Solved

Hi Guys,  I am grateful for this community, some great teachers here, I am learning alot about Fortimail and have done some good work so far. I have now fully integrated my fortimail in the DMZ, the fortigate fwl, getting smtp traffic, inspection of smtp traffic actually WORKING, thank God. However, one problem lol. ALOT of false positives and people are squealing. I used the full inspection rules instructed by guide below - antispam, antivirus, content etc and I tell you mails are being inspected hard.https://ebin.pub/fortinet-fortimail-lab-guide-for-fortimail-72.html Can anyone here post me a good setup for traffic inspection (not so robust/sensitive)? I am currently using the recipient policy as that is what was selected by my team. I was the one that configured the fortimail from scratch and deployed it(with the help/knowledge of you guys of course).

Hi all, I am unable to activate my Forti VM: FortiFirewall-VM64 # execute vm-license-options account-id enrico.thau@siemens-energy.comFortiFirewall-VM64 # execute vm-license-options account-password xxxxFortiFirewall-VM64 # execute vm-licenseThis VM is using the evaluation license. This license does not expire.Limitations of the Evaluation VM license include:1.Support for low encryption operation only2.Maximum of 1 CPU and 2GiB of memory3.Maximum of three interfaces, firewall policies, and routes each4.No FortiCare SupportThis operation will reboot the system !Do you want to continue? (y/n)yFailed to download VM license. But Internet connections is ok:FortiFirewall-VM64 # execute ping 8.8.8.8PING 8.8.8.8 (8.8.8.8): 56 data bytes64 bytes from 8.8.8.8: icmp_seq=0 ttl=128 time=47.4 ms64 bytes from 8.8.8.8: icmp_seq=1 ttl=128 time=46.8 ms^C--- 8.8.8.8 ping statistics ---2 packets transmitted, 2 packets received, 0% packet lossround-trip min/avg/max = 46.8/47.1/47.4 msFortiFi

Our FortiGate running 7.2.8 continues to quarantine the Barracuda load balancer, I believe because it's doing host impersonation. I can remove the MAC from the quarantine, but it shows immediately back up as being quarantined. What's the process for ensuring the MAC won't be quarantined? I can't find any documentation for accomplishing this. Thank you.

Hi everyone, I need help with the DNS server on Fortigate. I'm using Forti as a DNS server and currently, I'm using the recursive mode because we have a DNS database. As I understand it, the recursive mode will query the DNS database first, and if it doesn't find the record, it will forward the query to the DNS system (I've set the DNS system to 8.8.8.8). The problem is that I have some domains mapped to private IPs, and when using Forti as the DNS server in recursive mode, it cannot resolve those domains. Is there any way to fix this issue?

Hi, Assistance with a network configuration. We have an application on a local server (IIS) and need access to it from the external network:I try the below steps with no luck, can't access it from an external network * DDNS:Created account and host on no-ipConfigure no-ip client on the server and connected* On Firewall:1- Configure Virtual IPs (External IP address/range: 0.0.0.0, Mapped IP address/range: LAN IP)     Port Forwarding Protocol (TCP), External service port & Map to port (80)2- Create PolicyIncoming Interface (WAN)Outgoing Interface (LAN)Source (all)Destination (VIP) created earlierSchedule (Always)Service (HTTP)Action (Accepted)NAT (Disable) and try (Enable)Additionally, configure Windows firewall inbound and outbound for port 80 Modem: FortiWiFi 30EFirmware: v6.2.15 build1378 (GA)

Hi Guys....I'm a stranger in this town, dyed in the wool Cisco and Meraki wireless designer/operator but I've been tasked with looking at a Fortinet installation. I'm pretty sure from RF indications that the channels and TX powers that the APs are set to is not being managed automatically (several interfering APs not changing channel/power when they can see each other). Is there documentation that will show me how to set up and manage Automatic Radio Resource Management? I know what I want to do, done it before on Cisco/Meraki/Aruba, and could probably fumble my way through if this was not a customer's production network, but I'm being a bit careful Thanks for any help!

