Solved

Everything had been working just fine. Then last night I got this error code (-20199). I thought the VPN was down. Called work this morning everything is working fine on their end. I checked with their IT department and he doesn't know/hasn't hear of this problem. 

 Hi  team：The client is headquartered in China, 70 percent of its employees are located in China, and 30 percent are located overseas.Our plan is on-premise forticlient ems,Due to the Internet in China, we hope to deploy a set of EMS overseas to deal with the problem of network connectivity, so do you have any suggestions to solve this problem?

Hi,I am new to fortinet, I need to setup a network consists of two FortiGate1101E with forti Authenticator, Forti Manager and Forti Analyzer  in the HQ and about 100x FG-40F in branches. In each branch, I have one FortiAP and One FortiSwitch.The branches with will connect via IPsec tunnels to the HQ.My questionCan I create one single wireless network all the beaches, the core firewall or do I have to create a WLAN in each remote branch separately?Is there a design document to help with my scenario? Thanks2.12.0.02.12.0.02.12.0.0

Hi,Old Checkpoint R77.30 user, I'm using now one cluster of FG100E with v5.6.7 build1653. I'm having difficulties with Anydesk: all my workstations can't connect to Anydesk's services (error ssl_14090086).Application Control is on with "Monitor all applications" default profile and no trace of Anydesk in Application Control LogBut in Web Filtering logs, it's full of  hostname "AnyNet Relay" or URL "AnyNet Relay/" sometimes with non resolved IP or the classic boot-*.net.anydesk.com or relay-*.net.anydesk.com with Unrated Categorie.I've added Static URL Filter but no success. I can't add wildcard * expression in Web rating Overrides.I've also made a rule for testing with any any all "Anydesk-Web" but this Internet Service have only 28 entries and i can't edit thoses.The only thing that works: remove the Web filtering, and i don't want that.If someone could give me some hints. Thanks.

Hi, I have gotten a very special request that I can't figure out if is possible by some kind of magic.What is wanted is that all traffic except MS Teams traffic is routed through the Fortigate and Teams traffic is directly accessed.It's a Fortigate 200E with firmware 6.4.6 and the free vpn client going over ssl-vpn. Is there any way to achieve this?FortiGate#Client

Dear All Guru, i need urgent help. i have a 100D (V6.2.10)  in HQ office. i was able to create Site to site VPN to two other site office which is using 100D as well. Recently we have added a site office ( we called it C)  which is using 80E ( v7.0.5). i manage to create and bring up IPSEC tunnel between HQ and C. from C- C fortigate 80E able to ping HQ fortigate 100D- C server able to ping HQ server IP from HQ- HQ Fortigate 100D able to ping C fortigate 80E- HQ Server not able to ping C Server IP. The IPSEC tunnel already up between the 2 fortigate device, both device can ping to each other.  but the server from the HQ cannot access to the C network. i have tried open entire subnet for both side access but it is still not working. any idea if i miss out any setting?  Please help!  

Hi community! I'm interested in knowing if there is a way to download an installed firmware image from a FortiGate device through any transfer protocol such as SCP, FTP, TFTP, etc. ? According to this article we can actually push .out firmware images to a device via SCP with the command scp firmware.out admin@<IP>:fgt-image  What I am looking for is exactly the opposite. Is it possible? Thanks! 

Good afternoon!I am trying to connect two FortiGate 40F in HA and two different ISPs with a FortiAP 221e on the internal network. The architecture of the formed network is as follows:   the connections with the ISPs through the ISPs work correctly and the connection in HA also works as it should (I make the wired connection from the internal Switch to a computer, I run ping to google and when I disconnect the FG that is working as primary , only one packet is lost, making the switch from primary to secondary correctly). The problem is that when I perform such disconnection from the primary FG, the FortiAP goes offline and takes a long time to reconnect, leading to all client connections to the AP being disconnected.I would appreciate if someone could guide me on the following:Why will there be such a delay in reconnection to the secondary FG?Is this delay because I am using TPLinks Switches?Is there any particular configuration for the FortiAP in this situation?Thank you

