Solved

Hi,We are trying to integrate MSSQL via JDBC. However, we are facing an issue in the discovery process. It prompts an error for authentication (please refer to the attachments). Is there a possibility to bypass the SNMP configuration since SNMP is not required for JDBC configuration?------------------------------Cheers,Isuru------------------------------

I want to assign a FortiGate 60F's interfaces to eight different VDOMs, as followsdmz port: VDOM-Ainternal1: VDOM-Ginternal2: VDOM-Binternal3: VDOM-Cinternal4: VDOM-Dinternal5: VDOM-Ewan1: root VDOMwan2: VDOM-F(Then I want to create 802.1q VLAN subinterfaces for customers under each non-root VDOM interface.) But I cannot move internal1 out of the root VDOM. So I tried leaving internal1 in the root VDOM and put wan1 in VDOM-G, but it won't let me do that either. Is there something I have to tweak, to be able to extract one of those interfaces out of the root VDOM, and finally be able to use that eighth VDOM?

When configuring FortiAnalyzer idle timeouts, there is an option for both "Idle Timeout" and "Idle Timeout (GUI)". Anyone know the difference between these settings?I'm thinking that "Idle Timeout" might be for SSH sessions. Pete

I'm hoping someone maybe able to helps. We've been using Forticlient for many years starting with Windows 7, now we are on Windows 11 and FortiClient has worked well up until the recent upgrade from MS, 22H2 where the Forticlient Service Scheduler is stuck on Starting never started. We've been using V 6.2.6 and also v 7.0.5. V7 is just VPN only but both having the same problem. Any help would be grateful.

Hello Anyone with experience out there that has updated their FGs with such a big jump? I have to go from 6.2.5 in steps up to 6.2.11 - then it has me going directly to 6.4.11 per the download tool on Fortinet firmware page. I will perform the upgrade, but just wanted to see if anyone has run into any gotcha's. Thank you... 

I understand that the default action is deny unless explicitly declared in the fortigate firewall policy.Does this apply to 'local-in-policy' as well? Example) config firewall local-in-policyedit 1set uuid 0000000set int "port1"set srcaddr "Block Address group"set dstaddr "all"set service "TCP_22"set schedule "always"nextend

Product: Fortimanager-VM64Version: v7.0.4 build0306So, this is just super fun.  Upgrading a Fortigate from 6.4.x to 7.x requires using a 7.x ADOM, but once you do that if you have any VIP range definitions, they break and you can no longer push policy to the devices.  Like, at all.Even (and especially if) you're only using IPv4, within the 7.x ADOM in the Fortimanager, when attempting a per-device mapping for a VIP, below "External IP Address/Range" and "Mapped IPv4 Address/Range" appears "Mapped IPv6 Address/Range" which pre-fills with "::" and "::3fe" which despite many attempts to remove these values, isn't apparently going away.The end result is that when you try to push policy to the device, it uploads but won't apply because it attempts to set inappropriate IPv6 parameters on the thing, and there's no way to remove them.Does anyone happen to know if there's a sane workaround for this stupid bug?

I would like to use an Ansible playbook to import an SSL certificate into my Fortigate appliance and set that newly-imported certificate as the Server Certificate. Does anyone have any code examples on how to do that?

Hello Community,Dears, I have an issue in setup FortiGate MikroTik IPSec tunnelfrom MikroTik side -> failed to pre-process ph2 packetfrom FortiGate side -> NO-PROPOSAL-CHOSEN/no matchingAny help?FortiGate@IPSec  

Hi All,Load Balancing is defined for external network, but would like define for LAN.I set :Policy Route:Incoming interface: internalSource: IP TESTDestination: IIS SERVER IPOutgoing interface: internalGateway: IP FortiGateFirewall Policy:Incoming interface: LANOutcoming interface: LANSource: IP TESTDestination: Load BalWhy I have to set instead of  Use Outgoing Interface AddressThanks

I accidently disassociated a wifi client from one of my U431F ap's.  How do I reassociate it back? 

I have an IPSec tunnel between my FortiGate (7.0.8 0418) and a SonicWall firewall (version: old). After much hammering I have it working, but only for clients in part of my network.  I'm running using 192.168.8.0/21 as my network and netmask.  In my IPSec settings I have this entire range listed as an address group and in my Local Address list. For some reason 192.168.12.1 through 192.168.13.254 can all communicate with the target addresses.  192.168.10.1 through 192.168.10.254 cannot.  They are all using the same gateway. I can get the .10.0 network to communicate if I toggle the "Local Gateway" in the IPSec Tunnel to "ON" and enter my public IP address.  This kills the .12.0 and .13.0 tunnel connection.  These are both from the same tunnel, running a single Address Group. The firewall policy is set up so that internal interfaces with the associated internal source can go to the Outgoing interface (tunnel interface) with the destination IP

Is it possible to clone a custom dashboard between administrative users on a FortiGate and between HA FortiGate units?

