserved for use in documentation." The correct prefix length is /32, of course. 

 Hello! I've been trying to disable an IP listed in Malicious-Malicious.Server, which is a list in the IP Reputation Database. I found information that said that it is not possible to disable an IP from this list via CLI commands. The problem is that the GUI can't display all the entries and I can't get to the desired entry to disable it.Please if anyone has any suggestions that would be great. Thanks! Attached is a printscreen. I'm using version 7.2.4 

Using a WiFi 60D with the standard 10 included FortiClient licenses. When I try to click to Register Endpoint from a computer with FortiClient installed I get an Error message that says "FortiGate maximum licenses exceeded.". When I go to System / Dashboard / Status / License Information, it says that 10 of the 10 FortiClient clients are registered. We are using less than 10 endpoints with FortiClient currently. FortiClient may have been installed on computers that have since been decommissioned. How can we release licenses that are no longer being used?

Hi I'm deploying Azure Fortigate HA Active-Passive as per this documentation:https://github.com/fortinet/azure-templates/tree/main/FortiGate/Active-Passive-ELB-ILBwith Active unit in Availabilty zone 1 and Passive unit in Availability zone 2.I'm having problems with the Passive Firewall.If I logon, it shows no arp entries 'get system arp':couks-FGT-B # get system arpAddress Age(min) Hardware Addr Interfacecouks-FGT-B #HA cluster is working because they both show in Sync. But on Passive, it doesn't respond to the ILB probes:couks-FGT-B # diag sniff packet port2 'host 168.63.129.16'Using Original Sniffing Modeinterfaces=[port2]filters=[host 168.63.129.16]1.459976 168.63.129.16.55536 -> 10.201.0.70.8008: syn 29682361253.468306 168.63.129.16.55536 -> 10.201.0.70.8008: syn 29682361256.455136 168.63.129.16.55613 -> 10.201.0.70.8008: syn 24901956527.469473 168.63.129.16.55613 -> 10.201.0.70.8008: syn 2490195652^C4 packets received by filter0 packets dropped by kernel and

Hello, For the first time, i have the following error message : (2023/05/22 07:43:34) Fortigate iot_detec signature missing. Do you have any informations about this error ? I don't found more details about this. Thank you in advance, Regards,Christopher

Hi Team,  I'm just asking if we can add multiple IP address on the LDAP Server?Our main goal: The user connects on the Fortinet VPN, we setup the LDAP server that contain 2 IP address, is this possible?the 2 IP address is our active directory, Main and Backup AD. I really appreciate to help me this :)

Hi, I'm new in fortiSIEM and recently I facing a problem that, an Alert email with incident ID $IncidentID. In the email it show the link with Host Name" URL: https://FortiSIEM.localdomain/phoenix/html/incidents/26278 "how can I change it to Host IP" URL: https://10.99.0.50/phoenix/html/incidents/26278 "Thank you.John

Hi all,We have some handheld android tablets on a "guest" network on our Fortigate 100F and they get an IP address of say 192.168.30.0 and we have a server on a DMZ on another interface on say 10.10.10.10 but all connected to the same physical 100F. The tablets connect to the server fine when they are off our network (i.e at 3rd party sites etc) but they cannot connect to the server when inside our network (on the Guest network). If i do a trace route then it picks up that it needs to go to 10.10.10.10 but hits the guest interface on the router (so 192.168.30.1) but then the next hop is our WAN IP address instead of the interface IP of our DMZ network? What do i need to do to get it to route "internally" ?Hope that makes sense.Thanks 

Hello To All,  Because of a memory leakage the http process needs to be restart from time so I figured using auto-script (there is not analyzer at the moment to use the fabric automation as mentioned in https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/351998/creating-automation-stitches ) that can be scheduled or tiggered through the API but for example the command in "https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-restart-kill-all-the-processes-with/ta-p/194434 " that is fnsysctl killall httpsd is for backend-shell access and also diagnose test application <daemon_name> 99  that is suggested in the article belos does not seem to find the http processes https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restarting-internal-processess-daemons/ta-p/192124  I only need to find the correct command on 7.4 for Fortigate and then I can create the configuration script and then run the below commands:   &nbs

Hi  Actually, I want to create a Supervisor VM (all in one), and to allocate 2 TB of Data Disk (Local Virtual Disk), 2 TB is the max virtual disk size that VMware supports, I want to know, is there any issue from FortiSIEM side to accept this capacity ? Thanks in advance