Solved

Hello, Fortigate 600 v7.2.9.Ports 1 and 2 on the Fortigate are not yet in use. I activate both.I plug PC1 into port 1 and PC2 and port 2.Should the two PCs be able to talk to each other now (of course I gave them both an IP address from the same network)? So are they in the same Layer 2 network?Or do you have to tell the Fortigate that ports 1 and 2 should be in the same vLAN, so to speak.I'm not actually talking about ports, but rather aggregates, but the logic should be the same. ThanksAlbMin

Hi all,it's possible to create an email warning message (on the fortigate or fortianalyzer) when the interface limit has been exceeded over 2 minute? Thank's in advanceMaurizio

Dear community,  anybody using Fortigate API to retrieve log traffic with this endpoint : /api/v2/log/disk/traffic/forward/system?filter=srcip==10.227.108.88&rows=10 I can get logs for a specific source or destination IP, but do you know anyway to get logs for a network ( example : 10.0.0.0/8) ? Running version :"version":"v7.2.10","build":1706 Thanks in advance for your help ;)  Looking the FortiDev documentation, only available filters are the following, but they didn't make the trick to filter on network after several test : filterarray[string] (query)Filtering multiple key/value pairsOperator | Description== | Case insensitive match with pattern.!= | Does not match with pattern (case insensitive).=@ | Pattern found in object value (case insensitive).!@ | Pattern not found in object value (case insensitive).<= | Value must be less than or equal to pattern.< | Value must be less than pattern..>= | Value must be greater th

Team, I have all the required licensing for FortiSASE (advanced, SPA etc) and have a requirement to provide access to private resources (RDP) for contractors (non-managed devices). Before I go down this route, is this a supported configuration using agentless ZTNA? Or am I better placed to leverage a different solution?TIA.Justin. 

Hello, I am looking for older version of FortiClient VPN version 7.0.8.0427. Can someone please help me with the information about where I can get the software.Thanks,VRG

I tested SSL-VPN and IPsec Remote Access with Fortigate VM Evaluation.But,it didn't work both.Is that Evaluation limitation?I found Restrictions,as "Support low encryption operation only",that means I can't use  SSL-VPN and IPsec Remote Access?

LS,I'm trying to install a new GUEST SSID using the fortimanager, 7.2.8.------- Start to retry -------- FW003 $ config wireless-controller vap FW003 (vap) $ edit "WK-GUEST" FW003 (WK-GUEST) $ config mac-filter-list FW003 (mac-filter-list) $ edit 1 FW003 (1) $ next FW003 (mac-filter-list) $ end FW003 (WK-GUEST) $ next FW003 (vap) $ end ---> generating verification report ( wireless-controller vap mac-filter-list ) add entry 1 <--- done generating verification report install failedAny thoughts?

Hi @Anonymous,Can someone help me figure out how to get the currently logged-in user details through a playbook in FortiSOAR?Thanks.

We would like to delete the default admin accounts on FortiManager, FortiAuthenticator, FortiAnalyzer and FortiClientEMS and replace them with another generic account for security reasons. Is it safe for all these systems to delete the default user admin? For FortiManager and FortiAuthenticator I can see inside the logs that there are some actions performed by the admin user internally from the system. So I would like to ensure that deleting the account won't break something. Kind reagards

I have a internal (default) network 10.25.0.0/24 on port 1 and 2. I created a new network 10.20.10.0/24 on port 3.  Clients connected to the internal network can ping the Fortigate gateway 10.25.0.1.  Clients connected to the network on Port 3 cannot ping the Fortigate gateway 10.25.10.1.  The clients can all access the internet no issues.  In Administrative Access area of the interface configuration for Port 3, I have HTTPS, SSH, PING and Security Fabric Connection checked. Why can't my connected DHCP clients ping the gateway 10.25.10.1?  I can ping this address from CLI from within the firewall no issue (execute ping 10.25.10.1).  What am I missing? Also how do I setup a one way route so that a connection to 10.25.10.X can be initiated from the 10.25.0.X network, but not vise versa? Any help would be appreciated. Thanks!

DNS-DatabaseType: PrimaryView: ShadowDNS records within my private network.A erp 192.168.1.200A erp 192.168.1.201cmd: nslookup erp.exsampledomain.com192.168.1.201192.168.1.200always final a-erp-record like above.DNS round-robin is not working.How to set ?Regards

Hi everyone,I am facing a strange issue here: One of our laptops has bad network quality on MSTeams as soon as FortiClient is connected to EMS.The issue seems to appear only on WLAN, when Ethernet is connected via dockingstation (usb-c) everything works fine. But as soon as the user moves to another location and uses WiFi MSTeams has lot of dropouts when on a call. I tried disabling all security profiles but the issue still appears.Only thing that help is disconnecting the client from EMS in the zero trust telemetry section from FortiClient.I also tried the versions 7.0.x and 7.2.x. Any ideas?The affected device is a Dell Precision 7680 with an Intel(R) Wi-Fi 6E AX211 card... I have found some older issues (2 years old) with FortiClient and Intel wifi cards but nothing related to MSTeams...

