Solved

Hello,I'd like to ask your advice. I am building policies for my FortiGate and I am creating policies for URL categorization on AD groups (students at schoolI want to ask what approach you prefer and what impact it will have on the firewall performance.1. Disallowing blocked categories (**bleep**, spam, etc) and then only allowing all HTTP and HTTPS2. Setting allowed categories on given user groups. Thank you.

Hello, Does anybody know how to get rid of this new stupidity in FMG 7.0.x, called "Change note"? Thanks

I am trying to find a generated heat value of switch models 124F-POE and 148F-POE in kW.I only seem to find the operating temperature and not the amount of heat generated by these devices.Does anyone know where I can find this?

Hi, We have a Fortigate HA Cluster that is managed in Fortimanager.When we do a failover it says in fortimanager that the cluster is down.I can ping from the fortigate: fortimanager.forticloud.com. It still uses the same source IP to communicate with Fortimanager.In the debug i can only see 2024-06-24 11:35:49 FGFMs: __session_cb,125: fgfm_fqdn_connect fail.. Do you have any idea? best regards, Michael 

Good day all, Is it safe to say tha the bad boy here is the Forticlient installed on my exchange server? Full and incremental backups started failing immediately after installing FortiClient. Before though, my buexec normally has errors during backups, hit and miss, a few days backup fails due to some weird errors or communication errors, other days successful backups with no interruption. I cannot say however that it is definitely the FortiClient causing now CONSTANT failed backups, but i think it is. Kindly see attached resources for more information let me know what you think:1. FortiClient on email server2. https://www.veritas.com/support/en_US/article.100043312 - Look on Possible Causes #43. Fortinet Community post sharing an almost similar issue - (https://community.fortinet.com/t5/Support-Forum/Backup-Exec-not-copying-servers-with-Forticlient-AV-installed-on/m-p/45350) Any possible solution?

Hello, I'm not getting traffic in an ipsec vpn tunnel (HUB-SPOKE). When running the command "diagnose debug flow filter addr 192.168.1.254 192.168.13.254 and" on my HUB I get:  id=20085 trace_id=204199 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface HUB-WAN05, tun_id=0.0.0.0" id=20085 trace_id=204199 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel HUB-WAN05_0" id=20085 trace_id=204199 func=ipsec_common_output4 line=778 msg="No matching IPsec selector, drop"  HUB-WAN05 phase2-interface configuration is the same as HUB-WAN04 (HUB-WAN04 works perfectly)  edit "HUB-WAN04" set phase1name "HUB-WAN04" set proposal aes256-sha256 set dhgrp 5 set replay disable set keepalive enable next edit "HUB-WAN05" set phase1name "HUB-WAN05" set proposal aes256-sha256 set dhgrp 5 set replay disable set keepalive enable next  on both HUB-WAN04 and HUB-WAN05 the Phase 2 Selectors LOCAL ADDRESS and REMOTE ADDRESS are set to subne

Hello everyone,  the FortiManager has 2 IP addresses and the FortiGate is authorized to IP 1 in the Security Fabric/Fabric Connectors/Central Management Settings but I need to change the authorization to IP 2. How do I do this? If I use:  config sys centralset type noneendconfig sys centralset type fortimanagerset fmg x.x.x.xend I remove the FortiGate from FortiManager and i have to remap the interfaces right? Is there an easier way? Thank you 

Hi, Everyone.I have a plan to upgrade FortiGate firmware FortiOS 6.4.15 to 7.2.8.The FortiGate is models on NP6 platform.Before I'll do it, I have read the Document Library about FortiOS 7.2.8 in Fortinet official web page. and I found the Bug ID 1012518 in known issue.Here is the citation from the Document Library. https://docs.fortinet.com/document/fortigate/7.2.8/fortios-release-notes/236526 ---Some FortiGate models on NP6/NP6Lite/NP6xLite platforms experience unexpected behavior due to certain traffic conditions after upgrading to 7.2.8. Traffic may be interrupted momentarily.Workaround: Users impacted by this issue can contact Fortinet Support to request a special build with a fix for this issue. Alternatively, users can disable the processing of traffic by the IPS engine’s nTurbo using the following command:config ips global set np-accel-mode none end---I'm gonna do the workaround that using the command.But When I use the workaround, I'm wonderin

 FortiGate firewall running FortiOS firmware 7.0.12I see from older previous posts control-v ? was not supported from the cli window within the GUI and was hoping this may have  been changed in newer releases.If this is still not allowed within the GUI cli window or is there an alternative way to enter the ? character as part of a username?Thank you.  

