Solved

HelloWe have FOS 6.2.x and want to upgrade to 7.0.13.In the meantime we have some old FAP 220B that we want to keep but without breaking the compatibility.The following command on another FOS 7.0.13 shows that FAP 220B is compatible with FOS 7.0.13.config wireless-controller wtp-profileNow I need to check which FAP firmware version is required/recommended on my FAP 220B so it can be compatible with my FOS 7.0.13.Tried to check on document "FortiAP and FortiOS Compatibility Matrix" but couldn't find anything on FAP 220B, I guess because it is EoL/EoSL.Any idea where I can find this info?

Hello everyone! I have tried a Fortigate 501E to an Active Passive Cluster. But after I configured the high availability settings the firewall crashed and paralysed the connection in the company. There are already some VDOMs and some policies configured on the firewall. How can I prevent the firewall from crashing again at the next attempt? This an urgent Question. 

Hi,after updating a Fortigate 60E from version 7.0.7 to version 7.0.8 the RDP via SSL WEB VPN no longer works with any PC, the error "Connection closed!" always appears. If I perform a NAT of the port 3389 from the WAN to the LAN I enter the PC correctly.I have changed all the possible parameters but I cannot log in, whether I enter my credentials in the bookmark or enter them by hand.I have already tried to follow this KB but nothing, error: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Unable-to-take-RDP-of-machines-via-SSL-VPN-web/ta- p / 192454Has anyone had the same problem?

I have a physical interface "internal1" with 3 subinterfaces.I have another physical interface "internal2".If i want to create firewall rule to allow traffic from "internal1" to "internal2",do i have to create 1 firewall rule only or i have to do 3 firewall rules?

Can i connect new fortigate firewall with version 7.2.5 to my Analyzer running 6.4.11 firmware ? 

Hi I want to disable and enable fortigate port3 every friday on 09:00 AM. I configured the below snitch, trigger and action but it does not run. what is the problem? config system automation-trigger edit "Disable_LTE" set trigger-type scheduled set trigger-frequency weekly set trigger-weekday friday set trigger-hour 9 next end config system automation-stitch edit "Up_Down_LTE" set trigger "Disable_LTE" config actions edit 1 set action "Disable_LTE_Interface" set required enable next edit 2 set action "Enable_LTE_Interface" set delay 10 set required enable next end next endconfig system automation-action edit "Disable_LTE_Interface" set action-type cli-script set script "config system interface edit port3 set status down" set accprofile "super_admi

I need to do next configuration for two 802.1x devices per single fortiswitch port: - ipphone with EAP-MD5 802.1x authentification; - PC behind the phone with EAP-TLS certificate based authentification.As I understand I need configure 802.1X-mac-based authentification on port for this scheme. Shoud it works without keeping all devices mac-address database on RADIUS server?  Thanks.

Hi We have a SSLVPN Web portal on one Fortigate. When using it to get to resources behind a tunnel on another Fortigate, it seems to NAT the traffic despite the policy having NAT turned off.  FG2 sees the source address of traffic to AWS being 192.168.1.1 instead of 10.10.1.1 Can anyone explain what's going on here?

Can i upgrade my fortiAnalyzer 300G from version 6.4.13 to version 7.2.xx? i dont see any upgrade path to 7.2.xx.

Hi All, my Fortigate 900D, After one power outage is not working any more, but power led is bright. When I plugged the console cable into the computer, it sent logs continuously without stopping. Could you please tell me what's wrong with this? handle it.Thank you guys.-> this is a log that the Fortigate sends continuously....Buffer I/O error on device sda3, logical block 2525481Buffer I/O error on device sda3, logical block 2525482Buffer I/O error on device sda3, logical block 2525483Buffer I/O error on device sda3, logical block 2525484Buffer I/O error on device sda3, logical block 2525485Buffer I/O error on device sda3, logical block 2525486Buffer I/O error on device sda3, logical block 2525487ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0ata1.00: irq_stat 0x40000001ata1.00: cmd ca/00:08:01:8b:36/00:00:00:00:00/e0 tag 0 dma 4096 outres 51/40:00:01:8b:36/00:00:00:00:00/e0 Emask 0x9 (media error)end_request: I/O error, dev sda, sector 3574529Buffer I/O error on device sd

