Solved

Hello, everyone!I hope you are all doing great. I have the task of creating a new SSID for our campus accommodation. This SSID must have limited access, meaning the users should only access the Internet, not local resources, such as servers, PCs, network devices, such as printers, etc. We already have three other SSIDs with two lines coming from the ISP, meaning we also have SD-WAN.The main line is 100Mbps while the backup is 30Mbps. The backup is used for employees with limited access and guests.After business hours, most of the time, there could only be a few people working, so I was thinking of using the main line so it could handle the tens to hundreds of users. I am also planning to give the access points at the building only this new SSID with a schedule to work after business hours until the next day's morning. My questions are:1- Should I create a WPA2 Personal or WPA2 Enterprise to have the best monitoring and logs? The WPA3 implementation will be more head

Good afternoon friends, a question.I have a fortimail version 7.0.2, could you recommend which version I should update the device?Thanks for your comments.

Hello Expert, I have a 2 400E box that are configured as an active/passive cluster.Recently we are seeing in the HA log a lot of lost heartbeat errors. As per redundancy  we quick at another heartbeat interface to the Ha configurationWe are still receiving error message. (see screen shots . i humbly request some urgent feedback on the way forward, Thank you.

Hello, I tried to authentication a test user with local FNAC database using dot1x EAP-PEAP and always i get this error  The allowed authentication protocols :  The client supplicant is setup correctly for EAP-PEAP(MS-CHAPv2) as inner method. Thank you!Regards!@ebilcari              

Hello, I have  a use case where i have Cisco switch port configured with dot1x and mab and i need to seq 1 if the user is AD then vlan 25seq 2 if Printer then vlan 26seq 3  Guest access portal registration logged successfully then vlan 27 The issue i have is if i connect a laptop without dot1x supplicant i always get mac authentication success with the same default vlan on the port, i can access the guest portal and self register/login without any issue but the vlan change never occurs, only after shut no shut the port then on the new authentication procces FNAC detect and change the port vlan to 27 since the host already registered on the last portal authentication. Do you have any thought ?Thank you!Regards! @ebilcari 

A staging website (to display the business website first and do changes before applying it to the actual website) created by administration for has been blocked as "phishing" and despite several attempts we are unable to whitelist the url, with nothing changing. It reads: "Access to the site you have requested has been blocked by your policy." I cannot find where the conflicting error is within the policy, firewall or web filter. I'm not too familiar with group setting changes, so maybe that could be it.I've contacted Fortigate and they've even managed to change the flag for the specific site we've created to Information Technology instead of Phishing but the website is still blocked for Phishing (both externally and on our intranet).Does anyone have any idea how to fix this or what we could try to fix it with?

On my Fortigate, under Security Fabric, Security Rating, Security Posture, Failed, the Fortiguard IoT Vulnerability Category is reporting Aindows devices with Android vulnerabilities. Is anyone else seeing this? The Fortigate knows it is a Windows device, so why is it reporting Android IoT?   

I got a wonderful suggestion (kudos to the Fortinet community, excellent place) from previous post which I have not tried as yet, where i can turn off "check sender domain" to resolve the session domain(classifier) error where a particular mail is being rejected. Before doing this change though, after doing some reading, I tried using the block/safe list domain wide under security->block/safe list, but mails from that specific sender still being blocked. I need these mails as they are financial in nature. Is there any other way to exclude selected mail domains/senders from being blocked rather than turning off "Check sender domain"? Community member is experiencing the same issue, but received no response 

Our customer is using 100F  firewall with os version of  v7.0.14,build0601,240206 (GA.M).  Recently, we noticed that memory consumption is spiked up to  71.5% of the total memory. Upon checking  the processes, we noticed that fnbamd process is consuming 12.2 % of the total memory. What should I  do to solve this issue.  Your assistance would be greatly appreciated. 

Is there a way to geo lock access to Windows IKEv2 native VPN on Fortigate (same as one can do with SSL VPN)? Seb

Good morning at all, I have a problem using the captive portal on MACos.The login and password page pops up, I enter them and the page times out. I'm wondering if anyone has had this problem and if they have any advice for me. Same user with windows and android everything ok.in the past I remember having this problem and they asked me to open some Apple links for everyone but I don't remember and I don't want to remember them badly. please help. Fortios 7.2.8 

Hello,  I'm running Juniper MiST solution and all users are authenticated using Aruba ClearPass Radius against Active Directory.  Recently, I implemented FortiGate F1801 and wanted to see the authenticated user accounts/names instead of the IP Address.  Any guide in doing this config? I have followed multiple KB articles, but still not able to see the Authenticated Users in Clearpass to appear in FortiGate.  Any help on this please? Regards,  

When I Scheduled Playbook where its input come from,I mean for example i want to schedule daily reputation check on the Indicator and change the status depend on it,thanks on advance, 

Hello, everyoneI hope you are all doing great. Since upgrading our Fortigate to 7.4.3, we have been missing "SD-WAN Rules" page from loading. It was said to be a bug that was going to be fixed in future releases. This morning, I saw that 7.4.4 is available.Does anyone know if the problem has been addressed in this release or not? Best regards,

Hello Expert, We have two 400E fortigates in a HA cluster.This afternoon we temporary shutdown the secondary member in facilitate changing a defective patch cable which was connected to the respective HA ports on the active and passive device.The defective cable was remove ad replace with new one.When the secondary FortiGate was repowered during checking the system status it was discovered HA was out of sync.I humbly request you assistance to fix same.

