Solved

FortiManager-VM64 v7.0.3 GA build0254Log View... TrafficI notice many "Policy Violations" from china.Is this just standard "door knocking" on Telnet ports that I can ignore or is it symptom of more serious problem? 

Bonjour,Je veux essayer de résoudre les conflits d'ip lorsque je suis sous vpn.Mes utilisateurs ont besoin de se connecter en rdp à un serveur qui peut avoir la même ip que celui qu'ils ont chez eux.être explicite ; L'exemple :le serveur : 192.168.0.66home ip :192.168.0.66Il m'a semblé qu'avec l'option "Enable Split Tunneling" il était possible d'éviter ce conflit. Mais j'ai fait quelques tests, ça ne marche pas.J'ai peut-être tort ?Une idée ? Merci

Anyone know does the forticonverter on the juniper conversion section is determined by the model or by the OS? Need assist. As I have a ISG1000 running on ScreenOS want to do conversion but I saw only SSG(ScreenOS), SRX(Junos OS) and MX (Junos OS).

Hi, guys, Just would like to know if any way to view the local-in-policy hit count, thx a lot ? I tried the normal method, but failed, as the following: For viewing the hit count of  a normal security policy ( working ) :Ftg100E # diag firewall iprope show 00100004 36idx=36 pkts/bytes=485923/517732782 asic_pkts/asic_bytes=474029/508168477 nturbo_pkts/nturbo_bytes=0/0 flag=0x0  hit count:207 first:2020-03-30 16:17:19 last:2020-07-22 12:46:59 established session count:0 first est:2020-03-30 16:23:14 last est:2020-07-22 12:46:59  For viewing the hit count of the local-in-policy ( not working ? :(Ftg100E # diag firewall iprope show 00100001 1 idx=1 pkts/bytes=0/0 asic_pkts/asic_bytes=0/0 nturbo_pkts/nturbo_bytes=0/0 flag=0x0 Ftg100E # diag firewall iprope show 00100001 2 idx=2 pkts/bytes=0/0 asic_pkts/asic_bytes=0/0 nturbo_pkts/nturbo_bytes=0/0 flag=0x0  Please advice. With many thanks.Benson  &nbs

hello @Alli have a problem with fg-1100E firmware v7.2.2.when i want to create a hardware or vlan switch, i get sw0 & sw1 offered. so far so good, but why are the ports greater than 28 not included?i need the QSFP+ port 34 as uplink and at the same time other ports for subordinated switches or special servers. some of them are access ports and others are trunks.so at the moment i only have the possibility to create a software switch, but unfortunately it does not allow me to differentiate different ports with the same vlan as desired.i can't even define ports 33 and 34 as dedicated ethernet trunks.why is this?thxjmc

Hi Everyone, please help me to understand this,  when I checked the Event monitor by threat (High Risk App Usage), I found out that the application: TOR is using by some computers in company, actually the tor is not installed on any computers, please let me know why Fortianalyser show that? how we can investigate? Thanks  

Hello team!!! Through the cli, I know the way to use email as second factor authentication for a user, but I wonder if there is a kind of limit for this feature.  Is there a limit for licences for local users with email as 2FA?Also, another question, I think 2FA for VPN clients is only available for FortiClient VPNs (IPsec or SSL), right? I think I can not tell Windows or any other OS to ask me the second factor of authentication.  We have here a L2TP/IPsec VPN, which works in native clients, we prefer do not use FortiClient but I think we will need this. Regards,Damián

Hi,I got a Linux box setup on a DMZ with the IP 192.168.30.2 connected to my FG 30E DMZ port. The Linux box is setup with iptables to forward all traffic from eth0 to wlan0 using these parameters:# Forward LAN packets to the WAN.iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT# Forward WAN packets to the LAN if the LAN initiated the connection.iptables -A FORWARD -i wlan0 -o eth0 -m conntrack \ — ctstate ESTABLISHED,RELATED -j ACCEPT# NAT traffic going out the WAN interface.iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE From my PC on the LAN I can ping the DMZ Linux box. ( Ive got a rule on the FG30E allowing everything between LAN and DMZ and back again). From my PC I cant ping the "other device" (192.168.4.1) which is on the other subnet (192.168.4.0/24) which the Linux box is forwarding all traffic to. Linux box can ping the "other device" (192.168.4.1) no problems.FG20E console can also ping 192.168.4.1I have a static route setup in the FG30E:  Any ide

Hello Wondering if anyone has encountered this issue and if there was a work-around? I am assuming that it is installed...I can't seem to get HA2 working with HA1 because of this. Thank you for your assistance...  

