Solved

Hello everyone, first of all the most important information:FortiManager Platform type: VM-64FortiManger version: v7.4.3-build2487 240514 (GA)FortiGate model: 200FFortiGate version: v7.2.8 build1639 My scenario:I want to pre-configure a FortiGate 200F for which I do not yet have a serial number. To do this, I have added the device via "Add Device" => "Add Model Device" and the settings:"Link Device By" => Pre-shared Key"Device Model" FortiGate-200F"Automatically Link to Real Device" => enabled"Provisioning Templates" => Our TemplateNow I have received the FortiGate, switched it on and brought it into the FortiManager network and followed the instructions from Fortinet on how to integrate an FG with a PSK.The CLI config was as following:config system central-managementset type fortimanagerset fmg ip addressendand thenexe central-mgmt register-device fmg-serial-number pre-shared key My problem:I assume that the device in the FortiManager is then assigned to the

hello I have FortiGate100F I applied wan failover (I have two lines from my ISP ) if wan1 disconnect all traffic going from wan2.Now I connect new subnet to port10 .. I need all traffic going from port 10 to wan2 not wan1  (i add policy to allow traffic from port 10 to wan2 ) when i connect my pc to port10 it take IP and DNS (already I enabled DHCP) but no Internet anyone help me please 

Hello,I would like to know what is wrong with this rule, it doesn't work at all, attacks are still coming from the countries that I have added to this rule. Thank you in advance for any suggestions. 

Hi,  TLDR - I have a /63 prefix and I'd like to delegate a /64 to each of two interfaces. Delegation works but both interfaces get the same prefix. Where in Forti documentation would I find the correct syntax? I'm a home user looking to upgrade an old router. I played with *sense, then found FortiGate-VM. I have no experience with FG but prefer the UI. I'm continuing to play with an FG-VM, with a view to purchasing a hardware FG. Thanks to FortiNet for providing an easy way to get a VM. My ISP delegates a dynamic /62 prefix, and seems to require an ONT which then essentially limits anything downstream to a /63 (long story, and is the only available ISP). I've never used IPv6 either but I'm determined to try it out with the FG-VM. I'm trying to delegate a /64 on the FG-VM to each of two LAN interfaces. Both interfaces get the same prefix so I'm missing something. port1, my WAN interface, has the following ipv6 config - config ipv6 set ip6-allowaccess

Hi, I need help to debug IPSEC VPN between Fortigate to ForcePoint Here the ForcePoint conf : Here my fortigate conf config vpn ipsec phase1-interface edit "IPSEC_XXX" set interface "vlnk_XXX" set peertype any set net-device disable set proposal aes256-sha1 set dhgrp 5 set remote-gw 1.2.3.4 set psksecret ************ next endconfig vpn ipsec phase2-interface edit "IPSEC_XXX" set phase1name "IPSEC_XXX" set proposal aes256-sha1 set dhgrp 5 set src-subnet 10.XX.XX.0 255.255.255.0 set dst-subnet 10.XX.XX.0 255.255.255.0 next endHere my log 2024-06-19 14:27:42.549271 ike V=VIPP:2:IPSEC_VIPP:IPSEC_VIPP: created connection: 0x10111700 19 10.1.0.6->185.87.229.218:500. 2024-06-19 14:27:42.551162 ike V=VIPP:2:IPSEC_VIPP: HA start as master 2024-06-19 14:27:42.551178 ike V=VIPP:2:IPSEC_VIPP:45: initiator: main mode is sending 1st message... 2024-06-19 14:27:4

HelloMy implementation has been leaning towards a two-tier MC-LAG design. I am reaching out to you to explore the possibility of evolving it to EVPN-VXLAN seeing that data centre designs have shifted in that direction.So I would like to find out from Fortinet the following:1. If EVPN-VXLAN is a fit for purpose solution in this case2. How mature the technology is on FortiSwitch OS3. The level of after deployment support within Fortinet.4. Please note that the FS-2048-F switches are being used for 25G connections to the servers. So the spine-leaf architecture where nothing connects to spines is out of the question,There is very little Fortinet documentation of this feature on the internet. Please also share some documentation regarding this topic.Thank you

Hi, maybe we missed something and this feature was removed but I would like to see local reports and before I had like 7 versions on the memory (in Log Settings > Local Logs it is activated) and I dont see anything else. Also on Forticloud we had like 7 days some reports. Is it possible that there is no option anymore without another licence? Thanks,Roland

Hi!I'm trying to understand the relationship between periods specified in "System Settings" -> Storage Info: Data Policy : Keep Logs for Archive"... and "System Settings" -> "Advanced" -> "File Management" : Automatically Delete : "Device log files older than" because they both seem to dictate how long the Archive Logs are retained before deletion.Are they related? If so, who has higher priority; otherwise, If not related, how are they different?R's, Alex   

