Solved

Hello all, I am currently preparing QoS for a Dante audio network for some FortiSwitches managed by Fortigate / FortiLink. Dante needs at least priority for PTP (CS7, high) and Audio (EF, medium), and optional for other reserved traffic (CS1, low) according to following documentation:www.getdante.com/support/faq/how-does-dante-use-dscp-diffserv-priority-values-when-configuring-qos/ As far as I understood the Fortiswitch QoS concept, it should be sufficient to map the different DSCP values to different queue-numbers according to their priority (higher priority, higher queue) and to use the default "strict" scheduling, so that higher queues (e.g. the queue for PTP) are always serviced first. DSCP Mapping:CS1 to cos-queue 1 (reserved)EF to cos-queue 5 (audio)CS7 to cos-queue 6 (PTP) QoS Policystrict scheduling for all above named queues Port configurationMap the QoS policy to all uplink-portsTrust DSCP map on all Dante endpoint access ports Would you recommen

Hi Team, The site to site has already Up.From HQ to Branch Okay, everything can Ping and access.From Branch to HQ unable to ping and access.Route and policy has done on HQ FortiGate 80F.HQ - FortiGate 80FBO - Sophos UTM 9HQ subnet - 192.168.110.0BO subnet - 192.168.1.0, 192.168.3.0 Is it possible I need to add extra Route and Policy on the Branch Sophos UTM?  

Hi Team,I'm trying to Create an IPSEC Site to Site to a Sophos UTM.Below was my configuration in FortiGate: Just wanna to confirm that my configure correct or not as default. FortiGate  

 i have HUB & SPOKE scenario as shown in the picture with dual WAN connections one is DIA and the Second is private WAN Microwave Network and I configured auto discovery in to WAN interfaces and all spokes can access the HUB and spokes to spokes shortcut come up and suppose the internet VPN is selected first duo to aging time in BGP table when branch1 try to access branch 3 the shortcut tunnel come up and working fine but when the internet interface come down in branch 3 in example the microwave VPN tunnel not start between the branches . how can i configure this scenario to allow fail-over shortcut VPN ?Note the spokes to HUB fail-over working fine and no SDWAN Configured in this scenario and IBGP Multi-path and additional path is configured in all devices and the HUB playing as BGP router reflector

Hello Team,I am seeing something Weird. I am not finding firmware about Fortigate 30G. There is even no possibility to check upgrade path on that model on the fortinet support site. Is it normal ? is there anyone here who ever succeed to get firmware download on FGT 30G.  Please let me know, if you have information about it

Does anyone have a working cleaned config of ADVPN in a Dual Hub setup with BGP on Loopback and the spokes being full meshed to the Hubs? I have everything setup and all tunnels are running, but when it comes to the SDWAN SLA's the Hub1 is currently only utilizing 1 overlay. Tags and Policy routing have been applied. FortiNet doesn't have published configs on this setup (that I can find) due to the complexity however as of 7.0 (running 7.2.8) they do state in their design documents you no longer need the bgp per overlay, but I almost feel like I need to go back to not running BGP on the Loopbacks.  Basically just seeing if anyone has BGP on loopback up and running when spokes are dual ISP'd with meshed connections to the Hubs. Super simplified setup:Spoke1 ISP1 -> Hub1 ISP1 net 1Spoke1 ISP2 -> Hub1 ISP1 net 1Spoke1 ISP1 -> Hub1 ISP2 net 2Spoke1 ISP2 -> Hub1 ISP2 net 2Spoke1 ISP1 -> Hub2 ISP1 net 3Spoke1 ISP2 -> Hub2 ISP1 net 3Hub1 net2 and Hub

Hello everyone,I am new to FortiClient EMS and currently in a roll-out state. How do I prevent unwanted computers from connecting to the EMS? (EMS on-prem, running in a DMZ and public available to the internet) In theory someone can install FortiClient and connect to our EMS.I do install FortiClient for our users because they do not have admin privileges - so I did not enable user verification. Is there any other way to prevent unwanted devices from connecting to EMS?

Hello,I noticed a difference in the log view behavior after upgrading to FortiAnalyzer 7.6.1.In the current version (7.6.1), when I access the "Log View" section, all logs from my FortiGate devices are grouped together, without an immediate distinction between different devices.In the previous version (7.2.3), logs were displayed in a cascading format, and on the left side, it was easy to identify the originating FortiGate for each log entry.This change makes it more challenging to quickly locate logs from a specific device. Is there an option or configuration to restore the previous view?Thank you for your attention.Best regards,

Hello,I recently performed a fresh installation of FortiAnalyzer and am encountering an issue when attempting to add a secondary hard drive. Despite following the documented procedures, I am unable to complete the operation.Specifically:When using the "execute lvm extend" command, the process does not yield any meaningful result.The "execute lvm info" command returns the message "unavailable" on the disk 2I have verified that the added hard drive is visible at the hardware level, but it seems that FortiAnalyzer does not recognize or properly manage it through LVM.Could you please provide guidance on how to resolve this issue? Thank you for your support.Best regards,

 how many URL can be created in static URL filter? 

