Solved

Hello there,I have a question about applying a golden template for our customers. Our company (we are a MSP) has multiple customers who are switching to FortiGate firewalls. I was thinking, is it perhaps possible to create a template that we can apply/upload to all the new FortiGates? After that we specify the settings to the customer ofcourse, but is a base template (for settings that are the same for all of our customers) possible to create? Thanks in advance!

When I'm trying to download Forticlient VPN linux version (.deb), it's returning this message for me when I click the Linux .deb download button: 

Hello everyone, I'm trying to delete a certificate that I misplaced but I don't know how to do it. The delete button is not available on the options, only import, view or Download. I have a certificate that expired yesterday and the point was to replace it for the new one. When I try to reload it, appears the following message: "Certificate file is duplicate for CA/LOCAL/REMOTE/CRL cert.". I'm running the fw 6.4.5 @ 60F units. Thank you

Hello all Members.I would like to say hello for all .I'm starting my adventure with Forti Switches  and need some tips or example how to make configuration.My case is: like below. I need to create/configure additional pair of fiber switches connected by ICL-MCLAG and directly connected to stack of switches which are connected to FortiGate's. I already created one pair which is working fine but when I want to activate ICL-MCLAG between switch on top and red rectangle, both are going offline and only factory reset for both help. I found article about three-tier MCLAG config https://community.fortinet.com/t5/FortiGate/Technical-Tip-Three-tier-MCLAG-configuration-on-managed/ta-p/195452 but the question is, how to configure on the same level the second pair.Already prepared config switch auto-isl-port-groupfor this new pair but exist one is without this config. Is it possible to create new group and setup member ports for already connected and configured pair withou

I couldn't find any article clearly saying either "not possible" or "how to do it" online so far. But most of our FortiToken Mobile users who tried migrating from an old phone to a new phone told me a migration didn't work. So we always reactivate a token again.Recently one iPhone user who tried to migrate to a new iPhone told me the migration itself worked and she could use the 6-digit token code to get connected from the new phone. However, she never be able to get a push-notification. I found one discussion at Stackoverflow saying it involves a certificate and the "transfer" option at the app doesn't transfer it. But again, I couldn't find any from FTNT backing up the claim. Is it possible transfering FTM app w/ assigned tokens to a new phone with ability to get a notification? And if so, how should we do it? Thanks,  Toshi  

I've been at this for a couple days so I'm hoping someone can help.  This used to work until I did a factory reset.  I just updated my licence.  LAN/WAN is working just fine, I'm on it right now.    Model: FortiGate 40F Firmware: v7.0.13 build0566 (Mature)   I just want a basic WIFI AP Bridge - All of the docs and video say to enable the Managed FortiAPs but I don't have any listed.  When I try to add one using my 40F serial number is says Invalid Serial Number   I go through the setup where I:  Wifi & Switch Controller -> SSIDs -> New SSID Bridge Mode with SSID name and password Wifi & Switch Controller -> FortAP Profiles -> New Profile -> Use Defaults and I just add SSIDs manually and add the above SSID to both channels. Everything seems to be up I just can't see or join the network from a wifi devices.     I don't remember having to do more than this the first time I set it up. 

hi guys  What do these two errors meancmd_commit_cmdb: cmf_query_commit() errorrestore_pcontext:825 cmf_query_table_delete() error first one,did it mean that my configuration commit failedsecond one,did it mean that I failed to delete the table What puzzles me is what restore_pcontext and cmf mean hope someone can help methank you   

We have 2 FortiAuthenticators in seperate locations in an HA load balance. If the site that is listed in our fortigates as the primary server experiences an outage, Wifi connection is unsuccessful. I can see in the debug logs for the remaining FAC that the authentication is processed successfully but the fortigate/fortiAP is unable to successfully connect. Sites that have the remaining FortiAuth as primary instead of secondary connect successfully.   My working theory is that the remote auth failure time is too long to fail over to the secondary server for the WPA authentication to process successfully and establish a successful connection. Has anybody run in to anything similar?

I just need to confirm that the FWF-40F has a single radio and that if I want to have multiple SSIDs using different bands 2.4GZ or 5.0GHZ, you have to do one or the other BUT NOT both?  To do both, the next product available is the FWF-80F-2R or is this some other router/firewall/ap product I am not finding?

Hi,We have a Fortigate 601E on ver 6.4.13 manged by a FortiManager on ver 7.4.1. There is a discrepancy between what Webfilter categories are on each device and when I select to block on a category that is not on the Fortigate it gives me the following message:- post commit check fail: filters - 26 - invalid category id: Is there any way to manually create this category on the Fortigate? It stops me pushing policy whilst this issue exists.Thanks.

How is SD-WAN enabled on a FG device?Is there an explicit switch somewhere to turn it on?Or is it implicitly turned on by creating one or more SD-WAN zones and SD-WAN rules?Thanks.....

Good day!Would like to check if we can now rename the FortiSIEM admin account.We want to rename it since we dont want to use "admin" as username.Thank you.

