Solved

Hi all,In scenario with two location connected via ipsec tunnel, remote office is accessing internet through wan port in main office, is it possible to capture and send traffic, remote office - internet and vice versa traffic,  to analysis sensor?Something like port mirroring in L2 world.Thank you,Drazen

Can we query to get percentage disk utilization using SNMP? What OID should be used?

I am using Fortigate-100F(Fortios 7.0.12), but appear below logs every day:Failed to connect FortiManager 173.243.132.61        Central Management connectivity is inactiveTunnel to FortiManager is down                                  Central Management connectivity is inactiveConnected to FortiManager 173.243.132.61               Central Management connectivity is active I do not use Fortimanager,  why appear those logs?  Thanks and regards,Gavin  

We want to move from IKE v1 to IKE v2 on our Fortigate 100F.  If we change the tunnel config on the firewall, and then make the Forticlient EMS tunnel match in version, will we need to reinstall Forticlients/profiles, or will this be a process transparent to end users if performed after hours? Would love to know what we're in for.  Thanks!

Hi, We just put a Fortigate in place. I have the SSL VPN working and vpn my clients can get to the 172.19.0.0/16 network that the Fortigate is also on. However, they can't get to devices that are on the 172.18.0.0/16 network. 

i am getting the following SSL error message from my fortigate firewall when i access some FTP and HTTPS sites. how can i by-pass this error message ? This Connection is Invalid. SSL certificate expired.A secure connection to ftpsin.emc.com cannot be established.When you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.Site ftpsin.xxxx.comCertificate CN ftpsin.xxxx.comCertificate Authority Entrust Certification Authority - L1KCertificate ValidityNot Before: Nov 6 22:29:54 2020 GMTNot After: Nov 6 22:29:54 2021 GMT

Hello all,I used FortiClient VPN for a while and one day, it suddenly started to pop up the following window:I checked the security & privacy settings as mentined, but couldn't find any request for approval from any app. Full disk access is allowed for "FortiClient" and "fctservctl2" so there should be no issue but still, it insists. I decided to uninstall the client and reinstall it and now there is a new problem. Second before the installation process ends, I'm getting this message:                   I clicked "Allow" and the installation finished.Now, when I open the client and add a new profile, after clicking "Connect", it's getting stuck in the status: "Connecting". The disconnect button doesn't respond, I need to force close the client completely to get out of it.Any idea what it might be? It worked perfectly for a long time and now it stopped.There were no changes in my system tha

I configured allow access from specific subnets under admin user configuration, but it still allows access from anywhere. Is there anything am I missing? 

We have a FortiAnalyzer and want to create a new dataset with bandwidth consumption for the previous month based on vlans port. The bandwidth consumption refers to traffic from/to vlan to/from wan port.E.g. vlanconsumedvlan10123vlan20456...... So query intercepts "internet usage" of vlan# for the previous month.Can someone help us? Thanks in advance.VZ   

HelloVRRP on FortiGate fails over in a minimum of 3s and I couldn't find a way to reduce it more.Tried to use VRRP v3 but I got the same.By the way VRRP v3 timers should be configurable in millisecond but on FortiGate it is still in seconds.Any idea on how to reduce failover time to 1 or 2s?

good afternoon colleagues, a question.In the morning we had some problems with access to some pages that I could access normally.In order to pass the certificate analysis I had to enter the rule and in the SSL INSPETION section change from certificate-inspection to no inspection until the page loads without problems and then return to certificate-inspection.This problem has been occurring with other pages that were previously accessed. the connection is not privateIt is possible that attackers are trying to steal your information from xxxxx.com(for example, passwords, messages or credit cards).NET::ERR_CERT_AUTHORITY_INVALIDIt is worth mentioning that when you enter through another network, for example, a cellular data network or a home network, if you can access the page and the message "it is not secure" does not appear.Do you know why this happens? It is worth mentioning that the certificate of the page expires in 2024 so there should be no problem. 

I have this log in our FortiAuthenticator. What does it mean? Failed to send notification to user[username] due to: [HTTP code 400] Cannot determine platform based on reg_id  

Is there a way to disable all accounts with out a token in bulk? 

Hello, communityI am trying to update the database ISDB through REST API FortiOS from file "ffdb_...". Which db_name should I use? The REST API Reference does not say about it? Also, when I try to update through web from file "ffdb_...": Fortiguard→ Firmware & General Updates I get the error: "Failed to upgrade database"

Hello, I run a single supervisor node in a virtual environment. Is it possible to install Windows Agent and configure it to send data directly to the supervisor, or I always need to set up a collector in order for the Agent to communicate with it? 

have you tried registering AIX server? we're able to configure syslog setting but AIX still not sending logs to Fortisiem.

