Solved

Greetings all,I'm having an issue which I get the sense will be a simple fix but I'm at a bit of a loss. I'm trying to add a certificate to iOS to use for connecting to a fortigate vpn. I have no trouble getting the certificate onto the iphone and forticlient detecting it, but its asking for a passphrase. I generated a certificate key pair via Easy-RSA and was able to upload them to the Fortigate without issue. The private key has a password so I was able to enter that into Fortigate without issue. But on the iphone, my understanding is its just the one file, and it needs to be the certificate, which does not have a password. But the app will not let it be used without a password, and leaving it blank returns incorrect passphrase.  What am I doing wrong? I'd appreciate any help. Thanks!

Can we disable the hit count in the rule?

Hey everyone.I had a quick question about the following:SetupManagement - FMG 200GHUB - FG 201F HA pairSpokes - FG 40F HA pairsSDWAN overlay config is set to use ADVPN and spoke to spoke connectivity has been confirmed.Our customer is asking for reports related to performance SLAs between spokes.  I understand that performance SLAs generally point to the hub as configured by the FMG SDWAN overlay template.  I've read up on how the spokes build the shortcuts between themselves, but I haven't been able to find anything related to building a performance SLA between spokes.Is SDWAN with ADVPN able to do this or is this something that's easier seen in a custom report?  I've tried a few shots in the dark with configuring performance SLAs between spokes, but I've had no success so far.  I feel like having a standing SLA between spokes might mess with things and create a huge processing overhead for every device involved.I appreciate any insight or help and thanks in advanc

Hello team,   On Firewall FGT, When a user with administrative privileges is added\modified\removed on a Fortigate firewall is there a specific event that we find in the logs? Or is it something that needs to be manually enabled?   Thanks in advance BR

Hi,It is possible to aggregate wan1 & wan2 (or SFP1 & SFP2) ports on fortigate 90G please ??I created two aggregate : - The first,  with port 1 & port2 --> ok- The second , ports wan1 or wan2 are not in interfaces list ...Thanks.  

Hi, I will be transferring my unit from one FortiCloud account to another.Will the existing licenses and existing configuration be retained once the device is transferred? Thank you! 

Hello everyone, I am deploying FortiMail-VM01, i registered the VM and license (ATP) in Fortinet's support portal and downloaded the file  I deployed the image on the hypervisor Hyper-V. On the CLI the Fortimail displayed the serial number as the name of the VM My problem, when i try to upload the license file on the GUI it says "Invalid license" and on the general information of the Fortimail the serial number displays "FEVM00UNLICENSED" Does anyone ever had this issue ? if so i'll be taking any advice to resolve this problem Kind regards,

Hello, I need an urgent supportI am doing ztna configuration and fortiems on prem,For off-net and on-net users, I created a record as fortiems.xxx.com for users in both local dns and global dns,I created fortiems.xxx.com for off-net users, the dns record is in the same subnet as the wan ip but it is not a direct wan ip, I need to announce this ip behind the wan interface to get telemetry data, but I do not know how to do this, I entered the wan interface as the second ip, but it did not seem like a correct configuration, I cannot see it in the arp table.Can you help me for this 

Hi, I need to access a website, but even though I have listed it as "Exempt" in the web filter profile, the stations still time out. How can I fix this? I have an outbound policy that allows all traffic with specific countries permitted. The website I need to reach is "scopus.com." How can I ensure access without creating a dedicated policy?Kind Regards,Sisma

Hello Fortinet Community, I'm seeking advice on the best approach to secure our network. Our goal is to allow access only to domain-joined PCs and implement compliance checks.We currently have FortiClient installed on all user devices, and I’m trying to determine if we also need the FortiNAC Persistent Agent, or if integrating FortiNAC with EMS would be sufficient.Is there a comparison matrix available that highlights the features of the Persistent Agent and FortiClient specifically related to FortiNAC?Any insights or best practices would be greatly appreciated. Thank you!FortiNAC FortiClient 

HelloIn FortiMail, we can configure for each domain only 2 SMTP servers (primary & failback).I need to configure a third one (another failback server) but I couldn't find a way to do from GUI or CLI.Any help would be appreciated. Otherwise why this limitation?

