Solved

Hi All, Just a quick question as I couldn't find an answer either on here or generally across the web. Is it possible to set up High Availability using two different Forti models? We have a 100F as our primary FW but would like to use a 100E model we have spare and set up HA in a active-passive mode. I have been advised by our external IT company that it is not possible but just wanted to double check. I have matched the Firmware on the two devices but not sure on how the physical cabling would work, being that they are different models with different port arrangements? Just to add some information about our set up; we have two VDOM's set up; WAN wise, we have two leased lines connected - one running using built-in WAN1 & WAN2 ports and the other using an SFP port (#13) as their uplinks. Happy to provide more information. Thanks in advance.Chris 

Hi,I created a DENY policy (see. picture below). I tried to enable log violation traffic, but after click OK, and than reedit the policy it is switched off again. This is a normal behaviour?  

Hello all! I have some questions regarding some basics of the Fortinet ZTNA setup. I did go through the ZTNA and FortiEMS training but just wanted some things clarified if possible. 1st Dumb Question - Is the ZTNA Server just one of my Fortigate Firewalls? (It's not another physical box/server I have to setup right?) It seems like if I have two locations, each Fortigate could be a ZTNA server for access to the resources that are located there. Both would have to be joined via the Fabric connectors and one of those would have to serve as the "Fabric Root". If the above is true, when I'm setting up my ZTNA Server on one of the Fortigates, for the external IP, can I just choose any IP that's associated with my assigned block, and would I then connect via that IP address for access resources externally? (Let's say I have 123.123.123.1-50 for my external IPs, can I just set that external IP to 123.123.123.5, then if I setup rules to access SMB let's say, when I map a network

I have 2 VPN servers. I configure them in the list when setting up the VPN client. If the first server is unavailable, the client does not connect to the second server. Am I doing something wrong?

Hi, I'm trying to add ip addresses to my Fortigate but I'm getting an HTTP Forbidden.Here are the commands I run:curl -k -i -X POST https://X.X.X.X/logincheck -d "username=apiuser&secretkey=apiuser" --dump-header header.txt -c cookies.txtcurl -k -i -X POST https://X.X.X.X/api/v2/cmdb/firewall/address -d "{'name':'test','subnet':'1.1.1.1/32' }" -b header.txt My user apiuser has the profile super_admin. Do you know why I'm getting an HTTP/1.1 403 Forbidden? Thank you in advance. All the best,Hyjaal

Hey all, Have a Fortigate 81F.  Came with firmware 6.4.? (can't remember) and I ran the update process via the web GUI to update it to 7.0.15. It is now stuck with a static orange power led and the 3 green bars on the left, no other leds are lit.  I am getting no response via console cable. I have logged a ticket with Fortinet.  I didn't want to power cycle it just in case.  Has anyone had this before and resolved it? thanks j

Hello, everyone,but is it possible to configure the HA of two FGTs when they synchronize the configuration with a delay ?I read something about a hw-session-sync-dev command but my two FGTs (200F) with release 7.2.3 do not have it. Has anyone ever tried this ? Thanks in advance

I have a FortiGate 60F running firmware v7.4.3 build 2573. It is connected to the Internet via the Wan1 interface. Wan1 is configured with a static IP address that I rent from my ISP. My firewall is configured to let the internal network go out to the Internet.  I followed the documentation to add a split tunnel VPN so that I can RDP into my servers. It has worked great for a couple of years.  Lat week, I added a Virtual IP and a policy to point to my NGINX Proxy Manager. To expose an HTTP site with an NPM cert to make it HTTPS. But when I activate the policy, it breaks the VPN. Obviously, my knowledge is minimal at best. I would like to be able to expose a couple of web apps through NGINX and be able to continue to use RDP from the outside. My goal is to learn, and to solve my problem: 1. Should I be looking at using the FortiGate as the reverse proxy? If so, where is the documentation for setting that up and how to have it generate certs the wa

I've got an IPsec tunnel to a VM running StrongSwan. When I bring the tunnel up, everything works as expected for about 1 hour, after which the tunnel seems to stop working as it show's as Down on the Fortigate side. If I restart the ipsec tunnel on the strongswan side, it works again for about 1 hour.I followed this guide to set this up originally https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-Site-to-Site-VPN-with-Strongswan-on/ta-p/275092Output of "ipsec statusall"My ipsec.confOn the fortigate side of things I got the following as my tunnel settingsI've omitted the firewall rules and routes as these are working fine as far as I can tell. Any idea what could be causing this and how to fix it? Would appreciate any pointers!

