Solved

Dear All Guru, i need urgent help. i have a 100D (V6.2.10)  in HQ office. i was able to create Site to site VPN to two other site office which is using 100D as well. Recently we have added a site office ( we called it C)  which is using 80E ( v7.0.5). i manage to create and bring up IPSEC tunnel between HQ and C. from C- C fortigate 80E able to ping HQ fortigate 100D- C server able to ping HQ server IP from HQ- HQ Fortigate 100D able to ping C fortigate 80E- HQ Server not able to ping C Server IP. The IPSEC tunnel already up between the 2 fortigate device, both device can ping to each other.  but the server from the HQ cannot access to the C network. i have tried open entire subnet for both side access but it is still not working. any idea if i miss out any setting?  Please help!  

Hi community! I'm interested in knowing if there is a way to download an installed firmware image from a FortiGate device through any transfer protocol such as SCP, FTP, TFTP, etc. ? According to this article we can actually push .out firmware images to a device via SCP with the command scp firmware.out admin@<IP>:fgt-image  What I am looking for is exactly the opposite. Is it possible? Thanks! 

Good afternoon!I am trying to connect two FortiGate 40F in HA and two different ISPs with a FortiAP 221e on the internal network. The architecture of the formed network is as follows:   the connections with the ISPs through the ISPs work correctly and the connection in HA also works as it should (I make the wired connection from the internal Switch to a computer, I run ping to google and when I disconnect the FG that is working as primary , only one packet is lost, making the switch from primary to secondary correctly). The problem is that when I perform such disconnection from the primary FG, the FortiAP goes offline and takes a long time to reconnect, leading to all client connections to the AP being disconnected.I would appreciate if someone could guide me on the following:Why will there be such a delay in reconnection to the secondary FG?Is this delay because I am using TPLinks Switches?Is there any particular configuration for the FortiAP in this situation?Thank you

Bear with me everyone, I have a very minimal knowledge of Fortinet products.  I can barely navigate using command line in these firewalls.  The Firewall I am working with is, from what I am seeing, an EOL product, the Fortigate 1240B.  I need to capture some simple information from this firewall for QA purposes.  I need to capture things like the BIOS Version, the FW Version, and the HW Revision. All I have been able to find is a FW Version, whether its accessing the fw_mgmt or the GUI.  Using command line I typed in "execute revision list config" and that gave me the FW Version.  I tried rebooting the firewall to go into the "BIOS" to see if it would give me any other information and I couldn't find anything.  Again, newbie user to one of these Firewalls, I usually work with CISCO and Redhat exclusively.  Any help you can provide would be awesome! Thank you in advance! 

Hello, based on the post : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restricting-SSL-VPN-connectivity-from-certain/ta-p/191997. It is possible to restrincting ssl vpn connectivity from cities in place of country? Thank you

Hello  I have a FortiGate 100D that has diskI have connected it with the cloud I would like to ask if I can change the 7 day store period?Is it possible from cli? Thanks and regards, Konstantinos

Good day!I am having trouble with my configuration, I can successfully established connection with both firewall but I cannot access the VLAN on the branch firewall. Here is my config: HQLocal Subnet: 192.168.100.0/24Remote Subnet: 192.168.50.0/24 BRANCHLocal Subnet: 192.168.50.0/24Remote Subnet: 192.168.100.0/24 Static Route HQ:Destination: 192.168.50.0/24Gateway: 122.8.182.207 Static Route BRANCH:Destination: 192.168.100.0/24Gateway: 222.81.180.201 My firewall policies:HQ FIREWALL VPN1:incoming interface: hq-to-branchoutgoing interface: lansource: alldestination: allservice:allNAT: disabled VPN2:incoming interface: lanoutgoing interface: hq-to-branchsource: alldestination: allservice:allNAT: disabled BRANCH FIREWALL VPN1:incoming interface: hq-to-branchoutgoing interface: lansource: alldestination: allservice:allNAT: disabled VPN2:incoming interface: lanoutgoing interface: hq-to-branchsource: alldestination: allservice:allNAT: di

We have about a hundread FGTs for a retail customer managed by FMG-VM. And we're about to roll out a FAP per FGT for 100 of them. All have the same guest SSID/VAP. But when I looked at AP Manager, under the SSID tab I seem to be able to see configured VAPs for each device(FGT). So when we need to change something on the common VAP with AP Manager, we need to change it one by one in GUI.Or, am I misinterpreting the menu and there is actually a way to set just one config of of VAP and link it to all 100 FGTs? If not, I'm now thinking to set up a CLI template group/CLI templates to configure the VAP and all other necessary "wireless-controller" config so that when something needs to be changed, we just need to change the template and push it to all FGTs. FMG-VM: v6.4.8 Thanks, Toshi

Hello.We had recently a security breach in our company (a user breach), the user shared his credentials to another user who access the LAN during vacation.The user logged using a cached user then connect to the vpn using a friend credentials.Is there a way to avoid this?I mean forced a Forticlient login to a specific computer, if it doen´t match drop the connection.In Windows i did that using Active Directory but it don´t apply the rule to the vpn.Thank you.

