Solved

Hi, is anyone has experience with XML API ?  I don't know why, but all my request are not able to execute because I have an error "<errorCode>11</errorCode><errorMsg>No permission for the resource</errorMsg>". This is what I done :1) create user with super_admin profile2) enable web service on interface3) download wsdl from fortimanager4) create a request as : URL : [link]https://fmgIP:8080/FortiManagerWSxml[/link]<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:r20="http://r200806.ws.fmg.fortinet.com/">   <soapenv:Header/>   <soapenv:Body>      <r20:addCliGlobalSystemAdminUser>            <!--Optional:-->  <servicePass>            <!--Optional:-->   <userID&g

Anyone out there running a large FGT, like 600E, in the Fortinet "Enterprise/Office Closet" topology with FSW 1000+ at the distribution layer (MDF), and 35 FSW's broken up between multiple IDF's and data center top-of-rack switches, all using Fortilink?  Trying to understand how practical is would be manage that number of switches entirely through FortiGate interface. Thanks!

Hello, I have 3 fortigates A, B and C.The fortigate B connects to the A and C fortigade with IPSEC vpn. In fortigate A I have internal network 10.0.10.0/24 In fortigate B I have internal network 10.0.20.0/24 In C fortigate I have internal network 10.0.30.0/24The network 10.0.20 accesses the networks 10.0.10 and 10.0.30, but I need to make the network 10.0.10 access the network 10.0.30, passing through the fortigate B. Making vpn between Fortigates A and C is not an option.How do I do this? TKS for all. 

Helloi have fortigate 80c and hp switch 1910.my network (internal 1 ) working with 172.26.30.254/255.255.255.0.now i created on hp switch vlan 100 with interface 172.26.0.1/255.255.0.0.how can i connect vlan 100 to my fortigate ?       

I'm having some routing issues with an MPLS circuit that terminates on an interface to my Fortinet. MPLS Fortinet Interface IP:10.200.66.1AT&T MPLS HSRP Router IP:10.200.67.2I've added a static route for 198.105.206.0/24 to HSRP 10.200.67.1.  I've created a security policy for my internal/trusted zone to MPLS to allow everything. I can't ping anything on the other end but the LAN. I don't maintain the AT&T Cisco router or any of the config.  I was told by the vendor to add their public blocks via static route and point to HSRP of the cisco router.  I'm at a loss here.Here is traceroute that shows it makes it to AT&T MPLS router but nowhere else:Tracing route to ts099.scl.five9.com [198.105.206.150] over a maximum of 30 hops:   1   1 ms   <1 ms   1 ms 10.200.32.1   2   <1 ms   2 ms   3 ms 192.168.53.1   3   <1 ms   <1 ms   <1 ms bedfordfortigate.daystartv.internal [10.200.106

Hi all, A weird one. I've added a URL in the web filter and DNS filter and set it to allow. However the URL still gets blocked. I've also added a web rating override to make it unrated and still no luck. I'm not sure if this is a bug (couldn't find evidence of one), or if I'm missing something. Web Page Blocked!You have tried to access a web page which is in violation of your internet usage policy.URL: ***** Category: Spam URLs User name: Group name: Any help is appreciated.

We run a Loadbalancer (SD-WAN) on our FGT that balances internet traffic. We also have several IPSec Tunnels. Those have to be connected to a specific wan interface and cannot use SD-WAN.I set the Loadbalancer volume based and it is set o not use all avaiable bandwith.Thus big downloads affect the performance on ipsec. Since I cannot use SD-WAN rules here - is there a way to priorize ipsec traffc before internet traffic?

