Solved

Good night! Is there a way I can activate my physical interfaces without having to go to the site?  

Hello, I just want to ask if it is possible to override Fortimanager sdwan template. Network connection changed and I have to change healt-check IP for one device. In device group is multiple devices so I have to make change only for one device. If it is not possible what is the best way to deal with this situation ? Thank you RegardsPeter 

Hi all, I have a setup with Fortiauthenticator (v6.6.0) and Fortigate 401F (v7.2.9), where FAC is fed by an openLDAP, and I use remote user sync rules to add users to groups created of FAC. The thing is, I have several groups created on FAC, however the users can only connect to VPN if they are in a specific group (regardless of which group they belong on openLDAP). I don't have any filters on the FAC policy.This happens with, and without token.I know that the problem is not related with the password. Logs of the user connecting succefuly: ESEnfC-1 # [3592:root:1c23e]allocSSLConn:310 sconn 0x7f201b4e7000 (0:root) [3592:root:1c23e]SSL state:before SSL initialization (*.*.*.*) [3592:root:1c23e]SSL state:fatal decode error (*.*.*.*) [3592:root:1c23e]SSL state:error:(null)(*.*.*.*) [3592:root:1c23e]SSL_accept failed, 1:unexpected eof while reading [3592:root:1c23e]Destroy sconn 0x7f201b4e7000, connSize=1. (root) [3593:root:1c23e]allocSSLConn:310 sconn 0x7f201b4e780

I purchased a 100F firewall and three 248E-FPOE switches.How can I connect the devices together giving 2Gbits of bandwidth to each switch.I can aggregate the ports but how can I separate three FortiLink interfaces for the three switches. ??I'm missing this step. Why does it seem to me that the FortiLink interface is always and only one?? Or am I misunderstanding something??

My setup is that of your traditional legacy WAN hub (data center) and spoke (branch sites). Currently, my only Internet access is at my data center. Even though they are on private WAN connections, the branch locations' connection to the WAN is via FortiGate (for traffic inspection purposes away from the data center). I am in the process of adding Internet connectivity to each of these branch sites (will also add secondary Internet connectivity at the data center as well in the near future). I have a fair grasp of what needs to be done and following the hub/spoke guidelines in the SD-WAN Branch Deployment Guide documentation; however, what I am missing is process/procedures or caveats in migrating an existing used interface over to a new zone. So what I mean is, if I have my existing interface in a WAN zone and policies are applied to that zone, will I be able to easily move that interface to the new SD-WAN zone? I know I cannot do anything with the interface while it references s

Hi, I want to connect to my Fortigate using its hostname via SSH with PuTTY. However, the documentation only mentions establishing a session via IP address and whenever I try to connect by writing the hostname in the Hostname (or IP address) field, it gives me the error host does not exist. Session is established successfully without any errors if I use the the MGMT port's IP address instead.

Hello, the content on the fortigate management interface doesn't load because fortinet's cdn certificate seems to have expired.For example the browser doesn't load the content at https://fos-cdn.fortinet.com/artifacts/fos/7.2.10/b1706/3655.js, if I try to open the url directly in the browser I see  that the domain SSL expired one Oct 30thAnd the cert Is indeed expired

Hi,I've set the Data Policy for my root ADOM to 120 days for Analytic logs. All my Fortigates are in that ADOM. However, when I view the logs, there are only logs available for the last 61 days. It never exceeds 61 days plus a few hours, even though the ADOM root has 40 % of unused storage. The analytic / archive ratio is set to 75 / 25. Do you know what I'm doing wrong? I'd expect it to fill the storage until it's full or the data policy is met but it doesn't do any of that.I also tried rebuilding the SQL DB. It seemed to be working at first, since logs for analytics reached 61 and 20 hours but after 00:00, it reset itself to 61 days and 0 hours. After the rebuild it freed up some space and ADOM root now even has 55 % of unused storage but is stil not logging according to the policy. Thanks in advance

Hello, I am currently attempting a deployment for new Windows 11 PCs; these machines are equipped with Sierra Wireless EM7511 WWAN cards / modems using AT&T physical SIMs. Our deployment requires a split tunnel, using both Netmotion NetMobility Client and Forticlient VPN simultaneously. Over the past weeks we have had nothing but issues, both Windows 11 and Windows 10 based machines (same physical hardware) BSOD / BugCheck a short time after connecting via FortiClient. Initially we were concerned that this could be a Sierra Wireless issue, so as a temporary solution we tested USB modems. These modems perform well until the machines are connected to Forticlient; Once connected within 30s - 5 minutes the USB modem will restart / disconnect albeit no BSOD. This behavior is repeatable and occurs only when Forticlient is connected regardless if NetMobility is connected or disabled. It appears that for some reason when Forticlient is active it causes modems, whether USB or inte

Hi,When SSL-decrypted HTTPS traffic is sent to a mirror port and analyzed using Wireshark on a server connectedto that port, unusual packet patterns are observed.     wan port IP : 1.235.10.153destination IP : 54.84.14.5source IP : 172.30.0.162 It seems like there is wrong with hand shake process, and when I monitor this traffic with Zeek, either the request body or the response body always shows 0. Is there something wrong with my FortiGate configurations, or is this expected situation for mirrored traffic?I need your assist. Thanks.

Im using Fortigate 50E with Firmware FortiOS 6.2.16.FortiOS 6.2 is EOS but Fortigate 50E still supported until 2027 march, what's the reccomendation, should i upgrade my hardware? or it's secure enough?

