Solved

Dear Concern,  I am using FortiGuard as the DNS server on my FortiGate, but today its status is showing as RED with high latency, as shown in the pasted capture.    Previously, it was showing GREEN. Additionally, when I use Google's DNS like 8.8.8.8 or 8.8.4.4, it shows unreachable, as shown in pasted capture.  I have checked the internet, and it is working perfectly with proper browsing through the same ISPs that are terminated on the firewall.  My Second Testing, When I use Google's DNS server on FortiGate, like 8.8.8.8 or 8.8.4.4, these IP addresses are pinging from the FortiGate CLI without any packet loss while in DNS Tab in FortiGate firewall showing unreachable as mentioned in above picture.  However, when I ping a domain name like google.com, it doesn't work, meaning the DNS is not resolving.  Then, when I bypass the FortiGate firewall and check by directly connecting the ISP link to my laptop, both the IP address and the domain name are

Hi Everyone!I am testing EMS for FortiClient VPN depolymant and have depoloyed the ova image of EMS 7.4.1 on my esxi and switched to multi site management. I tried to create a deployment package to deploy FortiClient via invention. At the final step (4) of the Installer package creation process i get the following error: failed to create deployment package: not enough disk space.It does not depend if i use multi site configuration or not. i tried both. Same error.The Interface tells me, that there is 30% free space availible. Has anyone encountered the same error and has a fix?Regards,Thomas 

Overview/Scenario1. I have a use case for configuring NAT where in which an isolated Azure virtual desktop session host will traverse a NEW public ip address assigned to my Fortigate Azure NGFW virtual machine's WAN interface.2. Any IPs requiring egress traffic outbound will use cenrtal SNAT in a one-to-one mapping for all ip addresses within my AVD subnet range: `192.168.235.0/24`Questions:1. Could you please critique my implementation logic below? Relativley new to FortiGate, so please excuse the basic questions. I sourced FGT docs on [central SNAT](https://docs.fortinet.com/document/fortigate/7.6.1/administration-guide/421028/central-snat)2. As the new Azure public ip is assigned to the WAN interface of my FGT device, would DNAT be required? Not sure how FGT would route traffic from the new public IP inbound to my AVD subnet. However, there is currently no requirement to translate destination addresses to specific services within the isolated AVD subnet Proposed Azure deploymen

Looking into the benefits of FSSO in our environment for the purposes of restricting internet access. What does FSSO give you that a simple LDAP group doesn't within a firewall policy ? Or are they to be used in conjunction ?  Thanks all!

I am using Fortigate 100G in HA and running Firmware 7.2.9. The issues I am facing is the interface is able to reach the NTP Server. NTP Server : 192.168.1.10FGT MGMT : 192.168.1.4 I have added a MGMT interface under dedicated management interface, which changes the MGMT interface in different vdom and getting removed in interface GUI. I want to get the time through management interface. I have configured NTP with below config set ntpsync enableset type customset syncinterval 1config ntpserveredit 1set server "192.168.1.10"once I try to add command "set source ip" it is showing below error "192.168.1.4 does not match any interface ip in vdom root." , as Management interface is removed from root vdom So my question here is can we configured ntp on dedicated management interface vdom, or how can we achive. Also I am referring to below docs in which we can set the interface under ntp server-->edit 1, but I cannot see it in my firewall. https://docs.fo

First of all, I am inheriting this network and I believe this to be setup incorrectly however I've never seen someone try to do it this way. I have a two site-to-site fortigates with a switch behind each. I am getting inconsistent pings to the far switch. The far fortigate is also getting intermittent pings to its switch (they are connected via copper which has been swapped out).  The LAN interface is set to 192.168.0.1 and the switch's Management interface is set to 192.168.0.2. Under the FG's LAN interface are SVIs for the various vlans on the switch. It seems to me that the problem is likely that the OOB mgmt interface is being used or is there something on the FG side that I should look at?

Dear all, I have diagram as below:       --------- tunnel 01 --------------Hub (lo0)                                      (Lo0) Spoke       ---------- tunnel 02 ------------- I am using BGP on loopback to set up routing via 2 Tunnels. (FortiOS 7.4.4)And I try to set up SD-WAN Rule to steering BGP traffic (Keepalive, updates...) via tunnel02.In the sd-wan rule: I set: source is Lo0 of spoke and destination is Lo0 of Hub, Outgoing interface: i used Manual : Tunnel02 is first order and tunnel 01 is last order. Member is 2 tunnel interface SD-WAN zone. But after that, I can not see any hit count on the sd-wan rule, and diagnose packet port 179 : traffic still via tunne01. I am wondering what is my mistaken ? (or BGP update processed by SDWAN rules ?) (I have another sd-wan rule to allow all (all source and all destination), used SLA

Hey Guys We are facing Hight SSL Negotiation time, when WEB filter profile has enable on the rule at Security Profile.When we disable de WEB Filter profile on the rule, the SSL Time improve considerable .To test i'm using this curl command, for google website. But this issue occur with any destination addresscurl —resolve www.google.com.br:443:142.250.219.131 -w "DNS_resolution: %{time_namelookup}| TCP_negotiation_time: %{time_connect}| SSL_negotiation_time: %{time_appconnect}| TTFB: %{time_starttransfer}| Total time: %{time_total} \n" -o /dev/null -vsL https://www.google.com.brWhen WEB Filter profille is enable the SSL_negotiation_time is more 3 secondsWhen WEB Filter profile is disabled  the SSL_negotiation_time is not more tham milliseconds When I check on System ==> Fortiguard  My Web Filter Status is average 123 ms. Someone experienced this same issue ?

