Solved

Hello: I have a Fortinet 60F, I changed the wan1 connection to Starlink, addressing mode dhcp and static route with dhcp too. If I enable wan1, the PCs can have internet with Starlink and with the other connection but the VPN drops, I have to disable wan1 for the VPN to work. I don't know if I have something else to configure or if the VPN is configured incorrectly, I have virtual IPs that point to one connection or another, I don't know if it is that, I attached one with the Starlink connection.We use forticlient for vpn connection.I hope you can guide me to solve these problems.Greetings

 Hi everyone, I could use some help today. We're experiencing some unusual WAN latency issues. We have a setup using a pair of FortiGate-120G and FortiGate-100F devices with a WAN configured in LACP with 2x1Gb links. The network connection is structured as follows: WAN ISP (LACP 2x1Gb) <----> 120G (in Transparent mode on VDOM) <----> 100F <----> LANWhen our WAN traffic increases, we notice a rise in latency, particularly visible with ping probes. Could this be an issue with the ISP, a security profile, or something related to NPU offloading or ASIC processing? Thanks

Please can anyone provide a brief description of what STP MODE within the FortiAP configuration is supposed to do when it is enabled? If it is related to Spanning Tree, how does the mode operate when spanning tree is also configured on the switch port is connected to?

I have done nse 7 public cloud security and nse 7 firewall before as everything is restructured. I am planning to undertake nse 7 public cloud security soon and nse 7 enterprise firewall and SDwan later.  As certifications have been restructured, will nse 7 cloud keep all my other certifications alive? #nse

hi we are using 2 600E in ha cluster, and today lot of complaint were received from end users that services got stop working. when i login on firewall the error was displayed as per subject and memory graph was in between 82-85%. We never faced this issue before so after few googling we tried to disable IPS but this did not help out (may be take some time to get memory down), so finally firewall was rebooted and secondary firewall becomes primary, memory goes at 67%.and everything start working fine.  can somebody please suggest1) how can we prevent this in future as our env is a very critical and cant afford any downtime due to this issue2) how can we generate an email alert if conserve memory threshold value exceeds 75% or is there any way to prevent this error occurring again?2) can we add more memory to device?

Hi Community, In FortiSIEM 7, is there a possibility to delete a case and the references? On the FortiSIEM Dashboard under Cases, a case has a Ticket_ID and Incident_ID.In my example, I have a 1 Incident_ID 121212 which links to 3 Ticket_ID's 33086714, 33086715 and 33086716. So far, I had to delete the Ticket_ID from two tables: phoenixdb=# delete from ph_incident_ticket_trail where ticket_id = 33086716;DELETE 1phoenixdb=# delete from ph_incident_ticket where id = 33086716;DELETE 1However if I lookup the Incident_ID, it keeps pointing to 33086716: phoenixdb=# select ticket_id from ph_incident where incident_id = 121212;ticket_id-----------33086716(1 row)Is it safe to update the field here with the before last ticket_id 33086715?Also, if I check under Incidents, the Active History still shows all 3 cases - how can I delete the references?         

Hi All,     I've noticed a difference between FortiManager and FortiGate that I want to understand, and I'm hoping someone can help.We have a group of FortiGates (v7.4.5 build2702) that were recently added to a FortiManager (v7.4.5 build2553). If I log into one of the FortiGates, I can see that we have an SSL-VPN setup that limits access to specific hosts and then has two groups of hosts - but the negate switch is turned on, which means anyone can try to connect EXCEPT someone in one of those groups:  When I look at the same config in the FortiManager, there is no negate switch, meaning only those groups can try to connect - the opposite of what we want:  My concern is that if I push the config from the FortiManager, it will not push the negate switch, and I'll lose access to the firewall as I'm coming through the SSL-VPN.If you're building a VPN from scratch, how do you configure the negate switch in FortiManager? Thanks

Hi All,Been searching through docs but haven't found a clear answer...What TCP / UDP ports are required for FortiClient to comm with a cloud hosted EMS? Is it all just over TCP 443?And then - with all the individual services (exe's) installed with FortiClient, which specifically will comm with EMS?If there is a doc published somewhere please share;Thank you!FortiClient FortiCloud Products 

Hello Fortinet Community,I am currently working with a FortiGate firewall 61F v7.2.6 setup where I have a VLAN switch interface named bgroup0 with a physical connection to internal3. The IP address assigned to bgroup0 is 192.168.1.1/24, and it is connected to an Aruba switch.The goal is to have new devices that connect via LAN cable to the Aruba switch send DHCP requests to the bgroup0 interface. However, for security purposes, I would like these devices to receive IP addresses from a different subnet, such as 192.168.2.0/24. I initially tried using a secondary IP, but due to subnet conflicts, this did not work as intended.I am considering configuring DHCP Relay on the bgroup0 interface to forward these DHCP requests to another DHCP server(internal2 or internal5) that is configured to assign IP addresses in the 192.168.2.0/24 range. However, I am uncertain about the exact configuration steps required to achieve this.Could anyone provide guidance or confirm if this approach is feas

