Solved

Hi,2 weeks ago I configured another syslog server from the CLI and it worked fine. Now I tried the same with the same information on another FG100F and I dont get anything at our local Greylock Server.>config log syslogd2 setting > get shows me on both sides the same information: FG_MASTER_XXX (setting) # getstatus : enableserver : XXX.X.98.58mode : udpport : 1514facility : local7source-ip :format : defaultpriority : defaultmax-log-rate : 0interface-select-method: autoThe rule on the FG in the DC is for all the same. What am I missing? Thanks 

I need to configure VXLAN in the presence of Fortinet configured with SD-WAN and multiple WANs. Resolved by following the community KB below: https://community.fortinet.com/t5/FortiGate/Technical-Tip-VXLAN-with-SD-WAN/ta-p/198690 

Hello,   I'm using FortiGate 60E, firmware v7.2.8. I have 2 internet connections in one of my locations, main and failover. I always set it up with the same distance in static routes, in this case, 10 and different priorities for each, for the main one for example 5, and the failover one 6. In this scenario usually both connections work at the same time, I can ping external IP addresses etc.The problem is when I set it up this way, the failover PPPoE connection doesn't work, it doesn't respond to pings and the failover connection doesn't even show up on the routing table despite adding it as a static route. It looks like the problem is only when it's a PPPoE connection, for others it works fine.The way to bypass it is to click the option: retrieve default gateway from server: It starts working, but you can only set here the administrative distance and it will supersede the main connection, which I don't want. But turning it on allows me to create a static route with

Hello,When I try to access the following website address https://alcservis.com/, I am blocked by Fortigate firewall because it is under the "Phishing" category. Why is this website address blocked under the Phishing category? This website belongs to a company we work with. I can access this website without any problems via mobile internet access or internet access that does not have FortiGuard service.I think the website address https://alcservis.com/ should be removed from the Fortigate Phishing category.I would like your help in accessing this address.Kind regards

Morning, I have two questions that i need help with, if anyone has an explanation please comment below. 1/ Can you know the FortiMail's mode only with a report log ? If so, what field you must check, with the explanation for each one of them ? 2/ In the access receive rule, in my knowledge the RCPT TO field has to be the protected domain to match the rule (like the Fortimail checks the RCPT TO field first then checks the MAIL FROM), my question is do you need an access receive rule for internal emails, ex : the protected domain is "Fortinet", MAIL FROM : userA@fortinet.com RCPT TO : userB@fortinet.com does this enveloppe need an access receive rule ? Thank you in advanceKind regards, FortiMail 

Hello,I create SSL VPN for specific user with tunnel-access enabled. The client can access the internal resources using forti client but the user not able reach to the internet.I already create security policy to allowing vpn client to access to the internet, the rule was hitting but the client still not able connect to internet. Anyone know why?

Dears, Can someone explain why FRANCE IP subnet denied while other country is OK. Im whitelisting geographical onfirewall policy to allowed which country can access our external MAP IP with assign port. Below logs shows for references.  regards,

 【background】　I'M TRYING TO CONNECT THE THREE LOCATIONS WITH IPSEC AND ROUTE THEM USING BGP.【Prerequisite configuration】　All locations are Fortigate 50E using OS 6.2　- FOR A DIRECT IPSEC ROUTE WITH AS65001<->AS65002, ALL SUBORDINATE SEGMENTS ARE LISTED IN THE ROUTING TABLE.　- IPSEC routes between AS65001<->AS65010 / AS65002<->AS65010 are also listed in the routing table for all subordinate segments.　- When going through a AS65010 such as AS65001<->AS65010<->AS65002, routing information should not flow to AS65001 and AS65002.【question】　- Assuming that BGP is used for routing, what kind of settings should be made to "When routing via AS65010 such as AS65001<->AS65010<->AS65002, routing information should not flow between AS65001 and AS65002."?

Hello everyone,I am currently testing FortiClient EMS with the trial license.So far I did set up everything and worked fine. I did deploy FortiClient EMS on my personal notebook.Today I was working from home and the SSL VPN worked fine. After lunch the SSL VPN didn't work any more. When trying to reconnect the SSL VPN tunnel, the connection gets established and immediately aborted again. In the forticlient logs I can find following lines (debug log): 10.06.2024 13:37:33 error sslvpn error: poll_recv_ssl -> SSL_get_error(): 610.06.2024 13:37:33 error sslvpn error: poll_recv_ssl -> WSAGetLastError():010.06.2024 13:37:33 info sslvpn error: polling recv, try:1I can't find any more informations, I did not set up Forticlient or the SSL VPN to connect with certificates, so I do not have a clue where this issue suddenly comes from.Anyone having an idea? Edit: Connecting with a non-EMS FortiClient works without any problems.

It's a pleasure to greet the Fortinet community, Can you tell me what firmware version is available for the FortiAP 431F and 231F (FP431F, PU431F, PU231F), I currently have them with the firmware (FP431F -> v7.0 build0134, PU431F -> v7.0 build0125 and PU231F -> v7 .0 build0125) Greetings

Are my FortiAP231-F UTM models or not?

Hello Days ago I received a notification of 2FA enforcing for forticloud accounts. Following the suggestions in this link, it says that starting today the 2FA option by email is enabled for all users.I enter forticloud but the only option enabled is still fortitoken. The truth is I'm confused as to how to continue, because I need 2FA to be by email because other users find it more practical.From already thank you very much Greetings from Argentina PS: sorry for my poor English language.

