Solved

I am using the free version with FortiGateCloud.The free version can save logs for 7 days.Please tell me how to extract the memory conserve mode log from the system log for 7 days.-In FortiCloud, it was not possible to filter by message.-When I downloaded and checked the log (.gz), there was a period when there was no record.Download on 2/22 → Logs can only be downloaded from 2/10 to 2/18Thank you.

Hi,I would need to include only F5 signatures in an IPS policy.Of course, I know that they can be added individually, only then if new ones come out they won't be added automatically or am I wrong?Is there a simple and effective way to include only F5 signatures and all new ones in case they come out?Thank you

Hi!I want to sort the column "last used" in "Authentication -> User Management -> FortiTokens" but it does not work.I can sort "Token Type" and "Status" for example, but not "last used"Also exporting the list does not seem to be possible.(I tried in Chrome and Firefox) Am I doing something wrong or is it a bug?  

Hi, What are the benefits of having Fortimanager to act as Fortiguard server for all the Fortigates which are in SDWAN fabric? . Fortimanager will be one of the DC LAN IP which has reachablity to all the branch Fortigate over SDWAN Fabric. My observation1 This will ensure that all database updates will happen locally within the fabric from Fortimanager to all Fortigates.2 Not each fortigate needed internet connectivity..3 Just ensure Fortimanager alone can speak with Fortiguard to get all the signature, database updates. Once this is done, it can push to rest of the device4 It can also avoid impact to Webfiltering/Email filtering service, since any high latency from Fortigate to Fortigaurd webfilter service can cause "A rating error occured" These are my observations, whether I am correct or any other benefits I have missed. Or anyother caveats in this setup.

Hello, I'm using FortiClient (7.0.2.0069) on macOS Monterey and I'm having a problem connecting to SSL VPN. Sometimes it connects, however, most of the time it does not, and when it doesn't the output says that I'm connected but "Bytes Received" does not move from 0.13 KB and "Bytes Sent" does not move from 0.5KB.  I've talked to our company's tech team as well as others, but we can't seem to find the problem. Does anyone know what could be wrong or have had similar experiences? Thank you for your time!  FortiClient  

Hi, I have a scenario..I have sdwan rule with source as 10.50.10.0/24 , destination as 10.90.10.0/24. Source is Spoke1 network. Destination is spoke2 network.. These networks interfaces are configured as vlan interface in the respective Fortigate devices. When I check the session for the source user PC (Took an ip as 10.50.10.11), it was hitting in the correct Service ID (Service ID 10) and end to end ping is happening.. But when I check the ping session with source as firewall Vlan interface (10.50.10.1) then I could see this session is through SDWAN default rule (SDWAN service 0). Since my vlan interface also falls under 10.50.10.0/24 my ping from vlan interface to other spoke IP should go through service ID 10 only but not sure why it is hitting default SDWAN rule (Service ID - 0). IS this an expected behaviour or I should raise a TAC case for this issue?? 

hi, I am trying to remove a local certificate and get an error message. Apparently the FortiGate believes it is in use, but there is no reference to this certificate as you can see by the zero in the last column.  This is a Staging certifcate from Let's encrypt and i need to replace it with a non-staging one. Can anyone help? FortiGate  

Hi,  Whether anybody has tried VM snapshot of Fortimanager (Without HA). If this is possible, once we restore the snapshot whether all the configuration, settings, logs of Fortimanager will be intact?. Since Fortimanager is a single platform which holds all the configurations of Fortigate, so would like to understand whether VM snapshot backup is enough to restore all fortigate configs, logs etc..

Since the last update to Android 12 I can connect to our company with Forticlient VPN app but only have access to servers IPs no server name, it looks like there is no routing thru VPN DNS. But more unusual, I am able to access domain names out of the organization, like google.com. I followed google instructions for Android 12 known issues with VPN, clear cache and data, uninstall and reinstall, networking settings to factory reset, but no luck. 

Hello, I'm trying to follow the admin guides on installing fortiEMS server while installing SQL remotely (we have a fully licensed SQL server). The instructions are very vague at best.  Does anybody have a good "step-by-step" instructions on how to install fcems on a remote sql server?

