Solved

Hello All, I have strange issue with with Fortigate 40F using 7.0.3 (lastest version), the same was for 7.0.2.I have dual stack network on my home. Using IPv6 and IPv4 in paraller.Most of the Firewall rules are exact the same for two protocol versions. But funny thing is, whatever I'll change on my Fortigate, even description of the rule (even for IPv4), IPv6  traffic is freezing for 5-10sec and back to normal. The issue is even between LAN interfaces (on trunk, one VLAN to second VLAN).So we can skip WAN issues there. I have no clue how to document it (I have valid support), I can only record video when host using IPv6 are freezing, getting lags (IO timeout) when using NFS/iSCSI over IPv6. This situation as mentioned is for 5-10 and then back to normal without any action from my side. I wondering maybe this is related to ASIC offloading for IPv6, that there is a bug/issue with that? The IPv4 protocol is working fine, only IPv6 got freezee. It's hard

Hello, I am having some problems configuring IPv6 on FortiGate.My ISP provides me a /48 but wants me to use a static IP on a transport network (/126) on WAN, where my router is ::2 and their router is ::1. Can someone help me on this? I tried setting the ::2/126 on WAN interface, creating a static route to ::/0 from ::1 and manually setting a  /64 subnet on a interface but the interface is not pingable and I can't ping outsite from this interface aswell.

I would like to setup FortiAuthenticator and Fortigate to provide McDonald like WIFI access, when you connect, it pop up a disclaim page, and once user clicked "I accept", it grant the user access directly. Is this doable ? I have tried to use Portal policy with MAC authentication ( but doesn't really restrict any MAC ), it looks like FortiAuthenticator does send Access-Accept  to Fortigate, but there is no Fortinet-Group-Name radius attributes.  If I don't enable "Account registration" in Guest portal, there are new "social login users" created, but they can't be automatically added into a user group. Tried MAC group with device tracking enabled on guest portal, also no luck ( turn on device tracking doesn't add new social login user's MAC into the chosen MAC group. ).     

There is a way to upload a script via GUI: That script ends up here:  Is it possible to execute that script via the CLI?  ThanksDan

Would appreciate a response from Fortinet regarding the Apache log4 vulnerability if any Fortinet productis affected. Any information regarding updated IPS signature for CVE-2021-44228?

We have a Raspberry PI at one of our locations that I think is having an issue with VLANS and our Fortigate, I am not totally sure about this just suspecting.Here is the setupCampus 1 has a Fortigate 400E, switches are Extreme x440 with VLANS in place, the Fortigate does all the routing between VLANs and other campuses. The Raspberry Pi is on a VLAN that has rights to all other VLANS and campuses. The Raspberry Pi is located at Campus 1.Campus 2 has a Fortigate 600CSo here is what I have discovered thus far.If I connect the Raspberry Pi directly to the FortiGate 400E I can ping the FortiGate at Campus 2.If I connect the Raspberry Pi to a switch and put it on the correct VLAN I can ping the Fortigate 400E at campus 1 but I can not ping the Fortigate 600C at campus 2.We have gone through the steps to make the Raspberry Pi VLAN aware.Does anyone have any ideas about what might be causing this?

Hey guys, I was wondering and apologies if this sounds like a silly question, but, does forticonverter works in trial mode without a license? I was trying to see if I can convert Check Point config over to Fortinet, but it simply says "tunning" for last 3 hours and no progress. Any ideas? I attached a screenshot of it as well.

If someone is managing multiple FortiGates via the free version of FortiCloud, is it possible to verify that the IP signatures are up to date, to ensure that the log4j signature can be detected and blocked? Thank you!

When I want to view logs from Interface->internal they do not show up, from other subnets they show up normal

HiI've just update firmware from 6.0.14 to 6.2.0 and I found that 10 free VPN license on previous release is deleted.Now, if I need to enable 10 VPN SSL connection on new release, what do I do? What is EMS? ThanksMarco 

Hi Everyone,I'm facing an issue where on my FortiGate 100F (v6.2.3 build6188 (GA)) unable to create Virtual Server IP due to there is no Virtual Server tab under the Policy & Objects. I have multiple of servers and trying to create Virtual IP for those servers and load balance it. Anyone have idea what might be the cause of this ? 

On Fortigate firewall do we need to take any actions against LOG4J ?

Hello, We recently set up a Fortigate 6.2.5 device and set up IPsec VPN for external access for our co-workers. Now, I would like to block all incoming external traffic (or at least restrict ports and so on), but I could not figure out what interface should I add the rules to. I have tried adding some restrictions to WAN1 (incoming interface) > Internal (outgoing interface) but it does not seem to work, blocking rules are ignored, and no traffic goes through in the new rules. In our previous router (from a different brand), I could simply apply a rule to the WAN1 interface, and that's all. What incoming/outgoing interface should be set to restrict the incoming external traffic? Thank you for any help!

Hi,Im running 600e appliance in my main branch.All branches connected with MPLS and doing NAT to the internet from the main branch.Last week I configured BGP with my ISP and advertised all the local subnets in my MPLS topology, and so far everything works fine. The ISP just installed a secondary backup link for the BGP and another pair of IP addresses (customer IP, and ISP neighbour IP for me to set) I'd like to know how should I configure the backup BGP link, I want to make sure the Fortigate uses only the primary link when they are both available.I'm supposed I have to change costs or something ? Very much appreciate,Thanks.

