Solved

Hi All, We came to notice that after we updated the FortiManager from 7.0.6 to 7.2.0 the time field is showing an incorrect date. Instead of seeing the Time/Date stamp we now see it counting up in hours. (See screenshot) Is this already a known bug at Forti?  

hi all, Im new to the fortigate products and have not been able to find the answer online. Im wondering if DNAT/VIP is supported on the 40F firewall? I'd imagine so but I cannot find a confirmation online and the Feature/Platform matrix doesnt mention anything. Do it mean this feature is unquestionably supported on all firewall platforms? cheers.

Hi, Guys, I am using Fortigate 400E HA with FortiOS V7.0.3 and some SDWAN configurations; but found the local NTP servers do not work for LANs, as the following: Forti400e_01 # config system dnsForti400e_01 (dns) # showconfig system dnsset primary 208.91.112.53set secondary 208.91.112.52endForti400e_01 (dns) # end Forti400e_01 # diag sys ntp statusHA primary: yes, HA primary ip: 1.0.0.0, management_vfid: 0 ha_direct=0, ha_mgmt_vfid=-1synchronized: yes, ntpsync: enabled, server-mode: enabledipv4 server(ntp1.fortiguard.com) 208.91.112.61 -- reachable(0xc1) S:2 T:97server-version=4, stratum=2reference time is e6a5da97.d048a955 -- UTC Tue Aug 16 08:57:59 2022clock offset is -0.000284 sec, root delay is 0.127930 secroot dispersion is 0.011673 sec, peer dispersion is 524290 msecipv4 server(ntp2.fortiguard.com) 208.91.112.62 -- reachable(0x80) S:2 T:106server-version=4, stratum=2reference time is e6a5da97.d048a955 -- UTC Tue Aug 16 08:57:59 2022clock offset is 0.004056 sec, roo

Hello, It's my first time using these forum and i hope i'll be as clear as possible. I have two networks, A and B interconnected with two fortigate 30e with a site to site IPSEC VPN.When connected directly to the lan of these networks i can access both networks. Now, i have a second VPN on network A which is an IPSEC dialup-forticlient VPN. I need remote customers connecting on network A with their client VPN to access network B servers. The VPN is working fine for network A and they can access everything in there but i don't know how to allow theses interconnected users to be allow to go on network B. Here's a diagram to help : i guess i'm missing a route or policies but i can't quite understand how to set them up. Thank you for your help and time

HiI'm looking for an option to allow users to add paths and files to exclusions list in FortiClient by them self.We use FortClient EMS 7.0.2 an FortiClient 7.0.2.0090 and 7.0.6.0290.On the client site in FortiClient I can see there are buttons on the Malware Tab > Settings to add Exclusions:But they are greyed out.In EMS I can't find any option in the profiles to allow users to add paths or files. The only thing is to add the path in the profile:Does some one know how to allow users to add paths and files by them self?ThanksPatric

Hello - I created a few address objects, then made a new Policy all in FMG. I have to push so I do : Install wizard and go to the point of 'preview installation' The changes I did showed up as expected.My next step is to actually push the changes. My question is will anything else change? Do I need to do a backup before I push? Just curious if it will only change what is in the 'install preview'. Just making sure I'm not taking down or changing anything else since this is my first go at it... Mahalo

Hi, guys, FortiOS v7.0.3 are applied for Fortigate 60E, 400E; we found the Fortigate netflow traffic can not be read by the Grafana tool v8.1.5-1, that uses " logstash-8.3.1-1 collect", "Promtail version: 2.3.0", "Loki version: 2.3.0' The netflow configuration in FotiWiFi60E:config system netflowset collector-ip 10.10.1.86set source-ip 10.10.1.1set active-flow-timeout 300endconfig system interfaceedit "lan"set vdom "root"set ip 10.10.1.1 255.255.255.0set allowaccess ping https sshset type switchset netflow-sampler bothset sflow-sampler enableset description "mod3"set device-identification enableset role lanset snmp-index 10nextend  Configuration verification======================== 18FwF60Mgt1# diag test application sflowd 3===== Netflow Vdom Configuration =====Global collector:10.10.1.86:[2055] source ip: 10.10.1.1 active-timeout(seconds):300 inactive-timeout(seconds):15____ vdom: root, index=0, is master, collector: disabled (use global config) (mgmt vdom)|_

