Solved

Hello, I have an FG in 7.0.8, where its DNS server settings show DNS service on FortiLink interface and a DNS zone for identrust.com. Do you know if these are default settings in 7.0.8? I remember older releases where the DNS server settings were empty. Does anybody know anything about that? Is this documented somewhere. Thanks

Hello,I am setting up the ZTP function on the fortimanager.After adding the firewall on fortimanager via the "add device" functionThe firewall registers on the fortimanager (via the DHCP option)The registration is done well, but during the 1st installation wizard the fortimanager generates a purge action which generates an install failedDo you know why the fortimanager does this and do you know how to prevent this purge? Should I disable a function?Below are the installation logs Starting log (Run on device)Start installingFGT80E $ config endpoint-control fctemsFGT80E (fctems) $ purge5 can not be deleted because it is a static entry.4 can not be deleted because it is a static entry.3 can not be deleted because it is a static entry.2 can not be deleted because it is a static entry.1 can not be deleted because it is a static entry.FGT80E (fctems) $ endFGT80E $ config user fortitokenFGT80E (fortitoken) $ purgeFGT80E (fortitoken) $ end---> generating verification report<--- done

Hi we have Fortigate 61E (OS version 7.0.7 build0367 feature ) in our organization. At a time we can only allow or deny a port in the firewall policies for a server but can not specify both at a time (Example - allow 80 and deny 1433/1434). FortiGate 

Hello, We purchased about 1000 FortiTokens (Software) and want to assign them to our users. Instead of doing this manually I was hoping there was a way to assign these tokens to all our users at once. The Fortigate is running firmware 7.2.0 and we use LDAP to sync our users.Thank you in advance!

HelloI would like to access a web server in our DMZ from our public IP.Access via https (port 443) works find but the access via http (port 80) does not work.Here are some screenshots of my configuration:    If I change the external service port from 80 to for example 81, then I can reach the web server viahttp://....:81. Is another service running on port 80? I disabled "Administrative Access" over HTTP for wan 1 under interfaces. From my internal network I can reach the web server via port 443 and 80.How could I find out what might cause the problem?Thanks in advance.

Hi, I have a new FortiGate 80F located in a data center since August 2021 and it was working perfect, until October when I started getting notification that the internet was dropping out overnight. At first I thought it was the provider doing maintenance work over-night since the drop outs only happened between 1am to 3am and it was only happening once or twice a month. By December it started happening every second day or so. That's when I noticed that the router was rebooting automatically.Logged a call with Fortinet support, they checked logs, hardware stats, etc, all was showing to be working fine. They asked me to do a hardware diagnostic check and a format to the same firmware 7.0.3. After all those steps the unit kept on rebooting, so they replaced it with another unit.After replacing the unit it only took 2 days and the replacement unit started rebooting again.Escalated the issue again and now they're asking me to do other test. Downgraded to Firmware 7.0.2 and it continues

Hi! I recently discovered this Internet Service while going through the Source. Would like to know what is the purpose of this? Is it related to Spam databases and should we block it? Really appreciate the communities' assistance on this.  

Hi all,I created a SSL vpn with full access.I am able to connect to the VPN portal via web browser.When trying to access an internal https service, I receive this message:"SSL VPN Proxy ErrorThe proxy server could not handle the request GET /proxy/597d4bc4/http/x.x.x.x/.Reason: Access Denied "the x.x.x.x IP is the address of the internel service and is added to the vpn security policy as the destination address. I dont see any hits on the VPN access police!!!On the VPN event tab I have "SSL web application blocked" as a message for that destination host. Could you please help troubleshooting this issue?

Hello,I can't uninstall FortiClient Zero Trust Fabric Agent. When launching the forticlient setup to uninstall, I have only the repair option that is activated. ( if i launch this one i have a fatal error). Below the "Remove" grey button, it is indicated:   "Forticlient cannot be removed while registered to EMS".I can't use it anymore because I think that since v7 the VPN tab is not available. My client with whom i use a vpn connection asked me to install an old version of forticlient. Could you please help ?

