Solved

Hello, I would like to install a Fortigate 200G with active/passive HA.That's mean that only one Firewall is running, the second, just in case of problem on the primary. Our reseller said that's it's required to have both licences and maintenance same on both firewalls.Is that's correct ? Thank you. 

Hi guys,I need some assistance in clarifying some of the information I'm seeing in log 99 from my fortiproxy, particularly the rcvdbytes and sentbytes.Question 1: Does the received bytes refer to the amount of bytes received by the fortiproxy from user or vice versa?Question 2: Does the sent bytes refer to the amount of bytes sent by user to the dest or vice versa?Question 3: Does the HTTP method or any other telemetry within the rawlogs that may affect the order of how we see the bytes?This is crucial because it allows me to understand if there are potential malicious exfiltration happening in my environment.Thanks!

I have challenge concerning the setup diagram provided below. In this diagram, VLAN 30 is designated as the out-of-band (OOB) management VLAN, with the corresponding OOB management network IP address being 192.168.30.0/24. Each device intended for management via the OOB network is connected to the management VLAN ports of the Forti-switch through their respective physical management ports, as illustrated in the diagram. My objective is to manage the Fortigate firewall B using its IP address, 192.168.30.10, which is configured on the physical management port. In pursuit of this objective, I attempted to configure the static route outlined below. However, I encountered an issue where the command SET DEVICE MGMT was not accepted, even after I had removed the management port from being designated as a dedicated port. Could you please advise on the most effective method to achieve my goal of managing the Fortigate firewall B through its management port? config router staticedit 12set d

 AWS EC22 is running Fortigate 7.2 on vCPU, and the license is using 2 vCPU.Display 1/250% of allotted vCPUs after license change.I'm using 2vCPU, is there a reason why it only shows up as 1?Can't I get them to use both as basic?

I've setup ADVPN using BGP on loopback design with SDWAN. Traffic flows and failover to another link when when it disconnected on all devices.  Right now I have 1 hub and 2 spoke. I can steer traffic from spoke 1 out the correct interface - but the ADVPN shortcut is sending traffic into a different interface on spoke 1.  A practical example - I would like to send all backup traffic out our second ISP - WAN2 on spoke1. This works no issues. The traffic however ends up coming in on WAN1 on spoke2. This would normally be fine - except when it comes to traffic like an off-site backup I would prefer it not to be on our primary link.Is it possible to steer traffic to take a certain path if using BGP on loopback - I believe this is possible with BGP per overlay but don't want to invest a significant chunk of time on that design if what I'm trying to accomplish is possible with the loopback method. I am also waiting for a call with Fortinet support but hoping to get so

I have installed the latest VPN client from https://links.fortinet.com/forticlient/win/vpnagent  After installation accomplishied, I promptly noticed the lack of the tray icon (that indeed arise on other Win10-22H2 Win11-23H2 installations). Anyway I tried launch the client console configured and saved VPN settings according to my firm's guidelines (SSL-VPN on custom port).Unlike the other OSs mentioned above, the client remains stuck on the connection mask without any status/progress expected (indeed the client doesn't connect). I have already tried the solutions proposed herein, but without any success:https://community.fortinet.com/t5/Support-Forum/FortiClient-VPN-only-with-Windows-11-24H2-issue/td-p/348662 https://windowsreport.com/windows-11-forticlient-vpn-not-working/  

Planning on doing some route-map and prefix-list renaming. When testing i didn't see any impact when i just create new routing objects with the same content but different names. When i then change them for example at router bgp route-map-in or out it shouldn't cause any interruptions, might have to do a execute router clear bgp ip x.x.x.x soft though. Anyone with different experience?

I noticed a problem. When the updated version is the same (31.962 at the time of posting), the signatures under the v7.2.10 build1706 (Mature) version are much less than the total signatures displayed on Fortiguard, only 12,346. On the 0S6.2.16 system, it is 18,861, which is close to the total number of entries, and on another OS7.4 device, it is also close to the total number of entries. I have followed the tutorial to turn on extended signatures and set exclude-signatures to none.Will this affect Fortigate's security features?Update record query:Intrusion Prevention Service | FortiGuard Labs

greetings all,I created two SLAs, they have the same settings (same interface participants, same SLA target, same link status metrics) but only with different detect server (probing target). SLA 1 probing 10.74.a,b, SLA 2 probing 172.29.x.y. And, I added the two SLA under the same SD-WAN rule, which is with lowest cost (SLA)the question is , what is the Boolean logic here? Let's say, 15 consecutive times of probing failure occurs to either one of the two (1 out of 2) SLAs , will the related interface become inactive? and will the SD-WAN switch to the secondary interface (the interface with higher cost)?AND, what about if I add the two probing detect servers to the same SLA? and only use the one SLA under the SD-WAN rule?Thanks,Sean

HI guys, Due to a ISP change my local Fortimanger is no longer reachable with the old address. I want to deploy a new FGT to my Fortimanager, but when I try this, the old IP is listed. Where can I change the IP to the new one? Best regardsVolker 

Quick question.  Is it possible to use a SAAS SSO provider such as Okta, MS etc and using SAML? This is our current setup for VPN, but there seems to be a hitch when you need to involve Authentication rules because of the interface and protocol preference. Is the LDAP portion required for this? And not just relying upon the SP user data base? 