Hello, I have a scenario where a Server A (IP x.x.x.x) on port 10 of FG 500D (5.2) is configured to send TCP and UDP traffic to Server B (IP y.y.y.y) on Port 11. Using static routes I am able to successfully test connectivity between Servers A and B (no static NAT for server B currently) I want (but not sure how) to achieve the following, - Intercept the incoming TCP / UDP stream from Server A- change (or NAT) the source IP x.x.x.x of Server A to an IP (y.y.y.a) in the same subnet as Server B- Manipulate the original packet destination address. I want the TCP stream to retain the destination as Server B (y.y.y.y) but send UDP traffic to a Server C (y.y.y.c) in the same network as Server B So at the end I would expect Server B to receive TCP traffic from source IP a.a.a.a and Server C to receive UDP traffic from source a.a.a.aI created an IP pool and applied a policy to perform the source NAT, and was able to see that the source IP is being change as t

Hi there.Anybody can help understanding how to use the global database for webfilter profiles?I want to have some sort of "repository" in the global database, where I store my different webfilter profiles. Then I'd like to be able to pick/use them in the policy packages in each individual ADOM.Is this possible? If so, how? Thanks,Flavio.

Is it possible to utilize two factor authentication (2FA) on the support.fortinet.com website? Or, is it possible to use 2FA on the Cloud Management pages. This would increase security?

Hello All, I use two FG 200 A and the menu system is missing ... My question is : It's possible my account is not with the privilege for this menu but it s good for administration ? Thank you in advance for your help. Zipe.

Hi,What is the logic behind of using server ip ( behind or beyond  the router ) 

Hello!I`m using Fortigate 60C with OS6.0 and got issue with SIP - I made everything from https://kb.fortinet.com/kb/documentLink.do?externalID=FD36405 but when I type set sip-helper disable (first of course i`m typing config system settings) it isn`t showing on system settings (show system settings), I got only:config system settings set v4-ecmp-mode weight-based set sip-nat-trace disable set default-voip-alg-mode kernel-helper-based set gui-(...) And I add set sip-helper disable plenty times but with no-show effect. Is this normal? How can I check if sip-helper is disabled or not? Thanks in advance  

Hi,How the packet size  impact throughput .Why do we require higher throughput when the packet size is small. How do we identify the packet size during the poc time ?which service will be using the smaller packet size ? Thanks

HiI was wandering how can i get raport about end-systems like smartphones/hosts etc. that were connected to my device last day/ last week/last montIn my Analyzer i can only generate report about "TOP" users TOP sites etc. but i need to know how many end-systems were use my FG to connect to the internet.I have about 500 fortigates to report about "how many end systems were using my FG to connect to the internet", my devices are like FG80C and FW80CM Can anybody help me?Regards Marek

Hello everybody Whenever I try to connect to VPN I get Error 104. So far I was not able to find out why this occurs. I have looked at the logs but still am unable to find a solution. Can you help me? I have tried to allow Forticlient in System -> Security & Privacy but it do not get a message to allow it there. Also I have tried different versions of the Forticlient which always returned the same error 104. Detailed Information:I am on macOS Mojave 10.14.5 with FortiClient VPN 6.2.0.614 fortiagent.log:20190611 11:26:13.093 [FctMiscAgent:INFO] AppDelegate:451 FctMiscAgent started up20190611 11:26:18.994 [FctMiscAgent:INFO] AppDelegate:415 Config File fctsysconf.plist changed, reload config!20190611 11:26:36.024 [FctMiscAgent:INFO] AppDelegate:415 Config File fctsysconf.plist changed, reload config!20190611 11:26:38.420 [FctMiscAgent:INFO] AppDelegate:415 Config File fctsysconf.plist changed, reload config!20190611 11:26:53.908 [fctgui:INFO] FCTVpnConnection:56

Hello everyone,I'm looking for a script to generate policy text file (CLI fromat) from CSV file. Thanks

Hi,On my FortiGate 100D I have Hardware Switch with just one physical interface attached to it and many virtual interfaces (VLANs) on that switch.I would like to change it to Aggregate port because I want to connect it to the switch stack where I can configure link aggregation group too.I discover there is no possibility to change interface type in gui. I realize I should delete all rules which using those virtual interfaces, delete virtual interfaces under hardware switch and then recreate everything under Aggregation interface. But what if I replaced "set type hard-switch" to "set type aggregate" of interface in the configuration file as well as delete "config system virtual-switch" entry and then I would restore this configuration? Is this possible? Or maybe it is possible to force change interface type via CLI?

