Solved

hi, I am trying to remove a local certificate and get an error message. Apparently the FortiGate believes it is in use, but there is no reference to this certificate as you can see by the zero in the last column.  This is a Staging certifcate from Let's encrypt and i need to replace it with a non-staging one. Can anyone help? FortiGate  

Hi,  Whether anybody has tried VM snapshot of Fortimanager (Without HA). If this is possible, once we restore the snapshot whether all the configuration, settings, logs of Fortimanager will be intact?. Since Fortimanager is a single platform which holds all the configurations of Fortigate, so would like to understand whether VM snapshot backup is enough to restore all fortigate configs, logs etc..

Since the last update to Android 12 I can connect to our company with Forticlient VPN app but only have access to servers IPs no server name, it looks like there is no routing thru VPN DNS. But more unusual, I am able to access domain names out of the organization, like google.com. I followed google instructions for Android 12 known issues with VPN, clear cache and data, uninstall and reinstall, networking settings to factory reset, but no luck. 

Hello, I'm trying to follow the admin guides on installing fortiEMS server while installing SQL remotely (we have a fully licensed SQL server). The instructions are very vague at best.  Does anybody have a good "step-by-step" instructions on how to install fcems on a remote sql server?

Hello to all . can someone please explain or point to relevent data about this interface and its uses   thank you very much .

Hello friends, does anybody know how to solve the problem of certificate-warning when using a self-signed server-certificate for the ssl-vpn on the Fortigate-firewall? I use the FortiClient to establish a vpn-connection to the FortiGate-firewall. I already added/imported the (self-signed) ca-certificate of the FortiGate-firewall to the trused root authorities on my pc, but this didn't solve the problem. I recognized that the server-certificate was issued for the wrong hostname. The server-certificate was not issued for the hostname to which I connect when I establish the vpn-connection with FortiClient. Could this be the reason for the certificate-warning? Can I issue a new self-signed ssl-certificate on the FortiGate-firewall to use it as the server-certificate (for the ssl-vpn)?

Hello Expert, The monitor section is not visible on my fortigate.I am trying to monitor my ipsec traffic do not see the Monitor options. Regards 

in my setup the firewall outside interface uses a private ip as my isp router forwards my public ips toward my private outside interface and my existing firewall is cisco asa and it have nat rule where it does port forwarding natting using the outside interface which is a private ip "192.168.10.2". I need to move this port forwarding rule to my new fortigate which will replace my asa. so in order to do this should I put in "external ip " my private outside interface ip and in the "mapped ip" I will put my internal server ip? 

Hi all        I have to install FortiClient 6.4 on ubuntu server 18.0 for remote access vpn but it's not working. Please see log information below. Please advice. ------------ Create VPN Profile ERROR"Failed to save client certificate password. Cannot autolaunch D-Bus without X11 $DISPLAY"-------------------------------------- administrator@forticlient01:~$ /opt/forticlient/fortivpn edit CTH-VPN-SSL ===================== Create new VPN profile: CTH-VPN-SSL ===================== Remote Gateway: XXX.XXX.XXX.XXX Port [default=443]: 10443 Authentication (1.prompt / 2.save / 3.disable) [default=1]: 2 Username: username Client Certificate (.p12 file URL) [default=None]: Do not Warn Invalid Server Certificate (y/n) [default=n]: y Failed to save client certificate password. Cannot autolaunch D-Bus without X11 $DISPLAY DONE. administrator@forticlient01:~$ ------------------ Check SSLVPN profile-------------------------------- administrator@forticlient01:~$ /opt/forticli

Hello Folk, We have a Fortigate with the following data.##FortiOS V6.2.10 build 1263 G##Fortigate 100 Since we upgraded to the latest Fimware we have a continuous micro cuts are connected approx. 30 users thought it was something internal but it is discarded because we rebooted and corrected errors in the switch and network ports. Also to test we ping the public router and it does not lose packets. But if I do it to the IP of an internal computer I always have the loss of 3 packets. I do not know if this is a bug, could you advise me how I can follow up and go discarding points. Regards

