Solved

Hi,I have a very strange problem with Forticlient when I use it from MacOS (Sonoma). It was ok earlier (with Ventura) but because I tried to debug some another strange IPSec VPN issue, I had to uninstall it (using the official method) and install an older version. Since then when I press connect button for my SSL VPN it seems Forticlient is freezes (stuck in connecting phase) and the disconnect button also not working, so I have to shutdown Forticlient.... Unfortunately due to Fortinet strange policy, support can't help (forticlient-vpn is not covered by support contract), so all my hope is in this community :) Have you ever seen something like this? Any suggestion to fix? ThanksL: 

I want to record all the searches that employees do in search engines like Google or Yahoo, etc. In web filter I have the proxy option and in search engines I have Log all search keywords enabled but it doesn't work, do I have to enable or disable something else somewhere else or should that work? What should I check? Thank you

hi everyone I have a problem firewall down and led port Lan slow blink, Fortios 7.2.2 .I check even log find last log  date=2023-11-15 time=00:01:00 eventtime=1699981260853228885 tz="+0700" logid="0100020025" type="event" subtype="system" level="notice" vd="root" logdesc="Report generated successfully" msg="Report generation succeeded for layout:default." file="/var/log/log/root/report/generated/Schedule-default-2023-11-15-000100/default.pdf" filesize=422522 datarange="14-Nov-2023 00:00 To 14-Nov-2023 23:59" reporttype="Scheduled" processtime=0date=2023-11-15 time=00:01:00 eventtime=1699981260853198775 tz="+0700" logid="0100032040" type="event" subtype="system" level="information" vd="root" logdesc="Report deleted" action="delete" msg="System deleted 1 oldest reports"date=2023-11-15 time=00:00:00 eventtime=1699981200050441536 tz="+0700" logid="0100032011" type="event" subtype="system" level="notice" vd="root" logdesc="Disk log rolled" action="roll-log" reason="file-

Hi everyone, Have anyone got any clue on how to validate that the configure ISL is working fine for FortiSwitch & Fortigate?Thanks in advance.

hi,on FortiGate 60D, I want allow web filter from URL filter.but I try for setting and is not working? is still blocking! may know do have sample or how to solve it? thanks.

How to check if a particular website is blocked by fortigate AV or web filter?Perhaps I can enter the url into the firewall and check?Or is there an external website where i can check?Or do I have to do it from the local network?Assume that default settings of av and web filter are applied.  

Hi all,Hope you can give me a hand with this.I have a fortigate 90D. But untortunately I can not get renewal because is out of date.So I purchased a fortigate 80F.Here comes the question: can I export the configuration I had on the 90D to the new one (80F)?.I downloaded a conf file. Thanks and best regards, 

Hi All,  We realised that the connector was upgraded but an older version is required for compatibility. Had a look at the sites FortiSOAR Content Hub (fortinet.com) and Fortinet - FortiSOAR Integrations · GitHub to find the connector to download and therefore upload into the SOAR. How do I find an older version of the FortiSIEM connector? Thanks in advance,Craig

Hello good morning. Please, I wanted to ask the following question. I have a router connected to port 5 on my Fortigate in the following IP range: 192.168.30.100/24. On the other hand, I have on port 3 (configured as an interface) an output to a switch in the range 192.168.1.0/24. I am trying to communicate each subnet with the other by establishing a firewall policy that has port 3 as output and port 5 as input, but I cannot access it. What am I doing wrong? Thank you.

We have two old devices: Fortigate 111C and FortiAnalyzer 100B. They are currently offline (as they have been replaced by other models). We are going to try sell them via auction (being a public organization we have such rules). But we need to safely remove our data and yet have it still usable, so it is worth a purchase for someone. I have read about Factory reset command, but i'm not sure it will wipe all the data. Is it only resetting a configuration? Should i still wipe the logs and other stuff somehow? I have also read in the forums about running format on FortiAnalyzer to get rid of logs, but won't it render the device unusable after that? With personal computers we are just wiping out HDDs securely as installing OS is a trivial task. Probably not so trivial with Fortigate. Or is it possible to completely wipe its memory and then install fresh FortiOS?

I am seeing some strange ARP requests from our Fortigate using Wireshark. I'm not sure the best way to describe it. It's as if the Fortigate has a cooldown of 1 second in between ARP requests. So when a device doesn't respond, it keeps sending requests exactly every 1 second. The IPs that it's trying to contact appear to be random DHCP devices that joined the network and then left. The IPs that it's trying to contact do change some over time. It's like it has a list of the last 10 devices that it can't find and just keeps repeating those until other devices leave the network. I've checked the ARP table on the Fortigate while it's sending these ARP requests and the IPs it's sending the requests to are not in the ARP table. It's not a network loop. No other devices are showing this kind of behavior. The amount of traffic generated by this isn't causing network disruptions, but I don't want the Fortigate to be this noisy. Any thoughts?  

