Solved

In environments which do not have NTP server, we usually prefer Fortigate to announce time to related interfaces. However, I recently bumped into an interesting problem. With this fortigate, time is set manually and it has never been connected to the internet. When ntp server to specific, directly connected, vlans is enabled. Even if it seems to be working none of the clients could reach out and grab time from fortigate time server.I could not find any related info at the knowledgebase and documentation. Is there anybody who has experienced such a problem?FYI: Fortigate should be kept offline and connection to the internet even for a brief second is not possible. 

Good morning. Trying to clear these input and output port stats for a FortiSwitch running v6.4.x  Any suggestions?Port(port13) is Admin up, line protocol is upInterface Type is 10 Gigabit SerDes Framer Interface (SFI)Address is 04:D5:90:E9:FB:32, None loopbackMTU 9216 bytes, Encapsulation IEEE 802.3/Ethernet-IIfull-duplex, 10000 Mb/s, link type is manualinput  : 118759473804980 bytes, 128798728685 packets, 0 errors, 520 drops, 0 oversizes         128772867347 unicasts, 3135872 multicasts, 22725466 broadcasts, 0 unknownsoutput : 134128322003035 bytes, 138778544432 packets, 0 errors, 253307 drops, 0 oversizes         138646043063 unicasts, 57748125 multicasts, 74753244 broadcasts0 fragments, 0 undersizes, 0 collisions, 0 jabbers 

Hi  Actually, I could not find a resource that mention how to add Threat Map dashboard to the Fortisoar, I've no idea if it is a dedicated connector/widget or dashboard related to a specified connector. Thanks 

I'd like to know the difference between the Fortigate Local user and the Administrator User.Is there any Topic or technical documentation that addresses this?

Hi There,  

Hi guys, just a simple question : My Fortigate 90D,  under VPN Creation Wizard, STEP 2 , when asking for IP Address, it wouldn't let me input a port as we are using xxx.xxx.xxx.xxx:444 Is there a way to add a port to this IP address  Thanks in advance 

Setup required as follows: -In office LAN- User logs into PC/ Laptop with authentication and gets access to internet.Internet usage capping is done on particular user/ group (example- 10GB daily traffic is assigned). Currently we are achieving this via web filter security profile usage capping bandwidth quota in proxy mode.  Post user/ group has consumed the 10gb daily traffic; automatically the speed should reduce as per traffic shaping applied. Query here: - How to set it to daily usage for the amount of GB traffic capped.How to configure firewall to automatically allow traffic shaping applied over users in scope once they have consumed daily traffic allowance. Is it possible even or not to achieve such use case? Kindly confirm. User are authenticated via LDAP in FortiGate. 

Hello Team, Basically, I have planned a fortisoar implementation with Rocky Linux 8.6 and Fortisoar Bin file but there is no docker step for this implementation in 7.3 documentation. I have below doubt as well : 1) If I install fortisoar with rocky linux + bin , then can I run automation scripts without docker? FortiSOAR 

Hello,We have a problem with a client to create two VPN IPSEC DialUP.  How can I get access to the following post?https://community.fortinet.com/t5/Internal-Knowledge-Base-Articles/Technical-Tip-Using-Peer-ID-to-connect-to-multiple-IPsec-DialUp/ta-p/193477?externalID=FD38084common.feature.saml.dev.post.page_title  Thank you.

We're setting up an EMS VPN Tunnel to push out a VPN profile to FortiClients. In that script, we want to execute a gpupdate when the user connects to VPN. That way their GPO mapped drives will be mapped when the tunnel comes up. The question: When exactly does this script run?  Immediately after attempting to bring up the tunnel?  Or only once the tunnel is successfully up and running?  We're debating adding a sleep timer to the script to wait before executing the gpupdate.  But we only want to do this IF it's necessary.  Otherwise, we'd rather remove any delays, so users can have their mapped drives ASAP after the tunnel is up.

You used to be able to sort columns on the web interface (pretty much any screen that has columns) by right clicking on the column and dragging the items around to the order you want.  It seems somewhere along the line they either removed it or somehow made it work differently.  Any suggestions to change the column order? https://drive.google.com/file/d/1U_J-Ezgse52-QQt8byVpSkAGxP_vhSE-/view

The default route in Fortigate device leads to the operator, which has its own additional network protection. For example, it blocks Fortigate servers! I cannot change it. But we have the other operator on second WAN port. For one of VLANs I have defined appropriate policy routing. How can I define such policy routing for traffic from the "inside" of the device (communication with Forticloud, downloading antivirus definitions, etc.)? Which port is the source port for such traffic?

