Solved

Or where can I get the logs output?

I searched online but couldn't find exactly how to do this.We want to upload a logo image file to replace in the disclaimer page. But want to do it from TFTP or SFTP via CLI. Does anybody have the command and destination folder in the FGT's filesystem? Thanks, Toshi

{Forti OS 7.0.2}One Way Audio, Scratchy Voice and missing voice issues.Recently provisioned a new 3CX server and installed a new 60F Fortinet onsite for a customer. I setup all the usual forwarding rules and it PASSED the 3CX Firewall checker. At this point the customer was experiencing quite a lot of one-way audio and scratchy voice calls. Almost every forum says only disable SIP ALG but it didn’t help, after a week of digging and consulting with other SME’s I found a solution that worked. I applied it to 3 sites, and all are now operational. Creating a VIP - Go to Policy & Objects > Virtual IPs > Create NewFill out the information accordingly for each port required (note you can specify interface) Once you’re done add all the created VIP’s to a Group - Create a ServiceGo to Policy & Objects > Services and create a new Service and Specify your 3CX ServerCreate a VoIP priority shaper Go to Policy & Objects > Traffic Shapers and create new.Set Type

Hi All, I hope you are having a great day. Upgraded to FortiOS 7.2 and noticed there are 2 SFP ( grayed out ) under Network > Interfaces while there are no physical SFP ports. Also, I have missing "Firmware" menu under "System". Now I cannot downgrade to the previous firmware. I am new to Fortigate device. Any help/suggestions would be greatly appreciated. Thanks in advance.

Hello @All,I looking for a solution to redirect a URL like this one:User input: https://www.site.net:8080to; https://www.site.net:8080/info/faq.html I have look to this example:In my case, regular Expression is https://www.site.net:8080 and the replacement is https://www.site.net:8080/info/faq.html.If I try https://www.site.net:8080 I only get 404 not foundOn Policy / Web protection Profile, I have added the URL Rewriting. If I type that URL https://www.site.net:8080/info/faq.html everything is working. What I'm doing wrong?Many thanks for helping!TBC

Hello all,how can i access from outside over fortiweb to an internal web server without input of Login Details? We have an internal ADFS Server for Changing Passwords for the User.The User needs access to this internal Server from outside without any Logins. Is that possible? Many thanksTBC

Recently the FortiGate received attack from 114.34.160.41 and IPS successfully blocked the attack, but then caused a false alarm on SIEM. As the FortiGate sent a “Allowed – session reset” log message to SIEM, the SIEM triggered a high-alert message, which the keyword “allowed” made a confuse of the Firewall bypassed the attack. Any suggestion to prevent that? Thanks.  

Hi,it is possible on Fortigate 100F to have one vlan configured on multiple ports?Let's say I have vlan5 192.168.5.0, it is possible to attach it on port1 and port2 so then I will have on these ports the same shared vlan5 subnet ? thanks

I'm reading the FortiOS Handbook on page 1120 it says To import a separate server certificate and privat key files - GUI ......Go To System > Certificates and select ImportBut, there is no "Certificates" under System?????? 

Hi ¡¡¡ I have 2 doubts:  1) I have published WEB servers, which are in my DMZ. I have adjusted thresholds and protected them against TCP attacks since they only allow HTTPS traffic. I suppose there is no point in protecting them from other types of attacks DoS (UDP, ICMP etc). On the other hand, my firewall connects to an ISP and receives the public IP on one of its interfaces directly (witouth NAT). Is not the public IP (VIP) to connect to the web servers but is the same internet connection. This interface doesn't have any administrative acces enable (ICMP, HTTP etc are disable). I was wondering if I should protect the interface itself from DoS attacks, but I understand that it is not necessary since I do not have any services enabled. If there is no service enabled, they cannot do a DoS. However, I have monitored the IP of the interface with very low thresholds and if found anomaly alerts come out and I don't understand why it detects them when ports or services that a

Hello,  I have a 100D and I would like to clean installI boot it and got in the configuration menu so now I cannot upload through TFTP Is there a solution? Regards, Konstantinos

Hello,newbie using Fortigate.I created an automation sticth to upload a config backup to an SFTP server. I used the following CLI command execute backup config sftp /path/firewall_backup.cfg SFTP_IP SFTP_user SFTP-password If i run the above "CLI" command manually, file is created using the name I specify (in the example, firewall_backup.cfg) if I run the same command via an automation stitch, filename is prefixed with the fortigate serial number (i.e. it becomes FG123456789_firewall_backup.cfg) Of course such prefix doesn't disturb me, but I would like to understand WHY this prefix... Checked on documentation but since I'm a newbie on fortigate was unable to find the right point.Can someone help me understanding this  behaviour?Thanks in advance

