Solved

Last night one of FWF60Es' upgrade process for 6.0.10->6.2.7->6.2.9 caused the device to be offline in the first step (judged based on saved config revisions). Likely the first reboot got stuck and can't come up with 6.2.7 since the public IP on wan1 interface is not reachable.We're hoping it would come back up after a power-cycled in Mon morning by the customer, but we don't want to get the upgrade process resumed for obvious reason. The customer would experience extended outage in busy Mon morning. I'm looking for a way to suspend the upgrade process at the point with 6.2.7. Then want to resume it at Mon night. I so far couldn't find a menu to do it in Firmware page on the FMG. Is this possible? Thanks,  Toshi

Hello,there is a need to extract the details of all configured policies with the details of when they were used.We managed via FortiGate  / FortiManager  to export the info but for all policies the fields after Hit count in the image below (first used, last used, etc...) are all emptyIs it not possible to export that information even if it is present?

Hello Everyone.   So, I'm managing a client's Azure deployed fortigate, which has some local-in policies i'd like to get rid off, so it won't accept connections on a specific interface.   The problem is that the local in policies are not editable via gui, and via cli they don't even show. I can create new ones and all but, I would really like to simply delete the ones i don't need.   Even on a show full-config output the local in policies dont appear.   Anyone know how to delete these policies?   #fortigate

Hello, I hope that someone can give some explination about my issue. some rules in the Fortimanager have 0 Hit Count but I have a date in the colum Last Used, how can to explain that? Can someone explain that to me please? or it's just a bug? Thank you 

Hi,On one of my 200E firewalls, after some time, logging to memory does not show anything but after restarting the device it comes up and working. Any way to troubleshoot and solve the problem? Regards,

Hello, I can't find an answer to this question anywhere; what exactly does FMG-Access mean? Thanks!

We have many customers who have an IPsec VPN from customer's each location with an FGT/FWFrouted all internet traffic over the VPN toward the customers centralized FW VDOM in our core network.We manage some of larger customer's CPE FGTs/FWFs by our FMG-VM so that firmware upgrade for those CPE's can be done through the FMG relatively easily. A problem with this arrangement is all firmware download for the upgrades have to come through the centralized FW VDOM so it gets congested and takes longer time due to the distance to travel when we run upgrades for many locations at the same time even if we specify FMG to let the device directly download from FortiGuard services. An obvious solution is to split the tunnel to let the CPE devices get to FortiGuard servers outside the tunnel. So I opened a TAC case to ask what FQDNs I need to set static routes to go outside the tunnel while the default route (BGP) comes over the tunnel. I initially got three FQDNs euupdate.fortinet.ne

Hi, We are switching our firewall to Fortigate and will be using SSLVPN with local users.Is there a way to mass create users or import it from a csv ? Thanks

Hello I'm a newby with Fortimanager and I'm having issues when having to make changes on managed fortiswitches.I have fortiswitch "central management tick" untiked for my ADOM.If I have to make a change on a FSW port (name it asign a vlan or change a description), I go Fortiswitch Manager / Fortigate / Fortiswitch / Ports Configuration and edit the port that I need. After I have made my changes, are those supposed to be automatically deployed to the Fortigate and so to the Fortiswtich?Do I have to run the install wizard? my point here is that install wizard could deploy several other changes + the ones that I need for my switches? Thank you very much in advance. 

Hello everyone, is there a command to manually send an ARP request for a specific IP on a local interface? What I'm looking for is a functionality much like the 'arping' tool on Linux. My usecase is determining whether there is a duplicate IP on a directly connected network. Kind regards,Lupo

Example 1 works fine.  Example 2 fails with a 403 status code.  RestAPI Admin account is a super_admin with access to Global.  debug cli on Fortigate shows no communication for 2 but full communication with 1.  Scratching my head on this for a few days now.  The "password" option seems to break it.  These command come off the Fortinet Developer Network 6.2 API page.  There is no password complexity requirements on this Fortigate. Works Ex 1: curl -k -X PUT "https://FORTIGAGE-FQDN-HERE:443/api/v2/cmdb/system/admin/USERNAME-HERE?access_token=ACCESS-TOKEN-HERE" -H  "accept: application/json" -H  "Content-Type: application/x-www-form-urlencoded" -d "{  \"name\": \"USERNAME-HERE\",   \"comments\": \"This is a comment\"}" Fails Ex 2: curl -k -X PUT "https://FORTIGAGE-FQDN-HERE:443/api/v2/cmdb/system/admin/USERNAME-HERE?access_token=ACCESS-TOKEN-HERE" -H  "accept: application/json" -H  "Content-Type: app

Dear all I am new to Firewall Technologies and I want to ask Regardless of statefull Firewall feature. A statefull firewall maintains the tcp state and knows a user session so why do we need to allow a user to allow in both direction incoming and outgoing for same traffic if the state is already known when the user requests the session is known and the firewall knows for the returning also 

Hello.We've configured a custom signature to detect Login Brute Force Attack against SMTP service:F-SBID( --attack_id 9419; --name "SMTP.Login.Brute.Force.Custom"; --protocol tcp; --flow from_server,reversed; --pattern "Authentication failed";--no_case; --context packet; --distance 4,context; --within 40,context; --rate 5,30; --track dst_ip; )It is include into our IPS profile. We're using SSL inspection profile (protection ssl server).That signature works fine for SMTP (port 25) and SMTPS (port 465), but it doesn't work for SMTP submission (port 587, encrypted of course).Anyone has configured a custom signature to protect SMTP submission?Thank you!

