Solved

Hi Everyone. I have a Fortigate 80E on v6.0.12. I'm using 4 interfaces, interface 1 is incoming traffic going to interfaces 2, 3, and 4. If i click create new interface and put all 4 interfaces in a software/hardware switch interface, traffic flows between them automatically. When i separate them out and try to route traffic from interface 1 to interface 2 or interface 1 to interface 3 or interface 1 to interface 4 it doesn't work which is weird. They are all on the same subnet using same gateway ip, just 3 different webservers interfaces 2,3,4. I made a policy to allow all traffic between interface 1 (incoming int./source) and interface 2 (outgoing int./destination) as a test and it doesn't show any traffic going through the policy at all. I've tried creating multiple policies and none of them get used no matter what i do and the implicit deny isn't blocking any traffic, yet connection to the web server sites through interfaces 2, 3, and 4 are still happening (if i put all 4 interface

how do i go in-depth to look at the bandwidth utilization to see what traffic is occupying the bandwidth ?this is the bandwidth widget in the dashboard

Hi, I create a software-switch and enabled DHCP server on it. I spesified the address range and created ip address assigment rules. I want to block unknown mac address. I added mac address - ip address reservetion. But implict rule action is assign ip. How can i change the ubknown mac address actionb to block?    

Good day, I was wondering if the FortiLink aggregation interface could be used as a trunk with a non-Fortinet switch. By default, ports x3 and x4 of the 200F are dedicated FortiLink ports. I would like to run ports x3 and x4 to an existing Cisco switch, soon to be replaced by two aggregate FortiSwitches. I was hoping to set up all of the VLANs on the FortiLink interface to have them ready for when we move the connections over to the FortiSwitches. I'm hoping that traffic will still route out over the trunk properly when using FortiLink connections connected to a non-Fortinet switch.  Thank you,FortiBagel #FortiSwitch#FortiLink

Hello team!!! We manage many Fortigates in different sites and recently upgraded all to 7.4.3After this, we have problem accessing to some fortigates through some wan interfacesFor example I can access through wan2 but not through wan1, or in other cases, I cant access from wan1 nor wan2.  The issue started after upgrading the firmware version to 7.4.3The issue is that the page remains loading and wont load, keep trying to access but after some seconds the browser shows me that the page cannot be displayedWe use the same port to access to fortigates, different of the default 9443 * We tried to change the port but the issue persists* We disabled and re-enabled https in each interface, with the same issue* SSH works well in any interface* We cannot connect to Fortigate with telnet, using the same port. Any idea?Thanks in advance.Regards,Damián

Hi, I am currently looking for the Security POP IP Address of known locations for provisioning purposes. Thank you in advance for your attention to this matter. I eagerly anticipate your response and look forward to provide the Security POP IP Address provided below. 1. Sydney - Australia2. Vancouver - Canada3. San Jose - California Thanks and Regards,Rakesh

Hi,We are using FortiGate firerwall(v7.2.5 build1517) and the FortiClient SSL VPN(v7.0.70345) on all our laptops, the problem is that the FortiClient VPN keeps on disconnecting even though the internet connection is available on the laptops. This is happening intermediately.Can you please advise what could be the cause of this issue?Thank you in advanceKind Regards,Abel 

Hi All,I've configured a Fortigate to Fortigate VPN, created a Loopback Address and assigned a Public IP.The VPN uses BGP to advertise the Public IP and and receive the default route from the Hub. The Spoke isn't able to connect to Central Management with this config (I've got Fortiguard connected and have also changed the source IP for DNS and confirmed DNS lookups are working) I see there is supposed to be a command under config system central-management that would allow me to set a source IP, but this doesn't exist on my Firewall. Is this something that has been removed in v7.4 and is there another method I need to use for this? Or an I missing something that I need to enable for this? These are the only options that I see: (central-management) # setmode Central management mode.type Central management type.schedule-config-restore Enable/disable allowing the central management server to restore the configuration of this FortiGate.schedule-script-restore Enable/dis

One of our user always get error that "URL blocked by Forticlient" and he has to refresh few time to make it working, please details error message screenshot. I already added all the website in exclusion list under web filter, but it still blocks. When he disconnects from telemetry or work offsite, it loads all the website without errors.  I am working from the same location and I never had any issue. Forclient ver. 7.2.2Forticlient EMS: 7.2.2

Hi About to deploy FGSP between 2 existing clusters, both clusters in a new environment with only test networks connected to them I have 2 things I'm not clear on 1. I will be syncing a couple of VDOMS, is there any issue using the root VDOM for the sync link? Other options I have are create a new one for just this purpose, or finally use the test VDOM which has very little going on, and will be the least busy once the real network is connected.  2. In each cluster, the 2 firewalls are connected in usual fashion, 2 direct links. The FGSP link will be a lot higher bandwidth port. Do you normally leave it like that? Is session pickup on HA failover still running over the direct ports? thanks

I am seeing this "Critical (Collector Buffer greater than 50MB)" on my Forticollector. Can this be resolved by increasing the buffer size and is there a formula for sizing it correctly?