Hello,I'm trying to improve my setup. I have a new Fortigate units with 2 ISP: 1 primary and 1 backup under FortiOS 7.2.3. So I followed this https://docs.fortinet.com/document/fortigate/7.2.2/administration-guide/431448/sd-wan-overview in order to add my wan1 and wan2 into virtual-wan-link. I configured a cost 0 on WAN1 and a cost 10 on WAN. I added the default static route through virtual-wan-link. However, I cannot manage the distance and priority of this route and I'm not sure my VPNs (IPSEC + SSL) will continue to work. When I created a VPN (without SDWAN), I used to create a static route to the VPN interface with a lower distance than my default route. But now, I can only create a static route with the same priority. Will it work ? I read this https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-IPsec-VPN-with-SD-WAN/ta-p/209840 but not sure if it's mandatory ? Unfortunately I cannot test right now. I need to create and prepare my

I have a new FortiGate 40F that I'm learning and see that there is Wifi configuration available in the GUI and I'm wondering if this device can act as an access point? Thanks jackster

Hi I have a requirement to block a range of file types, however quite a few of them aren't in the supported file type list in the file filter or for use with DLP filters. For example, I need to block inf, jse, lnk, vbe, vbs extensions, but they are not in the supported list.  Is there any way I can block these file types? Thanks J

This client has FG-224B, and it's at V4.0 MR2, and they have WAN2 for the new ISP which provides 15MB speed (up/down). but at speedtest.net the download speed is good, giving 15MB, but the upload is very bad below 1MB. I have checked the firewall interface, there is no UTM enabled. How can I check the bandwidth settings for this network port? What CLI command shows me the WAN2 setting?How can I connect to the other ports on the firewall and check the upload speed? The network ports used are Port23 and WAN2 only, So how can I connect my laptop and check the speed from other network ports? Also, How can I do speedtest from the firewall itself? So I can eliminate the point of failure, I mean if the firewall is configured well, but we have a limit on the switches/VLANs, etc. 

Hi guys,I just bought a new FortiGate 40F which is up and running but I'm trying to configure SNMP polling so that I can perform the "snmpwalk" command from my MAC. I created the SNMP Agent as v1/v2c and set the community as public for now.I allowed my /24 network to be "Accept queries only", everything is enabled. When I try to poll from my MAC computer on the /24 using this command:     snmpwalk -v 2c -c public 192.168.1.99 I get "no response from 192.168.1.99". I started a packet capture and see the SNMP packet come into the FortiGate but no packets return so it's obvious that I have something misconfigured.  The configuration for the GUI seems very straightforward and everything looks correct, I'm wondering if I have to download FortiGate MIBS and install them before I can execute and snmpwalk from a remote computer? Thanks  

HelloWhen I execute  the command for a multicast address for instance : "get router info multicast PIM dense-mode table 239.2.10.10"  the Upstream IF is not what I attend and the the upstream state is pruned.My  logical configuration (see the picture) is composed by 4 nodes  (firewall 600D) PIM enabled using  between them GRE tunnels  in a HUB and SPOKE architecture. Each Spoke send multicast packet to both HUBs by GRE.The Upstream IF sometime are not the GRE tunnels that the spokes use to send multicast .Any  configuration to force  the spokes to use only a specific GRE between spoke to hubs? RPF seems ignore static routing and policies.Policies and static routing have been configured but RPF neighbor is sometime wrong.  What do I need to use? Policy routing?      

Hello Forti guys, I have a physical Fortimail 400E server mode and we would like to migrate to the new Fortimail 1000D server mode. 1) Is 400E Compatible with 1000D to backup and restore configuration?2) How to backup and restore mailboxes of all users from 400E to 1000D?3) The migration can be one shoot or will be divided into phases of testing? The migration project is stopped due to backup and restore mailboxes from the old appliance to the new one.  Thank you. 

