Solved

Hello I have created 2 new policies for GEOblocking but there is no sequence group created for that. I know it is not needed, but I do like to keep the book keeping sound. How can I create a new one? I only see the ability to rename or delete.I would like to create one titled "GEOblocking & deny" Thank you  

Hello, I can't seem to find any questions quite like mine, and I apologize if I have missed them. Fortigate 300D - 6.0.4 We are setting up a SSL VPN with Split Tunneling. I can route our internal networks and some public IP Addresses through the tunnel. That much is easy. What I am trying to find out is if I can switch this around? So I would specify 0.0.0.0/0 to go through the tunnel, but then specify IPs, or FQDNs out through the endpoints local ISP. Specifically Microsoft Office 365 traffic. The reason I am thinking this way is because we currently have no control of internet access at the endpoint, like WebFilter/AppControl using FortiClient. Something I hope to get soon, but having to wait. I don't like the idea of internet access outside of the corp net that I cannot control. And this is why we don't use Split-Tunneling. Feel free to change my mind here, I might be barking up the wrong tree. If I had EMS I wouldn't be doing this. Many thanks!

Recently we added a new fortinet device to our fortinet support account, but why does it shows only the trial license of 90 days ?Warranty Support Start Event - Initial Registration of SN at support.fortinet.comIs there any thing else we need to do to fully register the new hardware. 

Hi,Is it possible to install (any existing feature or service or script) to use the device itself as a tiny simple MTA to send its necessary emails without connecting to another MTA like exchange server or so? This is possible on many devices and software. Regards, 

I have setup two sites with a Fortgate 100F device (7.0.5) at each site. I have set-up and have operational a vxlan connection between the two sites over an IPSEC tunnel. At site A there is a monitoring VM with a fixed IP address (192.168.200.2/24 GW 192.168.200.1) and at site B a test VM with a fixed IP address 192.168.200.3/24 GW 192.168.200.1) The issue I have is the test VM is unable to ping the GW IP address 192.168.200.1 or anything beyond the GW) The testing at the moment is: The Monitoring VM (192.168.200.2) is able to ping the test VM (192.168.200.3)The Monitoring VM (192.168.200.2) is able to ping the GW (192.168.200.1)The Monitoring VM (192.168.200.2) is able to ping 8.8.8.8Can RDP from Monitoring VM (192.168.200.2) to Test VM (192.168.200.3)The Test VM (192.168.200.3) is able to ping the Monitoring VM (192.168.200.2)The Test VM (192.168.200.3) is able to ping other devices at Site A in the 192.168.200.x/24 rangeThe Test VM (192.168.200.3) is unable

Hi, I've been using FortiClient VPN on Ubuntu 20.04 and have no problems. Last week I have installed Ubuntu 22.04 from scratch and have several issues connecting to company VPN.  Today I've manage to connect to company VPN but no `bytes received` has to come.Logs shows, that some routes are failed to add:e.g. [sslvpn:DEBG] route:475 Failed add route: addr XX.X.X.X netmask 255.255.0.0 gw XX.X.XXX.X dev vpnthis command fails several times. Could someone help me with this? Also sometimes connecion is not established and have this error in logs: [sslvpn:DEBG] main:1457 exception: Backup routing table failed Regards.

Hi, I've a very huge problem about admin rights. I've a new costumer with a Fortigate firewall and i've reset the fortigate admin password(because they didn't had);.. but i still haven't the full super_admin permission. In fact the account can't see Administrators profile and i figured out that the admin account is an prof_admin.Is it possible to change an admin account from prof_admin to super admin? In the past i've done with a backup config but i had the backup file. Now i've no config backups files and no way to backup or restore fortigate config with the prof_admin account. I'm also wondering if there is another hidden account as super_admin? I'm very stuck in this bad situation and i can't do a factory reset.