Hello, we use Clearpass tacacs with FortiGate 6.4.9 with no problem, now I want to configure a user to see only one vdom in FortiGate  I try to use "set radius-vdom-override enable" but no luck,   config system admin edit "t1_admin" set remote-auth enable set accprofile "noaccess" set vdom "root" "vdom.01" "vdom.02" set wildcard enable set remote-group "TACACS1" set accprofile-override enable set radius-vdom-override enable next end   my questions:can I use "set radius-vdom-override tacacs" with Tacacs or not? or need to configure another user with set wildcard enable if possible ? Thank you 

Scenario: One "inside" server talks to another "outside" server over HTTPS. I want to monitor and log all traffic, with as much detail as possible. I set up firewall policies to allow the traffic (from certain hosts to other certain hosts, on HTTP(S)),works great, traffic flows. I assign a web filter profile setup to "monitor" all categories, including unrated. This should have the effect of creating Web Filter Security Event Log entries for all URLs flowing through a given policy, since I monitor everything and monitoring logs, right? They all have the "certificate-inspection" profile assigned as well. Except it doesn't. When looking at the Forward traffic log, and the details on the right, some entries have the "Security" entry with web filtering details, while others do not. When filtering on a given firewall policy and selecting different log entries, the security tab appears and disappears, seemingly randomly, entry to entry. Both the policy and secur

Hi team, I have a question... i need a Fortigate that handed a total of 12,000 users, do you have any idea what model o what tool can help me to know how many users in total a FortiGate handed, any model???? :)

Model: 100EFirmware: v7.0.0 build0066 (GA) I am unable to delete a VDOM configured on our 100E because there are two tunnel interfaces that are being referenced (l2t.STANBEL and naf.STANBEL), however when I try to delete these interfaces I get the following error:  Command_cli_delete:6588 delete table entry l2t.STANBEL unset oper error ret=-160. These two tunnel interfaces were created automatically when I first created the VDOM. They're not being referenced anywhere, they're not being used for any static routes or anything but attempts at deleting them via CLI and GUI always fail. And because I cannot delete these interfaces, I cannot delete the VDOM due to the references, as below  I've also tried setting the VDOM for these interfaces to another VDOM, but this also failed. Please let me know if this is a known bug with the firmware, or if there is a step I am missing. Any and all assistance is greatly appreciated! Please let me know if more info is

I'm a little confused about how this is supposed to work.  I've found multiple articles describing how to configure the master unit, most of which (including the docs) tell me to reset the slave unit to factory defaults, but then a couple of the articles make a vague comment about 'then configure the slave unit', or words to that effect.  But the pictures shown are in the GUI, which I can't get to if there is no network configured.  If I *do* configure a rudimentary network (e.g. setting IP on a LAN interface), I'm not in factory default mode anymore, no?  Or does the slave unit show up on the HA screen, and I click on it and set various things? Thanks!

(note: dummy WAN ips)I have WAN Redundancy using system link-monitor.WAN1: 1.1.1.4/255.255.255.248 (Primary)WAN2: 2.2.2.4/255.255.255.248 (Backup)Management Network: 172.16.200.254/24Type: Software SwitchRole: LANNetwork 1: 10.161.201.0/24Type: VLANNetwork interface 1: 10.161.201.254/24Network 2: 10.161.203.0/24Type: VLANNetwork interface 2: 10.161.203.254/24Static Routes:Dest: 0.0.0.0/0.0.0.0Gateway: 1.1.1.3Int: WAN1Prio: 5Dest: 0.0.0.0/0.0.0.0Gateway: 2.2.2.4Int: WAN2Prio: 10Policy Route:Incoming int: Network interface 2Source Add: 10.161.203.0/24Dest Add: ALLProtocol: ANYOutgoing int: WAN2Gateway address: 1.1.1.3Firewall Policy:Network Int 1 to WAN1 (Primary)Network Int 1 to WAN2 (Backup)Network Int 2 to WAN2 (Primary)Network Int 2 to WAN1 (Backup)Mgmt to WAN1WAN to MgmtWAN delegation:Network 1 uses WAN1 as primary, WAN2 as backupNetwork 2 uses WAN2 as primary, WAN1 as backupQuestion/Issue:Network 2 use WAN2 as primary link, now Network 2 users need to access a Server that is sittin

Hello I have a client that is asking to whitelist a bunch of supernets and URLs for the company RingCentral, but it appears that the ISDB that is created by Fortinet already has that as a default. There is over 2000 entries so I would assume this gets updated on a regular bases between Ring Central & Fortinet?  

