Solved

Hello I am working with Fortinet 201E v7.2 1157Please see diagram in reference to my issue below.So far, I have setup multiple vdoms. Traffic will go through hit the Root VDOM then it should go to VDOM 1.To browse to the Firewall I use VDOM 1 - Port 1 sub interface address.This works fine.At Global Level I have added SNMP settings and I can see traffic hitting the firewall through packet capture, but then I do not know where it is going.SNMP polling fails. My question is; how do I link ROOT VDOM to VDOM 1?I have tried a VDOM - LINK and I created a rule in the rule base of VDOM 1 to SNMP IP, but this failed, no traffic or logs. Do I need a static route on ROOT VDOM context to VDOM 1 context. The setup seems so simple but I am not sure why SNMP cannot talk to VDOM 1 but I can browse to it. Port 1 sub interface is management, I have a HA setup as well, Active-Passive.   I do not use the management port, this is for local access only. All help is apprecia

HiOne question why is the SNMP access on an Interface red/orange. Is thre a deper meaning? I haven't found something about this... Does anyone know this?Thank for.  Patric

Hi All I have the Persistent Agent installed on Windows and I noticed that logs are lost after a host reboot.Logs are saved at %ProgramData%\Bradford Networks\ folder:https://community.fortinet.com/t5/FortiNAC/Troubleshooting-Tip-Windows-Persistent-Agent-logs/ta-p/190324 Is there a configuration to set log retention on Windows? Thank you! FortiNAC 

Hi Why is the port forwarding not working? Any ideas?     Test Port from FortiGate (Port is open on the vm) From another Internet Access (no connection via port forwarding)  Thanks  

Good day, I am having an issue with users connected remotely to the office using FortiGate VPN, when connected any site the uses navigate to locally on their computer show certificate errors, for example the site www.google.co.uk gets a certificate issued by FortiGate issued to www.google.co.uk. Do I have to import the FortiGate certificate to the remote users computer to get this working? the users are using their own computers and not on the company domain. I am quite new to FortiGate and just learning. ThanksJulian

Hi,I have problem on the branch fortigate it route all traffic to hq fortigate, and I cannot run fortiguard (Unable to connect to FortiGuard servers.) Forticloud - failed to load data etc.In the branch console I can ping all fortiguard servers, I can telnet to 514 ports like: execute telnet 173.243.132.171 514Trying 173.243.132.171...Connected to 173.243.132.171. on hq fortigate I see in logs that traffic from branch destined to fortiguard like: 13.248.131.62 173.243.132.27 are allowed and go out to the internet but these service are not working, in log I have something like:     [3038] fds_download_image_list: TRACE [41] fds_queue_task: req-1 is added to fds-update [579] fds_https_start_server: server: 13.248.131.62:443 [580] fds_https_start_server: source-ip: 0.0.0.0:0 [113] __ssl_cert_ctx_load: Added cert /etc/cert/factory/root_Fortinet_Factory.cer, root ca Fortinet_CA, idx 0 (default) [480] ssl_ctx_use_builtin_store: Loaded Fortinet Trus

I have a rented FortiGate 30E, this equipment is managed by a third party company, I have read-only access to check some information on the equipment. However, I need to know if this company is maintaining the necessary needs, I know that the equipment is in version: v6.0.14 build0457 (GA) how can I check, that is, where on the Fortinet manufacturer's website I can find out if there is an update for my equipment.   I registered on forticloud and when accessing: https://support.fortinet.com/Download/FirmwareImages.aspx it says that I don't have equipment covered by the contract. I don't want to download Firmware I just want to know which update versions are available. How to query this information? Thanks!

Hello Guys, I have problem when enable WorkFlow Management in Global Setting. As the articol https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/656084/firewall-policy , the option "Policy change summary " and "Policies expire by default " could be appear, but not in may situation.. like the pic below: But in vdom root, the policy have the option to set the Policy Expiration.. That's not possible remove the default expiration to zero days, like this tips in the 7.2.3 guide in the link up..."The default value for Policy expiration is 30 days. This number can be changed in the CLI or in System > Settings in the GUI to any value between zero and 365 days. If the default value is set to zero, the Default state will disable the Policy expiration." Anyone can help me? in the release note i didn't see nothing .. Fabio

Hello Guys,I have to convert one multicast packet to unicast to avoid to use PIM between two sites. Could I use some policies? Destination NAT? or what else with fortigate?

Hello, i want to connect a FortiGate 101E in the "Branch Office" over a VPN-Tunnel with a LDAP Server in the "Main Office". Over CLI i get a ping to the ldap-server, but over "User & Device" -> "LDAP-Servers" -> Edit LDAP Server -> and then "Browse" or "Test Connectivity" i only get "invalid credentials" bzw. "invalid ldap server". But the credentials are ok. And also the ldap server.Does anyone had an idea, why i can't get a connection to the LDAP-Server? If you need more information, please ask. Kind regardsTobias

I've taken over a few more duties and I am having trouble adding a native VLAN to the VLAN list. It's available on my admin switches but cannot see it on the guest switches. it's an allowed VLAN on the guest switches and when I try to add it to the native, it says it already exists. All switches are fortinet & 200E if that helps as well. 