Dear Concern,  I am using FortiGuard as the DNS server on my FortiGate, but today its status is showing as RED with high latency, as shown in the pasted capture.    Previously, it was showing GREEN. Additionally, when I use Google's DNS like 8.8.8.8 or 8.8.4.4, it shows unreachable, as shown in pasted capture.  I have checked the internet, and it is working perfectly with proper browsing through the same ISPs that are terminated on the firewall.  My Second Testing, When I use Google's DNS server on FortiGate, like 8.8.8.8 or 8.8.4.4, these IP addresses are pinging from the FortiGate CLI without any packet loss while in DNS Tab in FortiGate firewall showing unreachable as mentioned in above picture.  However, when I ping a domain name like google.com, it doesn't work, meaning the DNS is not resolving.  Then, when I bypass the FortiGate firewall and check by directly connecting the ISP link to my laptop, both the IP address and the domain name are

Hi Everyone!I am testing EMS for FortiClient VPN depolymant and have depoloyed the ova image of EMS 7.4.1 on my esxi and switched to multi site management. I tried to create a deployment package to deploy FortiClient via invention. At the final step (4) of the Installer package creation process i get the following error: failed to create deployment package: not enough disk space.It does not depend if i use multi site configuration or not. i tried both. Same error.The Interface tells me, that there is 30% free space availible. Has anyone encountered the same error and has a fix?Regards,Thomas 

Overview/Scenario1. I have a use case for configuring NAT where in which an isolated Azure virtual desktop session host will traverse a NEW public ip address assigned to my Fortigate Azure NGFW virtual machine's WAN interface.2. Any IPs requiring egress traffic outbound will use cenrtal SNAT in a one-to-one mapping for all ip addresses within my AVD subnet range: `192.168.235.0/24`Questions:1. Could you please critique my implementation logic below? Relativley new to FortiGate, so please excuse the basic questions. I sourced FGT docs on [central SNAT](https://docs.fortinet.com/document/fortigate/7.6.1/administration-guide/421028/central-snat)2. As the new Azure public ip is assigned to the WAN interface of my FGT device, would DNAT be required? Not sure how FGT would route traffic from the new public IP inbound to my AVD subnet. However, there is currently no requirement to translate destination addresses to specific services within the isolated AVD subnet Proposed Azure deploymen

Looking into the benefits of FSSO in our environment for the purposes of restricting internet access. What does FSSO give you that a simple LDAP group doesn't within a firewall policy ? Or are they to be used in conjunction ?  Thanks all!

I am using Fortigate 100G in HA and running Firmware 7.2.9. The issues I am facing is the interface is able to reach the NTP Server. NTP Server : 192.168.1.10FGT MGMT : 192.168.1.4 I have added a MGMT interface under dedicated management interface, which changes the MGMT interface in different vdom and getting removed in interface GUI. I want to get the time through management interface. I have configured NTP with below config set ntpsync enableset type customset syncinterval 1config ntpserveredit 1set server "192.168.1.10"once I try to add command "set source ip" it is showing below error "192.168.1.4 does not match any interface ip in vdom root." , as Management interface is removed from root vdom So my question here is can we configured ntp on dedicated management interface vdom, or how can we achive. Also I am referring to below docs in which we can set the interface under ntp server-->edit 1, but I cannot see it in my firewall. https://docs.fo

First of all, I am inheriting this network and I believe this to be setup incorrectly however I've never seen someone try to do it this way. I have a two site-to-site fortigates with a switch behind each. I am getting inconsistent pings to the far switch. The far fortigate is also getting intermittent pings to its switch (they are connected via copper which has been swapped out).  The LAN interface is set to 192.168.0.1 and the switch's Management interface is set to 192.168.0.2. Under the FG's LAN interface are SVIs for the various vlans on the switch. It seems to me that the problem is likely that the OOB mgmt interface is being used or is there something on the FG side that I should look at?

