Solved

Hi All, We are deploying a full-forti-site, with FortiAP's.We have a VirtualFG installed and configured, AP's signing in (Thanks DHCP Option config!) and are now starting to make WiFi Floor Maps.1: Maps from FortiGate does not sync to ManagerIf I create Floor Maps in FortiGate WLC, they do not sync back to FortiManager - why? 2: Maps created in Manager does not puch to FG.If I create WiFi Floor Maps in Manager, there does not seem to be any link to what FortiGate the maps are for, so they does not sync from FGM to FG.Even after putting AP's on the maps, there is no 'link' from that map to the FG that manage the AP's..  Can anyone tell me what the thoughs about this is?!?Do I really have to create maps on both platforms, that I need to manage two places?!? 3: AP Placement on FGM Google Maps?That is only the 'general location' from the FortiGate, not by AP.. it seems..?

I have 2 - FG 200F's. I have HA configured. I have 1 FG WAN connected to a modem going to fiber internet. My 2nd FG WAN is connected to a modem going to COAX internet. So, 2 different internet pipes. "FG1" is primary, "FG2" is secondary. While in this configuration, I can access and ping the internet from each firewall. When I force an HA failover, "FG2" becomes primary as expected, however, once it does, I lose internet access and can no longer ping anything on the internet (from "FG2" via CLI). I am not sure what I am missing. FW: v7.4.4 build2662 (Feature)Active-Passive

I only can edit a Windows App filter, but when trying to apply it to a secret, there is no option to enable it in Secrets settings

SHORT ANSWER AS PER SOLUTION - DONT USE CHROME OR EDGE WITH FORTIANALYZER :D Original post:I have a weird/odd problem around the FAZ web GUI where anything on the UI that has a drop down arrow option is non-responsive. The buttons have black boxes around them but when you click on them, nothing happens, no response, no additional options.All of the normal options and functionality works within the FAZ but it means I cant change date ranges when searching logs or even open the alert bell in the top right corner.I get the same behaviour in Edge and ChromeEdge - Version 114.0.1823.82 (Official build) (64-bit)Chrome - Version 115.0.5790.99 (Official Build) (64-bit) FAZ - v7.4.0-build2223 230514 (GA)Platform - FAZVM64-KVM I even went to the effort of installing the latest version of Java because you just never know... Example one: Example two: 

Good day,The logging disk on our Fortigate 101E has failed. We've received a replacement device via RMA. We do not have HA, so I chose to not transfer the license upon shipping of the replacement.  I've installed the FortiOS version we are currently running and restored the latest configuration. How quick is a license transfer when I'm ready to move to the replacement device? Is there any way to expedite the process? I've contacted Fortinet support and they haven't given me much information other than to say it could be up to 4 hours. Thanks for any advice/assistance. 

Hi, We need to update Fortimail which is in an Active-Passive HA architecture, but we don't know if we should upload the firmware image to the Primary Device and this Primary Device is automatically updated itself and the Secondary unit likewise similar to FortiGate with this architecture. Or on the contrary, we must update the Secondary Unit manually, set this unit as Primary and update the unit that was previously primary. Could you please resolve this doubt?  Thank you all.  Best regards.

Hi, i'm trying to use the cli in Forti Manager 7.0.12 to script a policy. config firewall policyedit 0set name "test-policy"set srcintf ZONE_LANset dstintf ZONE_LANset srcaddr test-1set dstaddr TESTGRPset service TCP_5000-6000set action acceptset profile-protocol-options PROXY_FILTERset ssl-ssh-profile SSL_FILTER_CERTset ips-sensor IPS_FILTERset application-list APP_FILTERset inspection-mode flowset internet-service disableset nat disableset logtraffic allset schedule alwaysnextend I can run this script successfully.  No errors.  However in the gui the policy does not contain the APP and IPS filters?Any hint? 

