Solved

Hi Im looking to do the following, I have 3 wan interfaces (wan1, wan2 and wan3), im looking to make an arrangement of sdwan so some of the users (UsersA) primary output is wan1 with wan2 acting as the fail over, and the rest of the users (UsersB) use wan3 as their primary output with again wan2 acting as a fail over. The issue im coming across is how do i prevent from Users A from using wan3 as their output, I've set up the users A rule for wan1 and wan2 but when both of these are inactive their output then becomes wan3. Same case for usersB, if wan2 and wan3 are inactive their output becomes wan1. UsersA should never use wan3 and UsersB should never use Wan1 How do I prevent this?, the rules only have their respective wans selected but if none of their wans are available it uses another wan not in its rule.

i setup 2 IPsec tunnel with counterpart at AWS. the tunnel is working fine but there are 2 separate links showing that the tunnel is down.how do i remove the unwanted tunnel.phase2 selector route is down.or shall i do i reset to bring up the tunnel.

I have a 100F and the WAN Interface only shows speed settings for auto. No 1000Full, 100Full, ect... Fortigate is on 7.2.8. If I go to a lan port I have more options. My ISP has set their interface to 100Full, but on the fortigate get hardware nic wan2 it's showing half duplex 100. I am not able to force to 100Full. Are 100F's not able to set port speed other than auto?   

My goal is to implement FSSO for the purpose of creating firewall policies based on group membership. The caveat is that there is no LDAP server to provide group membership. We have a custom VPN application that is successfully sending username-to-IP info to Fortigates using API method here (https://fndn.fortinet.net/index.php?/fortiapi/1-fortios/3828/1/user/). However, this makes policies cumbersome because they can only be populated by source users and not groups.  Any ideas ? Could Fortiauthenticator solve this problem in some manner ?Don 

I own a Fortigate 60F. I'm a contract worker, operating from home. The company I'm working with demands that I'm behind a firewall which is set to reject ALL TRAFFIC except only needed services and web sites, just so there is maximum rejection of anything from the outside. I have also purchased the package which has IPS so that I'm in compliance, as they are most concerned with asset egress. It's Draconian, I know. My question is, what is the most efficient way to configure for this, using the fewest policies? To simplify, let's assume I need the following 3 "essential" things: 1. The company's Okta site, we'll call it "company.okta.com"2. Ability to sync with the Dropbox service3. An Apple file server, let's call it "afp://server.company.com For example, I can't tell whether using the Web Filtering is better than an individual policies which specify FQDNs, etc.Is it best to create a policy just specifying Dropbox's "Internet Service" services? Or some other method?Thank

we are settinng up our own networking monitoring tools using Opmanager.what is the proper way to configure snmpv3 for our fortigate firewall so that the Opmanager can recognize our firewalls ?

I have FortiClient EMS Cloud and so far I have been sending out invitations to my users so they can download the client and use the CODE from the invite to register to the EMS. However, support has told me that to manage auto updates I need to create an installer for all my users some how deploy the installer to the users.  Yet, it seems to me that Manage Deployments is really for auto installing on AD Servers/ Clients.  But this probably will not work for MACs.  Nor would this work for users who's machines are not port of the Domain. So that seems to mean I need to create FortiClient Installers for users.  And give them the download link.  Only 2 problems with this method that I see.  I do not have an updated Client yet.  (Not sure its been released yet.). So if I give them the link now they will just end up re-installing the same thing they have now. Am I going down the correct path?  Are there any better docs on this then FortiC

Helo all.I have issue after reinstalling my computer to latest Windows 11. I've installed Forticlient 7.2.4.0972. I has two profiles that uses personal certificates and username an password. I has also two certificates with private kyes in Windows Key store in Presonal Certificates folder. When i try to connect to VPN in drop box i only see one certificate, even if i have installed two personal certifiactes. When i try to create new connection, i see both certificates, but after saving new connection i can't see one of the certificates in drop box again. I've tested this on two independent computers. My college also try to import my certificate on his computer (Windows 10 and older Forticlient version) and he see certifacate and is able to connect to VPN. I appreciate any help.Thank You