Hello, I have a Fortigate unit where I have multiple VLANs (infrastructure, staff, guest, voice, servers...) and policies set up between them. All user devices (either wired or wireless) go to the Staff VLAN, and they get a DHCP assigned address. What I want to do is to give them an IP and a limited subnet address so that they won't see other devices on the same VLAN/DHCP pool. I've seen this in public WiFis (such as hotels). I tried looking in forums and Google, but I don't even know how this is called. Does anyone here know how to do this?Thanks and happy holidays!Luis

how do i setup forticlient ems ssl vpn to be always up for all users. FortiClient #vpn

Dears ,  are there any concerns to upgrade fortios from 6.4.8 to 6.4.11 so we can use ssl vpn again   ? Regards  

 Hi I have a pair of FortiGate-200E Firewalls in HA modev6.2.9,build1234,210601 (GA) The  advisory FG-IR-22-398 recommends checking for the existence of certain files in the filesystem./data/lib/libips.bak/data/lib/libgif.so/data/lib/libiptcp.so/data/lib/libipudp.so/data/lib/libjepg.so/var/.sslvpnconfigbk/data/etc/wxd.conf/flash The fnsysctl command doesn't appear to be available.$ fnsysctl lsUnknown action 0 How do I list files in the filesystem in v6.2.9? Do I need to enter a privileged mode to use fnsysctl or should I be using another command? I am new to Fortigates and this has just been dropped in my lap. Thanks for any assistance.

Hello,Please I need someone to help.I'm trying to activate trial licence in VM Fortimanager 2.7.1, installed in VMworkstation, but I can't do it.I wanted to configure the static route, after rule to access Internet, and after try to launch the licence activation from fortimanager.But I don't see how I can configure static route and rule to access internet in fortimanager with cli.So I would like to know if you can show me the method to help to activate a trial licence. Thank you

Hello everyone, I have just configured FGSP beetween pairs of FGCP clusters. I have tested some work scenarios: NAT sync, assymetric sync, failover session, DNAT sync etc. All works fine, except one problem. I have some assymetric traffic and I reboot FGSP peer. After peer rebooted session not sync back to this peer therefore I have traffic loss.I have found in documentation "down-intfs-before-sess-sync" option, but it doesn't help.Should back sync session work at all? Or where I misconfigured?Session sync works over L3 link, ForiOs 7.0.3. Configuration: Peer1:config system ha  set group-id 10  set group-name "Cluster"  set mode a-p  set hbdev "port8" 0  set session-pickup enable  set session-pickup-connectionless enable  set session-pickup-expectation enable  set override disable  set priority 200endconfig system cluster-sync  edit 1     set peerip 192.168.50.200     set syncv

I want to upgrade Fortigate firmware from 6.2.5 to 6.2.6 (Same Vdom)Also, I have fortimanager in my environment... So can I upgrade Fortigate firmware directly through Fortigate firewall settings or should I upgrade firmware from Fortimanager and push it in firewall Please suggest what is the best practice for upgrade of Fortigate firmware Image1) Uploading firmware image through Fortigate!!2) Uploading fortigate firmware image through Fortimanager and push it on Fortigate!!

I have setup a Fortigate 60E previously where it allowed an interface to select Internal1,Internal2, etc which is basically port1, port 2. This allowed me to set different ports for the different networks running through the firewall. However the latest Fortigate 60E I have acquired has a Software Switch Interface and it only has the option to add internal which is all the ports. How do you split internal up so I can choose specific ports?  I know it can be done as the other firewall (same model) had this.  

Hello,Im a new user of fortigate devices and need your help.Im trying to configure external access to the web service and unfortunately Im not successful. My configuration:Web server(Apache) - 10.0.8.88/24 (site is available locally by https)Interface - 10.0.8.1/24 Virtual IP:-External IP (my public ip)-Map to Web server (10.0.8.88)-Port forwarding 8000> 443When trying to connect MyPublicIP:8000 I get message "This site is unreachable". From the logs I get the information that it cannot find the right policy, which is incomprehensible to me because I have this one. Incoming interface(WAN1(public ip)) > Outgoing Interface (10.0.8.1/24). Please help,Lukas  

Hi There, I' new with Fortinet products.I have a Firewall event alert from one computer :  I don't undestand what happen with this alert.Does this mean that OpenVPN is installed ?Thanks for you help.Kader

Hi all.I have installed a Fortiswitch over layer 3 network, my fortiswitch is already managed by a remote Fortgate. Fortiswitch is connected directly with a 3rd party firewall in a branch site. Config looks like this: config system globalset switch-mgmt-mode fortilinkconfig switch interfaceedit "internal"set native-vlan 4094set stp-state disabledset snmp-index 11nextedit "__FoRtILnk0L3__"set native-vlan 4094set allowed-vlans 1-4094set dhcp-snooping trustedset igmp-snooping-flood-reports enableset mcast-snooping-flood-traffic enableset snmp-index 13nextconfig system interfaceedit "internal"set ip 172.29.xx.xx 255.255.255.0set allowaccess ping https sshset type physicalset snmp-index 12nextconfig switch-controller globalset ac-discovery-type staticconfig ac-listedit 1set ipv4-address 172.29.8.1nextendendconfig system ntpset allow-unsync-source enableconfig ntpserveredit 1set server "172.29.8.1"nextendset ntpsync enableendconfig router staticedit 1set dst 0.0.0.0 0.0.0.0set gate

Hi, i need to configure two vpn site-to site as in the following network diagram: Fortinet1---VPN---Fortinet2---VPN---Azure I need to reach from the fortinet1 and fortinet2 the servers on CloudAzure . What is the best type of configuration for this scenario ? The fortinet2 do i have to set it up as a hub and spoke ? thanksAntonio