Solved

Hello,I can't find any document about FG-200E EOL.I know it end of sale but I need to know about end of support date and it has not exited at the product life cycle.Thanks.

Hi, Please see the below diagram which shows connection for fortigate SDWAN. My question is after adding two Cisco ASR1K in front of Fortigate, what special configuration do we have to add so that we can let the fortigate SDWAN work well? Thanks    

Using the menu "VPN Location Map" does show me a nice overview of the currently connected VPN connections (IPSEC, SSL VPN). However, the locations of the fortigate are most of the time somewhere in the Gulf of Guniea (0°S, 0°E). The physical location of all our fortigates is configured in FortiCloud (product details) with the address (street, ZIP, town, etc.). I did not find a way to set the device location in the fortigate GUI, nor via CLI. I checked with dia "geoip geoip-query <IP>" on each fortigate it's own location and it shows a somewhat accurate location (sometimes off by a lot, based on the ISP). So, I have several questions:How does the fortigate determine it's own location used for the VPN location map? From the location configuration in FortiCloud? (difficult, if not impossible)Via geo-ip query? (most likely)If yes, which IP is used in a milti VDOM environment with several WAN IP's per VDOM?Note: If I use "dia geoip geoip-query <my-wan-ip&gt

I have a problem with FortiClient VPN 7.4.1 on macOS 15.1.After launching the application, I configure the VPN, enter the IP and user, and save. I enter the password from the administrator, and a window to enter the token appears in the background, which immediately disappears - so I have no way to enter the token. How can I solve this problem? I went through all the tutorials and set the necessary permissions (notifications, disk access, network settings, and permissions for FortiClientProxy and FortiClientPacketFilter) in the settings. I also installed Visual C++ tools and the application several times, but the problem continues.

hi,we would like to use the lock feature when an admin is making change/FW policy push.my questions are:1. is it "safe" (no downtime/outgea) when enabling "workspace" in FMG? just want to "lock" or create workspace for a specific ADOM only.2. what mode do i choose and what's the best practice?3. do i just choose "workspace" then apply?4. what is per-policy lock?5.does a user always need to "lock" the ADOM and create a new "workflow session" when making a change? 

We recently updated to FortiClient VPN version 7.0.7.0345 for Windows. When users now start FortiClient VPN on their Windows machines, they get a User Account Control prompt Can anyone advise what has been changed in version 7.0.7.0345 that cause this UAC prompt to come up? And what we can do to, except lower the UAC settings, to prevent this prompt from happening?

I have a single, 8 hour, professional services support day banked.  I've got a couple of options on how to use it.  I've got a FortiManager license but I've never set it up and never used it.  I would also like to configure my FortiGate that's in my DR site with a VDOM so that I could have a "bubble test" that's segregated from everything else, but uses Corp IPs.  I've also never set up VDOMs or worked with VDOMs.  I'm less than sure I can accomplish both of these tasks in 1 8 hour support day.  Which one would you consider more complicated and I should use the support day for?

Is there a way to use Fortimanager trial in an airgap environment? The Entitlement Files not work because the Trial has no support.

Hello guys,We have Forgates 100F in our production with v7.2.8.I would like to configure encrypted logs sending to Syslog server. But I didn't find settings in GUI  nor CLI commands.Could someone tell me if it is possible to do ? If yes, how ?Thank you.

Some has installed 7.2.2 and 7.1.4 Collector version... The Super is at 7.1.3 I do not want to risk consistencies or malfunction as this violates the version compatibility rules ofCollector version <= Supervisor Versions.   Can I use the remote image server utility to send down a lower version or do I have to reapply the correct version  manually I cannot seem to get an answer where I look. Thanks, Karl

I've been searching through the Product Life Cycle info but I'm unable to locate the end of life date for the following models FortiGate-40FFortiGate-60FFortiGate-101F Is anyone able to help with this please Thanks & regardsSteff 

hi,we have FG-xx "F" in our environmentmy question is, since these FG have internal HDD1. is it "safe" to enable log "all sessions"?2. haven't seen much FG docs regarding syslog, is logging buffer "circular" in a FG, i.e. overwritten by newer logs?3. is there a default threshold or buffer size in the HDD by these "F" models? is there also a "preferred" FW policy sequence based on its specific purpose/criteria? this is to prevent an overlap or "shadow" FW policy. refer sample below1. DNAT using VIP2. SNAT using IP pool3. SNAT using Egress interface 

Hi all,I am working on a test machine configured to access the Internet via a proxy PAC script set to FortiProxy. At the moment, when I open the browser, the proxy authentication banner appears correctly; by entering the domain credentials, I can browse without problems.Now, however, I need to configure FortiProxy so that Microsoft Teams can bypass authentication. The goal is to allow Teams to run without requiring proxy authentication, while for other services the proxy login request should continue to work as it does now. What are the methods for doing this? Thanks in advance for the supportBR

I'm going to be taking a backup of 1 fortinet and then doing a LOT of massaging of the .conf file to restore to a different fortinet.  I'm wondering if anyone has used some kind of .conf "editor" program.  Something with a little bit more 'oomph' to do things than Notepad++.  I'm thinking features like being able to "collapse" a section without having to highlight the whole section and then hit 'hide'.  Back in the day when I used to write ColdFusion I used DreamWeaver to edit the code and it had features like that which it could parse for ColdFusion code. Has anyone used a code editor like this when modifying .conf files for fortinets?  

