Solved

Hi,I am getting the same error message same as in this KB: Incompatibilities with NGFW Policy mode d... - Fortinet Community Already tried to use a Custom Application Group, but I'm still getting the same error message:"app 43322 is incompatible with NGFW Policy mode due its large scan-range detection requirements." Is there any other way to resolve this? How do I know which value to input if I adjust this part of the configuration?config ips global    set ngfw-max-scan-range 4096end 

Hi,  Can 2x 10 GE SFP+ FortiLinks ports be used as WAN or LAN ports? If yes is there any document to set as WAN or LAN?Upon checking the datasheet they have already GE RJ45 WAN Ports.  Thanks!

Dear Fortinet Support Team, I am currently facing two issues with my Fortigate 60F device, running firmware version 7.6.1, and I would appreciate your assistance. 1- Enabling Explicit Proxy:I am trying to enable the Explicit Proxy feature on my Fortigate 60F device. However, I am unable to find this option in the "Feature Visibility" section. Could you please guide me on how to enable this feature or help me identify why it's not appearing in the list? 2- Advanced DLP Features:The "Advanced DLP Features" are currently disabled, and I received the following message:  To use the advanced features, the main Data Loss Prevention feature must first be enabled in Feature Visibility or via the CLI: config system settings set gui-dlp-profile enable end Unfortunately, I received the following error message:  command parse error before 'gui-dlp-profile' Command fail. Return code -61  Could you kindly advise on how to resolve this issue and suc

Hello everyone,How can I configure FortiClient VPN (full-tunnel mode) to:Use internal DNS server (e.g. 192.168.1.x) for resolving internal domain names onlyUse public DNS (8.8.8.8) for all external domain queriesAvoid the current 6+second delay caused by failed DNS resolution attempts to internal DNSCurrently, all DNS queries first try the internal DNS server before failing over to 8.8.8.8, causing noticeable delays. I want to maintain full-tunnel mode for security but need more efficient DNS resolution.I am attaching screenshot an nslookup and the tunnel configuration so you guys have a clearer understanding and hopefully can help me.

Hellowe have a problem that we unable to allow fortitray. If we try to use Forticlient VPN only version to connect to our vpn, it prompts a windows that Fortitray needs to be allowed. If we press on open security & privacy it just shows the general screen of security & privacy and not the windows where you can allow fortitray. We were using Forticlient 7.0.3 and upgraded to 7.0.7 but the issue persists.

Hi,Hoping that someone could help in regards to the correct OID required to query FortiAuth-VM in order to get the number of FortiTokens available for usage, since the one I've found in a old forum post is not returning the correct value - https://community.fortinet.com/t5/Support-Forum/FortiAuthenticator-OIDs/td-p/228761 Upon querying, 1.3.6.1.4.1.12356.113.1.202.6.0 , I get a value of 244 which is more than the total amount of registered/available tokens in FAC-VM. iso.3.6.1.4.1.12356.113.1.202.6.0 = INTEGER: 244FortiToken MobileUsed: 148Populated: 155Available: 7Disabled: 0 Using .1.3.6.1.4.1.12356.113.1.202.3.0 returns the correct amount of tokens since I also got 1 Yubikey registered (populated). iso.3.6.1.4.1.12356.113.1.202.3.0 = INTEGER: 156FortiToken Mobile / Yubikey TokensUsed: 148Populated: 155Available: 7Disabled: 0Used: 0Populated: 1Available: 1Disabled: 0I am trying to create a plugin in the internal monitoring platform in order to

Hello,I'm trying to dedicate one wan link to a server in my infrastructure. I'm using a cluster of 601F, 3 Vdoms (Root, Internal, housing). The wan i want to use for my server is already NATed (ISP router cannot be set in bridge mode....) So i created the wan interface, using a private IP (192.168.10.10/24) on one VLAN interface of my root Vdom. Firewall is able to ping the ISP router But then i can't understand how i'm supposed to route traffic to/from my server through the 2 vdoms ...Do i need to create a VIP on the root vdom, pointing to the IP address of the internal Vdom on the Vlnk and then another VIP on the internal Vdom pointing to the server ?Is there any other solutions ? Thank youMatthieu  

For MAC-based filtering, please ensure the below points What is the maximum limit of MAC addresses that can be added?If we utilize the maximum limit of MAC address entry, is it to be cause any performance-related issues on the wireless controller (FGT) and FAP?Is there any option to import bulk MAC addresses from FMG at once or to add multiple MAC addresses one by one?