I did the following: - upgraded FMG to 7.0.11 while the FGT still were on 7.0.13 => everything still worked fine afterwards- upgraded the FGT to 7.0.14 during the next night (scheduled) => since then FGT keep losing the connection to FMG when I deploy policy package or device config. Results in the deployment timing out after some time. During a TAC session it helped to reboot FMG (and perform fsck on it with that) and then retrieving config of FGT and then deploy it. After this deploying of policy package worked fine until now.Now just deployed the device config only on a FGT and it got disconnected from FMG again... However they come back after some time...

Hi, I've inherited a client that has a Fortigate 61E firewall and have to set up a VPN user. I've been trying to follow the below document but get a little lost by the time it gets to the IPv4 Policy.https://blog.vpntracker.com/how-to-configure-vpn-for-a-fortinet-fortigate-firewall/ The really weird thing is, they have one VPN user already setup who can successfully dial in to the LAN using Forticlient from his home computer.. I can find no trace of a VPN, a user or any settings related to a configuration that allows this user to VPN through it. Any help appreciated.

Hi,I have 2 Fortigate setup as below, and the issue as follows.FW1 cannot ping anything on FW2. network, but FW2 can ping FW1's 10.11.30 and 10.11.40 network.BGP is setup between the 2 and is working fine, with RouteMap and Prefix List, so traffic from 10.11.30.0 flows through port1 (192.168.9.181) and 10.11.40.0 through port2 (192.168.9.182), smae configuration is on FW2 for 10.21 network. FW1 Routing table for VRF=0 C 10.11.30.0/24 is directly connected, VLAN30 C 10.11.40.0/24 is directly connected, VLAN40 B 10.21.30.0/24 [20/0] via 192.168.9.182 (recursive is directly connected, port1), 00:18:07, [1/0] B 10.21.40.0/24 [20/0] via 192.168.10.182 (recursive is directly connected, port2), 00:17:40, [1/0] C 192.168.9.0/24 is directly connected, port1 C 192.168.10.0/24 is directly connected, port2  FW2 Routing table for VRF=0 B 10.11.30.0/24 [20/0] via 192.168.9.181 (recursive is directly connected, port1), 00:18:47, [1/0] B 10.11.40.0/24 [20/0] via 192.168.10.181

I need to integrate my Forti-EMS server with cisco ISE to retrieve users and device info is that possible?note : my AD integrated with cisco ISE but EMS can't integrate with AD due to security restriction on my environment  

Hi,I am struggeling with API requests to a Fortigate (Version 7.0.15). I used instructions from FNDN and got curl requests working as expected but the same request in python just throws a 401.The python code: url = 'https://fortigate/api/v2/cmdb/firewall/policy/?vdom=vdom‘ request_headers = {'Content-Type': 'application/json', 'Authorization': 'Bearer <apikey>‘ } response = requests.get(url, headers=request_headers) The same (working) request in curl: curl -s -H "Accept: application/json" -H "Authorization: Bearer <apikey>“ https://fortigate/api/v2/cmdb/firewall/policy/?vdom=vdom  Anyone has an idea what's wrong with the python request?

Hi Everyone,I have the problem with configure SNMP. I use a pair fortigates model: 201F, version 7.2.7. I config HA mode Active-Passive. So I want to monitor 2 fortigates, I have enable snmp agent and config community snmp v2, config interface administrator access service: snmp, ping, https. Test ping from NMS to Fortigate is successful but when NMS send SNMP get but not receive response packet from Fortigate. Can you help me ? Thanks a lot.local traffic

After we Enable password expiry and define "Maximum password age", is there a way we can obtain local user password expiration time information? Tks

Hi we have 2 environments DEV & PROD FortiSOAR. Requirements is that if playbook is successfully in blocking IP on FortiGate then analyst can promote that playbook to Prod FortiSOAR is there a way. Thanks

Hello! We are facing a problem with disconnected FortiAP.After FortiGate upgrade to version v 7.2.2 b.1255 our FortiAP seems like it's disconnected.   On Edit Managed AP panel there is information that this AP is connected via Ethernet and it has IP address assigned - this AP is resolvable via this address and we can login into it.Clients can connect to networks availble on this AP but we still see this AP as disconnected. What can we do to see this AP as Online without resetting it to fabric state?   

Hello, I need to set up VDOMs on an existing installation. I have enabled VDOMs on the Fortigate, so I can see the root VDOM. I have created a VDOM1, and I want to completely move the contents of the root VDOM to VDOM1 (the VLANs, the rules associated with the VLANs, etc.). How can I do this simply and cleanly? I also have FortiManager available. In the future, I will need to create other VDOMs, which is why I want to move the contents from root to VDOM1. Thank you for your help!

We are exploring whether we can integrate our Fortigate FG401E with TrendMicro using the security fabric connector.But i don't see it in my FG401E using FortiOS 7.2.8.is this only for certain FG firewall ?? TrendMicro Integration with Fortigate FirewallIntegrating 3rd-party services using the Trend Micro Vision One Service Gateway

i will be upgrading my fortigate 401E to 7.2.8.do i need to upgrade the FSSO agent as well?current FSSO agent is 5.0.0312. i notice that there is version 5.0.0314.

Hi!I´m new to fortigate and I´ve spent some time but did not find a solution or hints in the forum on my question: I have configured a DNS-server on the local network.I want to migrate the windows hosts-file entries to the DNS-Server. in the hosts file I find entries likemyserver 192.168.1.55 how can I add this to the fortigate DNS database?the computers are not in any domain. I have not configured a domain.I just need the plain computername to be resolved to the local IP-Address.Is this possible? Many thanks