I need to use Azure Front Door as a WAF up front to on-premis Fortigateand with the FrontDoor_Header_Check - used to Application Control function block whole traffic except FrontDoor ID and i'm not sure how to create/which parameters to used to custom app signature for this traffici have only X-Azure-FDID number, i can't find anythink corrent in to Azure documentation https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-apply-and-validate-a-custom-applica... is not really legibledoes someone have any experience with this and can give me any direction?

Hello everybody, I have a Fortigate F60 device (v 7.2.10).this Fortigate is implementing a conditional DNS for the Wi-Fi interface.For some internal domain, I registered some DNS records:192.168.1.1 is the router address.Normally, everithing works, fine. If I try to ping one of the registered names (for example vpn.xxx.com):   10.1.0.1 replies to the echo request. 10.1.0.1 is the Fortigate address.These are my network settings:  So far, so good. Now I try to connect via Cisco Secure Client to a VPN.Regarding network settings, nothing has changed. My address is the same, Router address is the same, DNS address is the same. The interface is the same, so, if I ping the same address as before, I expect 10.1.0.1 to answer (as before), but now: 79.9.x.x is replying. Who is 79.9.x.x? Is the Fortigate WAN interface:And the domain vpn.xxxx.com, if I put it into the browser, is not reacheable anymore, because I think DNS is not functioning correctly. What am I missing?Thank you fo

HI, i am trying to configure authentication with LDAP in my fortiweb just for admin user I configured:  https://docs.fortinet.com/document/fortiweb/7.4.5/administration-guide/410257/grouping-remote-authentication-queries-and-certificates-for-administrators#Configuring_tacacs https://docs.fortinet.com/document/fortiweb/7.4.5/administration-guide/286471/administratorsFortiWeb #ldap if i do a test user in the remote server configuration i get succeful, but if i want to loggin with the ldap user i am not able.   

Hello everyone,I am pretty new to Fortinet community and I need some help regarding the activation of MFA SMS functionality on Fortigate 60F 7.2.9. :)If I understood correctly, we have 2 options: getting a FortiGuard Messaging license or getting a 3rd party provider SMS gateway. Either way, the documentation says I need to configure SMTP server.Is it necessary to go through SMTP server, that is to go through email2sms or can I just go directly and define my custom sms-server (provider's domain) and sms-phone to which I want the OTP to be sent and if it is necessary why is that if it's not too much of a trouble explaining?

Hello All, The Microsoft Defender Endpoint vulnerability scanner is detecting the following vulnerable files created as part of the Forticlient 7.4 VPN Installer, all with the version number 3.1.5.0:c:\program files\fortinet\forticlient\libcrypto-3-x64.dllc:\program files\fortinet\forticlient\libssl-3-x64.dllc:\program files\fortinet\forticlient\x86\libcrypto-3.dllc:\program files\fortinet\forticlient\x86\libssl-3.dllThe listed CVE's against these files from MDE Show as:CVE-2024-2511CVE-2024-4603CVE-2024-4741CVE-2024-5535CVE-2024-6119Is the Forticlient 7.4 VPN software vulnerable to these CVE's because of the libcrypto/libssl dlls present in it's install directorys?

Hello everybody, some days ago I received this error on my Fortigate F60 (v 7.2.10):msg="User shutdown the device from forticron. The reason is 'System file integrity check failed'"I searched for this error and I found the following guide: https://docs.fortinet.com/document/fortigate/7.2.5/administration-guide/249947From this guide, I didn't understand very well. I'll try to explain:what I understood is that this error appears beacause BIOS security level is 2 (I confirm) and, because the firmware (as well as the AV engine etc.) is signed by the Fortinet CA and a third-part CA, this integrity check fails.Now, I have two question:1) Who is this third-part CA?2) If there is an integrity check error, how is it possible that the solution can simply be setting the security level to 1? How can we simply ignore this error?I think I'm missing the point. Can someone explain to me this concept in a simple way?Thank you so much!

