Solved

I purchased a 100F firewall and three 248E-FPOE switches.How can I connect the devices together giving 2Gbits of bandwidth to each switch.I can aggregate the ports but how can I separate three FortiLink interfaces for the three switches. ??I'm missing this step. Why does it seem to me that the FortiLink interface is always and only one?? Or am I misunderstanding something??

My setup is that of your traditional legacy WAN hub (data center) and spoke (branch sites). Currently, my only Internet access is at my data center. Even though they are on private WAN connections, the branch locations' connection to the WAN is via FortiGate (for traffic inspection purposes away from the data center). I am in the process of adding Internet connectivity to each of these branch sites (will also add secondary Internet connectivity at the data center as well in the near future). I have a fair grasp of what needs to be done and following the hub/spoke guidelines in the SD-WAN Branch Deployment Guide documentation; however, what I am missing is process/procedures or caveats in migrating an existing used interface over to a new zone. So what I mean is, if I have my existing interface in a WAN zone and policies are applied to that zone, will I be able to easily move that interface to the new SD-WAN zone? I know I cannot do anything with the interface while it references s

Hi, I want to connect to my Fortigate using its hostname via SSH with PuTTY. However, the documentation only mentions establishing a session via IP address and whenever I try to connect by writing the hostname in the Hostname (or IP address) field, it gives me the error host does not exist. Session is established successfully without any errors if I use the the MGMT port's IP address instead.

Hello, the content on the fortigate management interface doesn't load because fortinet's cdn certificate seems to have expired.For example the browser doesn't load the content at https://fos-cdn.fortinet.com/artifacts/fos/7.2.10/b1706/3655.js, if I try to open the url directly in the browser I see  that the domain SSL expired one Oct 30thAnd the cert Is indeed expired

Hi,I've set the Data Policy for my root ADOM to 120 days for Analytic logs. All my Fortigates are in that ADOM. However, when I view the logs, there are only logs available for the last 61 days. It never exceeds 61 days plus a few hours, even though the ADOM root has 40 % of unused storage. The analytic / archive ratio is set to 75 / 25. Do you know what I'm doing wrong? I'd expect it to fill the storage until it's full or the data policy is met but it doesn't do any of that.I also tried rebuilding the SQL DB. It seemed to be working at first, since logs for analytics reached 61 and 20 hours but after 00:00, it reset itself to 61 days and 0 hours. After the rebuild it freed up some space and ADOM root now even has 55 % of unused storage but is stil not logging according to the policy. Thanks in advance

Hello, I am currently attempting a deployment for new Windows 11 PCs; these machines are equipped with Sierra Wireless EM7511 WWAN cards / modems using AT&T physical SIMs. Our deployment requires a split tunnel, using both Netmotion NetMobility Client and Forticlient VPN simultaneously. Over the past weeks we have had nothing but issues, both Windows 11 and Windows 10 based machines (same physical hardware) BSOD / BugCheck a short time after connecting via FortiClient. Initially we were concerned that this could be a Sierra Wireless issue, so as a temporary solution we tested USB modems. These modems perform well until the machines are connected to Forticlient; Once connected within 30s - 5 minutes the USB modem will restart / disconnect albeit no BSOD. This behavior is repeatable and occurs only when Forticlient is connected regardless if NetMobility is connected or disabled. It appears that for some reason when Forticlient is active it causes modems, whether USB or inte

Hi,When SSL-decrypted HTTPS traffic is sent to a mirror port and analyzed using Wireshark on a server connectedto that port, unusual packet patterns are observed.     wan port IP : 1.235.10.153destination IP : 54.84.14.5source IP : 172.30.0.162 It seems like there is wrong with hand shake process, and when I monitor this traffic with Zeek, either the request body or the response body always shows 0. Is there something wrong with my FortiGate configurations, or is this expected situation for mirrored traffic?I need your assist. Thanks.

Im using Fortigate 50E with Firmware FortiOS 6.2.16.FortiOS 6.2 is EOS but Fortigate 50E still supported until 2027 march, what's the reccomendation, should i upgrade my hardware? or it's secure enough?

Dear all,I'm following the guide in order to setup for the first time the FortiClient EMS with my existing architecture ( FortiGate + FortiAuth).  In the docs (https://docs.fortinet.com/document/fortigate/7.2.5/ztna-deployment/374384/connect-the-fortigate-to-ems) is telling that: 1- I need to generate a cert. By i do have already EMS Server Certificates (FortiCare). Do i need to generate again using a third party such as godaddy since i do not have an CA ? Or this are the defaults one ? 2- How i can publish in the DMZ the FortiEMS ? Thank You in advance#FortiClientEMS 

HI, I am planning to move my FortiGate SSL VPN to an external DHCP Server and have the following plan using a loopback interface following the FortiGate document link below. I am unsure if my plan will work and if I have the correct Firewall Policies etc, does it look good? https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-with-external-DHCP-Server/ta-p/215644 

Hello  I would like to know how does the FortiNDR VM  respond after it detects malware ? Can the FortiNDR clean the malware files on its own ? or it just detects the malware Thank You

Let me start by saying I'm not the network guy, I'm more of the endpoint guy. But I'm also kind of the security guy (IT department is, well... lean). With that being said, on more than one occasion now, I've noticed that we were exposing things we shouldn't via Shodan. We own a block of public IP's. One was the login page to a critical internal service. Another was a recursive DNS server and port 53. The former was an accidental misconfiguration that I brought up and was fixed (looking at the logs it was getting hammered with brute force attempts, as you would expect). The latter, the network guy just didn't know it wasn't a good idea. I don't pretend to know everything, so I'm just hoping for a reality check on what we still have exposed across multiple public IP's. We have a FortiGate. We have VPN setup. It requires MFA. I believe it's L2TP with IPsec. Ports 1701 UDP and 179 are exposed across multiple public IP's that we are using. On Shodan, for 1701, it says so

Ive been trying at this for awhile and cant wrap my head around the problem.  Im trying to go from ssl vpn to vlan100Fortigate sees vlan100 in the routing table. It has a firewall policy allowing it.  yet the policy match tool and debug shows it going to the implicit deny policy  What else am I missing?

