Solved

hello experts! i want to configure a site-to-site VPN between 2 sites. Site "A" has 2 ISP links and here I want to create 2 redundant IPSec tunnels with site "B".so the problem is that site "B" has only 1 wan link and site "A" has 2 wan links. As shown above image. so how can i configure any help would be appreciated thanks. ipsec

When create users from LDAP server (in my case, Microsoft AD server), the ID (username on Fortigate) of created user is actually "display name" of this user in AD. The request is to change the username on Fortigate from this display name to "sAMAccountName" or "userPrincipalName". Is it possible? And how?  

Hello team,   I would like to know whether sample-rate is supported by NetFlow or only by sFlow.   Thanks in advance

Hi Everyone My firewall's installed zone cannot connect to the internet, causing a system event log entry with the message 'FortiGate update now failed' every 2 minutes. And Licenses information status Pending always.Is there a way to solve this problem?   Firewall OS ver. 7.2.2 Thank You FortiGate  

Good morning friends, a question. Could you please help me with this query, because that message appears "Unable to connect to fortiguard servers" In firewall v7.0.12 we are using the DNS of the ISP provider and no drops are observed. There is no latency The licenses are in UP and expire in 2024.   What could be happening? thanks for your comments  

Hello, I have deployed Fortimanager in Azure Infrastructure. As I see it automatically applied 1TB disk. What is the purpose of this disk? Just for logs?  Because right now my Fortimanager has 2 disk:1 - OS disk - Size is 4gb2 - Data disk - Size iz 1TB 

We have upgraded our EMS server to 7.2.2 build 0879.After that we upgraded few of our FortiClient to 7.2.2.0864. The result:- all our FortiClient endpoints with 7.0.9 receive the ZTNA destinations and create successfully the virtual hosts in the Windows \drivers\etc\hosts file.- all our FortiClient endpoints with 7.2.2 did not change anything in the hosts file. Also the features status in the EMS console for that clients says: "ZTNA enabled (hidden)", although there is no such setting in the assigned profile. The user do not see the "ZTNA destinations" tab on the client side. How may I change the behavior of the 7.2.2 client, so it can use the ZTNA as intended?

Hi All I'm planning on creating a Aggregate Link for WAN on my Forti 200E.Would i need to create a trunk/LACP on my switch to accomplish same? (Aruba switch)

 I have two routers connected using ipsec site to site.The remote user connects to router A  (192.168.1.0/24) and has access to the network. The remote user does not have access to network B ( 192.168.2.0/24) How to make it have access to network B

Hi, I need to open a ticket with my Fortinet account on behalf of a customer. The device is registered under my customer's account. Is there a way for my customer to associate my account with the device or his organisation so I can open the ticket on his behalf? Thanks.

On FortiADC I tried to configure a NAT Source Pool with an IP-address of an existing VS, but seems to be not possible, as I get an error message saying that this IP-address is a duplicate to an existing VS.Is this really a normal behavior and if so, why is there such a restriction?!?!?!Background: we are currently planning a platform migration from F5-LTM to FortiADC and in F5 world we are using SNAT with the same IP-address as the VS itself.How can this be configured with FortiADC?Thank you!Regards Stefan :)

What feature is supported for One-armed Sniffer?  Is SSL certificate inspection supported? Is SSL deep inspection supported?

Is One-Armed Sniffer supported under HA configurations?  Can I connect SPAN port on the switch to a small switch and connect my one-armed sniffer ports from each of HA Fortigate member to the switch?

Seem to not be able to install FSSO agent 5.0.0311 on Windows Server 2019 (Standard).Seems fine on 2016 and 2022.. Any help much appreciated... 

