Solved

Hi,I'm deploying FortiGate SDWAN with dual-hub (DC and DRC) with many spokes. The spokes may not required to communicate each other, so that ADVPN is optional.I have routing challenge when I use iBGP between Hubs and Spokes. At the first, the iBGP includes Hub to Hub, Hub DC to Spokes, Hub DRC to Spokes. Then behind the hub is connected with router which is running OSPF. In that case, I need redistribute the spokes prefix from BGP into OSPF, but I found some routing loop issue in the behind caused by redistribution and advertises OSPF between DC router <> DRC router and advertises iBGP between Hub DC <> Hub DRC.My colleague advise me to use eBGP instead of iBGP for Hubs to Spokes and Hub to Hub. I need insight about what impact or disadvantage if I use eBGP in SDWAN deployment. Since I learn that the best practice of FortiGate SDWAN is to use iBGP. Thank you in advance.

Hi All, I am getting below error when attempting to connect VPN. This is new setup so kindly advice what could be the issue.   

   Good day family, Background:We have 2 ISP (like most companies do for fault tolerance)  Fortimail worked well until incoming mails (external) stopped coming/not being logged at all. My manager switched over to the other ISP2 for incoming mails (with the concern about our mail server being on the DNSBL due to public IP change) to start working coming in. Timeline:May 21, 2024 : ISP 1 went down, ISP 1 is designated for smtp traffic, no more incoming mails (external & internal), neither being logged in Fortimail.May 21-22, 2024 : Failed over to ISP2,  Fortimail incoming mails(external, internal) started coming in and being logged.May 22-23, 2024 : With ISP1 still down and Fortimail still coming, An IT team member made some change in either the public dns/DynDNS or Fortigate Firewall. As are result, no more external mails are being received as well as being logged in Fortimail. Internal mails are being received locally, but not logge

Gents, Need some help here.. I setup s2s. Tunnel is up and both p1 and p2 are up, however I encounter issue. Customer can't reach my loopback ip but loopback ip can reach and ping customer ip.  I've attached diagram and log result for everyone's information. Maybe I missed something here. Btw, it was working on 1st day and suddenly stop.  A kind support is highly appreciated.diagram and log resultRegardsHB

Hello, we have a Fortinet Wifi 60D. Now we have received the access data from our new ISP in the form of IP address, subnet mask, gateway etc.But I just can't find where I can set the gateway. For your information: WAN Port 2gets its IP settings from the DHCP of the Fritz Box AVM router from Vodafone and is our current working connection.WAN Port 1 has to be set manually by us.The IP address, the subnet mask and the gateway were given to us by Telecom.I have read in other posts that this is only possible via a static route, is that correct? Please find attached a network plan and our routing table.The current static route is obsolete I think, because it was something the guy before my did for using VPN. Right now we just need an easy setup, so if WAN1 ISP has a problem we just deactivate WAN1 and activate WAN2. No Loadbalancing, no automatic failover (maybe I like to do it in the future, but right now I just need the simple setup). 

Hello,I have WAF ( FortiWeb-VM 7.4.3,build0638(GA),240405) & I want to whitelist IPs ,is it available ?

Fortinet has an article posted about which FortiOS is recommended in comparison to hardware platforms (Technical Tip: Recommended Release for FortiOS - Fortinet Community).  I have been wrecking my brain in trying to better understand what the philosophy is behind the recommendations.  FortiOS 7.0 was released roughly 3 years ago (2021-03-30) and therefore has obviously the most bug fixes in it.  But according to the product life cycle page it will reach the end of it's engineering support by the end of this month (2024-03-30, Fortinet Service & Support).   FortiOS 7.2 has been on the market for 2 years now (released 2022-03-31).  I am surprised that it takes Fortinet roughly 2 years to finally recommend it's own software for usage.  It almost seems like the only reason why Fortinet considers the recommendation for 7.2 now is because 7.0 has reached its EOES.   Does anyone know why Fortinet would not potentially recom