Hello :), I've previously had an offline CA setup and used it to sign certificate request for Fortigate. It was an easy process overall.  However, I now have an enterprise CA. A new folder under my CA was created as "Certificate Template". I understand it's utilization and whatnot, but my troubles come with accepting Fortigate CSRs. I immediately get shot an error "Denied by Policy Module 0x80094801, the request does not contain a certificate template extension or the CertificateTemplate request attribute."That's fine and dandy but I can't seem to be able to add that attribute anywhere before generating the CSR. I've looked online and I'm instructed with a CMD process that applies the Template to use, but I have the upcoming project of signing more than 80 of these certificates.  I'd appreciate the guidance on making this as simple as it was with my offline root CA :)

Hi, I have a simple setup right now, with a Fortigate 600E on Floor 2, and a Cisco SG350 10G besides this, and I also have another Cisco SG350 10G on Floor 1. Each floor also have a storage server.Workstations from Floor 1 and Floor 2 are connected to the respective floor Cisco swich, and the Fortigate has X1 interface for internet in, and x2 interface to connect to the Floor 2 switch. The Fortigate is the router and dhcp server. But now the bosses want Floor 1 and Floor 2 to be completely separate, and only share the x1 internet connection (which should be also be filtered to only allow certain internet destinations) but worksations from Floor 1 cannot "see" workstations from Floor 2, and viceversa. Can you guide me how to setup something like that, preferably from the GUI of the Fortigate 600E ?I assume I will setup different VLAN's on each switch, with Trunk configured to communicate between them, but then what should I setup on the Fortigate ? Thank you 

Good day, This is URGENT.I am seeing “No license” for features Virus Outbreak & Antispam. These features were always in the green during my 2024 subscription and even after renewal license in January 2025. Last time I checked, even last week, these 2 features were in the green/licensed. I Logged on this morning and now realizing this. What is the cause for this change? Contact Fortinet support or something i can do from cli etc.? This is very strange. HELP!  

Hi Guys, We have two sites connected together but we want to have two guest portals so that we can get a user from each site to approve the requests. Currently it is setup as one guest portal. Any guides or help to achieve this? We are on FortiNAC 7.6.2.0715 (GA) Thanks John

Hello, I’m experiencing an issue with FortiNAC-OS 7.2.8.I’ve created a device profiling rule with the following settings:Registration: AutomaticType: WindowsRole: NAC-DefaultRegister as: Device in Host ViewAdd to group: XXXAccess Availability: AlwaysMethods:DHCP Fingerprinting with different custom attributes:Message Type: AnyHost Name: ICT-*Message Type: AnyHost Name: DSKT* However, Windows devices are detected but not properly profiled and registered. For testing purposes, I tried both creating a single custom attribute with Host Name: "ICT-*, DSKT*" and creating multiple rules with a single hostname per rule, but neither approach worked. I have another rule for IP Phones, which is working without any problems. What am I doing wrong? Any suggestions?

I have a Fortigate that has two vdoms (root vdom and OOB vdom). The OOB vdom is connected to the Forti-switch and the Forti-switch is being managed by the OOB vdom Fortigate. The Forti-switch has 3 Vlans and all the ports on the Forti-switch have been used. How can I configure a physical port of the Fortigate so that I can access the three Vlans on the Forti-switch Please help with configuration. 

Can I just flip the switch on IPSec XAUTH² to 'inherit from policy' and use the same rules as SSL-VPN, where you have to specify a Source and User/Group? Last time I tried this, the FortiGate acted as a MITM for IPSec users and redirected HTTPS³ to its own IP, causing a certificate error. I had to roll back without investigating further. FortiGate 200F 7.2.11² XAUTH is set to a group containing a remote group which is a radius of our 2FA token.³Split Tunnel, so not all HTTPS requests, only the ones where a FW rule was hit.    

