Solved

Hi community Can someone kindly assisting in guiding me how to enter banned words in Fortimail via CLI - in a batch? Is it possible? I have over 300 of them, clearly not to be entered one by one in the gui.

Guys, I have two 40F in AH A-A. I configured the load balance using the command set load-balance-all enable . But that the load is not balancing. Has anyone been through this that can help me??

Hello! I have few questions regarding FortiGate license. Product is 60F v6.4.6 build 6083 GA. I am providing a screen shot below: Qs1: Is creating a FortiCloud account a must for adding license/ renewal?QS2: If there is no forticare support license, will I still have to create the account in forticloud?QS3: from the picture, 4 entitlement is expired and 1 is for register. Which is the most important to do licensing/ renewal first and why?QS4: How much time will it take for (New license and renewal) the licenses to be added to the fortigate product? (can see it in the fortigate interface) 

Hello, Could someone give me one help? Made this request to my fortinet, gives 200 but looking at console, not works. curl -k -X PUT --location "https://*****/api/v2/cmdb/firewall/addrgrp/OFF" \--insecure \-H "Authorization: Bearer ****" \--header 'Content-Type: application/json' \--request PUT \--data-raw '{"method": "PUT","url": "/api/v2/cmdb/firewall/addrgrp/OFF","params": {"datasource": true,"with_meta": true,"vdom": "root"},"data": {"member": [{"name": "X.X.X.1"}]}}'{"http_method":"PUT","revision":"519**","revision_changed":false,"mkey":"TAOFF","status":"success","http_status":200,"vdom":"root","path":"firewall","name":"addrgrp","serial":"FG*","version":"v7.4.3","build":2573}%

Hi, I am trying to figure out Traffic Shaping on my FortiGate FGT200F running Firmware 7.4.3, I can see that you can create Traffic Shaping profiles in Policies & Objects and assign based on criteria but also can see that you can assign to Firewall policies. Which should you use or recommend to use? I have taken over the FortiGate's from another person and they appear to be using both but think they must be clashing with each other. Thanks   

Lets say I have the following portal config:config vpn ssl web portaledit "VPN_Contractors_General"set tunnel-mode enableset forticlient-download disableset auto-connect enableset keep-alive enableset save-password enableset ip-pools "VPN_Contractors_General"config split-dnsedit 1set domains "louis.net,louis.com,louisgod.com"set dns-server1 10.100.74.21set dns-server2 10.100.90.21nextendnextend Here I have defined the IP-Pool I want these users to use as VPN_Contractors_General.  Now in my VPN SSL Settings I have the following:config vpn ssl settingsset banned-cipher SHA1 SHA256 SHA384set https-redirect enableset servercert "star_louis_com_20250306"set idle-timeout 900set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"set dns-server1 10.100.74.21set dns-server2 10.100.90.21set source-interface "port1"set source-address "all"set source-address6 "all"set default-portal "full-access"config authentication-ruleedit 2set groups "TDS_FirewallSSO

Hello, I have several questions on FortiToken (e.g. to Login to FortiCloud: 1. How to create a second FortiToken on another smartphone?2. How to find and backup the recovery phrase / masterkey for an already created Token?3. How to use 3rd party OTP for FortiCloud login? best regardsMartin Haneke

Hi, Can I still connect to VPN even if I am connected to office WIFi/LAN? Is there a settings on FortiClient EMS for that?

Good day, IKEv2 Dial-In Clients [198.18.25.0/24] connect successfully via FortiGate to the Intranet 192.168.0.0/16.But they cannot connect to a branch office network [172.16.0.0/16] which is also connected as a Site-2-Site VPN on that FortiGate The firewall policies are set to "allow" accordingly for these IKEv2 clients.The Intranet 192.168.0.0/16 can reach the destinations in 172.16.0.0/16 over that Site-2-Site VPN. Phase 2 is up:name=Site2Site ver=2 serial=1 XXXXXXXXXXXX:0->YYYYYYYYY:0 tun_id=YYYYYYYYYYY tun_id6=::YYYYYYYYYYY dst_mtu=1500 dpd-link=on weight=1bound_if=16 lgwy=static/1 tun=intf mode=auto/1 encap=none/552 options[0228]=npu frag-rfc run_state=0 role=primary accept_traffic=0 overlay_id=0proxyid_num=4 child_num=0 refcnt=7 ilast=1 olast=1 ad=/0stat: rxp=10256 txp=6843 rxb=12044848 txb=1178486dpd: mode=on-demand on=1 idle=30000ms retry=3 count=0 seqno=6natt: mode=none draft=0 interval=0 remote_port=0fec: egress=0 ingress=0proxyid=Site2Site proto=0 sa=1

