Solved

We are in the process of doing a basic Forticlient EMS setup. I've been going through all documentation and searching for answers to the last part of the puzzle.  Our setup: Forticlient EMS on Windows ServerFabric is configured on FortiGate and syncing tags correctly (although not currently used)We have setup a VIP to permit the telemetry port 8013 through to the EMS server. We have configured one ZTNA connection for an RDP server. We are currently using default 443 for the ZTNA connection to the inside device on port 3389 just for testing. The client device is connecting to the EMS server and is receiving the ZTNA destination correctly.  We have configured a ZTNA Server to allow the TCP traffic from external ip on port 443 to the internal ip on port 3389.  We have also created a Firewall Policy for ZTNA to allow the traffic to the ZTNA Server. But at this point when we try to connect to the RDP server on our test machine, we never see

Hi. I registered FortiSwitch to my previous account, and now i would like to move registration to desidered company  account. Is it possible? For FortiGate it's quit easy. I cant find any info in documentation and in GUI/CLI. Thanks for any tip.  FSW 124F - 7.2.4. Managed by FortiGate. b/rwkasprz 

Hi,I have a brain-damaging situation ;) and maybe someone out there has a good idea.We have a Master/Slave Fortigate setup. On each Fortigate, we have 2 uplinks, which may contain the uplink because of redundant BGP setup behind.I now have the problem:- Do I assign Port 1 for the first BGP uplink to the SSL gateway, it would not work, if Port 1 is down and Port 2 is up- Same here, assigned Port 2, is the same, as with Port 1- I would need to assign an ip-address on both ports. So I could enable both ports for the SSL VPN gateway. VRRP would not work, because both are active and up because the routers behind are, tooWe need it, that are staff can login to the VPN, not using different hosts / IPplease, no DNS Stuff with refresh/TTL, this is not the kind we use to fix the problem ;)Any help would be niceThanksRonny 

Hello everyone, I have two Fortigate 201F firewalls in HA (active-active mode), both firewall are connected to the same Switch core (two stacked switches) which are connected by an aggregate port (two sfp for device). The problem is when I try to disconnect the two sfps from one forti to view if the traffic continues to the other firewall, this results in that traffic won't reach. It is as if the second firewall does not receive any traffic, but on the first firewall if I only disconnect a single SFP the traffic continues to arrive.Why the traffic wont arrive from the second firewall?

Let me submit one issue ...In my network, I have two FortiGate 201E firewalls (both are same model but different serial numbers) ...one is use for production (it is with licensed) and another FortiGate 201E is no use (just for backup purposed and licensed expired). I have taken configuration from production one and try to put in my backup firewall (backup config is put to backup firewall).  After config received and rebooted the backup firewall, it can't access with web access (normally we have access with https://(firewall iP:44443)) but I can access with SSH. I can see https, ping, ssh, are allowed access from backup firewall's management interface.  So, is there any issue? It is related to licensed expired on backup firewall.  If anyone got same issue..., could you please suggest to me for how to. Thank you.

Hi community, Under interface there's 2 setting where we could set the estimated bandwidth, however I am not sure sure to understand the difference and/or how they relate to each other or rest of config.  config system interfaceedit "my-inet-iface"set inbandwidth <some_value_in_kbps>set estimated-downstream-bandwidth <some_value_in_kbps>set outbandwidth <some_value_in_kbps>set estimated-upstream-bandwidth <some_value_in_kbps>nextend I do understand the need of those values, but I find them redundant and/or not sure how they relate to other config (QOS/SD-WAN) 

It Posible to manual Block Type FileHash-SHA256?  example  

 Is it possible to RSPAN vlans from managed FortiSwitches...  All the articles I have been able to find are for standalone switches and only talk about mirroring a port not a vlan.  With the Cisco equipment it was possible. See below: 

Hello, I've built a Hub-and-Spoke lab as I need to deploy SD-WAN, which is my ultimate goal here. The configuration went smooth with no issues I can remember. However, after the configuration is complete, and BGP is up, the spokes are not able to reach each other. I tried troubleshooting, and found that the Hub is not passing the traffic. Below is my topology on EVE/PNet  I'm not sure where the issue is. But the firewalls doesn't pass the traffic through the tunnels! I need to get SD-WAN fully running here. All 3 firewalls are running the same version: FortiOS-VM64-KVM v7.2.4,build1396,23013 (GA.F). For the IPSec Tunnels, I created the tunnels using the wizard using the Hub-and-Spoke Template I'm really not sure what is missing here.