I need to get full configuration from fortigate 600E with REST API. I want to know how send cli command with rest api. Maybe I can use post method for send cli command? Or u tell me other ways to do it with rest api. Thanks 

Hi all, We have web application fire wall latest version (7.4.3) i have a few sites under it.when some one attacks using tools and what not , how can i block his ip Address automatically when the system detects that he is triggering the deny rules?right now it just block every attempts he tries , it should just block him why wait until he passesThanks

Just inherited a site with Fortigate 60E. Old firmware 5.4.5 will be updated but now just need to get remote access using OpenVPN. All indications are port forwarding not working. Have read lots of docs and viewed numerous videos and tried assorted combinations but none work. (I use OpenVPN to other server sites, and similar routers (sonicwall)). Here are some of the address objects and policy combinations I've tried. Thanks. T  

Duplicate the configurationI often have to configure fortigate 40f or 60f in HAI was wondering is it possible to download the configuration of a fortigate online and upload it to a new fortigate (during this activity the fortigate will be offline) where I would then go and change just a few things about the configuration?Is it possible to copy a 40 f configuration onto a 60 f?Or is it better to do this activity on identical models? Thanks in advance

This is a FortiSwitch 248E-FPOE. I have replicated the issue with another switch.  The switches were on 7.2.1 and I tried to upgrade one to 7.2.4.  After I noticed the issue, I upgraded another to 7.2.3 with no issue, and then to 7.2.4 where the issue was there again.  I can ssh to the device using putty, but SolarWinds cannot anymore (I believe solarwinds ncm uses 'We only do' ssh client). SolarWinds gives an error about not being able to negotiate encryption.   On the switch's logs I see that the negotiation failed due to 'no matching MAC found. Their offer: hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5-none'. I have 'Strong Cyphers' enabled on the switch, but it was previously enabled on 7.2.1 and 7.2.3 (and I'd prefer to keep it on).  I disabled 'Strong Cyphers' just to test and was met with a different log along the lines of 'no matching host key type found. Their offer: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss'.   Did the defaults chan

Dear Support,Please kindly advise me here.I have Fortigate firewall version 7.2.8 configured with FortiClient VPN to Onpremise network and all is working fine, but now I want to add a connection(IPsec tunnel) to Microsoft Azure in the Cloud, we are in the process of migrating to cloud. Is it possible to run a local connection to (Onpremise) and then another connection again into Microsoft Azure Cloud simultaneously without conflict and will that work properly?And will I be able to connect two FortiClient VPN's one to Ompremise network and the other to Microsoft Azure Cloud network on my laptop?I look forward to your response.Thank you in advance.Kind regards,Abel

Good day Fortinet Family, I am use to Symantec Endpoint Protection (SEPM) and other security management endpoint applications where i can block USB/removable storage media excluding mouse, keyboard etc as it was easier, especially with SEPM.  How can achieve this with Forticlient EMS 7.2? In my Forticlient admin portal, I am at the section under MALWARE PROTECTION where you can block removable media, but some scary stuff here, when i select "block" it says that keyboard and mouse will be blocked as well LOL. I am also seeing some simple/regular expression fields to fill out some exclusions, I guess. Then i came upon this post.https://www.reddit.com/r/fortinet/comments/mpdtcq/forticlient_ems_never_ever_block_default/ I created a test environment with a test policy, profile and OU, adding only one laptop to this and trust me, i applied the block option and NOTHING works on the laptop.  Can someone tell me how to only block removable stage while all

Hello please tell me what can be done on windows x32bit information is not displayed in the window FortiClient VPN 

I have 2 fortigate clusters on my network. One is for sslvpn and the other one is for the internet(rest of the traffic other than sslvpn). They are connected to the internet router via a switch in between. They both have different public IP addresses, however, when i ping sslvpn firewall from outside, packets arrive to both internet and sslvpn firewalls as if there is a load balance (I sniff the trafic using sniffer command). It is very confusing bcs the IP addresses are different and there is no load balance at all. What can be the reason behind? Or do you have any other recommendations for tshoot? Thx in advance sslvpn -> 400F (active passive ha)Internet -> 600E (active passive ha)

Hi mates,I want to transfer one of my devices to another account but there's a question, what happens to my currently activated subscription?I mean the device have 2 years subscription (Antivirus, IPS, ...) when i transfer device to new account, are the license/subscription gonna transfers to the new account?Or it is bundled to the device's serial number and not depends on account?