Solved

Hi all, i am trying to get a certificate for a cmp client from the FAC (6.6.0).In beforehand igenerated a .pem keypair on the cmp client. (openssl genrsa -out key.pem 2048)generated CA cert for FACgenerated server cert for cmp server on the FACThis the command:openssl cmp -cmd ir -server http://192.168.1.99/app/cert/cmp2/ -subject /C=Country/ST=State/L=City/O=Company/CN=PFC200/emailAddress=placeholder@company.com -newkey key.pem -certout cert.pem  The problem is, that the cmp client throws the following error:CMP info: sending IRCMP info: received ERRORCMP error: missing protectionI could not find any hints as to how i can resolve the error/what the reason is. Unfortunately i cannot see any log entries in the logs of the FAC to further investigate. A capture from the answer of the cmp server on the FAC in wireshark shows the following:It was not possible to enter the screenshot, but it also said "missing protection" and failinfo was "BadRequest" with the error code being 4865

Hi everyone,Fresh out of the box and upgraded, no previous Fortigate here, so I am very green to this. Anyway, I have a rule from my LAN to SD-WAN with Source and Destination "All" and I have ICMP, DNS, Web Services, UDP 443, and Speedtest.net all allowed Services. Yet it gets Zero traffic. Meanwhile below it I have specific VLAN in the interface and source and ALL /ALL Destination and Service and that is catching all my internet traffic. FG is top down correct? Any idea where to look, I thought LAN interface (all the VLANS are under the LAN Virtual Switch) and all would cover the VLANS as well....seems to work for the implicit deny.    Here is the "all" address edit screen:SD-WAN is only a single local LAN address while I set it up...and that only Static Route is 0.0.0.0/0 to the virtual-wan-link.Thanks for any help and pointers...wondering if I went to "high" on the version.

Hello fellas, I've hit a snag trying to configure ZTNA to work with FQDN and I can't really seem to understand why.Firstly I'll state that the configuration works when using IP addresses but when changing the IP address to a FQDN it just doesn't work.the FQDN are configured on both the 'ZTNA Destinations' on the EMS server and the ZTNA Server on the FW there's a FQDN entry that resolves to the internal IP, I've also tried specifying the Virtual host and directing to the IP which also didn't work, I feel like I'm missing something along the way.Thanks in advance.

Hello,When I sent an e-mail yesterday to the address where I could send e-mails before, I received a reply from @fortimailcloud.com with the error "the following addresses had permament fatal errors".I am sending a screenshot

Hi everyone,We're using Fortigate Cloud.If the log transfer is over than the transfer limit, how is it?Old logs is deleted on the cloud, isn't it?Best regards.

Hi I have some Fortigate devices. I would like to have them both in my Fortimanager and my Forticloud. The Fortimanager is managed locally via a VM. Is it possible to do so? Can you give me more information? (I tried to add a device that is already added in Forticloud to my Fortimanager, but it failed)

I'm looking to propose a FortiGate ruggedize 60F for an industrial environment, after reviewing the datasheet I notice that SSL VPN might not be supported. Extract from the DatasheetThere is nothing in the data sheet which indicates the memory of the device, for this deployment SSL VPN will be required. Can anyone provide some clarity on this?

Hi, I am trying to figure out if I can setup 2 separate SSLVPNs with 2 separate SSL certificates, but I am getting nowhere.Is this possible?

I have a problem that i can't connect to the fortiguard servers. Ping to service.fortiguard.net, update.fortiguard.net and guard.fortinet.net works. I also tryed to change the porst like some articles described me to do it. But i can't solve the problem with this guides. Can you help me?

Is it possible to have more than one switch in the 'config target-port' section of the configuration or are you limited to one switch....? Also, I'm assuming you can only have one RSPAN or ERSPAN block of config... Sorry.... still new to Fortinet CLI after working in the other networking worlds equipment whom I would rather not even mention...         

Client have loaded a faulty configuration and have lost access (cannot login). We want to factory this unit.FGT 800D does not have a RESET button, only a NMI button. The below link does not work because we do not have any consolse access.https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-reset-a-FortiGate-with-the-default-factory/ta-p/196896Is there a way to factory reset the FGT 800D model as per below link?https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-To-Reset-To-Factory-Default-Configuration/ta-p/198660Appreciate Y'all. TIA :) 

Greetings all,I'm having an issue which I get the sense will be a simple fix but I'm at a bit of a loss. I'm trying to add a certificate to iOS to use for connecting to a fortigate vpn. I have no trouble getting the certificate onto the iphone and forticlient detecting it, but its asking for a passphrase. I generated a certificate key pair via Easy-RSA and was able to upload them to the Fortigate without issue. The private key has a password so I was able to enter that into Fortigate without issue. But on the iphone, my understanding is its just the one file, and it needs to be the certificate, which does not have a password. But the app will not let it be used without a password, and leaving it blank returns incorrect passphrase.  What am I doing wrong? I'd appreciate any help. Thanks!

Can we disable the hit count in the rule?