Our firewall (FortiGate-500E v7.0.14, build0601) is currently experiencing issues with upgrading to newer firmware versions. There are two options available: versions 7.2.7 and 7.2.8. However, the release notes for version 7.2.7 indicate a bug affecting IPsec tunnels, while version 7.2.8 has a known issue with routing and SD-WAN How should I determine the most suitable version for the upgrade?known issues: 7.2.7 -->> https://docs.fortinet.com/document/fortigate/7.2.7/fortios-release-notes/236526/known-issues  known issues: 7.2.8 --> https://docs.fortinet.com/document/fortigate/7.2.8/fortios-release-notes/236526/known-issues    

To a Virtual Server is it possible in Load balancing method selecting "HTTP Host" and "Round Robin" at the same time?As it is now with "HTTP Host" it looks like it uses Static with the 2 Real Servers. 

Hello,I now have new parser. When I go to the Admin -> Device support -> ParsersI can see my parser I try to check the box in the Enable columnit then opens the parser window showing the code. Here you can see the Enable state is checkedIf I pick Validate it validates if I select Test it tests successfully. if I select Save it says parser not validated or test failed which makes no sense. If I select cancel it just take me back to the list view of parsers.it is stuck in some kind of loop, there is no way for me to enable the parser , I cannot get to the Apply option.also if I start in the list view and select Edit it takes me in the parser code where again I select validate and it validates and then I select test and it tests successfully, but Enable is greyed out via this menu path that I take.

Estimados, tengo una política de navegación que esta aplicando una inspección ssl "certificate-inspection" con el metodo "inspeccion de certificados ssl" y en el navegador de un cliente que esta bajo esta politica me sale el siguiente error al abrir un enlace de unidad .google.com "Fortinet" no se ha instalado correctamente en tu ordenador o red. Póngase en contacto con el administrador de TI para resolver el problema. net::ERR_CERT_AUTHORITY_INVALID Asunto: *.google.comEmisor: FG200FT920905021Fecha de caducidad: 30 de diciembre de 2024Fecha actual: 29 de octubre de 2024como solución me indica que instale directamente el certificado en la máquina, lo cual ya realiza, pero sigue el mismo evento.Que mas podria realizar para solucionar este inconveniente 

Dear,Following the guide (https://docs.fortinet.com/document/forticlient/7.4.0/ems-administration-guide/701440/configuring-a-profile-to-allow-or-block-endpoint-from-vpn-tunnel-connection-based-on-the-applied-security-posture-tag) i'm trying to create rules in order to block for i.e:endpoint with critical vulnerabilities to connect vpn. But in my console i do not have the option like showing in the link: Link console: My console:

Where can I found EOO, LSED, and EOS of fortigate 201F, fortigate 60F, and fortigate 201E? I just downloaded the list of hardware EOO from fortinet support, but i can't find this three on the list.

DearsI have fortiGate SSL and IPSEC RAVPN, i need to force user to change password.any guide please

hi,would it be possible or does it make sense to have a multi VDOM FG managed in FMG to be in separate ADOM?for example, the "core or critical" VDOM such as the "root" and "internet access" are added in the "root" ADOM, then the rest of the "customer" VDOMs would be provisioned/managed in a separate ADOM. we'll deploy an "internet access" VDOM deployment. refer to sample diagram/scenario.the root VDOM in the diagram will be our "internet access" VDOM, like an internet edge device. the rest of the customer VDOM will connect (vlink) to the root/internet access VDOM.  

Hi,we have a colleague that wasn't able to connect to our VPN due to a unrequested route added by 7.4.0.1645 version of FortiVPN VPN-ONLY client.  default via 192.168.1.254 dev en6 default via 192.168.1.254 dev en0 default dev utun13 scope link #this is wrong  Could this be a bug or a misconfiguration? Regards,Dimitri

May I know can i connect Fortinet Client VPN which laptop in Singapore but connect in China?How about remote dekstop?

hi,i received a new FG-1800F and saw there's 2x ha and 2x mgmt ports.my question is, can i just utilize/configure only one of these? i.e. use ha1 and mgmt1 onlyor is there a config guide/design to follow wherein i have to use both? seems it will use a lot of switch ports since we're using A/P HA.what are some common design/scenarios for using two ha and mgmt? # show system interface name    Name.fortilink   static   0.0.0.0 0.0.0.0  10.255.1.1 255.255.255.0  up   disable   aggregate  disable   ha1   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   ha2   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  disable   l2t.root   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up  

Hi All, I have a FortiSwitch which managed via a Fortigate controller. Does anyone know how to create an automate task to automatically shut a switch interface when a cable is disconnected and then only can be then enable again by an administrator? Thanks regardsJimmy