Hi Fortinet Community! I have a question that I’m having trouble answering despite going through the training, documentation, and searching online. We recently purchased a FortiSwitch 148F-FPOE with a FortiLAN Cloud management license.The switch has been adopted and deployed to the new network, it pulled an IP address from DHCP, and everything looks good connectivity-wise. I need to assign a static IP address to the switch within a management network, which does not have DHCP. Does this need to be done via the command line? I found an area to set a static IP (physical interface configuration), but I do not see any place to set the gateway. The switch will not be doing any routing, so my idea was to untag the switch uplink on the management VLAN and set a static IP/gateway (or set a static IP/GW on the VSI internal interface) and tag (allow) other VLANs.Any advice would be greatly appreciated. #FortiSwitch#FortiLAN#FortiCloud Thank you! 

Hi Guys,  I am grateful for this community, some great teachers here, I am learning alot about Fortimail and have done some good work so far. I have now fully integrated my fortimail in the DMZ, the fortigate fwl, getting smtp traffic, inspection of smtp traffic actually WORKING, thank God. However, one problem lol. ALOT of false positives and people are squealing. I used the full inspection rules instructed by guide below - antispam, antivirus, content etc and I tell you mails are being inspected hard.https://ebin.pub/fortinet-fortimail-lab-guide-for-fortimail-72.html Can anyone here post me a good setup for traffic inspection (not so robust/sensitive)? I am currently using the recipient policy as that is what was selected by my team. I was the one that configured the fortimail from scratch and deployed it(with the help/knowledge of you guys of course).

Hi all, I am unable to activate my Forti VM: FortiFirewall-VM64 # execute vm-license-options account-id enrico.thau@siemens-energy.comFortiFirewall-VM64 # execute vm-license-options account-password xxxxFortiFirewall-VM64 # execute vm-licenseThis VM is using the evaluation license. This license does not expire.Limitations of the Evaluation VM license include:1.Support for low encryption operation only2.Maximum of 1 CPU and 2GiB of memory3.Maximum of three interfaces, firewall policies, and routes each4.No FortiCare SupportThis operation will reboot the system !Do you want to continue? (y/n)yFailed to download VM license. But Internet connections is ok:FortiFirewall-VM64 # execute ping 8.8.8.8PING 8.8.8.8 (8.8.8.8): 56 data bytes64 bytes from 8.8.8.8: icmp_seq=0 ttl=128 time=47.4 ms64 bytes from 8.8.8.8: icmp_seq=1 ttl=128 time=46.8 ms^C--- 8.8.8.8 ping statistics ---2 packets transmitted, 2 packets received, 0% packet lossround-trip min/avg/max = 46.8/47.1/47.4 msFortiFi

Our FortiGate running 7.2.8 continues to quarantine the Barracuda load balancer, I believe because it's doing host impersonation. I can remove the MAC from the quarantine, but it shows immediately back up as being quarantined. What's the process for ensuring the MAC won't be quarantined? I can't find any documentation for accomplishing this. Thank you.

Hi everyone, I need help with the DNS server on Fortigate. I'm using Forti as a DNS server and currently, I'm using the recursive mode because we have a DNS database. As I understand it, the recursive mode will query the DNS database first, and if it doesn't find the record, it will forward the query to the DNS system (I've set the DNS system to 8.8.8.8). The problem is that I have some domains mapped to private IPs, and when using Forti as the DNS server in recursive mode, it cannot resolve those domains. Is there any way to fix this issue?

Hi, Assistance with a network configuration. We have an application on a local server (IIS) and need access to it from the external network:I try the below steps with no luck, can't access it from an external network * DDNS:Created account and host on no-ipConfigure no-ip client on the server and connected* On Firewall:1- Configure Virtual IPs (External IP address/range: 0.0.0.0, Mapped IP address/range: LAN IP)     Port Forwarding Protocol (TCP), External service port & Map to port (80)2- Create PolicyIncoming Interface (WAN)Outgoing Interface (LAN)Source (all)Destination (VIP) created earlierSchedule (Always)Service (HTTP)Action (Accepted)NAT (Disable) and try (Enable)Additionally, configure Windows firewall inbound and outbound for port 80 Modem: FortiWiFi 30EFirmware: v6.2.15 build1378 (GA)

Hi Guys....I'm a stranger in this town, dyed in the wool Cisco and Meraki wireless designer/operator but I've been tasked with looking at a Fortinet installation. I'm pretty sure from RF indications that the channels and TX powers that the APs are set to is not being managed automatically (several interfering APs not changing channel/power when they can see each other). Is there documentation that will show me how to set up and manage Automatic Radio Resource Management? I know what I want to do, done it before on Cisco/Meraki/Aruba, and could probably fumble my way through if this was not a customer's production network, but I'm being a bit careful Thanks for any help!