Hi,Two things on my mind 1- Is that possible to set a device to get definitions update from the others? I have a few live fortiguard connected devices but some others who should not have direct Internet connection but can contact the firstly mentioned devices, So I'd like them to get definitions update automatically / scheduled from the live devices. And I need to have this with no extra cost of fortimanager or other devices / software. 2- Is there a simple way such as an script or a feature (again with no extra cost of fortimanager or so) to have a report from definitions update or other info like systems firmware / uptime and so ? Maybe via emailing them, having them in a SNMP software or using an API or a web page? Regards, 

Firmware: v6.4.9 build1966 (GA)Firewall: Fortigate-40FI need to connect two ISPs in firewall. I want to use these two ISPs separately. Means ISP1 will only work with 8/10 computers (according to my choice) and ISP2 with 10computers or more  both ISPs have their own switch (unmanaged) that is, sw1 and sw2. Whichever ISP I want to use I have to connect with that switch. Its not possible for me to give mix ISPs to PCs or servers (sometime ISP 1 and sometime ISP2)I have configured like this:Internet1 (WAN) to lan1Internet2 (lan3) to lan2Both internet interfaces are in DHCP mode and both LAN interfaces are in manual mode with "DHCP server" ON for assigning address range. I have created two static routes for two internets. Two separate policies (internet1 to lan1 and internet2 to lan2).The problem I am facing is only one internet is working at a time. What I have noticed is two static routes (Internet1 & internet2) is creating issue. If disable one static route, internet which stati

Can i export reports from old Analyzer 200D to my new Analyzer 300G so that i dont have to re-create all the reports 

Hi Team, We have a fortigate 3200D - v6.0.10 manage via Fortimanager v6.2.8. We have noticed the config status as "conflict" in Fortimanager and a popup of "device config out of sync".Could someone advise what can be done to resolve this issue?I have attached a screenshot for ref. 

Hello - assuming that many companies use Cisco Umbrella DNS, does anyone know if FNT plans to add these to their ISDB list? Thank you...

Is there a place where I can see solutions to commonly hit problems in FortiSOAR?

Upgraded FAZ from 6.4.7 to 7.0.4. The device is receiving logs from several FortiGates without issue, but now I noticed the out of box and previous filters (srcip, dstip, host name, etc..) under ‘Log View -> FortiGate -> Traffic’ is gone. Am I missing a setting to re-enable those or were they removed for version 7? Thanks!

Hi team, Please I can't find the manage image under replcament message in fortiGate 5.6.14 for e specific VDOM.Please any help or should be just under the global VDOM or need any feature to be activated. Thanks in advance.

Hi guys, I have a config file backed up from my forticlient VPN software (including many connections). Is there any way to restore this config file to machines on my Domain controller so I don't need to go to each machine and restore manually each one?  Thank you!

Hi All, We came to notice that after we updated the FortiManager from 7.0.6 to 7.2.0 the time field is showing an incorrect date. Instead of seeing the Time/Date stamp we now see it counting up in hours. (See screenshot) Is this already a known bug at Forti?  

hi all, Im new to the fortigate products and have not been able to find the answer online. Im wondering if DNAT/VIP is supported on the 40F firewall? I'd imagine so but I cannot find a confirmation online and the Feature/Platform matrix doesnt mention anything. Do it mean this feature is unquestionably supported on all firewall platforms? cheers.

Hi, Guys, I am using Fortigate 400E HA with FortiOS V7.0.3 and some SDWAN configurations; but found the local NTP servers do not work for LANs, as the following: Forti400e_01 # config system dnsForti400e_01 (dns) # showconfig system dnsset primary 208.91.112.53set secondary 208.91.112.52endForti400e_01 (dns) # end Forti400e_01 # diag sys ntp statusHA primary: yes, HA primary ip: 1.0.0.0, management_vfid: 0 ha_direct=0, ha_mgmt_vfid=-1synchronized: yes, ntpsync: enabled, server-mode: enabledipv4 server(ntp1.fortiguard.com) 208.91.112.61 -- reachable(0xc1) S:2 T:97server-version=4, stratum=2reference time is e6a5da97.d048a955 -- UTC Tue Aug 16 08:57:59 2022clock offset is -0.000284 sec, root delay is 0.127930 secroot dispersion is 0.011673 sec, peer dispersion is 524290 msecipv4 server(ntp2.fortiguard.com) 208.91.112.62 -- reachable(0x80) S:2 T:106server-version=4, stratum=2reference time is e6a5da97.d048a955 -- UTC Tue Aug 16 08:57:59 2022clock offset is 0.004056 sec, roo

