Solved

Hello. There are 2 firewall, FortiGate 60F (firmware 6.4.6 build 6083 GA) and FortiGate 200E (firmware 7.0.12 build 0523 Mature). Will there be any problem configuring IPSec VPN between these two firewall?

I just got finished setting up FortiMail Cloud for Office 365 (setup as gateway for inbound traffic only) and had a question I am having trouble getting definitive answers on. I am sending and receiving email just fine; however, I know I have some tuning and tweaking still to do. Also, I know I am asking this question from a O365 guidance side of things, but as it relates to the new integration with FortiMail, I'm hoping someone can share some guidance on what worked best for them advice. One setting I put into place was defining the IPs of my FortiMail Cloud instance into the Anti-Spam Connection Filter Policy at O365. I did this as it seemed O365 was declaring an inordinate amount of SPAM from FortiMail Cloud. According to Microsoft, the IP Allow List skips spam filtering but still scans for malware and high-confidence phishing. I am getting more email alerts from O365 about "Phish delivered due to an IP allow policy" (I assume due to the Connection Filter Policy and since it's

Hi,I would like to know, where to find the function "SMTPUTF8" in Fortimail Version V6.4.6 ?In Version V7.4 you find it under System -  MailSetting - MailServerSettings.https://community.fortinet.com/t5/FortiMail/Technical-Tip-How-to-avoid-email-with-UTF-8-encoding-being/ta-p/292948This parameter doesn´t exist in the older version at that place.

Hello! In a normal connection (like internet - router - firewall - LAN device) the destination is the default route 0.0.0.0/0.0.0.0.1) what does it mean by named address?2) In which case we do not use the default route? 3) for what purpose we select internet service option?4) for IPSec VPN, is it mandatory to use blackhole as the interface?

Hello, I hope you are well, I want to update my two Fortigate 201F but I don't know which is the most stable version: 7.4.1 or 7.4.2 or 7.4.3 Regards.   

I've upgrade by gui a 40F Fortigate from 07.4.0 to 07.4.2 and readonly view is the only access I have by gui. By cli all permissions are granted, until now according troubleshooting there is no chance to roll back from 07.4.2 to 07.4.0 by gui or cli, cli error output shows: "Firmware update license is expired. Please update to a valid license" similar output showed by GUI. Community, do you have any feedback?

Hello team, this is the scenario:IPSec peers are both public ip so I left NAT-T disabled and enabled DPD Peer detection on demand for both firewalls.As authentication I set PSK, IKEv1 Main (id protection) for both firewalls.For the Phase1 Proposal part I configured AES256-SHA1 and DH 21 and 2 for both firewalls.After that I configured the relevant policies and static route for both firewalls.The problem is that phase1 does not go up. Running some debugging I see this in the logs:I also ran a packet capture and I see traffic on port 500 for both firewalls:   Thanks in advance for the supportBR

Hello! I have a question regarding IPSec VPN. There are 2 firewall, FortiGate 60F (site A) and 200F (Site B). The question is, do I need to configure IPSec VPN for routers in Site A and Site B if the router is either before or after the FortiGate firewall?

Hello AllCan I deploya FortiNAC "Subscription Visibility+Control (PLUS) license for 25 concurrent endpoints. MOQ 500" withFortiNAC "Subscription Visibility (BASE) license for 25 concurrent endpoints. MOQ 500" for the same device or I can't combine two licenses.

 Hello, I searched it in this forum, and finally found a similar topic below. https://community.fortinet.com/t5/Support-Forum/IPSec-VPN-restricted-by-source-IP-address/m-p/129749?m=51069 But the topic is unresolved. I already found a way to solve it by using 'Local in Policy'. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restrict-VPN-access-to-certain-countries/ta-p/192328 However, I don't want to use it because of system operation and maintenance considerations, as 'Local in Policy' is supported only through CLI setting.If you have another idea, could you tell me how to set it? FortiGate 

Hello, we just changed our FG81 cluster (because of the prof_admin problem). The first 81E resetted, loading config file and it is up and running (7.4.3). The second I did the same but I have problems. The status LED is fixed, it is not blinking. I hace access via Console and access via web is strange, suddenly I loose contact, etc.  Is there a hardware issue? What can i do? Thanks

Hello, does anyone know how to unhook clients with a bad signal from the fortiap since I have clients that connect from areas that do not have good coverage

Hi, I have configured pool with pool member, used default http monitor, but I see the pool member availability is "init", it's in this state for more than 20 minutes, anyone knows the reason for this? Thanks

Hi, we have a HA config where sometime ago we backup them up with the wrong prof-admin. So now we dont have any super_admin accounts and the FGs have 7.4.3 so no maintainer option, right? I was thinking of changing the cnfig file, restore a new master config with super_admin instead of prof_admin in the admin accounts and change slave to master, reset master and set up new HA. Now I found out that I cant execute factoryreset, I connected via console and I guess again admin rights. What can I do? Thanks

HelloI have two questions regarding FortiSIEM 6.7 content update.Which ports are used by FSM to download content updates from FortiGuard (can't find it on admin guide)Any advice when it connects to FortiGuard behind a proxy?