Hi, everyone. I'm curious about the same content as the title, so I post it on the forum.  FortiAP is currently using FP221E and FP231F FortiSwitch is using 124E and 424D I'm trying to patch both AP and Switch FP231F is patched to v7.2.5 and I'm trying to patch FP221E with the same version, but I don't see the latest Firmware Image of FP221E The current operating system version of FP221E is FP221E-v7.2-build0280. I also tried to patch FortiSwitch 124E to v7.4.2 and patch 424D to the same version, but I don't see the latest Firmware Image as above. The current OS version of 424D is S424DN-v6.2.4-build213,200501 GA.https://www.fortiguard.com/psirt/FG-IR-22-038 In particular, fortiswitch is trying to patch it to solve the vulnerability, and if you know the answer to my question, please reply. Thank you.  

Hi All,If we configuration User SSL-VPN, Can we configuration One ID per One user concurrent access? Example:I just only can login my SSL-VPN with my laptop only.  If i have TAB/IPAD, I can't login with TAB/IPAD.**The configuration without enable MFA. Fortigate Version 7.2.7

Hello.I want to increase fortigate disk capacity. (/data)The disk is full as shown in the picture below.(The equipment is Fortigate 40F, and the version is v7.0.9_build0444.)  How can I do this?Please help me, Thank you.

I'm new to Fortinet certification (completed FCA -NSE3) program and now looking into FCP (Network Security).The page states that one has to Take 1 Core and any one Elective within 2 years. Does one have to take Core exam before Elective? or... it could be in any order but both must be completed within 2 years? Thanks...

Im currently on FortiOS 7.2.8. Traffics are being dropped by FortiGate when asic-offload is enabled. To work this out, we are currently set the asic-offload to disable but this is not a long term solution. Is this a bug on 7.2.8? https://docs.fortinet.com/document/fortigate/7.2.8/fortios-release-notes/236526/known-issues Does this issue will be resolved in what FortiOS? 7.4.x or 7.2.x ? Appreciate your feedback. TIA :) 

Hello FortiClient admins I have two Ubuntu clients with FortiClient 7.4.0 installed.Both are registered.The first hosts can access apps through ZTNA destination, while the second shows the following error: "No ZTNA client certificate was provided" Following a quick search I found that the first node has a client certificate "/opt/forticlient/ems_cert.crt", while the second doesn't. "Probably" the certificate was removed due to a previous uninstall with purge.Tried to unregister the endpoint an re-register it again but didn't help.Any idea on how I can reinstall the client certificate on the host?

Dear all, i want to set up dhcp server on dedicated vlan for my clients on fortigate.Basically, i want to import list of mac address which will receive an ip from dhcp range (not reserved). On web UI, i did not see any menu which allows me to do that. How can i achieve it ? Best regards.

 Hi Fortinet Community, I would like to explain our scenario and seek your advice on an issue we're encountering.In our environment, we have configured two Domain Controllers (DCs). Each DC has a separate FSSO-DC Agent and a separate FSSO-Collector Agent. In total, we have two collector agents and two DC-agents across our two DCs. We are using the DC Agent Mode, where the DC agent sends logon information (Windows security logon events) to the collector agents. The issue we're facing occurs when a user (e.g., 'abdul.rehman@example.com') logs into a Windows machine. The user is successfully authenticated by FSSO and gains access to resources according to the Firewall Policies. At this point, we can see in the FortiGate FSSO Users Dashboard that the user 'abdul.rehman@example.com' is listed with the assigned IP address (e.g., '192.168.100.100'). The problem arises when the user attempts to access one of our internal systems (a server or another PC) using the RDP protoc

HelloI have installed a Fortigate 60F firewall at a customer. When the customer uses FortiClient VPN they cannot access their Microsoft Dynamics Navision. If they use the Windows native VPN client, everything works as it should.So why not just use this all the time? This is because the firewall does not allow two simultaneous Windows native  VPN clients from the same IP address…I get this error (see the attached file, and bear with the fact that it's in Danish. I'm sure you can translate it).