Hello, It's my first time using these forum and i hope i'll be as clear as possible. I have two networks, A and B interconnected with two fortigate 30e with a site to site IPSEC VPN.When connected directly to the lan of these networks i can access both networks. Now, i have a second VPN on network A which is an IPSEC dialup-forticlient VPN. I need remote customers connecting on network A with their client VPN to access network B servers. The VPN is working fine for network A and they can access everything in there but i don't know how to allow theses interconnected users to be allow to go on network B. Here's a diagram to help : i guess i'm missing a route or policies but i can't quite understand how to set them up. Thank you for your help and time

HiI'm looking for an option to allow users to add paths and files to exclusions list in FortiClient by them self.We use FortClient EMS 7.0.2 an FortiClient 7.0.2.0090 and 7.0.6.0290.On the client site in FortiClient I can see there are buttons on the Malware Tab > Settings to add Exclusions:But they are greyed out.In EMS I can't find any option in the profiles to allow users to add paths or files. The only thing is to add the path in the profile:Does some one know how to allow users to add paths and files by them self?ThanksPatric

Hello - I created a few address objects, then made a new Policy all in FMG. I have to push so I do : Install wizard and go to the point of 'preview installation' The changes I did showed up as expected.My next step is to actually push the changes. My question is will anything else change? Do I need to do a backup before I push? Just curious if it will only change what is in the 'install preview'. Just making sure I'm not taking down or changing anything else since this is my first go at it... Mahalo

Hi, guys, FortiOS v7.0.3 are applied for Fortigate 60E, 400E; we found the Fortigate netflow traffic can not be read by the Grafana tool v8.1.5-1, that uses " logstash-8.3.1-1 collect", "Promtail version: 2.3.0", "Loki version: 2.3.0' The netflow configuration in FotiWiFi60E:config system netflowset collector-ip 10.10.1.86set source-ip 10.10.1.1set active-flow-timeout 300endconfig system interfaceedit "lan"set vdom "root"set ip 10.10.1.1 255.255.255.0set allowaccess ping https sshset type switchset netflow-sampler bothset sflow-sampler enableset description "mod3"set device-identification enableset role lanset snmp-index 10nextend  Configuration verification======================== 18FwF60Mgt1# diag test application sflowd 3===== Netflow Vdom Configuration =====Global collector:10.10.1.86:[2055] source ip: 10.10.1.1 active-timeout(seconds):300 inactive-timeout(seconds):15____ vdom: root, index=0, is master, collector: disabled (use global config) (mgmt vdom)|_

Hello, we use Clearpass tacacs with FortiGate 6.4.9 with no problem, now I want to configure a user to see only one vdom in FortiGate  I try to use "set radius-vdom-override enable" but no luck,   config system admin edit "t1_admin" set remote-auth enable set accprofile "noaccess" set vdom "root" "vdom.01" "vdom.02" set wildcard enable set remote-group "TACACS1" set accprofile-override enable set radius-vdom-override enable next end   my questions:can I use "set radius-vdom-override tacacs" with Tacacs or not? or need to configure another user with set wildcard enable if possible ? Thank you 

Scenario: One "inside" server talks to another "outside" server over HTTPS. I want to monitor and log all traffic, with as much detail as possible. I set up firewall policies to allow the traffic (from certain hosts to other certain hosts, on HTTP(S)),works great, traffic flows. I assign a web filter profile setup to "monitor" all categories, including unrated. This should have the effect of creating Web Filter Security Event Log entries for all URLs flowing through a given policy, since I monitor everything and monitoring logs, right? They all have the "certificate-inspection" profile assigned as well. Except it doesn't. When looking at the Forward traffic log, and the details on the right, some entries have the "Security" entry with web filtering details, while others do not. When filtering on a given firewall policy and selecting different log entries, the security tab appears and disappears, seemingly randomly, entry to entry. Both the policy and secur