Solved

Dear people, I have in FGM a lot of CLI Scripts, I use for automated Installation of a Fortigate.One of my problem is, that I must assign step by step the scripts to a fortigate and it does need nearly 10 Steps until the fortigate are completed. If I use all cli scripts in once, so I get Error from the FGM. Thats the cause, why I splitted the CLI scripts to mutch standalone cli scripts.  My question is, gives there some possibility, install all cli steps in once? For example I can not purge the DHCP from WAN and following delete the WAN Interface. So I get a error if I will execute this script. Kind Regards

Hi all,Since few days, we have started to use FortiToken and 2FA with the Fortigate's solution. Firstly, we have users in our AD, but we couldn't add mails associate in each user automatically. For that, you have to add mails manually for each user. You have any ideas about that?In addition, we can't automate the distribution of token for users? Because with a hundred users, it's not normal to attribute tokens manually.Any help would be appreciated.Thanks,Ali

Hello friends, I need some support in the configuration of a FortiAP. I have a specific vlan (with vlan-id 99) for all FortiAPs connected to my FortiGate-firewall. This vlanis the management-VLAN for the FortiAPs. My goal is that the FortiAPs broadcast a wifi-network which is bridged to my lan-network (connected to port2 of the FortiGate-firewall). But how to configure it? If I choose "Bridge" as "Tunnel Mode" in the configuration of the SSID then the wireless-clients get an ip-address in the management-vlan of the FortiAPs. If I choose "Tunnel" as "Tunnel Mode" I get a new (wifi)-interface on the FortiGate-firewall (with the name of the SSID) and I have to define an ip-address/netmask for this wifi-interface. Would the next step be to create a software-bridge with port2 and the wifi-interface as member ports? As mentioned above my goal is to have the wifi-clients in the same network as the clients connected to my lan (which is connected to port2). Ca

Good morning,I have a MV Fortianalyzer, I saw that I can generate the report of time used by the user, but my doubt is if I can pull it retroactively. viewtopic.php?f=15&t=19269 I need to get a report of the connected time of the users per day since 01/02/2022 I saw the general option that takes the total. but I need the consumption per day. can someone help me.Regards

Hello @All, i'm on configuration of our new fortigate latest OS to allow our external companies to using the ssl-vpn client to get access to our internal systems.We have several external companies and they need to have access to different internal systems.Neither company is allowed to see the other's systems. All of them using one VPN-Pool IP-Range (exampl. 10.10.1.0/24)User Login is based on LDAP Auth.I have try this configuration:1. Setup LDAP User/Groups2. Setup ssl-vpn-portal with split tunneling "Enabled Based on Policy Destination", Source IP Pools = 10.10.1.0/24; No "Web Mode" Active.3. SSL-VPN Settings "Listen Interface = WAN"; Tunnel Mode Client Settings "10.10.1.0/24"; Authentication/Portal Mapping "I add all VPN Groups from our external Companies"4. Firewall Policy, I add for all external Companies one Rule with:   Incoming Interface = ssl-vpn tunnel interface   Outgoing Interface = Internal Port to our Systems   Source = The VPN-Pool 10.10

Hi, I have changed our core switching to a pair of ArubaOS-CX devices and wanted to move the existing Fortigate LAG on X1/X2 on a 100F (6.0.14) to go to each of the Arubas.The Aruba multi-chassis LAG can only be set up with LACP and it didn't come up so ended up creating a non-LACP LAG to just one of the switches to get us up and running. I have looked at the Fortigate and seen that the LACP type is static. My question is, can this be changed to active or passive on an already configured Fortigate LAG? Or like with everything else, do I have to remove all config and start again to create a new one?I don't want to have to travel to the site to find out it can't be changed with a CLI command. Thanks!

I edited a backup .conf file and restored it through the webGUI. This apparently crashed the firewall and powered it off. After uploading the .conf and clicking enter, the webGUI said "Rebooting system" followed by "System reboot is taking longer than expected". Now, I can no longer access the webGUI or ping the device, and a console server it's connected to says it's disconnected. I have no physical access to the device until next week. I have a rescue backup .conf file. I'm just curious what I should expect next week. Did it crash because I edited a .conf instead of doing it through the cli/gui? Will it boot to the last working config - if at all - or is it in some sort of error state?  Basically, is it recoverable?