Dear all,I'm following the guide in order to setup for the first time the FortiClient EMS with my existing architecture ( FortiGate + FortiAuth).  In the docs (https://docs.fortinet.com/document/fortigate/7.2.5/ztna-deployment/374384/connect-the-fortigate-to-ems) is telling that: 1- I need to generate a cert. By i do have already EMS Server Certificates (FortiCare). Do i need to generate again using a third party such as godaddy since i do not have an CA ? Or this are the defaults one ? 2- How i can publish in the DMZ the FortiEMS ? Thank You in advance#FortiClientEMS 

HI, I am planning to move my FortiGate SSL VPN to an external DHCP Server and have the following plan using a loopback interface following the FortiGate document link below. I am unsure if my plan will work and if I have the correct Firewall Policies etc, does it look good? https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-with-external-DHCP-Server/ta-p/215644 

Hello  I would like to know how does the FortiNDR VM  respond after it detects malware ? Can the FortiNDR clean the malware files on its own ? or it just detects the malware Thank You

Let me start by saying I'm not the network guy, I'm more of the endpoint guy. But I'm also kind of the security guy (IT department is, well... lean). With that being said, on more than one occasion now, I've noticed that we were exposing things we shouldn't via Shodan. We own a block of public IP's. One was the login page to a critical internal service. Another was a recursive DNS server and port 53. The former was an accidental misconfiguration that I brought up and was fixed (looking at the logs it was getting hammered with brute force attempts, as you would expect). The latter, the network guy just didn't know it wasn't a good idea. I don't pretend to know everything, so I'm just hoping for a reality check on what we still have exposed across multiple public IP's. We have a FortiGate. We have VPN setup. It requires MFA. I believe it's L2TP with IPsec. Ports 1701 UDP and 179 are exposed across multiple public IP's that we are using. On Shodan, for 1701, it says so

Ive been trying at this for awhile and cant wrap my head around the problem.  Im trying to go from ssl vpn to vlan100Fortigate sees vlan100 in the routing table. It has a firewall policy allowing it.  yet the policy match tool and debug shows it going to the implicit deny policy  What else am I missing?

Our firewall (FortiGate-500E v7.0.14, build0601) is currently experiencing issues with upgrading to newer firmware versions. There are two options available: versions 7.2.7 and 7.2.8. However, the release notes for version 7.2.7 indicate a bug affecting IPsec tunnels, while version 7.2.8 has a known issue with routing and SD-WAN How should I determine the most suitable version for the upgrade?known issues: 7.2.7 -->> https://docs.fortinet.com/document/fortigate/7.2.7/fortios-release-notes/236526/known-issues  known issues: 7.2.8 --> https://docs.fortinet.com/document/fortigate/7.2.8/fortios-release-notes/236526/known-issues    

To a Virtual Server is it possible in Load balancing method selecting "HTTP Host" and "Round Robin" at the same time?As it is now with "HTTP Host" it looks like it uses Static with the 2 Real Servers. 

Hello,I now have new parser. When I go to the Admin -> Device support -> ParsersI can see my parser I try to check the box in the Enable columnit then opens the parser window showing the code. Here you can see the Enable state is checkedIf I pick Validate it validates if I select Test it tests successfully. if I select Save it says parser not validated or test failed which makes no sense. If I select cancel it just take me back to the list view of parsers.it is stuck in some kind of loop, there is no way for me to enable the parser , I cannot get to the Apply option.also if I start in the list view and select Edit it takes me in the parser code where again I select validate and it validates and then I select test and it tests successfully, but Enable is greyed out via this menu path that I take.

Estimados, tengo una política de navegación que esta aplicando una inspección ssl "certificate-inspection" con el metodo "inspeccion de certificados ssl" y en el navegador de un cliente que esta bajo esta politica me sale el siguiente error al abrir un enlace de unidad .google.com "Fortinet" no se ha instalado correctamente en tu ordenador o red. Póngase en contacto con el administrador de TI para resolver el problema. net::ERR_CERT_AUTHORITY_INVALID Asunto: *.google.comEmisor: FG200FT920905021Fecha de caducidad: 30 de diciembre de 2024Fecha actual: 29 de octubre de 2024como solución me indica que instale directamente el certificado en la máquina, lo cual ya realiza, pero sigue el mismo evento.Que mas podria realizar para solucionar este inconveniente 

Dear,Following the guide (https://docs.fortinet.com/document/forticlient/7.4.0/ems-administration-guide/701440/configuring-a-profile-to-allow-or-block-endpoint-from-vpn-tunnel-connection-based-on-the-applied-security-posture-tag) i'm trying to create rules in order to block for i.e:endpoint with critical vulnerabilities to connect vpn. But in my console i do not have the option like showing in the link: Link console: My console:

Where can I found EOO, LSED, and EOS of fortigate 201F, fortigate 60F, and fortigate 201E? I just downloaded the list of hardware EOO from fortinet support, but i can't find this three on the list.

DearsI have fortiGate SSL and IPSEC RAVPN, i need to force user to change password.any guide please

hi,would it be possible or does it make sense to have a multi VDOM FG managed in FMG to be in separate ADOM?for example, the "core or critical" VDOM such as the "root" and "internet access" are added in the "root" ADOM, then the rest of the "customer" VDOMs would be provisioned/managed in a separate ADOM. we'll deploy an "internet access" VDOM deployment. refer to sample diagram/scenario.the root VDOM in the diagram will be our "internet access" VDOM, like an internet edge device. the rest of the customer VDOM will connect (vlink) to the root/internet access VDOM.  

Hi,we have a colleague that wasn't able to connect to our VPN due to a unrequested route added by 7.4.0.1645 version of FortiVPN VPN-ONLY client.  default via 192.168.1.254 dev en6 default via 192.168.1.254 dev en0 default dev utun13 scope link #this is wrong  Could this be a bug or a misconfiguration? Regards,Dimitri