Solved

Hello community,I need yours help, when i make FortiGate-VM64-AWS (interface) #edit port1  set mode dhcpthen i getting this errorThis interface is being used by one or more dhcp servers.attribute set operator error, -236, discard the settingCommand fail. Return code 1

hi,i recently did a HA firmware upgrade following an upgrade path.the selection of HA primary kept changing due to high uptime.my question is, do i need to keep "forcing" back HA to original primary or just proceed to upload the firmware on the current primary (secondary unit).the serial with 795 is the original primary/active and 836 is the secondary/passive. # get system ha statusHA Health Status: OKModel: FortiGate-xxFMode: HA A-PGroup Name: xxFW01_CLUSTERGroup ID: 0Debug: 0Cluster Uptime: 264 days 9:33:6Cluster state change time: 2024-10-03 15:04:23Primary selected using:<2024/10/03 15:04:23> vcluster-1: FGxx836 is selected as the primary because its uptime is larger than peer member FGxx795.<2024/10/03 15:01:40> vcluster-1: FGxx836 is selected as the primary because it's the only member in the cluster.<2024/10/03 15:01:31> vcluster-1: FGxx836 is selected as the primary because UPGRADE_SECONDARY flag is set on peer member FGxx795.<2024/10/03 14:59:19> v

Hi, I have to import rules to a production SIEM.  Many of these rules contains a eventType IN (Group@PH_SYS_EVENT_Group). We have noticed those conditons are broken when imported in the new SIEM and we have to remap them manually to the event type group. My question:  Is there a quicker way to make those statements working? Thanks,

Hi everyone,I`m new to forum :)My question is:Is there a way to drop (not block) external traffic into my WAN without logging it?By country or by IP range or single IP?The goal is to block certain IPs so they can't even port scan my firewall.I can`t find too much apart from Deny ipv4 policy which still logs everything.I have Fortigate 60F.Thanks

Hello Community,we do have a problem with EMS. It suddenly stopped letting users log in to EMS and getting a valid license for FortiClient. Dashboard show 0 from 100 used. Licenses are still valid till 2026. We already created a ticket, but the answer by now was upgrading EMS from 7.2.0  to 7.2.5. and try to resync the FortiCloud or uploading the .lic file manually.The last two things did not help. We already did this before opening a ticket.Does anybody knows this issue and were to look for any informations? Setting the Log Level to debug doesn´t show me anything interesting.EMS services and SQL is running.I would like to troubleshoot the issue not only upgrading, because I can´t find anything in Release Notes about that issue and I´m afraid of breaking even more.Users, partially, have just white screens, if they open the Forticlient console. So, there is no change to retype a password if needed.Forticlient version is also 7.2.0 (Windows 10/11) Thanks,Thomas

Hi All !On my FG201F device dashboard, I see the status of "System DNS Servers" has unstable latency (sometimes very high). It seems to be affecting our network performance.Note: This device is running firmware "v7.4.5 build2702 (Mature)" with 4 Internet lines (divided into 3 SD-WAN groups), the system is also divided into VLANs.Could you please assist us in diagnosing this issue? Any guidance on potential configurations or troubleshooting steps would be greatly appreciated.Thank you for support.

Hi All, General question about memory optimization and firmware. I have a 60E that does a lot of work and runs quite high in memory, and has recently started hitting mem conserve mode. I'm aware there are a few ways to bring the memory down, and I am exploring those, but what about firmware? Are there any memory efficiency gains from potentially updating firmware from 7.0.11 to another version? If so, would Fortinet be able to advise which version to try upgrading to? Cheers 

Hi, We have a simple architecture :- a wan int for incoming request to our servers with static nat- several int for internal servers and users ressources- a single default route for outgoing and reverse traffic- several static routes for different ressources and sites All goes well. We recently had to manage a new public range, with new internal servers. For different internal reasons, the two public wan have to be separated and using the same vdom. We dedicated a wan int to the new range. Default route is still on the old one.When we try to reach the new public int from outside, the famous "msg="reverse path check fail, drop"" raised. Doc : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Detailed-Guide-on-dual-WAN-setup-for-targeted/ta-p/276308 was very good information, but does it apply only for egress traffic, or is it for ingress traffic too ? In other words, we want to expose services on internet on two separates wan int on the same vdom. B