Hello FCT EMS adminsAnyone tried EMS 7.4.0 and its client FCT 7.4.0 in production environment?As this is a new release, any feedback on the stability would be appreciated. This will help us choose between 7.4.0 and 7.2.4.

Dear All, We have created an IPSec tunnel between our HO and local location. The LDAP servers are hosted on HO Location and are we login the firewall based on AD user ID. But as soon as the tunnel is up, we cannot access the firewall as well as FortiManager using that tunnel. We have to bring the tunnel down manually to access the firewalls through the LDAP user ID. We have checked the configuration and the routes and also we have tried adding the tunnel to our SDWAN rules as per the requirement but we are facing the same issue. Today, one of our ISP was down and the entire traffic was switched to the secondary tunnel and we could not access the firewall as well as FortiManager. Post the ISP was up, we had to bring the secondary tunnel down and then we were able to access both devices. Please align someone on this call as soon as possible.

Hello community,   we would like to configure our fortigate 100F SSLVPN Access with SAML and MS Entra. Unfortunately, we get the following prompt    We use the following MS Node: https://learn.microsoft.com/en-us/entra/identity/saas-apps/fortigate-ssl-vpn-tutorial Is it important, that we use a entra Plan or is the free Version okay? We use M365 business St. 

Hello Fortinet Community, I've been reading https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Configure-FortiNAC-Tags-with-FortiOS-7-2-4-GA/ta-p/255138 on configuring FSSO tags with FortiOS 7.2.4 and https://community.fortinet.com/t5/FortiNAC-F/Technical-Tip-Connector-based-FSSO-vs-Fabric-Based-with-FortiNAC/ta-p/31610on Connector-based FSSO vs Fabric-based SSO.Is it correct to understand that Connector-based FSSO will be deprecated soon, possibly even removed from CLI configurations? Should we be configuring Fabric-based SSO for new deployments instead? With FortiGate and FortiNAC using a persistent agent setup, how can we propagate AD User/Group information to FortiGate without Connector-based FSSO? Currently, with Fabric-based SSO I only receive Dynamic-FortiNAC Tag. Looking forward to your insights!Thank you! 

Hi i would like to know if fortiXDR can protect against apc or is some device in fortigate than can protect agains apc ? 

Hi Everyone,unfortunately I have some issues with FortiClient 7.4. It freezes during "connecting" and nothing more happens. For my colleague it works with the version 7.2.4. So could someone please provide me with this Installer?Thanks and kind regardsJan

Hello Community. I'm trying to run some newly created playbooks with Manual Trigger using csadmin user, then I want to run it on ingested alerts from SIEM or escalated alerts (incidents) using the Execute option at the bottom of each record, but I can't see the playbooks that I want to run. Why is this happening? Regards!

I cannot locate any information on vlans in the Fortigate 100F datasheet. How many vlans 100F supports. Please assist in locating the solution.

Hi, i trying download backup a fortinalyzer but i dont see where is the option

Dear Community, I was wondering if anyone could give me directions on resolving the below issue. I had to deploy the FortiSOAR in an offline environment, and all installation steps were successful except for the "Installation of ansible python library" which was displayed below as shown in the installation log. One or more tasks failed. Please check the configuration log for details.\nPlease exit the wizard now, get the issues fixed and re-run the wizard by running\nbelow command:\n/opt/cyops/scripts/config-vm.sh \n Installation of ansible python library has failed. Some of the filter expression\nused in workflows might not work.\nThis could be because of broken network connectivity to repo.fortisoar.fortinet.com.\nIf the server connects via a proxy, ensure that the HTTPS_PROXY is set correctly\nusing the csadm network command.\nOnce the network connectivity is verified, run the following commands to reinstall\nthe library:\n1. sudo -u nginx /opt/cyops-workflow/.env/bin/pip d

After upgrading from FortiOS 7.4.4 to FortiOS 7.6.0 on Fortigate 100F I cannot modify an interface by GUI because of the following error message:"Invalid DHCP range. Start address is greater than end address."The interface IP address is 192.168.68.2/23 manual mode and DHCP range is 192.168.68.100-192.168.69.254 with subnet 255.255.254.0. On the other hand, I can modify its configurations in CLI. Have no idea what's wrong here?