Dear all, I have diagram as below:       --------- tunnel 01 --------------Hub (lo0)                                      (Lo0) Spoke       ---------- tunnel 02 ------------- I am using BGP on loopback to set up routing via 2 Tunnels. (FortiOS 7.4.4)And I try to set up SD-WAN Rule to steering BGP traffic (Keepalive, updates...) via tunnel02.In the sd-wan rule: I set: source is Lo0 of spoke and destination is Lo0 of Hub, Outgoing interface: i used Manual : Tunnel02 is first order and tunnel 01 is last order. Member is 2 tunnel interface SD-WAN zone. But after that, I can not see any hit count on the sd-wan rule, and diagnose packet port 179 : traffic still via tunne01. I am wondering what is my mistaken ? (or BGP update processed by SDWAN rules ?) (I have another sd-wan rule to allow all (all source and all destination), used SLA

Hey Guys We are facing Hight SSL Negotiation time, when WEB filter profile has enable on the rule at Security Profile.When we disable de WEB Filter profile on the rule, the SSL Time improve considerable .To test i'm using this curl command, for google website. But this issue occur with any destination addresscurl —resolve www.google.com.br:443:142.250.219.131 -w "DNS_resolution: %{time_namelookup}| TCP_negotiation_time: %{time_connect}| SSL_negotiation_time: %{time_appconnect}| TTFB: %{time_starttransfer}| Total time: %{time_total} \n" -o /dev/null -vsL https://www.google.com.brWhen WEB Filter profille is enable the SSL_negotiation_time is more 3 secondsWhen WEB Filter profile is disabled  the SSL_negotiation_time is not more tham milliseconds When I check on System ==> Fortiguard  My Web Filter Status is average 123 ms. Someone experienced this same issue ?

Hello All,I have this issue. FortiGate 40F (v6.4.15 build2095)Fortinet tunnel is showing inactive stateReproduction : I use the GUI not the CLI.1. I created a vpn user2. I assigned this user to a vpn group3. I used th VPN wizard to create an Dialup FortiClient (Windows, Mac OS, Android) :-> https://docs.fortinet.com/document/fortigate/6.4.15/administration-guide/785501/forticlient-as-dialup-client4. In Firewall & Objects-> Addresses :-> Created automatically -> vpn1_range = 192.168.1.1-192.168.1.254-> Created automatically -> vpn1_split = members = lan-> Firewall Policy :-> Created automatically -> vpn_vpn1_remote_0-> The VPN was created, but shows INACTIVE.I really don't understand. Can some help, please ?Kind Regards,Jo

Hi - weird one that has never happened before...https://imgur.com/gjjth76Everything is fine license-wise except for this "Industrial Attack Definitions" expiring. This occurs on both of our Fortigate 101F's.The contract was renewed and applied over a month ago, so it's not an update issue it seems. The Industrial DB's definitions have also been updating just fine.We purchased:1 FC-10-F101F-809-02-12 1 Year coverage for FortiGate 101F include:Hardware Advanced HWFirmware & General UpdatesEnhanced Support PremiumTelephone Support PremiumAdvanced Malware ProtectionFortiGuard IPS ServiceFortiGuard URL, DNS & Video Filtering ServiceAntiSpamFortiConverter Service 8x5FortiGuard Attack Surface Security ServiceFortiGuard AI-based Sandbox ServiceDLPWhats the deal? Am I going to lose IDS? Do we need to remove anything from our policies to prevent blocked traffic?These are several years old now and this has never happened before. It's just odd it's happening to both devices because it seem

I have a fortigate in the cloud that when the flow from a linux server passes through it, the source machine in question is on the Oracle Cloud internal network and the destination private load balancer is on another Oracle Cloud network, but I want to force them to communicate only by passing through the firewall. I can close telnet, which shows that the route is correct. I can connect to the destination, but when I try to execute the connection via the linux command line using SSL, it does not negotiate, giving an SSL Handshake error. The problem only occurs when passing through fortigate.If I go through the VPN in others to the same Load Balancer it works normally, only when the connection is coming from an internal network to another internal network that the error occurs. The tests performed were done both with NAT active and without NAT active, but in both tests the error persisted.

Hello,I'm trying to create a notification when my internet link is down to send a message by e-mail, but I'm getting 3 e-mails with DOWN and UP status, would you have a tutorial I can see where I'm going wrong? Another thing, would it be possible to send this by telegram or WhatsApp? I can't do it through teams because Microsoft is giving me an error in the apps. I'll send a printout of my settings 

hi,i plan to configure a couple of VDOMs in a FGT, one VDOM is our "main" internet VDOM connected to ISP (and downstream customer VDOMs).i plan to deploy another customer VDOM with eBGP integration.is this VDOM design/setup feasible? are there any "gotcha" that i should know?