Solved

This is my first foray into the need for VXLAN and have some questions. My current site has a L3 Aruba switch, which handles my internal VLANs, an egress VLAN connecting to my FortiGate which connects to both a private WAN circuit to my data center (which in turn, provides Internet) and a backup Internet circuit for Internet failover and the IPSEC VPN spoke to hub (data center). Bought new building that we will be moving to, so want to implement VXLAN so I can use the same VLANs and subnets for all the new equipment going in so when we do actually move, it will be an easier transition. So the VXLAN config will be a temporary situation (no more than 6 months is my guess). From a design perspective, my idea is to implement the same low cost Internet "backup" at the new site, but it will be the main Internet connection until time gets closer for the move to add the higher dollar private WAN circuit as the primary. I will establish a IPSEC VPN connection between the two sites dir

Hi  Am running Fortinac v7.4.0.0427 (GA) and the Endpoint Compliance doesn't run when a registered host connects back to the network ,or it takes very long to do so ,6+ mins however if i scan the host ,the compliance action is executed .Any idea why this could be happening ?

Hi  I want to achieve this :When a registered host is connected ,its first put in isolation vlan until it passes endpoint compliance ,is this possible? I have set the default vlan as isolation ,however when a registered host connects ,its moved from isolation -> production then isolated.Thanks 

Dear all,A question about how FortiGate handles the communication with a SCEP server when the CSR is based on elliptic curve.As stated in this FortiGate article [1], a CSR based on elliptic curve can be sent to a SCEP server.In that case, and as specified in the SCEP rfc8894 [2]:"The form of encryption to be applied depends on the capabilities of the recipient's public key. If the key is encryption capable (for example, RSA), then the messageData is encrypted using the recipient's public key with the CMS KeyTransRecipientInfo mechanism. If the key is not encryption capable (for example, DSA or ECDSA), then the messageData is encrypted using the challengePassword with the CMS PasswordRecipientInfo mechanism. "That further says: "Note that some early implementations of this specification dealt with keys that were not encryption capable by omitting the encryption stage, based on the text in Section 3 that indicated that "the EnvelopedData is omitted"My question: when emitting a CSR based

Hi guys. I have an issue with this device. Aleatory, it would work for some days, other days it would not turn on the radios. The logs shows it constantly leaving and joining. Accessed the SSH interface, and got the following log. Every exactly 24 seconds it shows a "signal 11 (Segmentation fault) received". What does it mean?   FP221ETF18009026> crash1: 2024-11-25 10:45:23 <05543> $ 8: e5d33000 e0822003 e15b31b6 e28310022: 2024-11-25 10:45:46 <05753> firmware FortiAP-221E v5.04,build437b176,170810 (Release)3: 2024-11-25 10:45:46 <05753> application wtpd4: 2024-11-25 10:45:46 <05753> *** signal 11 (Segmentation fault) received ***5: 2024-11-25 10:45:46 <05753> Register dump:6: 2024-11-25 10:45:46 <05753> r0: 00a47790 r1: 00a47790 r2: 00a5778e r3: 00a577de7: 2024-11-25 10:45:46 <05753> r4: 0023d598 r5: 000000a5 r6: 00000008 r7: 000000008: 2024-11-25 10:45:46 <05753> r8: 00000000 r9: 00000000 r10: b6fe9f7c fp: bead4a2c9: 2

I am having problems when upgrading to the new version of FortiAnalyzer. The database recontruction gets stuck and does not progress. It has been taking the same time for days. This does not allow me to review and collect logs.

greetings all, I got the information as following from FortiSwitch, what is an Internal port and the usual reason why it shows so much drops? Port(internal) is Admin up, line protocol is upInterface Type is Pass Through without PHYAddress is E8:ED:D6:51:77:14,MTU 10000 bytes, Encapsulation IEEE 802.3/Ethernet-IIfull-duplex, 1000 Mb/s, link type is autoinput : 13316481778 bytes, 82631689 packets, 0 errors, 481076 drops, 0 oversizes42314 unicasts, 55849479 multicasts, 26739896 broadcasts, 0 unknownsoutput : 252618470 bytes, 1781502 packets, 0 errors, 0 drops, 0 oversizes25319 unicasts, 1754202 multicasts, 1981 broadcasts0 fragments, 0 undersizes, 0 collisions, 0 jabbers thanks you.

hi,i was trying out 'worflow' in FMG and already had a few session list/history.i can't seem to remove/purge old session ID, so i just disable workspace and re-enable it back to clear it.can the old session be manually removed from the list so that only new session will appear and be approved? 

I've set up an IPSenc VPN between a head office and a branch office, two F60 fortigates, but we can't access the head office network folders, when I put DNS on the network card it works perfectly, without DNS on the card I can ping and everything, is there anything I can do so that I don't have to put DNS on the network card?

Hello, On my Fortigate 100F I would like to create an admin user with following profiles:- Able to change the admin users password- Able to update the SSH key of users But I didn't find the possibilities to do in system/admin profiles.Thanks.

I integrate Starlink Maritine antennas on Yachts.At the time of delivery of the Yacht, the Starlink antenna is not activated.The antenna is then activated months later.I need to make a report that demonstrates the correct functioning of the antenna (I don't want advice on how to prove if it works, I want to do it with the Starlink app).With the Peplink devices that we use, by implementing the following rule it is possible to reach the antenna via the Starlink App even if it is not activated:- Outbound policy – ​​IP Address 192.168. 100.1 – Enforced WAN 1 (where Starlink is connected).Installations on Yachts include an antenna, power supply and direct connection to the Fortinet WAN.The Starlink router is not present.I tried with a static route 192.168.100.1/255.255.255.255 but it doesn't work. Is it possible to instruct a Fortinet so that when a user is connected via the App he can reach the antenna even if it is not active?I hope I was clear.I'm waiting for your suggestions

Hello,I can't find any document about FG-200E EOL.I know it end of sale but I need to know about end of support date and it has not exited at the product life cycle.Thanks.