hi,i got a FW policy which includes blocking ISDB address group/objects, i.e. botnet, cnc, phishing, spam, etc.the FW policy install from FGM failed after i tried 3x times. FW01 (16) $ set internet-service-name "Blockchain-Crypto.Mining.Pool" "Botnet-C&C.Server" "Malicious-Malicious.Server" "Phishing-Phishing.Server" "Spam-Spamming.Server" "Tor-Relay.Node" "VPN-Anonymous.VPN"entry not found in datasourcevalue parse error before 'VPN-Anonymous.VPN'Command fail. Return code -3FW01 (16) $ nextMust set internet service, internet service group, dynamicnetwork service, custom internet service or custom internet service group for destination.object check operator error, -56, discard the setting per checking forticloud, the fortiguard service/feature entitlement are down/red. my questions are:1.do you need a valid warrantly/entitilment for ISDB to work?2.do you need to have a count under the 'number of entries' for the ISDB IP reputation DB.3.does 1 and 2 above need to be working

Hey guys, I'm facing an issue that I'm not sure if is my mistake or what, I hope you can give me an hand on this.So I'm installing a new FG with version 7.2.6 using fortimanager and I'm getting a error that I didn't saw last time we installed a FG (was in version 7.0.x) also using fortimanager.We use address objects and groups for the RFC1918 and now with it seems that we can't have the 0.0.0.0-9.255.255.255 range anymore since the FG says that "start-ip can not be 0", well sure let's change the address object, but I can't because "Could not change assigned objs"...Well that object is part of a group, and that group is being used, but if I try to remove the group from the address object nothing happens, I mean, the group is still there.I changed the IP on the global ADOM but didn't help.So I'm left with a catch 22.Can someone tell me what I'm doing wrong here? EDIT: I forgot to mention that the address object is a global one, that's why I though updating the global one would

Hello Fortinet Community!I have implemented in the past policys to allow my servers and VMs to reach microsoft and AVs(bitdefender) servers for update only. Recently the Internet Service Policy stopped working. The VMs wont update. Any ideas? Have the Internet Service Database stopped working?Is there a correct order for them to be adjusted?Is there a default internet service required in all policys to be able to reach the required destination?  Thanks in advance

Hi Everyone,Is there any way to limit users to only be able to Login Authentication using the Chrome browser?My device is FortiGate 80F and Firmware v7.4.1 build2463 Many Thanks! 

Hi everyone,   Here is my use case :   I set up a Hub'n Spoke topology with Hub in azure and physical appliance in offices. In one of theses office, we share Internet acces with tenants.   So, I activate multi-vdom on this Fortigate but, I'm stuck on how to configure Internet acces, how to set up this FGW as a spoke.   At this time everything is in the root VDOM. I want to set up a VDOM for my Company and a VDOM for tenants. Tenants only need to access Internet. And Of course My company need to access Internal ressource throgh Hub'n Spoke topology.       So my questions are : - Where should be may hub'n Spoke logic (Tunnels and SDWan rules) in Root or MyCompany VDOM? - How do I share Internet access (VDOM Link, VLAN on NPU Vdom Link assigned to each VDOM)? - What are the best practices for this scenario.   PS.: FortiOS is 7.0.13   Thanks for your help, Frederic.

Hi all,couldn't find any information about the change of the order of the rules inside a route-map. I know that for firewall rules or sdwan rules, you have unique identifiers forevery logic, and you can move them up or down through the GUI or via CLI ('move x before|after y'). But can I do something similar with route-maps ? For example suppose I have the following: config router route-mapedit "RM_EXAMPLE" config rule  edit 10   set match-community "CL_32:3"  next  edit 100  next  edit 5   set action deny   set match-ip-address "PL_DENY_PREFIX"  nextendnext Something not nice: in this case the identifier of the rule is important, and is related to the order the rules are executed. So even though '5' appears after '100', it is processed first. Suppose now I have rules '1' and '2', and I want to insert something in between. Is there any simple way to do it ? in Cisco there is a 'resequence' command that

Hello, Can someone confirm if we build a new VM in Azure, and choose BYOL, can we then use a license from our existing FortiFlex licensing? Or can it only be a traditional license?