Hello All,I have this issue. FortiGate 40F (v6.4.15 build2095)Fortinet tunnel is showing inactive stateReproduction : I use the GUI not the CLI.1. I created a vpn user2. I assigned this user to a vpn group3. I used th VPN wizard to create an Dialup FortiClient (Windows, Mac OS, Android) :-> https://docs.fortinet.com/document/fortigate/6.4.15/administration-guide/785501/forticlient-as-dialup-client4. In Firewall & Objects-> Addresses :-> Created automatically -> vpn1_range = 192.168.1.1-192.168.1.254-> Created automatically -> vpn1_split = members = lan-> Firewall Policy :-> Created automatically -> vpn_vpn1_remote_0-> The VPN was created, but shows INACTIVE.I really don't understand. Can some help, please ?Kind Regards,Jo

Hi - weird one that has never happened before...https://imgur.com/gjjth76Everything is fine license-wise except for this "Industrial Attack Definitions" expiring. This occurs on both of our Fortigate 101F's.The contract was renewed and applied over a month ago, so it's not an update issue it seems. The Industrial DB's definitions have also been updating just fine.We purchased:1 FC-10-F101F-809-02-12 1 Year coverage for FortiGate 101F include:Hardware Advanced HWFirmware & General UpdatesEnhanced Support PremiumTelephone Support PremiumAdvanced Malware ProtectionFortiGuard IPS ServiceFortiGuard URL, DNS & Video Filtering ServiceAntiSpamFortiConverter Service 8x5FortiGuard Attack Surface Security ServiceFortiGuard AI-based Sandbox ServiceDLPWhats the deal? Am I going to lose IDS? Do we need to remove anything from our policies to prevent blocked traffic?These are several years old now and this has never happened before. It's just odd it's happening to both devices because it seem

I have a fortigate in the cloud that when the flow from a linux server passes through it, the source machine in question is on the Oracle Cloud internal network and the destination private load balancer is on another Oracle Cloud network, but I want to force them to communicate only by passing through the firewall. I can close telnet, which shows that the route is correct. I can connect to the destination, but when I try to execute the connection via the linux command line using SSL, it does not negotiate, giving an SSL Handshake error. The problem only occurs when passing through fortigate.If I go through the VPN in others to the same Load Balancer it works normally, only when the connection is coming from an internal network to another internal network that the error occurs. The tests performed were done both with NAT active and without NAT active, but in both tests the error persisted.

Hello,I'm trying to create a notification when my internet link is down to send a message by e-mail, but I'm getting 3 e-mails with DOWN and UP status, would you have a tutorial I can see where I'm going wrong? Another thing, would it be possible to send this by telegram or WhatsApp? I can't do it through teams because Microsoft is giving me an error in the apps. I'll send a printout of my settings 

hi,i plan to configure a couple of VDOMs in a FGT, one VDOM is our "main" internet VDOM connected to ISP (and downstream customer VDOMs).i plan to deploy another customer VDOM with eBGP integration.is this VDOM design/setup feasible? are there any "gotcha" that i should know?

Hello all, I am currently preparing QoS for a Dante audio network for some FortiSwitches managed by Fortigate / FortiLink. Dante needs at least priority for PTP (CS7, high) and Audio (EF, medium), and optional for other reserved traffic (CS1, low) according to following documentation:www.getdante.com/support/faq/how-does-dante-use-dscp-diffserv-priority-values-when-configuring-qos/ As far as I understood the Fortiswitch QoS concept, it should be sufficient to map the different DSCP values to different queue-numbers according to their priority (higher priority, higher queue) and to use the default "strict" scheduling, so that higher queues (e.g. the queue for PTP) are always serviced first. DSCP Mapping:CS1 to cos-queue 1 (reserved)EF to cos-queue 5 (audio)CS7 to cos-queue 6 (PTP) QoS Policystrict scheduling for all above named queues Port configurationMap the QoS policy to all uplink-portsTrust DSCP map on all Dante endpoint access ports Would you recommen

Hi Team, The site to site has already Up.From HQ to Branch Okay, everything can Ping and access.From Branch to HQ unable to ping and access.Route and policy has done on HQ FortiGate 80F.HQ - FortiGate 80FBO - Sophos UTM 9HQ subnet - 192.168.110.0BO subnet - 192.168.1.0, 192.168.3.0 Is it possible I need to add extra Route and Policy on the Branch Sophos UTM?  

