Solved

Duplicate the configurationI often have to configure fortigate 40f or 60f in HAI was wondering is it possible to download the configuration of a fortigate online and upload it to a new fortigate (during this activity the fortigate will be offline) where I would then go and change just a few things about the configuration?Is it possible to copy a 40 f configuration onto a 60 f?Or is it better to do this activity on identical models? Thanks in advance

This is a FortiSwitch 248E-FPOE. I have replicated the issue with another switch.  The switches were on 7.2.1 and I tried to upgrade one to 7.2.4.  After I noticed the issue, I upgraded another to 7.2.3 with no issue, and then to 7.2.4 where the issue was there again.  I can ssh to the device using putty, but SolarWinds cannot anymore (I believe solarwinds ncm uses 'We only do' ssh client). SolarWinds gives an error about not being able to negotiate encryption.   On the switch's logs I see that the negotiation failed due to 'no matching MAC found. Their offer: hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5-none'. I have 'Strong Cyphers' enabled on the switch, but it was previously enabled on 7.2.1 and 7.2.3 (and I'd prefer to keep it on).  I disabled 'Strong Cyphers' just to test and was met with a different log along the lines of 'no matching host key type found. Their offer: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss'.   Did the defaults chan

Dear Support,Please kindly advise me here.I have Fortigate firewall version 7.2.8 configured with FortiClient VPN to Onpremise network and all is working fine, but now I want to add a connection(IPsec tunnel) to Microsoft Azure in the Cloud, we are in the process of migrating to cloud. Is it possible to run a local connection to (Onpremise) and then another connection again into Microsoft Azure Cloud simultaneously without conflict and will that work properly?And will I be able to connect two FortiClient VPN's one to Ompremise network and the other to Microsoft Azure Cloud network on my laptop?I look forward to your response.Thank you in advance.Kind regards,Abel

Good day Fortinet Family, I am use to Symantec Endpoint Protection (SEPM) and other security management endpoint applications where i can block USB/removable storage media excluding mouse, keyboard etc as it was easier, especially with SEPM.  How can achieve this with Forticlient EMS 7.2? In my Forticlient admin portal, I am at the section under MALWARE PROTECTION where you can block removable media, but some scary stuff here, when i select "block" it says that keyboard and mouse will be blocked as well LOL. I am also seeing some simple/regular expression fields to fill out some exclusions, I guess. Then i came upon this post.https://www.reddit.com/r/fortinet/comments/mpdtcq/forticlient_ems_never_ever_block_default/ I created a test environment with a test policy, profile and OU, adding only one laptop to this and trust me, i applied the block option and NOTHING works on the laptop.  Can someone tell me how to only block removable stage while all

Hello please tell me what can be done on windows x32bit information is not displayed in the window FortiClient VPN 

I have 2 fortigate clusters on my network. One is for sslvpn and the other one is for the internet(rest of the traffic other than sslvpn). They are connected to the internet router via a switch in between. They both have different public IP addresses, however, when i ping sslvpn firewall from outside, packets arrive to both internet and sslvpn firewalls as if there is a load balance (I sniff the trafic using sniffer command). It is very confusing bcs the IP addresses are different and there is no load balance at all. What can be the reason behind? Or do you have any other recommendations for tshoot? Thx in advance sslvpn -> 400F (active passive ha)Internet -> 600E (active passive ha)

Hi mates,I want to transfer one of my devices to another account but there's a question, what happens to my currently activated subscription?I mean the device have 2 years subscription (Antivirus, IPS, ...) when i transfer device to new account, are the license/subscription gonna transfers to the new account?Or it is bundled to the device's serial number and not depends on account?

Hi there,I am accessing my FortiGate web GUI using a public IP address.My question is, whenever I access the web GUI using the domain name, it does not show any error regarding an unsecured connection. However, whenever I try to access it using the IP address, it shows an unsecured connection error.I want the FortiGate to only be accessible via the domain name with a secured, encrypted connection, and not via the IP address

Hi All, I have taken then backup FG configuration by using the scp client command which i used to take the backup as below. Sftp server -- > scp admin@<FortiGate_IP>:sys_config <location> Question 1 : sys_config  ( is it full configuration file as like what we are taking the normal backup config from GUI -- > admin --> configuration -- > backup -- > downloaded with xxxxxx.conf Question 2 : Can we use the "sys_config"  scp client backup file to restore the firewall configuration in the Manual GUI method  admin --- > configuration -- > restore -- > upload -- > "sys_config" Does it work or any problem with this restore proceedure ?

Greetings  Hello guys, please give me some tip to solve this. We deployed FortiSIEM supervisor and a collector for Windows Agents that are remotely on branch sites, they reach collector and supervisor with FQDN using public ip (port 443) no IPSec can be established. Internally the Supervisor and Collector communicate each other with private IP, we noted that Windows Agents can register normally, but when template is applied, they (agents) try to reach the collector through private IP, not the fqdn or public IP, for us this is reasonable because collector health on supervisor shows the private IP for collector. On windows Agent we run Wireshark, and effectively note that SYN packets are constantly sent to collector private IP. How this can be solved? there are a way to say that Windows Agents must send data to collector public IP instead of private?, we try to re-register the agent using collector as a proxy but once the template is applied, they start to s

I have a site to site VPN, i want to apply a traffic shapping to specific traffic (sourc IP), but in the shaping policy it is not matching the traffic through the IPSEC tunnel. There are some configuration that works different for interface like wan and not for IPSEC tunnel ? FortiGate 

