Solved

Hi all,I read this article about restricting ipsec connections to certain countries.https://community.fortinet.com/fortigate-3/technical-tip-restrict-ipsec-vpn-access-to-certain-countries-94688When I attempt to implement it, I find that I cannot select any wan interfaces in an address object.In the article example (below image) it shows External (wan1) in the interface field but when I create a new address object it doesn’t show any active physical wan interfaces in the interface field.Would using the Zone that contains the wan interface work? We are running a Fortigate 81F with 7.4.12thanks

Greetings Im having some problems with my VXLAN over IPSec implementation. Im able to establish connection to the remote site. Telnet, SSH, RDP, VOIP is working fine but Outlook and some HTTP or HTTPS application don't work. I have read many article about this issue and all says that is a MTU or fragmentation issue. But I follow all the recommendation and nothing seems to work. First thing I notice is that VPN interface, Software-switch and vxlan mtu were set to 1370. I manage to bring the VPN and vxlan mtu to 9000 and Software-switch to 1500. My physical interface are all set to max mtu (9216). I also disable the honor-df bit but the maximum mtu that i can pass without fragmentation is 1472. And I think that is fine because 1472 + 28(header overhead) = 1500. But still cant get Outlook to work. I also adjust the mss in the policy to 1432 (1472-40). Also I lower my encryption to 3DES SHA1.My main FW is a 100F and the remote is a 60F. Im runnig 7.2.4. I will appreciate any

Sporadically our Fortianalyzer (7.4.9) will stop sending logs to our main syslog log collector (Is still collecting from other systems).  The “Log Insert Lag Time” will get up to 18 or so hours and keep climbing, when it should be like 20-30 seconds.   When the analyzer is rebooted, logs start to flow and the time slowly starts to normal, and everything is ok. I’ve been trying to get that value via a command line, or SNMP to feed our PRTG system to monitor when it happens before it gets out of control.  But, it seems to be allusive.  Maybe I’m missing something?  Perhaps there is another tell sign that I can look at?  Or is it a feature request?Thanks!

Hello, I apologize in advance if this sounds like a stupid question. I passed the NSE4 Certification Exam on June 18, 2024. I very recently heard that my certification would run out of validity if it’s 2 years old. I have to take the NSE5 Certification Exam, as I was unable to take it before, but I am unsure if my NSE4 Certification is still valid. Please let me know and thanks for your help!

Hello everyone,we have a customer who would like to generate a monthly report using FortiAnalyzer that includes the following information:WAN gateway availability over the reporting period (monthly uptime/availability) Reachability of defined WAN targets (e.g. public IP addresses or external services) from the FortiGate Information about when WAN failover events occurred, including timestamps A summary of all failover incidents within the reporting periodThe environment does not use SD-WAN. Standard WAN interfaces and failover mechanisms are configured.Is it possible to create such a report using FortiAnalyzer?I don't have any knowledge of SQL, and despite extensive research, I have no idea how to implement this. If necessary, I would recommend Fortinet Professional Services to the customer.Any guidance or best practices would be appreciated.Thank you.KRNiko

HiIs there a list of the available column names?I like to use:config system settings set gui-default-policy-columnsAnd I’m wondering how to include “Security Posture Tag” or “Hits”.Thanks

We recently upgraded from 7.4.4 to 7.4.5.In the meantime, the workstations have also been replaced with Windows 11 and are now Azure AD (Entra ID) Joined instead of AD joinedDeployment at workplaces is done via Intune / Patch my PCWhen I currently do a search in the Forticlient EMS console for an endpoint, I see the endpoint, but also 3 or 4 other endpoints in the search result. These "extra" endpoints can be seen with every searchI only expect to see the one endpoint I'm looking forIs there a duplicate GUID, Hash, or something like that somewhere?

