Solved

Good day, I am having an issue with users connected remotely to the office using FortiGate VPN, when connected any site the uses navigate to locally on their computer show certificate errors, for example the site www.google.co.uk gets a certificate issued by FortiGate issued to www.google.co.uk. Do I have to import the FortiGate certificate to the remote users computer to get this working? the users are using their own computers and not on the company domain. I am quite new to FortiGate and just learning. ThanksJulian

Hi,I have problem on the branch fortigate it route all traffic to hq fortigate, and I cannot run fortiguard (Unable to connect to FortiGuard servers.) Forticloud - failed to load data etc.In the branch console I can ping all fortiguard servers, I can telnet to 514 ports like: execute telnet 173.243.132.171 514Trying 173.243.132.171...Connected to 173.243.132.171. on hq fortigate I see in logs that traffic from branch destined to fortiguard like: 13.248.131.62 173.243.132.27 are allowed and go out to the internet but these service are not working, in log I have something like:     [3038] fds_download_image_list: TRACE [41] fds_queue_task: req-1 is added to fds-update [579] fds_https_start_server: server: 13.248.131.62:443 [580] fds_https_start_server: source-ip: 0.0.0.0:0 [113] __ssl_cert_ctx_load: Added cert /etc/cert/factory/root_Fortinet_Factory.cer, root ca Fortinet_CA, idx 0 (default) [480] ssl_ctx_use_builtin_store: Loaded Fortinet Trus

I have a rented FortiGate 30E, this equipment is managed by a third party company, I have read-only access to check some information on the equipment. However, I need to know if this company is maintaining the necessary needs, I know that the equipment is in version: v6.0.14 build0457 (GA) how can I check, that is, where on the Fortinet manufacturer's website I can find out if there is an update for my equipment.   I registered on forticloud and when accessing: https://support.fortinet.com/Download/FirmwareImages.aspx it says that I don't have equipment covered by the contract. I don't want to download Firmware I just want to know which update versions are available. How to query this information? Thanks!

Hello Guys, I have problem when enable WorkFlow Management in Global Setting. As the articol https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/656084/firewall-policy , the option "Policy change summary " and "Policies expire by default " could be appear, but not in may situation.. like the pic below: But in vdom root, the policy have the option to set the Policy Expiration.. That's not possible remove the default expiration to zero days, like this tips in the 7.2.3 guide in the link up..."The default value for Policy expiration is 30 days. This number can be changed in the CLI or in System > Settings in the GUI to any value between zero and 365 days. If the default value is set to zero, the Default state will disable the Policy expiration." Anyone can help me? in the release note i didn't see nothing .. Fabio

Hello Guys,I have to convert one multicast packet to unicast to avoid to use PIM between two sites. Could I use some policies? Destination NAT? or what else with fortigate?

Hello, i want to connect a FortiGate 101E in the "Branch Office" over a VPN-Tunnel with a LDAP Server in the "Main Office". Over CLI i get a ping to the ldap-server, but over "User & Device" -> "LDAP-Servers" -> Edit LDAP Server -> and then "Browse" or "Test Connectivity" i only get "invalid credentials" bzw. "invalid ldap server". But the credentials are ok. And also the ldap server.Does anyone had an idea, why i can't get a connection to the LDAP-Server? If you need more information, please ask. Kind regardsTobias

I've taken over a few more duties and I am having trouble adding a native VLAN to the VLAN list. It's available on my admin switches but cannot see it on the guest switches. it's an allowed VLAN on the guest switches and when I try to add it to the native, it says it already exists. All switches are fortinet & 200E if that helps as well. 

Our FortiFone-480 desk phones are randomly experiencing ring delays after upgrading the firmware to 3.0.12.225. When there is an incoming call, some of the 480 phones will not ring for about 15 seconds. Not only is the phone not ringing but the SIP packets do not appear to be reaching the phone as it doesn't even show the line is in use. So far I have been unable to replicate the issue on demand but I am taking a long term net cap for one phone to see if I can see anything from that after this issue occurs again. Has anyone else experienced this?

