Solved

I have a strange issue with FortiManager, I have two sites that have radius configured for VPN authentication. Each site has a local server and a remote server as a backup that connects over IPSEC. I set a source IP in FortiManager and push the system config. Both sites then can contact the servers using the test connectivity, but as soon as the system config is pushed, the policy package goes out of sync. When I go to push the policy package, it unsets the source-ip and the test connectivty fails. I have tried it directly on the firewall and retrieve the config, but ultimately get the same issue where FortiManager wants to unset the source-ip. Anybody ever run into this or have any suggestions?

Hello!after installing FAZ-VM-KVM 7.2.4 (with Trial License, if it matters), I was not getting "Top Sources" and "Top Destinations" for Last 4 hours, 1 hour, 30 minutes or 5 minutes. To fix, I rebuild'ed the database (using "execute sql-local rebuild-db") and now, I'm seeing "Server error: ERROR: relation "app_mdata" does not exist LINE 1: ... ON t1.dvid=t2.dvid) t WHERE (1=1))) t1 left join app_mdata ... ^" in graph and table.Suggestions on how to fix, most appreciated.R's, FerenX  

Hello everyone, Our #Fortigate v7.0.14 detected a Heartbleed attack, but it did not block it, so it reached an inner service (luckly not vulnerable)  To my understanding, the default action should be blocking such malicious connections. Why did it detect but not block? How should I configure Fortigate to block it? Thanks for your help,

Hi there , we are using Fortinet 60F and it was working all good and I can login via Https , but suddenly its stop working , i cannot access it , I have tried rebooting but no luck , the only way i can access is TELNET and I am not good on CLI , i have check some basic commands , i have tried already killing the Https daemon , and check the ports (http , https) for connectivity but I am still not getting any luck , I have also checked the storage which is all good, I am not sure what the Issue is , could this be a trusted IP issue ? i don't know as i was using the same IP address to access the console before. Any help will be much appreciated :) , Thanks in Advance

Hey all, my on Prem Data Gateway connects to Office 365 via 443(no inspection), but after few minutes it looses connection. The issue is definitely the forti. With a direct uplink the connection is persistent. How can i debug? What kind of trace can i perform to find the issue? Any direct ideas? Thanks and best regards

Hello, do you know why the path for the update from version 6.4.13 to 7.0.14 is not shown?I have a 300E device and I need to update to version 7.0.14 but when I enter the following link to see the update path https://docs.fortinet.com/upgrade-tool/fortigate I cannot find the version  

HelloI have FortiAP 220B/221B at v5.2.7 build0265, which I know is very old.I need some info but I can't find documentation on it.What is the last firmware version that was released for this AP?How can I find the upgrade path for this AP from v5.2.7 to its latest firmware version?

Hello fellows! In a FGT-61F I created a local DNS service for domain "local.tld" with some A records in it.All clients using the fgt as their primary DNS server and can resolve all hosts in "local.tld" with their FQDN.Fine. Now I want to use this working FQDN resolution for some firewall policies, so I added some addresses.When I try to use the same FQDN for an address object, fgt says "Unresolved FQDN: host.local.tld". What am I doing wrong? Any suggestions? Working on FGT-61F with FortiOS 7.2.6. Any help welcome. Thank you in advance! Regards, Michael.

Hello, Is it possible to block the change of the expiry time of a guest account? For example, I set 4 hours and the administrator who creates the account cannot change this or no longer than 4 hours. How can this be done? Zaq

I am trying to see the commands in CLI to display the network interfaces configured for the fortiportal but the show commands donot work.I am using the Fortiportal 7.2.2.Is there a specific command to see the configuration?

I have two LAN networks: the first one is 192.168.1.0/24, and the second one is 10.0.0.0/24. Each LAN is directly connected to a FortiGate firewall. I have set up a site-to-site VPN using two FortiGate virtual machines running version 7.2.0. The VPN configuration was done using the wizard.However, when I try to ping a host in the other subnet (for example, from 192.168.1.1 to 10.0.0.2), I don't receive any response. The ping requests seem to be unsuccessful.I researched this issue and discovered that it might be related to the black hole route created by the VPN wizard template. If anyone has experienced this problem before, I would appreciate any suggestions or solutions for resolving it. If anyone has knowledge of how to fix this, please provide guidance.