Fortigate-200Fおよび400FのMAC address tableの動的に学習可能な上限値を教えて下さい。スペック一覧等にも見当たらず、掲載場所があれば教えて下さい。

Hello Expert,   One cisco I am able to create vlan and assign respective port to vlan    example  ------------------   interface Vlan31description Switchware Vlanip address 10.118.133 .33 255.255.255.240   interface GigabitEthernet3description CCTV Interfaceswitchport access vlan 31no ip address!interface GigabitEthernet4no ip addressshutdown!interface GigabitEthernet5switchport access vlan 31no ip address   On the fortigate  i would like to able to create a similar vlan and assigned different interfaces unsure how to do this. thank you  Regards

We're in the process of upgrading our AnyConnect to FortiClient. What we're trying to accomplish is tie authentiation into our SAML SSO with MFA. We want to be able to provide segmentation  to the VPN users, that is, we want to control which systems the VPN users have access to. It appears we can accomplish this with FortiClient EMS, which we'll be purchasing soon, but I'm getting a bit wrapped around the axle in understanding the entire process. I believe I'm good in configuring the SAML SSO with MFA a the firewall, but outside of the FortiClient EMS, is there anything else we need to purchase or provision? I'll continue to look for the documentation, but I'm getting a bit behind on the schedule. Thank you.

Hi I have added a specific website to an allow group in a new policy with no security profiles.Additionally added wildcard/exempt in the Web Filter profile for other policies and yet am still getting the 'Fortiguard SDNS Blocked Page' when trying to access. Further nothing appears in the logs for it being blocked? I am at my wits end not sure where its going wrong FortiOS v7.41 Forti 200E

After upgrade Forticlient to 7.2.2, Firefox can't connect to any secure side (google.com, etc), because of: "Software is Preventing Firefox From Safely Connecting to This Sitewww.google.com is most likely a safe site, but a secure connection could not be established. This issue is caused by FortiClient Webfilter Root, which is either software on your computer or your network. What can you do about it?www.google.com has a security policy called HTTP Strict Transport Security (HSTS), which means that Firefox can only connect to it securely. You can’t add an exception to visit this site." Have you experienced this?

Hi, We created the vxlan according to the document below. We can carry vlan50 or etc. but it didn't work it for vlan1.  https://community.fortinet.com/t5/FortiGate/Technical-Tip-VXLAN-over-IPsec-for-multiple-VLANs-using-software/ta-p/195488

Hi.I wanted to ask you about the following problem I am encountering:I have a Fortigate 80E device with one of the internet outputs via fiber (Wan1). The second is WiMax and it is what we use to give our company's clients free Wifi (Wan2). To access this internet we use an access point connected to port 11 lan.At the same time, we have enabled the VPN connection to the Fortigate through the public IP and a port. If we connect a laptop from which we share the mobile phone's Wi-Fi, we have no problem accessing the VPN, but if we try to use the free internal Wi-Fi internet, access is impossible.The questions are the following: Is it viable to connect via internal open Wi-Fi to the VPN?If so, what additional policies or configuration would we need to create in Fortigate to make this possible?I am waiting for a response. Thanks in advance. All the best. Thank you.

Hi,Version 7.2.6, Events section missing from Log and Report.

HI  Anyone have experience and idea how to configure and process generate CSR at FGT and sign by FAC for internal access in order the webpage won't show warning and address bar show "not secure" ? I did try generate CSR in fortigate and signed by FAC. I did import the local CA from FAC to the end user devices. However, still see the warning and address bar show "not secure"  Appreciate anyone could share the idea and the step i missing I did refer link below as wellhttps://docs.fortinet.com/document/fortiauthenticator/6.5.0/cookbook/628126/fortiauthenticator-as-a-certificate-authority    

Hello https://docs.fortinet.com/document/fortimanager/7.2.0/new-features/47777/fortimanager-supports-authentication-token-for-api-administrators-7-2-2 I'm following above link to configure token authen for api admin in my fortimanager . I 'm trying but always get same  message "{ "id": 2, "result": [ { "status": { "code": -11, "message": "No permission for the resource" }, "url": "\/sys\/status" } ], "session": 48079 }"

Why is tcp port 179 open in firewall even though BGP is not used?Because it is scanned as being open.Is there any way to disable it?