Hi guys,As maybe all of you konw, there is a compatibility matrix file between Analyzer and fortios. we use it as a refrence for checking compatibility of fortianalyzer and fortigate. my question is that: is there any file for compatibility of fortianalyzer with fortiweb? or that file is for fortiweb too?thanks.

NULL

https://docs.fortinet.com/max-value-tableThis can be a really useful tool for figuring out how certain features will scale and what to be concious of when standardizing on certain models combined with your enterprises chosen features.  I'm getting lost at determining what each object is, apart from it's name.  There's no link to a full description on what the object is and what contributes to it's usage/capacity.  Some are obvious by there name, but others not so much.  How do network designers and implementers figure out scaling and capacity factors for objects that aren't so obvious by name? For example:user.fortitoken-Ok, that looks pretty straight forward - probably the maximum number of fortitokens that can be assigned to users on the firewall?user.fsso-polling-hmmm, im guessing this is the number of users that can be fsso polled - but only 20 for a FG-200F, that doesnt sound right so maybe it means something else? Where do we go to understand these t

Hello all, I'll try to explain my scenario. My office (192.168.7.0/24) has an ipsec to a remote location (10.133.3.0/24). My office subnet is natted to 172.31.19.0/24. So IPSec (tunnel mode, not interface) is set between 172.31.19.0/24 to 10.133.3.0/24. I'd like to use SSL to connect to my office (it's working), but i'd like to reach remote subnet (10.133.3.0/24). How to do this? Thank you in advance, Kind Regards,

Trying Python module "requests" on FortiManager URL with /jsonrpc, it is ok when doing method "get". But change to method "add", it returns an error code: -10147 and message: no write permission. Tried on different Fortimanager and get same result. FM version is 6.2.8 The admin setting on Fortimanager already enabled with "set rpc-permit read-write". Anyone encountered same problem?  

Hi, I am trying to eval FortiSOAR. I see in the documentation that upon deployment, you can activate the trial license after deploying the platform by logging into your FortiCare account. I did this and it said there was an error saying it couldn't sync with FDN. I logged into support.fortinet.com and could then see that the platform had been registered in my account (previously I didn't have any assets in my list), and that there was a license file. So instead of trying to login to my account to activate the trial, I downloaded the license file and uploaded from the same screen within FortiSOAR. This is a valid license file for 3 users and it doesn't expire (well not until 2122 anyway), but the same error about not being able to sync with FDN appeared. I can resolve and ping https://globalupdate.fortinet.net from the FortiSOAR server. Anyone else seen this issue before or know what else I can check? I'm stuck in a chicken and the egg situation w

Hi, Anyone had tried before access to the application directly from external without login to SSL-VPN in the fortigate.  Meaning does not need to login to SSL VPN.. but on the backend.. when they click on end user's application, it will pass in the login info via API to fortigate and fortigate validate with the SSL-VPN user profile. From: REST API documents

In FortiAnalyzer v6.4.8, from the Log View, I open the Chart Builder, and even though I have a 'Source' column in the logs which contains the source IP, it does not give me that option in the Chart Builder window. I does give the rest of the columns though. This can be seen below:

Hi! I am unable to toggle on any of the FortiGuard Spam Filtering features. I tried created a new profile but neither of the it works. Really appreciate if anyone have any explanations/solutions for this issue.   

Hello everybody, in my SMB I'm looking to switch to a new brand due to headaches had with CISCO ASA 5505/5506/5510 (Java required for GUI based configuration) and then NETGEAR BR200 (definetly a buggy/faulty product). After some reading and video watching, I think a Fortigate 40F can fullfill my needs. I just need one technical info I can't easily find: I currently have my LAN divided into 4 VLANs but I'd need to have more VLANs, let's say 6-8 VLANs. Can the Fortigate 40F handle 8 VLANs? Which is the limit?It should act as default gateway and DCHP server for each VLAN.It should handle different DHCP ranges for different VLANs. Is this product able to do this? Thank you.

