Solved

Hello everyone,We are facing a weird situation.With 1500D HA cluster (active-pasive),  yesterday slave had below messages:     XT2-fs (sda3): previous I/O error to superblock detected     Cannot open /daEXT2-fs (sda3): previous I/O error to superblock detected     ta2/geodb/geoip.EXT2-fs (sda3): previous I/O error to superblock detected     4. Error=Input/oEXT2-fs (sda3): previous I/O error to superblock detected     .... Some services were afftected.Can't see any log when access to slave from GUICan't get snmp data from mgmt port of master sometimes, seem like high cpu happened.IPsec multiple sites are not connected (Ping, remote desktop, file sharing, etc.) However, SSL-VPN can be connected and operatedAfter we shutdown slave, everything went okI am wondering, a disk/partion failed on slave can affect master performance. Is there any information about this case ?  Thank you. 

Hi, i been tasked to solve the problem in Forti 60F configuration. As i never worked with VIP here, so maybe someone could point where is the problem. Here is what must be done:Controller 1 and 2 has IP addresses: 172.22.22.194 and 172.22.22.195; GW is 172.22.22.206FW configuration regarding the are like this: edit "vlan 172"set vdom "****"set ip 172.22.22.194 255.255.255.240set allowaccess pingset alias "scalit"set estimated-upstream-bandwidth 100000set estimated-downstream-bandwidth 100000set role wanset snmp-index 10set secondary-IP enableset interface "wan1"set vlanid 172config secondaryipedit 1set ip 172.22.22.195 255.255.255.240set allowaccess pingnextend  edit "172.22.22.206"set uuid 86e0d2c2-ed36-51ec-69b1-611fb6a18871set type iprangeset associated-interface "WAN_scalit"set start-ip 172.22.22.206set end-ip 172.22.22.206 config firewall ippooledit "172.22.22.194-10.89.48.1"set type fixed-port-rangeset startip 172.22.22.194set endip 172.22.22.194set

Hi, We have aprox. 80 fortigates which we have added on the fortimanager only for the upgrade purposes. We dont want to change or import configuration on the fortimanager. We have some config status issue for example, we have some with status out-of-sync (because we still do changes locally), some with status unkown and some even with status "conflict".  Now my question regarding this. Will this still affect the upgrade process?

Hey there, I just noticed that there is a new last column in the output of the CLI command "diag sys top".Does anybody nows what this this means? Thanks & cheers,Sylvia

We would like to be able to scheduled automated full-config backups to be offloaded to an FTP server. I know the fortimanager has backup capabilities of configs for its registered devices but we do not really need a full central management system (though it would be nice).I'm wondering if anyone has used other solutions/workarounds to make this happen. I believe FortiMail or FortiWeb devices have a scheduled backup that can be run, but not FortiGate. Thank you, Ian

Dear Community,We have a problem regarding user authentication with FSSO. Some users are not getting in "Currently logon users" list in FSSO even though when I try to logoff and logon again, even restarting the machine does not help, but when I check Event Viewer on DC the user is successfully logged in / Authenticated. I will describe as detailed as I can:* We have 2 Domain Controllers (Windows Server 2022 Datacenter)* We do NOT use Explicit Proxy mode. Our fortigate device is Default gateway for users. 1. I have set Firewall Inbound Rules on DC's : UDP/8002, TCP/8000-8001 (For Agent communication)2. I have set Firewall Inbound Rules for Domain Users: UDP/137-138, TCP/445, WMI (For User workstation check and logoff event).3. I have installed FSSO Collector Agent (Advanced Mode) and DC Agent on both Domain Controllers. (FSSO_Setup_5.0.0308_x64). Used Domain Admin Credentials.4. HKLM/SOFTWARE/Fortinet/FSAE/DCAgent/ca - shows both DC IP's on both Domain Controllers.5. "Show Service

I have a Fortigate and configured 2 interfaces that connect to 2 different ISPs. Interface 9 - ISP AInterface 10 - ISP B Basically, I would like all computers to use interface 9, except for a selected few that will use interface 10. Interface 10 is configured with a DHCP, and I've been told that because of this, Interface 10 becomes the default route. To fix this, I created a Policy Route so that all traffic goes to Interface 9. Then I created another  Policy Route to make the selected few computers to use Interface 10. This all works perfectly fine. My question is: If interface 9 goes down, will the computers automatically use Interface 10? I don't want it to use interface 10, I want the computers to just not have any internet access at all if interface 9 is down. (sounds odd but there's a reason for that). I am unable to test this out now, hence this question.        