Hey everyone, hoping for your inputs on this.From the title itself; we have local users that are administrators for FortiAuthenticator GUI/CLI. Tese local users have FTM attached/enable on them. We want to disable Push notifications for these users; requiring them to manually code-in the OTPAppreciate any ideas/inputs

Hello - Looking for FortiManager version recommendations for a new install.  Was looking to start with 7.0.4 or 7.2.0.  Currently have FGT running 6.4.9. The licensing we would get has a 2GB/day 200GB capacity.  Are these hard limits?  We are looking to use the FortiAnalyzer feature with about 20 devices.  Does the following sound about right for an ESX VM? vcpu: 4mem: 8GBdisk: 250GB Thanks 

Hello @All, we using Graylog to get syslog messages from our Fortiweb over TLS.For example: on Fortiweb I see the Log Entry in Attack Log at 12:34:54 Local timeOn Graylog: the same comes with timestamp: 2022-07-27 14:34:54.000 and the Log detail are showing:full_message<185>date=2022-07-27 time=12:34:54 What I need to do to get the right timestamp? Many thanks in advanceTBC

i noticed that my Fortiview only shows data for now.there is no data in 5 mins, 1 hour and 24 hours.what is the settings I need to configure ?i have analyzer installed as well.logs is configured to store & upload to analyzer daily at 23:59.  

I'm working on a new ZTNA deployment and I would like to create tags based on domain OU membership.  Is this possible when using Cloud EMS? It appears I would configure SAML Configuration under user management in EMS, but I've only found instructions for using my firewall as the identity provider.  I thought I would be using Azure AD as the IdP like I did for Admin and VPN access.  

There was a thread/discussion on the previous site forum.fortinet.com in which it stated lists of FG models' hardware specs (RAM, CPU, ASIC chip version, storage) and etc. I am not sure if that thread/discussion was migrated through this portal.For me, it was very helpful in working with the Bill of Material (BOM) comparing specifications against its competitors.  

The firewall in question is a 40F running v6.4.9.  So the sessions widget is saying: 'Current sessions: 402 CPU: 83.6% SPU: 0.0% nTurbo: 16.6%' The CPU number seems awful high since there isn't much going on at the moment.  What has me confused: The 'CPU' widget shows CPU utilization fluctuating around 1%.  I'd appreciate any tips as to the discrepancy.

is it really useful to add fortinet DNS servers in the fortigate firewall DNS settings or we can use any public DNS servers ?what are the benefits of adding fortinet DNS servers, 208.91.112.53 inside the fortigate firewall ?

I'm currently demoing Fortigate v7.2.1 as a HyperV VM to replace our current SSL-VPN solution. At the moment, the Fortigate VM is only being used for SSL-VPN and not as our firewall appliance so there is no WAN interface connected. I've followed the Fortigate Cookbook for SSL-VPN (Cookbook | FortiGate / FortiOS 6.0.0 | Fortinet Documentation Library) but my SSL VPN web interface is not coming up. When I attempt to connect to the local IP for the SSL VPN I'm getting "The connection for this site is not secure. 172.16.0.5 used an unsupported protocol; ERR_SSL_VERSION_OR_CIPHER_MISMATCH. The client and server dont support a common SSL protocol version or cipher suite" NOTE: I am running my https admin interface on port 4443 and the SSL-VPN on port 443 Being new to Fortigate and only running a trial license I'm at a loss. Is it possible to run Fortigate for just an SSL-VPN appliance only?  

What is the best approach to set a port on the Fortigate for remote management by a FortiManager appliance? I am in a situation where if I make a change via FM, I will lose remote connectivity. For example, I am trying to get SD-WAN policy working but in order to do so, have to change the default route and move my interfaces out of the zone they are in. Is there a way to configure the FGs remotely so that when a network change is needed, you can still manage them without losing access?

How to position right Fortigate model for 3000 network users?