Hello everyoneA few weeks ago I was looking for a solution with the following post.....https://community.fortinet.com/t5/Support-Forum/Fortigate-7-6-1-policy-with-timer-and-passwort-release/m-p/365986#M259639Unfortunately it's still not the solution I want.I'm still looking for a way to somehow create a "session timer" with my Fortigate.I'm looking for a way to limit my children's devices, which are all enabled with fixed IP addresses via policies, so that an IP session can only access the Internet for 1 hour per day.Again for information...I am NOT looking for a solution with the scheduler because the internet hour is NOT at the same time every day.I'm looking for a solution to run an IP session for 1 hour daily.The solution with the web filter is very laborious and cumbersome (post with URL above).Don't you have another idea how I could implement this?Thank youGreetingsSwiss daddy

hello team i have uploaded VM licence but the status is Serial-Number: FGVM00UNLICENSEDLicense Status: No LicenseLicense Expiration Date: 2024-03-04VM Resources: 1 CPU/0 allowed, 985 MB RAM/0 MB allowedLog hard disk: Not available --- PLEASE HELP---

Hi there! Is it possible to install the same single policy to say 5 FGT Clusters from Forti Mrg, but each of the 5 Clusters has different interface names? The same single policy will be pushed to each Cluster as a Global FW policy not a VDOM.............or is the only way via a VDOM with normalized interfaces from the FM? later mapping INTERNAL interface to Port1 on Cluster-1 and INTERNAL3 on Cluster-2 etc.........  

Hello i have a problem when i set ha-mgmt-status with port mgmt1 I set vdom root in fg vm v 7.0 in this port but i cant port with the ip i assigned to this pruporse. FortiGate-VM64-KVM # show system interface mgmt1config system interfaceedit "mgmt1"set ip 192.168.25.3 255.255.255.0set allowaccess ping ssh httpset type aggregateset lldp-transmission enableset snmp-index 25nextendFortiGate-VM64-KVM # FortiGate-VM64-KVM # execute ping 192.168.25.3PING 192.168.25.3 (192.168.25.3): 56 data bytes64 bytes from 192.168.25.3: icmp_seq=0 ttl=255 time=0.6 ms64 bytes from 192.168.25.3: icmp_seq=1 ttl=255 time=0.1 ms64 bytes from 192.168.25.3: icmp_seq=2 ttl=255 time=0.2 ms64 bytes from 192.168.25.3: icmp_seq=3 ttl=255 time=0.1 ms64 bytes from 192.168.25.3: icmp_seq=4 ttl=255 time=0.0 ms--- 192.168.25.3 ping statistics ---5 packets transmitted, 5 packets received, 0% packet lossround-trip min/avg/max = 0.0/0.2/0.6 ms  ortiGate-VM64-KVM # show system haconfig system haset gr

Hello team!!!Happy new year to everyone using gregorian calendar!! I have the following 3 questions about Fortigate:1) To block phishing I am using web filter, is there another Fortigate feature to add, to help blocking phishing attempts?2) Is there any place in the Fortigate where I can see security alerts for applications installed on computers?  I dont think so, but I'm asking just in case3) You know another feature to block suspicious network activities in addition to DOS rules and IPS profiles?This is for all the traffic comming through the Fortigate, not for traffic between 2 computers in the same LAN, of course. Thanks in advance.Regards,Damián 

您好，客户的 foritgate 60f 防火墙已购买 ATP 和工业安全服务的许可证，并将在生产环境中以透明模式部署。我想了解一下在这个环境下如何完成防火墙部署，这个部署有哪些注意事项，以及如何使用工业安全服务特性库

Any one knows how to change the loginscreen title or name -> FortiAnalyzer-VM64-KVM to a different name ? I have tried the following config system globalset platform-name <new-name>endIT DIDN'T WORKED

Fortinet changed the way local-in-policies are created when an interface is part of an SD-WAN zone. From 7.4.6 and 7.6.1, the local-in policy is assigned to the SD-WAN zone instead of the interface as explained in the article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Local-in-Policy-is-Missing-after-upgrading-to-v7-4/ta-p/367001 This is great, however I'm dealing with issues now when I change these local-in-policies on the FortiManager. We run FortiManager 7.4.6. FortiManager 7.4.6 appears to not understand this new behaviour. I get a warning that I can't assign a local-in-policy to an SD-WAN zone when I create a local-in-policy in a policy package that's only assigned to firewalls that run FortiOS 7.4.6. That's quite annoying when you manage all your local-in-policies from the FortiManager. Is this intended behaviour in FortiOS 7.4.6 and if so, is there a fix on the way to bring this in line with FortiOS 7.4.6?

Hello,We are trying to switch our EMS authentication server from LDAP to LDAPS.  LDAP works fine.We have ports 389 and 636 open on our FortiGate firewall.  After inputting our local CA certificate and clicking Test we get a Network error message at the top.We are using the local CA certificate from our Windows server 2019 domain controller/Certificate authority by exporting it in DER format.  We have also tried that same domain controller server certificate, which is what EMS is syncing with today.Any thoughts about what could be doing wrong?  Could it be the certificate export process or maybe something else?Screenshot below.