Bear with me everyone, I have a very minimal knowledge of Fortinet products.  I can barely navigate using command line in these firewalls.  The Firewall I am working with is, from what I am seeing, an EOL product, the Fortigate 1240B.  I need to capture some simple information from this firewall for QA purposes.  I need to capture things like the BIOS Version, the FW Version, and the HW Revision. All I have been able to find is a FW Version, whether its accessing the fw_mgmt or the GUI.  Using command line I typed in "execute revision list config" and that gave me the FW Version.  I tried rebooting the firewall to go into the "BIOS" to see if it would give me any other information and I couldn't find anything.  Again, newbie user to one of these Firewalls, I usually work with CISCO and Redhat exclusively.  Any help you can provide would be awesome! Thank you in advance! 

Hello, based on the post : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restricting-SSL-VPN-connectivity-from-certain/ta-p/191997. It is possible to restrincting ssl vpn connectivity from cities in place of country? Thank you

Hello  I have a FortiGate 100D that has diskI have connected it with the cloud I would like to ask if I can change the 7 day store period?Is it possible from cli? Thanks and regards, Konstantinos

Good day!I am having trouble with my configuration, I can successfully established connection with both firewall but I cannot access the VLAN on the branch firewall. Here is my config: HQLocal Subnet: 192.168.100.0/24Remote Subnet: 192.168.50.0/24 BRANCHLocal Subnet: 192.168.50.0/24Remote Subnet: 192.168.100.0/24 Static Route HQ:Destination: 192.168.50.0/24Gateway: 122.8.182.207 Static Route BRANCH:Destination: 192.168.100.0/24Gateway: 222.81.180.201 My firewall policies:HQ FIREWALL VPN1:incoming interface: hq-to-branchoutgoing interface: lansource: alldestination: allservice:allNAT: disabled VPN2:incoming interface: lanoutgoing interface: hq-to-branchsource: alldestination: allservice:allNAT: disabled BRANCH FIREWALL VPN1:incoming interface: hq-to-branchoutgoing interface: lansource: alldestination: allservice:allNAT: disabled VPN2:incoming interface: lanoutgoing interface: hq-to-branchsource: alldestination: allservice:allNAT: di

We have about a hundread FGTs for a retail customer managed by FMG-VM. And we're about to roll out a FAP per FGT for 100 of them. All have the same guest SSID/VAP. But when I looked at AP Manager, under the SSID tab I seem to be able to see configured VAPs for each device(FGT). So when we need to change something on the common VAP with AP Manager, we need to change it one by one in GUI.Or, am I misinterpreting the menu and there is actually a way to set just one config of of VAP and link it to all 100 FGTs? If not, I'm now thinking to set up a CLI template group/CLI templates to configure the VAP and all other necessary "wireless-controller" config so that when something needs to be changed, we just need to change the template and push it to all FGTs. FMG-VM: v6.4.8 Thanks, Toshi

Hello.We had recently a security breach in our company (a user breach), the user shared his credentials to another user who access the LAN during vacation.The user logged using a cached user then connect to the vpn using a friend credentials.Is there a way to avoid this?I mean forced a Forticlient login to a specific computer, if it doen´t match drop the connection.In Windows i did that using Active Directory but it don´t apply the rule to the vpn.Thank you.