Hi, i want to create an app signature for our Forcepoint Web Proxy and i have been trying to create the signature but I get the same error: F-SBID( --name "Forcepoint-Forcepoint.Cloud"; --pattern "webdefence.global.blackspider.com)"; --service HTTP; --service HTTPS --protocol tcp; --protocol udp;) 

Hi All, I want to allow WhatsApp and WhatsApp file transfer through application control, I blocked all categories under Application control and under application overrides allowed DNS,WhatsApp and Whatsapp_File.Transfer, I am able to send text messages but not able to send images. Any idea? -SaimCategories

Dear Comunity,how to configure my FortiGate (FortiOS 7.2.8) to not stripping TCP option 19 (used for BGP MD5 authentication)? The same problem is in the Cisco world as well and it is nicely explained (with solution) here: https://learningnetwork.cisco.com/s/article/how-to-allow-ebgp-md5-authentication-when-asa-firewall-in-between I am looking for the same solution. Until I figure it down, I can't replace the Cisco ASA used in the production. Best RegardsBm

Hello !  I'm new witth Forti Technologies and I work at an IT department.I've earned a gift for working a lot of hours straight for weeks and this gift is a FortiGate 200A. I absolutely don't know this firewall, so I just got home, plugged the console port to my computer and launched Putty but unfortunately, nothing appaers, just a black screen. (WTF is this poisoned gift) Reading this forum, I tried to reboot the firewall while watching the putty window.It displays this : FG200A (19:06-02.28.2006)Ver:0400000300000000000000 And then nothing, so I can't go on an eventual maintenance menu or execute a factory reset. Could you help me to access to the firewall or reset it ? Thanks a lot !Have a nice day,Hamza

Hello, We are hosting a client on our infrastructure and have set up VDOMs as follows:  We use FortiManager and have created an ADOM that contains the client's VDOM. The client can manage their firewall rules autonomously. We have assigned them 10 public IPs and I would like them to be able to manage these autonomously as well. How should we proceed? Thank you for your help!

Recently fortisniff2.sys driver has caused multiple BSODs on our Win 8.1 computers when waking from sleep. We have tried to find the cause and ran into this which states different Forticlient driver, but is otherwise very similar issue: https://answers.microsoft.com/en-us/windows/forum/windows8_1-hardware/getting-multiple-bsod-since-upgrading-to-win-81/c84de019-e84e-494e-9ac1-848674e63755 Can someone from Fortinet comment on this please? We use registered 5.2.1.0605 clients. Thanks in advance, Ivan

Hello, I am trying to use our FortiManager to configure SAML (using Azure) for VPN access to our remote FGT's as a "break glass" means of getting access to our FGT should the FMG be offline or the HQ site is destroyed.  The idea is that we can VPN in to the remote FGT and then access the Admin console from the inside rather than have the Admin console facing the outside. I have entered all the Azure url's and certificate per what instructions I have found.  When I go to the VPN Settings and attempt to add the Azure user group I get this error. user/saml/azure/ : datasrc invalid. object: vpn ssl settings authentication-rule.1:groups. detail: <group name>. solution: datasrc invalid I have poured over the user group and I can find nothing that points me to what this error is referring to or how to resolve it.  I understand that the "datasrc is invalid" but I have not found the datasrc that is causing the issue.  I've tried following this link.

Hi All, I need to restrict FMG-Access to a certain IP.Could you please advise if this is what I need?  Or this is the only way to restrict FMG-Access?https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-restrict-FMG-Access-FortiManager-Access-to/ta-p/295120 Thanks in advance.

We need to configure Vdom for our project. but we have only one isp provider.ISP given /30 and /29 ip address. we configured /30 ip with fortigate firewall wan interface and created vlan1 in cisco switch and its worked fine. for vdom wan interface, we need to use this /29 ip address so I create one interface with this ISP /29 Ip address and configured as lan and connect this with cisco switch as vlan 2 and created the policy from vlan2 to wan(/30 ip address) and disabled the NAT and its worked fine. and from another vlan2 interface in switch connected to FortiGate firewall I configured as wan ip address with this /29 ip address and create a separate lan interface Vlan3 for the vdom and created a policy for this and its worked.but in vdom wan ip address /29 ip address, we cant able to access this interface ip address from remote and ssl and ip sec vpn is also not connecting from rem ote network. but sslvpn can connect when the the laptop is in vlan3 segment. i need to know whether

