Solved

Am I the only one who is really unhappy with the 35 character limit at firewall rule names? We have different vendors and always on the FortiGates I have to think how I can shorten the rule name.... I doubt Fortinet is changing this soon?

Hi FG adminsOn my FortiGate 7.2.3, freshly transferred to another FortiCloud account successfully, when I click force update license & signatures it doesn't work and it shows the below output.Any idea on what can be the issue before I open a ticket?upd_daemon[1808]-Received update request from pid=1621upd_daemon[1628]-Found cached action=00000002do_update[665]-Starting now UPDATE (final try)__update_upd_comp_by_settings[480]-Disabling FLEN components.__update_upd_comp_by_settings[484]-Disabling NIDSDB/ISDB/MUDB components.__update_upd_comp_by_settings[488]-Disabling APPDB/IOTDB/OTDB components.__update_upd_comp_by_settings[492]-Disabling AVEN components.__update_upd_comp_by_settings[496]-Disabling AVDB/FLDB/MMDB components.upd_fds_get_next_server[609]-no route, skip addr=[[2620:101:9000:140:173:243:140:6]], weight=1073736430upd_fds_get_next_server[609]-no route, skip addr=[[2620:101:9000:140:173:243:140:6]], weight=1073736430upd_fds_get_next_server[609]-no route, skip addr=[[2620:1

Dear all, I have a problem with a FortiMail  VM. I use my Fortimail as a gateway. Unfortunately, I have a loop when sending emails, which I cannot solve. The following error scenario:When I send an email from my M365 mailbox to another M365 mailbox this email goes into a loop and rejected with this error: "Remote server returned '554 5.4.6 < #5.4.6 SMTP; 554 5.4.6 Too many hops>'". When sending from my M365 to email addresses outside the Microsoft Cloud, the sending is successful.Can you help me to solve this problem? I suspect the problem is because the 365 accounts are all accessible via the same IPv4 address? Thank you very much for your help.David

I have Custom Tunnels from B1 (1.0) to B2(2.0) that is 1ms latency.I have a custom tunnel from B1 to B3 (3.0) that is 13ms latency.I have a custom tunnel from B3 to B2 that is a 54ms latency. I want to send the connection from B3 to B2 through B1 to reduce the latency between these two buildings. I need the latency to be under 20ms.I created a route forB2 2.0 traffic going to 3.0 to use the tunnel through 1.0I created a route on B3 for 3.0 traffic going to 2.0 to use the tunnel through 1.0In the firewall policy on B1 Lan traffic from 2.0 going to 3.0 to go through the 3.0 tunnel and reversed cloned.I also created a policy on B1 Lan traffic from 3.0 going to 2.0 to go through the 2.0 tunnel and reversed cloned as well. On B2 and B3 I created the Policies for any Lan going to B2 or B3 to pass through the B1 tunnel and also reversed cloned these two policies.It didn’t work. What am I missing here?

Hello,I have a strange behavior with our FortiClient's tunnels.Created a Remote Access profile on our FortiEMS, it's a VPN Tunnel with 4 remote gateways.Created DNS records for our public IP addresses from FortiGates via Let'sEncrypt.  Now when I try to connected to that one tunnel it will prompt me the "Security Alert" on 40% before it makes the connection.But if I create 4 separate tunnels and not 1 tunnel with multiple gateways then I don't get the prompt with "Security Alert", the connection is established normally.Does anybody have a clue what this can be, probably some limitations with multiple gateways..

I have found this article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-policy-routes-for-route-based-interface/ta-p/193376 But it is not 100% clear to me. Static routing is no problem. But policy based is not working for me. As I understood, in policy route, I have to select "Outgoing interface" (ipsec interface) and "Gateway address". Now, when I did not fill in the GW, the policy route was skipped and only static routes was evaluated. Than I found the article stating: "The solution is to configure an 'IP' and 'Remote IP' on the virtual tunnel interface". So I did it, only on my side of tunnel, and policy route was being hit after that and also data was flowing the correct way (so it seems at least, but it is not returning back).From the article it is not clear to me, if the IP and remote IP on interface and using gw of remote IP in policy routing is just a requirement, so the policy route is evaluated or does the remote IP have to exist in reality on

Hi, Does anyone tried to run globalprotect while connected to FortiSASE? Is it possible to run 2 VPN connections on windows simultaneously?  

Dear All. I have doubt why we configure - config firewall addressedit "test-reservedset country zzend  thank you.

How Fortinet Blocks ICMP Error Reporting Packets thanks.

Hello there, it should be possible to create this same VLAN ID and IP on both interfaces Hardware Switch and FortLink?Because I made it and not sure this is correct way and traffic between this interfaces but same VLAN will work.FortiLink:Hardware Switch:Basically I need to make connection between new network on FortiSwitches connected with Fortilink to FortiGates  and old network on different vendor switches there.VoIP phones from new network need to connect with server on with VoIP central that is located with old network. How is best to achieve this:Create new VLAN on FortiLinkAssigne to Port on FortiSwitchMake policy with NAT one to one?Normally that should be the way but I need it to work with LLDP profile with CDP (Cisco Discover Protocol) so that Phones after connecting to port will automatically connect with VoIP central and download config.