I have tried to download a FortiNAC demo from the support page to test on a virtual machine but it seems to be unavailable, do you know of any way to download a demo for Vmware, or is the web demo the only one available? I hope you can help me, thanks.

I'm using the forticlient with Ubuntu 24.04.1 LTS. After running an apt upgrade the forticlient was also upgraded from version 7.2.5.0854 to 7.2.7.0905. Now I'm no longer able to connect to my VPN.  I get the following error messages in the log file sslvpn.log:  20241217 17:58:10.901 TZ=+0100 [sslvpn:EROR] nmtools:255 Command to set ipv4.ignore-auto-routes returned with status 256. 20241217 17:58:10.901 TZ=+0100 [sslvpn:EROR] nmtools:1060 Failed to modify connection docker0 property ipv4.ignore-auto-routes 20241217 17:58:10.901 TZ=+0100 [sslvpn:EROR] dns:1007 Failed to finish Network Manager configuration 20241217 17:58:10.901 TZ=+0100 [sslvpn:EROR] vpn_connection:2072 Config DNS failed I have already removed some docker interfaces, which occurred before in the log as error messages, but I cannot remove the docker0 interface, only to get the client running.  I have also upgraded to the Version 7.4, but I get the same error messages. I tried

Hello Everyone,I want to configure DKIM on our Fortimail unit to sign outgoing messages, but I have a lot of questions that I need your help with. First of all, our Fortimail unit is 200F unit, working in transparent mode. We have 2 protected domains configured inside this unit. The two domains are MS exchange serversFor my questions:Can I configure the DKIM signing in Transparent mode, or it should be in gateway or server mode for this to work?If it is applicable in transparent mode, and I successfully configured it, will this configuration be affected or stop working if I change the working mode of the fortimail unit to gateway mode?Do I have to make a record for the DKIM inside my exchange servers internal DNS, or it should be published only on the external DNS?Does the protected domains SSL certificates have to be imported inside the Fortimail, or the DKIM has nothing to do with the certificates?Is it better to configure the DKIM inside my exchange servers, or it's better to be con

Hello, we just put in 2 branches a FG 80 cluster with 7.4.5. Both connected to Arruba Switch with ISP A Internet Access and ISP B 5G Failover. Our ISP now comments that the 5G router are in dormant and they dont reveice the VRRP events. Since router and 5G backup are connected to the switch I dont see why we should configure multicast policy. Trying out with multicast policy we risk some strange behavior with the Fortigates? Thanks!

Looked at the admin guide, and the example it shows, is www.google.com (As a subnet object???)Need to add a simple subnet object like "192.168.0.0/16".  Is this possible?I have many address objects of type Subnet, that were created in a FortiGate before FortiManager came along.  When trying to add in FortiManager, It clears the subnet address I try to add within IP/Netmask and then says "Invalid IP address"Does FortiManager have a different concept of a subnet address object than the FortiGate does?I know I can add an IP range (probably), but that means I have to go through and edit "all" of the exiting definitions. In the FortiGate, when adding a subnet object, I can name it something like "sn-bob" and it does (or at least did not previously) require that it resolve to anything. I'm hoping that I am missing something stupid. 

We recently upgraded multiple FortiGates (60F through 2600F) to 7.2.8 the day after the latest release was made available. Last week, one of these (60F) stopped passing traffic. We could ping the management interface and could do a "tnc -p 443 <IP>" where we'd see the 3-way handshake in a packet capture, but the login page would time out. We tried to console in - there was no prompt, but it'd echo back what we typed in. I did try an "exec reload", but nothing happened. But then, we couldn't get authenticated. This firewall required a hard reboot to bring back online. The only significant things in the system logs were these two events: - Critical: Kernel enters memory conserve mode- Critical: Kernel enters extreme low memory mode This was just a few msec after an antivirus update, but I'm not certain if they are related. We had the exact same thing happen today on another FortiGate. We have an upgrade scheduled for the main hospital this Friday, but I'm very hesita