Hello to all . can someone please explain or point to relevent data about this interface and its uses   thank you very much .

Hello friends, does anybody know how to solve the problem of certificate-warning when using a self-signed server-certificate for the ssl-vpn on the Fortigate-firewall? I use the FortiClient to establish a vpn-connection to the FortiGate-firewall. I already added/imported the (self-signed) ca-certificate of the FortiGate-firewall to the trused root authorities on my pc, but this didn't solve the problem. I recognized that the server-certificate was issued for the wrong hostname. The server-certificate was not issued for the hostname to which I connect when I establish the vpn-connection with FortiClient. Could this be the reason for the certificate-warning? Can I issue a new self-signed ssl-certificate on the FortiGate-firewall to use it as the server-certificate (for the ssl-vpn)?

Hello Expert, The monitor section is not visible on my fortigate.I am trying to monitor my ipsec traffic do not see the Monitor options. Regards 

in my setup the firewall outside interface uses a private ip as my isp router forwards my public ips toward my private outside interface and my existing firewall is cisco asa and it have nat rule where it does port forwarding natting using the outside interface which is a private ip "192.168.10.2". I need to move this port forwarding rule to my new fortigate which will replace my asa. so in order to do this should I put in "external ip " my private outside interface ip and in the "mapped ip" I will put my internal server ip? 

Hi all        I have to install FortiClient 6.4 on ubuntu server 18.0 for remote access vpn but it's not working. Please see log information below. Please advice. ------------ Create VPN Profile ERROR"Failed to save client certificate password. Cannot autolaunch D-Bus without X11 $DISPLAY"-------------------------------------- administrator@forticlient01:~$ /opt/forticlient/fortivpn edit CTH-VPN-SSL ===================== Create new VPN profile: CTH-VPN-SSL ===================== Remote Gateway: XXX.XXX.XXX.XXX Port [default=443]: 10443 Authentication (1.prompt / 2.save / 3.disable) [default=1]: 2 Username: username Client Certificate (.p12 file URL) [default=None]: Do not Warn Invalid Server Certificate (y/n) [default=n]: y Failed to save client certificate password. Cannot autolaunch D-Bus without X11 $DISPLAY DONE. administrator@forticlient01:~$ ------------------ Check SSLVPN profile-------------------------------- administrator@forticlient01:~$ /opt/forticli

Hello Folk, We have a Fortigate with the following data.##FortiOS V6.2.10 build 1263 G##Fortigate 100 Since we upgraded to the latest Fimware we have a continuous micro cuts are connected approx. 30 users thought it was something internal but it is discarded because we rebooted and corrected errors in the switch and network ports. Also to test we ping the public router and it does not lose packets. But if I do it to the IP of an internal computer I always have the loss of 3 packets. I do not know if this is a bug, could you advise me how I can follow up and go discarding points. Regards

Hello, After upgrading from 5.4.5 to 5.6.3, the DNS service on a loopback interface is not working anymore. The traffic is arriving on the VDOM and the debug flow shows the traffic is accepted and sent to the loopback. However the DNS service itself does not reply. A wireshark shows exactly the same behavior, the packet is incoming on the VDOM, but there's no reply back. DNSproxy debugging shows: udp_receive_request()-2065: vd=8, intf=39, len=32, alen=16, 10.1.0.47:42857=>172.16.10.13 handle_dns_request()-1395: id:0xabb5 pktlen=32, qr=0 req_type=3 get_intf_policy()-876: ifindex=39 A config compare between 5.4.5 and 5.6.3 shows no modified configuration whatsoever related to DNS or the loopback interface. Running the DNS service on a physical interface does seems to be working. Has anyone by chance run into this before? It seems like a bug or behavior change.