Hi, Please see the below diagram which shows connection for fortigate SDWAN. My question is after adding two Cisco ASR1K in front of Fortigate, what special configuration do we have to add so that we can let the fortigate SDWAN work well? Thanks    

Using the menu "VPN Location Map" does show me a nice overview of the currently connected VPN connections (IPSEC, SSL VPN). However, the locations of the fortigate are most of the time somewhere in the Gulf of Guniea (0°S, 0°E). The physical location of all our fortigates is configured in FortiCloud (product details) with the address (street, ZIP, town, etc.). I did not find a way to set the device location in the fortigate GUI, nor via CLI. I checked with dia "geoip geoip-query <IP>" on each fortigate it's own location and it shows a somewhat accurate location (sometimes off by a lot, based on the ISP). So, I have several questions:How does the fortigate determine it's own location used for the VPN location map? From the location configuration in FortiCloud? (difficult, if not impossible)Via geo-ip query? (most likely)If yes, which IP is used in a milti VDOM environment with several WAN IP's per VDOM?Note: If I use "dia geoip geoip-query <my-wan-ip&gt

I have a problem with FortiClient VPN 7.4.1 on macOS 15.1.After launching the application, I configure the VPN, enter the IP and user, and save. I enter the password from the administrator, and a window to enter the token appears in the background, which immediately disappears - so I have no way to enter the token. How can I solve this problem? I went through all the tutorials and set the necessary permissions (notifications, disk access, network settings, and permissions for FortiClientProxy and FortiClientPacketFilter) in the settings. I also installed Visual C++ tools and the application several times, but the problem continues.

hi,we would like to use the lock feature when an admin is making change/FW policy push.my questions are:1. is it "safe" (no downtime/outgea) when enabling "workspace" in FMG? just want to "lock" or create workspace for a specific ADOM only.2. what mode do i choose and what's the best practice?3. do i just choose "workspace" then apply?4. what is per-policy lock?5.does a user always need to "lock" the ADOM and create a new "workflow session" when making a change? 

We recently updated to FortiClient VPN version 7.0.7.0345 for Windows. When users now start FortiClient VPN on their Windows machines, they get a User Account Control prompt Can anyone advise what has been changed in version 7.0.7.0345 that cause this UAC prompt to come up? And what we can do to, except lower the UAC settings, to prevent this prompt from happening?

I have a single, 8 hour, professional services support day banked.  I've got a couple of options on how to use it.  I've got a FortiManager license but I've never set it up and never used it.  I would also like to configure my FortiGate that's in my DR site with a VDOM so that I could have a "bubble test" that's segregated from everything else, but uses Corp IPs.  I've also never set up VDOMs or worked with VDOMs.  I'm less than sure I can accomplish both of these tasks in 1 8 hour support day.  Which one would you consider more complicated and I should use the support day for?

Is there a way to use Fortimanager trial in an airgap environment? The Entitlement Files not work because the Trial has no support.

Hello guys,We have Forgates 100F in our production with v7.2.8.I would like to configure encrypted logs sending to Syslog server. But I didn't find settings in GUI  nor CLI commands.Could someone tell me if it is possible to do ? If yes, how ?Thank you.

Some has installed 7.2.2 and 7.1.4 Collector version... The Super is at 7.1.3 I do not want to risk consistencies or malfunction as this violates the version compatibility rules ofCollector version <= Supervisor Versions.   Can I use the remote image server utility to send down a lower version or do I have to reapply the correct version  manually I cannot seem to get an answer where I look. Thanks, Karl

I've been searching through the Product Life Cycle info but I'm unable to locate the end of life date for the following models FortiGate-40FFortiGate-60FFortiGate-101F Is anyone able to help with this please Thanks & regardsSteff 

hi,we have FG-xx "F" in our environmentmy question is, since these FG have internal HDD1. is it "safe" to enable log "all sessions"?2. haven't seen much FG docs regarding syslog, is logging buffer "circular" in a FG, i.e. overwritten by newer logs?3. is there a default threshold or buffer size in the HDD by these "F" models? is there also a "preferred" FW policy sequence based on its specific purpose/criteria? this is to prevent an overlap or "shadow" FW policy. refer sample below1. DNAT using VIP2. SNAT using IP pool3. SNAT using Egress interface 

Hi all,I am working on a test machine configured to access the Internet via a proxy PAC script set to FortiProxy. At the moment, when I open the browser, the proxy authentication banner appears correctly; by entering the domain credentials, I can browse without problems.Now, however, I need to configure FortiProxy so that Microsoft Teams can bypass authentication. The goal is to allow Teams to run without requiring proxy authentication, while for other services the proxy login request should continue to work as it does now. What are the methods for doing this? Thanks in advance for the supportBR

I'm going to be taking a backup of 1 fortinet and then doing a LOT of massaging of the .conf file to restore to a different fortinet.  I'm wondering if anyone has used some kind of .conf "editor" program.  Something with a little bit more 'oomph' to do things than Notepad++.  I'm thinking features like being able to "collapse" a section without having to highlight the whole section and then hit 'hide'.  Back in the day when I used to write ColdFusion I used DreamWeaver to edit the code and it had features like that which it could parse for ColdFusion code. Has anyone used a code editor like this when modifying .conf files for fortinets?