Solved

Hello,Could you please help me if there is any possibility to copy the complete settings of one ADOM in FortiManager to a newly created ADOM? Thank you very much.

Hello guys, I played a bit around with the Split-Task VDOM Option on a new Fortigate we received. However I just read the following in another forum post: "Just a side note, not an answer to your questions, the Split Task mode was discontinued in the FortiOS 7.2, and will no longer be available"Does anyone know if this is true? Will the Split-Task VDOM Option be no longer available with 7.2?Thanks!

Why can I not see the interface config in the show or show full-configuration CLI outputs? There seems to be a relationship between the following 2 command formats:show <<pathway>>config <<pathway>>So for instanceconfig vpn ipsec phase1-interfaceshow vpn ipsec phase1-interfaceThe <<pathway>> paragraph can also (usually?/Always?) be found in the show  and/or show full-configuration CLI output.  This relationship holds for the <<system interface>> pathway but this configu is missing from from the show and show full-configuration.I am speaking of the production VDOM in this case (FG-traffic) as you can see below) but I have checked the root VDOM as well. Nothing.What am I missing?

Hello all! I'm trying to delete a Fortigate device from FortiAnalyzer in the GUI but it results in an error message: "deldeverror". Have anybody any idea why I can delete the device?  

Hi i followed this docs https://docs.fortinet.com/document/fortigate/7.0.11/administration-guide/556915/installing-firmware-from-system-reboot to installing firmware from system rebootbut it doesn't show step 10. and show Fatal error: Loading FOS fails!i'm sure the firmware was upload success from tftp serverand the firmware filename is FGT_100F-v7.0.11.M-build0489-FORTINET.out also i tried this https://community.fortinet.com/t5/FortiGate/Technical-Tip-Installing-firmware-from-system-reboot/ta-p/190793 but it doesn't have "G" optionPlease help me.

I assume that the layer3 interface is tagged with vlan 1? What happens if I put an access vlan on a another switch port that is connected to this firewall port?

Hi,If I wanted to return to NAT mode after configure the Fortigate in transparent mode with firewall policies, security policies, etc.. What are the steps?Obviously remove the commands of transparent mode and assign ip addresses on interfaces. Other things? Thanks

Hi,   I ma trying to allow inter-vlan communication in firewall policy and wrote this policy. is that correct?     config firewall policy edit 6 set status enable set name "Vlan--->Vlan" set uuid 19f0b5c8-93f3-51ee-dc48-59756c056159 set srcintf "Vlan3" "Vlan20" "Vlan30" "Vlan40" "Vlan50" "Vlan60" "Vlan70" "Vlan90" "Vlan100" "Vlan101" "Vlan110" "Vlan172" set dstintf "Vlan3" "Vlan20" "Vlan30" "Vlan40" "Vlan50" "Vlan60" "Vlan70" "Vlan90" "Vlan100" "Vlan101" "Vlan110" "Vlan172" set action accept set nat64 disable set nat46 disable set ztna-status disable set srcaddr "Vlan100 address" "Vlan101 address" "Vlan110 address" "Vlan172 address" "Vlan20 address" "Vlan3 address" "Vlan30 address" "Vlan40 address" "Vlan50 address" "Vlan60 address" "Vlan70 address" "Vlan90 address" set dstaddr "Vlan100 address" "Vlan101 address" "Vlan110 address" "Vlan172 address" "Vlan20 address" "Vlan3 addres

Hello   i want to know   what are the steps to configure reverse-proxy in fortigate ?   i wait a reply from expert fortigate   Thanks     

Hello Expert,   I have to two fortigate 400e in HA setup, but I am unable to connect to standby one when I use the Management port on the device, How can I log into the device when it is standby mode?.   Thank you   Regards

I know this in an unsupported configuration, but I have a bunch of old firewalls that are running 6.4 firmware and no matter how hard I push, I haven't been permitted to upgrade them.  We will be swapping out hardware soon to new firewalls but that is going to be a slow process.  I have a FortiManager running 7.2.2 and have tried to add FortiGates running 7.2.6 firmware, but they fail every time.  I wanted to upgrade the FortiManager to 7.4.1 but wanted to leave the 6.4 ADOM in place.  We don't use FortiManager like we should, we are using it like a backup solution and importing the policy packages from each of the old firewalls.  The new ones we are rolling out will be managed by the FortiManager, but I need to still backup the old firewall configs.  If I upgrade FortiManager to 7.4.1, can I still run imports on a 6.4 ADOM?