Hi, i want to create an app signature for our Forcepoint Web Proxy and i have been trying to create the signature but I get the same error: F-SBID( --name "Forcepoint-Forcepoint.Cloud"; --pattern "webdefence.global.blackspider.com)"; --service HTTP; --service HTTPS --protocol tcp; --protocol udp;) 

Hi All, I want to allow WhatsApp and WhatsApp file transfer through application control, I blocked all categories under Application control and under application overrides allowed DNS,WhatsApp and Whatsapp_File.Transfer, I am able to send text messages but not able to send images. Any idea? -SaimCategories

Dear Comunity,how to configure my FortiGate (FortiOS 7.2.8) to not stripping TCP option 19 (used for BGP MD5 authentication)? The same problem is in the Cisco world as well and it is nicely explained (with solution) here: https://learningnetwork.cisco.com/s/article/how-to-allow-ebgp-md5-authentication-when-asa-firewall-in-between I am looking for the same solution. Until I figure it down, I can't replace the Cisco ASA used in the production. Best RegardsBm

Hello !  I'm new witth Forti Technologies and I work at an IT department.I've earned a gift for working a lot of hours straight for weeks and this gift is a FortiGate 200A. I absolutely don't know this firewall, so I just got home, plugged the console port to my computer and launched Putty but unfortunately, nothing appaers, just a black screen. (WTF is this poisoned gift) Reading this forum, I tried to reboot the firewall while watching the putty window.It displays this : FG200A (19:06-02.28.2006)Ver:0400000300000000000000 And then nothing, so I can't go on an eventual maintenance menu or execute a factory reset. Could you help me to access to the firewall or reset it ? Thanks a lot !Have a nice day,Hamza

Hello, We are hosting a client on our infrastructure and have set up VDOMs as follows:  We use FortiManager and have created an ADOM that contains the client's VDOM. The client can manage their firewall rules autonomously. We have assigned them 10 public IPs and I would like them to be able to manage these autonomously as well. How should we proceed? Thank you for your help!

Recently fortisniff2.sys driver has caused multiple BSODs on our Win 8.1 computers when waking from sleep. We have tried to find the cause and ran into this which states different Forticlient driver, but is otherwise very similar issue: https://answers.microsoft.com/en-us/windows/forum/windows8_1-hardware/getting-multiple-bsod-since-upgrading-to-win-81/c84de019-e84e-494e-9ac1-848674e63755 Can someone from Fortinet comment on this please? We use registered 5.2.1.0605 clients. Thanks in advance, Ivan

Hello, I am trying to use our FortiManager to configure SAML (using Azure) for VPN access to our remote FGT's as a "break glass" means of getting access to our FGT should the FMG be offline or the HQ site is destroyed.  The idea is that we can VPN in to the remote FGT and then access the Admin console from the inside rather than have the Admin console facing the outside. I have entered all the Azure url's and certificate per what instructions I have found.  When I go to the VPN Settings and attempt to add the Azure user group I get this error. user/saml/azure/ : datasrc invalid. object: vpn ssl settings authentication-rule.1:groups. detail: <group name>. solution: datasrc invalid I have poured over the user group and I can find nothing that points me to what this error is referring to or how to resolve it.  I understand that the "datasrc is invalid" but I have not found the datasrc that is causing the issue.  I've tried following this link.

Hi All, I need to restrict FMG-Access to a certain IP.Could you please advise if this is what I need?  Or this is the only way to restrict FMG-Access?https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-restrict-FMG-Access-FortiManager-Access-to/ta-p/295120 Thanks in advance.

We need to configure Vdom for our project. but we have only one isp provider.ISP given /30 and /29 ip address. we configured /30 ip with fortigate firewall wan interface and created vlan1 in cisco switch and its worked fine. for vdom wan interface, we need to use this /29 ip address so I create one interface with this ISP /29 Ip address and configured as lan and connect this with cisco switch as vlan 2 and created the policy from vlan2 to wan(/30 ip address) and disabled the NAT and its worked fine. and from another vlan2 interface in switch connected to FortiGate firewall I configured as wan ip address with this /29 ip address and create a separate lan interface Vlan3 for the vdom and created a policy for this and its worked.but in vdom wan ip address /29 ip address, we cant able to access this interface ip address from remote and ssl and ip sec vpn is also not connecting from rem ote network. but sslvpn can connect when the the laptop is in vlan3 segment. i need to know whether

Hi AllI Want to schedule an Ingestion to run each 3 hours what is the parameters should i put on the scheduleThanks on Advance FortiSOAR #Data Ingestion