Solved

Hey all, I have FortiGate 80E firewall (v7.0.7 build0367) with DHCP range 192.168.9.100-192.168.8.250 I'd like to add 25 slots to that range by increasing the starting range from 192.168.9.100 to 192.168.9.75). My question: Can I make this DHCP change in real time? Or will it affect DHCP users, static IP users, VPN users, and my access to the local FortiGate portal?

Good morning, I have a question about what is the best way to update/register a Fortigate 40F behind another Fortigate? There is a big rollout coming up, we want to replace all of our Fortigate 40C with Fortigate 40F and I would like to send the fortigates up to date and registered. We have a lot of small branches and usually we configure new Fortis at our main location just to get them online after they arrive at one branch. Then we register and update the Fortigate, this obviously causes an internet loss.I’m kinda shure that there is a better way, but I can’t figure out how to do it. First I tried to update the firmware manually. But after one successful update I receive this Error-Message:This is a FortiOS v7.6.0-build3401 firmware image that cannot be installed because the device's FortiGuard license for firmware upgrades could not be verified or may have expired. Verify or renew the license to install upgrades.If I understand that correctly the Fortigate needs internet a

Hello everyone, I am running a Fortigate with FortiOS v7.4.5, where the default VLAN traffic arrives untagged on the LAN interface. Currently, several networks (e.g., 10.0.1.0/24 and 10.0.2.0/24) are operating over this interface.After assigning a secondary IP address to the interface (10.0.1.3/24), routing between the two subnets works as expected. However, the security policies configured between these networks are not being enforced. I have reviewed some relevant articles, but the suggested solutions do not seem to resolve the issue. According to these Fortinet Technical Tips, the traffic should be blocked by default and then allowed through the appropriate policies:Allow traffic between different subnets with the same VLANHow to allow traffic when using the same logical interfaceI have tested this in a lab environment, and as expected, the traffic between the subnets is routed, but the configured security policies are not being applied. Is this behavior expected? Are

Dear all, I'm new to FortiEMS. I have done the fresh installment as a VM using the trial license. Our current architecture is: FortiGate + FortiAuthenticator. The user are connecting to VPN (SSL-VPN) using FortiGate + FortiClient and FortiAuthenticator as a MFA. We want also to add FortiEMS as a layer to do a posture check for the device prior of giving them permissions to connect remotely to the company resources. We have users with a company joined AD laptop + BYOD devices. I'm trying to understand: 1- Where will the FortiEMS stand in the "big picture" at the architecture level ? Will it replace any of the components ?2- Do i need to connect FortiEMS with FortiGate ? If yes, will i have any impact since i do not have a test env and FortiGate is directly in production.3- Do i need anymore the FortiAuthenticator ?  Thank You in advance #FortiEMS 

Hello,I have spent some time searching for a solution for this issue and cannot find it anywhere. We recently purchased a bunch of the FortiswitchRugged 112D-POE to replace older switches at our site. This is going to part of a giant network upgrade project. However short term I am using two 112Ds to connect to an existing network. I can connect via CLI and have already changed the IP/netmask (with hope that it would allow the web gui to work). I am looking to log into the web gui to finish a few updates to a few settings. I type in the IP in internet explorer and type in admin for username, I have already changed the password in CLI so I have a password to enter in that field. The login button seems to be disabled and won't let me login. I was wondering if anyone encountered this and has a possible solution. Many thanks!   

When I connected to my iPhone's hotspot, the FortiClientVPN stays stuck always at 98% during login.My iPhone is at that moment connected to a 4G network here in the Netherlands.What I noticed is the problem is fixed if I disable IPv6 support on my wireless adapter in Windows.See below the logs of the FortiClient VPN (debug level) I am using version 7.0.6 of the FortiClient VPN on Windows 10 21H2, the firewall is running FortiOS 7.0.6 Do more people have this problem?

Hi, i'm wondering the following... I have 4000 endpoints registered in EMS.  I need to free up some licenses.  I can exclude some endpoints which actually never use the vpn. The endpoint receives a 30 day grace period where they can still connect to the vpn.  What happens after 30days?  They can no longer connect, that's clear.  But the endpoint still exists in the EMS environment?  Or is it cleared up? Secondly, with the Forticlient comes the fsso agent (authenticator).  What happens when an endpoint is excluded from management?  Does the fsso service stop?  Immediately, or after 30 days?  Of does this just continue to work (as the license for this is basically on the authenticator server)...