Hi all!Maybe a simple question, but I don't see it: Why is the traffic to Cloudflare-Web implicitly denied while the traffic to Xbox is allowed?   Both connections use port 443...Policy 44: config firewall policyedit 44set srcintf "Name1"set dstintf "wan1"set action acceptset srcaddr "Name1 address"set dstaddr "all"set schedule "always"set service "HTTPS" "HTTP"set utm-status enableset ssl-ssh-profile "deep-inspection"set av-profile "default"set webfilter-profile "block some & monitor-all"set dnsfilter-profile "default"set ips-sensor "high_security"set application-list "block-high-risk"set logtraffic allset nat enablenextend  I guess, that it has something to do with the item "Action" and "Security" below:  What engine performs this deny? Why is the security log empty? Thanks for your help! Oliver 

Generally from a given vdom it is possible to issue the following to get the config including ALL DEFAULT settings:show full-configurationI know also that I can get what I would understand to be NON DEFAULT settings for given sections of the config from commands such as the following (this is by no means of course an exhaustive list):show system interfaceshow vpn ipsec phase1-interfaceshow vpn ipsec phase2-interfaceshow router bgpEtcMy question is there a command equivalent to show full-configuration above that will give just the NON DEFAULT settings i.e. all that has changed since the last factory-reset?Hope this makes senseThanks

Hi All ,  As a new guy on Fortigate appliances, I need your help. I have a customer with internal AD DNS servers. All endpoints are configured to use the AD DNS servers.   The issue that I'm facing is that in Fortiview, I can only see the IP Address of the endpoints I'm wondering how to setup the fortigate to get the FQDNs of those IP addresses from the internal AD DNS. ThanksPadelis  

Hi team,   I am developing some playbooks, which then will be useful when showing the solution to potential customers.   Firstlly I´ve created a playbook that calls https://icanhazdadjoke.com/api (RestFull API) and then shows the result joke to the customer.    Now, I am trying to modify the playbook to call the above API call X times (the variable X is configured inside the playbook). For each execution the API call returns a string (the joke). So, my purpose in this second test is to present to the cusromer X jokes together, like the following: "joke 1"+"\n"+joke 2"+"\n"+....+joke X"   The two playbooks are similar. The first one calls the API call just once.  The second playbook call the API many times (variable X) and return the outputs together (append or join could be used).   Could you help me on how to create loops (like the "for" or while commands in C), execute a code inside the loop and then show the results? Is there any example

Hello, I am new to the community but I really like Fortinet, could you please help me, I have 2 Fortiswitches, a 424E and a 448E, I would like to create an aggregation port to increase the bandwidth, I know I can do it with LAGBut I would like to understand the LACP mode, if what I want is an aggregation interface, which mode should I use? Static, active or passive?I tried static mode on both sides and the interfaces do not go up.The manual indicates Active on one side and Passive on the other side, but I would like to understand why? or better understand the modes of LACP.

Hi All,  Having some issues building SD-WAN in Eve-NG, or at least I think it's built correctly but traffic isn't routing, is anyone aware if there is an issue with Forti, SD-WAN and Eve? I can see hit counts in the SD-WAN rules section, but I'm getting a timeout on pings from my VPC. Pictures of the build below: - Thanks, Rich 

I have a problem getting a WAN connection through VIP to a virtual server (with Roundrobin).The virtual server works internally.If I point the VIP to one of the servers in the Virtual server it works.The policy for the Virtual server also includes the wan interface as the source. Could it be a flow/proxy base thing? 

Hi,I have a problem with the GeoIP block message after updating from 6.3 to 7.0.When GeoIP blocking is enabled in an inline web protection profile, FortiWeb just reset the connections instead of displaying a block message page related to Geo IP blocking!!!Does anybody know how we could handle this?Thanks.

Hi allI'm looking for a twinax cable to connect a fortigatte 600e with a Nexus 5672UP and, because is already planned to change the Nexus with a HP J9822A , if is it possible reuse this cable also for this ssecond kind of connection or I will have to buy a new one.   

Good evening!   I've created the following policy to scan web traffic (test setup):   config firewall policyedit 2set name "Trust:Webzugriff"set uuid a7a53264-XXXXXXXXXXXXXXXXset srcintf "internal2"set dstintf "wan1"set action acceptset srcaddr "Trust address"set dstaddr "all"set schedule "always"set service "HTTPS" "PING" "HTTP"set utm-status enableset ssl-ssh-profile "certificate-inspection"set av-profile "AV-Web"set webfilter-profile "block some & monitor-all"set dnsfilter-profile "default"set file-filter-profile "default"set ips-sensor "all_default"set application-list "block-high-risk"set logtraffic allset nat enablenextend   The webfilter profile is configured to warn on specific categories. This works fine. Surfing to a corresponding web page triggers the webfilter. The Fortigate "warning-page" is shown. However, while the log says the web filter was triggered, the warning page says "FortiGuard Intrusion Prevention - Access Blocked". May be a cosmetic issue. &

Hello,   We purchased 200 mobile Fortitokens and I'm wondering if there is an alternative method instead of assigning them one by one manually. Any help would be well appreciated.   Thanks in advance!

Hi Support,I need to access my internal server machine through RDP with External pubic IP address . i created Virtual IP pool by selecting interface as my primary wan and mapped Internal machine IP with the external IP address and i enable port forwarding and map the port with TCP and in Port mapping type i selected one to one and i entered external server port to 3389 and map to IPv4 port to 3389.In Firewall Policy i selected incoming interface as SDWAN which i mention as Virtual WAN link and outgoing interface as my lan and source i selected all and destination as my internal server IP and server all and disabled the Nat and enabled this policy.now i cant able to connect remote desktop with my external IP address( public IP) can anyone help me

Dear support,I'm seeking guidance regarding my current network setup and the configuration required to enable internet access using the ISP-provided LAN IP pool (1.1.2.2/29 subnet) via our Fortinet firewall.Currently, our Fortinet firewall's WAN interface is configured with the WAN IP pool address (1.1.1.1/30), and it's functioning seamlessly. However, we now aim to utilize the ISP-provided LAN IP pool (1.1.2.2/29) to enable internet connectivity using IP addresses within this subnet.Any detailed instructions or guidelines you could provide regarding these configurations would be immensely helpful in achieving this setup.

Hello, what if admin from the same country that apply geoblocking?Will that be a problem?