Hi Team,My Forticlient EMS is behind a Fortigate NAT , port 8013. Can I connect to EMS from my client on a public IP with a port? For example: 3.3.3.3:8013 Or do I have to use fqdn?FortiClient,FortiGate, FortiClient, FortiAuthenticator, FortiDB

For a client, I am trying to setup a vpn site-to-site from a local Fortigate 200F, firmware 7.2.3, to the AWS site-to-site connectors. I succeded to make it so I could ping from AWS to a local machine, but ping from a local machine to a AWS machine would not work. How I did it and config I went in the docs of AWS and Fortinet, followed them, then downloaded the IKDv2 configuration file, followed the instructions, and it was pretty smooth for those parts.* Fortigate Network IPSEC tunnels section here:Fortigate routes here:  *In this post, I'll only talk about one tunnel, and I'll ask the community about the two tunnels failover in another post. So the route on AWS side are working and I suspect that the AWS side is not the cause here: My Firewall policies are there:   And If I DENY my AWS VPN to the local LAN, the pings from AWS to local LAN stops, so this is proof that that direction goes by the Firewall.If I reverse that by puttin

Dear All,We want to enable FIPS mode in FortiOS 7 version and above.As per details available till now, we found FIPS-CC mode which gets enabled in FortiOS 6.2 and below;post loading FIPS-CC firmware over the box and enabling it in CLI. In FortiOS 7 and above, we do see config system fips-cc but enabling the mode is disabled. Please confirm if Fortinet does not compliant now with FIPS standards or if it does, then what are the steps to enable it? 

Hello, Some of the devices in our LAN are relying on hostnames to address other devices, e.g. server-a, server-b, laptop-john.In our pfSense setup we have DHCP Static Mappings, which are binding MAC addresses to IP addresses and at the same time specifying a hostname. Is there a way to achieve the same in FortiGate or at least some alternative solution? Thanks in advance!

hi everybody,I'm testing custom IPS signatures with FortiGate 60 (firware v7.0.9 build0444 . The idea is to detect and block http responses  containing certain strings like "<?php" (php opening tag should never appear in the output html code). My web server is located in DMZ protected by Forti (of course, the right IPS profile is attached to the right firewall rule). since it doesn't work with http (80) I didn't even try with https. In order to exclude server compression I even tried talking  to my web-server using telnet client - without success. thx for any hints:I tested many combinations like this:F-SBID( --name "php_detect1"; --default_action drop_session; --service http --protocol tcp; --app_cat 25; --flow from_server ; --src_addr 86......230/32; --pattern "<?php"; --no_case; --context body; ) F-SBID( --name "php_detect2"; --default_action drop_session; --service http --protocol tcp; --app_cat 25; --flow from_server; --src_port 80 ; --pcre "/<\?p

 Hi everyone i will try to backup FortiEMS database via GUI, but error. how is the solution? have you ever experienced it? FortiClient  

Hi, I had saw a quite a lot on the guide to solve. But I had tried on the method but it is still failed. I can manually add the device and I can authorize the unit, both method can work.But we try manually add, once added and it will be stuck at the section and failed (see image below).Need some advice on it. Below is the issue.FGT201F is on 6.4.9 (upgrade from 6.4.4)FMGR is on 6.4.9FGT is not an internet-facing unit. Status: reloadconffail|datasrc invalid. object: dnsfilter profile ftgd-dns filters.24:category. detail: 96. solution: datasrc invalid 

Hi,I have a question about the fortilink. I transformed port A of my fortinet into a classic lan port.And I use a DHCP on this port but it does not work, I do not get any ip address (if I fix the IP address, the network works)the DHCP does not work because it is a Fortilink port? How can I solve this problem?

Hello, I want to deploy the following very simple traffic shaping scenario:port1---WAN---> High priorityport2---WAN---> Low priorityI have set two shared shapers for that:High: Traffic priority - High, Max BW = 6000, Guaranteed BW = 2000, DSCP = OFFLow: Traffic priority = Low, all other settings are OFF With these settings, a client PC that is browsing from port2 (low priority) is taking all the BW and the high priority traffic is not served. When I set Max BW at the Low priority shaper, both shapers are served. I was assuming that when the priority is set to Low to a traffic shaper, all traffic should be put a low priority no matter the bandwidth. Therefore it shouldn't matter if you have set a Max BW or not. However I notice that the Max BW really matters at Low priority shaper. Can somebody explain to me how the traffic shaper is working at low priority in respect of the Max BW setting? How does the low priority shaper is working, when the Max BW setti

Hello, first time posting in the forum.We need some help, need step-by-step assistance adding FortiGate 80E to Cisco 3750 stack, we have multiple different subnets, would like them all to coming together, seems there is multiple ways posted online for doing this, what's the best way to do this. We have several interfaces with IP's/SVI on Cisco stack, along with several VLANS. Not sure how to configure the FortiGate for the new networks, if routing is required, Policies we should create to allow all networks to connect. Thank you all for your help 

Have to replace Fortigate-300D in challenging position in rack. Defective unit is mounted with the ear brackets. Need to verify/confirm the screw size and bracket dimensions/length. Will need to use right angle rachet screwdriver to get unit out and need to confirm bit size. And/or - anyone have mechanical drawing of Fortigate 300D that might detail screw size. Much appreciated. Did check Fortigate300D install guide but it just has generic pix of bracket and screws but no specifics. 

Hi allI have updated to FortiOS 7.2.3.And then I realized following bad configuration.----FG60F # config system email-serverFG60F (email-server) ## set reply-to noreply@example.comcommand parse error before 'reply-to'Command fail. Return code -61FG60F (email-server) #----By this Document, I can set 'reply-to'.http://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/526019/email-alertssomeone have how to config 'reply-to' in FortiOS 7.2.3?thanks.

Hi All, Do you encounter the issue with 2 PC connect same IPsec VPN on same wifi network? Mean, 1 PC connect the VPN, another PC unable connect VPN, until the 1st pc disconnect the VPN, 2nd PC just can connect the VPN.