Hi Guys, Can't connect FGT (ver:6.0.5) to FAZ (ver: 6.2.1 FortiAnalyzer), connectivity test fails; FGT been added to FAZ devices;exec log fortianalyzer test-connectivity Failed to get FAZ's status. SSL error. (-3) Capture shows that FAZ sending RST back to FGT: 66.345323 port10 out 172.16.102.248.13765 -> 172.16.102.247.541: syn 1195392681 66.345952 port10 in 172.16.102.247.541 -> 172.16.102.248.13765: syn 1231566839 ack 1195392682 66.346003 port10 out 172.16.102.248.13765 -> 172.16.102.247.541: ack 1231566840 66.346728 port10 out 172.16.102.248.13765 -> 172.16.102.247.541: psh 1195392682 ack 1231566840 66.346857 port10 in 172.16.102.247.541 -> 172.16.102.248.13765: psh 1231566840 ack 1195392682 66.346885 port10 out 172.16.102.248.13765 -> 172.16.102.247.541: ack 1231567207 66.346990 port10 in 172.16.102.247.541 -> 172.16.102.248.13765: ack 1195392843 66.347044 port10 out 172.16.102.248.13765 -> 172.16.102.247.541: psh 1195392843 ack 12315672

HelloAfter pentests we have issue about showing SSLVPN webpage. I need use SSLVPN only in tunnel mode (this is not problem), but without showing any page in browser. I looked on cli and gui and can`t still found any solution, how disable web page, but still have actvite tunnel mode.Do you have any idea?Thank you

I have a Fortigate F100 with rules in place for the management address of my company's UPS. One policy allows SMTP traffic from that address to our mil server. The other allows DNS traffic from that address, nothing else. I'd like to log any other traffic from the address in question that doesn't match either of these two rules; what's the simplest way to configure such a policy? Just clone the 'UPS Management Address to DNS' rule, set it to DENY instead of ACCEPT, choose every service other than DNS, and hit the log option?

greetings friend,I created an IPsec tunnel named OL_INET_AZ, and it was added to an SD-WAN zone. but there is NO SD-WAN rule using this IPsec tunnel as the outgoing interface. there are 3 static routes:S 10.74.0.0/15 [10/0] via 1.2.3.4, port17, [1/0]                        [10/0] via OL_INET_SKO tunnel a.b.c.d, [20/0]S 10.75.0.0/23 [10/0] via OL_INET_AZ tunnel v.w.x.y, [1/0]Now my LAN network want to talk to 10.75.1.68 via OL_INET_AZ.  From the routing table 10.75.0.0/23 via OL_INET_AZ is the best route as it is most specific. When I ping 10.75.1.68 from the fortigate itself, the traffic is going through OL_INET_AZ, but if I ping from a LAN host behind the Fortigate (and behind the core switch) , it will hit the SD-WAN rule with destination 10.74.0.0/15, and going through port17.From SD-WAN routing logic, it said SD-WAN rules are matched only if the best route to the destination points to SD-WAN, will this

hi,i'm trying to build a new FW policy and wondered if i just build a single custom service object with all the required ports added, i.e. TCP 80, TCP 443, TCP 8080 or create a service group and add the individual service objects.1. would there be a difference if i used a single service object vs a service group in the FW policy?2. what's the recommended or considered "best practice" in FGT FW policy?3. what are the pros and cons between the two approach? 

I've followed some of the most posted protocols for preventing brute force on my vpn interface, biggest was to only allow US based traffic to the interface, but what I've found in the last coupld of years, is that all the open VPN environments in the US are used by threat actors constantly.  I'm up to about 3000 failed login attempts in 6 hours time.  This is just US based IP's and when I look them up, the bulk of them are associated to open VPN providers IN the US. I was doing some searching to see if there are geo lists of these open vpn providers that I could import.  I've been manually digging up the blocks and doing ASN/Whois lookups to piece it together.  I get it down to about 200 / 6 hours, but then in a couple of weeks, shoots back up to the 1K's of hits.  Anyone have suggestions?  Again, this is US only attacks at this point.

Hello, we are currently running our Fortigates on FortiOS 7.0.13 and want to upgrade them as the version is coming out of support in next few months. we first considered 7.2.10 (7.2.11 now) but Fortinet recently changed their recommanded version to 7.4.7 for our models. Reviewing the release notes, I noticed this known issue :  1069208If the DHCP offer contains padding when DHCP relay is used, the DHCP relay deletes the padding before relaying the packet. From what I understand on various internet sources, removing padding from DHCP packets could be an issue for certain devices that could no more get an IP. I found nothing specific for Fortigate setup however. This is a major issue for us as our main Fortigate is used as a DHCP relay, and it is the only one so we cannot test it before. I was curious if someone encountered DHCP issues on 7.4.7 ?