We have Collectors  at 6.2, 6.3, 6.5.0,  6.5.1 , 6.6, 6.7,  7.1 , 7.0,  7.1 and 7.2Supervisor is 7.1.3 I have taken on a new role out of the versions 6.5 collector seems to a problem, as a Engineer I am the one who has to answer collectors going in the red for disk space capacity, cpu usage, and what ever else. And now I'm told the supervisor image server is broken  7.1.3.  How do we get that fixed?  Do I try to upgrade 6.5 ? can I see the upgradable paths somewhere for the above versions how do we get the supervisor image server fixed so it can be used and function correctly for them we need to improve our KPI. Meanwhile the worst is that these clients repeatedly lose the credentials to LOG IN  to the collector, not register,  and this forces us to have to re-deploy the collector,  what version do I give them that is the least problematice I haven't done that yet either... need some best practice advice and assist. All in one

Hi How do you ensure that when the user locks the pc ,the fortinac disconnects the user from the network ,until when the user logs in again?The user has a persistent agent installed.

Could someone please advise me. I have setup SSO login for SSL-VPN via AAD, but in AAD I have groups for example finance and tech support, but in fortigate I have it all as one group azure - Remote sso, problem is I need different rules for finance and different for tech support, how to make me use SSO, but have multiple groups in fortigate and the female from finance don't have access everywhere like tech support. Thank you for your help!

Hello Forti Guys and girls. I have 2 Fortinet devices, 60C and 40F. I want to use 60C as a lab device to test some features, routing policies. But there is a problem. They both have different firmwares. While 60C has 4.0 (can bu updated to 5.2.13) the 40F has 7.2. So there is a question: is there any major differences between two firmwares, mainly differencese in firewall, routing policies? I want to test policies in 60C and then make the same in 40F. Of course I have to make some changes, like interface's names and others.Have a nice weekend!

For the FortiDeceptor is there an official document (matrix compatibility type) as is done for FMG and FAZ ?Also among the Fortinet Fabric I mentioned below, can you confirm that the ISOLATOR interacts only with these: Fortigate - YESFortiAnalyzer - YESFortiManager - NOFortiSandbox - YESFortiIsolator - NO Best regards

Hello,We have a hybrid configuration on our domain. When we receive mail from our M365 mailboxes to our on-prem exchange mailboxes, the mail is classified as fortiguard spam outbreak. We has opened a case. Tac engineer gave the following suggestion;1) Change the level from 'High' to 'Medium'.2) Place the domain or sender IP in the Safe list (it will bypass the entire AntiSpam profile).3) Create a specific Recipient policy with the AntiSpam profile where FortiGuard Spam outbreak protection is disabled.4) Set the spam outbreak protection time to minimum (6 minutes).I wonder if I change the outbreak protection level to low or medium, how will this affect us?

Model: Fortigate 60C (FGT60C) When connect to console it has the following error message. The firewall can boot up and functioning. Is there any way to replace this disk ?And what disk is this ?What is the function of fgtag.c ?  Thanks.   

We recently made some changes to our DNS server which now has a new IP addess.  When connecting via Forticlient, all network adapters are reverted back to the old IP address causing network drive mapping issues. Changing the settings on the adapter will work while connected through the VPN, but no matter what, the next time a user logs in, the old settings take precedent again. I have manually configured the adapters to the correct DNS address.I have done all the ipconfig / related commands I have tried other solutions from similar posts on this forum and others, but nothing prevents the VPN from changing the settings. Has anyone run into this before, or know of a solution?

Question regarding FortiManager.Is there any way to only show interfaces for the devices we have, as opposed to the entire product line? We typically use FGT 200F, 201F, 80F, and 60E/F devices. When I want to configure normalized interfaces, I have to wade through every model of device that Fortinet supports in that version of FMG. If I search just for the device type (e.g. 60F), find the port, then make a change, it goes back to the default view of everything and I have search again. When I'm working on building normalized interfaces for a bunch of devices, that can be difficult to deal with and I end up using port specific configurations instead of normalized ones. It would be great if I had the option to choose what devices I want to see in the normalized interface section of FMG and it was a setting that was saved.

When I used the FortiConverter to convert my ASA config into FortiGate, I really didn't care about the Phase2 VPN names. Now the migration to the FortiGate is done and I find that I would like to rename the Phase2 interfaces.  Is this possible after the fact?  I know it's not possible in the GUI, but thought it might be via CLI however I wasn't able to figure it out just poking at the CLI.

