Solved

I have guest ssid on the cisco wlc9800 and if there are user want connect to this ssid then the user will authenticate by captive portal with entra id.After the authentication successfull the client should be move from isolation network to guest network, in my case the client was moved to guest network if i see from fortinac policy but the client itself still connect to isolation network.Already ask to cisco support then they said the cisco not receive the coa to change the vlan. Anyone know here how to change thje vlan to teh cisco wlc9800?

Hi ,I would like to ask for some clarification regarding Flow-Based Antivirus behavior and architecture on FortiGate.I reviewed the Administration Guide and several technical documents, but I could not find detailed explanations for some internal Flow AV processing behaviors.I would highly appreciate it if you could clarify the following points or provide any related technical documentation, KB articles, technical tips, or architecture references.In Flow-Based Antivirus mode, is there still a file size limit / oversize handling mechanism similar to Proxy-Based AV, or is the oversize behavior only applicable to Proxy mode? In Flow mode, when scanning large files, does FortiGate bypass scanning after reaching a specific internal threshold, or can it continue scanning regardless of file size? Does Flow-Based Antivirus use the same Antivirus databases (Normal / Extended / Extreme) as Proxy-Based AV, or does Flow mode use a different AV engine/database architecture? If Flow mode does not fu

Hi all, when I try to add a firmware template to a FG80F the Fortimanager Cloud returns me the following error: "[-9001] invalid template assignment - conflicting template assignment scope: device FG-BENIARJO, vdom root, firmware template object [(null)] and [Template_Upgrade_Beniarjo]" (attached screenshot). As you can see the template has no device assigned.  The FG does not have any firmware or provisioning template configured. On the other hand, another FG with the same characteristics, and being the template a clone, I have not had any problem. Any ideas? Best regards!

We have policy to allow all servers access to microsoft then i have a firewall policy and set the destination to all microsoft internet service.However i found some microsoft url still blocked by implicit denied and this mean microsoft internet service not contains all microsoft url. Anyone know how to solve this?  

Hi, i have a Fortigate 200D Firewall with FortiOS 6.0.16 and a Huawei 4G Webstick Modell 3372h. I can't bring the Connection to the LTE-Network up. I searched around and found this https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-Huawei-E3372-h-modem-stick/ta-p/193600 The Problem is, that i have the AT-Command Version of this Stick and this HowTo is for the Web-Interface Version. When i try to configure the Stick as lte-modemdiagnose sys lte-modem infosays, that the Modem is not connected.  So i tried to configure the Stick as "normal" Modem. The Modem itself seems to work properly: diagnose sys modem queryUSB status: Connectedmanufacturer: huaweimodel: E3372IMEI number: 868230032061123SIM state: Validservice status: Valid Servicesignal level: 3/4network name: E-Plusnetwork type: E-UTRANlocation area code:active profile(AT&V):COMMAND NOT SUPPORT^RSSI:18^HCSQ:"LTE",45,47,136,26 But in the Debug Messages a Timout occures (At

Hello FortiPeople, I’m checking if there’s a possibility to create a “recipient verification” exception for a particular source IP address. Let me explain:We have a particular client application, which sends e-mails to multiple addresses in one SMTP session.Whenever there’s a bad recipient address in the list of recipients, the application logically gets a “550 5.1.1 ... User unknown” reply from the FortiMail, via the recipient verification options set in the domain settings.However, where this SMTP client differs compared to other SMTP clients like Exchange Online, is that it quits the session after this reply and will not send the mail for ANY of the recipient, so no one receives the e-mail when only 1 address is bad.Exchange Online, for example, will continue on the same session (verified in the logs by session ID) and just continue for all the good addresses, which will then receive the mail. We tested with Thunderbird as an SMTP client, which also gives the same behaviour (SMTP se

I was curious if anyone was already ingesting the Malicious IP and/or Domain Lists from their MS-ISAC membership?  Someone asked in another community thread if those were included in the Fortigate threat feeds somewhere, but didn't get a response.  I’ve gone through the steps in several documents from support, but keep running into an Internal Error on my Fortigate when I refresh the object.  I figured I would check and see if someone had already figured this out and would mind sharing the configuration settings they used to create their successful objects.  I’m running a case with support but it’s slow going.

How do I schedule a reboot in FortiGate firewall at a certain time from remote ?

Anyone know wbaout below error and how to fix this when try configure the eap-tls?failed continuing EAP TLS (13) session. EAP sub-module failed

Hi I want to have 1 single FortiGuard license for my 2x100F FortiGate.You have the doc if the devices are not yet registered, but i want to do this with already registerd device is this possible?FYI Doc, how to do if the devices are not registered.https://docs.fortinet.com/document/fortigate/7.4.11/administration-guide/246857     

Hi I’ve been using the FortiClient app for many years on my personal Surface Pro 7 device. Not had any issues, but recently we’ve taken part in a vulnerability audit and the app is flagging a few issues. The solution is to update, but I’m struggling to do so. I had version 7.4.3 installed but need 7.4.5 for the vulnerability to be cleared. When I download the latest software file it doesn’t show any version options. Instead, it I think it pulls down the latest version it can. I’ve tried to reinstall but still only getting to 7.4.3. I’ve seen a post regarding Snapdragon processors not being compliant, with newer versions of the Surface Pro. That may explain why my colleagues Pro 12 is not working at all with the app. But my older 7 model works fine, but I just need help updating. Many thanks 

hi,is there a way to send a weekly or monthly report to our registered email for the FortiFlex license points usage?it’s kinda tedious and manual looking at the points usage in the portal.or are we just going to receive an email if it’s already in a low point threshold?