Hey everyone.I had a quick question about the following:SetupManagement - FMG 200GHUB - FG 201F HA pairSpokes - FG 40F HA pairsSDWAN overlay config is set to use ADVPN and spoke to spoke connectivity has been confirmed.Our customer is asking for reports related to performance SLAs between spokes.  I understand that performance SLAs generally point to the hub as configured by the FMG SDWAN overlay template.  I've read up on how the spokes build the shortcuts between themselves, but I haven't been able to find anything related to building a performance SLA between spokes.Is SDWAN with ADVPN able to do this or is this something that's easier seen in a custom report?  I've tried a few shots in the dark with configuring performance SLAs between spokes, but I've had no success so far.  I feel like having a standing SLA between spokes might mess with things and create a huge processing overhead for every device involved.I appreciate any insight or help and thanks in advanc

Hello team,   On Firewall FGT, When a user with administrative privileges is added\modified\removed on a Fortigate firewall is there a specific event that we find in the logs? Or is it something that needs to be manually enabled?   Thanks in advance BR

Hi,It is possible to aggregate wan1 & wan2 (or SFP1 & SFP2) ports on fortigate 90G please ??I created two aggregate : - The first,  with port 1 & port2 --> ok- The second , ports wan1 or wan2 are not in interfaces list ...Thanks.  

Hi, I will be transferring my unit from one FortiCloud account to another.Will the existing licenses and existing configuration be retained once the device is transferred? Thank you! 

Hello everyone, I am deploying FortiMail-VM01, i registered the VM and license (ATP) in Fortinet's support portal and downloaded the file  I deployed the image on the hypervisor Hyper-V. On the CLI the Fortimail displayed the serial number as the name of the VM My problem, when i try to upload the license file on the GUI it says "Invalid license" and on the general information of the Fortimail the serial number displays "FEVM00UNLICENSED" Does anyone ever had this issue ? if so i'll be taking any advice to resolve this problem Kind regards,

Hello, I need an urgent supportI am doing ztna configuration and fortiems on prem,For off-net and on-net users, I created a record as fortiems.xxx.com for users in both local dns and global dns,I created fortiems.xxx.com for off-net users, the dns record is in the same subnet as the wan ip but it is not a direct wan ip, I need to announce this ip behind the wan interface to get telemetry data, but I do not know how to do this, I entered the wan interface as the second ip, but it did not seem like a correct configuration, I cannot see it in the arp table.Can you help me for this 

Hi, I need to access a website, but even though I have listed it as "Exempt" in the web filter profile, the stations still time out. How can I fix this? I have an outbound policy that allows all traffic with specific countries permitted. The website I need to reach is "scopus.com." How can I ensure access without creating a dedicated policy?Kind Regards,Sisma

Hello Fortinet Community, I'm seeking advice on the best approach to secure our network. Our goal is to allow access only to domain-joined PCs and implement compliance checks.We currently have FortiClient installed on all user devices, and I’m trying to determine if we also need the FortiNAC Persistent Agent, or if integrating FortiNAC with EMS would be sufficient.Is there a comparison matrix available that highlights the features of the Persistent Agent and FortiClient specifically related to FortiNAC?Any insights or best practices would be greatly appreciated. Thank you!FortiNAC FortiClient 

HelloIn FortiMail, we can configure for each domain only 2 SMTP servers (primary & failback).I need to configure a third one (another failback server) but I couldn't find a way to do from GUI or CLI.Any help would be appreciated. Otherwise why this limitation?

Hello,I use fortigate and fortiauthenticator and my configurations are correct,but some users can establish a connection after a few tries while vpn,When I look at the fortiauthenticator logs, it says that the user was previously authorized and remains in the cache, remove itlogs as below how can I solve this problem ) facauth: Sending email token code (timeout 180) to firat.gazel@cnbce.com 2024-06-13T13:56:29.921757+03:00 FortiAuthenticator radiusd[24056]: (34) facauth: Updated auth log 'firat.gazel' for attempt from 10.100.100.1~176.236.73.154: Remote LDAP user authentication partially done, expecting email token 2024-06-13T13:59:18.771835+03:00 FortiAuthenticator radiusd[24056]: (35) User-Name = "firat.gazel"2024-06-13T13:59:18.772239+03:00 FortiAuthenticator radiusd[24056]: User-Name = "firat.gazel" 2024-06-13T13:59:18.772331+03:00 FortiAuthenticator radiusd[24056]: (35) facauth: ===>Username:firat.gazel 2024-06-13T13:59:18.773880+03:00 FortiAuthenticator radiusd[24056]: (3

Hello everybody, i would highly need your assistance in preparing for FCP Network Security Exam, i can see that there's a core exam which is NSE4 and one elective exam my question is how to prepare to the exam ?there're alot of topics in FCP network security, may i know which topics is mandatory for the exam and what should i start to study as i must take the exam in a month from now ??where the NSE-4 topics?! how can i get it ?please assist!    

Long time lurker, first time poster. Hi everyone.We’re upgrading some FortiAP 221C access points with FortiAP 223E access points. Straight swap I thought and plugged the 223E into the same PoE injector which was powering the 221C, a Ubiquiti branded PoE-AF injector - UniFi PoE Adapter (15W) - Tech Specs (ui.com). The document that came with the 223E AP says to use a PoE AF injector.This worked fine on my test bench. The 223E powered up and I was able to add it to the controller, then took it to its permanent location where is failed to power up at all. Now it won’t power up on my test bench either.I contacted my reseller who said I needed to use the GPI-130 PoE injector which is a PoE AT specification? I purchased one which has worked with a second 223E on the same cable that the first one failed on using the AF injector but I can’t understand why?