I've inherited a fortigate 60E in a business location. The owners say every few months people can't connect to the wifi network. The business gets dozens of people a day who connect to the Wifi. So my suspicion is the Fortigate is hitting some limit of 255 192.168.1.X ip addresses? In the past I would tell them to reboot the Internet modem going into the fortigate. That would clear things up. But now looking to get to the bottom of this and solve it :) Here's what I see in the settings below. Ignore the "Guest Wifi VLAN" as nobody uses that as it does not work. Folks connect to the regular Wifi network and get a 192.168.1.x address.  

I've inherited a rack system with a Fortigate 60e that was setup by some other company. I am trying to understand how they created a static IP ( 192.168.1.51 ) for a raspberry pi video camera device sitting in the site. When I go to "Addresses" I see this for the pi:And under Addresses  I see this is where they assigned the static IP:However, the confusing part is I don't see where Camera 1 points to pi003? If I edit the Camera 1 or pi003 I see no reference to each other? 

Hello, I would like to purchase FortiManager and FortiAnalyzer physical hardware. I will be adding 4000 units of Fortigate into the FortiManager and FortiAnalyzer.  Does the Fortigate requires any license in an order for it to be managed by FortiManager and get reports from FortiAnalyzer?  Please advise. Thank you. 

I want to upgrade Forti Analyzer 400E.Current version: v6.2.3Upgrade to: 7.0.4I want to upgrade my Forti Analyzer from 6.2.3 to 7.0.4As per the upgrade guide while upgrading from 6.2.x to 6.4.x, it requires log database rebuild according to the given KB.https://docs.fortinet.com/document/fortianalyzer/7.2.1/upgrade-guide/545261/firmware-upgrade-pathsHow much time it requires to rebuild the database?

We have one static/fixed IP. We want to run both VPN and a local web server, both on port 443.Is FortiGate # able to determine which protocol is connecting on port 443 and then redirect according(It looks like I can run VPN on port 443 and also access the configuration page via 443).If so, how would I configure this?Thanks in advanceMichael

Hello Bro,                Thank you for accesting me in your family, I hope to get any of your expertise.My first Question and as I've mentioned before we are new to fortinet, we are waiting out first fortigate deployment and it supposed to be licensed as follow " Hardware plus 24x7 FortiCare and FortiGuard Unified Threat Protection (UTP)".#FG-1801what are the features included in such bundle "IPS, AV, VP, ... etc" ? TIA :)

Hi team,I am unable to solve below issue can you please help me. let me tell what I am doing - WAN IP 192.168.99.2Internal Server IP - 10.1.1.1Remote user's public IP - 99.99.99.2 which is trying to access my internal server via port 8080which is mapped on fortigate Firewallexternal IP - 192.168.99.2Internal IP - 10.1.1.1with port no - 8080,8081,8082please find the snapshots for more clarifications -

Hello everyone, I'm just making my first steps with the FortiClient EMS. I have already installed some clients on domain PCs and would now like to update them.But...1. I can assign a deployment package only to a OU. But I don't want to supply all PCs in this OU with the forticlient. I only want to update not to install.2. If I don't use the AD connection, but "only" groups, then I can deploy to the group only, but I can no longer distribute the client policy dynamically per user group. Background: There are about 1000 PCs in different OUs and the FortiClient should only be used for SSLVPN on 50 PCs, which is why I don't want to distribute the installation to all PCs. Is there a best practice how to do it?How can i keep the installed clients up to date? THXSebastian  

hello togetherIs it possible to use a Forticlient with 7.2.1 when the Fortigate has 6.4.7 in use?

