Solved

Hi,We have a Fortigate 60F and go through a reseller who look after it for us. We had a Forticare licence renewal reminder 3 months ago but didn't act on it at the time (because it was 3 months away and we weren't sure if we would lose time by renewing early). No reminder was set internally (my fault) and no further reminders were received from the reseller. It expired last week and we have had to scramble to renew. The reseller put the renewal in last Thursday and it still hasn't renewed on the device, so we continue to have issues.Is this normal 5 days later, and is there anything we (or they) can do to speed it up?I have access to the dashboard and the CLI.Thanks

Actually in the VPN why function of Local Gateway? What pro and cons if we enable/disable this?

I have a Fortinet FortiGate 100E (V7.2.10) running in a production environment.Currently, multi-VDOM mode is NOT enabled.I want to create a new VDOM.Can someone confirm whether enabling multi-VDOM mode and creating a new VDOM will impact the existing production traffic or policies?What precautions or best practices should I follow before enabling multi-VDOM on a live firewall?

Hello,I have to design a network based on sdwan, ibgp and advpn technology by the book, but using three hubs instead of the classical two.It is possible to implement advpn based on three hubs?Thank you all Vincenzo Stolfi 

Hi, I have set up virtual server with full ssl offloading. Everything is working fine but when I check our website by ssl checker for example https://www.digicert.com/help/ it says that the server is not sending the required intermediate certificate. Anybody know how to fix it? The problem is that Bluemedia cannot correct ask our webserver because it gets error "Unable to find valid cerification path to requested target".   I have already tried to upload .pfx with certificate, intermediate certificate, private key etc. and it still does not work.

Hi all, simple question...How do I unlock a user which is blocked due too many failed attempts?As of default the waiting time is 600sec. "diagnose firewall auth clear" seems a bit too much. Or is this the way to go? FortiOS 7.4.9 Thanks, regardsMarc

I have a fortinet v7.0.12 router and it's configured to nat and allow all traffic from the internal network to the internet. There's a firewall rule for internal -> wan with source/destination/Service set to 'all' and the security police is no-inspect. This seems to work for most things, internal users can access web site but some outgoing connections are blocked. Notably ports 8007 and 25 don't work. Where else would these connections be getting blocked if not the firewall?

Does anyone know how to do the equivalent of a " terminal length 0" on a Fortigate firewall? Our Fortigate has roughly 65k lines of config in the configuration file - hitting space bar all the way to the bottom is painful.

Hi everyone, I would like some clarification regarding FortiMail HA in active–passive mode, specifically around IP addressing and routing/firewall configuration. I already know how to configure HA itself, but my main question is about IP addresses:In an active–passive HA setup, do both FortiMail units use the same IP address, or does each unit keep a different IP address?I currently have a Virtual IP configured on my firewall (192.168.1.1) to forward SMTP traffic.At the moment, the primary FortiMail has IP 192.168.1.1(which is the VIP), and the secondary FortiMail has IP 192.168.1.2.SMTP traffic is currently being forwarded correctly to the primary unit.My concern is failover behavior:What should be configured so that when the primary FortiMail goes down, the secondary automatically takes over?Once HA is configured and synchronized, does the secondary automatically take over the primary’s IP address (192.168.1.1), or do I need to modify something on the firewall side (VI

Hi, I wanted to test 7.2.4 VM on ESXI.For my current and wanted setup, i wanted to add a NIC using PCIE passthrough of ESXI to the VM i downloaded, because i wanted to use a VLAN on my Nic so that i can get PPPOE. I Have my SFP in that NIC. I Got my PPPOE config to work using the CLI, so i currently can ping fortiguard servers or any other outside destinations using the execute ping command. When i go execute vm-licensesI get : 60 - Failed to request forticare license. Failed to download VM license.But when i am using Diagnose hardware sysinfo vm fulli getValid : 0Code : 202,Status : 3If i do it from the GUI i get a message bottom right which says : "Licence invalid product model"My guess is because i kind of tempered with the VM adding a passed through nic but i hoped i was wrong, confirmed, or that it would be made possible.My current number of physical interfaces is 2, i do respect the CPU and ram limitation (even tried lowering the ram to 1536 in case pcie did something).