I have recently opened a ticket with Fortinet and shared this information so that Fortinet can fix a problem that was recently introduced in some of the newer 7.4 versions (such as 7.4.10, 7.4.11 and possibly earlier and later versions).  It may affect many other versions, but I'm not sure, because I've been only having the issues with recent 7.4 versions.  I have tested this on models 40F, 60F, and 61F, but I am guessing it will not be model specific.The issue: When doing a system Format of the drive, and then doing a TFTP firmware recovery, the TFTP connection will repeatedly "Timeout" when it attempts to download the firmware.   On the TFTP server side, there will be a log entry when it connects, and it will result in a "Transfer Timed Out" message after it tries a number of times.I tested this using multiple TFTP servers:1) TFTPD32/TFTPD64.exe by Philippe Jounin on windows. 2) Fedora Linux's install of TFTP server3) The "Transfer" app for Mac by intuitbits4) Mac OS Native TFTP serv

Hi All, I want to ask about URL Filter in Webfilter Profile.I added a URL Filter Exempt(type:wildcard).Target url to use 8020 port, but Access block. I checked this KB: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Resolve-issue-web-filter-block-override-and/ta-p/193291?externalID=FD39997And set config: set ovrd-auth-port-warning 9020, and then the URL Filter takes effect.Does the official document mention that Fortiguard uses this port like the link below?I wonder my solution is correct. https://docs.fortinet.com/document/fortigate/6.4.0/ports-and-protocols/362392/fortiguard-open-portsMy Fortigate: 6.4.9 

Hello, I have a headquarters site with a FortiGate firewall.We also have multiple secondary sites across the country. Each remote site normally uses its primary ISP connection ( through MPLS) to access the corporate network. Our goal is the following:If a remote site loses its primary ISP link,We plug in a Starlink connection at that site,The site should automatically establish an IPsec tunnel (IKEv2) to the headquarters,All traffic (0.0.0.0/0) should be routed through the tunnel to HQ (full tunnel), so the site can continue to access the corporate network and internet through HQ.The tunnel requirements:IPsec with IKEv2Full tunnelStarlink uses dynamic public IPMy question:Is it possible to configure a single Phase 1 and Phase 2 configuration on the HQ FortiGate that can accept connections from all remote sites (with dynamic IP addresses), or do I need to create one Phase1/Phase2 pair per remote site ? What I find difficult to accept from a design perspective is the idea

Hello, Is there any known reason for the FortiClient taking upwards of 30 minutes to download or sometimes failing? Today, one download started, restarted after 40% then failed. This is the VPN only client downloading.    - Dan

Hi all, I have my own Fortigate and one Fortiswitch from ebay.The switch seems under that seller account. Might I know if I still can use Forti-link to manage that switch without any issue? Thank you!

The  FAC 300F  in picture only  has  200 user but its  showing  license type i belief  FAC  300F  only hardware limited upto 1500 user right  ?? 

Hi All, I'm implementing SDWAN topology with Dial-Up Ipsec VPNs. I also want to implement traffic shaping for the relevant traffic. I plan to use Shaping profiles on interfaces but I'm a little bit confused about where to put the shaping profile. On the VPN interface, or on the physical WAN interface. Or Both? Never find a documentation about that. Thank you!

Hello everyone, I would like to know, will I have issues with the persistent agent if I use Fortinac’s Self signed certificate ?  BR,

This same question was asked over a year ago, but never found resolution. I send invites to users following the Technical Tip: How to send email notification which contains FortiClient installer package that embedded with invitation code post. Forticlient is installed and connects to the fabric as expected. If a user disconnects from the fabric they are unable to reconnect without using the invite code. The invite code is supposed to be short-lived and only used to register the endpoint. I thought FCEMS Cloud sent an identity cert to the client machine upon registration. I cannot find any settings for client certs or similar. How are users supposed to reconnect after the invite code expires?

Anyone know where i can download forti vpn client for mac?I try download from https://www.fortinet.com/support/product-downloads#vpn but after i fill the data then the page only showing submitting and back to download now again. 

Can someone from Fortinet indicate when Ubuntu 24.04 will be supported.Ubuntu 24.04 LTS was released on 25 April 2024

Hello, used products: FortiGate 80F/FortiGate 400F I have a simple Hub and Spoke Szenario, which works perfectly in 7.4.8 and less. If I upgrade my spoke to 7.4.9 I can't establish my VPN any more. Spoke says: ike V=root:0:vpn-pfi-hub: connection expiring due to mode-cfg client IPv4 error ike V=root:0:vpn-pfi-hub: going to be deleted ike V=root:0:vpn-pfi-hub: schedule auto-negotiateHub says:twin connection Spoke config: mode-cfg, but with manual assigned ip on the interfaceHub config: mode-cfg, no ip assignmentThere must have been a change in 7.4.9 - but I can't find it. If I downgrade, everything works.Kind regardsTwoSoulz