Solved

Hi All, I want to ask about URL Filter in Webfilter Profile.I added a URL Filter Exempt(type:wildcard).Target url to use 8020 port, but Access block. I checked this KB: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Resolve-issue-web-filter-block-override-and/ta-p/193291?externalID=FD39997And set config: set ovrd-auth-port-warning 9020, and then the URL Filter takes effect.Does the official document mention that Fortiguard uses this port like the link below?I wonder my solution is correct. https://docs.fortinet.com/document/fortigate/6.4.0/ports-and-protocols/362392/fortiguard-open-portsMy Fortigate: 6.4.9 

Hi team, I have a question... i need a Fortigate that handed a total of 12,000 users, do you have any idea what model o what tool can help me to know how many users in total a FortiGate handed, any model???? :)

Model: 100EFirmware: v7.0.0 build0066 (GA) I am unable to delete a VDOM configured on our 100E because there are two tunnel interfaces that are being referenced (l2t.STANBEL and naf.STANBEL), however when I try to delete these interfaces I get the following error:  Command_cli_delete:6588 delete table entry l2t.STANBEL unset oper error ret=-160. These two tunnel interfaces were created automatically when I first created the VDOM. They're not being referenced anywhere, they're not being used for any static routes or anything but attempts at deleting them via CLI and GUI always fail. And because I cannot delete these interfaces, I cannot delete the VDOM due to the references, as below  I've also tried setting the VDOM for these interfaces to another VDOM, but this also failed. Please let me know if this is a known bug with the firmware, or if there is a step I am missing. Any and all assistance is greatly appreciated! Please let me know if more info is

I'm a little confused about how this is supposed to work.  I've found multiple articles describing how to configure the master unit, most of which (including the docs) tell me to reset the slave unit to factory defaults, but then a couple of the articles make a vague comment about 'then configure the slave unit', or words to that effect.  But the pictures shown are in the GUI, which I can't get to if there is no network configured.  If I *do* configure a rudimentary network (e.g. setting IP on a LAN interface), I'm not in factory default mode anymore, no?  Or does the slave unit show up on the HA screen, and I click on it and set various things? Thanks!

(note: dummy WAN ips)I have WAN Redundancy using system link-monitor.WAN1: 1.1.1.4/255.255.255.248 (Primary)WAN2: 2.2.2.4/255.255.255.248 (Backup)Management Network: 172.16.200.254/24Type: Software SwitchRole: LANNetwork 1: 10.161.201.0/24Type: VLANNetwork interface 1: 10.161.201.254/24Network 2: 10.161.203.0/24Type: VLANNetwork interface 2: 10.161.203.254/24Static Routes:Dest: 0.0.0.0/0.0.0.0Gateway: 1.1.1.3Int: WAN1Prio: 5Dest: 0.0.0.0/0.0.0.0Gateway: 2.2.2.4Int: WAN2Prio: 10Policy Route:Incoming int: Network interface 2Source Add: 10.161.203.0/24Dest Add: ALLProtocol: ANYOutgoing int: WAN2Gateway address: 1.1.1.3Firewall Policy:Network Int 1 to WAN1 (Primary)Network Int 1 to WAN2 (Backup)Network Int 2 to WAN2 (Primary)Network Int 2 to WAN1 (Backup)Mgmt to WAN1WAN to MgmtWAN delegation:Network 1 uses WAN1 as primary, WAN2 as backupNetwork 2 uses WAN2 as primary, WAN1 as backupQuestion/Issue:Network 2 use WAN2 as primary link, now Network 2 users need to access a Server that is sittin

Hello I have a client that is asking to whitelist a bunch of supernets and URLs for the company RingCentral, but it appears that the ISDB that is created by Fortinet already has that as a default. There is over 2000 entries so I would assume this gets updated on a regular bases between Ring Central & Fortinet?  

Hey everyone, hoping for your inputs on this.From the title itself; we have local users that are administrators for FortiAuthenticator GUI/CLI. Tese local users have FTM attached/enable on them. We want to disable Push notifications for these users; requiring them to manually code-in the OTPAppreciate any ideas/inputs

Hello - Looking for FortiManager version recommendations for a new install.  Was looking to start with 7.0.4 or 7.2.0.  Currently have FGT running 6.4.9. The licensing we would get has a 2GB/day 200GB capacity.  Are these hard limits?  We are looking to use the FortiAnalyzer feature with about 20 devices.  Does the following sound about right for an ESX VM? vcpu: 4mem: 8GBdisk: 250GB Thanks 

Hello @All, we using Graylog to get syslog messages from our Fortiweb over TLS.For example: on Fortiweb I see the Log Entry in Attack Log at 12:34:54 Local timeOn Graylog: the same comes with timestamp: 2022-07-27 14:34:54.000 and the Log detail are showing:full_message<185>date=2022-07-27 time=12:34:54 What I need to do to get the right timestamp? Many thanks in advanceTBC

i noticed that my Fortiview only shows data for now.there is no data in 5 mins, 1 hour and 24 hours.what is the settings I need to configure ?i have analyzer installed as well.logs is configured to store & upload to analyzer daily at 23:59.  

I'm working on a new ZTNA deployment and I would like to create tags based on domain OU membership.  Is this possible when using Cloud EMS? It appears I would configure SAML Configuration under user management in EMS, but I've only found instructions for using my firewall as the identity provider.  I thought I would be using Azure AD as the IdP like I did for Admin and VPN access.  

