Solved

Hello Team, I have 2 ISP aconnectivity in my infra both connectivity using DHCP . I don't have access to the client machine but I wanted to confirm that weather both ISP public ip what they are getting as we checked in what is my ip or the ip we recieved We recieved WAN ip as I have DHCP connectivity I wanted to have Nattedpublic ip Please help me how do i look into it through fortigate any command pl

I have two SKU's related to the Premium RMA Service for the FortiGate 200F that I was provided to place in my proposal.  They are FC-10-F200F-210-02-12 (Next Day DeliveryFC-10-F200F-211-02-12 (4-Hour Delivery) Can someone confirm they are basically the same Premium service except one is RMA on NBD and the second one is on 4-hour delivery schedule? Appreciate it.  Thank you.

Hello all,  i need an applicationsignature for the brave-browser. Has anyone perhaps already written one and would like to share it? Thanks a lot :)

Hello, I have 2 sites with fortigates connected by IPsec, both can reach each other.I wanted to know if there is a possibility to be connected with Forticlient at the site A, and be able to reach site B ?I tried to do a Firewall policy from the Site A tunnel IPSec FortiClient to the Tunnel towards the site B, but it's not working, maybe it's not possible and I'm totally wrong. Many thanks for your help ! 

Hello Everyone, On fortigate 60f, inside ssl vpn portal setttings " allow client to save password " check box is greyed out.Can't seem to find the reason why that's the case.Please advise.  Kind regards,  

HelloHow can I change the format of the "Source" value in "Log view" -> "FortiGate" -> "Traffic" from e.g. "0d42e9ab-05es-4202-bg6a-7r937cstff36" to an IP address? Some of the endings are represented by an IP address, and some by such an identifier as above. What it comes from?  

GreetingsI am new to Fortigate and have a lab to connect two sites using IPsec VPN. I have used Sonicwall before and am trying to learn what this type of setup would look like in Fortigate.So far, I have been able to configure it using the guides and the cookbook with no problems. But with Sonicwall, I could do the VPN tunnel using the Firewall identifier (user-defined name) instead of the wan IP. I saw that FortiGate uses the peer id, but I have to specify the remote wan IP.This feature in Sonicwall solved the problem of knowing the IP of the remote site since I transported my clients from their remote site to their main site. Still, the internet service belongs to the client, and I often do not have access to know their wan IP to be able to establish the VPN tunnel.And I'd like to see if there is something similar in Fortigate to perform that type of configuration.

How to display unauthenticated users in the "Forward Traffic" Logs? Set the Active Directory Connector in "External Connector" and it is working perfectly. but none of the users are shown except one with pink color (un-authenticated user) how can I get the remaining users and why this user only is showing? FortiGate 

Hi All, We are utilizing Fortinet products in our environment for a few years now, so to better help my journey as an effective administrator, i tried setting up a home lab using VMware. Very simple setup: one virtual machine (10.100.73.201)---> (10.100.73.1) Fortigate VM (192.168.0.65) ---> (192.168.0.1) Internet (ISP modem) one policy for testing purposes: any/any/all. Oddly, when i first deploy the VM, everything works (tested this 3 times). I can ping, browse, windows updates (everything). The following day, I can no longer browse even though there were no config changes. From the my virtual machine, i can ping the fortigate, from the fortigate i can ping the internet (8.8.8.8) and fortiguard servers are connected. DHCP on the fortigate interface, issues an address to the virtual machine and acts as the DNS server and DNS queries from the VM work against the FG interface. Below i've done a simple debug to 8.8.8.8 to catch pings, with show function ena

Hello, I have small problem with authorization in LDAP. In basic SSLVPN everything works fine, LDAP, FortiToken etc. But I need create spectial setting for one user (static IP address). I made second portal (mm-portal / full access) and second relam (/mm). User is added to separate group and to portal. I'm able to open dedicated portal, but unable to login On FortiVPN I see only:04.03.2023 17:20:22 error sslvpn date=2023-03-04 time=17:20:21 logver=1 id=96603 type=securityevent subtype=sslvpn eventtype=error level=error uid=4904307826234D2C9EC3C19FB49E5A92 devid=Fxxxxxxxxxxxxxx0 hostname=3xxxxxxxB pcdomain=mm.loc deviceip=192.168.195.1 devicemac=00-50-56-c0-00-08 site=N/A fctver=7.0.7.0345 fgtserial=Fxxxxxxxxxxxxxxxx0 emsserial=N/A os="Microsoft Windows 11 Professional Edition, 64-bit (build 22621)" user=mm@MM msg="SSLVPN tunnel connection failed" vpnstate= vpntunnel="MML VPN" vpnuser=mmlogin remotegw=ssl.mm.com.pl On firewall also very few log Actionssl-login-failRe

Hi forumI have a lot of new fortigates, direct from the box, that i need to upgrade(to version 7.0.9) and factory-reset after successful upgrade. In trying to make a configuration file (fgt_system.conf) that reset the gate back to factory-default after successful upgrade of the new firmware image (image.out). As of now im stuck in a "catch-22" problem :The gate upgrades to the new firmware version, reboots, and then tries to load the config from the USB-drive If the fgt_system.conf file on the USB contains e.g.      execute factoryreset    y the gate get stuck in a endless reset loop.All my attempts with auto-install scripts have so far also ended up in loops. Anyone done this before or have any suggestions?   

