Solved

Hi all,My first post here!I am trying to deploy FGT (V7.0.8) on two sites, each FGT with its own dedicated mgmt interface, and have HTTPS access over an IPSEC tunnel, diagram below:From the local site, each admin pc can access the local FGT web interface, the issue starts when the admin at pc A tries to access the FGT-B web interface tunnel and when the admin at pc B tries to access the FGT-A web interface. mgmt interface configuration of each FGT below:FGT-A: config system interface edit "mgmt" set vdom "root" set ip 10.206.250.2 255.255.255.0 set allowaccess ping https ssh fgfm fabric set type physical set dedicated-to management set snmp-index 2 set trust-ip-1 10.21.31.0 255.255.255.0 set trust-ip-2 10.11.32.0 255.255.255.0 next FGT-B: config system interface edit "mgmt" set vdom "root" set ip 10.205.250.2 255.255.255.0 set allowaccess ping https ssh fgfm fabric set type physical set dedicated-to management set snmp-index 2 set trust-ip-1 10.21.31.0 255.255.255.0

We are using a Fortigate 100F with firmware 7.2.2.  Is there a way to reset the hit counts for specific SD-WAN rules?  After some searching in the guides and the forum I found info to reset the hit counts for the policy rules but uptil now no luck in resetting the hit counts for the SD-WAN rules. Can some of the guru's here help me or point me in the right direction?  Thanks in advance

We just started with Fortimail units running in Gateway mode, and we are now migrating all SMTP connections to it. However, I did run into an issue after moving the mail connectivity from Notes app to Fortimail. The application sends an HTML formatted email, but after the move, the content is seen as TXT instead of HTML. In the header of the email, I notice a change of the content type: After the move:Content-type:  text/plainContent-transfer-encoding: quoted-printable Before:Content-type:  multipart/alternativeContent-disposition: inline Is there any setting to resolve this problem?I have nothing special configured in my policies, as the servers are simple SMTP gateway servers for outbound email. I can't find any related settings to this. 

Thank you for your reply.

Hi,If I edit a EMS remote acces profile will clients using this profile recive the updated change? For example if I edit the VPN Tunnel 'On Connect' XML script to add a new drive mapping I would want clients using this profile to detect this. I want to avoid uninstalling the client and re-installing.

I am using Kubuntu 22.04 and it bothers me that fortitray (forticlient icon on system tray) is present event if I did not open forticlient. Is it possible to disable forticlient autostart?

We have setup our Fortigate 80F to connect to our AzureAD. All seems to work fine, but users immediately logout after the credentials are checked. So either if we connect through the webinterface or the FortiClient software, we fill in the credentials of the user.The login is validated and immediately we get 'Microsoft: You've signed out of your account.'Followed by a 'Session ended' screen from the Fortigate. I have followed all steps here: https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/fortigate-ssl-vpn-tutorial#configure-azure-ad-sso But I seem to have missed something. Anyone any idea?

Hi Team, I would work with RestAPI Fortigate and access to documentation.I saw that it was necessary to be sponsored by 2 employees of Fortinet, can you tell me if partners are sufficient or not? what solution can i have? thx 

Good day, I have an IPSEC tunnel created between my head office running a FortiGate FW and my branch running a Sophos FW. The tunnel is connected and I am able to ping devices between the 2 offices over the tunnel. I am however having issues accessing anything over the tunnel, I can browse any device web interfaces over the tunnel as well as access any shares. Any suggestions as to where the issue could be?  Thanks in advance 

Hi Guys~! My customer's used FG100D with firmware 5.0.11 and log max age 20 days.  Today, He want me a law log file. ( GUI Section in log & report - law log download option) In fortigate 100D display correctly 20 days log. But, when the law log downlad, downed file contents limited 400,000 line counts. Is anyone who know This? I confirm FG-analyzer lower firmware bug 400,000 line limites. Fortigate is too? or Originaly limites 400,000 line counts? Thanx for read guys.  

Hello @All, Our web pages have a problem, they hang up again and again when called up or the display is faulty or incomplete.In the browser Firefox the work is possible only in the private mode, in the normal call almost not.The call in Google Chrome is error-free, in Edge mostly too.Several Windows clients and browser versions have been tested, but we cannot find a reason for this behavior.The internal call of the web pages is error-free.Fortiweb version 7.01. Build 81 For help we would be very grateful TBC

Hi I have SSL VPN configured and working using a Let's Encrypt certificate. It has been configured for a FQDN (vpn1.domain.com) that points to IP address at Fortigate port1 interface.Now I have a second ISP connection on port2 and want to listen to SSL VPN connections on port2 also.Fortigate part is simple. Just add interface to "Listen on Interace(s)" field. FortiClient part is also simple. Just add a second remote gateway using a new FQDN (vpn2.domain.com) that points to port2 IP address.But server certificate used for SSL VPN profile just points to vpn1.domain.com. For any reason that FortiClient connects to port2 (vpn2.domain.com) a certificate warning is issued.Add a wildcard certificate is not possible.Is there any way to avoid this warning using a certificate issued by Let's Encrypt and managed by FortiOS (including automatic renewal) ?Or I have to issue a wildcard certificate by myself, load into FortiGate  and renew it by myself ? Thanks in advance.

i have issue with DHCP REPLY on firewall, the traffic not pass from DHCP to LAN side, attached topology for your understanding, the dhcp  server interface address 192.168.1.10 connect to switch and to Port1 Firewall. port 1 address 192.168.2.100.

