Solved

Hi everyone, I got a issue since yesterday on my FAZ : i cannot connect to webGUI anymore. When I try to connect to https://192.168.1.16 I get an ERR_CONNECTION_REFUSED in any web browser on any computer. It was working earlier. I did not make any changes on the interfaces. Rebooting the FAZ has no effect. No host filtering on the interface or on admin account. SSH and PING keep on going on. allowaccess is set on https, ping, ssh, snmp, webservice and fgfm. Where could the problem be spotted ?

For my FortiCloud subscriptions (FAZ, FMG, Sandbox, EMS) - Our compliance team needs documentation that our data is kept in US datacenters only. How is this handled and is there any documentation that proves it ?  Thanks, Don

I have a Fortinac Guest network. I want the Citizenship number from the user in the guest network. There is an API where I can query this number. I want to include the user's name and surname in the network when it matches the citizenship number. how can I do this?  

Greetings, I have users on a internal network with Internet access blocked. We have MS Office installed on their workstations and I authorized them on a different vlan *with* internet access. (They're the per-machine perpetual licenses that ship with Dells, so should be fine forever offline.) After replacing a juniper with a fortigate when the no-internet users launch Word or Excel it hangs for roughly 26 seconds and then starts normally. Before installing the fortigate this didn't happen. When I make a rule for these machines that gives them access to the internet the problem goes away, so I'm fairly convinced the problem has to do with Word/Excel phoning home and some kind of keep-alive or time-out issue. The migration was fairly painless and this is one of the only quirks that have come up. Any advice on how to solve this without putting these machines on the Internet?

HelloI wonder why FortiGate's active portal is somehow not as active as FortiNAC's active portal.In FortiNAC when you are isolated there is always a popup message in OS and in browser telling you that there is an active portal and asking you to click to authenticate.However in FortiGate when you enable active portal there is no popup message in OS neither in browser, and you need to open the browser and access some site in order to get activate the active portal.If someone successfully managed to make it more proactive thanks to share.

Hi, is there a way to disable nat on ipv6 when using combined policies (ipv4 & ipv6).There is only 1 checkbox to enable/disable nat. This implies to both ipv4 & ipv6.For ipv6 of course you don't want nat. Fortios is 7.4.3 thx

Hi All,There is a FortiGate 60E.I set up MFA the way shown on the screenshot.   The drawback of this method is that it requires FortiToken Mobile.It means if I'm not available nobody can access the router.Is it possible to set up MFA for admin access in some other way that wouldn't be linked to someone mobile device?  

Working on some FortiOS firmware upgrades and have come to reckon with the FortiAP and FortiSwitch compatibility. I am running a FortiGate-100F and trying to upgrade to FortiOS 7.x, but the FortiAP's I'm running areFortiAP-221E and FortiAP-222E.I looked at the FortiAP compatibility matrix , but it does not list the 221E or the 222E that I'm using.Currently the FortiAP's are running 6.4, so based on what I see in the matrix I should be safe to upgrade the FortiGate.

Hello Everyone Our customer has a FortiGate network that only contains 1 FortiGate FG-200E firewall. Now they want to purchased another FG-200E firewall and make an HA build.  But to reduce failure points, we are thinking if we don't need Switches for this HA build. Then I'm wondering, is it possible to enable HA for two FortiGate firewalls without any switches and hosts under two firewalls can all work fine? For example, like below topology. VLAN 101 was there on both FortiGate firewalls with private IP address 10.1.1.1/24. This VLAN is used to connect with each other and to the hosts under them. Then, when the Secondary FortiGate works in Spare mode, will its LAN ports in the same VLAN still be functioning as a L2 switch and make Server 2 be able to access Internet via Primary FortiGate? Thanks a lot.

 FYI:Seems like the latest FortAP release has put ModelName in the SystemName LLDP object, so in a switch you get a lot of 'FortiAP-NNN' names, not the actual hostname of the AP's:Port:     SystemName: The Cisco AP still active on the switch, correctly shows the hostname.Earlier FortiAP's listed the System Name corretly, but currently I can't downgrade any AP's, so can't verify at what version it 'broke'. TAC: 9287117

Hello,where can i find download link for FortiWeb VM deployment docker image package?in following installation doc it mentioned to look it at https://support.fortinet.com but couldn't found any download sectionhttps://docs.fortinet.com/document/fortiweb-private-cloud/6.4.0/fortiweb-vm-on-docker/794267/deploying-fortiweb-vm-on-docker 

Hi Team,I have encountering an issue with devices while updating their records.This issue occurs after installing FortiClient ZTNA.I monitored the traffic by Wireshark and I observed that the connection refused as shown:Our DNZ zone security configuration is to allow secure connection onlyBut after changing it to unsecure, machines can update their records.This issue without connecting to VPN just the FortiClient installed and connected to EMS server.FortiClient Appreciate your support.Thanks,Alaa Elrayes

I am trying to figure out the best way to setup ZTNA for our environment.  We create a lot of server that server up our SaaS application via https.  Each server has its own unique URL.  If I had to create a ZTNA server for each one I would have a new full time job.  Even setting up a single ZTNA Server and then managing webservers as they are added/removed from our environment would be a full time job.  All of our webservers do live on a handful of subnets that never change. What would be the best way to setup ZTNA for this?