HI there, Im trying to configure a local in policy to allow a VOIP provider's ROBOT to be able to ping the Wan interface to report that the internet is up at any given stage. I can do this but I want to limit the response to specific hosts Public IP addresses. So I have a VLAN (10) configured as my PPP wan connection bound to the physical port wan1. My VLAN interface is called WAN-UFB with an appropriate alias. I have enabled ping on this interface and ZI can ping in from outside no problem.Now I want to limit the hosts that can ping so I'm trying to create a couple of local-in-policy's bit I cant get past the set intf as follows:config firewall local-in-policy edit 1 set intf "WAN-UFB" set srcaddr "xxx.xxx.xxx.xxx" set dstaddr "all" set service "PING" set schedule "always" next endWhen I get to intf, i get the error :  " node_check_object fail! for intf Attribute 'intf' MUST be set. Comma

I have a firewall with a wrong command in the config, I am exploring whether I can correct it without rebooting the firewall.  The following syntax is in the Fortigate firewall. However, the command "set associated-interface "Terminal10" in red is wrong, it should not be there. Can the wrong command be removed by CLI without restoring the firewall config file? Restoration will cause disruption to the firewall operation as there will be rebooting. Appreciate your advice. Thanks. edit "Terminal_192.168.1.1"        set associated-interface "Terminal10"        set comment "Terminal_192.168.1.1"        set subnet 192.168.1.1 255.255.255.255    next After the removal, it becomes as follows:edit "Terminal_192.0.132.1"        set comment "Terminal_192.168.1.1"        set subnet 192.168.1.1 255.255.255.255    next

I am trying to figure out how to deploy traffic shaping for the below situation. I am receiving conflicting information, so I thought I would reach out to the group to see if anyone could provide some guidance. I have 5 separate subnets in which I need to apply traffic shaping to. Each subnet shares a 300 down and 30 up internet connection. Each subnet should have a minimum of 60 down and 6 up; however, if bandwidth is available, each subnet should be allowed to burst to 300 down and 30 up.In conversations with support, it was recommended I create 5 separate "shared shaping" policies for each subnet. However, after researching this further and based on my understanding of the way policies are applied, each policy operates independently, so each policy would think it could burst to 300 as it is not aware of the other policies. In other conversations with support, it was recommended I create a single "shared shaping" policy. Based on my understanding, this approach would n

We have a 524D switch, and using a 40GB breakout cable to 10GB. The FortiSwitches are managed through the Fortigate. We then have a transceiver to be plugged in to an HPE Gen 10 Server. The documentation mentions the following: "Auto-speed detection is supported on 1/10G ports, but not on higher speed ports (such as 40G)". What does this mean for the 4 x 10GB speed ports? Can they be set to Auto 10GB? The port speed on the present Cisco transceivers in the HPE Gen 10 servers are already set to 10GB auto. Also I am not understanding what the speed setting called Auto-Module is used for? We are running version 6.4 version of firmware. And one more question regarding MTUs. If we look at the settings on the switch this is what we see. " The VLANS are set to an MTU of 1500, but the ports themselves are set to 9198". This is confusing. Does one. overide the other?  Thank you

I found the bid in the FortiOS log field.I'm not sure what this field means.who can tell me? The log format documentation doesn't even mention the bid field.

I' m using FortiClient for VPN purposes only and dont need it running any other time. I cant get disable fortinet from starting on startup. Its getting very frustrating. I' ve followed this guide; http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD31776   But when I go to step 2 and try to uncheck FortiClient Service Scheduler and click Apply, it automatically re-ticks itself. Anyone had this problem or know how to solve it? We use Forticlient for corporate vpn and I' m having second thoughts now.

I have a version of the Fortigate 600D-LENC device, that is, without access to Fortinet cloud services and without access to FortiManager and FortiAnalyzer. Is there a possibility on FortiOS Firmware v5.4.1 build 3753 configure automatic backup actions and security policy changes?

Hello Guys,i have a strange question:i have two IPSEC tunnels as below:branch 01 ----- HQ ------ azureip1 -> iphq    iphq->ip1                   iphq+ip1->ipaz       ipaz->iphq+ip1we can't have any more IPSEC tunnel on brach01 so i'm trying to route the subnet ipaz presented by the tunnel between hq and azure to branch01 and vice versa.I think i'm missing something in between also i can't nat because we have video traffic that don't like nats. any ideas? THX a lot!