Hi AllI Want to schedule an Ingestion to run each 3 hours what is the parameters should i put on the scheduleThanks on Advance FortiSOAR #Data Ingestion

Hi, We have a Windows Server 2019 Datacenter Edition AD Server integrated with Fortigate for VPN users, and we are planning to change the version of the AD Server to Standard Edition. Everything will be the same as the original except the version. My question if the LDAP integration will remain intact or will it need to be reconfigured in Fortigate again, and what about the users, will they have to be imported again from the LDAP ? Thank You

I want to download the FortiClient VPN software which version is 7.0.10.0396, how could I find the version. Also want to know could this version compatible with macOS 

Hi allI am supposed to configure OSPF peering between a Fortigate and a Meraki Hub (MX?). Unfortunately there is not much to configure on Meraki side (it has the correct ospf ID and an unique router ID and identical Hello and Dead timeouts). So I suppose I need to do that on my site on the FGT. Has someone an idea why the meraki does not show up on my neighbor list? Information I have:I made a new OSPF subarea ID (1.1.1.17) which is configured on Fortigate and MXThey are connected to the same LAN 10.x.x.x/23 and FGT can ping the MX (and vice versa)Both devices send out proto 89 packets to 224.0.0.5The LAN segment is on port1 of the FortigateI added that port1 as OSPF interface (which I guess is correct)The OSPF interface is on network-type broadcast at the momentThe OSPF interface (port1) is coming up as in area 0.0.0.0 instead of 1.1.1.17 according to "get router info ospf interface port1" (see [2])The reason might be, as the network 10.x.x.x/23 is already configured in

Hello everyone, I have 4 FortiAP 431F (FP431F) with firmware v7.0 build0134, the issue is that memory usage increases with and without connected users. I restart them and they start with 38% of the memory occupied, after 3 or 4 days the memory reaches 93% usage which makes browsing slow when users are connected. I have to restart it again to free up memory and the same thing happens again. Do I have to update its firmware to a more stable version? Thanks!

Hi Folks,I'm technical, but not an IT person.  It is less than once a year I need to do something with my Fortigate - so I always have a big knowledge refresh and ramp-up for any simple change.   I have a Fortigate 60F and two (2) Fortiswitches - a 108E and a 124D.  The 108E has servers and the 124D is family and household. My fortigate can see all of my FortiDevices no matter how I configure them ... My question is:  What is the better configuration?A) Connect 60F A -> 108E -> 124D (Daisy Chained switches)B) Connect 60F A -> 108E and 60F B -> 124D (Two switches off the firewall)C) Other? I don't care about redundancy or failover.   I was watching the guy on YouTube with the hair and it seemed like I should daisy chain, but 'm not sure.Thanks,TFPJ

Hi,Is it possible to downgrade my FGT 40F from version 7.2.6 to 6.4.6 directly and without any issues?Thanks 

3/11/2024: I've made some progress and have updated my original post below as needed. Thank you very much, @Anthony_E, for continuing to look for support! I know this topic has been covered, but I need help. I have a fortiswitch in a separate building from the main firewall and switch. I am trying to connect to that switch via fortilink, but each time I enable the fortilink-p2p on the REMOTE switch ports, my AP's go into a reboot cycle. Here's my configuration: FG100F(port12) <-> (port23 via fortilink)Fortiswitch(port 7) <-> FAP432F <-> FAP432F <-> (port2)Fortiswitch(port3) <-> clientThe VLAN for the APs is 10.The VLAN for the client is 20. Following these guides...Technical Tip: FortiLink over P2P wireless bridge/... - Fortinet CommunityFortiSwitch FortiSwitch Devices Managed by FortiOS 7.0 (fortinetweb.s3.amazonaws.com)Fortilink Managed Switches over Wireless P2P Bridge – J's Stuff (jsstuff.com)...I have done the below: Remote sw

Hi,I need to know whether iBGP routes that learnt in FortiGate can be redistributed to OSPF by default or not?Because in other router like Cisco, iBGP can't be redistributed to OSPF by default, it needs command like 'bgp redistribute-internal' Thank you

Hi TeamI have an alert and I have investigated the destination Ip of that alert and I want to update the record correlations to change the indicator descriptionthanks, on advanceFortiSOAR #Update Record Correlations