Solved

Hello, I have 2 FortiGate VMs that I want to configure HA in Active-passive mode. I immediately lost GUI access when I applied the HA configuration to the first VM. The same thing happened to the second FortiGate VM.For context, both VMs are deployed on vSphere and are connected to the same port group.Does anyone know why this happens and how I can resolve this problem?

Hello Fortinet Community,  We have configured an Incident Notification in FortiSIEM to send email alerts when incidents occur. • Test emails (via the “Send Test Email” option) work correctly and are being received. • However, when a real incident is triggered, no email is received. • Email server settings are valid, as test emails are successfully sent.  The issue appears to be specific to incident-triggered email alerts. We kindly request your assistance in identifying and resolving this issue.  Best Regards, İsmail Ürek FortiSIEM 

Hi,We have FortiMail and trying restrict outgoing email to a few addresses only in an external domain, let's say to user1@abc.com and user2@abc.com  and block off everything else to that domain. I have created 2 Recipient Policy with Recipient Pattern, first policy with all the email addresses, and then second policy with wildcard *@abc.com, then enabled Content profile and set max size to 10 and also 102400, Action to Reject.I can see the second policy is able to catch non whitelisted address as expected, but still accept and send those emails and not reject them. Any idea why or better method to implement this?   

Hi, Syslog functionality was operating correctly when a single VDOM was in use. However, after enabling multi-VDOM, the syslog configuration now appears exclusively in the Global VDOM mode, making it applicable only to the Global VDOM. In the root VDOM, where all policies, VPN tunnels, and other configurations are present, it is not possible to configure syslog. Attempts to use the "config log syslogd settings" command in the root VDOM were unsuccessful, as the term "syslogd" is not recognized. We are currently running version 7.4.7v. To forward logs, each VDOM needs to have its own separate syslog configuration.

How can I use [FortiClient VPN-Only] in an offline environment? I would like to perform IPsec remote access testing in a closed testing environment, but FortiClient VPN-Only is not functioning correctly offline. When I click "Connect," nothing happens, and it returns to the screen before entering the password.No packets are reaching the FortiGate side, and when I perform a packet capture on the client, no packets are being generated.In the testing environment, I am using an L3 switch as a pseudo-internet environment, and there is a Ping response between the client and the FortiGate. The client’s default gateway is the IP address of the FortiGate’s listening port. Even when I connect the client directly to the FortiGate’s listening port without using the pseudo-internet environment, the issue persists. Is it not possible to use FortiClient VPN-Only in a completely offline environment? Environment in use:FortiGate 60F Version 7.4.5 build 2702Windows 11 FortiClient VPN-Only

Hello, Email-based two-factor authentication has been successfully enabled for users, including SSL VPN users, who are now receiving OTPs via email without any issues. The OTP emails are currently being sent from the email address "DoNotReply@fortinet-notifications.com." Is it possible to modify the sender's email address to align with our domain (e.g., example@test.com)?

Good day Team, Fortimail v7.4.1 I have a few entries (full email addresses) under IP Policy -> Inbound Session -> Lists -> Sender Blocklist checkingand indeed, it works, no more mails from those senders.  However, I am getting quite a few from same domain, how can someone in Fortimail block only the @domain.com portion of email addresses. Please show me the definite steps to complete this procedure. So far my Fortimail is working well, just a few domains I want to keep under control. Regards,

I am following this doc.https://docs.fortinet.com/document/fortinac-f/7.2.0/kvm-deployment-guide/31945 ./deploy_kvm <domain_name> 1- what is meant by "domain name" in this case?2 - Didn't know what that was so I just used "nac". After running the script, I got the following errors and cannot proceed../deploy_kvm: line 164: virsh: command not found./deploy_kvm: line 165: sudo: command not found Any ideas ?