I had a working IPSEC VPN between our main site and my home computer, a few days ago my VPN stopped working and I can't figure out why. So let me lay the important VPN details down:- Fortigate model: 100-F- Fortigate unit NOT behind NAT.- Home computer IS behind NAT.- OS: Windows 11 Pro version 22H2- VPN type: IPSEC (Dialup)- Authentication: X.509 client cert- This VPN works on a strongSwan client under Debian 12.Here's the FTG log:ike 0:****************/0000000000000000:370001: responder: aggressive mode get 1st message...ike 0:****************/0000000000000000:370001: VID CISCO-UNITY 12F5F28C4...ike 0:****************/0000000000000000:370001: VID RFC 3947 4A131C81070---ike 0:****************/0000000000000000:370001: VID draft-ietf-ipsec-nat-t-ike-02 CD6046433...ike 0:****************/0000000000000000:370001: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913E...ike 0:****************/0000000000000000:370001: VID DPD AFCAD71368A1...ike 0:****************/0000000000000000:370001: VID fortic

Hello gentlemen,I need your help. I configured a SSLVPN as described in this article:https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-specific-SSL-VPN-address-pool-to/ta-p/195190It's setup with individual SSL-VPN portals, where each has it's own Source IP Pools.SSL-VPN Settings are configured, so each User/Groups has it's own Portal.SSLVPN client can connect, but they are not getting an IP address from the correct IP Pool.I have check similar setups on other firewalls, and I am unable to spot the issue.Any idea what I am missing?

Hi All, Is it possible to combine RSSO and FSSO on the sametime ? I want to configure the policy using FSSO group becasue FSSO Group is more granular for the grouping as we can choose or retrieve the SG / OU on the AD which we want to add. And in the sametime i want fortigate to lookup on the RSSO authentication table list for IP to User mapping. Because RSSO is more reliable fof IP to User mapping. However i dont want to add attribute class on the Radius Server. So basically i just want to use RSSO to get the IP to user mapping information, and use FSSO group on the Policy. Is it possible ? any advice ? Thanksakala

Our fortigate FGT already matches on fortiguard threats DB. Including IOC threats.Our fortianalyzer FAZ is asking for an IOC license to be able to analyze these particular threats.Is the fortiguard DB more updated in FAZ than FGT ?Why would i buy ICP license in FAZ when it's already there in FGT ? 

I configured my FortiGate to use EU update servers:The status dashboard still shows an US flag and IP for the update server:How do I verify my update server restriction for EU update servers?

I'm probably one of the few crazy enough to run a bleeding edge release, but anyone running 7.4.4 experiencing authentication issues with the web management gui?Symptoms include:- AUTH failure happens with ALL local administrator accounts including the built-in.- AUTH for admin accounts fails only on HTTPs /SSH but not on console- A password change may TEMPORARILY resolved the issue- Before problem occurs, accounts are able to log into the GUI for a time. When problem begins to occur a logged in user will have their GUI session terminated (forced log out).- An admin account can be logged into the GUI, but not allowed SSH access.- An admin account can be logged into SSH, but not allowed GUI access. Debugging of httpsd yields one piece of useful information:[httpsd 6450 - 1716567558 info] logincheck_handler[532] -- login attempt completed with code -110 Anyone?

Hi,In my technical report concerning a firewall solution based on a cluster of FortiGate 201F, I was asked by the client to specify the RAM capacity of the device. can someone please officially provide this information?

Hello Engineersi have 2 601F in HA cluster (Active/Standby).There is a cable between the OOB-SW to each 601F into the MGMT port on the same VLAN.i need to access the FortiGate directly , when connect my laptop to the Firewall Primary one in MGMT port i can ping and i can login via GUI ,BUT, when connect my laptop to the Firewall Secondary one in MGMT port i can`t ping and i can`t login to the GUI also , when i connect my laptop to secondary firewall also disconnect the MGMT port on Primary Firewall .the another issue isyesterday, i upgrade the Firmware of firewalls in (HA Mode) when the Primary on reboots the Secondary become the Primary as well as but what i noticed it i can reach internet via VDOM " INTERNET "BUT, Also i can`t Reach the MGMT IPs of the switches and servers in VDOM " OOB "After the First firewall finish the Reboot it Becomes the Primary and the i Can Reach the MGMT IPs of the switches and servers.So i think the issue is between the OOB Switch and the second FirewallSO

I installed the GM candidate of Mac OS X 10.11 El Capitan and my FortiClient VPN has stopped working. It completes the login, but after connection, no data is transferred - the incoming and outgoing freeze. It is a split tunnel connection and neither network or internet traffic works.  I tried disabling the firewall and System Integrity Protection, but neither had any effect. 