In continuation with my last posts,I have configured the second ip address on port2 of the Fortiportal and Port2 has been enabled.I have also configured another static route to the gateway of the VLAN of the IP address being assigned to port2.The Fortiportal has two static routes now one for port1 device and second for port2 device. I can ping the gateway for the VLAN ip address on port2 from the fortiportal.For some reason, I cannot ping the fortportal secondary ip from my pc or another network device and hence not the GUI as well on the secondary ip.Is there a service that I have to enable for the port2 ip address so that I can access the GUI through the secondary IP as well?I am trying to have two IP address on two VLANs so that it can be accessed by two teams

HelloI'm hesitating between FortiWeb 7.4.2 and 7.2.8 in a new production environment.The 7.2.8 seems much more mature as it has an high patch number, while I see some very interesting new features on 7.4.2.On both release notes I can see only 1 or 2 known issues, which is so few that I feel the known issues section is not up to date.My concern is to have a stable and bug free appliance, so if someone has 7.4.2 in production your advice would be appreciated. Also if only some features are not so stable thanks to mention them.

do i need to enable FMG-Access on my fortigate interface is i do not have forti manager in my environment ?is it good practice to enable FMG-Access ?

We configured notifications for Firewall policy expiry alerts.The alerts are operating well.The issue is that we are receiving notifications from both the primary and secondary firewalls.Please supply the necessary "Kb" so that we can receive notifications from the primary firewall only. #FortiOSv7.2.7 build1577 (Mature) 

Good morning friends, I have created a report in the fortianalyzer about which countries access or try to access my publications that I have created in the firewall.In the report I have noticed the following information (image):  When you say "reserved" what does it mean?Reviewing the logs, I see that the source IP is the private IP of my LAN network (users) and that the signature has LOW criticality with the signature "traceroute" and others have the signature "IP.LAND". It is worth mentioning that the IPS profile detects it. Do you recommend blocking the IP.LAND signature?

Hi Fortinet Community! I've been researching around but figured I'd drop a quick post here to see what others think. Working on implementing FortiSwitches into an environment with an existing FortiGate. To be clear, the current switches are not FortiSwitches. Layer 3 is handled by the FortiGate, and there are several VLAN sub interfaces on say the internal1 port. It looks like for this implementation, we will need to use FortiSwitch VLANs, which are bound to the FortiLink interface. It seems like we will need to recreate the existing VLANs as FortiSwitch VLANs to utilize them in the WiFi & Switch Controller in the FortiGate as if we create them as-is I believe VLANs and subnets will conflict. I've found some clever ways to speed this process up by exporting a config backup, modifying the interface lines, and restoring. Either way this seems like it'll be intrusive and was hoping to see if anyone in the community had experience with an implementation such as this.&nbs

Hi, does anyone know if possible, to put multiple /32 IP in system proxy arp in Fortigate? I been searching for inputs but most of the time the guide only put one IP in system proxy-arp? Is it possible to have multiple IP or not? Hope someone can guide me here!

Hi all, When using the Virus Total connector action "Get Analysis Details", the execution output shows the API request is 'queued'. Does anyone have any experience building in steps to keep checking when the status becomes complete?Using google.ca just as a test in the screenshot. Thanks in advance, Nelson

Hello, I have two firewalls Fortigate model 60E in HA.I have 2 tokens each, 4 tokens in total.I would like to know if I can use all 4 tokens I read to do this I have to delete the tokens on secondary FW, and then reimport them on the primary, in this way I can see all my 4 tokens on primary firewall, is it right? Thank you!

I am running fortigate vm in AWS ver 7.2.4.  I am starting to look at setting up client VPNs for our users.  After reading the documentation I noticed we could do this in 2 phases.  Phase 1 move all existing users to forticlient VPN.  Phase 2 move the users to ZTNA. While going through the SSL-VPN Settings on the Fortigate I see the message "For increased security, scalability, and flexibility, use ZTNA or IPsec VPN as an alternative to SSL-VPN tunnel modes."  So does that mean I should be doing IPsec VPNs for normal users rather then using the old SSL-VPN?  Are there any gotchas if I do Client IPsec VPN when the fortigate is running in AWS?