Solved

Our firewall (FortiGate-500E v7.0.14, build0601) is currently experiencing issues with upgrading to newer firmware versions. There are two options available: versions 7.2.7 and 7.2.8. However, the release notes for version 7.2.7 indicate a bug affecting IPsec tunnels, while version 7.2.8 has a known issue with routing and SD-WAN How should I determine the most suitable version for the upgrade?known issues: 7.2.7 -->> https://docs.fortinet.com/document/fortigate/7.2.7/fortios-release-notes/236526/known-issues  known issues: 7.2.8 --> https://docs.fortinet.com/document/fortigate/7.2.8/fortios-release-notes/236526/known-issues    

To a Virtual Server is it possible in Load balancing method selecting "HTTP Host" and "Round Robin" at the same time?As it is now with "HTTP Host" it looks like it uses Static with the 2 Real Servers. 

Hello,I now have new parser. When I go to the Admin -> Device support -> ParsersI can see my parser I try to check the box in the Enable columnit then opens the parser window showing the code. Here you can see the Enable state is checkedIf I pick Validate it validates if I select Test it tests successfully. if I select Save it says parser not validated or test failed which makes no sense. If I select cancel it just take me back to the list view of parsers.it is stuck in some kind of loop, there is no way for me to enable the parser , I cannot get to the Apply option.also if I start in the list view and select Edit it takes me in the parser code where again I select validate and it validates and then I select test and it tests successfully, but Enable is greyed out via this menu path that I take.

Estimados, tengo una política de navegación que esta aplicando una inspección ssl "certificate-inspection" con el metodo "inspeccion de certificados ssl" y en el navegador de un cliente que esta bajo esta politica me sale el siguiente error al abrir un enlace de unidad .google.com "Fortinet" no se ha instalado correctamente en tu ordenador o red. Póngase en contacto con el administrador de TI para resolver el problema. net::ERR_CERT_AUTHORITY_INVALID Asunto: *.google.comEmisor: FG200FT920905021Fecha de caducidad: 30 de diciembre de 2024Fecha actual: 29 de octubre de 2024como solución me indica que instale directamente el certificado en la máquina, lo cual ya realiza, pero sigue el mismo evento.Que mas podria realizar para solucionar este inconveniente 

Dear,Following the guide (https://docs.fortinet.com/document/forticlient/7.4.0/ems-administration-guide/701440/configuring-a-profile-to-allow-or-block-endpoint-from-vpn-tunnel-connection-based-on-the-applied-security-posture-tag) i'm trying to create rules in order to block for i.e:endpoint with critical vulnerabilities to connect vpn. But in my console i do not have the option like showing in the link: Link console: My console:

Where can I found EOO, LSED, and EOS of fortigate 201F, fortigate 60F, and fortigate 201E? I just downloaded the list of hardware EOO from fortinet support, but i can't find this three on the list.

DearsI have fortiGate SSL and IPSEC RAVPN, i need to force user to change password.any guide please

hi,would it be possible or does it make sense to have a multi VDOM FG managed in FMG to be in separate ADOM?for example, the "core or critical" VDOM such as the "root" and "internet access" are added in the "root" ADOM, then the rest of the "customer" VDOMs would be provisioned/managed in a separate ADOM. we'll deploy an "internet access" VDOM deployment. refer to sample diagram/scenario.the root VDOM in the diagram will be our "internet access" VDOM, like an internet edge device. the rest of the customer VDOM will connect (vlink) to the root/internet access VDOM.  

Hi,we have a colleague that wasn't able to connect to our VPN due to a unrequested route added by 7.4.0.1645 version of FortiVPN VPN-ONLY client.  default via 192.168.1.254 dev en6 default via 192.168.1.254 dev en0 default dev utun13 scope link #this is wrong  Could this be a bug or a misconfiguration? Regards,Dimitri

May I know can i connect Fortinet Client VPN which laptop in Singapore but connect in China?How about remote dekstop?

hi,i received a new FG-1800F and saw there's 2x ha and 2x mgmt ports.my question is, can i just utilize/configure only one of these? i.e. use ha1 and mgmt1 onlyor is there a config guide/design to follow wherein i have to use both? seems it will use a lot of switch ports since we're using A/P HA.what are some common design/scenarios for using two ha and mgmt? # show system interface name    Name.fortilink   static   0.0.0.0 0.0.0.0  10.255.1.1 255.255.255.0  up   disable   aggregate  disable   ha1   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   ha2   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   l2t.root   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up  

Hi All, I have a FortiSwitch which managed via a Fortigate controller. Does anyone know how to create an automate task to automatically shut a switch interface when a cable is disconnected and then only can be then enable again by an administrator? Thanks regardsJimmy

This version of FMG was released last week and now CVE-2024-47575 is released as well.https://www.fortiguard.com/psirt/FG-IR-24-423However, the release notes doesn't have anything in the resolved issue section. Does this actually have the vulnerability fix in it?https://docs.fortinet.com/document/fortimanager/7.2.8/release-notes/972111/resolved-issuesToshi

When clients work remotely and connect VPN via FortiClient it takes too long to get the access to the shared drives after connecting with FortiClient, sometimes it takes more than 20 minutes show up the network drives. Any ideas?Thanks 

Hey all, I have FortiGate 80E firewall (v7.0.7 build0367) with DHCP range 192.168.9.100-192.168.8.250 I'd like to add 25 slots to that range by increasing the starting range from 192.168.9.100 to 192.168.9.75). My question: Can I make this DHCP change in real time? Or will it affect DHCP users, static IP users, VPN users, and my access to the local FortiGate portal?