HelloThe following doc shows that FortiLink is supported is this topology:FortiGate <---> FortiSwitch <---> 3rd party L2 switch <---> FortiSwitchhttps://docs.fortinet.com/document/fortiswitch/7.0.8/devices-managed-by-fortios/801183 My question is more simple: is FortiLink supported in the following case?FortiGate <---> 3rd party L2 switch <---> FortiSwitch

I need to delete ima Interface, but I can't figure out how to do it? I want to remove it and put it in SEM_USO 

When I do the Fortigate ssl-vpn test, client failed to get gateway, but traffic flow is normalIs it okay if it's like this?IPv4 Add : 192.168.1.1Subnet : 255.255.255.255Default gateway : 

I have 2 Fortigate 201F set up with a tunnel and I'm seeing some strange traffic (mostly missing) from site A to site B.  Site A has 2 active WAN interfaces with the 2nd interface static DF route at a higher priority. My tunnel is assigned to the interface with the lower routing priority.  I'm not able to ping devices on Site B, yet I'm able to access the internal web interface of the Fortigate of Site B.Site B only has one WAN interface and I'm able to ping from devices within Site B to devices on Site A, but I'm not able to connect to NTP, DNS or LDAP from the Fortigate B to Site A.Both tunnels were created as custom pointing to the IP address of the outside interface of the opposite.  I have phase 2 selectors set for each of the VLANs from Site A and all show active.  Both sites are set with incoming/outgoing policies using the named tunnel and allowing ALL traffic and stated VLANs.Both sites have static routes set to use the tunnel interface for traffic.&nb

Hello team kindly helpi am configuring site-to-site IPSEC on fortimanager to push on fortigate but the i am confused where to confgure the IPsec?i have tried to my best on all platform1. on VPN Manager2. on IPsec Template3. on the device phase1 and phase 2 but after creating the vpn on all the 3 i can not see the VPN as the interface so that i can use on policy?PLASE HELP

Hello Community I am attempting to use the FortiOS API to apply a license. The device is a FortiWifi 80F with Firmware 7.2.6.I am attempting to apply the Advanced Malware Protection Free Trial, for testing purposes.From help with the Fortinet Developer Network I have seen this command:  curl -X 'POST' \ 'https://192.168.20.1/api/v2/monitor/registration/forticare/add-license?access_token=xp40rkkhqcbfyr8Nq96H9G7H43q0f4' \ -H 'accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "registration_code": "STRING" }'  I am not sure what the registration_code value should be. I visited support.fortinet.com to gather the license key I wish to apply. It downloads as a .lic file. There is text in there but nothing matches the registration code. I have tried to insert the contract number as the string but this did not work.Where can I find the registration code?Am I using the wrong endpoint?Appreciate it

Hello FortiSIEM Community,I hope this message finds you well. I am planning to upgrade my FortiSIEMinstance from version 6.7.1 and would appreciate any guidance on the recommended upgrade path to the latest stable versionSpecifically, I am looking for:Recommended Upgrade Path: The sequence of versions to upgrade through from 6.7.1 to the latest recommended version.I have reviewed the available upgrade guides but could not find specific recommendations for upgrading from version 6.7.1. Any insights or experiences shared would be greatly appreciated. Thank you in advance for your assistance and support. Your expertise and experiences are invaluable to me.

I am currently preparing for the Fortinet Certified Professional (FCP) certification in Network Security. As part of my hands-on learning and practical lab setup, I have successfully installed the FortiGate VM on my local environment.However i am finding it hard to access the GUI of the FortiGate VM due to absence of a trial license.i have tried this commands execute vm-license-options account-id xxxx@fortinet.comexecute vm-license-options account-password xxxxxxxexecute vm-licenseIt showed the error "Requesting Forticare Trial license, proxy:(null)failed to download VM license"I would like to kindly request help in acquiring trial license for the FortiGate VM. This is meant exclusively for my study and practice and learning experience. Community help will be very much appreciated :'(

Hello,I am starting to learn with FortiManager and when initially importing an existing FortiGate I get the following error: Retriving configuration file from FGT... Configuration file import succeeded. Reloading configuration file... Error: Configuration reload error. --------------------------------- Failure info: SELECT "##oid" FROM objcfg_fw_sched_onetime WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_group SELECT "##oid" FROM objcfg_fw_sched_group WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_onetime SELECT "##oid" FROM objcfg_fw_sched_onetime WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_group SELECT "##oid" FROM objcfg_fw_sched_group WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_onetime SELECT "##oid" FROM objcfg_fw_sched_onetime WHERE "##parent"=3 AND ("name"=? OR "name"=?); >command(set firewall local-in-policy.1:intf SD-WAN-Inet) detail(datasr

Hi Fortinet Community, We're facing an issue where traffic shaping on our FortiGate device doesn't seem to be working as expected. Despite setting up the necessary configurations, no traffic appears to be shaped — the system always shows current-bandwidth=0(kbps) when monitoring shaping statistics. What We’ve Verified So Far:1. Class IDs are configured correctly.2. Traffic Shaping Profile is set up and active.3. Relevant Traffic Shaping Policy is in place.4. Interface outbound bandwidth is configured.5. Traffic Shaping Profile is applied to the correct interface.6. Ran "diagnose netlink interface list" command No matter what we try, shaping stats show zero usage:  Any help or insights would be greatly appreciated.Thanks in advance!

