Solved

i Noticed that the logs on my Fortigate is stuck at 22-April.eg. web filter and email filter logs when viewed from Fortigate Logs and Report and from my FortiAnalyzer latest logs is until 22-April. I cannot see any logs from 23-April to today.How do i check whether my logs is working properly 

Hi, Long story short:I have created CSR on Fortiweb, CSR was signed and cerficate was imported on FortiWeb My question is:Is it possible to export private key and import it to the backend server?  The probilem I see here is:Private key is password encrypted (duh?), but there is no option to specify password during CSR creation, so I guess the password is automatically generated during CSR creation. I tried changing the password in CLI:conf sys cert localedit "cert1"unset passwdset passwd somepasswordendbut I get an error:Command fail. The configuration of a certificate can not be changed from CLI except the comments. Am I missing something here? Or this is just not possible? 

EnvironmentFortiGate 100FV6.2.9 Build 1234 Cloud EMSV6.4.4.1658 Has anyone upgraded from 6.x to 7.x for Cloud EMS? According to support, it just a case of converting the EMS licence.My concerns are as follows:Will this still be compatible with FortiGate (according to the compatibility chart I should be OK)?How will be affect my existing EMS 6.x VPN clients?Should I schedule the convert out of hours (even though this is a licence change)?I presume the EMS console will expose the option to create 7.x FortiClient installers alongside the existing 6.x created installers?Any advice would be welcome. 

Hi. I have fortigate 600E with 6.2.10 firmware. I have 3 DR (3 ISP internet connections) which the traffic from my servers goes to the internet. To determine which of the 3 lines the source from my server traffic leaves, I use policy routes. Now I would like to configure a SDWAN with 2 different internet lines, for other pourpuses, in addition to the 3 that I already have. When trying to create the new default route I read this message "You cannot have duplicated routes on SD-WAN and non SD-WAN interfaces." I have read about it and it seemed to me that what is usually done is to put all the lines in the SDWAN (the new and the 3 that it had) creating the default route to the SDWAN. Finally, create a DR that goes to the SDWAN (eliminating the current 3) and with SDWAN rules control what goes out through each line. I would like to know if it is correct. On the other hand, I would like to know if this would generate any problem in the servers that go out through the 3 DR that I have, for e

Hello @All, for internal testing, I have set up our fortiweb with an internal and external virtual IP.If I'm using the internal virtual IP for my profile under Policy / Server policy, I get my replacement message screen and everything is fine for internal communication.If I change the same Profile to my external virtual IP I only get a Login Prompt.After input my date the communication works fine but no replacement message at start. Has anyone an Idea what could be the Problem?Fortiweb OS: 7.0.0 Many thanksTBS

My organization is currently reviewing IOC and I been reading about it. However, I can't find answer to one thing, what if its a false positive and we know it and we want host to access the internet and remove it from 'compromised host' tag?

I see the FortiOS and Fortigate Image on Fortinet Support.I'd like to know how are there different?Note:1. Port1 is a management port (cannot use in firewall policy) I tried to change port name but it's not work.2. port 2 is a port1

Hello all,  i have here an Fortigate 60E with enterprise bundle. It is possible to combine it with an Layer3 FortiSwitch 448E without subscription? Is the Switch restricted without subscription? This time i have an HP29xx series as Layer3. However, this does not work optimally with the Fortigate. I thought a Fortiswitch would be a better choice. Especially in device detection and IOT.  Very ThanksBest regards IPranger

Hello @All, I'm looking for a configuration example how to configure a Fortigate to communicate to a Fortiweb like on this example:If a Client on the internet communicate over a public IP of Fortiweb Virtual Server, how to configure the Fortigate to send the traffic to Fortiweb.Is that just a NAT Rule? Fortigate and Fortiweb are on latest Firmware. Many thanks for helpinggreetings TBC    