Hello everyone, looking for help to find Fortiguard SSL gateways to be used on our activity, thank you in advance.

The goal is to pass vlan 8 and vlan 40 MGMNT without tagging. how i can do it?The configuration inside internal port 1, but my suggestion is to be able to use vlan 40, similar to native mgmnt ap, and the vlan 8 pass for the trunk as well.Vlan 8 is currently fconfigured it on the internal VLAN switch for the purpose of connecting the printer so that port 3 is connected.There is a conflict if I try to add vlan 8 (such as 8021.q) to port 1 and I wish to provide an IP address because vlan 8 is assigned to an internal vlan switch.how I am able to accomplish it Connect port 1 to meraki, untag vlan 40 MGMT, and pass vlan 8. maybe the setup it is not  correct. The AP dosen´t  come up Meraki ap is now like dhcp     

Hi All I am fairly new to FMG altogether, but I'm sitting my FCP-FMG7.4 soon, so figured I would install and play around with this version.My (limited) experience so far has been riddled with issues simply with pushing out policy packages. On FMG 7.4.2 (VM) installing a policy package to FGT 7.4.3 (VM), I ran into the bug where FortiManager attempts to delete the "edm-keyword" - bug ID 983219.I couldn't find any work around on this, so downgraded FMG to 7.4.1.This version came with another bug where under firewall ssl-ssh-profile -> quic only has two options in 7.4.1 (enable/disable) but in 7.4.3 it has (inspect/bypass/block), so policy package fails on validating devices - bug ID 938115 Ultimately, I've installed 7.4.1 on my FGT and can finally install policy package but this version has a critical vulnerability, which is resolved in 7.4.3 by the looks.  What are my options? Am I missing something? Has anyone else come across any of this?Seeing as reco

Hello, I need to do a migration from an old fortimail in server mode to a new one.But I want to try first with two virtual Fortimails with trial license, however, althoughI activate the email-migration-status option through the cli, it is not activated in the GUI

Hi all I can't wrap my head around this features. I might be misunderstanding everything. In the Explicit Proxy feature of the Fortigate there is a parameter called "Default Firewall Policy Action" which can be set to "Accept" or "Deny".However, I don't understand what a) it actually does, b) what it does when its on accept or on deny and c) what is being influenced by this setting. Does anyone have any insights for me? Side note:In the official documentation (https://docs.fortinet.com/document/fortigate/6.4.0/best-practices/997260/explicit-proxy) it says that "Set the explicit web proxy and explicit FTP proxy Default Firewall Policy Action to Deny. This means that a firewall policy is required to use these explicit proxies, allowing you to control access and impose security features".I don't understand how the (regular) firewall policy is affected by this setting. How does the regular firewall policy "know" that it needs to send the traffic to the explicit proxy if

Hi Experts! Kindly suggest some best practices to configure the backup and restore mechanism of the FortiSOAR data and configuration file? The idea is to use the backed-up file (data and configuration) and restore the FortiSOAR again with minimum downtime. BR,MFaruqi

we are currently implementation for PAM solutions for remote access.the solution we will be using is cyberarkwe also plan to enroll network devices like switch and firewall appliance.is there anything document we can refer from fortigate.how should we enroll the admin account for PAM  

Hi all, Wondering how best to handle registering devices. We have had a shared account for our IT staff.  We have never had any devices registered before but want to register one now. We now need to enable 2FA on that shared account, but that means only one person can have the fortitoken app to get codes which won't work for us. I have my own account with my work email address.  I can see that you can add sub-accounts so could add my colleagues to mine, but how do we handle registering devices? What if my account is the master with the registered device but I leave and the other staff can't get access to my account?  Can they promote themselves to master and take over registration?  It seems wrong to register devices to specific users. What is the way others handle this? thanks jc

Hi,anybody or Fortinet staff knows? I found that a mandatory subscription is needed to upgrade to fortiOS 7.4.3. can you give me the reference of this point on release note? and what is the minimum subscription for just upgrading to 7.4.3?thanks. 