A Windows user was disabled at a client site and I was asked to verify whether he was still present and operational in the Firewall (and the SSL VPN users) and, if he was, I should disable/remove him. First of all I found no means of getting the current known LDAP users in the FortiGate database. I could get the names of all the LDAP users if I tried to add a new remote user, but I am not sure that is a list from the Firewall database or an active one via the LDAP connectivity. Then I tried to disable the user via a password change in the Windows AD. When I went to the LDAP Server to check the change via Test User Credentials, I would get a positive check whether I input the old or the new password. Of course, in time, things settled and there was no positive check with the old password. Still I need a way to1) display actual current LDAP user names known to the Firewall2) force a refresh of the LDAP user names and their credentials Any help will be greatly apprecia

The VPN client is newly downloaded from "https://links.fortinet.com/forticlient/win/vpnagent". The VPN client settings are the same as on Windows 10. The VPN is established, but the client is not receiving any data.FortiClient VPN 7.0.7.0345  

Hi Im trying to get ospf over ipsec. I have already established a vpn tunnel between the 2 site using dialup vpn. When i configure the ip in the tunnel interfaces i cant ping the other side.  I follow the guide for dialup vpn and ospf over ipsec. What videos and i see that once the vpn is established, you configure the ip on the tunnel interfaces and they ping. But i cant get a ping between the two tunnel interfaces. I appreciate any help you can provide Thanks 

Hi, I have a problem on my FortiGate61F, I have a process called "wad_usrinfohist" and it's using 40% of memory on its own. So my fortinet goes to 80% memory usage and goes into conservation mode. When I restart the fortinet, the process goes down again and my fortinet goes back to 40% of total memory usage, but the process goes back up again and brings my fortinet back to 80% after a few days. Do you have any solution to restrict the % of this process? Thanks.

I have FortiGate 60F V7.0 and 8 FortiAP231F  How to enable the WiFi controller feature in FortiGate 60F ? Do we need an extra license or not ?  Thanks.

Hi I would like to test some feature of SDW in eve-ng. so that I want to install NetEm. What is NetEM? I am not very sure. WIthout NetEm, can we use a switch to substitue NetEm for initial SD-WAN configuration on Fortigate SD-WAN network topology? NetEm function is to adjust some traffic feature on wan link such as delay etc? this is correct? Thanks  

Hi all!I've added some FortiGates (running 7.0.9) to a FortiManager (running 7.2.2). All appears to be well apart from the IPsec VPN config.In FortiManager, when I go to VPN Manager > IPsec VPN > Monitor, I can see all the configured tunnels with the gateways and phase 2 names listed.However, I don't see where this is actually configured in FortiManager?I get that if setting up and NEW VPN I need to create a VPN community and so on, but how does it work for an existing FortiGate that had existing VPNs that has been added to FMG?Am I being blind? Sure I don't have to set up the VPNs again from scratch in FMG?Any advice is very much appreciated! Thank in advance.

Hi, We have small public IP (/29) network from our provider, but only one public IP is in use, on External (WAN1) interface. We need to use another public ip, so the only way is add it as secondary to same WAN1 interface?  Also if it's true, don't understand, how then to create a policy to allow, for example, doing NAT through new public ip to internal network ? When I create a new policy with Incoming Interface=WAN1 does it matter which public ip will be using ?  FG100F with fw 7.2.3

As the title says, I don't see the automation category in the security fabric drop down menu. Our Forti gate version is 7.0.9. Is there a CLI command to enable it or a button somewhere that I couldn't find?

 Hello team,  We get the error "Unresolved FQDN" on our firewall for the below: *.discoverysrv.windowsazure.com*.download.microsoft.com*.migration.windowsazure.com*.vault.azure.net Has anyone had similar and what should we do? Other FQDN's are fine. Regards, Forti_tude

In Firewall Policy I have configured data flow policy between two subnets. I have set a schedule for this policy when it is active (specific hours on specific days). I also have full logging enabled for this policy (All Sessions in Logging Options) and would not like to change it.Is there any way that when this policy is inactive (time outside its activity schedule), its logs are not collected as well? I want to get the effect that logs are collected only when this policy is active.

I have one fortigate 100E, one public IPI have multiple subnet for multiple servicesI done 3 Ipsec Remote acces VPN on it and each VPN reach a specific network.My issue is that only one VPN is work, the two other throught an error Thank you for your help

Hi, my firewall detected POP3 Invalid Message Number blocked by IPS. I have checked the fortiguard encyclopedia.Encyclopedia : "This indicates that a client has tried to retrieve a message from a POP server with a number higher than 65535. This is an indication of a buffer-overflow or denial-of-service attack." Does it mean someone tried retrieving a message with a port higher than 65535?Or the total number of messages retrieved is higher than 65535? Or the content of a message has a number of words higher than 65535?Or any other meaning? I am not familiar with this, please someone explain to me. FortiGate 

Hello, I have this question, can we keep the informatons of last hit et last used of rules in Fortigate and Fortimanager after an upgrade to FortiOS 6.4.11? Thank you