Hi, I have a FortiGate 50E running v6.2.4build1112 The following issue occurs with different browers (FF, Chrome, Safari) and also on different platforms (Win,OSX,iOS,Android) For the last 24h I have suddently started receiving certifiacte errors on various websites which have worked flawlessly before. I get the typical HTTPS warning in my Browser (e.g. "Your connection is not private" in Chrome) and the exact error message is "NET::ERR_CERT_AUTHORITY_INVALID". Interestingly if I look at the certificate details it shows "Fortinet Untrusted CA" as the issuer. If I access these sites via mobile data these pages work fine and also the issuer is shown as a know institution (in all cases noticed so far it's "Sectigo"). In the SSL Logs I see "blocked" actions for the respective website: Message: Server certificate blocked Reason:    block-cert-invalid Type:    utm Sub Type:    ssl Event Type:    ssl-anomalies These actions are

Hello - We have a FortiGate 30E with 2 VLANs at a new office.  The first VLAN is for devices that just need internet access, the second is for domain connected devices that need to connect to the private LAN at our datacenter.  That connection is done through an IPsec VPN tunnel (FortiGate to FortiGate, other side is a 200E).  The 0.0.0.0/0 routing entry points to the local internet connection so that regular outbound traffic goes over that connection.  However, I'm trying to find a way to route all traffic on the 2nd VLAN over the VPN connection, including internet bound.  In other words, we want internet traffic from that subnet to be routed over our corporate internet connection in the datacenter, not the local office internet connection.  Is there a way to do this?

Hello!I hope someone can help with a boot loop issue on a 900D.Please excuse the NOOB description, as I am just coming into this job and have a non functioning device.Putty is being used for CLI serial access to the device.I have had to format the boot device, as I am starting from scratch--which appears to go fine.Then I load from TFTP (tftpd64 program) on MGT port 1 the downloaded OS version 7.0.0 (checksum verified).That goes well, no errors.Next I am prompted to choose the boot program as Default/Backup/ etc.I choose Default (I also have tried backup).The system then goes into the "Programming firewall" - again, no errors.After that the system reboots.Here is the console out put that is concerning, and I am not sure what to make of it.Sorry for the long detail, but perhaps someone can decipher it:FortiGate-900D ( 9:56-10.13.2017)Ver:05000004Serial number:123456789RAM activationCPU(00:000306c3 bfebfbff): MP initializationCPU(02:000306c3 bfebfbff): MP initializationCPU(04:000306c3 bf

Hello,I am running an AD on Windows Server 2019, and I would like Fortisiem to trigger any change or modification made on the DNS server ( adding a new record, deleting a record, etc ... ).Fortisiem now polls event information from different DCs by using OMI. 

Hi Guys, I have not configured any static route but it is showing in the routing table. Kindly suggest on the same. 

Hello Is it possible for a FortiGate to both act as the DHCP server and relay? The reason I would want this is because I have a NAC solution that would use the relay information to profiling the endpoint and the endpoint also needs to get an IP address from the FortiGate DHCP server. I have tested this in a Lab, but I am getting this error:FORTINET-FW (CISCO-CORP-LAN) # set dhcp-relay-service enableFORTINET-FW (CISCO-CORP-LAN) # set dhcp-relay-ip 10.0.1.51FORTINET-FW (CISCO-CORP-LAN) # set dhcp-relay-agent-option enableFORTINET-FW (CISCO-CORP-LAN) # showconfig system interfaceedit "CISCO-CORP-LAN"set vdom "root"set dhcp-relay-service enableset ip 10.100.100.1 255.255.255.0set allowaccess pingset device-identification enableset role lanset snmp-index 7set dhcp-relay-ip "10.0.1.51"set interface "port4"set vlanid 100nextendFORTINET-FW (CISCO-CORP-LAN) # nextdhcp server 2 of type Ethernet already exists on this interface, cannot add relay!object set operator error, -76 disca

i have deployed fortianalyser container with this command Docker run -it --restart always -p <Port Mapping>:443 -p <Port Mapping>:22 -p <Port Mapping>:541 --cap-add=ALL <image ID>:<Tag>and then i go to the browser i put localhost:39443, it says  "This site can’t be reachedThe connection was reset."is the image fortinet/fortianalyser not stable or what !!what is the solution please  !!?

I have a scenario where there are two subnets in AWS, a public subnet and private subnet. Most of the public subnet have web servers running with multiple public IP's to access from the internet. Now I would like to deploy the Fortigate Firewall in the same public subnet & route all those web servers traffic through the Fortigate without changing already mapped public/elastic IP's of those web servers. Can some one please provide some inputs on this ? PS: my private subnet traffic towards internet through Fortigate is working fine & also traffic from internet to private subnet via Fortigate WAN public VIP and port forwarding is working perfectly.  Only concern are the instances hosted in the public subnet where it has multiple public IP's and I can't change the architecture keeping existing setup in view. Appreciate your inputs, thanks FortiGate 

Hi guys,In my domain I have two web Servers appliccation and I need to publish both. They are hosted in differente internal web servers.I only have one public IP to do that and both need to use https port.Ex:webserver1.mydomain.com  / 200.10.10.10:443 > 192.168.1.10:443 webserver2.mydomain.com / 200.10.10.10:443 > 192.168.1.11:443 Is it possible configure Fotigate to do it with virtual IP?Fortigate will be able to match different fqdn and redirect to correct web server ? Regards ,