Solved

Hi All,    FortiLink was working fine, with a FortiSwitch connected on port A of a 60f. All kit lost power, and now port A is still showing up and green but the FortiLink doesn't and is down.    If I add port B to the FortiLink it momentarily comes back up but then drops again.    Switch is up and working, uplink port is up and connected. I have checked NTP on the FortiLink but not sure what else to do from here pending a reboot etc? Any thoughts?   Thanks, 

Hi, I would like to ask where I can edit the emails that I receive thanks to the Interface status changed notification. The default email is not easy to read. date=2023-12-15 time=05:17:13 devid="XXXXXXXXXXX" devname="Device name" eventtime=1702613832734597809 tz="+0100" logid="0100020099" type="event" subtype="system" level="warning" vd="root" logdesc="Interface status changed" action="interface-stat-change" status="DOWN" msg="Link monitor: Interface internal1 was turned down" Thank you very much.

Hello,I'm trying to get started in FortiAnalyzer # and I'm running into a problem. I have added all the Fortigates that I manage to FortiAnalyzer and now when I look at the logs I only see a column with the Device ID, which is the serial number of the firewalls. However, I don't have all the serial numbers in my head, so I would have liked to have a Device Name column there. I don't see that optioCould someone please advise me?

Hi everybody,After upgrading our #FortiNAC and #Fortinac Manager fro 9.2 to 9.4 I'm not able to access some configuration such as guest and contractors and portal configuratioThe users and their privileges are the same, with the 9.2 version I was able to everything (admin profile) but after the upgrade I cannot.I created also a new user with all the privileges but when I try to access to the guest and contractor section i have the following message: You do not have the permission to access this page.How can I fix this issue??? Thaks Fabio

Hi I want give my users internet based on their AD credential. In firewall policy if i select users or users group i should choose a address or something else. If i choose all+user group is that going to give internet only to specified users or all of them?

I have been asked to explore captive portal as an option for guests wireless, I see in the docs its OPEN (ie no encryption) for the initial connection. Does it ever flip to an encrypted channel post validation?

I have a question regarding auto-negotiate and keepalive as it relates to the IPSEC configuration. I understand the functionality from reading the following article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-the-IPSec-auto-negotiate-and-keepalive/ta-p/189536. My question is fairly simple but have not been able to find a definitive answer. Do these settings get applied to both Fortigate appliances or only on one side? My end goal is to have the tunnels always up unless the circuit is down on either side.   

Hi,If i create a policy from wan to lan with security profiles enabled, is that going to protect the inbound traffic to my lan? And also do i need to enable nat for this traffic direction?

Hi, My 200F FGT does not have hard disk. So which software is best to have logs with a great user friendly interface? Free or paid ones.

Hi How can i block internet access when remote users connect to fgt with foriclient vpn app?

Dear All,                i have a question on SD WAN redundancy , if i'm gong to use SD Wan rule & performance SLA for redundancy, below are the setting i did, just wonder base on which setting to determine the failover and priorities which circuit to use first ? for instance if wan1 down it will failover to wan2, and if wan1 resume, it will failover back to wan1, and how do i set if i want use load balancing and where to determine the % to use on which circuit ? any help would be appreicated   SD Wan rule Interface selection strategyManualManually assign outgoing interfaces.Best qualityThe interface with the best measured performance is selected.Lowest cost (SLA)The interface that meets SLA targets is selected. When there is a tie, the interface with the lowest assigned cost is selected.Interface preferenceWAN1 (port1)WAN2 (port2)Zone preferenceMeasured SLADefault_Google SearchRequired SLA targetQuality criteria