Hello team!!! Is there a way to enable 2 factor authentication for admins with other than local Users?As suggested by Fortinet, I created an AD group, added the AD Group to the local group, and added the local group as admin in System->AdministratorsWith local users I have the "Two factor authentication" option in the gui, but this option is not available with this group, also tried to configure two factor autentication from the cli but "set two-factor" is not possible with this group. Any suggestion?Regards,Damián

 Hello,I have a FortiGate 60E appliance on which I am trying to enable SAML sign-on for the SSL-VPN portal. I have followed the steps in Fortinet's guide, as well as verifying everything using Microsoft's guide. SAML SSO does technically work, but it authenticates everyone as the "azure" user. Here are my configs:FortiGate Side:FW (saml) # show full config user saml edit "azure" set cert "{CERT}" set entity-id "https://{FQDN}:8443/remote/saml/metadata"; set single-sign-on-url "https://{FQDN}:8443/remote/saml/login"; set single-logout-url "https://{FQDN}:8443/remote/saml/logout"; set idp-entity-id "https://sts.windows.net/{GUID}"; set idp-single-sign-on-url "https://login.microsoftonline.com/{GUID}/saml2"; set idp-single-logout-url "https://login.microsoftonline.com/{GUID}/saml2"; set idp-cert "REMOTE_Cert_1" set user-name "username" set group-name "group" next end edit "AAD-

Hi, has anyone try before using RDP to access back into the server within a fortigate?using noip fqdn address as the RDP. while created a loopback interface for the wan port as it only had one public static IP address. Will it works? Below is the configuration set. port1 role - WAN policyincoming int- "port 1" "loop"outgoing int- "internal"source- "all"Destination- "VIP"service allnat disabled VIPint "port 1"External "public static ip"IPv4 192.168.50.222Port Forwardingexternal port 9100ipv4 port 3389

On URLScan.io, some sensitive URLs to shared documents, password reset sites etc. were leaked recently. Is there any advisory for FortiSOAR users to verify their URLScan.io integration is safeguarded from the issue?

Is it blocked or exempt? Exempt comes first then we get the ssl-anomalies We are seeing new behavior in 6.4.9, for windows updates this was resolved by importing the CA. But for push.apple.com this was not resolved by importing Apple Public EV Server RSA CA 2 - G1.crt 

Hello, I have a FGT 60F and have multiple WAN IP configured on WAN1(Network >> Interfaces >> WAN1 ; Manual settings + "Secondary IP address" configured  Is this the right way to configure it? The second thing:one internal IP should route all traffic over the second WAN IP Address and all the other internal devices should route over the "normal/default" WAN IP.   

Looking for a reference on official Fortinet /Fortigate models that offer -48V DC power options.  We are a service provider by nature and most all of our power plant is DC (-48V) sources. Thanks ahead of time, Jesse

Hello everyone,I have two FortiGates 1100E that with HA and the secondary console is acting out.Whenever I disconnect HA and make it standalone both work fine, when HA is connected the console keeps posting messages in Putty "Incorrect login" but I do not even press any key or anything it's just every 5-second posting error login.Did anyone have the same issue and have a resolution to it, I just want to have the console to secondary in case of emergency.P.S. I do know how to connect to secondary CLI via primary > exe ha manage (id of secondary)

Hello there, I'm trying to configure Explicit Proxy on my Fortigate 500E with FortiOS 6.0.5 and no luck so far.My Fortigate is linked to my fortianalyzer and I just want to log every http/https traffic without any deep inspection SSL. I followed multiple tutorials that we can found online and everything is pretty working well when we are using a PAC file (and add it to our web browsers configuration).However, I want to make my last step and make it works transparently. It seems to work well with HTTP website. When I call it, my kerberos ticket is created on my workstation and when I go on my firewall user monitor I can see my user logged with attribute Explicit + Firewall.But if I browse an HTTPS website, I always have a certificate SSL error (and I don't want to import my fortigate SSL certificat into all my workstations). I don't understand why it works well when proxy information is added to the web browser and with the same "filtering option" in transparent, it