Hi, I have an issue with forwarding VIP port for local web server. The web server itself has port for example:Web server: 10.10.1.1:8081WAN: 172.16.40.50 so if in the port forwarding setting when I enter:External server port: 8080 or 8081and map to : 8081 won't work. but for the other web servers without port will work fine. Please advise.Thank you   

Hello,  I am trying to delete an IPSEC TunnelI see a reference of an admin user. In the details the below is highlighted gui-dashboard.0.widget.6.interface So I think that the user has created a widget in the dashboard.  How could I delete it in order to erase the Tunnel? Thanks and regards, Konstantinos

Hello everyone,  A user on Mac updated to the Monterey OS and updated his forticlient to the latest version.Before those updates he managed to connect to the VPN, but since the update he's unable to connect to the VPN (Network timeout). We are using the free version of Forticlient.Tried to installed the latest, also tried version 6.4.6.1378 and 6.4.7.1405 without success. We have several other mac with the M1 chip which are using the IPad version on their mac which works perfectly fine, but the other user can't install the Ipad version. Do you have any recommandation ? Thanks in advance for your help

Hi,I am running vrf on the lan (inside zone) switch . I don't have separate physical switch for dmz. So i am planning  to run the dmz on the same insdie switch .In firewall we create a vdom for  dmz ,In that case how many physical link I need from the lan switch to the fortigate firewall .Do I need separate link for dmz vdom ,Or  I can use the same link for the root vdom ?If I can use the same link what configuration requires on fortigate side and switch side Thanks

Please try to stay with me on this longer post... I've tried to shorten it up but there is a lot to relay on this one and I appreciate your taking the time and reading through it.. First off, Let me elaborate on that Subject a little. My user is currently configured to receive a token into my email account when I do things such as: log into any of our Gates, Connect to IPSEC VPN's, Log into our VMware Horizon virtual desktops, etc... I am receiving the token via a RADIUS Client on the FA where the authentication group ultimately looks at our AD environment via LDAP and/or FSSO so I can use the same credentials across several platforms. This works fine with the exception of an occasional delay in the SMTP conversation(s) which will occasionally cause the login to timeout before I can get the token input -  Other than that, I have been using this method w/o issue for a couple of months now BUT most everyone in the company are using FortiToken Mobile. I was recently ta

Hello, how to configure anti spoofing and statefull ??

Hello,I would like to process a report of IPS attacks sorted by geolocation (country) for the customer. I'm not familiar with sql - can I request a sample dataset or chart?FAZ 7.2Thank you. Jirka

Hello,I need your help to understand some logs for a rule : For example my rule contain : Src : IP_A, IP_B ...; Dst : IP_O, IP_Z, Service ; ftp(21),telnet(23)and tcp 6058 in my logs on the forianalyzer I can some others dst port value. It's possible? There are some explinations for that? Thank you 

Hello Fortinet CummunityI wonder how we can bypass access enforcement for the isolation logical networks.I can find it on the admin guide (check Access Enforcement section):https://docs.fortinet.com/document/fortinac/9.1.0/administration-guide/151724/model-configuration However actually on my GUI (FNAC 9.2.2) the only available options are "Enforce" and "Deny". I need this option in order to assign different Authentication networks for hosts depending on some of their attributes. Any idea on how we can do that? Cheers!AEK 

I have an FG-80C setup with LDAP authentication for SSLVPN. It' s been working great and we recently introduced FortiTokens for two factor authentication. The way I' ve set it up is by creating local accounts on the Fortigate unit and assigning the password field to LDAP lookups, along with the token s/n and adding them to an SSLVPN group. The issue we' re running into is case sensitivity on the usernames. I' ve got them all entered on the Fortigate in lower case and when a user logs in they are prompted for a token PIN code. Works great. However, if a user happens to put their username with an uppercase letter in the username, the Fortigate does not require a token PIN code and allows VPN access with just the AD password. I' ve got a ticket open with Fortinet support, but I' ve managed to stump the first engineer, so thought I would post here. They suggested removing the local accounts, but I/they were unsure how to bind the tokens to each user.

I purchased a fortigate 60D from eBay, it appeared to be unused.  When I booted it up and tried to connect with the iPad app I get a message “Unsupported version. This firmware version of FortiOS is not supported by FortiExplorer. You will need to use the Web GUI or SSH to configure this device.” I want to update the firmware and learned that you have to have an active support license to do so. But I can’t figure out how to get a support license or find out how much they cost. How have others out with this ?