Hi all, We are currently facing an issue with upgrading the firmware to a recent firmware. Currently, the Firewall is running FortiOS v5.4.10 build1220 (GA). Using the upgrade path tool, I need to do the following;VersionBuild Number5.4.1012205.6.916736.0.50268 So, as usual, I upload at the firmware then select FGT_60D-v5-build1673-FORTINET.out and then the firewall appeared to hang ('rebooting screen for 40+ minutes - excluding time to actually do the backup, firmware upload, etc). The firewall had to be manually restarted after 1+ hour of waiting for a response.  What can I do as its happening for 3 times now? Thank you.    

Hello, Our sister concern are deploying fortinet based vpn. It was found that users can connect to the vpn & access local resources.However, they are unable to access internet via our corporate proxy.  Split tunnel is not enabled & client version is 5.6.  appreciate all inputs.

Hello,i have a lot of clashany suggestion FGT500D $ diagnose sys session statmisc info: session_count=15502 setup_rate=246 exp_count=626 clash=17417memory_tension_drop=0 ephemeral=0/589824 removeable=0npu_session_count=3414nturbo_session_count=480delete=83073, flush=1, dev_down=0/0 ses_flush_filters=0flush_work_num=0TCP sessions:538 in NONE state4437 in ESTABLISHED state44 in SYN_SENT state4 in SYN_RECV state3 in FIN_WAIT state534 in TIME_WAIT state423 in CLOSE state72 in CLOSE_WAIT statefirewall error stat:error1=00000000error2=00000000error3=00000000error4=00000000tt=00000000cont=1ef546cdids_recv=30d613e7url_recv=00000000av_recv=8b78184bfqdn_count=00000039global: ses_limit=0 ses6_limit=0 rt_limit=0 rt6_limit=0

In the past 2-3 years many of my Fortigate devices have lost features due to the removal of internal storage. WAN Acceleration, web cache, logging.. From 90D, 60D, 94D and so on. Many new units also don't come with internal storage 50E. Fortinet, please consider allowing at least logging to a user provided USB device. We could use a USB flash drive or external HD. I understand maybe all 500GB on that HD may not be accessable for logging on say a 30D but something reasonable the device could support would be great!-It costs Fortinet nothing, and could save Fortinet money.-Assists in troubleshooting problems with TAC.-Reduces RMA on devices as only user replaceable USB flash is being used, not affecting internal storage with read/write cycles. -Build loyalty with users like myself by restoring features the unit was sold with.Users please speak with your sales rep and maybe comment in this post if you'd like to see this feature added.

Hi,In setting up a  fortinet based multifactor setup, fortigate firewall is used along with Active directory.Now, to enable the second factor (token) what configuration is required on fortigate considering that an AD is being used. We have tried looking at documents available online, but all of them indicate two factor with local username password & none with an AD being used.Please help  with some links or help regarding configuraing this for second factor (token) authentication with AD radius.  

Many Bugfixes but no TLS 1.3 mentioned. https://docs.fortinet.com.../fortios-release-notes

Hi Everyone,  We have a SSL VPN for our corporate users on a Fortigate 5001V (daily average users 10-15).  Everyone internet speed slows down as soon as they connect to vpn.  Below are some examples of speed test without and with vpn.  Please let me know if this is normal expected behavior slow down or if there is something that we can do to improve the situation.  I can also provide tracert if need be.  We do have a manage network so I do not full cli access to the blade, but I can pass any recommendation to our manage provider company: The issue is more significant and a pain point when users map a server shared folder and they try to save or dowload the file.  The VPN blade is in the west coast and most share folders are also in the west coast.  I do expect some slowness while updating huge excel files in the NY shares drive folders.  Our typical time from vpn or from mpls is always consistent at 75ms from LA to NY (while on vpn