There was a thread/discussion on the previous site forum.fortinet.com in which it stated lists of FG models' hardware specs (RAM, CPU, ASIC chip version, storage) and etc. I am not sure if that thread/discussion was migrated through this portal.For me, it was very helpful in working with the Bill of Material (BOM) comparing specifications against its competitors.  

The firewall in question is a 40F running v6.4.9.  So the sessions widget is saying: 'Current sessions: 402 CPU: 83.6% SPU: 0.0% nTurbo: 16.6%' The CPU number seems awful high since there isn't much going on at the moment.  What has me confused: The 'CPU' widget shows CPU utilization fluctuating around 1%.  I'd appreciate any tips as to the discrepancy.

is it really useful to add fortinet DNS servers in the fortigate firewall DNS settings or we can use any public DNS servers ?what are the benefits of adding fortinet DNS servers, 208.91.112.53 inside the fortigate firewall ?

I'm currently demoing Fortigate v7.2.1 as a HyperV VM to replace our current SSL-VPN solution. At the moment, the Fortigate VM is only being used for SSL-VPN and not as our firewall appliance so there is no WAN interface connected. I've followed the Fortigate Cookbook for SSL-VPN (Cookbook | FortiGate / FortiOS 6.0.0 | Fortinet Documentation Library) but my SSL VPN web interface is not coming up. When I attempt to connect to the local IP for the SSL VPN I'm getting "The connection for this site is not secure. 172.16.0.5 used an unsupported protocol; ERR_SSL_VERSION_OR_CIPHER_MISMATCH. The client and server dont support a common SSL protocol version or cipher suite" NOTE: I am running my https admin interface on port 4443 and the SSL-VPN on port 443 Being new to Fortigate and only running a trial license I'm at a loss. Is it possible to run Fortigate for just an SSL-VPN appliance only?  

What is the best approach to set a port on the Fortigate for remote management by a FortiManager appliance? I am in a situation where if I make a change via FM, I will lose remote connectivity. For example, I am trying to get SD-WAN policy working but in order to do so, have to change the default route and move my interfaces out of the zone they are in. Is there a way to configure the FGs remotely so that when a network change is needed, you can still manage them without losing access?

How to position right Fortigate model for 3000 network users?

Hi all,I would like to understand if I could use a FortiAP-xxx-E-I (built for international geographic area) in Europe without issues (it will be managed by a Fortigate) and if I can mix FortiAP-xxx-E-E (built for european geographical area) and FortiAP-xxx-E-I (built for international geographic area) without issues managed by the same Fortigate in the european geographical area. Thank you very much in advance for your help. 

I wanted to test a new version of Forticlient and somehow must have downloaded the wrong version, which showed me EMS and an expiration date. I uninstalled, rebooted and installed the correct VPN only version from https://www.fortinet.com/support/product-downloads#vpn, same problem.I uninstalled, rebooted, cleaned registry, appdata, program files and program data from Fortinet/FortiClient entries. Reboot, reinistall of the old 6.4.8 VPN only client that I had saved on my hard drive.Now also 6.4.8 shows me EMS and shows an expiration date.Since I use for sure the free VPN only version, why does it ask for a license file? Where is the config stored that it lets the free version assume its the not free version?

We have a 3rd party who uses AWS for their VPNwe have a Fortigate 601EThe configuration we received from AWS is using BGP, I tried configuring but will not come up.I think the problem is with the provided local and remote addresses. Inside IP Addresses- Customer Gateway : 169.254.170.166/30- Virtual Private Gateway : 169.254.170.165/30In Phase 2 selectors when  I try and eter the above,it comes back with169.254.170.164/30 for bothand the tunnel will not come up.If I change the Ip addresses to normal subnets, that reside at local and remote, the tunnel comes up, but of course it wont pass any traffic 

Hello Guys, I have configured this network in my laboratory(Please see the photo) . I have two Fortigate 7.2 and both Fortigates are connected through a Site-To-Site VPN Tunnel(I created by IPSEC Wizard) and also I have configured SSL VPN Tunnel mode and my remote user is connected to Fortigate 1 with Public IP 1.1.1.1, now the problem is that Remote VPN user can only see the Client 1 and cannot see the Client 2, what can be issue? or do you have any training material for this topology? Thanks in advanced,Ali 

We created a REST API Administrator on a FortiGate 80E (6.4.6) to monitor certain access point data.  The programmer trying to make this work has requested the following: "We need the proper syntax for a remote server making a REST API call to retrieve an active list of devices (by mac address) from the Fortinet controller.  Some systems call this a “presence API” call." I hope that makes sense.  Can anyone help? Thank you!!

We are trying to add objects to backup file and import onto the firewall when ever we need make changes into the firewall config. There we see a field of UUID which was existing for all the other objects. So when ever we add a new object to config, should we need to add a random unique UUID to the object or will the firewall create the UUID for the object that we create in config file

Dear TAC,I registered the FortiManager Trial for lab demo, and I have FortiGate VM trial, so I can't add Fortigate VM into FortiManager. Please help me and give me a solution for this issue.I tried follow this guide, but still not working:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Getting-error-Probe-Failed-message-while-adding/ta-p/197318 Thank you.

Hi, I'd like to be able to inspect within normal DNS requests passing firewall and find the record they are trying to query. For instance, clients goes to query DNS record for google.com and this request passes firewall policies. I want to know which is the destination address queried (here, google.com) Is that possible with FortiOS? Regards,