Our FortiFone-480 desk phones are randomly experiencing ring delays after upgrading the firmware to 3.0.12.225. When there is an incoming call, some of the 480 phones will not ring for about 15 seconds. Not only is the phone not ringing but the SIP packets do not appear to be reaching the phone as it doesn't even show the line is in use. So far I have been unable to replicate the issue on demand but I am taking a long term net cap for one phone to see if I can see anything from that after this issue occurs again. Has anyone else experienced this?

Hi guys,As maybe all of you konw, there is a compatibility matrix file between Analyzer and fortios. we use it as a refrence for checking compatibility of fortianalyzer and fortigate. my question is that: is there any file for compatibility of fortianalyzer with fortiweb? or that file is for fortiweb too?thanks.

NULL

https://docs.fortinet.com/max-value-tableThis can be a really useful tool for figuring out how certain features will scale and what to be concious of when standardizing on certain models combined with your enterprises chosen features.  I'm getting lost at determining what each object is, apart from it's name.  There's no link to a full description on what the object is and what contributes to it's usage/capacity.  Some are obvious by there name, but others not so much.  How do network designers and implementers figure out scaling and capacity factors for objects that aren't so obvious by name? For example:user.fortitoken-Ok, that looks pretty straight forward - probably the maximum number of fortitokens that can be assigned to users on the firewall?user.fsso-polling-hmmm, im guessing this is the number of users that can be fsso polled - but only 20 for a FG-200F, that doesnt sound right so maybe it means something else? Where do we go to understand these t

Hello all, I'll try to explain my scenario. My office (192.168.7.0/24) has an ipsec to a remote location (10.133.3.0/24). My office subnet is natted to 172.31.19.0/24. So IPSec (tunnel mode, not interface) is set between 172.31.19.0/24 to 10.133.3.0/24. I'd like to use SSL to connect to my office (it's working), but i'd like to reach remote subnet (10.133.3.0/24). How to do this? Thank you in advance, Kind Regards,

Trying Python module "requests" on FortiManager URL with /jsonrpc, it is ok when doing method "get". But change to method "add", it returns an error code: -10147 and message: no write permission. Tried on different Fortimanager and get same result. FM version is 6.2.8 The admin setting on Fortimanager already enabled with "set rpc-permit read-write". Anyone encountered same problem?  

Hi, I am trying to eval FortiSOAR. I see in the documentation that upon deployment, you can activate the trial license after deploying the platform by logging into your FortiCare account. I did this and it said there was an error saying it couldn't sync with FDN. I logged into support.fortinet.com and could then see that the platform had been registered in my account (previously I didn't have any assets in my list), and that there was a license file. So instead of trying to login to my account to activate the trial, I downloaded the license file and uploaded from the same screen within FortiSOAR. This is a valid license file for 3 users and it doesn't expire (well not until 2122 anyway), but the same error about not being able to sync with FDN appeared. I can resolve and ping https://globalupdate.fortinet.net from the FortiSOAR server. Anyone else seen this issue before or know what else I can check? I'm stuck in a chicken and the egg situation w

Hi, Anyone had tried before access to the application directly from external without login to SSL-VPN in the fortigate.  Meaning does not need to login to SSL VPN.. but on the backend.. when they click on end user's application, it will pass in the login info via API to fortigate and fortigate validate with the SSL-VPN user profile. From: REST API documents

In FortiAnalyzer v6.4.8, from the Log View, I open the Chart Builder, and even though I have a 'Source' column in the logs which contains the source IP, it does not give me that option in the Chart Builder window. I does give the rest of the columns though. This can be seen below:

Hi! I am unable to toggle on any of the FortiGuard Spam Filtering features. I tried created a new profile but neither of the it works. Really appreciate if anyone have any explanations/solutions for this issue.   

Hello everybody, in my SMB I'm looking to switch to a new brand due to headaches had with CISCO ASA 5505/5506/5510 (Java required for GUI based configuration) and then NETGEAR BR200 (definetly a buggy/faulty product). After some reading and video watching, I think a Fortigate 40F can fullfill my needs. I just need one technical info I can't easily find: I currently have my LAN divided into 4 VLANs but I'd need to have more VLANs, let's say 6-8 VLANs. Can the Fortigate 40F handle 8 VLANs? Which is the limit?It should act as default gateway and DCHP server for each VLAN.It should handle different DHCP ranges for different VLANs. Is this product able to do this? Thank you.

I have this setup, where EMS is not published and the off-net profile is restricting malicious and security risk contents. Will the Forticlient be able to do restrictions with the configured EMS Profile if the EMS is not reachable. This also refers when the VPN is not connected. FortiClient  #ForticlientEMS

Hi,I have configured two ipsec tunnels between Fortigate_A and Fortigate_B with static routing and then added to sd-wan zone on both sides. I created ipv4 allow rules to allow lan to lan traffic, and this is not working, I mean tunnels are up established but cannot ping from lan to lan. So I addressed Ipsec interfaces, now the strange I can ping from Fortigate_B to Fortigate_A ipsec address but not in opposite. Ping are allowed on ipsec interfaces. How to troubleshoot this?

HiI have FortiEMS 6.4.8 and have problem with Thunderbird.this is exaple logW32/PossibleThreat, Last detected at: 2022-11-24 15:45:12, C:\Users\Dyzurny\AppData\Roaming\Thunderbird\Profiles\9ms2l7at.default-release\ImapMail\powiat.tczew.pl\INBOXand it's repeat many times. in TB i have cheked "allow antivirus clients to quarantine individual incoming messages" but no changes there are too many messages in the inbox to check one by one. the problem occurs with several users any ideas?