Hello,I use fortigate and fortiauthenticator and my configurations are correct,but some users can establish a connection after a few tries while vpn,When I look at the fortiauthenticator logs, it says that the user was previously authorized and remains in the cache, remove itlogs as below how can I solve this problem ) facauth: Sending email token code (timeout 180) to firat.gazel@cnbce.com 2024-06-13T13:56:29.921757+03:00 FortiAuthenticator radiusd[24056]: (34) facauth: Updated auth log 'firat.gazel' for attempt from 10.100.100.1~176.236.73.154: Remote LDAP user authentication partially done, expecting email token 2024-06-13T13:59:18.771835+03:00 FortiAuthenticator radiusd[24056]: (35) User-Name = "firat.gazel"2024-06-13T13:59:18.772239+03:00 FortiAuthenticator radiusd[24056]: User-Name = "firat.gazel" 2024-06-13T13:59:18.772331+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: ===>Username:firat.gazel 2024-06-13T13:59:18.773880+03:00 FortiAuthenticator radiusd[24056]: (3

Hello everybody, i would highly need your assistance in preparing for FCP Network Security Exam, i can see that there's a core exam which is NSE4 and one elective exam my question is how to prepare to the exam ?there're alot of topics in FCP network security, may i know which topics is mandatory for the exam and what should i start to study as i must take the exam in a month from now ??where the NSE-4 topics?! how can i get it ?please assist!    

Long time lurker, first time poster. Hi everyone.We’re upgrading some FortiAP 221C access points with FortiAP 223E access points. Straight swap I thought and plugged the 223E into the same PoE injector which was powering the 221C, a Ubiquiti branded PoE-AF injector - UniFi PoE Adapter (15W) - Tech Specs (ui.com). The document that came with the 223E AP says to use a PoE AF injector.This worked fine on my test bench. The 223E powered up and I was able to add it to the controller, then took it to its permanent location where is failed to power up at all. Now it won’t power up on my test bench either.I contacted my reseller who said I needed to use the GPI-130 PoE injector which is a PoE AT specification? I purchased one which has worked with a second 223E on the same cable that the first one failed on using the AF injector but I can’t understand why?

We are in the process of doing a basic Forticlient EMS setup. I've been going through all documentation and searching for answers to the last part of the puzzle.  Our setup: Forticlient EMS on Windows ServerFabric is configured on FortiGate and syncing tags correctly (although not currently used)We have setup a VIP to permit the telemetry port 8013 through to the EMS server. We have configured one ZTNA connection for an RDP server. We are currently using default 443 for the ZTNA connection to the inside device on port 3389 just for testing. The client device is connecting to the EMS server and is receiving the ZTNA destination correctly.  We have configured a ZTNA Server to allow the TCP traffic from external ip on port 443 to the internal ip on port 3389.  We have also created a Firewall Policy for ZTNA to allow the traffic to the ZTNA Server. But at this point when we try to connect to the RDP server on our test machine, we never see

Hi. I registered FortiSwitch to my previous account, and now i would like to move registration to desidered company  account. Is it possible? For FortiGate it's quit easy. I cant find any info in documentation and in GUI/CLI. Thanks for any tip.  FSW 124F - 7.2.4. Managed by FortiGate. b/rwkasprz 

Hi,I have a brain-damaging situation ;) and maybe someone out there has a good idea.We have a Master/Slave Fortigate setup. On each Fortigate, we have 2 uplinks, which may contain the uplink because of redundant BGP setup behind.I now have the problem:- Do I assign Port 1 for the first BGP uplink to the SSL gateway, it would not work, if Port 1 is down and Port 2 is up- Same here, assigned Port 2, is the same, as with Port 1- I would need to assign an ip-address on both ports. So I could enable both ports for the SSL VPN gateway. VRRP would not work, because both are active and up because the routers behind are, tooWe need it, that are staff can login to the VPN, not using different hosts / IPplease, no DNS Stuff with refresh/TTL, this is not the kind we use to fix the problem ;)Any help would be niceThanksRonny 