Hi, Have an Issue with an IPSec Site-to-Site between set of Fortigate units:1 x 200E behind a public IP / LAN 10.184.0.0/161 x 60F behind a dynamic, natted IP. / LAN 10.151.0.0/16I'm running 7.0.2 I've established the tunnel, using dial-in from the 60F, all easy enough.Problem is that it seems no traffic is exiting the 200E, over the tunnel (outgoing data remains at 0).In the other direction It seems to work fine (so from 60F to 200E) I've checked policies, and done some packet sniffing, and all the policies are fine, the packets enter the tunnel, I can see this in a sniff capture as well as in the counters of the policies. However, when I sniff on the WAN port, no outgoing data whatsoever. It seems like the data is entering the tunnel but not encapsulated on the WAN port? This is the Sniffer on the Tunnel IF. MeetMe-FGT200E # diagnose sniffer packet VPN-TO-Koreainterfaces=[VPN-TO-Korea]filters=[none]pcap_lookupnet: VPN-TO-Korea: no IPv4 address assigned4.93274

Hi all, I am planning to conduct feasibility check on Fortigate 200F with Okta authentication for SSL VPN. So I need some clarification on configurations changes and impact to productions environment. Here are my questions: -Is it possible to integrate with Okta using specific VDOM only? does it affect global config?Is there any impacts if t testing on VDOM in production environment?Any guidance or steps that I can refer?Is it possible to test integration with Okta developer account?  Thanks,

Hello all, We are in discussion with a customer that likes to host the FortiSIEM on prem but considers moving to our multi-tenant-cloud-environment some day in future.As we are just setting up the SIEM, I would like to build the environment in a way that this migration might be possible. Most interesting thing would be the eventdb for me here (as the parsers, reports, etc. might just be ex- and imported). Has anyone done a similar thing before? Moving the eventdb to another (already running) FortiSIEM? The target system is on ClickHouse. The on-prem system can be anything as we have not set it up yet: Local, NFS, ClickHouse; we can also set it up as enterprise oder service provider mode.It would also be enough to just have the eventdb in archive-format for the transfer, since it's all just about "keeping logs for 365 days". Thanks already for any kind of input :)Best,Christian

Hi, I am looking to go for the FCP Network Security Certification. However it says the core exam is NSE 4 FortiOS but I don't see that on the website anywhere. When I look at the training material it's all in sections like FortiGate Administrator, FortiAuthenticator Administrator etc. Do I have to do all of it to prepare for the exam or only things that mention FortiGate? I am a little confused. Thanks

hi,is it possible to configure continously using CLI instead of type 'end' in each configuration section.for example, after i've configured mgmt ip i can go straight to 'config router static' and type 'end' after the mgmt and static default route are configured? or will the system reject it? edit - i just tried and indeed rejected the command when i go straight to 'config router static'is there a way to type commands continuously or is it required typing 'end' each config section? FG# config system interfaceFG(interface) # edit mgmtFG(mgmt) # set ip 192.168.200.202/24FG(mgmt) # set allowaccess ping ssh httpsFG(mgmt) # end   <<< CAN I SKIP THIS?FG # config router staticFG(static) # edit 99new entry '99' addedFG(99) # set dst 0.0.0.0/0FG(99) # set gateway 192.168.200.1FG(99) # set device mgmtFG(99) # end ----- FG(mgmt) # set allowaccess ping ssh httpsFG(mgmt) # config router staticcommand parse error before 'router'Command fail. Return code 1

Hello, it looks like I am doing something wrong and I was not able to find my answer on the internet, so please if someone could enlighten me :)I have web server, behind nat. Rule set like this:incoming: wanOutgoing: lansource: alldestination: virtual IP of the serverservice: httpssecurity profiles: ips high security (modified to quarantine most threats)    ssl inspection: specific "protecting ssl server" profile From time to time when there is IPS attack blocked, the IPS puts into quarantine the internal IP of the web server (ie. 192.168.x.x , it is visible in quarantine monitor and can be removed there manually). See below ips log - i suppose the "source" should be blocked, and not "destination" :( Do you please know what am I doing wrong?Thank youRegardsMartin

