Solved

Dear Community,i am having problem with logging in a fortimanagervmdoownloaded img, installed it on HyperV with 4 GB RAM 2 CPU cores1 initial nic vswitch1 initial vhdd FGMVM has a dummy policy to connect to internet through FGT.I can see the traffic logs from FGT and ping from the CLI of the VM when i try to log in with Forti cloud creds from GUI i get undefined error I tried to upload my trial license file from my assets with no avail. Any ideas?Thanks in advance

Hi All, I had try to find any CLI command everywhere for fortigate to display the status of the power supply unit when doing UAT, Power Redundancy Test. But could not be found.For this unit, Fg401E, Fw 7.0.10Example like, when 2 PSU is plug on, the status will be like Connected or Ok. When one of it is unplug off, the CLI command will display 1 PSU connected 2 PSU Not connected, etc.Attached is an example of it. 

HiiCould someone help me please to identify the problem I don't know why this traffic is blocked and it affects our ADSync Server online syncronization  

Hi, On FortiGate, an IPsec Tunnel is configured to the AWS site-to-site VPN, which is the only configuration to communicate to the outside. However, I have found some internet-service-name configs(ISDB) unintentionally rewrote like FortiGuard synchronized updates. I wonder why this FortiGate can communicate with FortiGuard under the condition that IPsec Tunnel to the AWS site-to-site VPN is the only way and. The configuration is like this:---config firewall policyedit 1set srcintf "LAN"set dstintf "AWS_Tunnel"set action acceptset srcaddr "all"set dstaddr "all"set schedule "always"set service "ALL"--- I would really appreciate if anyone gives an advice. Thank you,

I have a user that i setup for ssl vpn connection with the forticlient 7.0.8.  the device is having trouble conencting and stops at 20%  this happened after some required software was installed.  Is there anything that anyone knows of that would interfere with forticlient from connecting to a ssl vpn?   thanks

Hey FortiExperts, For FortiGate NGFW throughput e.g. 60E - 250 Mbps - NGFW60F - 1 Gbps - NGFW This NGFW would be traffic that is utilising security profiles e.g. web/application control?Say in my scenario I am allowing outbound traffic with one firewall policy with security profiles enabled. Would the max throughput be throttled to 250 Mbps if I was running a 60E? Likewise if I was running a 60F instead of a 60E would this throughput limit to 1Gbps? I would like to clarify what NGFW means on the datasheets https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiGate_FortiWiFi_60E_DSL_Series.pdfhttps://www.fortinet.com/content/dam/fortinet/assets/data-sheets/fortigate-fortiwifi-60f-series.pdf   If you can also refer me to the documentation to understand those metrics on the datasheet this would also be appreciated thanks.    

Is there a how-to on configuring yubikey 4 on a Fortiwifi 60E for a second MFA on VPN? Is it done in the CLI? I am also  using the fortinet vpn client 6.0.10.0297. Thanks for any insight.

I have upgraded kubuntu 22.10 to version 23.04 recently, and since then Forti Client refuses to connect with the error message "Config routing table failed" (was working well before).  An excerpt from the sslvpn.log: 20230424 21:10:49.713 [sslvpn:DEBG] route:380 Tunnel mode: Full tunnel20230424 21:10:49.713 [sslvpn:DEBG] route:381 Exclusive routing: Disabled20230424 21:10:49.713 [sslvpn:DEBG] route:434 Can't find dev for IP XXX.XX.XXX.XX (tun)20230424 21:10:49.713 [sslvpn:EROR] vpn_connection:1335 Config routing table failed I have already tried reinstallation, also with a different version of the Forticlient (7.0.7.0246 instead of 7.2.0.0644), and I have also tried connecting from a different network - without success. Has anybody encountered similar problems after upgrading to ubuntu 23.04? Thanks in advance,Friedrich

Currently we have 2 sites that we connect through a Site to site VPN, this is already up and running. All of our servers are on Site1. We would like to have our printers and access controllers on Site2 get an ip address (and communicate with) from the server on Site1 without adress translation or a static route. Is this possible? And what should I do for this and/or what am I doing wrong because it is not working. My apologies if this is a stupid question, if anyone feels like taking a look at this dummy problem with us, we are immensely grateful.... 