Every time one of our users attempts to login, they are prompted to provide all their credentials. We're using Forticlient VPN (free). The connection is established and works, but on the next login it prompts for the Microsoft login again. This began happening in Forticlient 7.2 and has continued in Forticlient 7.4. This does NOT happen in Forticlient 7.0, so we're still using Forticlient 7.0 in production. The Fortigate itself has been on various flavors of FortiOS 7.0, 7.2, and 7.4, and the results have been the same for Forticlient. Our Azure accounts are setup with MFA, and we're using SSL-VPN in tunnel-only mode. Forticlient 7.0 - connecting with Azure SSO works fine without reprompting for credentials and without needing to change any of the default Forticlient settings Forticlient 7.2 - connecting with Azure SSO works, but prompts for credentials every login regardless of whether you tell it to remember credentials and MFA authorization or not.  For

Hi @Community  I was planning to deploy multisite HA for FortiSIEM deployment with the following current 7.3.5 architecture of 6 nodes.1 super with DB3 keepers2 data/query, which double as event upload workers I have reviewed #High Availability and Disaster Recovery - ClickHouse | FortiSIEM 7.0.0 | Fortinet Document Library I already have 6 nodes on the second site ready to go.kindly suggest the best architecture and load balancer if needed @FSM_FTNT @Secusaurus,  I would really appreciate your input.  

Im trying to troubleshoot what happen that HA isnt synced. I did try debug commands but no luck :) Please suggest where to search for solution. Below example logs:  FW600D-RZ-0~ $ dia system ha sync-config get-statusThe sync config status is enable.||diag system ha statusHA informationModel=FortiWeb-600D 7.07,build0151(GA),230519, Mode=active-passive Group=2||HA group member information: is_manage_master=1.LocalSN: FV600DXXXMasterSN: FV600DXXXFV600D3XXX: Primary, 3, 0, 50617820, 47648191, FW600D-RZ-01FV600D3XXX: Secondary, 4, 0, 50606741, 47638346, FW600D-VWG-02||diag system ha confd_statusHA informationModel=FortiWeb-600D 7.07,build0151(GA),230519, Mode=active-passive Group=2HA group member information: is_manage_master=1. cfg_state:Not syncLocalSN: FV600D3XXXX confdmember cnt: 2msg_queue:0 file_queue:0 md5_rep_ignore:0 do_md5sum:242FV600D3XXXX: Primarypending:0 update:0 time:0 sync:0 cfg_state:Not syncSYS: 4159F01630575F9FDF120EDB1EC3638BCLI: 7853F4D9511E41F8A8EB471011

Hi allIm trying to find a way to get connection count to a real machine within the loadbalancer pool.My platform is FortiADC v8.0.1The closest method listed in the guides is /slb/all_vs_status_last_2but this gives 404 page not found Any suggestions? 

Hello FortiCommunity, We currently are using FortiClient with an EMS server and noticed when we connect to the VPN we received our specified internal DNS on both our physical adapter (wifi/lan) and our vpn adapter. Our specified internal DNS are our domain controllers that run DNS services.   The issue we are having with this is that sometimes the FortiClient software disconnects or something in windows causes the application to crash. My assumption is when you hit the disconnect button on the FortiClient it removes routes and/or the static DNS entry. With that process not taking place the end result is that the static DNS that was not cleared, thus leaving the PC unable to connect to the internet.    Our users working from home do not get admin access to their network adapters as well. The combination leaves the end user unable to connect to the internet and our remote tool useless. Do you guys know why the static DNS is set- can we set this to obtain automatically? I d

Hello everyone.We have two FortiGate 100F devices configured in active/passive mode.We are using six site-to-site IPsec tunnels, as well as remote users (Windows/Linux) who connect via FortiClient VPN.In addition, there are users who connect from Android phones using FortiClient VPN for Android.About a month ago, the FortiGate devices were automatically updated overnight to FORTIOS v7.6.5 build 3651.After the update, external users lost the ability to connect via FortiClient VPN on Windows laptops.After reconfiguring the VPN settings and switching back to DH group 5, Windows laptops were able to connect again.However, FortiClient VPN on Android still cannot connect and returns an error.On FortiClient for Android, only the following DH groups are available: 1, 2, 5, and 14.I tried all of these DH groups one by one, but there was no improvement.I tested this on multiple Android devices, and also tried the full FortiClient VPN version.In all cases, I receive the same error in a loop (the

Hi all, Do Fortigate Firewalls support "BGP peer groups" by sharing the same outbound policies and setting instead of configuring each BGP neighbor individually and updates replicated to all peer group members. I can't seem to find any docs or commands that support BGP peer group config on a Fortigate like a Cisco or Arista Switch.  