I am currently preparing for the Fortinet Certified Professional (FCP) certification in Network Security. As part of my hands-on learning and practical lab setup, I have successfully installed the FortiGate VM on my local environment.However i am finding it hard to access the GUI of the FortiGate VM due to absence of a trial license.i have tried this commands execute vm-license-options account-id xxxx@fortinet.comexecute vm-license-options account-password xxxxxxxexecute vm-licenseIt showed the error "Requesting Forticare Trial license, proxy:(null)failed to download VM license"I would like to kindly request help in acquiring trial license for the FortiGate VM. This is meant exclusively for my study and practice and learning experience. Community help will be very much appreciated :'(

I passed my exam 7 days ago. I made mistakes with the registered email on PearsonVUE. I know know that was the problem. I should have used my company's email when I registered. I contacted Fortinet support to associate my FortiID but no response.https://ftnt.freshdesk.com/support/solutions/articles/73000524133 I contacted PearsonVUE, but they asked me to contact Fortinet. How? How can I reach Fortinet training support?They said I can create a ticket with them on the above link. But nobody is monitoring that ticketing system. Just wait for another 2-3 weeks? I need to provide it to my company. :( 

Can we use third party authenticator like google auth in Fortigate?

Dear Community,I have cluster on siteA with primary and secondary. Their ha interface connected with a direct cable. Also there are x1 ports in the hbdev configuration via a switch. Now I would like to add a third fortigate to the cluster but this is on siteB. The x1 ports are connected via switch on L2 between siteA and siteB. While the hb interfaces are only connected on siteA devices (primary and secondary) with direct cable without switch. Because the hbdv setting mirroring between the primary and secondary units, I think the x1 should be the higher priority in the hbdv setting. But what should I do with the dircet ha config? Should I have to remove it? Or should it remain in the hbdev config with lower priority as a “backup between devices on siteA”? In this last case the remote siteB new fortigate (subordinate secondary) will see its hb interface as permanent dead, and will ignore it?thank you

Can we use wildcard certificate for persistent agent? I have this log from the client when the Persisten Agent using valid wildcard certificate.Wildcard cert!Peername “nac.mydomain.com” matches wilcard “*.mydomain.com”Refusing to connect to trust_DISTRUST nac.mydomain.com|*.mydomain.comConnection failed! 1SslStreamtransport::disconnect()SslStreamtransport::disconnect() NOT joined rxBoostThread because this IS the receive threadSslStreamtransport::disconnect() joined threads, free-ing the SSL State

I use FortiClient on Windows every day for VPN and other company resource access.When FortiClient opens in web browser, I type the one time password digit by digit and it works.When I connect to VPN with FortiClient, it opens from Windows system tray, and typing a digit doesn’t move to the next digit box, so I need to hit tab after each digit. I do this several times a day and it’s so annoying I felt I had to submit this. Please fix this!!!

Please help meI want to set it up like this: I have FortiGate, a Ruijie managed switch, and several APs. FortiGate port 3 will connect to the switch, and the APs will connect to the switch as well. I want mobile devices connected to the APs to be on the same IP subnet as the FortiGate and Ruijie.

Hi all,I can see lots of posts about dual wan connections on the Fortigate with lots of solutions for different scenarios, however I'd still like some advice with my situation.We have a Fortigate 81F (firmware 7.4.12) at the main office.  It currently has one internet link (wan1).  This is used for internet traffic, as well as ipsec vpn from 4 remote sites.  These remote sites also use the Fortigate wan1 as their internet connection.We are using ospf to advertise routes between the main office and remote sites.  The Fortigate's default route is via our isp.We wish to get a second internet connection to connect to wan2.  This will be solely for the ipsec vpn; no link redundancy or load balancing (at this stage, perhaps in the future).  All internet access will be via wan1.In what I hope is a simple situation like this, would setting static routes to both wan1 and wan2 but setting a higher priority on wan2 be enough to prevent atttempts to use wan2 as the internet link?I see other option

We use 600F and hosted switches and APs in the 7.2.13 system.After testing and TAC confirmation, the 600Fwith7.2 system will discard multicast of tunnel SSIDs.Users cannot use Airplay to discover Apple TV through tunnel SSID,even though I have already configured multicast and IPv4 policies according to KB.We have two suggestions, either use 'set capwap-offload disable' or try upgrading to 7.4 or higher for testing.But we currently do not plan to upgrade to 7.4 because it is not possible to directly configure switch ports such as "loop gurad" and "stp budp guard" on the web management page, and these features are precisely the reasons why we chose Fortinet.I would like to know if Fortinet will fix this bug in FortiiOS7.2?Thanks.