Hello, following this configuration scenario, what I configured is a redundant that looks towards the primary router and the secondary router and put the monitor of this redundant under it, in case a link of this redundant goes out it automatically switches it to the secondary or does the primary remain active?PRIMARYconfig system haset group-id 2set group-name "FGT-HA"set mode a-pset hbdev "ha1" 50 "ha2" 60set session-pickup enableset override enableset priority 250set monitor "Redundant"endSECONDARYconfig system haset group-id 2set group-name "FGT-HA"set mode a-pset hbdev "ha1" 50 "ha2" 60set session-pickup enableset override enableset priority 150set monitor "Redundant"end BR, Giuseppe

Hello, everyone! I am facing a question regarding custom scans on FortiNAC.Currently I have a scan to check for my AV service. Every once in a while the network agent gets updated and the syntax for the service name changes. After that, all my hosts start to fail the scans.Is there anyway to turn the service name into a regular expression? Let's say, instead of checking for a service "ABC.20.17", am I able to check for "ABC.20.*" for any patch version of the given service? Tried on my lab environment but did't work. Appreciate the help! FortiNAC 

I have been watching Rumble on my network for years.  Suddenly, midmorning today, I could no longer watch videos on Rumble.  Most of the images on the home page are blocked.  When I try to start a video on my PC, I get no video feed just the html page. When I attempt to watch videos on my Apple devices with access through my Fortigate, I get the video for the ads, but the main video will not run. I also get a message in the video box which says, "The certificate for this server is invalid".  When I access Rumble on my Apple devices using cellular data, everything works perfectly. There is no issue viewing YouTube, or any other sites I have tested. There have been ZERO changes to the configuration on the Fortigate.  The bios is up to date, and last update was several weeks ago.  Rumble video was working for most of the morning, then suddenly stopped midday with the issue describe above. Has this happened to anyone else? 

version : 7.2.3.0929 when i put ID/PASSWORD, i can see status : connecting... forever.. and no raise up percentage. just connecting.im sure connection setting. whats the problem? 

Hi, Can we extract indicators from a password protected file (pdf, csv) ? Thanks

helloI have two FG 30eI CONNECT between fg1 and fg2 (connected by SD-wan) site to site no NAT1...when i connected site to site it is working but clients cannot open any URL by SD-wan( I put routing to SD-wan and put IP policy to allow  traffic but no work)2...i can ping from client that connected from fg1 to clients connected to fg2 but fg2 can not ping to any IP in fg2 whycan help me please

HelloI have FotrtiGate100FI have 3 building in my company each building has connection to MY FortiGate Building A - connect to port 17   ( I create VLAN 10 for LAN and  VLAN 11 for AP )Building B - connect to port 18   ( I create VLAN 12 for LAN and  VLAN 13 for AP)Building C - connect to port 19    ( I create VLAN 14 for LAN and  VLAN 15 for AP)I need All AP  in all Building to take IP Address from same range anyone can help me thanks for allbest regards.

Hi all ,Please , i have an issue with fortisiem when i generate report for last 7 days and export the result , the exported file not showing all days , its show just last 1 day .Thanks  

Hi, We are replacing a FG-80E with an FG-81F (7.2.8) and hit the following issue when changing the external IP address for our VIPs from test to live that the live DMZ machines are not contactable from the internet. We have setup the FG-81F with a temp external IP address A.A.A.100 and two VIPS A.A.A.101 and A.A.A.102, these are both mapped to 10.10.10.13 and 10.10.10.14 and a test Linux machine is sitting there and is quite happy, it can be contacted from the outside and ping to the outside world. So it seems that the firewall policies are happy. When we replace the IP addresses with the actual live ones A.A.A.50, and VIPS with A.A.A.51 and A.A.A.52 then our live Linux servers (10.10.10.13 and 10.10.10.14) can not be contacted externally and they can not ping out. They can be contacted from the LAN->DMZ though, if the machines on the LAN contact them via their external IP addressed they can, however external machines can not contact them. The only changes we mak