Recently, mac OS 15 (Sequoia) was released, and I would like to know if Forticlient 7.4.0 version will work normally on that OS.Looking at the Document Library, I still only have mac OS 13,14.Unfortunately, I can't test because I don't have a MacBook.If anyone is using Forticient 7.4.0 for macOS 15 (Sequoia), please replyThank you.  

Hello FortiSOAR Team, I do not find reference to FortiSOAR MT_RegionalSOC license type in v7.6.0 in comparison with v7.5.0.Please refer to below two links and compare. In v7.6.0 there is no reference to FortiSOAR MT_RegionalSOC license type. Is this FortiSOAR MT_RegionalSOC license discontinued in v7.6.0 ? If not then provide corresponding documentation reference. What will be the impact for existing FortiSOAR MT_RegionalSOC license deployed? V7.5.0 Web Reference: https://docs.fortinet.com/document/fortisoar/7.5.0/deployment-guide/223944/licensing-fortisoar#/document/fortisoar/7.5.0/deployment-guide/223944/licensing-fortisoar#License_Manager_Page V7.6.0 Web Reference: https://docs.fortinet.com/document/fortisoar/7.6.0/deployment-guide/223944/licensing-fortisoar#/document/fortisoar/7.6.0/deployment-guide/223944/licensing-fortisoar#License_Manager_Page ThanksMalaya Manas 

Hello team, This is a stack with 2 Fortigates 100F (A-P)We found in "FortiView - Sources", a machine with "30" in the column "Threat score", all the others had 0When I drill down, I found the followingThis was: biserka.xyz (phishing).I have tried to find any log with more information about this but without luck.¿Do you know where can I find more information? Thanks in advance.Regards,Damián

Hi,I'm new with Fortigate and migrating from ASA world.  I'm a little surprised that the fairly basic configuration causes difficulties even for vendor.The question is: Does version 7.x support setup where traffic should travel from policy-based tunnel to policy-based tunnel and where the NAT should be used for source address. If so, is there any document to follow so that the implementation would be done correctly?  Already found some articles but still wondering do I need VPN Concentrator config to enable traffic flow between tunnels?  

Hi,I would like to manage my switches from the FMG but many options are lacking, especially the "Block Intra-VLAN traffic". Same for SSIDs and "Block Intra-SSID traffic". How to enable these from the FMG ?Thank you.

Windows 11 (intune enrolled), FortiClient 7.4.0.1658.If I setup a VPN that doesn't have a certificate associated with it, I have no issues.But if I associate a certificate with a connection, about 2 seconds later the console crashes. If I open it up again, it will crash a couple of seconds later.It doesn't log an error at the time it crashes.I have to uninstall and reinstall again to get it stable again but can't associate the connection with a certificate.Anyone got any thoughts? 

Scenario:I have a network setup consisting of a FortiGate , FortiSwitch and multiple FortiAP . The connections are as follow:FortiGate:Port1 (FortiLink) is connected to Port 24 on the FortiSwitch.I have created VLAN 400 (named "MGMT") on the FortiLink interface, which is used for managing the FortiAPs.FortiSwitch:Ports 21, 22, and 23 are configured in VLAN 400 for connecting the three FortiAPs. These ports are working correctly, and the FortiAPs are connected.SSID Configuration:I have configured three SSIDs on the FortiGate in Tunnel mode.Each SSID is associated with a different VLAN (configured as optional VLAN IDs within the SSID settings).DHCP is enabled on the FortiGate for these VLANs.Issue:When clients connect to the Wi-Fi SSIDs broadcasted by the FortiAPs, they are not receiving IP addresses from the DHCP server, even though DHCP is enabled and configured correctly on the FortiGate for the SSID VLANs.Upon further investigation, I noticed that the VLANs associated