Hi all, I'm having some issues with port forwarding. I'm running fortinet v7.0.5. I have a Windows Server running Tomcat 8.5 which is running my website. I've succesfully managed to import my SSL certificates into tomcat (on my windows server, going into https://localhost:8443/ i can see the certificate (shows as error, because the domain doesnt match, but all of the information about the CA etc is there, so its working okay). But when i go through https://domain.com:8443/ i get Unable to connect - An error occurred during a connection to domain.com. If i go to https://domain.com (without the port) i get The connection has timed out - An error occurred during a connection to  Now i have a public ip on my fortinet wan, which is used mostly just for ssl-vpn to remote into my workspace when im at home. I've added 2 VIP's one for port 80 and one for port 8443(https) - port 8443 seems to get hits, but cant load, and port 8443 reports as closed when using tools to ch

Hi, I am trying to add ips signature and I want to know rate based settings default value. Does anyone know what the default value is? 

Greetings.I have a FortiGate-80F router and a website with domain somedomain.comNow I need to set it up, so that whenever a user from WAN loads the website (port 443, https), he will be forwarded to a webserver on my internal network. Also, if the user loads some subdomain, but with same 443 port, his request will be forwarded to another webserver.In the routers UI > Policy & Objects > VIPs there is a configuration type FQDN, but setting it doesn't do anything, internal websites are still inaccessible from outside.Please, help solving this problem.

Hello  I have to change an HA password for security reasons and is it best to change from the GUI or the CLI?Is the only place that needs to be changed is on System > HA > Primary device and change it there - then that should populate it to the Secondary HA2? Thank you. I know it is kind of basic but just making sure there is no gotcha's.

Hello, is there an opportunity to bind a VLAN (subnet) to one specific physical port which is not in an SW/HW switch on a FortiGate ? My problem is, that I actually have configured a hardware switch containing one pyhsical port within the FortiGate and also have created a VLAN on that switch. So, that I would have a tagged VLAN on that port.That would have been alright, if the FortiGate would not force me to assign an IP address to that hardware switch (but not the VLAN). I also do not understand why an IP address is necessary for a L2 switch. Is there any documentation how FortiGates understand the concept of VLAN (Access, Trunk, Hybrid)? best regardsMartin Haneke

Hello, how can one aggregate many IKEv1 and IKEv2 dial-in peers in one Firewall policy ruleset? I have approx. 80 IPSec dial-in tunnels defined. Each of which would need an own firewall rule to access the IP-Pool "IPSecClient_IP-range" which is dedicated to IKE-Config mode. See sample below: config firewall policyedit NNset name "IPSec Client"set uuid 3da34a02-nnn-nnn-8f09-f6ef3d7ennnnset srcintf "IPSec Tunnel Client"set dstintf "INTRANET"set action acceptset srcaddr "IPSecClient_IP-range"set dstaddr "all"set schedule "always"set service "ALL"nextend Is there an opportunity to create such a rule for a number of IPSec clients?Or do You have an idea to bulk create the necessary rulesets? best regardsMartin Haneke   

I have a 1101e firewall. After the 7.0.14 update, ram usage increased from 41 to 70 in a meaningless way. It switches to conserve once a week. Do you have any idea? 

Hello, My Fortigate VM isn't syncing with FortiToken Cloud. When I try to synchronize using "exec fortitoken-cloud sync local," it fails :  "FGVMEV167DQDX5F5 # exec fortitoken-cloud sync localCannot retrieve user information from FortiToken Cloud!Command fail. Return code -1" After investigating, I found the issue lies in the SSL handshake not completing between the Fortigate and FortiToken Cloud. The SSL minimum protocol version is currently set to TLSv1: "FGVMEV167DQDX5F5 (global) # get | grep ssl-min-proto-versionssl-min-proto-version: TLSv1 " I need to change this to TLSv1.2, but the option isn't available : "FGVMEV167DQDX5F5 # config system globalFGVMEV167DQDX5F5 (global) # set ssl-min-proto-versionSSLv3 SSLv3.TLSv1 TLSv1.FGVMEV167DQDX5F5 (global) #"Any help or solution would be appreciated.   