Hello, After upgrading from 5.4.5 to 5.6.3, the DNS service on a loopback interface is not working anymore. The traffic is arriving on the VDOM and the debug flow shows the traffic is accepted and sent to the loopback. However the DNS service itself does not reply. A wireshark shows exactly the same behavior, the packet is incoming on the VDOM, but there's no reply back. DNSproxy debugging shows: udp_receive_request()-2065: vd=8, intf=39, len=32, alen=16, 10.1.0.47:42857=>172.16.10.13 handle_dns_request()-1395: id:0xabb5 pktlen=32, qr=0 req_type=3 get_intf_policy()-876: ifindex=39 A config compare between 5.4.5 and 5.6.3 shows no modified configuration whatsoever related to DNS or the loopback interface. Running the DNS service on a physical interface does seems to be working. Has anyone by chance run into this before? It seems like a bug or behavior change.

HI there, Im trying to configure a local in policy to allow a VOIP provider's ROBOT to be able to ping the Wan interface to report that the internet is up at any given stage. I can do this but I want to limit the response to specific hosts Public IP addresses. So I have a VLAN (10) configured as my PPP wan connection bound to the physical port wan1. My VLAN interface is called WAN-UFB with an appropriate alias. I have enabled ping on this interface and ZI can ping in from outside no problem.Now I want to limit the hosts that can ping so I'm trying to create a couple of local-in-policy's bit I cant get past the set intf as follows:config firewall local-in-policy edit 1 set intf "WAN-UFB" set srcaddr "xxx.xxx.xxx.xxx" set dstaddr "all" set service "PING" set schedule "always" next endWhen I get to intf, i get the error :  " node_check_object fail! for intf Attribute 'intf' MUST be set. Comma

I have a firewall with a wrong command in the config, I am exploring whether I can correct it without rebooting the firewall.  The following syntax is in the Fortigate firewall. However, the command "set associated-interface "Terminal10" in red is wrong, it should not be there. Can the wrong command be removed by CLI without restoring the firewall config file? Restoration will cause disruption to the firewall operation as there will be rebooting. Appreciate your advice. Thanks. edit "Terminal_192.168.1.1"        set associated-interface "Terminal10"        set comment "Terminal_192.168.1.1"        set subnet 192.168.1.1 255.255.255.255    next After the removal, it becomes as follows:edit "Terminal_192.0.132.1"        set comment "Terminal_192.168.1.1"        set subnet 192.168.1.1 255.255.255.255    next

I am trying to figure out how to deploy traffic shaping for the below situation. I am receiving conflicting information, so I thought I would reach out to the group to see if anyone could provide some guidance. I have 5 separate subnets in which I need to apply traffic shaping to. Each subnet shares a 300 down and 30 up internet connection. Each subnet should have a minimum of 60 down and 6 up; however, if bandwidth is available, each subnet should be allowed to burst to 300 down and 30 up.In conversations with support, it was recommended I create 5 separate "shared shaping" policies for each subnet. However, after researching this further and based on my understanding of the way policies are applied, each policy operates independently, so each policy would think it could burst to 300 as it is not aware of the other policies. In other conversations with support, it was recommended I create a single "shared shaping" policy. Based on my understanding, this approach would n

We have a 524D switch, and using a 40GB breakout cable to 10GB. The FortiSwitches are managed through the Fortigate. We then have a transceiver to be plugged in to an HPE Gen 10 Server. The documentation mentions the following: "Auto-speed detection is supported on 1/10G ports, but not on higher speed ports (such as 40G)". What does this mean for the 4 x 10GB speed ports? Can they be set to Auto 10GB? The port speed on the present Cisco transceivers in the HPE Gen 10 servers are already set to 10GB auto. Also I am not understanding what the speed setting called Auto-Module is used for? We are running version 6.4 version of firmware. And one more question regarding MTUs. If we look at the settings on the switch this is what we see. " The VLANS are set to an MTU of 1500, but the ports themselves are set to 9198". This is confusing. Does one. overide the other?  Thank you

I found the bid in the FortiOS log field.I'm not sure what this field means.who can tell me? The log format documentation doesn't even mention the bid field.

