Solved

HI all,as per diagram,the three sites are configured with BGP and all is working properly.All the networks are received trough BGP from both FGTs and from Cisco R1.Now the problem is when i configure Vlan in FGT.As per diagram,vlans configured trough cisco router as L3 device are working properly,buuut the Vlan I configured on SITE-C FGT (Vlan 50)the network is published trough BGP to all the sites,but the PC4 is only able to ping his GW but any site.I don't understand if is a bug or something not configured properly.Wireshark only give "no response found" for ping request.Either PC4 can't be pinged from any other site.Basically,all network is working proiperly,only vlans configured in FGT are not working.Thanks in advance!

Keeping Split Tunneling routing address blank in SSL-VPN portal. be able to use FQDN addressesso my collaborator's internet goes out through fortigate, or through the internet from his own home? Leaving Split Tunning blank, when checking the IP that the Client is going out to the internet, it is the Company's IP. Is internet traffic going all the way through Fortigate? https://community.fortinet.com/t5/FortiGate/Technical-Tip-Access-to-Specific-FQDN-using-Split-Tunnel-SSL-VPN/ta-p/190062?externalID=FD46248

EnvironmentFortiGate 6.4.4FortiClient EMS 7.0.4 (Cloud)FortiClient 7.0.5 So I am just starting to look at the Web Filtering module and have some questions: Q.Is there any dependency on FortiGate Firewall or can this be ran independently given a lot of my users are WFH? Q.Once configured, I see there were prompts to install the Web Filter extension for Chrome and Edge on the detected browsers.The Chrome extension was found and installed OK but when I tried the one for Edge (Chromium version) it took me to a blank Add-ons page which displayed nothing.Is this a known bug?Tried installed the native Chrome extension for Edge but I was still getting prompts. Q.Is there any work required on the ForitiGuard setup? I presume that this is part of the licence set you get with Cloud EMS. 

Hi, I have a question about FAC as below.1. I want to set Captive Portal on FAC as HTTP. but I found only HTTPS service on network setting. Can I set Captive Portal as HTTP?2. Can FAC Provide a logout page after done login page? My Network DiagramComputer (wired) > Fortigate(Point External Portal to FAC)> FAC that provide Captive Portal. Thank you.

How do i find out what is inside the custom1 list under Local Categories in Web Filter ?What URL are inside this custom1  

Hello, forum. I need help ASAP. So I decided I wanted two-factor authentication on my Fortigate-30E. I was supposed to receive an authentication code or something like that to my email but I never received it. I'm now unable to get into my fortigate (GUI and CLI) because it is requesting a Fortitoken. I went to the Fortitoken page and now have a free license but I would think the previously stated activation comes first. I don't have a license for Support and I'm not apart of any organization. I'm just a aspiring network engineer that wanted something to practice on at home. Can someone help? 

Hello,Do you have information about release date FortiOS 7.0.6? Our security team requests a fix for CVE-2022-0778. The solution is to upgrade to 7.2 or 7.0.6 https://www.fortiguard.com/psirt/FG-IR-22-059I don't want to install 7.2 in a production environment.Thank you

Everything had been working just fine. Then last night I got this error code (-20199). I thought the VPN was down. Called work this morning everything is working fine on their end. I checked with their IT department and he doesn't know/hasn't hear of this problem. 

 Hi  team：The client is headquartered in China, 70 percent of its employees are located in China, and 30 percent are located overseas.Our plan is on-premise forticlient ems,Due to the Internet in China, we hope to deploy a set of EMS overseas to deal with the problem of network connectivity, so do you have any suggestions to solve this problem?