Hello. We are currently using FortiSwitches with FortiLink.In version 7.2.x, I understand that changing the FortiSwitch name does not affect active sessions. Recently, we upgraded all our devices (gate, switch, AP) to 7.4.x.We have about 20 switches in use.However, when we change a switch name from the gate, it appears that some other switches temporarily disconnect and reconnect. It also seems that active sessions are interrupted.Based on my research, it seems that when a managed switch is renamed, it is deauthorized and then rejoined, which causes all sessions to be dropped. As the switch reconnects, STP path recalculation occurs, so session drops or other switches disconnecting may be observed. Is this understanding correct?I referred to the following URI for this information:community.fortinet.com/t5/FortiGate/Technical-Tip-Unable-to-change-managed-FortiSwitch-name-after/ta-p/280009docs.fortinet.com/document/fortiswitch/7.4.0/fortilink-guide/59264/defining-names-for-managed-switche

Is it possible to configure a time-based administrator user access in FortiGate?For example: an administrative user must be able to login the firewall device from 9 am to 11 am. Beyond 11 am, the login access should be disabled 

Hello community, I am new to FortiSIEM, I want to build a rule to detect new devices in my network, I had the idea to create like a list containing MAC addresses and a rule to check each time if a mac is in that list if not it will trigger an incident and add the mac address to the list (if you are familiar with qradar it is like a reference set), the problem is I don't know if that is applicable also in FortiSIEM or there is another approach to solve the problem??? any idea is appreciated, thank you in advance.

Greetings community!We are now receiving events from the Kaspersky cloud in FortiSIEM, where the format is a "System Log", and it has the following structure, for example:<14>1 2025-04-15T12:50:06.047Z | - TEST_SIEM_CONNECTION [event@23668 et="TEST_SIEM_CONNECTION" etdn="Test Siem Connection"]<14>1 2025-04-15T01:34:49.000Z xxx_hostedinst_xxxxx.openstacklocal 1093|1.0.0.0 - KLAUD_EV_SERVERCONNECT [event@23668 p2="x.x.x.x" p3="2x\\xx" p5="x.x.x.x" p9="::1" et="KLAUD_EV_SERVERCONNECT" etdn="Audit (connection to the Administration Server)" hdn="<xxxx>" hip="x.x.x.x" gn="Managed devices" kscfqdn="xxx.openstacklocal"] User "2xxx" has connected to the Administration Server from "x.x.x.x".As a result, the events are arriving as "Unknow_events", precisely because there is no parser for this type of log. I created a new parser file at this first moment just to test the simplest events, for example: <14>1 2025-04-15T12:50:06.047Z | - TEST_SIEM_CONNECTION [event@23668 et="T

Dear Team,I have a question regarding the use of the Per-IP Shaper feature in traffic shaping on the FortiGate firewall.I configured a traffic shaper with a total shared bandwidth of 20 Mbps (Reverse enabled) for 10 users.Additionally, I applied a Per-IP shaper limit of 4 Mbps.My inquiry is:Does this configuration mean that all 10 users combined can consume up to 40 Mbps (i.e., 4 Mbps per user), or will the total bandwidth still be limited to 20 Mbps regardless of the Per-IP shaper setting?Looking forward to your clarification.

How can I set up an SSL VPN connection on an FGT60F v7.6.2.F? Unfortunately, I can't find this option in this FortiOS version.

Hi Everyone, We just bought a FortiSwitch 448E and when I tried to connect a LAN cable from my laptop to the FortiSwitch's MGNT port, it's giving my LAN port an IP of 169.254.200.221.  The label on the switch says the switch itself is supposed to be 192.168.1.99. I even tried to set my laptop's LAN port to a static IP of 192.168.1.10 and still can't access this switch's GUI. Any assistance is greatly appreciated. Thank you very much,Sonny