Hi Guys, i need to delete an expired local certificate and upload a new one but the delete botton is grayed out and i've no access to CLI (i access directly to the public ip address), how can i replace it?if i try to import the new one i'm promped this: "Certificate file is duplicated for CA/LOCAL/REMOTE/CRL cert."hardware is FortiWiFi 60F Region-E thanksregards  

Dear Fortinet Community!FWF30E-3G4G (6.2.10)  is using onboard LTE modem with SDWAN. It works only with direct routes, and doesn't work  with static route sdwan--> 0.0.0.0. LTE gets dhcp address with /32 mask - so there is no any gateway... If I downgrade it to 6.2.9 - everything is fine, LTE gets /30 address with normal gateway. Asking here to see if anybody recently had this issue. Thanks!

Hello @All I have configured sslvpn on Fortigate OS 7.2.0.On Win10 Client Login Works, Ping IP and FQDN to system are working too.If I'm using nslookup I get DNS request Timeout.If i using ping -a I can Ping but no name resolution. My configuration:Under Network DNS Server I have configured LAN and SSL-VPN tunnel interface.DNS Database are configured our domain with both internal MS-AD-DNS Server.Under VPN sslvpn setting there are also both MS-AD-DNS Server configured. Is there anything wrong in my configuration?Also, i have no nslookup on Fortigate CLI Many thank's for helpingTBC 

Hi,I need to set a rule to deny any one RDP to a server, not just TCP 3389 but on any port.I know this can be done using IPS security profiles but there is a problem: When I set the rule to deny, no IPS profile may be selected and in the rule I can only choose RDP service which is TCP 3389. IPS profiles and exceptions within can only be selected when the rule is an Allow type. So? In short, I need a rule to deny RDP protocol with any port (default or non-default) to be blocked toward a specific destination. Regards, 

Has anyone gone thorugh the exercise of bundling the free Forticlient (6.0.x) MSI into a package for mass distribution throughout their enterprise via SCCM?  Any pointers, suggestions, gotchas that you ran into that you're willing to share? We're also trying to figure out how to bundle/pre-package our default Forticlient settings (Connection name, Remote Gateway URL, etc.) into the package - any recommendations on the good way to insert this into the package would be appreciated. Thanks, T. 

How do i enable email filter logs in Log and Report ?my FortiOS is 6.4.8. i can see web filter, Antivirus, web application firewall, but email filter is missing 

I am using the SSL-VPN tunnel interface (ssl.root) in a zone. But in the vpn ssl configuration it does not detect the policy created using the zone instead of the interface.There is a document that indicates that this configuration is possible.https://docs.fortinet.com/document/fortigate/7.0.0/new-features/538358/use-ssl-vpn-interfaces-in-zones-7-0-1But I am trying version 7.0.5 and it does not work.Here is the zone:This is the policy:But in the ssl settings apper the missing policy error:Has anyone had this problem? 

Hi Everybody,some time ago I have done a network segmentation in the headquarters based on zones (client, voip, server) and numerous policies. Now I have to do the same in a remote seat (IPSEC VPN). The remote seat  have the same logic as the main office, although not all VLANs are necessary (only client, VOIP). All routing between the VLANs is done at headquarters. I would like to avoid the following solutionUsing multiple interfaces in the policies because i lose the "Interface Pair View".Duplicate policies (this makes administration more complex)my ideaMultiple IPSec VPNs (with diffrent public IPs in the main site - parameter "set local-gw") - one VPN per VLAN, whereby its interface can then be added to the corresponding zone and the existing rules are then used automatically. Since I don't have a test environment, I wanted to ask beforehand whether this is even possible (routing..) or whether I've overlooked something here? Graphic for better understanding.Thank