Hi Is there any option to monitor the percentage of accelerated sessions in fortigate firewalls with enabled VDOM?I've been  looking for an OID to get this parameter but I can't find it.thanks Manel

I have successfully configured a site-to-site VPN connection between 2 Fortigates.The two subnets of the locations can also reach each other with static routes.However, if I create a policy-based route instead of a static route, no data is transferred.Unfortunately I didn't find a suitable article about FortiOS 7.2.This article cannot be implemented this way under 7.2: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-policy-routes-for-route-based-interface/ta-p/193376Can someone give me a tip here?

I have the following use case with Fortigate 6.4.12: I have a DNS domain hosted with my ISP for internet facing service say myorg.com. Therein I have several hostnames for services. I need to split-brain only specific hostnames under this domain internally on my corporate LAN. For example  When www.web.myorg.com is resolved from the internet I wish to give 1.1.1.1When www.web.myorg.com I wish to return 2.2.2.2When anything underneath it (host.www.web.myorg.com etc.) is resolved I wish to forward to another set of DNS servers Internally on my corporate we use Windows DNS servers. Whilst these support conditional forwarding catering for 2 and 3 is messy and requires multiple upstream DNS servers. Can the Fortigate DNS servers setup with non-authoritative zones simply answer for specific records and forward for all others in a zone? 

Hello. we are using a 100d and the field crew is working over ssl vpn. Now we are thinking about backing up the clients over ssl vpn as well. Unfortunately it's not possible to get this running. Client update of the backup software (acronis) is not working but the client is shown as online in the managemnt console. Is there a principle thing I do not hink about? The access of c$ is not possible as well.

Hello Fortinet Community We have FortiNAC 9.4.3. All corp hosts have PA agent. We enabled PA optimization on all access switches.Without IP phone everything works fine. However when we connect a host with PA agent behind a IP phone, the PA seems not to initiate DHCP request when VLAN is changed, so the host's IP remains unchanged, until we initiate ipconfig /renew, here the IP is renewed correctly and all works fine.This issue happens every time when VLAN is switched by FortiNAC, e.g.: from isol to prod, or from prod to isol, or from prod1 to prod2, ... etc Any useful idea would be appreciated.    

Hi. I have a question regarding IPSec VPN.We have a customer that is currently in the process of switching from an ASA 5505 to a FG-40F-3G4G, both physical on-prem.They have an IPSec VPN as of right now, which we use to access thier enviroment to make regular maintenance. With this, they will also replace their physical server which they host two VM's on (App and DB) with two VM's hosted in our cloud service along with another virtual firewall (PfSense) hosted in the same cloud. My question is, they have a public ISP with a dynamic public IP address and this in turns makes it hard for us to setup IPSec VPN on the FortiGate. Is it best to make the PfSense an OpenVPN client and make a OpenVPN connection to the FortiGate, or is there a better way to do this?If more information is needed, feel free to ask and thank you for all the answers. Kind regards

We have a current SD WAN setup with LAN internet connectivity traffics load balanced to 2 ISP providers - both WAN interface IPs are used and the bandwidths are combined.192.168.0.0/24 --> ISP-A-50Mb (1.1.1.1/29) + ISP-B-50Mb (2.2.2.1/29)Both IPs are used randomly in each session even in a single deviceBandwidths are combined to 100MbpsThis time I would like to use the other available IPs from each ISP block then still have the bandwidth combined and load balance from a diff LAN subnet.192.168.10.0/24 --> ISP-A-50Mb (1.1.1.2/29) + ISP-B-50Mb (2.2.2.2/29)Attempt: Assign overload IP pool for each ISP, and setup an outbound firewall policy NAT to it.Only single IP (random) is used per deviceOnly single ISP bandwidth is utilized - 50Mbps

Good day all. The IP address assigned to one of my WAN interfaces on my Fortigate changed unexpectedly a few days ago. It is assigned by my ISP via DHCP. Is there a log I can check to determine exactly when this happened?