I know from the dashboard under license will show as below, but how do i see it from the last few month?Used GB/Day  Today(Jul 20, 2016)0.27 GBJul 19, 20160.61 GBJul 18, 20160.61 GBJul 17, 20160.25 GBJul 16, 20160.26 GBJul 15, 20160.63 GBJul 14, 20160.65 GB

i recently joined a new place and found a network is running on native vlan from fortigate hardware switch interface. i have many ports free on firewall and i want to create vlans for all services and remove the network from native vlan. Can you please guide me how to create vlans in the same hardware switch interface and allow the vlans to communicate with my cisco switch connected to Fortigate.

Hello, We are new to Fortinet products, having just purchased a Fortigate (FG-60F) and setting it up as a VPN site router/firewall, to connect back to our headquarters. We have created the VPN tunnel etc (mostly via the wizard), which sends all traffic from 0.0.0.0/0 to 0.0.0.0/0 down the tunnel. This works as expected, as we wanted all traffic, including internet, to hit our headquarters. The problem is that the Fortigate itself is unable to access any FortiGuard services. We assume this is because its own internet requests are being sent down the tunnel. We have tried to split-tunnel the VPN using policy routing but to no avail. The biggest issue we seem to have is that we are unable to specify the Fortigate itself as a source to exclude from the VPN rules. Can anyone with more experience point us in the right direction? How can we send ALL traffic down the tunnel EXCEPT FortiGate's own update/maintenance requests? Thank you

how to access from outside (my host ) with putty to internal VM ubuntu server of fortigate VM 7.2.0?my ubuntu server is inside the fortigate and i want to access it from outside(my host) with putty 

Hello everyone, I have a problem with internet blocking on production computers. If I disable Internet access for this network, I have a problem with windows / linux updates and additionally after entering my server in the local network, my site after https is dangerous because the computer cannot connect to verify the certificate. Any ideas?

I was checking the fortigate and when I entered the events tab I appeared many times the event of cmdb lock deadlock is detected and when I want to make a change in some policy it does not save anything and it gets stuck. What does this event mean, and why can't I make a configuration? 

I want to create a vlan interface by the REST API on a FortiGate. Here is a JSON code:{"name": "vl405","vdom": "prod","mode": "static","dhcp-relay-interface-select-method": "auto","dhcp-relay-interface": "","dhcp-relay-service": "enable","dhcp-relay-ip": "\"x.x.x.x\" \"y.y.y.y\" ","dhcp-relay-type": "regular","dhcp-relay-agent-option": "enable","ip": "z.z.z.z 255.255.254.0","allowaccess": "ping","speed": "auto","status": "down","type": "vlan","interface": "ag_inside","vlan-protocol": "8021q","vlanid": 405,"alias": "VDI",}When I POST it, I get this result:{"http_method": "POST","revision": ".....","revision_changed": true,"old_revision": ".....","cli_error": "current vf=root:0\nentry not found in datasource\n\nvalue parse error before 'prod'\nCommand fail. Return code -3\nCommand fail. Return code 1\n","error": -3,"status": "error","http_status": 500,"vdom": "root","path": "system","name": "interface","serial": "FGT3KDT.....","version": "v6.4.6","build": 1879}I created the interface man

Hello, On the Fortigate 80E (ver7x) we need to set up access from VLAN2 (WAN2 / ISP2) to VLAN1 (WAN1 (ISP1). On the firewall we have two Internet connections (WAN1 and WAN2) and internal networks VLAN1 and VLAN2. Under VLAN1 is an internal HTTPs server (accessible from the Internet via DNAT), assigned to WAN1. Under VLAN2 is the guest network, assigned to WAN2 (another ISP). Now we need to access this HTTPs server from guest VLAN2/WAN2 but we are not able to do it. We've tried something within the firewall and address translation, but to no avail / I'm out of ideas. Thanks for the help

Does the SD-WAN feature for FortiGate (600E for example) requires per year license?

Followed the manual from this post: https://community.fortinet.com/t5/FortiGate/Technical-Tip-ACME-certificate-showing-not-secure/ta-p/195496I Cannot find a way to forcing the letsencrypt certificate to be renewed with the correct url.The post itself is correct, but needs some more steps.. 

Hi,After upgrading from 7.0.5 to 7.0.6, I noticed all my proxy policies and any configuration related to proxy service are gone. I had backed up global configuration and tried to restore it but still those proxy configurations are not back. Any bug or me-made mistake here? 

Hello, Fortimail appliance comes with 2 disc to import in hyper-v or vmware.OS disc and logs disc. I presume you can't expand those discs in vmware for Fortimail appliance.How to expand disc if disc is full? Another question about discs.If you importing fortimail appliance disc to vmware can you choose thick or thin or only thick