Hey, everybody!anyone have any experience? I set up an ipsec tunnel between FG and AWS. The tunnel is up, static route and policies are in place. Ping from aws to fg is pinging. but from fg to aws is not.I started looking, I saw an outgoing ip during the ping from the management port. although it is not even connected. there is no such route. even if I turn off the mgmt port, traffic to the tunnel still comes from it. I put 0.0.0.0.0/0 on the mgmt port.Now traffic started coming from FortiLink port (802.3ad Aggregate), also disabled port, also put 0.0.0.0.0/0 ip on it. now traffic went to vpn tunnel from wan port. How can this be fixed? I don't have such routes, does fg make them up by itself)?model 400F - os v7.2.6

As in what version should I upgrade firewall to for a recommended stable and not necessarily latest version

Hello, this is the first time I use Forticlient.When I establish a VPN connection, I can reach the server but I can't navigate internet from my PC.Is there a way to solve this issue without make changes on the Forticlient server side? I'm using Windows 10.Please, give me puntual instructions as I am not expert in configuring net and firewalls.Thank you

We recently moved a clients local server infrastructure to a collocate.  Currently they are connected to the infrastructure over a site-to-site VPN (soon to be a point-to-point connection).   As a result, their RADIUS server (NPS) is now across the VPN tunnel.  Their main site (outside the Collocate) has a number of FortiAPs that were configured to use WPA/Enterprise with the RADIUS server.  This stopped working after we converted them and I've been trying to fix this and we've temporarily implemented a different wireless network for them to work.  I can't seem to get the RADIUS working across the tunnel.   It seems to me - if I can control what IP the local Fortigate sends out to the Collocate, and the NPS servers, I should be able to resolve this by configuring the NPS server with a client corresponding to the IP.  I don't see anything in the NPS logs referencing this traffic, so it's like it's not even reaching the server.  The tunnel between

Hi,Any ideas on how to apply a Nat Souce based on the destination port, in version 7.0 with Central SNAT enabled?In version 7.4.x, a new functionality was released so that in the Central SNAT policies you define the destination port using the CLI.But in previous versions is there a similar way to do this?It is required that the source IP be changed when the request is made to a specific destination port.Example.When I launch a request from the computer with the IP 192.168.1.10 to destination 10.10.10.5 and destination port 5302, the source ip change 172.16.1.10.When the request is launched between the same source and destination but with a different port (5555), a nat source with 172.16.1.20 is applied.

I'm experiencing intermittent issues with link monitor failover on my FortiGate device. I have four WAN connections (internal7, wan1, dmz, and wan2) set up with the following link monitor configuration: config system link-monitor edit "1" (internal7) set srcintf "internal7" set server "8.8.8.8" set protocol ping set gateway-ip 0.0.0.0 set source-ip 0.0.0.0 set interval 5 set timeout 1 set failtime 5 set recoverytime 5 set ha-priority 1 set update-cascade-interface enable set update-static-route enable set status enable next edit "wan1" set srcintf "wan1" set server "8.8.8.8" set protocol ping set gateway-ip 0.0.0.0 set source-ip 0.0.0.0 set interval 5 set timeout 1 set failtime 5 set recoverytime 5 set ha-priority 2 set update-cascade-interface enable set update-static-rou

I did FortiEMS deployment and installed Forticlient for 1000 machines. After I did Vulnerability scanning im got some Vul with Auto and others as manual. My question is, how can I do manual patching through EMS? Is there a way to install the patch from the internet manually and upload the MSI or patch file to EMS to push it automatically to all machines? OR does manual patching mean that users have to do it by themselves only?In addition, can I create a custom message to show to users once they log in to their machines including a message and link to download the patch of vulnerability manually? #ems #vulnerability #patch

I tried disabling 1 interface of another admin computer in Fortigate GUI but it accidently disabled mine too, I couldn't reconnect with changing interfaces, even the console interface didn't work, am I required to reset the device ? 

I have FortiGate v7.2.5, where in the firewall can you whitelist the Pentester IP with the IPS Security Profile. Or is the best way to create a firewall policy to allow that traffic for the engagement?

Hi Everyone,I have a unique and frustrating situation with an ISP that can only provide service via DHCP - and that DHCP is provided by another 3rd party as their last mile provider who refuses to acknowledge their mistake because "it still works for others"I have a remote site fortigate that loses it's WAN DHCP lease every other day or so because the upstream relay is providing an unreachable internal IP (10.x.y.z) as the server and relay IP in the original DHCP lease.  I have packet captures of this and watching the fortigate constantly trying to renew the lease with direct IP packets to this address, obviously being dropped by the next hop.  It's only when the fortigate loses its lease completely and finally falls back to broadcast discovery / requests that its able to recover. Question:  is it at all possible to configure the DHCP Client on the fortigate to do "broadcast requests" for leases exclusively, without trying to renew via unicast?I know this is not the

How to check temperature values on FortiGate 200F ?

Hi everyonei need someone to see what i am doing wrongi have a fortiauth as a radius server , and the fortigate is a radius client.i have many groups in the fortiauth.when i create a group in hte fortigate using remote server fortiauth , there is two opitions (any, specify)when using any everything works fine and good, but i want to specify certain groups for the policywhen i choose specify it gives me and emtpy tab to write a group with no choices , ive written one of the groupsmanualy but when i try it gives me access deny from ssl portalcan anyone help me with that ?thanks

I have a setup with one FortiManager that today manages internal firewalls. It has an interface connected to a mgmt network where most of our internal networking equipment are connected to. We want to use this FortiManager to also manage other Fortigates from different customers.  My initial plan is to create a private VLAN and let a new interface on the FortiManager be behind a promiscious port,.It's only used for adding the units to the Fortimanager.  My consern is that the FortiManager becomes a bridge between our internal mgmt network and customers mgmt network. Example someone makes a static route on the customer Firewall that points to our internal mgmt network with the FortiManager as next hop. I have not yet found any way to have an ACL directly on the FortiManager and would in this case be only dependent on the customer Fortigate ACL. Another solution would be to route the traffic towards the FortiManager through a firewall, but I want to kee