HelloI'm looking for to update/upgrade in our company the FortiClient VPN from 7.0.1 to 7.4.0. I've searched for the parameter but I could found it. Does anyone know if this is possible or not to update/upgrade the client instead of uninstall the old one and install the new client SW? #Produkt-Downloads | Fortinet-Produkt-Downloads | Support Thanks and regards,Daniel

Hi all, i have stubborn customer insisting on Rustdesk as a support tool for desktop support.Advising him of migration to Anydesk or something similar didnt helped.So, question:FG80f configured to allow necessary ports (21114-21119) are configured, nothing is blocked:  On link below is instruction about similar issue, configured for that particular policy without help:ArticleID 274423  All security profiles are disabled, pure NAT internet access without restrictions.So, i can confirm that Rustdesk is not blocked, on diagnose flow also didnt saw anything unusual, but tbh what should i diagnose.Did somebody else had similar issue with Rustdesk? ty,Drazen 

For FortiDeceptor is it possible to configure a different port than port 1 (used by mgmt network) with function for license validation, FDS services, Web filtering and other ?Speaking of the physical appliance can ports 2 through 8 be used only to deliver the decoy services ?Thank everyone in advance!

I've recently migrated our primary firewall from an ASA to a FortiGate 600.  Don't get me wrong, I love Cisco but the FortiGate firewall has been a HUGE improvement and I don't regret the change for a moment!  However, there was one thing about the ASA that I loved and has saved my butt more than once.  With every "commit" I made, I had the ASA spit out a CLI of what change I just made.  So like if I made some new service ports in the ASDM, when I hit "apply" I'd get an out put like so:object service TCP-7046service tcp destination eq 7046description Nav Client Servicesobject service TCP-7047service tcp destination eq 7047description Nav SOAP ServicesThen I would copy that info and place it into my own personal change log with a little note of what I was doing, so I've got my own personal change log of every change made.  An example entry:4/30/20241. Create the NAV ports on the ASAobject service TCP-7046service tcp destination eq 7046description Nav Client Serv

Hello, I have a FortiSIEM on VM, the license expires in 1 month and we will not be able to contract support again until the first days of next year.The question is what will happen when the license expires, what limitations does it have?Is FortiSIEM still functional?Thanks.

Hello Team! I am using a FortiGate 40F model FG-40F with a configuration which consist of a VDOM root (management, operation mode NAT) and a VDOM transparent (operation mode transparent).  The VDOM root is only use to give access to internet:  The VDOM transparent is only use to stablish a firewall between a network called LAN and a network called WAN:  My objective is to monitor the Fortinet sending get SNMP from a PC connected to the port 2 (Inside lan 2).I have configured the System > SNMP in this way:  My problem is that the Fortinet receives the SNMP get but not answer me:  I am sending the get SNMP with iReasoning Browser: I amnot using HA or trusted hosts (I have tested to add my pc to trusted hosts but the behaviour does not change), I have checked the threads: SNMP don't response traffic, SNMP response and SNMP no response: timed out but I can not solve the problem. I give you more information that could

Hello everyone,currently we are hanging in the SAML Entra SSO Setup. I checked the recommends Articles here in the Support Forum and watched serveral Videos.Firmware: v7.4.5 build2702Model: FortiGate 101F After the SAML login via the FortiClient and Enter the M365 Credentials, follwing Error Appear: Configuration on the Fortigate:User & Authentication > Single-Sign-onService Provider ConfigurationAddress: "forti-fqdn:6443" Entity ID: "http://forti-fqdn:6443/remote/saml/metadata/" Assertion consumer service URL: "https://forti-fqdn:6443/remote/saml/login" Single logout service URL: "https://forti-fqdn:6443/remote/saml/logout" Identity Provider ConfigurationEntity ID: "https://sts.windows.net/xxxx/" Assertion consumer service URL: "https://login.microsoftonline.com/xxxx/saml2" Single logout service URL: "https://login.microsoftonline.com/xxxx/saml2"  Certifcate Import from Entra  Additional SAML AttributesA

Hi,Is it possible to have the Fortigate perform a ICMP-ECHO to a IP Address before it sends a DHCP Offer to a client device. Have had an issue with duplicate IP Addresses on overlapping scopes / ranges that have static IP Addresses configured. This could be resolved with the DHCP server testing to see if the IP address is already in use in advance rather than relying on the client device to perform this function, I.E sending out an arp before accepting the DHCP Offer.  Any help would be much appreciated, thankyou.