Solved

hi hello allI need to replace a FGT200B v5.2.13,build762 (GA) with a FGT 400D v6.4.9 build1966 (GA) but I can't find the option to add "device"User and Device -> Device -> Device Definitionspresent on the FGT200Bis it a device or firmware version problem for the FTG400D?any suggestions about new hardware and firmware.thanks a lotMassimo

Hi All,  Customer is running non forti APs with a Wireless Controller located over an IPSec VPN from my Fortigate to their ASA.   AP's are losing their connection to the controller, and the customer is confident the Fortigate isn't sending on CAPWAP traffic.    I thought this might be an MTU issue, with ASA side set to 1500, Fortigate was set to 1420 so I've increased it to 1500 but issue is still ongoing,  Any ideas, or debugs I can run to help determine the cause?   Thanks, 

When ADOMs are activated, When ADOMs are activated, Hello, I'm a beginner and I've activated ADOM in my lab.I have 2 ADOMs:  - ADOM Si1 - ADOM Si2 And a third ADOM that was created automatically. THE ROOT ADOMThere is no policy package in this ADOM.What is it for? Thanks for your help.

I’m working on a project where a client is installing a new camera system. The vendor will provide their own router and PoE switch. We need to connect this router to the client’s existing firewall (91G), and the client has available public IP addresses. Can I configure the 91G firewall to pass-through mode, allowing the vendor’s router to use a public IP directly? Or is there a better approach to integrate the vendor’s router with the client’s firewall? BTW, the camera vendor will handle all system management independently and requires full access to their equipment, which will be completely separate from the client’s network. Thanks!

Hi all, i am trying to get a certificate for a cmp client from the FAC (6.6.0).In beforehand igenerated a .pem keypair on the cmp client. (openssl genrsa -out key.pem 2048)generated CA cert for FACgenerated server cert for cmp server on the FACThis the command:openssl cmp -cmd ir -server http://192.168.1.99/app/cert/cmp2/ -subject /C=Country/ST=State/L=City/O=Company/CN=PFC200/emailAddress=placeholder@company.com -newkey key.pem -certout cert.pem  The problem is, that the cmp client throws the following error:CMP info: sending IRCMP info: received ERRORCMP error: missing protectionI could not find any hints as to how i can resolve the error/what the reason is. Unfortunately i cannot see any log entries in the logs of the FAC to further investigate. A capture from the answer of the cmp server on the FAC in wireshark shows the following:It was not possible to enter the screenshot, but it also said "missing protection" and failinfo was "BadRequest" with the error code being 4865

Hi everyone,Fresh out of the box and upgraded, no previous Fortigate here, so I am very green to this. Anyway, I have a rule from my LAN to SD-WAN with Source and Destination "All" and I have ICMP, DNS, Web Services, UDP 443, and Speedtest.net all allowed Services. Yet it gets Zero traffic. Meanwhile below it I have specific VLAN in the interface and source and ALL /ALL Destination and Service and that is catching all my internet traffic. FG is top down correct? Any idea where to look, I thought LAN interface (all the VLANS are under the LAN Virtual Switch) and all would cover the VLANS as well....seems to work for the implicit deny.    Here is the "all" address edit screen:SD-WAN is only a single local LAN address while I set it up...and that only Static Route is 0.0.0.0/0 to the virtual-wan-link.Thanks for any help and pointers...wondering if I went to "high" on the version.

Hello fellas, I've hit a snag trying to configure ZTNA to work with FQDN and I can't really seem to understand why.Firstly I'll state that the configuration works when using IP addresses but when changing the IP address to a FQDN it just doesn't work.the FQDN are configured on both the 'ZTNA Destinations' on the EMS server and the ZTNA Server on the FW there's a FQDN entry that resolves to the internal IP, I've also tried specifying the Virtual host and directing to the IP which also didn't work, I feel like I'm missing something along the way.Thanks in advance.

Hello,When I sent an e-mail yesterday to the address where I could send e-mails before, I received a reply from @fortimailcloud.com with the error "the following addresses had permament fatal errors".I am sending a screenshot

Hi everyone,We're using Fortigate Cloud.If the log transfer is over than the transfer limit, how is it?Old logs is deleted on the cloud, isn't it?Best regards.

Hi I have some Fortigate devices. I would like to have them both in my Fortimanager and my Forticloud. The Fortimanager is managed locally via a VM. Is it possible to do so? Can you give me more information? (I tried to add a device that is already added in Forticloud to my Fortimanager, but it failed)

I'm looking to propose a FortiGate ruggedize 60F for an industrial environment, after reviewing the datasheet I notice that SSL VPN might not be supported. Extract from the DatasheetThere is nothing in the data sheet which indicates the memory of the device, for this deployment SSL VPN will be required. Can anyone provide some clarity on this?

Hi, I am trying to figure out if I can setup 2 separate SSLVPNs with 2 separate SSL certificates, but I am getting nowhere.Is this possible?