I' m using FortiClient for VPN purposes only and dont need it running any other time. I cant get disable fortinet from starting on startup. Its getting very frustrating. I' ve followed this guide; http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD31776   But when I go to step 2 and try to uncheck FortiClient Service Scheduler and click Apply, it automatically re-ticks itself. Anyone had this problem or know how to solve it? We use Forticlient for corporate vpn and I' m having second thoughts now.

I have a version of the Fortigate 600D-LENC device, that is, without access to Fortinet cloud services and without access to FortiManager and FortiAnalyzer. Is there a possibility on FortiOS Firmware v5.4.1 build 3753 configure automatic backup actions and security policy changes?

Hello Guys,i have a strange question:i have two IPSEC tunnels as below:branch 01 ----- HQ ------ azureip1 -> iphq    iphq->ip1                   iphq+ip1->ipaz       ipaz->iphq+ip1we can't have any more IPSEC tunnel on brach01 so i'm trying to route the subnet ipaz presented by the tunnel between hq and azure to branch01 and vice versa.I think i'm missing something in between also i can't nat because we have video traffic that don't like nats. any ideas? THX a lot! 

Hi , I have read the new feature in 6.4 release note, for advpn and shortcup behind NAT.  UDP Hole Punching. But i have not look if this parameters is by defaut in 6.4 or if it' a parameter in fortigate? I don't have found this information in forum or cookbook.  Anyone have  some information for that? I try to use with advpn and OSPF routing. https://community.fortinet.com/t5/FortiGate/Technical-Tip-UDP-hole-punching-for-spokes-behind-NAT/ta-p/192762  Thanks,  

Hi Guys, I am using Fortigate 60D v6.0.12. recently I deployed the SD wan, in our network. When I see the performance SLA in GUI it shows more than %. it's totally wrong. Is anyone facing the same issue. please help me.       

Hi, Currently having some concerns as I'm adding a /22 on my policy. I have a working configuration for /24 and the new one cant push the internet connection even that policy setup is working before.

Here's a scenario, I have a branch fortigate using a base configuration which uses two ISPs for the virtual link. In this case we do not yet have the link for WAN2 (Waiting on the carrier to install) So in the SDwan we see WAN1 up and WAN2 down. When hitting an SLA on wan1, does the fortigate bring wan1 down until it it meets SLA? Even if WAN2 is hard down? Or is there some sort of safety built into this since WAN2 is hard

To check the 7.0.5 release in a test environment, I downloaded the imageFGT_VM64_KVM-v7.0.5-build0304-FORTINET.out.kvmand added it to GNS3. I've done this plenty of times. The image will run a couple of days in eval mode and I can then exec factoryreset to reset the eval timer. Works fine in a simulation environment like GNS3. However, I seem to have an issue, as the eval license is not working anymore.  Each time I spin up the image, I am greeted with the following after a few seconds :"*ATTENTION*: Admin sessions removed because license registration status changed to 'INVALID'" and, surely it shows:FortiGate-VM64-KVM # diag debug vm-print-licenseSerialNumber: FGVMEVX0OGFYAC9ACreateDate: Thu Feb 10 08:20:15 2022Evaluation license expires: Wed Dec 31 16:00:01 1969Model: EVAL (1)CPU: 1MEM: 2048VDOM license:permanent: 1subscription: 0  usually exec factoryreset or exec factoryreset2 would to the job.Or downloading a new copy of the image. But this time

In Log > Log Settings is... Logs older than 7 day(s) are deleted from the disk Can I extend it to 10 days? 15 days? A month?