Hi all, I have a problem, Fortinet support have been less than useful. FortiGate  We have a cloudflare Zero trust setup that stops any DNS requests to malicious sites. What I want to do is intercept these requests on the Fortigate before they get to Cloudflare.In the past I have been manually adding eachnew site that cloudflare makes me aware of, this is time consuming. I have been on leave and returned to over 100 URLs to add to the DNS filter on the Fortigate. I was hoping to just import a csv or text file of the URLs into the Fortigate DNS filter list. Apparently this is not possible. I have seen some talk of using a cloudflare API to do this but not sure how. Has anyone found a way to do this. The Stock Frotinet answer of "put in a new feature request" is laughable when solutions are needed quickly and when we all know, that feature will never get added. I don't know why they can't have a plain text input for the list. E.G. on our smoothwall

 Our setup is such that we're trying to get our FG1101E to act as both router and firewall with BGP routing. We have our ISP provided single fiber uplink at 10gbps (SFP+) which has a defined Point to Point IP /29 IP address that's used to peer with a BGP neighbour. The BGP side of things appears to work ok, with our prefix for public IPs are being advertised and received to our ISP, and they are sending at default route to us. What we're trying to achieve is to be able to egress to the web using an IP on the advertised prefix, these are public IPs assigned to us as an organisation.  We're able to use them in the context of an outbound rule, for this to work we have to create an IP_Pool overload object and use that in the rule which shows to the world we're coming from an IP we own. If we don't do that, then our IP is shown as the BGP peer IP. We are trying to get to a place where we can use some sort of virtual interface with the IP loaded on fro

Hello everyone,Since we did move to FortiClient EMS end of last year I do want to start diving into ZTNA now: I do have a VLAN that is not connected to my windows domain server (Domain Controller, File-Server, ...). This VLAN is for third party machines and computers (robotics, PLC, IOT devices, ...)Now there is a use case that some of our plc programmers want to work in this specific VLAN for the ease of access to the robotics but also need to access e.g. windows File-Server. What is the easiest way to set it up? Basically I was thinking about creating a policy that only allows FortiClient EMS managed devices. I do see the ZTNA Tags created from EMS in the FortiGate. Should I go for the "IP/MAC Based Access Control" in a "standard" FortiGate policy where I can secelt the ZTNA tags? Or do I need a full ZTNA policy?    ZTNA policies documentation seems to often point into a kind of webserver scenario - that is not really needed here. So do I need a ZTNA ser

My new 60F Wi-Fi will only do 5 or 2.4ghz which I think is normal.I am using 2.4ghz since one device is IoT and likes 2.4ghz only.Many devices are happy but the 16 Pro is not - I tried a few settings and channels (3 choices) and it wont connect.Any ideas please?

My aim is mainly blocking bad sites (malware, C2, phishing) not controlling certain types. Web filter and DNS make sense, though perhaps are a tad similar. ISDB seems to offer some IP blockers. Would ISDB cover my wish by blocking connections pre/post malware to malicous domains (IP behind)? Thank you

Hi, I was wondering if someone can help me on this. I am very new to networking and would like to check if I can do IP address translation on a layer 2 device with address 192.168.199.2 on my VLAN2 going to VLAN 1 with subnet 10.156.116.0/22. My intended translated address is 10.156.119.2 for this layer 2 device and will be using a kepserver ex v6 device from the vlan 1. Hope someone can assist me. Thanks

Hi Everyone,  we like to monitor our local SSL-Certificates from our Fortigate with PRTG to E-Mail us when the day of experation is near. has Anyone found a posibilty to do so ? I looked for a solution the last day an didnt found any.  Greetings!     

Howdy, I just have a question on a firewall policy that I have been playing around with. I have an IPSec tunnel between my agency and our parent agency allowing traffic to 2 subnets on their end (192.168.139.x). On my end, we have a supernet (172.19.41.x) passing clients using their application to their servers over that tunnel and everything is working well. However, the local LAN at my agency (192.168.56.x) is on a subnet that conflicts with one at the parent agency's, so we cannot pass that traffic over the IPSec tunnel. In an attempt to get around that, I created a firewall policy to pass the traffic but with a NAT IP Pool that falls within the allowed supernet, so the conflicting 192.168.56.x subnet is disguised as the allowed 172.19.41.x subnet. This works going out but does not work coming in. I can ping the parent agency's application server, but I can't connect to it from one of the end user computers. I have the two firewall policies for this below (sanitized), can anyon

Hi, In log view or FortiView I'd like to see netbios / host names next to the IP address - or as a column - for each entry. This would save me from doing individual reverse lookups in our internal DNS.  I've looked at the settings and added columns for "host name" but they are not populated.  Am I missing a setting somewhere to achieve this?