Hello Team I created 6 VLANs on an interface, I want to configure a rule to communicate 5 VLANs to one, but I can't find how to do it. The single way is set one by one rule. Does anyone know how I can do this? Regards

from time to time FortiManager 7.4.3 tries to "modify" my CLI template from "config system global" to "config 1 system global" when pushing to FortiGate Firewall 60F/100F/200F. I can force this error by "retrieve config" and pushing "policy package AND device settings" afterwards. Pushing ONLY device settings works and does not have this issue and once only device settings are pushed policy also works :) Does anyone else have this issue or maybe a solution?  Thanks...

Hello everyone!I was wondering why is not possible to assign named address to SD-Wan, or I'm missing some option/configuration that enables it.For example:I have this static routesAnd I want them in a single static route with named address I'm using a Fortigate 100E with FotiOS 7.0.12 Thank you for taking the time to read my question and for any help you can give me.

I have searched high and low, but cannot get a clear answer on this, created a CSR last year for a Fortigate, got it signed by ROOT CA, installed cert and used it for SSL VPN, no problem at all. Now its renewal time, got the new cert from the signing authority GODADDY, and I cant install it?  I have the ROOT CA cert on there, so I goto Certificates > import > Certificate > Local certificate, select my .cer file and I get this "Certificate file is duplicated for CA/LOCAL/REMOTE/CRL.cert"  I assumed I would delete the old one and replace with this one, same issue? any help please? the troubleshooting link for this error is not helpful, I really dont understand why it doesnt work Thanks

Hi Everyone, I'm facing a strange problem, I have 2 usernames which are working fine on different machines but on some specific machines as soon i hit connect it got stuck on connecting with no progress. I'm facing this issue on windows 10 pro machines. personally i have tested it on windows11 and it's working fine on them. I'm unable to see any logs when the user is stuck on the connecting stage.   

I have 2 standalone FGT200E firewalls running 6.1.15, for the last month Qualys has failed the PCI ASV scan with a detected vulnerability QID150004 Predictable Resource Location Via Forced Browsing, its finding an /image/ fileRESULT:url: https://x.x.x.x/images/Payload: https://x.x.x.x/images/comment:Original URL is: https://x.x.x.x/matched: HTTP/1.1 200 OK I have SSL VPN in tunnel only mode, web mode disabled I came across an article https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-prevent-the-SSL-VPN-web-login-portal-from/ta-p/215905 to stop the web login page from appearing, which i applied to no effect. I also changed all the portals to not allow forticlient download in case this was causing the problem. Nothing has changed on Qualys that i know of & as mentioned scans were fine until the start of July.I've searched forums, google etc but not coming across any similar issues. 

Is there a way to configure FortiGate to not reflect the DHCP server IP when the end user (guest) opens command prompt on the client machine and perform an "ipconfig /all"? If there is no direct configuration, any other ways for us to hide the IP of DHCP server? Thank you!

I am having a problem running an automation to backup my computer. I want to send the backup to a sftp server of a remote branch, connected to the fortigate equipment from which I make the backup, and it is as if it did not arrive. If I do a ping it arrives, but I have to specify the source. Does anyone have any idea how I can fix it?The traffic and routes are allowed on both sides. But when I launch the "execute backup" it doesn't arrive. When pinging I have to add the source option to allow the traffic. Packet Trace #7,2024/08/06 15:59:27,"vd-root:0 received a packet(proto=6, 181.14.198.42:6817->10.1.4.121:22) tun_id=0.0.0.0 from local. flag [S], seq 4203643946, ack 0, win 65535"Packet Trace #7,2024/08/06 15:59:27,"Find an existing session, id-060b7b91, original direction"Packet Trace #7,2024/08/06 15:59:27,"enter IPSec interface VPN_IPSec1, tun_id=0.0.0.0"Packet Trace #7,2024/08/06 15:59:27,output to IPSec tunnel VPN_IPSec1 vrf 0Packet Trace #7,2024/08/06 15:59:27,"No matchi