Hi, I have an issue with forwarding VIP port for local web server. The web server itself has port for example:Web server: 10.10.1.1:8081WAN: 172.16.40.50 so if in the port forwarding setting when I enter:External server port: 8080 or 8081and map to : 8081 won't work. but for the other web servers without port will work fine. Please advise.Thank you   

Hello,  I am trying to delete an IPSEC TunnelI see a reference of an admin user. In the details the below is highlighted gui-dashboard.0.widget.6.interface So I think that the user has created a widget in the dashboard.  How could I delete it in order to erase the Tunnel? Thanks and regards, Konstantinos

Hello everyone,  A user on Mac updated to the Monterey OS and updated his forticlient to the latest version.Before those updates he managed to connect to the VPN, but since the update he's unable to connect to the VPN (Network timeout). We are using the free version of Forticlient.Tried to installed the latest, also tried version 6.4.6.1378 and 6.4.7.1405 without success. We have several other mac with the M1 chip which are using the IPad version on their mac which works perfectly fine, but the other user can't install the Ipad version. Do you have any recommandation ? Thanks in advance for your help

Hi,I am running vrf on the lan (inside zone) switch . I don't have separate physical switch for dmz. So i am planning  to run the dmz on the same insdie switch .In firewall we create a vdom for  dmz ,In that case how many physical link I need from the lan switch to the fortigate firewall .Do I need separate link for dmz vdom ,Or  I can use the same link for the root vdom ?If I can use the same link what configuration requires on fortigate side and switch side Thanks

Please try to stay with me on this longer post... I've tried to shorten it up but there is a lot to relay on this one and I appreciate your taking the time and reading through it.. First off, Let me elaborate on that Subject a little. My user is currently configured to receive a token into my email account when I do things such as: log into any of our Gates, Connect to IPSEC VPN's, Log into our VMware Horizon virtual desktops, etc... I am receiving the token via a RADIUS Client on the FA where the authentication group ultimately looks at our AD environment via LDAP and/or FSSO so I can use the same credentials across several platforms. This works fine with the exception of an occasional delay in the SMTP conversation(s) which will occasionally cause the login to timeout before I can get the token input -  Other than that, I have been using this method w/o issue for a couple of months now BUT most everyone in the company are using FortiToken Mobile. I was recently ta

Hello, how to configure anti spoofing and statefull ??

Hello,I would like to process a report of IPS attacks sorted by geolocation (country) for the customer. I'm not familiar with sql - can I request a sample dataset or chart?FAZ 7.2Thank you. Jirka

Hello,I need your help to understand some logs for a rule : For example my rule contain : Src : IP_A, IP_B ...; Dst : IP_O, IP_Z, Service ; ftp(21),telnet(23)and tcp 6058 in my logs on the forianalyzer I can some others dst port value. It's possible? There are some explinations for that? Thank you 

Hello Fortinet CummunityI wonder how we can bypass access enforcement for the isolation logical networks.I can find it on the admin guide (check Access Enforcement section):https://docs.fortinet.com/document/fortinac/9.1.0/administration-guide/151724/model-configuration However actually on my GUI (FNAC 9.2.2) the only available options are "Enforce" and "Deny". I need this option in order to assign different Authentication networks for hosts depending on some of their attributes. Any idea on how we can do that? Cheers!AEK 

I have an FG-80C setup with LDAP authentication for SSLVPN. It' s been working great and we recently introduced FortiTokens for two factor authentication. The way I' ve set it up is by creating local accounts on the Fortigate unit and assigning the password field to LDAP lookups, along with the token s/n and adding them to an SSLVPN group. The issue we' re running into is case sensitivity on the usernames. I' ve got them all entered on the Fortigate in lower case and when a user logs in they are prompted for a token PIN code. Works great. However, if a user happens to put their username with an uppercase letter in the username, the Fortigate does not require a token PIN code and allows VPN access with just the AD password. I' ve got a ticket open with Fortinet support, but I' ve managed to stump the first engineer, so thought I would post here. They suggested removing the local accounts, but I/they were unsure how to bind the tokens to each user.

I purchased a fortigate 60D from eBay, it appeared to be unused.  When I booted it up and tried to connect with the iPad app I get a message “Unsupported version. This firmware version of FortiOS is not supported by FortiExplorer. You will need to use the Web GUI or SSH to configure this device.” I want to update the firmware and learned that you have to have an active support license to do so. But I can’t figure out how to get a support license or find out how much they cost. How have others out with this ?

Hi,a few days before, we made the Update 6.4.8 to 6.4.9. After this, the FG can't resolve any Hostnames.Ping with FQDN on FG CLI says "unable to resolve hostname". All rules that use FQDN doesn't work anymore. If I ping the IP-Address the FG is working fine. He also can ping the DNS. We didn't change any other configuration on the FG.Only thing I did after Update was this, cause I couldn't reach the GUI: "set admin-server-cert Fortinet_Factory"FG has configured the same DNS like every client in the network and all clients working fine!It is a FG100F. There is nothing special configured: In DNS-Settings there is only our DNS-Server / DC set with it's IP. I don't know what to do anymore. I tried to contact the support but for every answer they take about 2 days. I hope the FG community can help a little faster.

Dear Team,Is it supported FSSO to poll user-id mapping to FortiGate Firewall from Horizon RDSH servers?  Multiple users will have the same IP address while using RDSH.     

Hi all, I have implement Forticlient VPN with Azure SSO, and all seems to be working well. However I cant resolve hostnames, unless I specify the full suffix i.e. http://webserver.mycompany.lan, whereas on laptops / desktops I can reach it with http://webserver.  Is there something different with how mobile devices do DNS? I found the following tech doc, which outlines updating "set dns-suffix" https://docs.fortinet.com/document/forticlient/7.0.0/ios-administration-guide/597536/features I just dont want to impact anything thats currently working. We have a lot of VPN clients. Thanks.

Hi, I am trying to enable a newly created read only IPS profile on all FW policies. Is there a simple way to do this on the GUI, or would I have to script it into the policy config file? I can also see there is a CLI command "config ips global". Would this be an option for my requirements? Are there any potential drawbacks here?  Thanks.

Hi, I’ve been trying to configure a policy in Fortimail cloud that deliver mails from specific sender’s domain or specific mail sender to a specific internal mail account but I can’t figure how :(I want, for example, that all mails from example@gmail.com be delivered to example@internal.comThanks in advance