Hello All, Do we have an option to limit the TCP/UDP connections limit on FortiGate? likewise of Cisco ASA Firewalls. 

Hello I currently have a Fortigate managed through Fortimanager with 1 Uplink ISP router (let's call it OLD router), I use it for outgoing traffic to have my servers reach internet, and I also use Virtual IPs to NAT incoming trafic to some web servers on a public-ip basis.default route 0.0.0.0 -> interface going from forti to the OLD ISP routerFor bandwidth reasons, I Need to add another Router (NEW router) with the same specs and needs, to my fortigate.So I can have 3 specific LAN servers use the NEW router and not the OLD one.  I wonder what is the best course of action to do so (I'm ok about the ports/vlans/creating the interface) : - Should I just add another default route 0.0.0.0 -> interface going from forti to the NEW ISP routerand create policies using this interface ? - Or would I also need to create some policy routing (which I never did ever) ? What would these policy have to look like to make sure using my new isp router does'nt break the

Hello, is there any way to suspend the transport mail delivery and keep mail in queue on my fortimail ? Indeed, i need to stop mail delivery to my mail server to be able to make some maintenance operation. My mail server is in the cloud and can't be stop or suspend. Thanks by advance for your answers !

There is no problem with the web filter, but it still cannot be connected, and the query finds that there is a problem with the DNSDomain Name 「donate2.ncku.com.tw」 dns response blockBut this site is a university in Taiwan, how do I apply for a re-evaluationv7.4.3

I'm seeing the eap-proxy daemon utilizes high CPU usage. Suspecting that this may cause of the flapping on the IPSec tunnel phase 1. # diagnose sys top-all 1 100 1Run Time: 235 days, 16 hours and 28 minutes4U, 0N, 10S, 83I, 0WA, 0HI, 3SI, 0ST; 7979T, 3432Feap_proxy 1218 R 99.9 0.1 7 the killed daemon is /bin/eap_proxy: status=0x0 the killed daemon is /bin/eap_proxy: status=0x0 the killed daemon is /bin/eap_proxy: status=0x0 the killed daemon is /bin/eap_proxy: status=0x0 the killed daemon is /bin/eap_proxy: status=0x0 My question is we only have issue with one tunnel that also flaps once or twice in an hour. Rest of the tunnels are fine. What impact this command "fnsysctl killall eap_proxy" will have on the firewall ? WIll it kill all the VPN tunnels ? TIA. :)     

Hi, I noticed i unable to access the FortiSandbox at my office. Previously it working fine and the hardware is up and running. The network port is blinking, but the LED status no light & HDD status blinking red. I already restart the hardware but still same. Any idea ?  TQ

How can I access the database and examine various tables? I require this information for configuring osquery. I have installed FortiSIEM 7.1.3 with ClickHouse.  Detail steps along with creds (if any default) would be helpful.

Trying to move my Fortigate VM, from a old machine, to a newer one. How do i activate the same trial license that was in use on the old, onto the new ?

I want some opinions on this. I have a customer who has multiple remote sites that connect to a central site for Active Directory. The remote sites do not need to have connectivity to each other nor does the customer want them to have connectivity to each other. Given these circumstances, should I configure a hub and spoke topology or just do a site to site tunnel between each remote site and the hub? If I configure a hub and spoke topology, should I just create policies that Deny the spokes from speaking to each other?

hello everybody, I changed the account on my fortigate 60F (fortios 7.0.15), now when I want to change the forticloud account on the forti I get the previous email without the possibility of changing it, if I go to system/fortiguard and choose "transfer fortigate to another account" I get an error origin mail (username or password).How do I send the forticloud logs to the new email? Best regards

Hello everyone! I will soon be doing a deployment around 20 firewalls for a customer and they are wanting a hub and spoke configuration. They will have dual ISP connections at each of the locations for SDWAN. I also plan to implement ADVPN so the spokes can have shortcuts to talk to each other. I would like to us iBGP to advertise the local routes as well. My question is when I configure SDWAN for the ISP connections, do I put the ADVPN interfaces in the same zone? Or would I create a separate zone for the ADVPN interfaces? Also, I'm finding tons of documentation on configuration guides for 7.0 but not too many guides on 7.2. If anyone could link some my way that would be very much appreciated! **NOTE: I will not be using FortiManager for this deployment. Configurations will happen locally on the FortiGate's themselves. **

Is there a multi-tenancy option for FortiEMS Cloud? I know there is for the on-premises version, but i'm not seeing the option for it in the cloud version. 

I would like to do some upgrades on the server. I need to know which components I should shut down first and which should be shut down last, as well as the order for booting them up. This includes the supervisor, worker, collectors, and NFS.Thanks.

Hi guys, Windows 11, I connect to vpn FortiClient 7.0.7.0345 but the route print output is apipa.  

Hi, I have noticed that the "conf_file_ver=xxxxxxxxxxxxxxxx" in configuration has changed to a different number without doing anything recently. Is there any reason for that?