Hi,I try to configure an automation stitch with this event:However, I can't understand why the event never gets triggered. Even on the system event logs I never find anything related to IPS db updates .. does anyone know why?Maybe because I only have the IPS license and not antivirus?Thank you

Hi, I'm still learning, wanted to get one up and runing in Hyper-V together with a Fortigate or 2.(on a local Windows 10 machine)I followed https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/9c527bde-cce0-11e8-8784-00505692583a/FortiAnalyzer-HyperV-VM-Install-Guide.pdf Dowloaded vm from https://support.fortinet.com/Download/VMImages.aspx 7.03 Reinstalled 3 times, didnt find any guide for 7.0x. Video's just show to log into gui after adding HDD and booting up. Tried a execute sql-local rebuild-db, and afterAt shutdown and the dots counting up, it always ends with Failed! =/ I guess all my questions are wrong, butAs they have 7.03 for hyper-v i guess its supported? OR should I try another version? or vm platform?Tried google the errors. reset system all-settings. How do I mount /var?

Hi all, I'm seeing every few minutes the number of sessions moving through my FortiGate spike from a few thousand, to tens of thousands, and back.How would I best identify the source of these connections?

i have seen this a couple of times and just wondering if anyone else has come across this. and can add any logic, so i can add to my notes for resolution. when the logotype has been set to CEF, via the GUI.however the format it seem to come out in the local disk value not the expected CEF e.g  expected output  CEF:0|Fortinet|Fortigate|version|etcnot the ondisk formatdate=2022-03-20 time=14:55:20 logid="1203030258" type="utm" subtype="waf" eventtype="waf-http-constraint" level="warning" 

Hi. Is it possible to view traffic log from internal device to another internal device (for example RDP connection). Currently I am not able to view any traffic from lan to lan. Appreciate your knowledge and information. Thank you.

Hi, I trying to add IPv6 to existing interfaces on my Fortigate 60E running 7.0.2 The WAN part was no problem. When adding the configuration to the LAN (internal) interface, I got an error:object check operator error, 1, discard the settingCommand fail. Return code 1 Config WAN:FTG60E (wan1) # showconfig system interfaceedit "wan1"set vdom "root"set mode dhcpset allowaccess pingset type physicalset description "WAN Ziggo"set alias "Internet Ziggo"set lldp-reception enableset monitor-bandwidth enableset role wanset snmp-index 1config ipv6set ip6-mode dhcpset ip6-allowaccess pingset dhcp6-prefix-delegation enableconfig dhcp6-iapd-listedit 1set prefix-hint ::/56nextendend Confige I try to add to LAN:config system interface edit "internal"FTG60E-BMR-001 (internal) # config ipv6FTG60E (ipv6) # set ip6-mode delegatedFTG60E (ipv6) # set ip6-send-adv enableFTG60E (ipv6) # set ip6-other-flag enableFTG60E (ipv6) # set ip6-upstream-interface "wan1"FTG60E (ipv6) # set ip6-

Dear Poeple,Nice Sunday first:-)I put a picture to explain my behaviour better.I want connect with a forticlient to FG1 to reach their network and reach the Network from FG2 too.FG1 und FG2 have side to side VPN connections.I can ping only the FG1 networks and cannot reach the FG2 networks like in picture to the network 192.168.4.0/24.Does it possibele to reach other Networks with a Forticlient over VPN Connection or not? Phase 2 all FGs and FortiClient Network are 0.0.0.0/0.0.0.0 typedIn FortiClient VPN Connections are both Network (192.168.4.0 and 192.168.5.0) typed.In FG 1 is a policyincomming: FortiClientVPNoutgoing: internal, VPN Connection to FG2incomming Network: alloutgoing Network: 192.168.4.0 and 192.168.5.0Split Tunneling ist activatedThanx in advantage 