Hi all, I am able to connect to a Fortinet VPN server from Windows 10 using Fortinet Client v6.0.9.0277. My configuration is displayed in the following 2 pictures: But, from linux mint, using strongswan I am unable to connect. Here is my configuration: # ipsec.conf - strongSwan IPsec configuration file conn FortinetVPN keyexchange=ikev1 aggressive=yes authby=secret left=%defaultroute leftauth=psk leftid=My_User_name right=VPN_IP_HERE rightauth=psk rightid=%any rightsubnet=0.0.0.0/0 ike=aes256-sha256-modp1536,aes128-sha1-modp1536! esp=aes256-sha1-modp1536,aes128-sha1-modp1536! dpdaction=clear dpddelay=30s dpdtimeout=150s ikelifetime=86400s lifetime=43200s keylife=43200s rekeymargin=3m keyingtries=1 auto=add type=tunnel replay_window=32 mobike=no forceencaps=yes   #ipsec.secrets My_User_name : PSK "My_Preshared_key" My_User_name : XAUTH "My_Password" &nb

Hello family! I am asked to enhance a Fortimail VM with recommended features located in the dashboard for Fortimail 7.4( and believe me, I do not understand MOST of the features in Fortimail - as someone said in a  video, features are TOO vast/plenty):1. Policy (Access control, ip policy, recipient policy etc)2. Profile (session, antispam, antivirus, content, replacement message, resource, auth, ldap, dictionary, security, ip pool, group, notification)3. Security(url filter, quarantine, greylist etc)4. Encryption ( IBE etc)5. Log & Report Could I kindly get a set template/industry standard for a good Fortimail Deployment( a step by step guide) so that i can use on my fortimail? I know many admins have their options tweaked to their environment, but I will use anyone's recommended options, take time tweak mine accordingly.I already know my LAN/WAN net configs. The only thing i would do is just use my IP details, replacing what e

Hi Guys,   Is it possible to directly integrate the on-premise FortiGate with SSL VPN use case to my Microsoft Authenticator to be my 2FA mechanism? Or, should I use a RADIUS server like FortiAuthenticator where the FortiAuthenticator will be the integration point of my FGT, AD, and Microsoft Authenticator? Thank you.   Thanks

Hello, there are two versions of the FortiClient available. User based and device based where the first one is cloud based. what are the main differences between the two and to which use cases are the two types more suitable) Is there a comparison sheet available? Please point me in the right direction. BR Andreas

Hi Team.I have configured site to site vpn with fortigate firewall and sonicwall firewall. with this help of this link https://www.gns3network.com/how-to-configure-ipsec-tunnel-between-fortigate-and-sonicwall-firewall/   i configure site to site vpn . after configuring vpn. both the phase1 and phase 2 tunnel are up in forigate and sonicwall. but i cant able to access the sonicwall network lan or even i cant able to ping sonicwall lan network. from sonicwall lan i can able to access the fortigate lan interface.but from fortigate i cant not access sonicwall lan. can anyone guide me to solve this.

Good day,I am new to Fortinet, I am use to the Cisco product line and wish to expand my knowledge further, using Fortinet products way forward.Mode chosen: Gateway modeDeployment type: Forti mail in the DMZ or Behind the FortiGateCould someone kindly assist me step by step(probably u did for your environment/similar if possible) how to carefully deploy a Forti mail VM to manage and monitor my email traffic in Gateway mode. I have read via the 7.4.1 admin guide, other admin guides, watched a few YouTube videos and NO real guidance, step by step solution, not even a workable template based setup for Forti mail, just a bunch of webinars, chatting and simple setups(telling/referring you to go read this entire document(admin guide), no real lab scenarios at all. I have configured/setup and deployed many devices, network solutions in infrastructure environments/datacenters, some all by myself, others with help of comrades, video guides and straightforward - coherent reading material. But I a

Hello, I have a 1101f series firewall. I want to connect 6 fortiswitches. When I connect the switches over fortilink by jumping from each other, there is no problem and all of them get ip and the connection status is actively monitored. However, when I need to connect with different 6 ports of the firewall (due to the wiring structure of the building), I enter 6 ports into fortilink. When I connect the switches, they get ip first, but the connections go immediately. DHCP does not work and they cannot get ip. What is the reason for this?In addition, I created a fortilink port as a Hardware Switch. When I put the ports into it, all switches get ip but only 2 of them seem to be active. I can reach the others but they do not seem active. What could be the reason for this?