Hi Team,I'm trying to Create an IPSEC Site to Site to a Sophos UTM.Below was my configuration in FortiGate: Just wanna to confirm that my configure correct or not as default. FortiGate  

 i have HUB & SPOKE scenario as shown in the picture with dual WAN connections one is DIA and the Second is private WAN Microwave Network and I configured auto discovery in to WAN interfaces and all spokes can access the HUB and spokes to spokes shortcut come up and suppose the internet VPN is selected first duo to aging time in BGP table when branch1 try to access branch 3 the shortcut tunnel come up and working fine but when the internet interface come down in branch 3 in example the microwave VPN tunnel not start between the branches . how can i configure this scenario to allow fail-over shortcut VPN ?Note the spokes to HUB fail-over working fine and no SDWAN Configured in this scenario and IBGP Multi-path and additional path is configured in all devices and the HUB playing as BGP router reflector

Hello Team,I am seeing something Weird. I am not finding firmware about Fortigate 30G. There is even no possibility to check upgrade path on that model on the fortinet support site. Is it normal ? is there anyone here who ever succeed to get firmware download on FGT 30G.  Please let me know, if you have information about it

Does anyone have a working cleaned config of ADVPN in a Dual Hub setup with BGP on Loopback and the spokes being full meshed to the Hubs? I have everything setup and all tunnels are running, but when it comes to the SDWAN SLA's the Hub1 is currently only utilizing 1 overlay. Tags and Policy routing have been applied. FortiNet doesn't have published configs on this setup (that I can find) due to the complexity however as of 7.0 (running 7.2.8) they do state in their design documents you no longer need the bgp per overlay, but I almost feel like I need to go back to not running BGP on the Loopbacks.  Basically just seeing if anyone has BGP on loopback up and running when spokes are dual ISP'd with meshed connections to the Hubs. Super simplified setup:Spoke1 ISP1 -> Hub1 ISP1 net 1Spoke1 ISP2 -> Hub1 ISP1 net 1Spoke1 ISP1 -> Hub1 ISP2 net 2Spoke1 ISP2 -> Hub1 ISP2 net 2Spoke1 ISP1 -> Hub2 ISP1 net 3Spoke1 ISP2 -> Hub2 ISP1 net 3Hub1 net2 and Hub

Hello everyone,I am new to FortiClient EMS and currently in a roll-out state. How do I prevent unwanted computers from connecting to the EMS? (EMS on-prem, running in a DMZ and public available to the internet) In theory someone can install FortiClient and connect to our EMS.I do install FortiClient for our users because they do not have admin privileges - so I did not enable user verification. Is there any other way to prevent unwanted devices from connecting to EMS?

Hello,I noticed a difference in the log view behavior after upgrading to FortiAnalyzer 7.6.1.In the current version (7.6.1), when I access the "Log View" section, all logs from my FortiGate devices are grouped together, without an immediate distinction between different devices.In the previous version (7.2.3), logs were displayed in a cascading format, and on the left side, it was easy to identify the originating FortiGate for each log entry.This change makes it more challenging to quickly locate logs from a specific device. Is there an option or configuration to restore the previous view?Thank you for your attention.Best regards,

Hello,I recently performed a fresh installation of FortiAnalyzer and am encountering an issue when attempting to add a secondary hard drive. Despite following the documented procedures, I am unable to complete the operation.Specifically:When using the "execute lvm extend" command, the process does not yield any meaningful result.The "execute lvm info" command returns the message "unavailable" on the disk 2I have verified that the added hard drive is visible at the hardware level, but it seems that FortiAnalyzer does not recognize or properly manage it through LVM.Could you please provide guidance on how to resolve this issue? Thank you for your support.Best regards,

 how many URL can be created in static URL filter? 

I have tried to download a FortiNAC demo from the support page to test on a virtual machine but it seems to be unavailable, do you know of any way to download a demo for Vmware, or is the web demo the only one available? I hope you can help me, thanks.

I'm using the forticlient with Ubuntu 24.04.1 LTS. After running an apt upgrade the forticlient was also upgraded from version 7.2.5.0854 to 7.2.7.0905. Now I'm no longer able to connect to my VPN.  I get the following error messages in the log file sslvpn.log:  20241217 17:58:10.901 TZ=+0100 [sslvpn:EROR] nmtools:255 Command to set ipv4.ignore-auto-routes returned with status 256. 20241217 17:58:10.901 TZ=+0100 [sslvpn:EROR] nmtools:1060 Failed to modify connection docker0 property ipv4.ignore-auto-routes 20241217 17:58:10.901 TZ=+0100 [sslvpn:EROR] dns:1007 Failed to finish Network Manager configuration 20241217 17:58:10.901 TZ=+0100 [sslvpn:EROR] vpn_connection:2072 Config DNS failed I have already removed some docker interfaces, which occurred before in the log as error messages, but I cannot remove the docker0 interface, only to get the client running.  I have also upgraded to the Version 7.4, but I get the same error messages. I tried