I have this setup, where EMS is not published and the off-net profile is restricting malicious and security risk contents. Will the Forticlient be able to do restrictions with the configured EMS Profile if the EMS is not reachable. This also refers when the VPN is not connected. FortiClient  #ForticlientEMS

Hi,I have configured two ipsec tunnels between Fortigate_A and Fortigate_B with static routing and then added to sd-wan zone on both sides. I created ipv4 allow rules to allow lan to lan traffic, and this is not working, I mean tunnels are up established but cannot ping from lan to lan. So I addressed Ipsec interfaces, now the strange I can ping from Fortigate_B to Fortigate_A ipsec address but not in opposite. Ping are allowed on ipsec interfaces. How to troubleshoot this?

HiI have FortiEMS 6.4.8 and have problem with Thunderbird.this is exaple logW32/PossibleThreat, Last detected at: 2022-11-24 15:45:12, C:\Users\Dyzurny\AppData\Roaming\Thunderbird\Profiles\9ms2l7at.default-release\ImapMail\powiat.tczew.pl\INBOXand it's repeat many times. in TB i have cheked "allow antivirus clients to quarantine individual incoming messages" but no changes there are too many messages in the inbox to check one by one. the problem occurs with several users any ideas?

I installed that latest FortiClient on my debian 11 host. When I attempt to open the GUI, it get this error: $ forticlient gui The futex facility returned an unexpected error code. Aborted I configured my VPN server connection and verified that I can ping that server. When I attempt to connect, it starts attempting a connection but then fails with: $ forticlient vpn connect owems [owems] Connect VPN: owems Status: Connecting... Status: Disconnected Notification: Error: Can not connect to VPN server. DONE. I can connect to this server from my work setup where I am also running debian 11. However, when I connect there,  I get a popup indication that there is not a valid SSL cert for the connection and I have to click OK to ignore that warning and then the connection completes successfully. At home, on my debian 11 workstation, I never see that SSL cert warning when the connection starts. At work I am running:  $ lsb_release -a No LSB modules

My network (currently 1x GW, 2x dist switches, and multitude of access switches) is set up for mclag. Our ultimate goal is to have a full HA system. Our 2nd gateway hasn't been added till I resolve the layer 2 issues. Both dist switches connect to the gateway over a combined 8x ports, 4 per dist switch. The dist switches are connected to each other via 2x physical links (mclag-icl). All access switches were initially connected to one dist switch. As a second link is activated on the second dist switch, the entire network resets and all switches lose conn. It takes almost 45mins for the network to normalize. Traffic flows over both links when things work but we haven't tested removing one link for fear of generating another 45min long "hold your breath that things normalize" event. Any help on what we're doing wrong would be appreciated. Here's a config from one dist switch:edit "DIST-ICL"set port-selection-criteria src-dst-ipset description ''set mode staticset bundle di

Hello Team,Can we configure netflow in transparent vdom of a fortigate firewall running fortios v6.0.10 with no gateway IP configured.

Hello,I need to acheive the below scenario using Fortiauthenticator. SSID with self registeration captive portal, user register their devices.After device registeration, users should not login using their credentials, they should be automatically authorized by their MAC (previously registered) To achevice them, I have configured the following: 1- SSID with MAC filtering and automatice vlan asignment.2- radius policy on FAC for mac authorization.3- authorized macs should be granted access to the network (succeeded)4- unauthorized MACs : send access accept with the known three attributes to assign the host to a specific vlan (tunnel-type=vlan, tunnel-medium-type=ieee 802, tunnel-private-group-id=vlan-id (171)). This configured in the authentication policy which give the option to set "radius authentication response" to access accept for unauthorized MACs and to configure the attributes to be sent. 5- On Fortigate I have configured subinterface of the ssid (vlan-171),