I've been having issues getting my AP to work while building my network. I have a Fortigate 40F connected to a Fortiswitch 108F connected to a a FortiAP 221E. The Fortigate is running 6.4.15 and the AP is running 6.0. The AP shows up in the Wifi/Switch controller > Managed FortiAPs and shows that it is online. Its broadcasting the SSID I setup, but when I connect to it, it shows connected with no wifi. It also has a VLAN with a manual IP config.I'm confused and need help, would anyone know why this would be doing this?Also does anyone know how to delete VLANS, its not giving me the option to delete them. I want to try and put them on the fortigate instead of the switch

I am accessing the site when I go to generate a file to download it does not download, would there be any way I can check and the domain is blocked, I did the release of the site, it was already F12 in Sources and nothing.

Hello,I’m experiencing an issue with my FortiAP after performing a reset, changing the password, and configuring a static IP address. When I connect or add the FortiAP to the FortiGate and try to log in to the FortiAP, the password I set no longer works.Additionally, I am unable to access the FortiAP via SSH because the password is being rejected.Could you please help me resolve this issue?Thank you in advance for your assistance.

Hello everyone, I’m back with another issue related to FortiNAC... In the client's network infrastructure where FortiNAC is deployed, there is an Explicit Proxy configured on the FortiGate.If I disable the proxy on the test machine, the FortiNAC Captive Portal appears as expected. However, when the proxy is enabled, the traffic bypasses FortiNAC entirely, and I can browse the internet without being redirected to the Captive Portal. I’ve tried creating Proxy Policies to deny traffic from the isolation VLAN subnet, but this still bypasses the FortiNAC registration portal, and I receive an error indicating that internet access is blocked. Is it possible to forward traffic from the FortiGate proxy to FortiNAC? I couldn't find any reference to "proxy" in the allowaccess settings for FortiNAC's port2 interface.Thank you very much for your help!

132>1 2024-09-30T19:28:50.597024Z adadsads61.irasp.etta asd.asdt.gads.asda.com NILVALUE NILVALUE - {"adf":true,"significant":0,"udf":false,"virtualservice":"virtualservice-333afa37-f201-4d1c-bc3f-3fe7a5e337fa","report_timestamp":"2024-09-30T19:28:50.597024Z","service_engine":"z9900001awaf401-se-jmonv","vcpu_id":0,"log_id":123935,"client_ip":"199.19.253.11","client_src_port":25458,"client_dest_port":443,"client_rtt":8,"ssl_version":"TLSv1.3","ssl_cipher":"TLS_AES_256_GCM_SHA384","sni_hostname":"asd.asdt.gads.asda.com","request_state":"AVI_HTTP_REQUEST_STATE_SSL_HANDSHAKING","significant_log":["ADF_CLIENT_CONNECTION_CLOSED_BEFORE_REQUEST"],"vs_ip":"1.1.111.10","ocsp_status_resp_sent":true,"max_ingress_latency_fe":0,"avg_ingress_latency_fe":0,"conn_est_time_fe":8,"source_ip":"199.19.253.11","vs_name":"asd.asdt.gads.asda.com"}

Hi all. Ive been setting up brand new Fortigate 100F.There is only one cable between them: HA port 1 to HA port 1. However it keep saying out of sync because of the table  ips.sensor.I have seen this before on 70F aswell. Im running v7.2.8 build1639 (Mature) I have tried to recalculate #diagnose sys ha checksum recalculate but no result.

I have created Fortlink with dedicate to Fortiswitch checked. I setup internal DHCP and connected POE switch with Access Point. I am getting DHCP management address to switches but not getting DHCP from downstream port where access point is plugged in. There is no way to tag Fortilink interface in any downstream switch port unless I create interface type vlan. My question is, is there any way to use Fortilink as management vlan to provide DHCP for switches and DHCP also for  access points only using Fortilink rather creating a separate interface type vlan under Fortilink and add downstream switchports to it. I would like to know if this is possible.   