I have a problem that i can't connect to the fortiguard servers. Ping to service.fortiguard.net, update.fortiguard.net and guard.fortinet.net works. I also tryed to change the porst like some articles described me to do it. But i can't solve the problem with this guides. Can you help me?

Is it possible to have more than one switch in the 'config target-port' section of the configuration or are you limited to one switch....? Also, I'm assuming you can only have one RSPAN or ERSPAN block of config... Sorry.... still new to Fortinet CLI after working in the other networking worlds equipment whom I would rather not even mention...         

Client have loaded a faulty configuration and have lost access (cannot login). We want to factory this unit.FGT 800D does not have a RESET button, only a NMI button. The below link does not work because we do not have any consolse access.https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-reset-a-FortiGate-with-the-default-factory/ta-p/196896Is there a way to factory reset the FGT 800D model as per below link?https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-To-Reset-To-Factory-Default-Configuration/ta-p/198660Appreciate Y'all. TIA :) 

Greetings all,I'm having an issue which I get the sense will be a simple fix but I'm at a bit of a loss. I'm trying to add a certificate to iOS to use for connecting to a fortigate vpn. I have no trouble getting the certificate onto the iphone and forticlient detecting it, but its asking for a passphrase. I generated a certificate key pair via Easy-RSA and was able to upload them to the Fortigate without issue. The private key has a password so I was able to enter that into Fortigate without issue. But on the iphone, my understanding is its just the one file, and it needs to be the certificate, which does not have a password. But the app will not let it be used without a password, and leaving it blank returns incorrect passphrase.  What am I doing wrong? I'd appreciate any help. Thanks!

Can we disable the hit count in the rule?

Hey everyone.I had a quick question about the following:SetupManagement - FMG 200GHUB - FG 201F HA pairSpokes - FG 40F HA pairsSDWAN overlay config is set to use ADVPN and spoke to spoke connectivity has been confirmed.Our customer is asking for reports related to performance SLAs between spokes.  I understand that performance SLAs generally point to the hub as configured by the FMG SDWAN overlay template.  I've read up on how the spokes build the shortcuts between themselves, but I haven't been able to find anything related to building a performance SLA between spokes.Is SDWAN with ADVPN able to do this or is this something that's easier seen in a custom report?  I've tried a few shots in the dark with configuring performance SLAs between spokes, but I've had no success so far.  I feel like having a standing SLA between spokes might mess with things and create a huge processing overhead for every device involved.I appreciate any insight or help and thanks in advanc

Hello team,   On Firewall FGT, When a user with administrative privileges is added\modified\removed on a Fortigate firewall is there a specific event that we find in the logs? Or is it something that needs to be manually enabled?   Thanks in advance BR

Hi,It is possible to aggregate wan1 & wan2 (or SFP1 & SFP2) ports on fortigate 90G please ??I created two aggregate : - The first,  with port 1 & port2 --> ok- The second , ports wan1 or wan2 are not in interfaces list ...Thanks.  

Hi, I will be transferring my unit from one FortiCloud account to another.Will the existing licenses and existing configuration be retained once the device is transferred? Thank you! 

Hello everyone, I am deploying FortiMail-VM01, i registered the VM and license (ATP) in Fortinet's support portal and downloaded the file  I deployed the image on the hypervisor Hyper-V. On the CLI the Fortimail displayed the serial number as the name of the VM My problem, when i try to upload the license file on the GUI it says "Invalid license" and on the general information of the Fortimail the serial number displays "FEVM00UNLICENSED" Does anyone ever had this issue ? if so i'll be taking any advice to resolve this problem Kind regards,

Hello, I need an urgent supportI am doing ztna configuration and fortiems on prem,For off-net and on-net users, I created a record as fortiems.xxx.com for users in both local dns and global dns,I created fortiems.xxx.com for off-net users, the dns record is in the same subnet as the wan ip but it is not a direct wan ip, I need to announce this ip behind the wan interface to get telemetry data, but I do not know how to do this, I entered the wan interface as the second ip, but it did not seem like a correct configuration, I cannot see it in the arp table.Can you help me for this 

Hi, I need to access a website, but even though I have listed it as "Exempt" in the web filter profile, the stations still time out. How can I fix this? I have an outbound policy that allows all traffic with specific countries permitted. The website I need to reach is "scopus.com." How can I ensure access without creating a dedicated policy?Kind Regards,Sisma

Hello Fortinet Community, I'm seeking advice on the best approach to secure our network. Our goal is to allow access only to domain-joined PCs and implement compliance checks.We currently have FortiClient installed on all user devices, and I’m trying to determine if we also need the FortiNAC Persistent Agent, or if integrating FortiNAC with EMS would be sufficient.Is there a comparison matrix available that highlights the features of the Persistent Agent and FortiClient specifically related to FortiNAC?Any insights or best practices would be greatly appreciated. Thank you!FortiNAC FortiClient