Solved

Hello, I´ve configured an LDAP Server, Connectivitiy test is successful (Windows2022 Srv) Also I created a UserGroup with the LDAP Server and chosen the desired Group from LDAP I cannot figure out how to login with an account which is member of the group Domain\Username username@domain does not work. Password is known, Account is not locked in AD. Any help is appreciated!  

I have a site-to-site link between two offices and I need to force one VLAN from site A to use site B as it's gateway for internet access. Currently the site-to-site link allows for devices from either network (including other VLANs) to communicate with each other, but they use their home firewall for internet access. I need this one site A VLAN to go out site B's firewall for internet access. 

Hi Support Forum! Could you please provide me on more information about this bug in 7.0.13 When configuring an 802.3ad aggregate interface with a 1 Gbps speed, the port's LED light is off and traffic cannot pass through. We have configured 802.3ad 1 Gbit Interfaces and i am afraid to update the Fortigate. Or is it okay to make an update without interruptions.  BR

Hi all,I would like to configure  ACL for FortiGate and FortiManager connection. The devices are deployed in a closed network and FortiManager is acting as Local FDS FortiGuard server.For licensing update , FortiGate will get update from FortiManager. As per the document , we need to allow TCP/443 and TCP/8890 for FortiGuard override service. I'm confused what incoming and outing ports means by the document FortiGate to FortiManager ( Is it incoming port?)FortiManager to FortiGate ( Is it Outgoing port?) https://docs.fortinet.com/document/fortimanager/7.2.0/fortimanager-ports/465971/incoming-ports As per the document , TCP 8890 need to allow for incoming ports . Does that means  from FortiGate to FortiManager IP?Or is it 443 and 8890 need to allow for both direction  : FG > FMG and FMG > FG ? Please help me, thank you

Hi, I am new to using Fortigate and looking to update the source IP for local out routing\system DNS but the manual option is greyed out. It is on latest firmware. We have few more exact model firewalls but no issues. ,

Hey everyone! I have a site-to-site VPN between two locations. Is there a way I can pass only one IP address through for remote browsing. For example, I have a subnet of 10.0.0.0/24 on FW A that can access all internal resources on FW B (example subnet of 10.1.1.0/24). I have one workstation (10.0.0.50) on FW A that would need to access the internet through FW B. The rest of the network would still access the internet through FW A. I tried using this KB https://community.fortinet.com/t5/FortiGate/Technical-Tip-Remote-browsing-over-IPSec-VPN-tunnel/ta-p/190719 but am unable to get what I need to work. Any help with this would be greatly appreciated!

Hi Forum! Is in Version 7.0.13 also this Problem?Solved: Re: Fortios 7.0.x memory leak? - Page 2 - Fortinet Community Could you give me an answer on this problem. BRValentin

I'm using Fortinac-F version 7.2. We have the following problem. When I install the agent on a machine in the domain, we can see it as active in the management interface. But when I install it on a machine outside the domain, the agent appears as deactive even though it is properly installed, what could be the reason for this?

Hello, I am trying from an external script in python to create an indicator in FortiSOAR 7.4.2, and I am bit stuck on how to define the indicator type which is basically a picklist.How would I formulate in the payload the reference to the item in the picklist? So far, I have tried the following payloads (and various variations) unsuccessfully; it looks like the API call tries to create (in some cases successfully) both the indicator but also a new IndicatorType (if I omit the uuid)payload = {"typeofindicator": "Domain","value": indicator_value,"recordTags" : [ "mytag" ],"description" : ioc_descr,"lastSeen" : lastseen,"firstseen" : firstseen,"expiryDate" : expirydate} payload = {"typeofindicator": {"itemValue" : "Domain","listName": "/api/3/picklist_names/50ee5bfa-e18f-49ba-8af9-dcca25b0f9c0","uuid" : "5a5a7d42-be27-4903-858a-19909ebfa1eb"},"value": indicator_value,"recordTags" : [ "mytag" ],"description" : ioc_descr,"lastSeen" : lastseen,"firstseen" : firstseen,"expiryDa

Hello guys, I'm new here.I have a doubt about default value for hb-lost-threshold, from experience I notice that virtual FortiOS has 20 and physical ones 6, but I don't find any documentation about that difference.I compared the values of some clients that I manage, but I need an official document to support me in making a change recommendation on cluster hosted on Azure. I'm confused because even the Admin and CLI Guide in the same FortiOS version 7.2.5 diverge about the default values, informing 20 and 6, respectively.Admin Guide on page 2346CLI Guide on page 1255Can anyone clarify or have any documentation on this?Roni MatosFCSS - Network Security

Hi   Currently, all interface vlans are on cisco 3750 switch and I want to move all interface vlans to fortigate. I have created all sub-interfaces on fortigate but do not know how to move them all to fortigate. Also what should i do about switches vlan ? All access switches's default gateway is the interface vlan on 3750.

Hello. I'm inquiring because I found something strange while setting up the product.The model is 101f.I test in IDS mode  (license retention) , I used 4 sfp ports and set up 4 spins.But the power (state) LED doesn't turn on. The product UI all works normally!! The version 7.2.6. I tested the LED with HQIP and the LED turns on normally. When it reboots, it turns off again.Is this a bug? Or does it turn off when it's IDS mode operation? This version also has bugs where HA LED doesn't turn on (randomly).Does the LED work differently depending on the license?

Hello to you I want to set my WAN port to be accessible for the firewall management interface, so that I can access the firewall with its external address, but only from a specific external address. How can I do this?I thought using acl but the rule there only says to block and not to open to a specific address Thank you

Hello, what is the best way to search all ADOMs in FortiManager for a particular device e.g. you have a Fortigate's serial number, but no idea of what ADOM it belongs to ?is there any way apart from changing system settings to enable global search ?

FortiToken Mobile Push (ftm-push) is no longer working after updating from Forticlient 7.0.7 to 7.2.  We are in an all Windows 11 22H2 environment.   When connecting to an SSL VPN, the FortiToken Mobile approval request appears on the phone, but after approving the connection from the phone, the client just stays at the “A FortiToken code is required for SSL-VPN login authentication” prompt.   Oddly enough, after approving the request from the phone, if you then click on Cancel to cancel the connection attempt in FortiClient itself, you get a VPN Connection failed message, BUT it then connects successfully right after.   Because the client thinks it failed, after disconnecting from the VPN, it clears the username and password.   Alternatively, instead of using the ftm-push approval you can manually enter the FortiToken code when prompted and all works as normal.   Additionally, the mobile push authentication does work correctly if using the connect to VPN

I have been trying to create a local IPSec VPN connection (no connection through internet) as my previous attempts at getting it to work over the internet have not worked. I wanted to prove first that i can get it working without introducing the complexities of opening up ports on my edge firewall or contacting my ISP to troubleshoot. I configured the VPN to use Internal2 (port 2) as a WAN interface and i have connected an (offline, Windows Firewalls off) Windows machine (A) to this port with FC (FortiClient) installed. Having followed this video FortiGate Remote Access IPsec VPN (youtube.com) to create the IPSec tunnel, I tried to initiate a VPN connection to the Fortigate with no joy. I can ping the IP address i have given to internal2 from the machine A to prove connection. I have checked that both Phase 1 and 2 of the VPN config match on FW (version 7.4.1) and FC agent (version 7.2.2.0864).   I installed Wireshark on machine A and can see the pings appearing in the w

Hello team, anyone help me resolve this issue i have loaded the VM license but it can not be validated  FGVM01TM24000015 # get system statusVersion: FortiFirewall-VM64-KVM v7.2.6,build1575,230926 (GA.F)Security Level: 1Serial-Number: FGVM00UNLICENSEDLicense Status: No LicenseLicense Expiration Date: 2024-03-04VM Resources: 1 CPU/0 allowed, 985 MB RAM/0 MB allowedLog hard disk: Not availableHostname: FGVM01TM24000015Private Encryption: DisableOperation Mode: NATCurrent virtual domain: rootMax number of virtual domains: 10Virtual domains status: 1 in NAT mode, 0 in TP modeVirtual domain configuration: disableFIPS-CC mode: disableCurrent HA mode: standaloneBranch point: 1575Release Version Information: GAFortiOS x86-64: YesSystem time: Wed Jan 3 23:45:17 2024Last reboot reason: power cycle

FortiManager Version: 7.2.4, FortiGate Version: 7.0.13Hello,We encountered issues with FortiManager 7.2.4, so we decided to perform a fresh setup, but unfortunately, the problems persist.The Logs Filter is not functioning correctly, consistently displaying "No logs found." Additionally, we are unable to activate or view logs for the default deny policy.Within the logs, we observed an unknown interface for certain policies. Although template groups are present, there is no visible content. Despite a background loading process, nothing is displayed, and it remains grayed out! What could be the underlying problem?Thanks for helping! 

Hello, I want to change one of the VDOM from Transparent to NAT. I plan to do this step : 1. Login web UI 2. Choose Global Mode 3. Go To System > VDOM 4. Edit VDOM 5. Change Operation Mode from Transparent to NAT Mode 6. Configure IP Address in the VDOM interface   is there anything else that needs to be done ?   Thanks

Hi, Im currently working with a Fortigate, which has 2 ISP's working on and SD-WAN, ports being used are Wan1 and Wan2. The rule I have setup is that Wan1 is prefered over Wan2, Wan1 has better bandwith and Wan2 is used as a backup. I need to have admin access via Wan2 with https (Wan2 works with a private ISP so the public IP is safe from outside intrusion). I have already configured Wan2 with the Admin access with https enabled and have confirmed with a remote user that the connection works, but it only works if Wan1 is down. If Wan1 is up the remote user can still ping the Wan2 address, but is not able to enter the GUI via https. What config could I be missing for this setup to work? Thanks

Dear Community, I need to decommission a FortiGate Cluster from FortiManager and before that, I would like to explore the recovery process when deleting it from Device Manager panel and the Policy Package.  1. is there any feature to backup/export all device settings (including advanced settings like dynamic interface binding) ir order to fast recovery in case of future demand (reinstall the cluster, audit..)?  2.  Related to Policy Package, creating a new ADOM revision is the only and best practice to be used as recovery? or there is any chance to backup/recovery the Policy package related to this cluster only? The goal here is to created secure points/fast recovery related to all settings from Device Manager and Policy Package to this individual Cluster only.We know the FMG backups haven the entire settings for all devices but will take so long to be activated touching config for all devices and also there are considerable impacts during the procedu

Dear All,                 I have a to fulfil the security policy on the fortigate of the following, just wonder what firewall policy i need to create in order to meet below security concern ? any help would be appreicated    Ensure firewall policy denying all traffic to/from Tor, maliciousserver, or scanner IP addresses using ISDB    Rationale:FortiGate includes Tor or malicious server related IP address using ISDB. The idea is tofilter out malicious traffic using firewall policies as first level filtering. This is done withoutinvolving more resource intensive processes such as IPS inspection, hence optimizingFortiGate's performance.Audit:Go to "Policy & Objects".Validate that there is a firewall policy created to block inbound connections fromsources named "Tor-Exit.Node", "Tor-Relay.Node", "Censys-Scanner", "ShodanScanner", and "Malicious-Malicious.Server" on "All" services.Validate that there is a firewall policy c

Hi We have a vip server facing outside of our company. I created a policy and enabled waf with all high severity enabled. When a user from outside submits a form, FGT waf recognizes it as sql injection extended and won't let the user submit the form and webpage crashes after. What should i do?

Hi   I have configured ipsec remote access vpn and I want to allow only IPs from united kingdom to be able to connect to my FGT. how can i do that?

Hello Everyone,   I am looking into how to connect several sites to each other, who all have a primary broadband WAN connection and a 5G backup WAN connection, all with static IPs. Our current site-to-site connections are only configured to use one WAN connection on each end, so when the office broadband connection goes down on occasion, the office has internet access via the 5G but no VPN access because it is configured for the single interface. There seem to be multiple paths i could take here and none of them seem as simple as i thought they would be.    Our network mainly consists of all Fortigate devices. F40s, 60Fs, a 61F, a 71F, and some 81Fs at our two data centers.   Approximately 15 of our sites, including our data centers, LANs are already connected to eachother via L3VPN managed by Windstream, connected to their SDWAN solution, VeloCloud, and routed to eachother via BGP.   The other 15 sites are not on any kind of managed SDWAN solution at this time