Hi,Trying to evaluate Fortianalyzer, I created a Forticloud account, logged in and downloaded the VM image but as my lab is not able to access Internet, I cannot connect the VM in lab to get the free trial license directly from forticloud. Is there anyway I can download a free trial license file using my account and upload it to my lab VM?Regards, 

FortiNAC is not providing DHCP service for Isolated network via eth1 service interface. How can i resolve this issue?   

i Noticed that the logs on my Fortigate is stuck at 22-April.eg. web filter and email filter logs when viewed from Fortigate Logs and Report and from my FortiAnalyzer latest logs is until 22-April. I cannot see any logs from 23-April to today.How do i check whether my logs is working properly 

Hi, Long story short:I have created CSR on Fortiweb, CSR was signed and cerficate was imported on FortiWeb My question is:Is it possible to export private key and import it to the backend server?  The probilem I see here is:Private key is password encrypted (duh?), but there is no option to specify password during CSR creation, so I guess the password is automatically generated during CSR creation. I tried changing the password in CLI:conf sys cert localedit "cert1"unset passwdset passwd somepasswordendbut I get an error:Command fail. The configuration of a certificate can not be changed from CLI except the comments. Am I missing something here? Or this is just not possible? 

EnvironmentFortiGate 100FV6.2.9 Build 1234 Cloud EMSV6.4.4.1658 Has anyone upgraded from 6.x to 7.x for Cloud EMS? According to support, it just a case of converting the EMS licence.My concerns are as follows:Will this still be compatible with FortiGate (according to the compatibility chart I should be OK)?How will be affect my existing EMS 6.x VPN clients?Should I schedule the convert out of hours (even though this is a licence change)?I presume the EMS console will expose the option to create 7.x FortiClient installers alongside the existing 6.x created installers?Any advice would be welcome. 

Hi. I have fortigate 600E with 6.2.10 firmware. I have 3 DR (3 ISP internet connections) which the traffic from my servers goes to the internet. To determine which of the 3 lines the source from my server traffic leaves, I use policy routes. Now I would like to configure a SDWAN with 2 different internet lines, for other pourpuses, in addition to the 3 that I already have. When trying to create the new default route I read this message "You cannot have duplicated routes on SD-WAN and non SD-WAN interfaces." I have read about it and it seemed to me that what is usually done is to put all the lines in the SDWAN (the new and the 3 that it had) creating the default route to the SDWAN. Finally, create a DR that goes to the SDWAN (eliminating the current 3) and with SDWAN rules control what goes out through each line. I would like to know if it is correct. On the other hand, I would like to know if this would generate any problem in the servers that go out through the 3 DR that I have, for e

Hello @All, for internal testing, I have set up our fortiweb with an internal and external virtual IP.If I'm using the internal virtual IP for my profile under Policy / Server policy, I get my replacement message screen and everything is fine for internal communication.If I change the same Profile to my external virtual IP I only get a Login Prompt.After input my date the communication works fine but no replacement message at start. Has anyone an Idea what could be the Problem?Fortiweb OS: 7.0.0 Many thanksTBS

My organization is currently reviewing IOC and I been reading about it. However, I can't find answer to one thing, what if its a false positive and we know it and we want host to access the internet and remove it from 'compromised host' tag?

I see the FortiOS and Fortigate Image on Fortinet Support.I'd like to know how are there different?Note:1. Port1 is a management port (cannot use in firewall policy) I tried to change port name but it's not work.2. port 2 is a port1

Hello all,  i have here an Fortigate 60E with enterprise bundle. It is possible to combine it with an Layer3 FortiSwitch 448E without subscription? Is the Switch restricted without subscription? This time i have an HP29xx series as Layer3. However, this does not work optimally with the Fortigate. I thought a Fortiswitch would be a better choice. Especially in device detection and IOT.  Very ThanksBest regards IPranger

Hello @All, I'm looking for a configuration example how to configure a Fortigate to communicate to a Fortiweb like on this example:If a Client on the internet communicate over a public IP of Fortiweb Virtual Server, how to configure the Fortigate to send the traffic to Fortiweb.Is that just a NAT Rule? Fortigate and Fortiweb are on latest Firmware. Many thanks for helpinggreetings TBC    

Hi Guys, i need to delete an expired local certificate and upload a new one but the delete botton is grayed out and i've no access to CLI (i access directly to the public ip address), how can i replace it?if i try to import the new one i'm promped this: "Certificate file is duplicated for CA/LOCAL/REMOTE/CRL cert."hardware is FortiWiFi 60F Region-E thanksregards  

Dear Fortinet Community!FWF30E-3G4G (6.2.10)  is using onboard LTE modem with SDWAN. It works only with direct routes, and doesn't work  with static route sdwan--> 0.0.0.0. LTE gets dhcp address with /32 mask - so there is no any gateway... If I downgrade it to 6.2.9 - everything is fine, LTE gets /30 address with normal gateway. Asking here to see if anybody recently had this issue. Thanks!