Hi,I am new to fortinet, I need to setup a network consists of two FortiGate1101E with forti Authenticator, Forti Manager and Forti Analyzer  in the HQ and about 100x FG-40F in branches. In each branch, I have one FortiAP and One FortiSwitch.The branches with will connect via IPsec tunnels to the HQ.My questionCan I create one single wireless network all the beaches, the core firewall or do I have to create a WLAN in each remote branch separately?Is there a design document to help with my scenario? Thanks2.12.0.02.12.0.02.12.0.0

Hi,Old Checkpoint R77.30 user, I'm using now one cluster of FG100E with v5.6.7 build1653. I'm having difficulties with Anydesk: all my workstations can't connect to Anydesk's services (error ssl_14090086).Application Control is on with "Monitor all applications" default profile and no trace of Anydesk in Application Control LogBut in Web Filtering logs, it's full of  hostname "AnyNet Relay" or URL "AnyNet Relay/" sometimes with non resolved IP or the classic boot-*.net.anydesk.com or relay-*.net.anydesk.com with Unrated Categorie.I've added Static URL Filter but no success. I can't add wildcard * expression in Web rating Overrides.I've also made a rule for testing with any any all "Anydesk-Web" but this Internet Service have only 28 entries and i can't edit thoses.The only thing that works: remove the Web filtering, and i don't want that.If someone could give me some hints. Thanks.

Hi, I have gotten a very special request that I can't figure out if is possible by some kind of magic.What is wanted is that all traffic except MS Teams traffic is routed through the Fortigate and Teams traffic is directly accessed.It's a Fortigate 200E with firmware 6.4.6 and the free vpn client going over ssl-vpn. Is there any way to achieve this?FortiGate#Client

Dear All Guru, i need urgent help. i have a 100D (V6.2.10)  in HQ office. i was able to create Site to site VPN to two other site office which is using 100D as well. Recently we have added a site office ( we called it C)  which is using 80E ( v7.0.5). i manage to create and bring up IPSEC tunnel between HQ and C. from C- C fortigate 80E able to ping HQ fortigate 100D- C server able to ping HQ server IP from HQ- HQ Fortigate 100D able to ping C fortigate 80E- HQ Server not able to ping C Server IP. The IPSEC tunnel already up between the 2 fortigate device, both device can ping to each other.  but the server from the HQ cannot access to the C network. i have tried open entire subnet for both side access but it is still not working. any idea if i miss out any setting?  Please help!  

Hi community! I'm interested in knowing if there is a way to download an installed firmware image from a FortiGate device through any transfer protocol such as SCP, FTP, TFTP, etc. ? According to this article we can actually push .out firmware images to a device via SCP with the command scp firmware.out admin@<IP>:fgt-image  What I am looking for is exactly the opposite. Is it possible? Thanks! 

Good afternoon!I am trying to connect two FortiGate 40F in HA and two different ISPs with a FortiAP 221e on the internal network. The architecture of the formed network is as follows:   the connections with the ISPs through the ISPs work correctly and the connection in HA also works as it should (I make the wired connection from the internal Switch to a computer, I run ping to google and when I disconnect the FG that is working as primary , only one packet is lost, making the switch from primary to secondary correctly). The problem is that when I perform such disconnection from the primary FG, the FortiAP goes offline and takes a long time to reconnect, leading to all client connections to the AP being disconnected.I would appreciate if someone could guide me on the following:Why will there be such a delay in reconnection to the secondary FG?Is this delay because I am using TPLinks Switches?Is there any particular configuration for the FortiAP in this situation?Thank you

Bear with me everyone, I have a very minimal knowledge of Fortinet products.  I can barely navigate using command line in these firewalls.  The Firewall I am working with is, from what I am seeing, an EOL product, the Fortigate 1240B.  I need to capture some simple information from this firewall for QA purposes.  I need to capture things like the BIOS Version, the FW Version, and the HW Revision. All I have been able to find is a FW Version, whether its accessing the fw_mgmt or the GUI.  Using command line I typed in "execute revision list config" and that gave me the FW Version.  I tried rebooting the firewall to go into the "BIOS" to see if it would give me any other information and I couldn't find anything.  Again, newbie user to one of these Firewalls, I usually work with CISCO and Redhat exclusively.  Any help you can provide would be awesome! Thank you in advance! 