Hi, we have deployed a Fortigate cluster on AWS cloud, mostly used as a VPN/NAT-Gateway. Now as you usually have no network layer 2 on AWS, there is no ip/mac failover. As the cluster members are deployed in multiple subnets/availability zones, the interface config on each cluster member is unique, with different ip addresses and subnets. Failover is done by Fortigate using the AWS api and modifying route tables and elastic/public ip assignment. So far so good. As a consequence of the above, you have to exclude some configuration items from the configuration sync with the ha peer, namely the interface config and router static config (by default also vip configuration is excluded). As we will do definitely DNAT in our VPNs, I have removed the exclusion of the vip already. But interface config and static routes must kept excluded. Now to the issue with this: For each VPN you have to configure some static routes pointing to the tunnel interface. But now with stati

I have a pair of 200e that I'd like to get into an HA pair. My issue is that I will not be able to cable the passive one the same as the primary for a few months because reasons. I want to link them via the HA port so that the primary unit automatically sends the config to the 2nd and in case of complete hardware failure, anyone on the team can just move the cables over and the unit is ready to go. Is this possible?  Is there another solution to have the configs mirrored to each other?   

Hello, the following feed is discontinued.Anyone can help me? thank you   

Dear community My question is:Does a VRRP-IP (the "gateway") generally answer to ping/icmp requests (or not)? We have four fortigates in two datacenters (in each datacenter is an active/passive cluster). On each of those clusters are the same vlans configured and we spanned vrrp over these vlans.The goal is, that everything does to one datacenter, until both fortigates in that datacenter (or the whole datacenters) goes down...and then the vrrp-ip should go to the second cluster in the other datacenter.The ip addresses of the fortigate clusters temselves in those vlans are answering to ping/icmp as expected (because it is configured accordingly). However, the customer claims that the vrrp ip in the vlan is not responding to IP.We still are investigating, but I just want to ask whether the vrrp ip in general is supposed to answer to pings or not (to make sure we are not chasing ghosts here :)). Thanks for your helpscheuri FortiGate 

Hello, I don't understand  when to set or unset the NAT button. I have two servers on my LAN that are reachable on the same WAN with port mapping from WAN adress IP: port_to_translate to  LAN IP: port_translated.On the first server I have a SSH server without the NAT button set on the Policy  and it works.I can access the server from WAN.On the second server I have a web server ( node.js) but I have to  have the NAT switch set on.If the switch is off , I can't access the server web. In which case in port translate I need to turn the switch on or off in the policy?Thank you. Félix 34           

Hi Teams, Is there a way to show ip address on spoke tunnel interface when enable "mode-cfg" on hub and spoke site?  The Spoke has assigned a ip address from hub but no command to show.

Hi everyone!I have FG300 and FMG version 6.2.7Such a problem has recently emerged:I change the interface settings on the device, in particular, add networks to the exceptions on the captive portal. Apply this.      config user security-exempt-list     edit "DMZ-exempt-list"     config rule     edit 1     set srcaddr "DMZ Subnet" "gatchina" "IPsec subnet" "main" "medical equipment" "mgmt" "phone" "printers" "Remote access" "servers" "other devices network"     next     endEverything passes correctly. Next, I change any policy (only policy, not device settings) I apply changes and eventually get that the interface settings are returned to their original position!config user security-exempt-list2: edit "DMZ-exempt-list"3: config rule4: edit 15: set srcaddr "DMZ Subnet" "gatchina" "IPsec subnet" "main" "medical equipment" "mgmt" "phone" "printers" "Remote access" "servers"6: next7:

I am trying to upgrade my Forti Analyzer 200D appliance box firmware from 6.0.11 but i cannot seems to find the firmware from fortinet support download site ?does it means the  Analyzer 200D is EOL ? 

I have the following setup: FortiGate > FortiSwitch > FortiAP. So far I have been managing FortiAP through FortiCloud just fine. I now want to transition to managing it from the FortiGate. First of all, will the FortiSwitch that is in-between create any problems? But most importantly, when I add the FortiAP to the FortiGate, will the settings (SSIDs etc.) of the FortiAP stay? Or will the FortiGate enforce some default AP Profile, potentially removing the configuration of the FortiAP?  Thanks a lot in advance!

Hi, I'm running a FortiManager in v7.0.2, we have preconfigured "Firmware Templates" to centrally schedule Firmware Upgrades on the managed devices. Now that the new FortiOS 6.4.8 has been released, we would like to upgrade to this version.Unfortunately, I have no way to select this FortiGuard image in my corresponding firmware template.My databases on the Manager look current. Do you have any tip for me? Thanks!

I'm new to Fortinet/Fortigate and am using a 40F as a lab learning device. I have just a few configs that is causing the push install to fail. All it is :config system interface2: delete "lan3"3: delete "lan2"4: delete "lan1"5:endAll three error out with message: "The entry is used by other 1 entries.  Command fail. Return code -23" So how do I undo these commands?  I can't figure it out.