Hello everyone, I have two Fortigate 201F firewalls in HA (active-active mode), both firewall are connected to the same Switch core (two stacked switches) which are connected by an aggregate port (two sfp for device). The problem is when I try to disconnect the two sfps from one forti to view if the traffic continues to the other firewall, this results in that traffic won't reach. It is as if the second firewall does not receive any traffic, but on the first firewall if I only disconnect a single SFP the traffic continues to arrive.Why the traffic wont arrive from the second firewall?

Let me submit one issue ...In my network, I have two FortiGate 201E firewalls (both are same model but different serial numbers) ...one is use for production (it is with licensed) and another FortiGate 201E is no use (just for backup purposed and licensed expired). I have taken configuration from production one and try to put in my backup firewall (backup config is put to backup firewall).  After config received and rebooted the backup firewall, it can't access with web access (normally we have access with https://(firewall iP:44443)) but I can access with SSH. I can see https, ping, ssh, are allowed access from backup firewall's management interface.  So, is there any issue? It is related to licensed expired on backup firewall.  If anyone got same issue..., could you please suggest to me for how to. Thank you.

Hi community, Under interface there's 2 setting where we could set the estimated bandwidth, however I am not sure sure to understand the difference and/or how they relate to each other or rest of config.  config system interfaceedit "my-inet-iface"set inbandwidth <some_value_in_kbps>set estimated-downstream-bandwidth <some_value_in_kbps>set outbandwidth <some_value_in_kbps>set estimated-upstream-bandwidth <some_value_in_kbps>nextend I do understand the need of those values, but I find them redundant and/or not sure how they relate to other config (QOS/SD-WAN) 

It Posible to manual Block Type FileHash-SHA256?  example  

 Is it possible to RSPAN vlans from managed FortiSwitches...  All the articles I have been able to find are for standalone switches and only talk about mirroring a port not a vlan.  With the Cisco equipment it was possible. See below: 

Hello, I've built a Hub-and-Spoke lab as I need to deploy SD-WAN, which is my ultimate goal here. The configuration went smooth with no issues I can remember. However, after the configuration is complete, and BGP is up, the spokes are not able to reach each other. I tried troubleshooting, and found that the Hub is not passing the traffic. Below is my topology on EVE/PNet  I'm not sure where the issue is. But the firewalls doesn't pass the traffic through the tunnels! I need to get SD-WAN fully running here. All 3 firewalls are running the same version: FortiOS-VM64-KVM v7.2.4,build1396,23013 (GA.F). For the IPSec Tunnels, I created the tunnels using the wizard using the Hub-and-Spoke Template I'm really not sure what is missing here.

Hi, everyone. I'm curious about the same content as the title, so I post it on the forum.  FortiAP is currently using FP221E and FP231F FortiSwitch is using 124E and 424D I'm trying to patch both AP and Switch FP231F is patched to v7.2.5 and I'm trying to patch FP221E with the same version, but I don't see the latest Firmware Image of FP221E The current operating system version of FP221E is FP221E-v7.2-build0280. I also tried to patch FortiSwitch 124E to v7.4.2 and patch 424D to the same version, but I don't see the latest Firmware Image as above. The current OS version of 424D is S424DN-v6.2.4-build213,200501 GA.https://www.fortiguard.com/psirt/FG-IR-22-038 In particular, fortiswitch is trying to patch it to solve the vulnerability, and if you know the answer to my question, please reply. Thank you.  

Hi All,If we configuration User SSL-VPN, Can we configuration One ID per One user concurrent access? Example:I just only can login my SSL-VPN with my laptop only.  If i have TAB/IPAD, I can't login with TAB/IPAD.**The configuration without enable MFA. Fortigate Version 7.2.7