Hello, based on the post : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restricting-SSL-VPN-connectivity-from-certain/ta-p/191997. It is possible to restrincting ssl vpn connectivity from cities in place of country? Thank you

Hello  I have a FortiGate 100D that has diskI have connected it with the cloud I would like to ask if I can change the 7 day store period?Is it possible from cli? Thanks and regards, Konstantinos

Good day!I am having trouble with my configuration, I can successfully established connection with both firewall but I cannot access the VLAN on the branch firewall. Here is my config: HQLocal Subnet: 192.168.100.0/24Remote Subnet: 192.168.50.0/24 BRANCHLocal Subnet: 192.168.50.0/24Remote Subnet: 192.168.100.0/24 Static Route HQ:Destination: 192.168.50.0/24Gateway: 122.8.182.207 Static Route BRANCH:Destination: 192.168.100.0/24Gateway: 222.81.180.201 My firewall policies:HQ FIREWALL VPN1:incoming interface: hq-to-branchoutgoing interface: lansource: alldestination: allservice:allNAT: disabled VPN2:incoming interface: lanoutgoing interface: hq-to-branchsource: alldestination: allservice:allNAT: disabled BRANCH FIREWALL VPN1:incoming interface: hq-to-branchoutgoing interface: lansource: alldestination: allservice:allNAT: disabled VPN2:incoming interface: lanoutgoing interface: hq-to-branchsource: alldestination: allservice:allNAT: di

We have about a hundread FGTs for a retail customer managed by FMG-VM. And we're about to roll out a FAP per FGT for 100 of them. All have the same guest SSID/VAP. But when I looked at AP Manager, under the SSID tab I seem to be able to see configured VAPs for each device(FGT). So when we need to change something on the common VAP with AP Manager, we need to change it one by one in GUI.Or, am I misinterpreting the menu and there is actually a way to set just one config of of VAP and link it to all 100 FGTs? If not, I'm now thinking to set up a CLI template group/CLI templates to configure the VAP and all other necessary "wireless-controller" config so that when something needs to be changed, we just need to change the template and push it to all FGTs. FMG-VM: v6.4.8 Thanks, Toshi

Hello.We had recently a security breach in our company (a user breach), the user shared his credentials to another user who access the LAN during vacation.The user logged using a cached user then connect to the vpn using a friend credentials.Is there a way to avoid this?I mean forced a Forticlient login to a specific computer, if it doen´t match drop the connection.In Windows i did that using Active Directory but it don´t apply the rule to the vpn.Thank you.

Hi, I have an issue with forwarding VIP port for local web server. The web server itself has port for example:Web server: 10.10.1.1:8081WAN: 172.16.40.50 so if in the port forwarding setting when I enter:External server port: 8080 or 8081and map to : 8081 won't work. but for the other web servers without port will work fine. Please advise.Thank you   

Hello,  I am trying to delete an IPSEC TunnelI see a reference of an admin user. In the details the below is highlighted gui-dashboard.0.widget.6.interface So I think that the user has created a widget in the dashboard.  How could I delete it in order to erase the Tunnel? Thanks and regards, Konstantinos

Hello everyone,  A user on Mac updated to the Monterey OS and updated his forticlient to the latest version.Before those updates he managed to connect to the VPN, but since the update he's unable to connect to the VPN (Network timeout). We are using the free version of Forticlient.Tried to installed the latest, also tried version 6.4.6.1378 and 6.4.7.1405 without success. We have several other mac with the M1 chip which are using the IPad version on their mac which works perfectly fine, but the other user can't install the Ipad version. Do you have any recommandation ? Thanks in advance for your help

Hi,I am running vrf on the lan (inside zone) switch . I don't have separate physical switch for dmz. So i am planning  to run the dmz on the same insdie switch .In firewall we create a vdom for  dmz ,In that case how many physical link I need from the lan switch to the fortigate firewall .Do I need separate link for dmz vdom ,Or  I can use the same link for the root vdom ?If I can use the same link what configuration requires on fortigate side and switch side Thanks