We are utilising the FSSO Agent to identify the logged in users and match them to traffic. In the traffic logs we have one user that seems to be matching to multiple IP addresses that are in different geographic locations. What's also interesting is the MAC that's showing is a Cisco router. The related device seems to be appearing in the fabric topology.I have no idea how it's relating the device and user.I'm only fairly new on Fortigates so a bit perplexed..Any thoughts?

Hi, I'm trying to determine whether FortiLink traffic can be sent out-of-band/over separate interfaces to my other traffic. I'm working on the topology below and would essentially like to send regular traffic and FortiLink traffic across different links. Is this possible?  

I is configuring site to site vpn.I no want to use wizard.I have to add in ALL the remote subnets in static route 1 by 1.Is it possible to have: REMOTE SUBNET -> next hop of virtual interfaceinstead of add subnet 1 by 1 for each rule

Hi   I’m testing the Sandbox integration with FortiOS7.2.6, but when I set it to “suspicious file Only”, no files are linked to the Sandbox at all. I’m having trouble because even when I use the test file provided at the following URL by Fortiguard lab, it is not linked to the Sandbox. https://www.fortiguard.com/sample-files Do you have any advice on how to test this? Also, is there anyone else with the same symptoms?    

Dear All,         I have downloaded FAZ_VM64-v7.4.1-build2308-FORTINET.out.ovf from the portal, and when i deployed on esxi and powered on, and its ask to enter password, i though this password is ask for new password i will be using, but its look like not, just wonder where i can obtain this password ? any help would be appreicated  keith   

hi,can't seem to aggregate port1 and port2 in a FG-201F.i already factory reset the device.i don't see port1 and port2 listed/available for the new aggregate interface (po1).ports1-4 are patched to our cisco switch and they're green/up. FW01 # config system interfaceFW01 (interface) # edit "po1"new entry 'po1' addedFW01 (po1) # set vdom "root"FW01 (po1) # set type aggregateFW01 (po1) # set member "port1" "port2"node_check_object fail! for interface-name port1value parse error before 'port1'Command fail. Return code -651 FW01 (po1) # set memberinterface-name Physical interface name.ha interfaceport17 interfaceport18 interfaceport19 interfaceport20 interfaceport21 interfaceport22 interfaceport23 interfaceport24 interfacex1 interfacex2 interfacex3 interfacex4 interface FW01 # show system interfacename Name.ha static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable physical disablel2t.root static 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 up disable tunnel disablelan static 0.0.0.0 0.0.0.0 1

Hi all,    I hope you're well.    I have a question surrounding importing previous configurations from an existing FortiGate to a new device. For example, if I have a FortiGate already configured with FortiLink and a number of managed FortiSwitches is it possible to import the switch-controller/FortiLink configuration from this device and have it apply to the new switches once they're connected and authorized on the new FortiGate?    I already have a configuration of a deployed network and rather than build the new devices from scratch if there is a way to import this and make the required changes for the new devices this would be much faster and efficient.    Not sure if this is possible or not, if anyone has any tips or tricks regarding this it would be greatly appreciated.    Regards,  Dan_Eng52

Hi, Having a little difficulty with this, I have a FortiAP plugged into a CISCO 3750, port is trunked with native VLAN 50 , LLDP is enabled. Cisco is connected to another Cisco 9K , vlan 50 trunked and LLDP enabled there also. Fortigate (7.0.14) has a Layer 3 Aggregate inteface connected to the Cisco 9K, no issues there. In order to get the AP MGMT, I created an SVI 50, with DHCP etc, and put it behind the Agg Layer 3, this is where I think there is a problem, I allow ALL traffic for now, but the AP will not come online, simply says "no LLDP neighbours found" if I do "diagnose lldprx neighhour" you can see the Cisco 9K, and the Cisco 9K can see the 3750 as an LLDP neighbour, so not sure why the AP cannot get to the SVI on the Fortigate, I did notice on the SVI you cannot set "recieve LLDP" or "Transmit LLDP" the option isnt there.. I have enabled security fabric, you can see the AP MAC on the cisco switches on VLAN 152..any suggestions where I have made a silly mistake??