The customer currently has approximately 50k concurrent explicit proxy users, and we are trying to identify a suitable FortiGate/FortiProxy model or scalable architecture to support this requirement.Unfortunately, we haven’t been able to find publicly available documentation that clearly states the maximum supported value for “Concurrent Explicit Proxy Users” on most FortiGate models.So far, we have confirmed the following:FortiProxy 4000G – 60k users (from published specifications)FortiGate 901G – 32k users (observed from device login)FortiGate 1001F – 32k users (observed from device login)Could anyone please confirm the supported values for the following models?FortiGate 1800FFortiGate 2600FFortiGate 3000FIf you have access to the device, the value can be found under:System → Global Resources → User & Device → Default Maximum Any insights or confirmations would be greatly appreciated. Thank you.

I am trying to install a FortiClient (VPN only) FortiClient I have downloaded the instalation file after filling the form https://www.fortinet.com/support/product-downloads#download-vpn-only I have selected the Windows version.When I launch the instalation file, it downloads image, unpack it, but then nothing happens.  

HiI continue to try to configure my first FortiGate. After admin login, the GUI hang on register  I think it's beacause it has no internet access.So I tried to configure on CLI.First WAN : edit "port1" set vdom "root" set ip 192.168.99.191 255.255.255.0 set type physical set alias "WAN" set role wan set snmp-index 3 next Then routeconfig router static edit 1 set gateway 192.168.99.254 set device "port1" next endThen DNSconfig system dns set primary X.X.X.X set secondary X.X.X.X endThen firewall policyconfig firewall policy edit 1 set name "LAN_to_WAN" set srcintf "any" set dstintf "port1" set action accept set srcaddr "all" set dstaddr "all" set schedule "always" set service "ALL" set nat enable next end What have I missed :) ?RegardsMarc

HiI've just recieved my FortiGate 200G.I am following the quickstart guide. It says to connect WAN port. But there is no WAN port So I have connected a PC to the MGMT. I manage to acces the GUI.But It wants to connect to FortiCloud. But no wan port plugged = no internet access. So I tried console CLIhttps://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-initial-configuration/ta-p/283529 config system interface edit port1 set ip 192.168.99.99 255.255.255.0 command parse error before 'ip' Command fail. Return code -61 So I am a little lost.Can you help ? Where can I find a Quickstart guide updated ?RegardsMarc 

We've been having issues getting a SiriusXM player to stream audio when connected to our network and Fortigate 100F and 200F firewalls running 7.2.12 build 1761 firmware. We have created a Firewall Policy for the device that Allows all traffic, with security profiles removed and no SSL inspection. DNS Helper has also been disabled for diagnostic purposes, and we are using external DNS (8.8.4.4 and 1.1.1.1). When checking Forward Traffic logs, we see no traffic being Denied, but the player will not stream audio. We verified the traffic for the device is using the Policy that has been created for it. When connecting the device to a wireless hotspot, the audio streams properly. Below is a sample flow debug:id=65308 trace_id=1 func=print_pkt_detail line=5813 msg="vd-root:0 received a packet(proto=6, x.x.x.x:35366->34.215.0.215:443) tun_id=0.0.0.0 from VLANx. flag [.], seq 288633703, ack 3087288262, win 1503"id=65308 trace_id=1 func=resolve_ip_tuple_fast line=5901 msg="Find an exist

I have an on prem AD synced to Entra - my EMS cloud is connected and the Entra domain is imported over. I have configured SAML so when the client is pushed to my contractors who are non-domain joined devices, they will be prompted for credentials before connecting to EMS. The SAML redirect is occurring, but I am receiving an invalid response error after attempted log in. Any Ideas? EMS client packager version 7.4 patch 7.4.5   

Hi community, I have bought a used Fortigate 60E to work with SD-WAN. The port WAN2 not working (no sign of life) but my problem is the port WAN1 because it's working only Fast. My service provider router is Giga and my link is 500Mb. What is the problem? I count with your support Addtionals Informations:- The two WAN ports are 10/100/1000;- My firewall is up to date - version 7.0.12;- Memory and CPU used is OK;- When i tested the same cable on another port, it's works Giga (Today, it's my workaround);- When i forced the speed port to 1000, it's stop work; FortiGate#Fortigate60E

Anyone using FortiTester and can confirm / deny if test case configuration is not shared among users? If I create test case configuration and another user logs in they don't see my created configuration, and neither do I see theirs. These are remote (RADIUS) users.