Hello, I faced a problem, that some time ago stopped working CoA DisconnectionIf I do: echo "User-Name=Username, Framed-IP-Address=10.0.0.X" | radclient -x name.fortidyndns.com:3799 disconnect SecretThe router receives packet on wan interface, i see it with packet capture tool on port 3799L4 Length 43 Checksum 0xb86aBut not performs anything. On LocalIn Policy I see that Custom Application UDP any 3799 AcceptOn corresponding wan port Radius accounting is enabled. Plus it was working few days ago. I suppose it could get broken after I put both wan interfaces into SD-WAN, but not sure. On 2nd device FG-61F there is same thing happens. Both have version 7.4.3config user radiusedit "Radius"set server "y.y.y.y"set secret Secretset nas-ip x.x.x.xset acct-interim-interval 60set radius-coa enableset auth-type papset acct-all-servers enableconfig accounting-serveredit 1set status enableset server "y.y.y.y"set secret Secretset

Hi, im using Fortigate 61F with firmware 7.4.3.so i create SSL VPN for some user. i try the user id and password before give to them and all works perfectly.but one user inform me that he cant login with current user id and password that i gave before. the error is permission denied (-455)i try again in my laptop using this credentials and it succssfully login. im checking the fortivpn software uninstall and install the new one but this problems still exist. please advise what should i do for check ? or maybe this user internet connection prohibited using VPN ?

Hello everyone! The following messages appear in the logs in the FortiAuthenticator every minute. That is, the FortiAuthenticator both loses and finds the remote LDAP server again. Please, tell me why this may occur. In the FortiAuthenticator CLI, diagnose netlink arp list, I see that the mac-address of  my ldap server is either in the STALE state or in the REACHEBLE state.  Could there be a problem with arp?Thanks

Our tenable is detecting that our Fortianalyzer VM is using a vulnerable version of openSSH " The version of OpenSSH installed on the remote host is prior to 9.3 " and we should upgrade to a 9.3 or later. is there any patch for that? 

Hi everyone, i hope i can be as clear as possible. I've been trying to copy this setting from an old firewall for the past few hours and i can't make it. One of my customers has a classic home subnet 192.168.1.0/24. (the mother of all broubles)They have a lot of SSLVPN users that must access this network. This creates a lot of overlapping since 192.168.1.0 is a very common subnet.On the old Firewall (Fortinet 40F) there was a setting that allowed a SSLVPN user to reach all addresses in the 192.168.1.0/24 subnet by using another subnet 172.16.0.0/24.All IP addresses would then be automatically forwarded to the corresponding server IP in subnet 192.168.1.0: Example: if I ping 172.16.0.19 i would actually ping 192.168.1.19 but it would also work if i pinged 192.168.1.19. This was made to avoid ip conflicts in case your home subnet is the same as the company, allowing you to still reach the remote servers using a subnet that is usually not present in home connectio

Hi guys  Im having difficulties with my captive portal within my guest interface. The Window shows up as expected, however it shows blank white and nothing shows up.  - I was wondering if i'd need to add an exception in my policy to show the default local login page- if there was a way i could locally test? - Or find the port or url?  Kind regardsAnt FortiGate 600Ev7.4.3 

In Service provider mode when we use Supervisor, Worker and Collector it is expected that windows agent communicate everything through collector.However FortiSEIM windows agent guide expects that agent will send logs to collector however status update communication would be done with supervisor. Is there any way to completely avoid role of supervisor in communication?It is not possible to allow supervisor access to all windows end points, because if we have collector in place which is acting as proxy why do windows agent need to communicate to supervisor?