I have a Fortigate 101F running v6.4.6.  A 360GB drive that's 1% used.  I've changed maximum-log-age to 365.  However, under Log & Report -> Events, only 7 days of logs are shown.  Below is my "log disk setting". config log disk settingset status enableset ips-archive enableset max-policy-packet-capture-size 100set log-quota 0set dlp-archive-quota 0set report-quota 0set maximum-log-age 365set upload disableset full-first-warning-threshold 75set full-second-warning-threshold 90set full-final-warning-threshold 95set max-log-file-size 20set roll-schedule dailyset roll-time 00:00set diskfull overwriteend What could be the problem?? 

Hello everyone,For the Fortinet client 7.0.7 auto uninstall disappear. My case: the computers in the company are installed with Fority Client (7.0.7), and the software naturally disappears.It will reappear after many restarts or reinstallations (completely disappearing from the control panel).Has anyone encountered this and has a solution? Thanks.

Hi guys please help, I have a task in my office to create SD-WAN connection via FortiManager. but I have confused to make connection from Fortigate Branch to FortiManager because the branch WAN is DHCP with private IP. the position of FortiManager is on server (behind NAT) and it has public IP by using NAT from Fortigate. Is there any KB or suggestion to establish connection between it to make Fortigate on branch can be managed by FMG and create SD-WAN connection? Please advice .... topology:                            |HQ Site|                                                                                                          &nbsp

I was cleaning up my fortimanger when I happened to notice at the bottom of my push config wireless-controller vapdelete "Chloe_203"delete "Crowley_App"delete "Crowley_Cams"delete "Micah_App"these are all in use.  Is there a reason why its trying to delete them?

Hello everyone. I have a Fortigate in which, with 2 physical interfaces, I have created a software switch.In that switch  I have created some Vlans with IP. Traffic between those Vlans doesn't work without policies, which is what I'm looking for. Its ok. However I have read about intra-switch-policy explicit and have verified that the policies that work are between the interfaces that make up the software switch. On the other hand, the IP, I give it to the switch software instead of the vlans. I have not been able to ping any Vlan within the software switch with the intra-switch-policy explicit command. It doesn't work even allowing , into permit all policys, the Vlans that I create and the physical interfaces of the switch software. I can Only ping traffic between the interfaces of the software switch, wich have the same IP. So what I want is the first option, which works just the way I want it to. But I wonder if this way of configuring the switch software could give m

Hi, I've been waiting months for the release of fortclient 7.2 with its EMS server. It has now been months since it was announced but it is continually being postponed.Are there still any chances of being able to see it downloadable? :)

FortiGate Hello i need support, i have an OpenVPN server on my network, and its listening on default port 1194 so I created a VIP from the public to the inside but VPN is not working I have tried multiple ways but no luck, so i ran debug on the srcddrs and I see TCP rst message .   edit OVPNset comment "OVPN"set extip 1.1.1.1set mappedip "2.2.2.2"set extintf "wan2"set color 12FW policy :-set srcintf "wan2"set dstintf "lan1"set srcaddr "all"set dstaddr "OVPN"set action acceptset schedule "always"set service "ALL"set logtraffic all wan2 is my secondary circuit, so I created a route policy  for the return traffic edit set input-device "lan1"set srcaddr "2.2.2.2"set dstaddr "all"set output-device "wan2"set gateway 1.1.1.2Thanks 

Hello Support Community,Is it safe to say that the API Key for the Fortigate does not expire? If I were to generate one using the command line, could this be re-used forever?execute api-user generate-key apiadmin  Appreciate it

EnvironmentPostgresSQL = 15Patroni = patroni-2.1.4-1.rhel8.x86_64 & patroni-etcd-2.1.4-1.rhel8.x86_64OS = RHEL = 8.xDetailWe have a setup of Postgres Cluster with 2 nodes. On top of Postgres Cluster a load balancer (name HAproxy) is also installed. Additionally the Postgres Cluster use Patroni software for HA related activities against Postgres Cluster. Patroni update the HAproxy to let him know who is Active / Leader node of Postgres Cluster thru API. So HAproxy know who is Active node of Postgres Cluster and send traffic to only Active node of Postgres. My Query: Does Fortinet Firewall have support for Postgres Cluster and can we use Fortinet Firewall in place of HAproxy in above mentioned environment  

