Solved

Hi,it is a period that I have some problem with PIM of my  Firewall Fortigate 600D and wish to share this post if someone else has had the same experience.I have a network of seven firewall connected by LAN. All node are PIM dense mode enabled. When I change the configuration to one of these, at beginning, after booting,  some of multicast between the firewall updated and the other firewalls are missing. Everything is ok in term of client join , IGMP , policy etc. What I do to let it to run is simply disable /enable, in the dashboard, the multicast routing. After this all run perfectly. It seems  as the boot is not enough to restore a right situation or   disabling enabling multicast routing probably reset some ethernet ports. In the multicast forwarding mode instead I have never had this problem. Do you know some tricks that can add to the configuration to avoid this problem? Could it be a bag? thanks in advance for your support

I recently started to receive the following errors when I run "diagnose debug config-error-log read" on my FortiGate 60F running 7.2.0.  The only thing we did recently is add a REST API user.  However, even after a factory reset we get these.   ffdb_app_map_process-2000: wrong word 5530ffdb_app_map_process-2000: wrong word 43ffdb_app_map_process-2000: wrong word 4303ffdb_app_map_process-2000: wrong word 194ffdb_app_map_process-2000: wrong word 47ffdb_err_msg_print: ret=-10, Error: open map res file error I've been doing a lot of searching and can't seem to figure it out.  Any ideas what they are and how to resolve it? Thanks in advance!

Hello Fortinet Community, I have a Fortigate 200F with Firmware v7.0.2. How do I edit the email alert settings currently set up with my Fortigate?  I did some searching, but only able to find information on Setting up new email alerts. I also noticed this firmware version doesn't have the GUI for updating Email Alerts.  Was this deprecated on purpose? Any information or help would greatly be appreciated.

Hi everyone We're trying to connect 2 sites with an VPN IPSEC. with the tunnel up and working. we have the next issue: Scenario:Triying to connect 192.168.0.102 --> 10.58.152.10Having the following issue: Anyone can help please?

Hello there, We want to apply IPS signature MS.OWA.Brute.Force (ID 39292) on a Microsoft Outlook Web App 2019 server but according to the documentation it is not supported. Is it known when this signature will get support for Microsoft Outlook Web App 2019 server?

Hello guys! I already implemented a solution with FortiGate and LDAP (via LDAPS) in which it's possible for users to change the password with the SSL VPN Client if it is expired so I hope there is an FortiAuthenticator solution.config user ldap   edit <server_name>   set password-expiry-warning {disable | enable}   set password-renewal {disable | enable}   ...end I'm searching for a solution in which the same is possible but the FortiGate isn't connected to an LDAP server but instead to an FortiAuthenticator via RADIUS (dynamic FortiToken Mobile assigning) which gets the User Information from the LDAP server (via LDAPS). I only found the Self Service Portal which provides this feature but this doesn't meet the customer expectations. Do you have any experience with this? Thank you.

Hello Team, Is that possible to include a link aggregate interface as a member of hardware switch? I did this test with the Fortigate VM, but using the software switch instead, and I can insert the aggregate interface into it. My scenario is this: We'll need to implement two switches (from other vendor) doing an uplink with Fortigate. This two switches needs to connect to fortigate by PortChannel and we need to share the same vlans with all of it.So, by the test I have did, I know that by soft-switch it is possible, but my concern is about the CPU usage, so I need to know if is that possible using the hardware switch. Tks!

set up SSL deep inspection and now am able to find the viruses in https links too, but, while testing this with TekDefense.com (http://www.tekdefense.com/downloads/malware-samples/)some files are recognized nut some not. For instance: This one is recognized and blockedhttp://www.tekdefense.com/downloads/malware-samples/malz4.zip but these are downloaded and not blockedhttp://www.tekdefense.com/downloads/malware-samples/malz5.ziphttp://www.tekdefense.com/downloads/malware-samples/yitaly.exe.zip I'm using the firewall in proxy mode (provides Internet to users via web proxy) and the mail policy rule to provide internet is proxy based. Would you please give me hints what is the root cause? size of file? types of viruses? type of files or? Regards,Mohammad

We are using FAC for 2FA and we have configured our SMS gateway and also SMTP server to receive token codes on Email and SMS. Its working fine but the end user is receiving the token code along with username details. Our query is there any way to remove username details from token received on Email and SMS?We don't want username only token code is sufficient.We have checked admin guide of FAC but not found any such settings to remove username details. If anyone have any suggestions kindly assists!!! 

Hi all, We have a FortiGate 81f running FortiOS 7.0.5. We have Application Control running that blocks proxy and vpn, which we want. We do however have one internal device (static IP) that we need to connect via vpn to an external ip.  We also have another internal device that requires connection to an external proxy. What is the best way to allow an internal ip to use vpn or proxy to contact an external ip? Custom IPS signature? thanks jc

Hello,Fortiweb offers the option to change password before logging in. If this option is used and the password change fails, where do I see the details?The login and therefore also a possible password change is done against a MS-AD.The user gets as error message "Failed to change password", but in the logs no reason can be seen.Unfortunately, the details under Log&Report / Traffic do not provide any clues for error analysis. Many thanksTBC

Hello everyoneI have the following problemOn page A I have a Foritgate with incoming traffic.Now the problem is the SRV's are on Fortigate side B.There is another IPSEC tunnel between the two Fortigates.How exactly do I have to configure the VIP there.Many thanks for your help