I am trying to configure trusthost for the user ADMIN on my fortigate with the following:config system adminedit adminset trustedhost1 172.25.176.23 255.255.255.255set trustedhost2 172.25.177.0 255.255.255.0end My other users use ADFS SSO login with 2FA so I am ok with them accessing the FortiGate from the internet.  I just want to block the default admin account (and any other non 2FA backed account) from logging in via the internet.  I do want to allow the admin user to be able to login from our internal AD domain servers. When I set this up though I found that ALL users were blocked from accessing the FortiGate unless they came from our AD servers.  Support is trying to tell me that setting up the trusthost effects ALL users and not individual users.  I find this very hard to believe that Fortinet would prevent people from controlling where a user logs in from on an account by account basis.  Linux has been doing this for MANY MANY years.  And

Hi all,I've got an incident based on traffic from an internal IP to Malware IP 192.143.59.12. FortiGuard is not showing anything regarding 192.143.59.12. Neither the Malware IP list under FortiSIEM -> Resources.I know that Malware IP's are based on services such as Emerging Threat.Why is FortiSIEM classifying  IP 192.143.59.12 as a malware? Thank you,Norberth  

I am trying to configure the fortiportal with a secondary IP address and every time I do so, I get the error"Disabling interface eth1"after I enter the end commandhere is what I input:fortiportal # conf system interface(interface)# edit port2(port2)# set ip (ip address and subnet)The system already has a primary address and port1 configured with an ip which we use to access through ssh to configure the secondary ip.What we are trying to do is have a primary IP for one team to use for configuration and a secondary for another to access Fortiportal.Did anyone have any luck in configuring two IP addresses for Fortiportal?

Hello,For our customer who has a full forti-stack: Fortigate firewall, FortiSwitch and the FortiAPs, the WIFI guest users are not getting the IP addresses and the error DHCP-no-responseWarningDHCP server not responding for client (Client device Mac-address)The link to the Fortigate documentation which shows the Log ID:https://docs.fortinet.com/document/fortigate/7.2.7/fortios-log-message-reference/436581:) I have a question is there a separate document that advises the steps to troubleshoot this issue related to the log messages on the firewall not only for this issue but also for the other issues?2:) Lastly the issue started after the firmware upgrade from version 7.0.12 to 7.2.7 last week?3:) What are the steps to troubleshoot the issue?Many thanksFaisal

Dear Colleagues,we are facing issues with tcp forwarding on some MacOS mashines. On some Macs its working quite fine but some are not able to connect to ZTNA Destinations, while the normal ZTNA Web-Proxie stuff is working.The FortiClient logs are showing the following on these devices:2024-02-26T15:08:55.162 TZ=+0100 info ztna mergeCfg:{"enabled":0,"rules":[{"name":"replaced","mode":"transparent","enabled":0,"destination":"replaced","gateway":"replaced","encryption":0,"local_port":"7788","type":"private"}],"portals":null,"gateways":[{"redirect":"0","addr":"replaced","alias":"replaced","rules":[{"name":"replaced","mode":"transparent","enabled":1,"destination":"replaced","gateway":"","encryption":0,"local_port":"7788","type":"private"}]}],"notify_on_error":1,"portals_enabled":1,"gateways_enabled":1}2024-02-26T15:08:55.162 TZ=+0100 info ztna ztna disable I replaced the private data with "replaced".Every time you try to access a host, specified in the ZTNA Destinations, you will get t

Hi,I have a problem with a FAZ trial license. Some time ago I've been playing with a FAZ VM on Proxmox - restoring from backups and resizing data disk (of course within trial limits). After that I was getting errors about duplicated license.I've decided to decommission the old license, delete the VM and start fresh. Sadly, with the new license and new VM I was still getting the duplicate license error.With the support help, I was able to remove all old and decommissioned FAZ licenses from my account and once again deployed the new VM. Nothing has changed. I've even tried to create another Fortinet account, but no matter what I do, there is still an error.Does anyone have any idea what to do to deal with this?

When we configure this SSL VPN MAC address filtering, what system limit would dictate the max number of MAC addresses we can configure on an FGT (no vdom/muti-vdom)?https://community.fortinet.com/t5/FortiGate/Technical-Tip-MAC-address-check-on-SSL-VPN-connections/ta-p/194337The max value table doesn't seem to have the exact matching object.https://docs.fortinet.com/max-value-tableToshi

Hi, Our company has 6 x /24 IP blocks, and we want to create static ARP records for each IP address, consisting of different MAC addresses. We only want the specified MAC addresses to access the internet. We are using a Fortigate 3700D device. We don't want anyone else to use that ip other than the mac we paired with. Is it possible with without problem ?  My question this process can be offloaded by the NP6 processor and if there would be any issues with a 10Gbps active capacity. Thanks.

Hello, 2 wees ago we replaced a FG100D cluster for FG100F. We copied all VoiP rules for the external Voip provider. Now we get some feedback from the local users that "sometimes" it takes lie 1-2 seconds before they can take the call and they did not have this issues lie 2 wees before. the policies are the same, we deleted the session session helper so I think we should have the same situation. Any ideas? Thanks

Could someone kindly assist me with the FortiSOAR uninstallation/reinstall procedure via the command line interface? (Tried and Tested)

Trying to get a trunk built between a Cisco Catalyst switch and a Forigate 100F using two 10G links in an LCAP link-aggregation configuration.  The LACP link comes up but the VLAN communication does not work.  I swear I've used this same configuration in the past and it worked, but it isn't working now. Here is the configuration on the Fortigate:config system interface    edit "x1"        set vdom "root"        set type physical        set trunk enable        set snmp-index 7    next    edit "x2"        set vdom "root"        set type physical        set trunk enable        set snmp-index 8     next     edit "po1"        set vdom "root"        set allowaccess ping https ssh snmp http fgfm radius-acct fabric ftm&nbsp

Hi guys, I wanna upgrade my SOAR to the latest version but i get a response disc error. How can i fix this?  Error: There is insufficient disk space to complete this operation.Make sure you have enough space on the following locationsand then retry the operation.Details: Available Free Space on /: 1.33GBRequired Free Space on /: 2 GBRerun the script post addressing above error(s).Exiting.