Hi, I was trying to create dedicated HA management port for the firewall cluster but "mgmt" wasn't listed as option under HA config. Could you please advice if i have missed any configuration here.# showconfig system interfaceedit "mgmt"set vdom "root"set ip x.x.x.x x.x.x.xset allowaccess ping https ssh snmp fgfmset type physicalset dedicated-to managementset role lanset snmp-index 2nextendFW01 (mgmt) # endFW01 (global) # config system haFW01 (ha) # set ha-mgmt-status enableFW01 (ha) # config ha-mgmt-interfacesFW01 (ha-mgmt-interfaces) # edit 1new entry '1' added# set interface<string> please input string valueha interfacenpu0_vlink0 interfacenpu0_vlink1 interfaceport1 interfaceport2 interfaceport3 interfaceport4 interfaceport5 interfaceport6 interfaceport7 interfaceport8 interfaceport9 interfaceport10 interfaceport11 interfaceport12 interfacex1 interfacex2 interface# set interface mgmtnode_check_object fail! for interface mgmtAppreciate your response. TIA :) 

hi,i plan to configure SNAT in a FG with multiple VDOMs.i currently have the "internet VDOM" topology wherein "internet" VDOM act as our internet edge device and all downstream VDOMs will connect/flow through it to go to the public internet.my question, if i create a FW policy WITH SNAT in "VDOM-1", do i also create FW policy WITHOUT NAT in "internet VDOM" for traffic flow continuity?   

I have two phones that are not registering with Fortivoice that are behind a site-to-site IPSEC VPN. The reason in Wireshark is. I can ping both sides with no problem and the DHCP option 66 is configured.  There not much information about this in Google or any other documentation available. I hope anyone can help Spoiler (Highlight to read)NOTIFY sip:MACd476a0f758ce@xx.xx.xx.xx(Phone IP) SIP/2.0Via: SIP/2.0/UDP xx.xx.xx.xx:5656(FortiVoice IP);branch=z9hG4bKbK4f1731334589;rportRoute: <sip:MACd476a0f758ce@10.100.101.201>Max-Forwards: 20Contact: <sip:xx.xx.xx.xx;transport=UDP;handler=dum>To: <sip:MACd476a0f758ce@xx.xx.xx.xx>;tag=e9b466de-2d30-48e6-80c1-d33fc386c2adFrom: sip:MACd476a0f758ce@224.0.1.75:5060;tag=888888286Call-ID: 9c0ee096-b8a6-472a-ade1-66fa8cfb4affCSeq: 286 NOTIFYContent-Type: application/urlSubscription-State: terminated;reason=timeoutUser-Agent: FortiVoiceEvent: ua-profileContent-Length: 37NOTIFY sip:MACd476a0f758ce@xx.xx.xx.xx(Phone IP) S

Hello, good evening from here. Please, for days now, I've been struggling to setup the FortiEMS license, and honestly I'm feeling like giving up. I don't know if anyone will be kind enough to assist me through, and I'll greatly appreciate it. Thanks 

Hi All,i need to connect two building with FortiAP outdoor (Distance = 100M).Which FortiAP model should I choose? Thanks

Hello a far more general question As I hone my expertise in this tool,  what is the  threshold for how long it has been since a file is received? Do I wait a certain time?  what are others doing to handle general critical states that can show up in the health column as it goes red? I often times see these red alerts then go greenafter a time, but what is a safe time to wait, once they hit these threshold? Thanks in advance,Karl.

I am trying to create software switch and bind the SSID to tunnel wireless traffic. As I read, it is required to have software switch to perform internally pass traffic between VLANs. However; I have uplink ports added to 803.ad as aggregate links to the switches where access points are plugged in.  When I create an interface as software switch, I cannot add the ports that was already added to Fortlink as management therefore I cannot add the ports which already added to Fortilink to the software switch as member interfaces also to pass traffic to the SSID, do you know it is possible in any way to accomplish this add ports already in 803.ad aggregated link? 

Hi All, I have dual wan setup on my fortigate. Is there a way to set the "WAN IP" in the system information that always uses wan1 or wan2 ip? Thanks regardsJimmy

How can I extract the existing logs from a fortianalyzer version 7.4.4 to CSV? They are asking me for the last 90 days for a particular analysis.Within the team there is an adom who receives the 4 fortigates and it is required to obtain this information from all of them.I tried to do it Through API but the documentation is limited,Has anyone achieved it?I don't know if the logs already existing on the computer could be converted to csv in any tool?

Dear Members,I work in a support team at our company, and we have been facing the following problem:Users must change their Active Directory passwords on a company computer when the password expires or if they forget it.After that, users work from home on their personal computers and must use the VPN with the FortiClient.In this situation, they cannot access the VPN because the Windows certificate has saved the old password.To resolve this, we need to update the certificate.Is there any way to minimize support efforts? For example, could FortiClient prompt the user for the new password, or could the certificate be deleted when this issue occurs?Thank you in advance.