Hello Fortinet experts, We have established a site-to-site VPN between Fortigate(7.0.12) and AWS, where the client runs on AWS and the server is located on the other end of the VPN (on-premise). client ip: 10.12.140.86 or 10.12.124.160server ip: 10.60.98.100 listen on port 8080fortigate port1 ip: 10.60.97.10 Fortigate interface:Fortigate routing table:  FGVM04 # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default Routing table for VRF=0 S* 0.0.0.0/0 [10/0] via 10.60.97.1, port1, [1/0] S 10.12.0.0/16 [10/0] via aws-vpn-1 tunnel 52.11.17.158, [1/2] [10/0] via aws-vpn-2 tunnel 52.43.39.105, [1/2] ... C

When looking at the forward traffic logs (for incoming connections), I see that some sources are from "known malicious sites" when I hover over the source IP. But when I add the column "source reputation", it's always empty. I'd like to ad some reputation filtering, but it would be nice to be able to see the reputation for each log line first, without having to hover over each line. Is there a way to show the source reputation in the table?  

Hi, I have a Fortigate 200F with FortiTokens initially assigned to RADIUS account for VPN MFA authentication.We had to rebuild our Active Directory and would like to assigned the Fortitokens to new RADIUS accounts in the new Active Directory.However the Fortitokens in the Fortigate 200F show with the "Assigned" status as they are linked with the old (and now inexistant) RADIUS accounts.How can I make the Fortitokens available again so that I can assigned them to new RADIUS accounts?Thank you in advance for your advice. 

Today I configured a FGT200E with an IPsec VPN with a PFsense. For the first time I used the DH32 (elliptic curve) in phase 1 (AES256, SHA256). no PFS in phase 2. Do you think we have problems with slow communication? If so, which protocols might it affect?Thank you.Regards.Marco SpadaW3 - Italy

Hi, We will onboard 850 users to FortiSASE, I know that we can import CSV file of email addresses to send link in bulk. Just want to ask if there is a way to install FortiClient in bulk, aside from manual installation.  Thanks,JL

I have removed two physical interfaces (internal2 and internal3) from the internal interface. I gave internal2 192.168.10.1/24 and internal3 192.168.20.1/24. I connected a device to port 2 and gave it the IP address 192.168.10.10/24. I plugged another device into internal3 and gave it 192.168.20.10. I made sure each device could ping it's own gateway .1 address. I then tried to ping the opposite IP gateway which as expected did not work. I then created a firewall policy called 10 to 20, Inc int: internal2, Out int: internal3, source: all, destination: all, service: all. Action: accept. Apart from disabling NAT and setting the logging to All Sessions (which doesn't seem to be logging anything by the way, but that's a separate issue) everything else was left as default. Yet I can't seem to ping one device from another. I can't even ping the opposite gateway. What am I doing wrong?

Hello, is it possible to configure a FortiAP with the RadSec protocol?I have only seen RadSec in the FortiGate config menu.

hello team, i have a question about phase 2 selector IPsec.It's possible use public ip on phase 2 remote subnet? And how configure it? thanksbr  

I have a WPA2 Enterprise network. Fortinac connects to the network by authenticating the user from the active directory with radius. But I want to make this role based. I want those in role A to get IP from vlan A and those in role B to get IP from vlan B. How can I do it?

I'm having the hardest time getting my getting my 40F Fortigate connected to IPv6. I am fairly versed in networking and Fortigate (two years now) but not having luck here.   So I have the Interface set to DHCP and its COX Communications.  I have obtained an IPv6 IP address and two IPv6 DNS servers.   For my LAN interface I'm using SLAAC, using fd00:6565::/64 as my prefix and all my devices have an IPv6 address. I even have enabled the DHCPv6 Server to give out my DNSv6 server addresses but mostly I use my DNSv4 which works also.  And I have Central NAT enabled. BUT I am just confused how to acquire delegated IPv6 addresses and how to pair them to my SLAAC IPv6 addresses in my devices. Should I be using a different addressing mode????  MANUAL allows you to set "Auto configure IPv6 address"Or "DELEGATED" mode.  I don't know my "prefix hint" I spend HOUR and HOURS trying to get setup info from COX, even pay for extra te

I attempted upgrading my 6.0.7 virtual fortiauthenticator server to 6.4.9 last night with no success. It simply hung when it reached the "Migrate Encoding - upgrading encoding of database fac to UTF8 succeeded portion" I waited roughly 45 minutes with no movement. I ended up shutting the server down and reverting to my snapshot. I also tried version 6.4.0 and 6.3.4 to see if there were any differences and they all simply hung as well. Anyone run into this type of issue that can shed any light on what to look for when this occurs so I can attempt this again during non production hours? Thanks in advance!!

In our FortiManager and FortiAnalyzer we have some weird behavior with the UI elements.Some hitboxed have a hitbox over the button. So we cant use these button without fiddling around with F12-DevMode. This happend on all browsers (Chrome, Edge, Firefox and even iExplorer) and on Phone and Desktop. Is there something im missing to fix this or need i to create a new VirtualAppliance for the FAZ and FMG? 

Can I delete or de-register the FortiCloud account from the Fortigate unit, so I can re-register with the same account.if possible how? and can a factory reset delete a Forticloud account?

Dear Community, I tried creating a new module and after creating and adding the module to the navigation pane in the application editor, I am not able to see the created module on the left-hand sidebar of the FortiSOAR windows to navigate across modules in the system.Please can anyone let me know if there is any additional step I am missing?Thanks