Hi, I have the below setup on an ESXi host, Router VM is a Fortigate Firewall VM. Traffic from VM1 can ping VM2 but not the other way around, not sure what is missing.   Intergfaces configuration  Policies Configuration  vSwitch 1G is connected to vmnic0 and vSwitch 10G is connected to vmnic1. Any help as to what is missing ? Thank You

Hi all,can you clarify the difference between the Report & Report bundlesthanks, on advancemuhammed#Reports#Reports Bundles

Fortigate not showing any logs in Events >> HA Events.Checked the same in FAZ and there also it is not showing any log for HA.Both device are showing status Synchronized in HA section.Trying to check ha history "diagnose sys ha history " but that is also not showing any output.Please guide..  

I have noticed if you set an IP-Range for the client configuration. It will then give the client the first IP-Address that is useable, and then set the Gateway to the second IP-Address of the range. Can you set the gateway manually?

AnyConnect allowed us to prepopulate the username field and still require the user to enter a password when they are ready to connect to VPN. With FortiEMS, I found that if we enable the "Allow personal VPN" option, you then have the option to save login and provide a username to a new connection you setup in FortiClient. However, the connection we created in EMS will have everything grayed out and not allow to save the username. I tried enabling the "Show VPN Before Login" and "Use Windows Credentials" option, but you are forced to either use VPN prior to login or not. If you choose not to, then it does not cache your credentials when you are ready to connect. Hopefully that makes sense. Does anyone know if there is a way to prepopulate the username field or store it without the end user having to setup their own VPN connections?

Suddenly last week I lost logs from one of our firewalls (200F) in the Fortinet Cloud views. I can view the logs stored on local memory and the cloud logs of other firewalls in the security fabric in FortiView still, and the log settings show data still being uploaded to Fortinet Cloud. We're on a free plan, so I'm not sure what my options are for verifying on the cloud side that the logs are there. I have a ticket in, but support has been less than active on it. So far my only instructions have been to restart the logging service with fnsysctl killall miglogdwhich hasn't had any visible effect.

Hi, I have query on how licensing works when we configured Fortianalyzer in analyzer and collector mode.  If we have one layer of collector which collects logs and does Archive storage and another layer of Fortianalyzer in analyzer mode which receives logs from collector and then does indexing and stores Analytic logs. In this scenario, what is the perpetual license model to select. If my expected data ingestion is 25GB/day then should I need to buy 25GB/day perpetual license for both collector mode and analyzer mode FA or getting it in one either collector mode or analyzer mode is fine?? Can you please clarify. There is no public Fortinet documentation available on this.. RegardsRaja

Hello,I'm trying to create a MAC address-based policy using the VPN tunnel interface as the incoming interface, but it's not working and it authorizes all MAC addresses of the VPN users. Do I need a license for this?Regards, 

Hello team!!! I hope it goes well for you!We have 2 different "trunk" interfaces (With different VLANs on each one).For example:* VLANs 10, 20 and 30 on port1* VLANs 40, 50 and 60 on port2Now, we need to add the VLAN 100 in both trunks interfacesBecause, for example, we need to access from something in VLAN 100 connected to port1 to something on VLAN 100, connected to port2.We have a managed switch directly connected to port1 and a different managed switch connected to port2 I thought to create the first VLAN Switch (Other 2 are not VLAN switches, just interfaces with VLANs) but I do not believe I will be able to use current port 1 and port 2 on it So, with my moderate knowledge, I think the following 2 options:* Create a VLAN switch for different ports (example: port3 and port4), with VLAN 100, and connect both to each managed switch in a different port, with VLAN 100 as tagged* Create a virtual switch (without VLANs) for different ports (example: port3 and port4),