Can someone please help me get IPv6 configured?I'm on Xfinity and previously had OpenWRT configured with ::/60 prefix but having difficult time with 80F running 7.2.0 getting IPv6 addressNo matter what I do, the GUI does not record DHCPv6 prefix hint.What am I missing? config system interface edit "wan1" set vdom "root" set mode dhcp set allowaccess https set ident-accept enable set type physical set role wan set snmp-index 1 config ipv6 set ip6-mode dhcp set dhcp6-prefix-delegation enable set ip6-dns-server-override disable config dhcp6-iapd-list edit 5 set prefix-hint ::/56 next end end set dns-server-override disable next end(ipv6) # get ip6-mode : dhcp nd-mode : basic ip6-address : 2001:558:6030:7a:ccb4:xxxx:xxxx:xxxx/128 ip6-allowaccess : icm

Hi, I need to use someone to update signatures on Fortigate firewalls and not willing to give him super admin admin account. Is there any way to create an account with the minimum permissions just to be able to use execute restore ... command and update the firewall? Regards,  

Can somebody share a real scenario of load balancer configuration with couple of servers attached to it and spcify the traffic that comes from WAN to LAN with all the IP addresses. Thanking in advance !Nabi

Hi Community, can someone explain the meaning of "ret-no-match" in a debug flow on a FGT?As an example debug line see the following:"2022-07-01 09:04:45 id=20085 trace_id=32985 func=__iprope_check_one_policy line=1951 msg="checked gnum-4e20 policy-6, ret-no-match, act-accept"" I understand the line itself but not the meaning of "ret-no-match". Thanks a lot. Kind regardsDominik

Hi, Does the FortiGate and FortiManager support sending SNMPv3 INFORMs? If so does anyone have a guide please. Many thanks. Paul.

Does anyone have any suggestions on how to use Ansible to get around the admin initial password change of a brand new FortiGate? We stage dozens of FortiGates a quarter in an isolated manner.  Having to manually enter in the admin password first doesn't truly make this approach "zero-touch".  We've been searching and trying with Ansible, but I'm missing something? Thanks in advance for any help you can provide!  

Hello Fortigate team, I have a query, is it possible to perform a direct update of the Fortigate ios version in case the team is new without configuration. FortiGate 

Hi I've updated my Home office User from FortiClient 6.0.9 to 7.0.3 manually.With 6.0.9 We've a tool to modify the installer to VPN only.With 7.0.3 I download FortiClientVPNSetup_7.0.3.0193_x64.exe.But Now I see in the console that the FortiClient try to Update something every dayBut my user has no right to update something so it fails everyday.Is there an option to block the forticlient to call to the cloud?Thanks for any hint  

Hello,  I have a question. FortiGate is communicating with Forti Servers to determine the web category. When that communication is disrupted, the firewall stops accepting traffic. Is there a way to overcome this? Thanks and regards, Konstantinos

Hi, following constellation: We have a FortiGate 100E running here. I created a CSR on it to have that signed by our internal CA. I then imported the certificicate to the fortigate which all worked fine. I selected it for to use it for https and that works fine so far. It does do https with that cert and I do not get any more Browser warning (since all our clients know our CA).However the FGT denies me to select that cert for use with SSL Inspection. I can onyl choose the FortiNet built in one here and none of the others installed.Does anyone have a tip why that is? FGT runs FortiOS 5.4.x and our CA runs on Wind*ws btw.FGT is not part of a HA Cluster, a FortiManager or a Fabric..just standalone. CheersSebastian

Hello all I have recently inherited a network of Fortinet gear.  It was mostly setup reasonably well, but there were a number of issues.  It consists of 2 60F which are setup in HA.  3 FortiSwitch 248E-FPOE, and 6 Forti AP 221E.  I have managed to work out most of what needed to be done.  However one odd thing lingers. I have all my FortiSwitch online and accessible through FortiLink, as well as Forti AP managed.  The FortiLink address is 10.109.92.1, and my FortiSwitch are 10.109.92.2/3/4.  From any Fortiswitch I can ping and access the other (for instance from 10.109.92.2 I can SSH to one of the other FortiSwitch at 10.109.2.3).  However I cannot from any switch ping the FortiLink interface of 10.109.92.1, nor from the GUI can I access any Fortiswitch via CLI.  My only option right now to access the Fortiswitch directly if I wanted to is to use a console cable. One challenge I faced was that when I was given this setup the F

I was gifted this awesome device, but now I need to set it up.Where should I start? I currently have an all-in-one cable/modem+wifi/router.Looks like I need to separate them.. this will be for my home/network/lab. I found the "Quick Start" Guide, but I need more helpHow do I get started?Where do you plug the Cable/Modem?Where do you plug the Wireless router?Do I need a 'compatible' kind of wireless router?

Hi Team,We are seeing a strange issue with our FortiAnalyzer which is related to the radius authentication. We have configured Cisco ISE  as a radius authentication server. ISE IP and all other parameters are configured on the Fortianalyzer however authentication is not working.  We have captured the sniffer traffic but do not see any traffic leaving the device. Please advise what could be the issue? Is there any way to restart auth daemon/radius service? We have already rebooted the Fortianalyzer.           FAZ01 # diagnose sniffer packet any "host x.x.x.x" 4 ainterfaces=[any]filters=[host x.x.x.x]^CPlease find the snap for reference.