Hello, I want to migrate a Policy Package from one FMG to another. I have seen that it is possible to export a Policy Package to a CSV file, but I do not see any option in the FMG to import a package (from a CSV file or whatever). So, if I want to migrate a policy package from one FMG to another, is there any tool that does this automation? Or, what is the recommended way of doing that? Thanks

Hi,I know this is not best practice to use same certificate on all FortiGate for IPSec VPN Authentication.But I'm wondering, let say I deployed Hub and Spoke with 10 branches connect to DC as hub.Can all FortiGate use same certificate for IPSec VPN authentication? Does FortiGate can authenticate each other? ThanksAri

Hi I am testing some Explicit Proxy configuration and have configured an authentication rule and scheme to use agentless NTLM auth, which works fine.   I can see the authenticated users in the Firewall User Monitor Dashboard, where is shows a time-out value which looks to be set to 10 minutes  I have been trying to find out where this time-out is configured, but can't see anywhere where it is set to 10 minutes.  I've looked at the settings mentioned in these articles   https://community.fortinet.com/t5/FortiGate/Technical-Tip-Explanation-of-auth-timeout-types-for-Firewall/ta-p/189423 https://community.fortinet.com/t5/FortiGate/Technical-Tip-Authentication-timeout-value-for-firewall-user/ta-p/193705  but there is no auth timer set to 10 minutes. Anyone any ideas where this is configured? Thanks John FortiGate 

Hi, I have a strange problem. I have a new Fortigate 60E and I've configured it to replace an old pfSense router. There is an OpenVPN server inside the network and I have to create a portforwarding to it. I'm not able to get this working. So I created another portforwarding to a Windows machine and tried to RDP into that. To my surprise this works. I can even test the policy with Policy Lookup to simulate a session to the external IP-adres. TCP 3389 works without a problem. TCP 943 (management page) and UDP 1194 (tunnel) don't match a policy. I've checked it over and over but I guess I'm missing something.   This is my CLI configuration:  config firewall policy     edit 13         set name "OVPN"         set uuid eeb3d648-70dd-51e9-8b48-10597084cee0         set srcintf "wan1"         set dstintf "internal" &n

Hi Please see the below config, which include http and https. why I can only access it via http instead of https? thanks  FG01 # sh system interfaceconfig system interfaceedit "port1"set vdom "root"set ip 192.168.1.221 255.255.255.0set allowaccess ping https ssh httpset type physicalset snmp-index 1

Hello all, So I've got a situation that I've not seen reference to, so i figured i would post here. I have two FortiGate 100F devices set up in HA (two ISP's/108F's in SDWAN outside) running 6.4.11. I currently have a mish-mash of switches inside the network-x1 HP ProCurve 2810-48G, x2 Juniper EX2200 POE, and x1 Dell N2048.  All these were in place when I started working here and I have been working to upgrade things as I can.  There are multiple VLAN's set up (server, users, voip, printers) and DHCP is handled by an active directory server. So now I have finally received x5 FortiSwitch 148-FPOE devices and I am working to try to slowly integrate and replace these switches with the existing ones.  The new switches will be set up in a ring to the Fortigates via the SFP+ ports. Is there some documentation or something I have missed that advises in this situation?  I am working to replicate the VLAN configs from the established switch

hello togetherQuick question.is possible with FortiAnalyzer to show the traffic and traffic shaping in one report?

HelloWhich rules: "Local In Policy" or "IPv4 DoS Policy" have higher priority in filtering traffic and should be activated first?It makes sense to me that the "Local In Policy" rules should work first. If some network traffic is detected and stopped in "Local In Policy", it should not reach the "IPv4 DoS Policy" module anymore...However, that's probably not the case...I have a rule in "Local In Policy" that blocks network traffic by geolocation (Russia, China, etc). In "IPv4 DoS Policy" I tested only one rule with very small values (e.g. 1, 5) of anomaly thresholds and a "Monitor" action (does not block) to see if any network traffic comes here.In Fortianalyzer, however, I observe that the rule in "IPv4 DoS Policy" captures network traffic that should not be allowed by the "Local In Policy" module, i.e. network traffic from countries such as Russia, China, etc.I gave here an example of blocking after geolocation, but the same behavior is also in the case of attempts to block specific I