Unable to load SD-WAN rules with firmware 7.4.3. This error is already in the list of errors in firmware 7.4.3 but there is no update to fix it

hi everybody i want to limit bandwith of sentinel one packet antivirus in my lan.i don't see the signature of this application on my fortigate 100 D THANKS FOR HELP 

Buenas,Cambie mi Forti AP de oficina,por ende, cambio su IP. Ya tengo acceso al Forti AP sin embargo, mi Fortigate no lo detecta y aparece como Offline. Recalco que los segmentos entre el Forti AP y el Fortigate si tienen comunicación, sin embargo, mi FTG sigue sin tomar nuevamente el Forti AP. Ya lo reinstalé de fábrica y sigue el mismo problema

why the formula that allows to get column's names from log: select * from $log .... doesn't work   

I would like to know if there is a site on which I could have the possibility of paying for labs with the possibility of repeating them several times. The courses concerned are the following: FortiGate Security 7.2 and FortiGate Infrastructure 7.2. I don't want the Fortinet Institute labs because you can't start again once you start.

Hello everyone :) As the name suggests, I'm trying to recover the ip addresses of my fortigate's interfaces.I found this command but it only returns the interface name: /api/v2/cmdb/system/interface/Overlay-A/ "results": [{"name": "Overlay-A","q_origin_key": "Overlay-A","q_limited_permission": true}],I've seen in the GUI via the API Preview button that there are formats with ip, remote-ip, etc. fields, but the following command doesn't return anything satisfactory: /api/v2/cmdb/system/interface/Overlay-A?format=ip"results":[{"q_limited_permission":true}], Can you please help me with this? Hyjaal

Has anyone been able to move FortiSwitch interfaces to a different VDOM than where FSW is?  I added FortiSwitch to root VDOM and moved some interfaces to another VDOM following this guide: https://docs.fortinet.com/document/fortiswitch/7.4.2/fortilink-guide/801172/multitenancy-and-vdoms I created a VLAN on the new VDOM and assigned to the switch ports. However, when connecting a device to one of these ports, I'm unable to get the device to have an IP assigned from the VLAN.  When checking "FortiSwitch Clients" list, I find the connected device under "root" instead of the new VDOM, and It's assigned the default VLAN 1 from root, rather than the VDOM assigned to the port. I'm running FortiOS 7.4.3 on FGT and FortiSwitch 7.4.2.

after login and getting session id i will upload an 1,5 MB file with the following code: def sendSmallFile(file_content_as_base64, file_name): print("try to send small file to sandbox") print(f"start of base64 content: {file_content_as_base64[:100]}") print(f"got filename: {file_name}") submitURL = "https://fortisand-api.our-domain.de/jsonrpc/" submit_json_data = { "method": "set", "params": [ { "file": file_content_as_base64, "filename": file_name, "skip_steps": "2", "url": "/submit-file", "type": "file", "vrecord": "0", "enable_ai": "", "forcedvm": 1, "browser": 0 } ], "session": session_id, "id": 11, "ver": "4.4.0" } response = requests.post(submitURL, json=submit_json_data) sid = getValueFromResponse(response.json(), "sid") print(f"sid: {sid}") the b

Hi team, Is there a way to exempt traffic for certain apps like Teams from going via SASE? there are issues reported by end users that teams calls are getting disconnected and there is loss in audio sometimes.  

I am currently working on FortiGate Captive Portal with Guest Users, and wondering if I can edit the email received by the guests. This is my reference link - https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-Captive-Portal-with-Guest-Users/ta-p/278606On step # 2, a sample output is provided when the credentials are sent to the guest. I am looking at removing the sponsor and company field. Is that possible? Thank you!    

Reports started rolling in on Monday, 22 April 2024, at approximately 07:00 AWST (Sunday, 21 April 2024, 23:00 UTC) that people could not access HTTPS websites but could access HTTP websites.We found that the common denominator was that only customers with a PPPoE dialler for the WAN/Internet service were impacted.We've seen this in the past and resolved it by adding "set tcp-mss 1452" to the LAN/INSIDE interface/s configuration of our Fortigates.We provide Internet to many of the customers, but not all - it does not seem to be isolated to a specific network or ISP.I wasn't involved in the initial information gathering, so I'm unsure if it was limited to specific sites, but I was aware that sites such as office.com (all of Microsoft), www.bom.gov.au, and www.news.com.au were impacted.The question is, why is it only impacting Fortigates (we have customers with different firewall vendors who didn't have the same issue), & why were they working fine before when the repo

Hello everyone, I was trying to make a Windows Deployment Services server working in my infrastructure with my Fortigates.We have two different interfaces: One for the servers and another one for the Clients Computers.I did a lot of tests and it's working without any problem when the computer is into the server interface. On the Client interface, I tried commands "next-server" and "filename". the computer is seeing well the WDS and the image as attached, but stuck at downloading and fail...  I saw from internet that when it's 2 differents network the ip helper is helping, but in this case should I have to do that? I tried with dhcp relay etc but didn´t work, maybe I did it wrong... Many thanks

Hi everyone,I'm looking to enhance the security of my FortiGate device. I want to set up a rule or policy that automatically blocks the source IPs trying to log in as admin and failing multiple times. For instance, if someone tries to log in with the wrong password 3 times(or more), the source IP should be automatically banned for a certain period of time.Could someone guide me on how to configure this on my FortiGate? Is it possible to do this directly from the admin interface, or do I need to configure any additional security profiles? Detailed instructions or any advice would be greatly appreciated.Thanks in advance.

Hi wireless adminsAnyone knows what can be the following FAP log?Log Description: Wireless bridge intrusion detected Action: wids-detect-firstThreat Type: wl_bridge Manufacturer: LoopcommMessage: WIDS wl_bridge: data/DS chan 11