Hello I just want to know if it is possible to make a suggestion for NSE training institute for adding the feature of different playing speeds. As in x0.25, x0.5, x.075, x1, x1.25, x1.5, x1.75, x2 speeds. If I am supposed to make this suggestion somewhere else, please refer me.Best regards.

Morning: New to Fortigate, and am trying to setup SNATing some VMs out to the Internet from my home lab on VLANs. It's a 40F, so it doesn't have a VLAN switch. In this instance, the VM is on vlan50, using the Fortigate as a DHCP server. It receives an IP in the proper range, and I can move the VM from vlan to vlan in the lab, and it recognizes the different subnets and gets DHCP for them. So tagging seems fine. I just can't get out. My processAdded VLAN interfaces to the LAN w/DHCP, which is just ports 1-3 for now.Central SNAT is enabled. ALL/ALLFirewall policy: vlan50 > wan, ALL/ALL/ALLThe policy is getting hits, but I still can't ping out to any external IPs. I have a feeling I'm missing something simple here :) Any suggestions on what I'm missing?  id=20085 trace_id=197 func=print_pkt_detail line=5846 msg="vd-root:0 received a packet(proto=17, 10.16.50.50:57296->1.1.1.1:53) tun_id=0.0.0.0 from vlan50. " id=20085 trace_id=197 func=init_ip_session_c

Dear All,            I have a fortigate 61F, just wonder if Web filter support on only blocking specific gmail address rather than blocking the whole gmail.com ? any help would be appreicated  keith

I understand that the steps are to download the config fileChange the firmware , build, version, interfaces of the config fileUpload the edited config file into new firewall.Any other steps I need to take to ensure that the configuration port over is ok?

Hello guys! I have web filter configured on my fortigate 80F to my AD users and for the las 3 months it have been working fine, since last month a profile where the Web Chat category is permited started blocking the whastapp web. The logs tells the block is because the webfilter is categorizing whatsapp web as Social Networking. The FortiGuard Web Filter Lookup categorizes it as Web Chat, I created a web rating overrides to solve the problem but why my fortigate is categorizing it like social networking?

I have web filter configured on my fortigate 80F to my AD users and for the las 3 months it have been working fine, since last month a profile where the Web Chat category is permited started blocking the whastapp web. The logs tells the block is because the webfilter is categorizing whatsapp web as Social Networking. The FortiGuard Web Filter Lookup categorizes it as Web Chat, I created a web rating overrides to solve the problem but why my fortigate is categorizing it like social networking?Please, see the following raw log:date=2023-03-21 time=15:30:54 id=7213068811073749046 itime=2023-03-21 15:30:54 euid=12697 epid=1206 dsteuid=3 dstepid=101 type=utm subtype=webfilter level=warning action=blocked sessionid=179721645 policyid=41 srcip=XXX.XX.XXX.XXX dstip=157.240.222.60 srcport=53029 dstport=443 proto=6 cat=37 logid=0316013056 service=HTTPS user=USERNAME group=FSSO_SPO_ProPlus eventtime=1679423454318969117 sentbyte=1239 rcvdbyte=3451 srcintfrole=lan dstintfrole=wan direction=outgoing

Hello team!!  Greetings!! We have 2 sites with a FGT60F in each site. (7.2.3 in one and 7.2.4 in the other)Each site has 2 WAN interfaces in an SD-WAN Currently we have 2 VPNs IPsec site to site:* Site 1 Wan 1 <-> Site 2 Wan 1* Site 1 Wan 2 <-> Site 2 Wan 2We are having troubles with this, sometimes one VPN stop passing traffic and users complain.  Then we change route distances to use the other VPN. I am wondering about the differences between "Aggregate" "Redundant Interface" and "SD-WAN" for IPsec site to site VPNs.Some considerations:* We dont care if the traffic is balanced, but we want the link will be working as much as it is possible* We would like to view the redundant links status, preferably in gui* It would be nice to create some email alert when some link is down.Which method do you reccomend?  Thanks in advance.Regards,Damián 

Dear guys!! I can not send my email to other via outlook when use my network (forttinet router) on both WIFI too cannot send, but I try on an andriod it's send normally, So why? can help me plz!!!!