I know I setup some VLANs on my FG60F a while back, but when I look at the interfaces in the GUI, they don't show up. How can I view my VLANs either in the GUI or even command line?

Hi All, Sorry, my first post here, and forgive me if this has already been asked earlier.What firewall will do if it receives SYN, ACK (half-open session) packet or subsequent packets for an already established session on a different interface (not the one where the packet was sent out)?  Thanks,Myky

Hello team, I have the following problem when a device connects to an SSID.Basically when a device connects to this specific SSID it fails to get the 'ip address in DHCP. This is the traffic flow:Device --> FortiAP --> FGT200F --> MPLS Circuit --> Fortinet 400F (fortiAP was added here) .The authentication via Radius occurs successfully while the release of an ip address does not. The DHCP server and Radius server are two different virtual machines.I see from the logs that the correct vlan is pushed to the device but the DHCP request goes timed-out. I kindly ask:On the network interface of the SSID should DHCP relay be enabled ?Should policies be created to allow DHCP traffic from this interface to the DHCP server ?Should vlan31 be carried from the interface where the FortiAP is connected to the firewall interface where vlan31 is connected ? Thanks for the supportBR

HelloI have a FortiNet and I would like to connect a FortiAPI have connected the FortiAP to a switch (management vlan) which is connected to the FortiGate.The thing is that from the Fortinet "Managed FortiAps" appears in (Offline). However, the FortiAP responds to ping on the network.Is it necessary to connect the FortiAP directly to the FortiNet for it to detect it?If not, why does it appear Offline?

FGT60F has two WAN lines.WAN1 Fixed IP: NOT WORKWAN2 Dynamic IP: NormalFirmware 7.4.3 Reviewed the configuration with FWF60D to test WAN1 It is the same WAN1 setting. FWF60D is normal:It can ping 8.8.8.8Outsite can ping the Fixed IPConfirm the Fixed IP line normalWhen set FGT60F's WAN1 to be dynamic IP, the WAN1 can ping another device that can ping back FGT60F Not sure why Fixed IP fails but Dynamic IP works on FGT60FWAN1: Dynamicexec ping-option resetexec ping-option interface wan1 exec ping 8.8.8.8PING 8.8.8.8 (8.8.8.8): 56 data bytes64 bytes from 8.8.8.8: icmp_seq=0 ttl=58 time=1.7 ms64 bytes from 8.8.8.8: icmp_seq=1 ttl=58 time=1.4 ms64 bytes from 8.8.8.8: icmp_seq=2 ttl=58 time=1.4 ms64 bytes from 8.8.8.8: icmp_seq=3 ttl=58 time=1.4 ms64 bytes from 8.8.8.8: icmp_seq=4 ttl=58 time=1.4 ms--- 8.8.8.8 ping statistics ---5 packets transmitted, 5 packets received, 0% packet lossround-trip min/avg/max = 1.4/1.4/1.7 msWAN1: Fixedexec ping-option reset exec p

Dear All,I'm using the FortiGate 100D and I am using 802.3ad Aggregate interface. One another device is plugged into another port of the FortiGate (port 3) (IP static is 10.199.139.200). I have created one policy for I can go to that port 3 but I can't ping to the IP 10.199.139.200 when I'm in the 802.3ad Aggregate interface network. I can ping that IP from FortiGate. I don't why? 

GreetingsI navigate here:Fortilyzer > Log View > Traffic.See below.Q1 How do I custimoze the columns?Q2 How can I edit/change the Device ID column to give an hostname of some more friendly host id?I have checked these URLs but I have not made sense of them:7.4.1 Admin Guide Customizing displayed columns Forum Post Sorting the Columns Customizing displayed columns  Thanks