Hi, I have an HA setup, but firewalls are currently out of sync.Tried to check the configuration for both firewalls, and seeing the difference is only ENC value for the password. Is it normal to have different ENC value for password for HA configuration? I have tried to recalculate the checksums already but still getting an out of sync status. Thanks!

we have users connected FortiSASE and the traffic from a user to FortiManager Cloud & FortiAnalyzer Cloud showing Accept: session timeout on FortiSASE.any one had this issue before and what's the fix? 

Hey TEAM, I will try to be clear as I can. My manager wants personal quarantine emails (that are passed as clean) to be automatically released to recipients/staff inbox(exchange)over a particular retention period e.g. 5 days. I told him the only way that I am aware of users releasing their own mails is via quarantine reports -  https://docs.fortinet.com/document/fortimail/7.4.2/administration-guide/907026/managing-the-quarantines My inspection rules are working perfectly, spam reduced SIGNIFCANTLY in my environment, I have full control of inbound mails. I am also manually releasing quarantine mails for staff, not daily, but from time to time, this can be a bit of an overhead though. I suggested to him the quarantine report/release method, but he does not want that method lol. Can he get his wish and if yes, how can this be done? I welcome all suggestions/feedback.

HiI'm new to the board and also very new to Fortigate. Have a lot of experience using asa firewalls but now migrating to Fortigates. But I need some help. We are migrating using the forticonvertor.I’m looking for a simple solution to add the option“set logtraffic-start enable” on every ruleIt there a option to do this easilyI tried using the cli config firewall policyedit 0 - 4294967294set logtraffic-start enable But it does not accept the command “edit 0 – 4294967294”Enabling it by hand on every rule is not a option. I hope there is a global command or at least a option to edit a range of rule numbers in one go. Kind RegardsEduardThe Netherlands

Hello - does the FortiGate 121G support "hardware switch"? I searched around and found this tip, but, the 100G series is in neither of the supported, or not supported lists: Compatibilities of Hardware Switch with F... - Fortinet Community (Edit to add, I submitted feedback on that link to request the 100G series be added; here's hoping they add it for clarity)

Hello, I am a user of Fortigate 7.4.4. I have an architecture based on a root VDOM, where my WAN connections arrive, and then interconnection links with my child VDOMs (as shown in this diagram visible in the Fortigate documentation).  My infrastructure is shared with a client. My client wants to set up an IPSEC VPN on their VDOM. I followed the configuration available here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-IPSec-VPN-tunnels-on-VDOMs-that-do-not/ta-p/195596 This configuration is based on a NAT on the root VDOM. My client does not want NAT. How can I completely remove NAT? Thank you for your help.

When I try to connect FortiGate-80F and FortiClientEMSCloud (trial) with FabricConnectorsI get a message "requires FortiClient EMS Cloud entitlement" and cannot select it.Is it possible to connect with some settings? Do I have to purchase a license?Please let me know if you know anything about this.

Hi, I had upgraded my FortiGate from FortiOS 7.2.x to FortiOS 7.4.3. I am currently using deep packet inspection ssl profile. Is it expected that I also import again Fortinet_CA_SSL into my browser every time I upgrade? Is this a normal process - Upgrade of FortiOS = Import of Certificate again into the browser?I am currently having issues with SSL after the upgrade. Thank you!

I upgraded my Fortigate 61F firmware, then there is notification the device will be reboot. After that my device didnt turn on normally, it was just stuck on power LED. I have try to unplug and plug power cable, and push hard reset button Please anyone can help?