Good morning friends, a question.I need to increase the disk space in the FortiAnalyzer VM, the reason is because we have 8 synchronized fortigates and the complete information is not displayed in the FAZ. Then the TAC recommended that the record disk be increased. https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Extending-disk-space-in-FortiAnalyzer-VM/ta-p/194365My problem is that I don't know how much space I should increase, is there some kind of formula? to calculate the space I need   

Fortigate is not sending icmp redirects."icmp-send-redirect" is setting enable.I would like to be able to send ICMP redirects using the case 2 pattern.If the PC is in the same segment as the FW,ICMP redirect responses are possible.However, if there is a router between the PC and the FW and they are on different segments,ICMP redirect responses will not be received. QAren't ICMP redirects sent to another segment?How does it work?Case 1In this case, the FW sent an ICMP redirect.PC①------[FW①]------PC②　　　|　　　----[FW②]------PC③settingPC①：192.168.1.1/24PC②：192.168.2.1/24PC③：192.168.3.1/24routingPC①: Default gateway is FW①FW①: Setting static route "Gateway of destination PC③ is FW②" Case 2PC①----[RT①]------[FW①]------PC②　　　　　　　　|　　　　　　　　----[FW②]------PC③settingPC①：192.168.1.1/24PC②：192.168.2.1/24PC③：192.168.3.1/24RT①：Do not use NATroutingPC①: Default gateway is RT①FW①: Setting static route "Gateway of destination PC③ is FW②"FW②: Setting static route "Gateway of destination PC① is

Hello, in a transition from another manufacturers router to Fortigate I have to transpose IKEv2 Dial-In Client configurations into FortiOS 7.2.8. Although the necessary parameters should match. The connections do not work. Therefore I tried to troubleshoot the IKE connections with the following CLI commands: diagnose debug application ike -1diagnose vpn ike log-filter src-addr4 <remote WAN-IP> alternatively: diagnose vpn ike log-filter dst-addr4 <local WAN-IP>diagnose debug console timestamp enablediagnose debug enable But there are only empty lines. I double-checked that the dial-up client could reach the Fortigate and successfully pcap´ed.Although I am new to FortiOS I would bet that there is a debug command to have a live view / monitor the setup negotiations of IKE phase 1 and IPSec phase 2 connections. But I have no clue how start these. Your hints would be appreciated. The Admin-Guide https://docs.fortinet.com/document/fortigate/7.2.8/administratio

I just got a FortiGate FG-40F-3G4G and I need to move the GSM antenna to the roof to get a proper signal (about 10 yards from where the router is located). Is there a readily available cable I can use? And if not, where can I find the specifications of the connectors I need in order to produce such a cable? Thx

I'm trying to work on some scenarios in my lab with KVM , but fortiOS 7.4.3 generates wrong serial number and i can't register virtual device on my account!does anyone have same issue o any solution to fix the problem?thanks

Hey guys, I'm starting to implement NAC-F on Google Cloud, but on the download portal, there is no ready-to-deploy template, would you have any suggestions? I found an implementation guide for GCP, which advises how to deploy using a tar.zg, but it still doesn't show objectively how to do it, if I use the .bin file to generate the tar.gz or some other procedure, follow the link below. FortiNAC Google Cloud Deployment Guide (fortinetweb.s3.amazonaws.com) FortiNAC Regards, Emerson   

I have multiple accounts with a fortigate vm in each region we use and I want to keep all us-east-1 traffic in us-east-1 unless it needs to leave the region.  I have setup a SDN Connector for the VPC where the the fortigate is.  Via that connector I can see all the instances, SGs ... in that VPC.  But do I only need the one connector for AWS or do I need multiples?  And by multiples I mean do I need a Connector for the other VPC (even if they cross accounts) in this region?

Hi, I would like to add a customer header to all mails received from Internet. Originally, I thought to add this as an action to my Content Profile. However, this does not work. I assume this is because the action does not "fire". Another approach which works is to enable domain specific disclaimers and then use "advanced options" > disclaimer on the domain configuration to set the header for all incoming mails. An ugly side effect of this approach is, that in the logs the Classifier is set to Disclaimer and the Disposition is set to Disclaimer Header. Are there other options to add a header to all incoming mail? Any advice appreciated. Thanks.