Hi,When in FGCP A-P, the virtual-switch mac-address is following the virtual MAC Address of the HA.What are attributes that can we change to make the virtual-switch mac-address different between cluster?We are running FortiGate A-P and using virtual-switch in multiple site, but we are facing issue where the virtual-switch mac-address is conflict between site. Thanks

Hi all, I have clients using Android tablets where split tunneling is configured, and not working. Im pretty sure this is down to the DNS configuration on both client and Fortigate, rather than split tunnelling. I can see all DNS requests going through the SSL interface. Windows devices are working fine, as they seem to have internet DNS server on the adapter. Ive found a lot of KB articles around split DNS, which have me a bit confused. Im wondering could someone advise me on the clear steps required here to enable split DNS (assuming thats my issue), on the Android devices? Of course I dont want to impact the current 500+ VPN users, so need to be mindful of any global DNS changes. Thanks, D 

I'm using Fortimanager v6.2.9-build1471.I am having trouble with the following events.Event 1Execute "diagnose fgfm session-list" from FMG and execute SSH to the displayed tunnel IP, but login is not possible.Event 2I clicked "Connect to CLI via SSH" from FMG's WebGUI, but I couldn't log in.Event 3There were some devices that enabled SSH login with the following command.However, SSH login is still not possible on many devices.　exe fgfm reclaim-dev-tunnel <device_name> forceI guess it corresponds to the following items written in FortiManager 6.4.6 Release Notes.BugID:667442FortiManager may not be able to connect to FortiGate CLI via SSH widget or executeTCL scripts.Therefore, updating to FortiManager 6.4.6 may solve the problem, but due to circumstances, it cannot be updated immediately.Please let me know if there is a way to connect via SSH other than updating.

We are using SSL VPN through Fortigate at the moment. We deployed FortiAuthenticator for 2FA which is working fine with Parallels RAS solution. Now we are going to enable 2FA for SSL VPN. At the moment Fortigate configured to allow only select AD groups for vpn access. If we are going to use FortiAuthenticator for SSL VPN where can I select user group so only those group members can access vpn. Right now I imported users from AD group using Remote User Sync rules which imports all users group AD group and assign Fortitoken. We don't want all imported users to have VPN access. So how I can allow access to vpn for selected users.Thank you.

Dear All,  Could you please tell me how can I view the settings (F-SBID) of predefined ips signatures? Also where can I modify the rate/limit setting for example for the SMTP.Login.Brute.Force ? Especially in CLI?Thank you fortigate 600e

Anyone that knows if it would be possible to use ZTNA destination before a user login? We think it might be a good solution to publish FortiSandbox and a SIEM solution with the ZTNA Access Proxy but we need it to work before a user login. Thanks!

Hello Guys,a question: I have two fortinet working in VRRP each fortinet is connected to different switch trunked with lacp. The configuration of two firewall is fine but they are at the same time master . They exchange some messages between them 224.0.0.8 (protocol 112) but nothing they remain master both. I tried to ping from one switch the physical ip address of the other but nothing . From each switch we can see only the virtual IP that is the virtual ip of the local firewall . The switches are trunked well.I wonder if It is mandatory to use with VRRP proxy-arp configuration because I  suspect that arp do not resolve the physical IP of the firewalls connected to the other switch.Configuration:switch 1 connected to firewall 1switch 2 connected to firewall 2switch 1 and switch 2 trunked I checked with get info router vrrp of both everything is fine but do not resolve the arbitrage who is master who is slave, probably because they do not see each other due to some arp proble

Hello Team, Please who has an idea on how can we mitigate this risk? Kindly help me with a solution please Regards,Firdausi Nababa

I just setup a Fortigate under Azure recently, we have a web server behind the Fortigate with Virtual IP configured. It is working fine, I could access the website externally. But when I disable NAT, web server is inaccessible.  We would need the NAT disabled as there is a script from the webserver that needs to capture the original source  IP of the web visitior. Here's a sample of the network:(Azure Public IP) --> Fortigate Port1 (WAN facing) --> Fortigate Port2 (LAN Port) --> Web Server IPWhere:FG port1 = 10.1.1.5FG port2 = 10.0.0.5Webserver = 10.0.0.4 Currently the webserver only captures the 10.0.0.5 IP because of NAT, instead of the Original IP of web visitor.What would be the best way for the webserver to capture the original IP of web visitor? 

i want to configuration load-balance but found wan2 only

Dear All, I had a problem with rekeying phase2 tunnels, the dhgroup numbers were different. After a vpn reset the phase2 works until the first rekey occurs. The solved by recheck the two side parameters, but what is frustrating is I can not get this exact info via debug. with:diagnose debug application ike -1diagnose debug enableI can get only this info:ike 0:ahvpn:ahvpn: IPsec SA connect 17 x.x.x.x->y.y.y.yike 0:ahvpn:ahvpn: using existing connectionike 0:ahvpn:ahvpn: config foundike 0:ahvpn: request is on the queuewith flow debug only this:id=20085 trace_id=2256 func=ipsec_common_output4 line=878 msg="SA is not ready yet, drop"Is there any method that can debug a rekeying process or that can go a little deeper in debug level where the dhgroup mismatch possibly shown?thank you

Hello Team, I would like to know if we can update Forti OS for Specific VDOM?Say for example I have multiple VDOMS configured on my FortiGate firewall. root VDOM, Internet VDOM, UAT VDOM. Can I update only Internet VDOM and no other VDOM, as per my understanding it is not possible. but I am not getting any documents related to this, any reference document would help.