We have a WAN interface on which 6 public IPs are available.  On the WAN interface the value x.x.2.226/24 is specified for IP/Netmask. I wanted to enter the value x.x.31.227 for the source-ip of the email-server in the CLI, but I get an error message ..: config system email-serverset source-ip x.x.2.227x.x.2.227 does not match any interface ip in vdom root.node_check_object fail! for source-ip x.x.2.227 value parse error before 'x.x.2.227'Command fail. Return code -8  I need the dedicated WAN address x.x.2.227 for the forti mail-server because I have to use it for validation in an ExchangeOnline Connector. Does anyone here have an idea how I can do this or an alternative solution?Any workaround is welcomed. Thanks in advance

Hello, I want to raise an issue that someone may encountered in the past.We own 4 Fortigate (3 of the in HA-Cluster) devices which are imported as devices in Fortimanager.Fortimanager version : v7.0.12 GA build0623Fortigate version : v7.0.16 build0632 The issue is that i cannot have all of the devices Policy package status in imported state.When i import configuration for one of them this specific device change state to "imported" and the rest 3 devices changing state to "Modified". below is when i finished importing the the policy package in the 1st device below is when i finished importing the the policy package in the 2nd device  Does anyone faced this issue before? Any workaround is welcomed. 

Hello, I have two Fortigate Cluster, FortiManager and FortiAnalyzer. I have a problem with FortiAnalyzer that don't show implicit deny log. I already checked my implicit rules in my FortiManager to active logging for IPv4 and IPv6. Hit count on my implicit rules increase correctly, despite this, FortiAnalyzer don't show deny log. What have I to do ? Thanks for you help !

Hello everyone,I'm currently managing an environment with approximately 5000 EPS and encountering an issue where the PHparser crashes frequently. Our setup includes one supervisor and two workers, each running on servers equipped with a 32-core processor and 64 GB of RAM. Despite not using custom parsers, the PHparser fails every 20-25 minutes, recovers, and then continues to crash intermittently. We are seeking advice on troubleshooting this problem. Any suggestions on what might be causing these frequent downtimes or how to stabilize the parser would be greatly appreciated.Thank you! :)FortiSIEM @premchanderr @FSM_FTNT @Richie_C 

Hello everybody,I'm working on a Fortigate 60E (FortiOS 7.2.8).My pc is on an isolated network (i'm the only host) and there is only one simple rule:The dlp profile is simple and is configured to block a credit card number. I built it following the Fortinet tutorial for DLP. It's configured to work with every possibile protocol.I tested this profile on dlptest.com and everything worked fine.Now, I'm trying to understand if this profile could be able to block an email that contains a credit-card number inside the text (or an attached file that contains a credit-card number).Here is Gmail:During the upload of the attached file, Gmail correctly detects the data leak inside it and blocks the upload. But if I write the same credit-card number as plain text, the mail is blocked in a strange way...the connection collpases ("an error occured") and I have to refresh the page. I can't send the mail obviously, but this is not a good filtering. You are stucked and you have to refresh the page

Hi, I have seen a second hand Fortigate 80E.   Can the current owner still transfer ownership to another person/company?   Or can the new owner transfer it over themselves? The owner sent me: FortiGate-80E # get sys statusVersion: FortiGate-80E v7.2.4,build1396,230131 (GA.F)Virus-DB: 1.00000(2018-04-09 18:07)Extended DB: 1.00000(2018-04-09 18:07)AV AI/ML Model: 0.00000(2001-01-01 00:00)IPS-DB: 6.00741(2015-12-01 02:30)IPS-ETDB: 0.00000(2001-01-01 00:00)APP-DB: 6.00741(2015-12-01 02:30)INDUSTRIAL-DB: 6.00741(2015-12-01 02:30)IPS Malicious URL Database: 1.00001(2015-01-01 01:01)IoT-Detect: 0.00000(2022-08-17 17:31)BIOS version: 05000007System Part-Number: P18822-02Log hard disk: Not availableHostname: FortiGate-80EPrivate Encryption: DisableOperation Mode: NATCurrent virtual domain: rootMax number of virtual domains: 10Virtual domains status: 1 in NAT mode, 0 in TP modeVirtual domain configuration: disableFIPS-CC mode: disableCurrent HA mode: standalone

Hi, i try to connect my new switch F148 with my SonicWall GW.I create VLAN on my sonicwall (ID 5), connect sonicwall to switch to port 23, and connect one PC to port 21. On the switch create VLAN 5, and set native VLAN 5, Allowe VLAN 5 on port 21 and 23. But i have not communication with SonicWall.This is my first Switch from Forti and maybe i somting set wrong. Please suggest what I did wrong