Happy new year everyone.I want to authenticate a user through the Forti API, after the user finishes to authenticate against a 3rd party captive portal.I figured the API command would be: https://FORTI-IP/api/v2/monitor/user/firewall/auth?vdom=root{"users": [{"ip": "10.235.1.50","ip_version": "ipv4","method": "firewall","user_type": "firewall","username": "test4"}]}But I'm getting 424 Failed Dependency.Unfortunately I don't know what parameter is missing and I do not have access to the developer portal to read the documentation.FYIDeauthentication works fine like this:https://FORTI-IP/api/v2/monitor/user/firewall/deauth?vdom=root{"users": [{"id": 0,"ip": "10.235.1.50","ip_version": "ip4","method": "firewall","user_type": "firewall"}]} 

Hi Everyone, I'm having 10 years of experience with Palo Alto's. We make heavy use of their URL filtering and Application Detection.In our environment it's not possible to decrypt any traffic, yet the Palo could block all URL's (based on SNI, certificate names etc) but here with the Fortigate Eval License it even refuses to block any webpage using the URL filtering - I've tried "youtube.com", whatsapp.com, facebook.com and none of these work and I'm refusing to believe that this isn't possible with a Forti without decryption. What I've done:1. Security Profiles -> Web Filter -> Create New -> Checked URL Filter (Static URL Filter) and I've choosen Wildcard, Block, Enable for *facebook.com* / *whatsapp.com* and "*youtube.com*"2. I've made sure the Filter is set in "Flow Mode" and hit OK.3. Created a "Firewall Policy" under "Policy & Objects" that includes this Filter:Accept, All, All, All, Flow-Based, Web-Filter checked and choosen, SSL-Inspection left on "no-inspe

Please help me configure a policy for one connection. FG-60E (firmware v.7.2.10) works in transparent mode between optical modem (also in transparent mode) and main router for LAN. External IP address is on router, not on modem. When Inspection Mode works in Proxy-based (Firewall Policy), one of the devices in LAN cannot communicate with its server where it sends measurement data (blitzortung.org). Policy in Flow-base mode does not block the connection. It blocks only in Proxy-base. Is it possible to set Flow-based policy for selected remote server? Or add some exclusion in current policy? I know the addresses of servers to which data is sent.

Hello there,  I try to to slim down our Stack by getting those things mentioned in the Subject directly from FortiManager instead of all the Fortigates directly. Is that possible ? - Haven't found anything in the API Docs. API or Mail Event would be prefered.  Thanks!

Hi Forum,I have configured "host negated" and added a group of countries (block_country) on vpn-ssl settings to avoid ssl failed login attacks but a user need to connect permanently from a country who is on the group mentioned above. Is there a trick to bypass the current config and allow a remote ip from a country forbidden ?Thank you for your help.Regards

New setup with a 60F on 7.4.6.With 3 interface: WAN (6.6.6.6),Vl10_Users(10.0.10.1/24),Vl20_Servers(10.0.20.1/24)I did a rule that allow traffic between Vl10 and Vl20 with no ''inspection profile''.When NAT is disable on this rule trafic doesn't work between a host in Vl10 to another host in Vl20.Has soon I enable the rule with NAT, the host in Vl20 see traffic originating from the host on Vl10 with it's NATed IP.I don't want to enable NAT on this rule in order to see the originated source IP on the host in Vl20.Both hosts have they gateway pointing to the corresponding interface on the FW.I should not have to Nat traffic when routing should only be involved. I can do some show or debug if needed.Rule in question:set name "Allow_All_To_DNS"set uuid ...........set srcintf  "VL-10_OLD_LAN"...set dstintf "VL-20_SRV"set action acceptset srcaddr "all"set dstaddr "host_10.0.20.20_DNS-SRV"set schedule "always"set service "DNS" "ALL_ICMP"s

Hello Expert, I would like to setup client server vpn, but would prefer to use a customize setup as instead of ADVPN (I have move control of the setup)I notice the option to use dialup user for customize setup can I use this option Instead of the ADVPN?I humbly request some guidance   Thank youRegards 

Hi Fortinet Community, My address object is edit "Wifi-address"set type interface-subnetset subnet 192.168.0.0 255.255.255.0set interface "Wifi-interface"next how ever my interface status is unused/disable/down edit "Wifi-interface"set vdom "root"set ip 192.168.0.1 255.255.255.0set allowaccess ping fabricset status downset device-identification enableset role lanset snmp-index 8set interface "port4"set vlanid 888next ...  however, I am use the same Address Object to use in new Firewall Policy but using different interface in source/destination like source is port9 destination is wan1. the policy can created. i ask ChatGPT, is this possible? Behavior with Disabled Interface:When you disable an interface, FortiGate may interpret that the address object no longer has a valid binding, effectively treating it as "unbound." This could allow the address object to appear in policies for different source/destination interfaces.This behavior can be se