I have a question regarding Radius Server with Dynamic Vlan Assignment for SSD profiles. Basically I would like to have Dynamic VLAN Assignment and VLAN pooling enabled. I am running 7.4.5 code version and whenever I enable Dynamic VLAN Assignment, it disabled the VLAN pooling. I did find a documentation that it is possible 7.4.1 version came that both dynamic vlan assignment and vlan pooling is possible, reference: https://docs.fortinet.com/document/fortigate/7.4.0/new-features/924614/support-dynamic-vlan-assignment-with-multiple-vlan-ids-per-name-tag-7-4-1However; this is not working in code 7.4.5 code version. I would really like to have this feature that support vlan pooling with Radius because this setting in Cisco called RADIUS Server Overwrite interface, Meru called Radius With VLAN Pooling, allows us to have restricted access and unrestricted access at the same time based on the Network Policy server rules. This makes it easier to have users in groups tied to authenti

Fortimanager version 7.4 and Fortigate version 7.4.3. Fortigate is 40F.While pushing any config to Fortigate below line automatically come sin the config preview. The installation faisl due to this config too.config web-proxy global set proxy-fqdn "default.fqdn" endbelow is the error getting. Any idea to fix this please.------ Start to retry -------- 40F-TEST $ config web-proxy global 40F-TEST (global) $ set proxy-fqdn "default.fqdn" 40F-TEST (global) $ end ---> generating verification report (vdom root: web-proxy global:proxy-fqdn) remote original: to be installed: "default.fqdn" <--- done generating verification report install failed 

HiYesterday I had to disable full SSL inspection in our proxy policies due to poor browsing performance. Fortigate 200E running 7.0.15 No policy changes were made, and user numbers, session numbers and interface throughput are average for daily use. This is an edge firewall. I tested early this morning before most users were in, and still had slow performance. I tried restarting the WAD processes, to no avail. CPU and memory are both fine, with no change when DPI is disabled/enabled. I notice no change in CPU/SPU ratio when turning DPI on/off either. Any ideas where I should look to diagnose this, and has anyone else experienced a similar problem?  

Hi, The Fortigate 50G-SFP documentation does not specify whether the SFP port can function as a secondary WAN. Does anyone have information about this? Thanks!

Our health check has come back that our login pages are viewable over the internet.I have disabled HTTPS/HTTP over the WAN but page still shows.Any quick fix please?Thanks

Hi,I've looked on Broadcomm's (nee, VMware) support site, but I was hoping someone here has already delt with this and might share the port list to successfully connect 1 vCenter server to 1 host and 2 VMs over a site to sire IPSec tunnel. I'm looking to limit access of the whole remote network to the vSphere infrastructure.TIA 

We have some hyper-v VMs that we upgraded from 7.2.3 to 7.2.5 forticlient. SSL VPN no longer works after upgrading.We can repeat the problem by downgrading to 7.2.3 and then successfully connecting then upgrading to 7.2.5 and breaking it again.we need to run 7.2.5 to fix a wild card FQDN issue with ztna destinations that we were experiencing on 7.2.3.

Hi Forticollegues,I'm implementing a Fortinac solution to manage dynamic vlans via unique WiFi SSID.The wifi networks and all wired networks are managed by Fortigate.In Fnac inventory I see all Fortigates ports mapped and FNAC learn all client mac address from wired and wireless ports.There is some methods to instruct the Fnac to learn mac address only by wireless networks? I don't need to manage all wired networks and I see a lot of rogue devices from Fortigate wired ports.Thank youVincenzo

Hi,we are sw company, and have own security product (authentication server). It can work like radius + otp (and many others methods) so I try to integrate OTP to ftgt. It works (with free ssl vpn client). But after I try use 2FA online method, with push notification. And here I have problem. Forticlient send AD user name and correct password, mobile app recieve notification, but FortClient instantly shows OTP dialog. With no reason, I not send more validation req. -- UPDATE ---This is because I have second functional radius server with MS365 MFA on it. And fortigate from unknown reason switch to this, second server, almost instantly after password send. When I change IP of second radius to nonsense, everything works.Fortios have only 2 parameters I know, timeout in radius definition, and global, remoteauthtimeout. Both set to 120s and not helping.This seems now like some error in fortigate logic, so I create ticket on it, sorry for this post, I believe in time of writing that this can

Hello Community. Please give some tip on how to create lists like (words, emails, names, etc) for later use. case scenario: using the filter "Mail Sender" --> IN --> (select from cmdb the list emails)   Regards.