Good morning, I have a question about what is the best way to update/register a Fortigate 40F behind another Fortigate? There is a big rollout coming up, we want to replace all of our Fortigate 40C with Fortigate 40F and I would like to send the fortigates up to date and registered. We have a lot of small branches and usually we configure new Fortis at our main location just to get them online after they arrive at one branch. Then we register and update the Fortigate, this obviously causes an internet loss.I’m kinda shure that there is a better way, but I can’t figure out how to do it. First I tried to update the firmware manually. But after one successful update I receive this Error-Message:This is a FortiOS v7.6.0-build3401 firmware image that cannot be installed because the device's FortiGuard license for firmware upgrades could not be verified or may have expired. Verify or renew the license to install upgrades.If I understand that correctly the Fortigate needs internet a

Hello everyone, I am running a Fortigate with FortiOS v7.4.5, where the default VLAN traffic arrives untagged on the LAN interface. Currently, several networks (e.g., 10.0.1.0/24 and 10.0.2.0/24) are operating over this interface.After assigning a secondary IP address to the interface (10.0.1.3/24), routing between the two subnets works as expected. However, the security policies configured between these networks are not being enforced. I have reviewed some relevant articles, but the suggested solutions do not seem to resolve the issue. According to these Fortinet Technical Tips, the traffic should be blocked by default and then allowed through the appropriate policies:Allow traffic between different subnets with the same VLANHow to allow traffic when using the same logical interfaceI have tested this in a lab environment, and as expected, the traffic between the subnets is routed, but the configured security policies are not being applied. Is this behavior expected? Are

Dear all, I'm new to FortiEMS. I have done the fresh installment as a VM using the trial license. Our current architecture is: FortiGate + FortiAuthenticator. The user are connecting to VPN (SSL-VPN) using FortiGate + FortiClient and FortiAuthenticator as a MFA. We want also to add FortiEMS as a layer to do a posture check for the device prior of giving them permissions to connect remotely to the company resources. We have users with a company joined AD laptop + BYOD devices. I'm trying to understand: 1- Where will the FortiEMS stand in the "big picture" at the architecture level ? Will it replace any of the components ?2- Do i need to connect FortiEMS with FortiGate ? If yes, will i have any impact since i do not have a test env and FortiGate is directly in production.3- Do i need anymore the FortiAuthenticator ?  Thank You in advance #FortiEMS 

Hello,I have spent some time searching for a solution for this issue and cannot find it anywhere. We recently purchased a bunch of the FortiswitchRugged 112D-POE to replace older switches at our site. This is going to part of a giant network upgrade project. However short term I am using two 112Ds to connect to an existing network. I can connect via CLI and have already changed the IP/netmask (with hope that it would allow the web gui to work). I am looking to log into the web gui to finish a few updates to a few settings. I type in the IP in internet explorer and type in admin for username, I have already changed the password in CLI so I have a password to enter in that field. The login button seems to be disabled and won't let me login. I was wondering if anyone encountered this and has a possible solution. Many thanks!   

When I connected to my iPhone's hotspot, the FortiClientVPN stays stuck always at 98% during login.My iPhone is at that moment connected to a 4G network here in the Netherlands.What I noticed is the problem is fixed if I disable IPv6 support on my wireless adapter in Windows.See below the logs of the FortiClient VPN (debug level) I am using version 7.0.6 of the FortiClient VPN on Windows 10 21H2, the firewall is running FortiOS 7.0.6 Do more people have this problem?

Hi, i'm wondering the following... I have 4000 endpoints registered in EMS.  I need to free up some licenses.  I can exclude some endpoints which actually never use the vpn. The endpoint receives a 30 day grace period where they can still connect to the vpn.  What happens after 30days?  They can no longer connect, that's clear.  But the endpoint still exists in the EMS environment?  Or is it cleared up? Secondly, with the Forticlient comes the fsso agent (authenticator).  What happens when an endpoint is excluded from management?  Does the fsso service stop?  Immediately, or after 30 days?  Of does this just continue to work (as the license for this is basically on the authenticator server)...

We have Collectors  at 6.2, 6.3, 6.5.0,  6.5.1 , 6.6, 6.7,  7.1 , 7.0,  7.1 and 7.2Supervisor is 7.1.3 I have taken on a new role out of the versions 6.5 collector seems to a problem, as a Engineer I am the one who has to answer collectors going in the red for disk space capacity, cpu usage, and what ever else. And now I'm told the supervisor image server is broken  7.1.3.  How do we get that fixed?  Do I try to upgrade 6.5 ? can I see the upgradable paths somewhere for the above versions how do we get the supervisor image server fixed so it can be used and function correctly for them we need to improve our KPI. Meanwhile the worst is that these clients repeatedly lose the credentials to LOG IN  to the collector, not register,  and this forces us to have to re-deploy the collector,  what version do I give them that is the least problematice I haven't done that yet either... need some best practice advice and assist. All in one

Hi How do you ensure that when the user locks the pc ,the fortinac disconnects the user from the network ,until when the user logs in again?The user has a persistent agent installed.

Could someone please advise me. I have setup SSO login for SSL-VPN via AAD, but in AAD I have groups for example finance and tech support, but in fortigate I have it all as one group azure - Remote sso, problem is I need different rules for finance and different for tech support, how to make me use SSO, but have multiple groups in fortigate and the female from finance don't have access everywhere like tech support. Thank you for your help!

Hello Forti Guys and girls. I have 2 Fortinet devices, 60C and 40F. I want to use 60C as a lab device to test some features, routing policies. But there is a problem. They both have different firmwares. While 60C has 4.0 (can bu updated to 5.2.13) the 40F has 7.2. So there is a question: is there any major differences between two firmwares, mainly differencese in firewall, routing policies? I want to test policies in 60C and then make the same in 40F. Of course I have to make some changes, like interface's names and others.Have a nice weekend!