Hi,I receive on event of my fortinet 600D the following message:PIM-SM no vif corresponding  to interface ...My configuration use only PIM dense mode what is the meaning? what is missing?   

Hi, This is Mohammed TayibWe are presently migrating from old FAZ 1000D to FAZ 1000F.The Firmware on FAZ-1000D is 6.0.2The Firmware on FAZ-1000F is 6.4.5 We have to move the complete logs available on FAZ 1000D to FAZ 1000F.As per technical team only option is to load the files manually.However once loaded the database rebuild gets stuck at some point or the other.We have tried even resetting the device and redoing the process again without any results.As per the TAC team Fletcher management cannot copy logs from a lower OS to Higher version. Can you please let us know if there is a work around as we have tried several times without any results. RgdsMTT

Hi, guys, I am using Fortigate 400E with FortiOS v7.0.3;  A SDWAN configuration of 3 internet lines; lines information are the following:1.  line1 = 100.100.100.0/24 ; ( a VIP mapping - 100.100.100.10-NATed-10.16.6.35 )2. line2 = 111.111.111.0/24 ;  ( a VIP mapping - 111.111.111.11-NATed-10.16.6.35 )3. line3 = 222.222.222.0/24 ( a VIP mapping - 222.222.222.22-NATed-10.16.6.35 ) the SDWAN service for these 3 lines:  mode (load-balance, hash-mode=round-robin) A customer IP : 134.96.54.129  "session clashed" is found as the below: 1: date=2022-10-25 time=12:22:50 eventtime=1666671770025306040 tz="+0800" logid="0100020085" type="event" subtype="system" level="information" vd="root" logdesc="Session clashed" status="clash" proto=6 msg="session clash"new_status="state=00010200 tuple-num=2 policyid=85 dir=0 act=2 hook=0 134.96.54.129:29656->111.111.111.11:18889(10.16.6.35:18889) dir=1 act=1 hook=4 10.16.6.35:18889->134.96.54.12

Dear all I have some trouble when need to integrated Fortigate with Windows NPS based on this article : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-Radius-Single-Sign-On-using-NPS-2019/ta-p/200187 When I configure the accounting server and appear the error like this : FG200E-LDAP-MASTER (NPS) # config accounting-serverFG200E-LDAP-MASTER (accounting-server) # edit 1FG200E-LDAP-MASTER (1) # set status enableFG200E-LDAP-MASTER (1) # set server "192.168.100.250"FG200E-LDAP-MASTER (1) # set source-ip "192.168.100.252"FG200E-LDAP-MASTER (1) # set secret ENC Mhp123&Jaya321Failed to decode passwd.value parse error before 'Mhp123&Jaya321'Command fail. Return code -204 How we can use secret ENC, do we need decyrpt before use this command, if so. how to decrypted the password. Please let me know, if someone can help me. Best Regards,Heri #fortigate #RSSO 

Hi,We just replaced all our Meraki Firewalls with FortiGate 100F and we are very happy with the performance.Now we are planning to replace our on  prem Cisco phone system (CCM and UCS).I have contacted our sales person and was hoping to get some information about Forti Voice but he told me they don't do voice. I am just using google to gather some information.Can i get some information so that I can compare it with Cisco,Teams , Avaya and others.Can someone share experience of Forti Voice please.How complex is it to implement and integrate? ThanksTazio 

I have a cert for an SSL VPN in one VDOM and would like to copy it to another VDOM for a different SSL VPN. I need to keep both VPNs running for about a month. Is there a way to do this or do I just have to purchase a new cert?  Thanks!

Hi,Forticliente EMS 7.0.7 license ZTNA. Since yesterday I have this message in the dashboard but if I click on it no host appears.Another question: I have had ForticlientEMS for months but in the "FortiGuard Outbreak Detection" section I always see only these four signatures:SignaturesLOG: 2022-10-21 07:37:13 - Info -Update Service - No updates available -1 time since 2022-10-21 07:37:13