Solved

After upgrading to FortiOS 7.4, I am getting a notification to migrate the configuration when logging in with GUI. Is it necessary? What does it affect?

Hi Team, We have deployed fortigate in Active/Active in GCP between 2 load balancers (external & internal).We are facing issue in ingress traffic, in External LB both Forti-VM is healthy.When user from the internet try to hit external IP of External LB, traffic is not hitting to FOrti-VMs.

hello,I have questions regarding SD-WAN Config. I have two WAN interface from two different ISP (ISP1 (as main, subnet 176.x.x.x) and ISP2 (as backup, 96.x.x.x subnet). They are combined in SDWAN, ant there is SLA which check if ISP1 is OK, if not switch to ISP2.Question 1When ISP1 is down, all incomming connections to our services will be down  quickly, or sessions must expire to allow new sessions to be  up again using ISP2 ??  If yes, how long it takes in default ?  From ISP1 we bought IP public pool (88.x.x.x), and this pool is regitered in RIPE for us, and our partners can use these IPs to access to our services in DMZ, but when ISP1 is down, no possible for our partners to connect. Question 2.If his pool is registerd for us shouldn't be possible to connect from outside by ISP2 to our resoures???  Thanks 

Hi, I have Fortigate 60F and two ISP added to SD-WAN: WAN1 WAN2     I would like always to route traffic from Interface "3" (Subnet 192.168.0.0/24) to ISP "WAN2" and never failover to ISP "WAN1". If "WAN2" is down then clients on Interface "3" will be offline (that is OK). When other interfaces can use WAN2 as primary ISP and failover to WAN1 ISP.  If I will create below SD-WAN RULE then won't Interface "3" (192.168.0.0/24) failover to WAN1 in case of WAN2 is offline? SD-WAN Rule  

Hi All,IPSec VPN is configured this way:HO: LAN [192.168.7.0/24] - WAN --- IPSEC VPN --- WAN --- DMZ Zone [10.10.10.0/24]: BOOn both ends FortiGate routers.VPN tunnel is up but traffic doesn't go to\from.Checked firewall rules - ALL allowed to\from on both endsChecked static routes - for both 192.168.7.0/24 and 10.10.10.0/24 static routes exist with VPN interfaces as destinations.Is there anything special about configuring VPN for DMZ Zone?In the HO IPSec VPN tunnels to other branches works like a charm, but IPSec VPN to the BO in question with LAN in DMZ doesn't work.I compared IPSec VPN configuration and the only difference is in other branches VPN tunnels connect LAN to LAN and in this case it is LAN to DMZ. 

Since last week we've noticed that with the latest versions of Edge (114.0.1823.41) and Chrome (114.0.5735.110), drop down menus in Fortimanager 7.2.2 (haven't tested 7.4) and Fortianalyzer 7.2.2 and 7.4 no longer work. Manager and Analyzer 7.0.7 seem unaffected. Firefox works fine too.

I newly implemented sd wan. My sdwan has only 1 WAN interface. I remove the previous static route configured on the wan interface. I put a new static route for the sdwan interface. Now i cannot ping or https from the wan interface. Why? 

I am just playing with a 40F and have only console access…I have followed various suggestions on how to configure lan2 with an ip address and mask/gateway but constantly get errors….  should I be editing lan2 or port2… any help appreciated…

I am looking to migrate from Palo Alto 3020-HA to Forti 600f-HA. we currently use Panorama and will now be using FortiManager.We only use Panorama for objects and polices, no device templates...This is my plan... remove 3020 from Panorama and import all objects and policies.(already done)export config to xml. (already done)send xml for conversion,load returned config onto 600Fcreate HA pair.join to fortimanager with required settings... also.. is this a one off..   as in if it goes a bit wrong we are scuppered...do we get more than one attempt???any advice would be greatly appreciated. 

Hello Experts, I'm interested in RFC 2544 testing as it pertains to Fortigate VMs. Specifically, I'd like to understand Fortigate's approach to throughput testing. They provide online throughput figures for their VMs and mention details like server specifications, memory, CPU, and SRIOV enablement.  My inquiry is whether Fortigate employs a tool like FortiTester to determine these throughput numbers. If they do, I'd like to know their recommendations for conducting RFC 2544 tests for throughput. For instance, should there be a delay between each iteration? For example, when testing different frame sizes like 64, 128, 512, and 1528 bytes, should there be a pause between each frame size, such as waiting for a few seconds after the 64-byte test before proceeding to the next frame size? If such delays are recommended, what is the suggested duration for these pauses?