HiI'm running FortiOS v7.2.0,build1157,220331 on FortiGate-200EI enabled DNS Database in Feature Visibility and configured it like this: config system dns set primary 1.1.1.1 set secondary 1.0.0.1 set protocol cleartext dot doh set server-hostname "one.one.one.one" set domain "test.local" end config system dns-server edit "port3" set mode forward-only next end config system dns-database edit "Test" set domain "test.local" set view public set authoritative enable config dns-entry edit 1 set hostname "@" set ip 192.168.5.15 next edit 2 set hostname "asd" set ip 192.168.5.15 next end set primary-name "dns1" set contact "host@test.local" next end (The IP Address of port3 is 192.168.5.1) The firewall doesn't respond to DNS for this domain and for

Hello @All, I have reed this Post: Technical-Tip-SSLVPN-Idle-timeout-not-working Is there any chance to solve the problem without changing anything on Client Side? Many thanksTBC

Hello everyone, Where i work we have a Fortigate 400E unit and I have some doubts on how to manage internet access for some of the users, we are using the profile based mode: Heres the scenario:Sales department have a firewall rule "Sales department internet access"Marketing department have a firewall rule "Marketing department internet access"General managers have another firewall rule for them aswell. Those internet access rules have different levels of access. For instance, general managers can access more websites than sales or marketing departments.  So far this is working, not issues at all. But sometimes a user from marketing or sales department gets assigned a task that in order to get it done he/she must have access to certain websites that are not allowed in the original policy. So, i need to give that user (and only that user) the permission to access the new websites he needs to access, but i dont want to give that access to the whole sales or

Not sure if this thread belongs here.My client has a fortigate firewall and may want to activate forticloud.What is the procedure and is payment necessary?

Is there any way to properly shutdown a FortiGate-manged FortiSwitch without having to ssh into it from the FortiGate CLI? Also, how about doing so remotely with FortiCloud? (There's a way to reboot FortiSwitches from the FortiGate GUI and CLI, but not easily from FortiGate Cloud and not at all from FortiExplorer iOS) The best thing I have been able to come up with is not very convient for remote use and it only sort of works: 1.) On the FortiGate define a custom-command to send to each of my 2 FortiSwitches:  config switch-controller custom-command edit "shutdown-sw-custom" set description "shutdown now script" set command "execute shutdown" next end   2.) Invoke the commands from the ForiGate CLI, or from FortiGate Cloud define and deploy a script containing the commands:  execute switch-controller custom-command shutdown-sw-custom <FortiSwitchF124SerialNumber> execute switch-controller custom-comman

Hello, I'm using FortiLAN to manage a number of FAPs.Now it looks like we're going over 30 managed FAPs. In the datasheet I see that up to 30 FAPs is free (and 3 switches and 3 sites), if you go over you need a Advanced Management License, does that mean we need to purchase 1 licenses if we have 31 FAPs, or do we have to purchase 31 licenses?Thanks.

Hi all, I would greatly appreciate help in resolving a problem I have with FG-80F and FAP-433F both on 7.2.0 where I'm trying to bridge WiFi with local interface using VLANS, without software switch.Configuration:System/Settings/VLAN switch mode: onports 1-4 as "internal_LAN", VLAN Switch with VLAN 167. This interface is configured with an IP and DHCP. All hosts connecting to this IF get IP fine.ports 5-6 as "internal_IoT" - VLAN 50, I've tried different configs but for now it's unconfiguredFAP is connected to FG port 4 (which is internal_LAN)"WiFi_LAN" SSID for my LAN is configured as "bridge" and since it is physically connected to VLAN 167, it works fine bridging WiFi with LAN.I'm trying to create a "WiFi_IoT" as bridge specifying "OPTIONAL VLAN ID" 50 and have it bridged with "internal_IoT". Here is what I've tried so far.Software switch: SS requires tunneling mode for SSID but then it's pretty easy, add SSID and unconfigured physical interfaces into it, configure SS with IP a

we are doing some relocation of the FAZ200D, after shutting down, i cannot find the power on button to power up the FAZ.is there any method to power on the FAZ200D ?