Hello,Some our user can't connect to the Azure SQL Server with error I try to disable my App Control and the user is able to access to Azure SQL.Here my App Control settingThen i try to disable 'Block applications detected on non-default ports' on the app control, enable this app control on the firewall policy and the user is able to access to Azure SQLSo anyone can help me to make more understand why the 'Block applications detected on non-default ports' should be disabled?

Hi Team, I am building a playbooks that reads the password protected pdf files extract the indicators, create its record and then block the indicators and update its record in indicator if the indicator blocked successfully. In order to update record in reference playbook I need to pass indicator IRI value in the reference playbook but unable to pass the value.Attaching playbook. Assistance is required in passing the IRI value in the reference playbook. Thanks in advance.

I have activated a FortiGate VM-Trail license, followed the deployment process, and am able to access the GUI. The FortiGate can also access the internet. However, under "Firmware and Register," the device is indicated as "Not Registered." But when using the CLI and entering the "get system status" command, I can see that the device license status is valid. Am I missing something? Serial-Number: FGVMEVRFEK_AEUBFLicense Status: ValidVM Resources: 1 CPU/1 allowed, 1930 MB RAM/2048 MB allowedLog hard disk: AvailableHostname: FGVMEVRFEK_AEUBF

Hi— I use FortiClient with cellular data both directly on a Verizon iPhone and through ‘hotspot’ (on the phone) to connect an iPad and Windows laptop. As of about 2 weeks ago, I began receiving an Error: Invalid DNS Server message each time I try to connect any device through the cellular network. Any WiFi network works without issue and connection is no problem, however the cellular network can not connect. I used a colleagues Verizon phone with FortiClient and entered my credentials— no issue. I’ve contacted Verizon who says there’s nothing wrong with my line and to contact Apple or Fortinet for support. Uninstalling and reinstalling the app has not yielded any result. Anyone else experiencing? Any ideas or suggestions on how to resolve? Thanks!!

In our internal LAN we have the DNS server set to be the same as the Interface IP of that subnet. This DNS server is set in recursive mode and exists only to translate some domain names to IP address for internal uses. I would like to have this same functionality over the SSL VPN for some of our remote users but am unsure how to go about setting it up. 

 We use sslvpn web portal to reach http/https server. We are not able to proceed after browser hits the url https://hostname-fortigate/proxy/xxxxxxx/https/login.microsoftonline.com/common/GetCredentialType?mkt=en-USI did debug for sslvpn and following is the error:[313:root:5dd]SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384[313:root:5dd]do_http_validate:442 method (POST) on uri (/proxy/xxxxxx/https/login.microsoftonline.com/common/GetCredentialType) not allowed.[313:root:5dd]sslConnGotoNextState:309 error (last state: 1, closeOp: 0)[313:root:5dd]Destroy sconn 0x7f0f70cae000, connSize=0. (root)[313:root:5dd]SSL state:warning close notify ()

We were having trouble accessing a specific website and the issue ended up being our Geo Blocker policy was preventing access to the website. We have temporarily resolved the issue by disabling the Geo Blocker policy but would like to reenable this policy while still allowing access to the website we were previously experiencing issues with. I called the company that owns the website/server, and they gave me the public ip address for their webserver I created both a subnet allow policy and an ip range allow policy to hopefully allow access to this server while the Geo blocker policy is on. Neither allow policies seemed to work and when I looked up the company's server ip address it is located in a country that is not blocked by out firewall. I am assuming they either gave me the wrong ip address, somehow the webserver is associated with a country that is blocked by our policy, or I configured the allow policies wrong. Would anyone be able to assist in listing out the steps required to