Hello to all, I need a little help with configuration of captive portal for our SSID for guest.I already created everything, user, add it to group, create SSID with captive portal, create policy for network access and it's working perfectly.Now the only problem is that I can't find a way to set and test authetication timeout.It only asks for authetication on the first login with the new device, even if I configure set auth-timeout 2 (2 minutes for testing only) and it is still logged in and have access to network. Also when I forget the network and connect again it doesnt ask me for authetication and don't display Captive Portal.Any help is welcomed :)

We would like to be able to better identify users with our Fortigate, when we view FortiView, rather than just getting IP addresses to hunt down. Sometimes, the device name is shown, but not always and often I have to hit "Sources" under FortiView a second time for that to happen.  If Fortigate can't do that , on it's own, is there another product or plug-in that would facilitate this ?  

Hi guys, In fortisiem, some of the log sources are sent to supervisor and some to collector. Is there any way to see this on the GUI other than getting a dump?

HiI have all my interface vlans on my 200f port1 and I am looking for a way to config mgmt port to connect to fortigate. What should i do?

Hello all,Can Fortigate syslog receive routing or VPN "configuration change" notifications?I know that syslog can receive status change notifications, and change notifications can be sent via email alerts, but I don't know if syslog can receive them.I've checked, and I don't seem to have seen any instructions for this.

We need to access our server via VPN and internal Network only, no need to access an external network, Please suggest the following steps to access our server port.  

Hi Everyone, Our company is running FortiEDR and FortiClient.  FortiEDR detected AsyncRAT and WGZ!tr on one of the workstations.   In FortiEDR, the device was moved to the High-Security Collector Group with the protection enabled. However, the vulnerability scan using FortiClient Endpoint did not detect the AsycRAT and WGZ!tr.   What can cause these inconsistencies and how do we resolve this?   Thanks for your responses.

Hello to all,I would like to know you're best practices and approaches on configuring Firewall Policies to be as restricted as possible.I want to restrict access as much as I can.Examples would be to allow only certain Services for certain Servers (for DNS servers only port 53 etc), For Pirnters only SMB and so on.From Clients to Servers also only needed services for specific Servers (AD, Print Servers, File Servers)IT to have adminsitration rights for all serversRestricted for others that don't need anything else that servicesI think you get the point what I want to achieve.We already have something like that for  our branch office, but I want to see if there are some better recommendations.And also I don't have zoning concept. Don't know if granular restrictions can be a lot of work with zoning since I'm going to have few VLANs etc. This is an example of our branch office: Like this our Firewall Rules are getting larger and more difficult to manage.over 100 rulesBest R

Hi youI cannot access some websites using Chrome browser, but other browsers like EDGE or Firefox are normal.I Determined the cause was due to the Web filter and created a ticket for the Fortinet but it has not been resolved. Can anyone help me fix this error? Chrome reports an error ERR_TIMED_OUT

Hi, I have created a schedule as follows and assigned it to a policy but after time reaches to 06:00 PM the policy do not disable. config firewall schedule recurring edit "DNat Schedule" set start 08:00 set end 18:00 set day sunday monday tuesday wednesday thursday friday saturday set color 6 set fabric-object disable next end 

I followed these steps to import a CA certificate and key for decryption:   https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-import-the-CA-certificate-for-full-SSL/ta-p/189786   The certificate now shows up in Local CA certificates. However, in FortiManager > Policy & Objects, I do not see this certificate as available in the SSL Inspection profile.    How can I use this certificate for SSL decryption when configuring from FortiManager?   If I try to do it locally on the firewall, the CA certificate is available in the profile, just not in FortiManager.   Thanks,

Hello,  I get a remote server certificate validation error when connecting to our VPN provider. I checked their certificate with https://www.sslshopper.com/ssl-checker.html#hostname=healthconnect.vpn.cloudgateway.co.uk, and it seems to be valid and issued by the GoDaddy I linked Ubuntu's certificate storage as suggested in https://community.fortinet.com/t5/FortiClient/Technical-Note-Certificate-warning-when-connecting-to-SSLVPN/ta-p/197402 but to no luck, as you can see on the screenshot below.   This is with #forticlient vpn 7.2.2.0753 on Ubuntu 22.04 Any tips are appreciated!  

Hi, I have created a SD-WAN and put 2 WAN links as members in SD-WAN Zone. I want to have Dnat some of my servers and created a virtual IP pointing from Valid IP address of WAN1 to my internal server. Then I went to firewall policy and created a policy to allow Dnat, but when I want to select WAN1 port as incoming interface, it does not show the wan1 port and only shows the SD-WAN port instead. I should mention that I want to Dnat from valid IPs from my WAN1 to internal servers. what is the problem? Thanks.

hi,just wondering if i can delete the "lan" hardware switch in a fortigate 40F?can't seem to delete it even when it's disabled.i'm trying to do this setup:WAN: internet/ISPA: HAport 1: MGMT (out of band)port 2 and 3: 802.3AD aggregate/Port-Channel to switch the port-channel interface (ports 2 and 3) will be my "inside" interface with a private layer 3 IP.is this scenario possible? appreciate your advise.