Meaning he gets the local ip address but he has no internet access.What can be done to resolve this issue?

Hi Community Member, I have a requirement of 150 days data retention policy. 30 days should be online and 120 day on archive. I am getting little bit confuse in FortiSIEM documentation.There are two types of retention policy (archival retention policy and online retention policy), we have configured data storage (online and archive) on NFS server. If I set data retention to 30 days in online retention policy, what will fortiSIEM will do after 30 days ? will it move data to archive or it will delete the data ? Thanks in advance.

Hello, I just upgraded my Fortigate 60F to version 7.4.1 from 7.4.0 and my traffic shaping configuration disappeared, I tried to create a new one but after I click OK it is not saved, all the traffic shaping configuration including services and applications that I entered are not saved . Can you help me with this problem?

A client we help has a small office, one Windows Server, and a FortiGate. The server has some DNS Server problems. Would it be possible and wise to turn uninstall the Windows Server DNS and to instead use the FortiGate for DNS? What are the advantages and disadvantages of the Windows Server acting as DNS server vs. the FortiGate acting as DNS server?

Buen día,Necesito saber a nivel de fortigate cual es el Algoritmo utilizado para la encriptación de la información que viaja por la SSL VPN,dónde puedo sacar la información

I am currently provisioning a FortiGate 7.0 VM HA cluster in the Google Cloud (through the GCP image). Now our organizational policy requires OS Login to be enabled. This results in a high number of users managed by the Google IAM to be imported as "prof_admin" into the machine. Is there a possibility to disable the OS login feature on the Fortigate directly so that the GCP does not manage the users on the VM? I realized that I myself am "super_admin". Is that because I am the creator of the VM? In general, who gets the "super_admin" role? Is there some documentation on how the FortiGate VM image integrates into the GCP? Thanks in advance.

hello,I have this situation:I have two links from two diferent ISP (let's say ISP_A (fast) and ISP_B (slower)), and from ISP_A i have Public IP pool, we are using one IP from this pool to provide one application available from outside (by configuring VIP).Is SD-WAN we have rule in general saying that if ISP_A is down or bad SLA use ISP_B Our partenr is using VIP address to access to or resource from Their site. Question:):1.If ISP_A is  down , will be possible to access from Partner site using VIP(pool from ISP_A) but on link from ISP_B ??Thanks 

Hi all, I have an SSID using 802.1x authentication and would like to configure a secondary RADIUS server for redundancy. However it seems like I can only select one server. Any ideas how can I configure this? Thanks.  

We are using Web filtering in EMS. Is there a way to get a report of where someone click pass the warning about a bad site? 

Hi guys, How can I use the set variable value in a playbook I created in a different playbook?

if one of my sdwan links goes down, I want an alert sent to my email or phone.Can this be done?

Hi All,FortiGate 60E [FortiOS v7.2.5 build1517]I don't see VPN logs. Why isit so and where I can enable VPn logging. 

Hi team,    I am kind of a stuck in a situation. I was accessing the fortinet dashboard board the DDNS with Letsencrypt SSL. I had setup a port forwarding to one my server through port 443 and 22. I didn't realise the ports were also used for the web admin and ssh. Now when I am trying to access the web admin and SSH the requests are being forwarded to the server. Is there anyway I can change the port or there's no other way apart from resetting the device? I do have a backup file, but not sure how to even restore that.    Thanks!

Hi i need to configure two wan port on Fortinet 40 F , like a aggregation each wan port can see mac adress for each other  to build my failover Solution  Br Alain 

Hello.  I have some test switches (248E-FPOE).  I put them into standalone mode (factory reset and then reconfigured).  Some of the switches are on 7.2.1 and others on 7.2.4.  The switches are connected to each other, and only each other.  There are no redundant links.   The problem is that about every three or so hours the switches cpu load spikes to ~90% for 20 or 30 minutes and then goes back down.  I tried disconnecting on of the switches from the others, and it still is doing this.  Looking at the logs, they just seem to spike and them cpu utilization logs get generated.   Not sure what might be causing this?  I'll look into one more thing tomorrow, but I have my doubts.  Was curious if anyone has ran into anything similar.   **Note: Only having this issue after putting them in standalone mode.