Dear All, am facing the problem on viewing the traffic logs in Fortiweb which is deployed in Azure. Enabled the traffic logs in CLI but still it's not visible, any suggestion pls   

Hello , could someone give me a light I'm configuring F60 , when the WAN1 card is set to receive DHCP modem from the operator it navigates normally , when I put it in Manual it stops navigating , I already went to the modem of the operator I made a DMZ I put the same IP and nothing someone could help me with this

Hello team, This time, a basic question.https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/369092/enabling-automatic-firmware-upgradesThis article says "updates within the same major release", so I am wondering, what is this "major release".For example, if we want to schedulle an automatic update to afterhours, I will need to know to which version will be updated Thanks in advance.Regards,Damián

I need the installer for Forticlient VPN 7.0.8.0427 (ideally the MSI) for a large-scale uninstallation via Intune. Is there anywhere I can find it? I've seen some posts within this community that contained a link, but they were all expired. 

Hi Folks! Hope you are all doing well, I am new to the firewall role. I would like to ask why I cant see any denied logs related on our block list policy. we have this group for IP address and full qualified domain, we plae any malicious object from this group. but as I checked, It has block other IP address that are not included on the repository. and the IP address that are on the group are not is it because the user are not accessing this IP or I cant see it because of the 7 days log retention. I would appreciate your insights on this Also here is the policy (Version 7.2.8) NameFromToSourceDestinationScheduleServiceActionLogBlock Inbound TrafficanyanyGroup of Malicious IP and FQDN detected from QradarallalwaysALLDENYEnabledBlock Outbound TrafficanyanyallGroup of Malicious IP and FQDN detected from QradaralwaysALLDENYEnabled

Hello, One of my customers asked if FortiNAC-f would support their Dell Powerconnect N5548 switches.I assumed it would be possible with SNMP or just CLI. Back to the subject - is there a publicly available list of supported 3rd party switches or if not is the above model supported and in what capacity. Any answers to this or just pointers to the appropriate materials would be appreciated!

We are in POC state and what my expect framework is supervisor, collectors and agents all communicate via Internet, because the VMs and network devices we managed seperate in different physical location and they can only reach each other through the Internet, but it seems not working if I just NAT them to make sure they can ping and telnet :443 to each other. So I am wondering if there is any further configure requirement we have to do?

I recently added a cellular internet back up service to our Fotigate. For the last 2 or 3 weeks I have recieved over 1000 "Login Denied" email alerts. I would like to block all public ip addresses but I have not found a good step by step using the web interface (I don't use CLI). Can someone point me in the right direction?I have a Fortigate FG60F with version 7.0.16 build0667. I cuurently have the backup internet unplugged.

Our FMG and FGTs are all running 7.2.8, and several months ago we upgraded the security fabric across all our devices. Now, we have a problem to where our local-in-policy will deploy once from the FortiManager, and the next change we deploy deletes the configuration that as just installed. We're trying to enable BGP to a vendor for one of our new systems over one of the VPN tunnels, but BGP is being listened to on the outside interface. I blocked tcp/179 using the local-in-policy on the outside interface, but then had to make another change after that. It's now unblocked. We have 18 FortiGates, and all have various local-in-policy configurations, but we can't make any further changes. Can someone provide guidance on what we need to do? Thank you.

Hi people,I just updated a firewall from 7.0.15 to 16 and lost the standard SSL-VPN on forticlient. So we migrated the vpn remote access config on IPSEC restoring user groups, policies etc etc. The only issue I still have is to have the Forticlient (now connected by ipsec) use the dns suffix I'm passing to the clients. I did all the standard config steps I've seen on other posts:        set mode-cfg enable        set dns mode manual        set ipv4-dns-server        set unity-support enable         set domain <domain>   but the client is still ignoring it. On the ipconfig /all of the vpn client I can see it gets the parameters (internal dns, domain suffix, routes) but if I try to resolve a domain host without the suffix it simply fails. I can still ping it and resolve it with the full domain name. Rules have been checked and I can r

Anyone have this issue? I need follow the in progress case....