Hi everybody, In now, I need create Policy internet access with AD account. I already Ldap with AD Server but when create policy then can not access. After that, I read document and create windows polling group, add user group with FSSO and test but user can not access internet I think, must install FSSO Agent. But I have questions below:  FSSO Agent must install on AD Server or I can install at other server with collect/polling mode ? Thanks   

Hello, I have a question about the setting of Virtual Server(loadbalance). Please see the detail as below. -There are 2 Real Servers and I want Real Server1 is Active and Real Server 2 is Standby.-If a Real Server1 fails. Real Server2 to be active instead. When Real Server1 is back. Can FortiGate automatically set Real Server 1 as Standby? I want Real Server1 is standby after coming up. I tested many settings. but when Real Server1 is back. It will always be back to active. Does anyone have a solution for this situation? Thank you.

Can someone explain to me why the answer is "client did not authenticated"? i thought it was authenticated because on the smtp session "sender ok" and "recipient ok" and also the message is delivered

Im planning to upgrade our FSSO Agent to version to 5.0.0304.But on our Citrix servers we are currently running TS Agents with version 5.0.0294. Would this cause any issues? I cannot find any information about running diffrent versions. Thanks,

Hi. I have a question to the community. What is the difference in creating VIP (NATting) with port forwarding and without port forwarding? If i VIP all service without port forwarding does that mean all services are exposed to the internet? Hope someone can have a clear explanation on this as I am quite confused about this matter. Thank you in advance!

Hello everyone,When a guest user authenticates via the captive portal, a FortiGate page appears on the browser with the address ---> http://192.168.x.x:1000/fgtauthBy pressing the "Send anyway" button you can navigate correctly.How is it possible to remove this page?Browser: ChromeCaptive Portal: FortiAuthenticator v6.1.2, build0420 (GA)ThanksAndrea

Hello There, Is anyone having the same problem of disappearing the Device Information from devices connected to each Fortiswtich Ports, with Fortigate 301E using OS 7.0.5 version?    

I have a problem with the webfilter and app control of my Fortigate60E I am blocking EVERYTHING that is remote access and it is not working, which it is but if I go to Log&Report>FowardTraffic absolutely NOTHING is reflected in "Application Name", which makes me assume that my traffic passes without SSL inspection. I'm using a basic Monitoring setup profiel on App Control and Webfilter, and it doesn't work either, I don't really see anything. What's going on?

Our AD is hardened and our service accounts are limited in what they can do.  I have a service account that I am attempting to poll active directory groups for usernames.  Currently my service account can query ldap and view event logs.  What other permissions would I need the service account to have.  Currently I have a red arrow on my active domain controller. Our domain controllers are up to date and our Fortimanager is version 6.4.3 build 2201. The connector does get a green arrow if we use domain admin credentials. thank you

Hello team!! I have the following issue with a fortigate 60F (firmware 6.4.4)We have all the rules from LAN to WAN, with "Certificate-inspection", no one with "Full-inspection", and the "Certificate-inspection" profile is the default one.Sometimes, clients are having problems browsing in the internet, because Fortigate is giving to user its own certificate and it is not trusted in clientsI know a possible solution is to install the fortigate certificate in clients but I prefer to know why is happening thisDo you know why fortigate could give its own certificate to clients even using default "Certificate-inspection" profile? Thanks in advance.Regards,Damián

Hi,Does anyone know exactly what it means no_ofld_reason: redir-to-ips??? I have two fortigate 60F, (FGA and FGB) with FortiOS 7.0 but one (FG A)of them has problems inspecting the traffic, i mean that the traffic passes without inspecting the security policies. Example, if I want to block Torrent or Remote Desktop, the traffic goes through and is not blocked by Application control. This only happens with one of the two fortigates (FG A), in the other (FG B) i can block an application or URL without problems when I run the command "dig sys session list" the result say in FG A no_ofld_reason: redir-to-ips is constant and it always stays, but in FG B it varies does it have something to do with it? FG A says: no_ofld_reason: redir-to-ips (is constant)Fortigate A redir-to-ipsFG B says: no_ofld_reason: