Solved

I have spare equipment that is not licensed, but I need to exchange it for one that is in production and licensed.  I saw that the rehost is normally done through RMA, but my production equipment is not having a problem, this exchange needs to be carried out due to the client's particular needs.  Is there possible to perform this rehost via the customer's Admin Portal? Or through some Portal that the customer has control over and is not dependent on having to open a case with Fortinet Support? Thanks. Best Regards.

HiWe want to allow allow anydesk for it department but in ssl logs i see that anydesk ssl is resign and untrusted. I exempted anydesk domain in deep ssl inspection but did not solve the problem. What can i do to solve this problem?

Hello guys, I'm a newbie in IT field.I'm currently trying to setup policy on a FortiGate100E to block the use of Line PC client.>>FortiOS v7.2.4 build1396(Feature)Now I successfully block Line usage, but regarding the subject, I want to know if it's possiable to block file transmission on Line PC client without affecting text and voice messages.I've tried to dissecting packets and setting app signatures, but can't made any progress. Thanks for any reply and possible assistance.

Hi What is the best practise to create a policy from wan to lan?

I would like to connect directly from the SSL-VPN segment to the spokes segment.This is network layout.[PC]--<Internet SSLVPN>----[FGT60E@HUB]----<IPsecVPN>----[FGT60E@SPOKE1]----[LAN@SPOKE1]                                                                  |                                                                  |                                                                  |                            &nb

I've made a change in our LDAP configuration by moving all users with current tokens to a new group CN=FW_VPN_Client_Users. I plan to manage VPN access by adding users to this group as needed. Before I proceed further, I have a question regarding the 'Set Group Filter' option in our Fortinet setup: If I adjust the group filter settings now, will it impact users who are currently logged into the VPN with valid tokens? In other words, will changing the filter settings disconnect or otherwise affect these active users? I'm looking to understand whether these changes will apply only to new authentication requests or also to users who are already authenticated and actively using the VPN. Any insights or experiences you can share would be greatly appreciated!

Hi all, I have a new FAC and I have changed the admin local user password. Now, I can connect in CLI but when I want to connect in GUI with the admin local user, I have an error. The error is:  please enter correct credentials. note that password is case-sensitive.   I have changed the password with the admin-maintainer and change the password: I can connect in CLI with the new password but in GUI it's the same error. I have tried to restart the webserver with this command: Diagnose web restart, but it's also the same.   How can I resolve that?

Dear everyone.I have configured my network to use Ipv6 as detail below, it work ok, this configure allow client pc connected to LAN interface can connect to internet using ipv6 OK with ipv6 from DHCP6 server.But the problem is if the pppoe is reconnect, IPv6 Address/Prefix on LAN interface will changed because it is delegated to WAN1 and the ISP provide dynamic IPThe DHCPv6 will assign a new ipv6 to computer network, now the computer may contain multiple ip address, the previous IP and the new ip. But after this, the PC cannot connected to internet using ipv6, i have to disable the network interface and enable again or reconnect to wifi network to make the PC work with new Ipv6I think that there are sth wrong or miss in my configuration, so pls kindly helpThanksconfig system interfaceedit "wan1"set vdom "root"set mode pppoeset allowaccess ping https http fgfmset type physicalset explicit-web-proxy enableset role wanset snmp-index 1config ipv6set ip6-mode pppoeset ip6-allowaccess ping h

I am looking for Fortigate firewall buyers guide, most specifically UTM, Enterprise, Advanced Threat Protection vs  manual selection of services. Is there URL / PDF for buyers guide?

What happens if it is a "normal" firewall rule without any filtering applied?

Hi All, I have issue with web filter, I blocked shopping category and I tried to add an exception for a specific web site, so I added this link to URL filter to allow this traffic, the site already opened but unable to load any content in this site like photos, to solve this issue I must allow entire category which is not what I need to do. .  

Hi   I encountered a wired situation. When I enable web filter and dns filter in a policy, the dns servers on fortigate become unreachable or with high ping times and fortigate won't update at specified time. when i disable those security profiles the dns will have normal ping time. How can i solve this issue? I have tested with so many dns servers.

Hi I am really confused about flow based and proxy based on firewall policy. When should i use either of these? Fkr example i have 7 servet facing on internet and i configured antivirus,ips and i want to config WAF too but it requires to use proxy based but all other security profiles configured in flow based mode. What should i do?

HiI want to enable ddns in fortigate but i can not select any servers in server list. How can i config ddns?

Hi, As a part of PoC work for one of our projects, we are evaluating FGCP HA. Currently, we are trying to setup HA on ESXi servers with evaluation licenses for FortiGate servers. But the setup for FGSP HA did not work, even though we have two different serial numbers for both FG and FW. I also enabled promiscuous mode on Vswitch, but it didn't work. Could anyone please confirm if HA will work on the VM evaluation version? Regards,Thoubik Ahamed P.

Hello everyone,I have a question about Fortigate IPS.Could you please provide information on the potential actions that can be implemented upon a signature match?It would be helpful if you could include explanations for each action (what thatb mean success / failure).Any documentation or explanations you can share would be greatly appreciated.Best rtegards,

I thought I would configure failover - LTE at home.I made a sdan, configured the gateways, static routings, politics, etc. The internet is working, but I am not happy with Failover. Why?E.g. During working on a company laptop (company VPN)I want to do a test. On FGT, I'm turnning off the WAN1(primary) interface and then Forti is switching to WAN2(backup). After about 30 seconds, I revert to WAN1 (so that the FGT will come back to the main ISP) and im seeing in Dashboard and logs that the part of the sessions continues to fly around Wan2 (LTE). To completely cut those sessions, I have to turn off the WAN2 interface, then business laptop breaks the connection and after 3 seconds its reconnection again, but already with WAN1 - and that's what it should be, but why does it not work automaticly?I don't know why Forti continues to maintain the sessions of the company laptop on a spare WAN2 - can it be because its VPN traffic?

Hi everyone,   I have a Fortigate 30E and zyxel GS1900 switch in my office. We have two VLANs and the routing is 'Router on a Stick' mode. Recently we found the inter-VLAN is slower than speed inside the same VLAN. Here are our test results using iPerf3 (using NAS as the iPerf server to do speed test)   From PC in VLAN3 to NAS in VLAN3: 950M From PC in VLAN1(wired) to NAS in VLAN3: 550M From PC in VLAN1(WiFi) to NAS in VLAN3: 350M We are wondering it is a routing problem.   Could you please advise what we can do to improve the inter-VLAN connection speed? Thank you.

Dear Team, I would like to know whether there's a report to show me the login status(Success/Failure) of the VPN User via FortiGate. If FortiSIEM has any Default Report Template can meet this. Or I can clone an existing report and then modify it to meet the above description.  Thank you ~ 

As above. The remote site VPN GW has 2 ip addresses. SO how do I configure it? 

Hi,I started having issue recently with FortiClient (Windows) from versions 7.0.7 to v 7.2.1.0779.All my FortiClient are connected to Licensed EMS server (on-prem) and SAML enabled with Azure IdP for VPN login.SSL VPN fails at 70% or sometimes at 98% with the error: Unable to establish the VPN connection. The VPN server may be unreachable. (-6007)I have reinstalled different client versions but still same error. Some community posts suggest internet issues but i don't think it is. On the same network, FortiClient v7.2.0.0101 (Android) SSL VPN works with SAML enabled and Windows Add vpn option with FortiClient as provider works well too (Ofcourse no SAML for this)I have checked logs in Fortinet folder and see following errors under:FortiVPN_1[2023-08-15 13:07:54.7483807] [14204:14208] [FortiVPN 1811 info] fortivpn::StateMachine::HandleTunnelDisconnected disconnection reason: 12, ("Failed Unknown")sslvpndaemon_1[2023-08-15 13:15:06.5364715] [13644:5388] [sslvpndaemon 1186 info]

Hi All,   Anyone have experience or know how to configure LDAP connection with FQDN instead of IP address? The FQDN here are mapping to 5 LDAP servers IP (binded by F5 GTM). When I configured with FQDN the connection to LDAP is unstable because every I ping the FQDN it was resolved to different IP randomly.    I know if it possible to use more than one IP on LDAP setting, but we have to use FQDN to connect LDAP server. Example: ldap FQDN: my.ldapserver.com and this domain contain IP 10.20.30.10, 10.20.30.11, 10.20.30.13, 10.20.30.14 .10.20.30.15 for backup IP. Appreciate for the help.     #Fortigate #fortiproxy

Dear All,           I have 2 x fortigate 201F with HA, port 23 & 24 were connected to each other for HA, may i ask for monitor interfaces which interface i should be added for this ? does it means if i added a interface for example port3, if this port3 were disconnected, the whole devices will be failover to the secondary device ? any help would be appreicated     piaakit  

Hello, I recently upgraded a customers FAZ-200F from version 6.4.9 to version 7.0.10 and now none of the FortiGates will connect. All of the FortiGates are on version 7.0.12 which looks to be supported by FAZ on 7.0.10 per the matrix. The FAZ had support expire on it so I cannot contact support at the moment unfortunately which is why I am coming here. When I run log fortianalyzer test-connectivity on the FortiGate I get 'Failed to get FAZ's status. Invalid error number (0).(0)' which looks like it's pointing to a certificate error. I verified the FGTs and FAZ have matching certificates. I tried importing the local FAZ cert onto a FGT with no luck. When I run 'diagnose debug app oftpd 255' on the FAZ I get the following output:2023-12-19 13:43:57 [OFTP_SSL_CTX_dft:1237 10.112.15.50] dft-idx=0 inited=1.2023-12-19 13:43:57 [__create_ssl_context:1663 10.112.15.50] SSL socket[72] pid[29164] ssl[0x18427b0] SSL_new() success.2023-12-19 13:43:57 [__SSL_info_callback:2

Dear Colleagues, I'm currently implementing ZTNA as a VPN replacement. I added some ZTNA Servers and Policies for them and from the outside its working quite well. But if I'm in the office, I'm facing some issues, especially with resources connected via vpn-tunnels. I'm using a nat-pool (set pool-name) to translate to an internal IP which is routed over the tunnel (BGP). But while it is working from outside, it is not from internal network. I did a "debug sniffer packet ..." and it looks like the forti is sending the packets to the wan interface and not through the vpn tunnel. What am I missing? thanks in advance best stephan