Hello, I have a Fortigate 401F that I currently have access to via the mgmt interface. This interface is connected to one of my core switches (catalyst 9300) via cat6 and I can reach it at 10.Y.X.115/25. The Fortigate and my switches are all in the same subnet 10.Y.X.0/25I can ping the Fortigate from every switch in my network, so I know that all the switches can reach the fortigate. My question comes into play because I am attempting to use the x3 interface (with an SFP transceiver from Fortinet) to connect to one of my switches (for example, SW-30). I have fiber run from SW-30 to the MDF in my primary server room, and when I plug in my NetScout, the interface on SW-30 comes up.When I insert the fiber into x3 on the Fortigate, the interface on SW-30 goes down, and x3 continues to stay down.At first I thought this was because x3 does not have an IP assigned to it, but when I attempt to put it on 10.Y.X.31 /25 it says I can have it on the same subnet as mgmt.I will admit I am

date=2023-12-13 9 time=11:56:25 devname=FGT200xxxxxxxxx=FG200xxxxxxxxx eventtime=1885229385635990681 tz="+0100" logid="0122032002" type="event" subtype="system" level="alert" vd="root" logdesc="Admin login failed" sn="0" user="admin" ui="https(89.248.192.55)" method="https" srcip=xxx.xxx.xxx.xxx. dstip=xxx.xxx.xxx.xxx action="login" status="failed" reason="passwd_invalid" msg="Administrator admin login failed from https(xxx.xxx.xxx.xxx) because of invalid password"     How can i block that IP on FORTIGATE?

Hi community,   I have a problem regarding authentication via TACACS+ on FGT units (FGT40F).I have two WAN interfaces, but their're no members of a SD-WAN.   If the primary interface goes down, the login via TACACS+ is not possible anymore.Also I configured the same lines on the secondary one. Here is the entire TACACS configuration:   config user tacacs+edit "RAGTAC1"set server <ip of primary server>set secondary-server <ip of secondary server>set key ENC vnm4VKB0FI5aNL1cBxRAngfqZtn75GS2aLWuFn7Va7KhhK0avUJGMG/JHVRyy+AGFKKvJ7xbAuDmM4+V6m4iTv76iUGgMssbNKpcBq+BLcluknE61I5r6emPmIwu6J04hP+qWiglAlc/QlA==set secondary-key ENC xBDZhp1GT9MnrQpkBHe342XbjGcb/YLoMHuXP5PmK7ALnDEvUmYcsEGy+4BJmJZdDKRX56sJWXzIbVmYEPwekPgXWlECqGWkPnMnoVyanbFrsoZG1xE0w==set authen-type asciiset authorization enableset interface-select-method specifyset interface "wan"nextedit "RAGTAC2"set server <ip of primary server>set secondary-server <ip of secondary server>set key ENC fI8pEqi

I recently acquired a Fortigate 80F firewall appliance and have been working on configuring the Librenms system to retrieve certain metrics from the 80F. I have successfully set up the SNMP protocol and can view most of the interfaces on the Librenms dashboard, but unfortunately, the WAN2 and only WAN2 interface is not appearing. The firmware version I am using is v7.2.6 build1575. here is the screenshot from librenms I would greatly appreciate any guidance on resolving this issue. Thank you!

Hello to all,I would like to secure a bit more our traffic from Clients to internal Servers.What are your recommendations with applying security profiles between clients and servers.We have restricted only certain ports etc but would like to implement Security Profiles as well.Can't seem to find something on these topics.Also topics for security profiles differences for clients and for servers specficily for outside access to internet

Dear All,          Would like to ask if i have dual internet circuits and want to enabled link redundancy and no load-sharing, and i have followed below guide and seem work as expected, but i have one question, if wan1 down, and its will failover to wan2, and if wan1 resumed, will it be able to failover back to wan1 itself ? would it be possible to achieve that ? https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/360563/dual-internet-connections#Security Piaakit 

Hi everyone,I want to create a geo-cluster.two of the FortiGate are in one location and another FortiGate is in a different location.do I need to create a specific VLAN for the ha traffic? and if I do need it, which subnet should I choose for this vlan?Thank you

Hello community,Since 2 week I  update Forticlient from version 7.2.1 to 7.2.2 but using the package with Intune all new installed computer ask Key for telemtry, and because I have a lot of computer I can do one by one, is there any way to insert Telemtry key using command line ? then I can write a script can be used with Intune for all installed machine. thanks a lot thanks