I have successfull sync my entra id group to the fortinac, however if i add someone to the group then why the user is not synced in fortinac?Example i add user1 to group IT then if i go to System-Groups-Remote Groups then the member still empty.

Hi, i tried to deploy FortiManager following this doc: https://docs.fortinet.com/document/fortimanager-private-cloud/8.0.0/microsoft-hyper-v-administration-guide/449452/creating-the-virtual-machineAdded a second Hard Disk in “IDE 0” Show me this error, i tried to create Fixed and Dynamically (in differents clear installations) but same error appears even when i have enough space.After this error i cant type in terminal. Any suggestion? 

Good day,I would like to verify that  whether the local network configuration, such as static route, traffic with security files,  will stop when deregister the device from Cloud managment, no not.BrgdsLiu Wei 

Hi, I would like to filter out all the IP from network 192.168.11.0.  Could you guide what is value should I input? I try type 192.168.11.* , or 192.168.11.0 or 192.168.11.1-192.168.11.100. no correct result.  BrgdsLiu Wei 

Hello Everyone, I see that  /api/declarative is desribed in fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/7a380719-1f54-11ed-9eba-fa163e15d75b/fortiadc-v7.1.0-handbook.pdf The example is for posting system configuration (Simmilar to F5 DO declarative onboarding) but what about Virtual Servers to be created declaratively ? Something like F5 AS3 way to deploy Virtual Servers. Also is there such options for the WAF?

Hello everyone, I just encountered issue while connected Access Switches (specifically 148F and 124G) to our core switch 2048F. In our enviroment we have FGT 120G as perimeter firewall which is connected to 400F that serves as segmentation firewall and also as switch controller. 2048F is main core switch from which I have connected few access switches (148F and 124G). For some strange reason out of 9 switches only 6 came online without issue. The other 3 did not show up. Strangely I can see the ports leds blinking and if I go to FortiSwitch Ports and roll out the ports of the 2048F I can see the ports online with the missing switches serial numbers shown. The 3 missing switches would show up for authorzation I have waited approx. 30+mins. I have tried to add the FortiSwitches manually but they are still shown as “Offline”.Attaching screenshot from FortiSwtich Controler → Managed SwitchesThis is how it looks from Fortiswitch Ports menu (I circled the switches which I added manually and

Hello everybody,I hope you all doing well,I have some question for Forti web a-a setup as this is my first time updating I did my research and found that both nodes will be updated at the same time and there will be down time so is there any way like splitting the HA connection and try to update one of them then swap the traffic or am taking to much risk ? the upgrade path will be from 7.4.8->7.6.2->7.6.7what is the best way to prepare for such kind of operations I have previously worked with FortiGate's but only in Active-Passive clusters.Please advise as this is my first time trying to prepare for this Forti Web updates.Also have anyone tried 7.6.7 in production env ? it seems for me the most stable one and has no CVEs or known issues.Thank you in advance.

Hello everyone,I am preparing to deploy a brand-new FortiGate appliance for a customer and I have a couple of questions regarding the initial setup process.When I connected to the management interface for the first time, I was presented with a screen requiring FortiCare registration before proceeding.My questions are:Should the FortiCare registration be performed using the customer's FortiCare account, or is it acceptable to use our company's FortiCare account as the implementation partner? What is considered best practice? Does the FortiGate license/support contract need to be activated before performing any configuration changes, or can the firewall be fully configured first and the license activated later? What is the recommended procedure for license activation on a new appliance? Where can the license be downloaded or claimed? Is there an official Fortinet process or best-practice guide for onboarding a new FortiGate? I would appreciate any recommendations based on real-world dep

Hi Everyone.  today we was encountered the Fortigate Dynamic DNS issue in firmware 7.4.11 and 7.4.12. Restart the firewall few time still unable to access even ping google.com also unable to resolve but when PING 8.8.8.8 from Fortigate is reachable.  In the Network → DNS → DNS server show Primary DNS and Secondary DNS server is unreachable.  Even the host name unable to resolve