Solved

Hello,Looking for best way to configure one of multiple wireless 223E repeaters so it broadcasts on a dedicated 2.4 GHz SSID.  Is this configured at the switch MGMT port or on the repeater itself?  There are multiple units all with the same SSID and password and both frequencies active, so there's no control over 5GHz or 2.4GHz connection.  My device does not work with 5 GHz.  Thank you.

Hi all! I'm looking for a model of P2P Wifi antennas that would work to pass the Fortilink P2PL2 over it to extend some networks over 800 meters and some close to 2KM. I can't find any model that are certified to work with the Fortilink.  If you have experienced it successfully, I'd be very happy to hear from you.  Thanks !

Hello all Is it possible to add (external/thirdparty) lists of BotNet IP addresses in the AMP/AV profile or the IPS sensor? As far as I can see it is possible to add thirdparty/external AV-Lists, however, I am not sure if AMP/AV does check IP addresses or if those thirdparty/external AV-Lists need to be AV signatures.As far as I can see there is no option in the IPS profile/sensor to add external lists. So my best guess at the moment is, that it this is no possible - did someone do this by any chance and can confirm that it indeed might be possible? Thanks a lot, much appreciated

Hello Team, We’d like to acquire an SSL certificate to use in the Guest Portal of FortiAuthenticator, but I have some doubts: - The certificate needs to be issued to a public domain (public dns resolvable) or could I use a local domain (mycompany.local)? Example, issuing the certificate to the CN fac.mycompany.local would work? I ask it, because the company doesn’t have a public domain (mycompany.com, for example). The second and last doubt is if I can use a certificate with wildcard, for example issued to *.mycompany.local, is that possible in the FortiAuthenticator? And in the FortiGate, is that possible to use certificate with wildcard too? Cheers,Gui  

Hello guysI'm Facing a problem with the log's in the forti-cloud option meanwhile it's displaying in memory but not displaying in the forti-cloud option. it was able to show 3 days ago but not showing now. so logs not reflecting in reports also In log settings,1) Memory = enabled2) send logs to Forticloud = enable (added my email and tested connectivity)upload option set to every 5 min.3) Log setting Event logging & Local Log Traffic set to all4) GUI preference Resolve Hostnames & Resolve Unknown Application is enabled please help me to resolve this issue 

I am trying to configure the file filter to block ".scr" file extension which I see is missing on my FortiGate. Is there an alternate and/or customization to block .scr file extensions?  Firmware - v6.4.8

Hello We have an environment with two sites: Site A and site B. Both sites have a Fortigate in the edge.There is a Site-to-Site VPN between this two sites. We'd like to configure in the Fortigate from site B a NPS Server that is in the site A (through VPN). Is that possible? I have tried to do that, but the NPS Server is showed as offline in the Site's B Fortigate and never goes up to online. In the site A, the NPS Server is showed online and is working fine. Is there any configuration that I have to set to the Site's B Fortigate communicate with the NPS Server in the other side of the VPN? The subnet where the NPS is placed is in the "crypto map" of the VPN and there is a policy allowing the communication. Thanks in advanced.

Hi, I am new to FortiGate Firewall. I created a VIP with port forwarding to one of our internal servers. Do I need to enable NAT in the firewall policy? If no, may I know why?  

Hello all I have an odd issue:I have TWO different cluster of fortigates (four fortigate 1100E altogether, two active/passive cluster). On each of those cluster the port 25 and port 26 are aggregated to one interface.Now it turns out that the MAC address of this aggregated interface has the SAME MAC address on EACH of the clusters.Unfortunately those two clusters have this interface in the same network - so that poses an issue. Any one an idea why this happend and how I can actually change the MAC of an aggregated interface? Thanks a lot

I am using the free version with FortiGateCloud.The free version can save logs for 7 days.Please tell me how to extract the memory conserve mode log from the system log for 7 days.-In FortiCloud, it was not possible to filter by message.-When I downloaded and checked the log (.gz), there was a period when there was no record.Download on 2/22 → Logs can only be downloaded from 2/10 to 2/18Thank you.

Hi,I would need to include only F5 signatures in an IPS policy.Of course, I know that they can be added individually, only then if new ones come out they won't be added automatically or am I wrong?Is there a simple and effective way to include only F5 signatures and all new ones in case they come out?Thank you

Hi!I want to sort the column "last used" in "Authentication -> User Management -> FortiTokens" but it does not work.I can sort "Token Type" and "Status" for example, but not "last used"Also exporting the list does not seem to be possible.(I tried in Chrome and Firefox) Am I doing something wrong or is it a bug?  

Hi, What are the benefits of having Fortimanager to act as Fortiguard server for all the Fortigates which are in SDWAN fabric? . Fortimanager will be one of the DC LAN IP which has reachablity to all the branch Fortigate over SDWAN Fabric. My observation1 This will ensure that all database updates will happen locally within the fabric from Fortimanager to all Fortigates.2 Not each fortigate needed internet connectivity..3 Just ensure Fortimanager alone can speak with Fortiguard to get all the signature, database updates. Once this is done, it can push to rest of the device4 It can also avoid impact to Webfiltering/Email filtering service, since any high latency from Fortigate to Fortigaurd webfilter service can cause "A rating error occured" These are my observations, whether I am correct or any other benefits I have missed. Or anyother caveats in this setup.

Hello, I'm using FortiClient (7.0.2.0069) on macOS Monterey and I'm having a problem connecting to SSL VPN. Sometimes it connects, however, most of the time it does not, and when it doesn't the output says that I'm connected but "Bytes Received" does not move from 0.13 KB and "Bytes Sent" does not move from 0.5KB.  I've talked to our company's tech team as well as others, but we can't seem to find the problem. Does anyone know what could be wrong or have had similar experiences? Thank you for your time!  FortiClient  

Hi, I have a scenario..I have sdwan rule with source as 10.50.10.0/24 , destination as 10.90.10.0/24. Source is Spoke1 network. Destination is spoke2 network.. These networks interfaces are configured as vlan interface in the respective Fortigate devices. When I check the session for the source user PC (Took an ip as 10.50.10.11), it was hitting in the correct Service ID (Service ID 10) and end to end ping is happening.. But when I check the ping session with source as firewall Vlan interface (10.50.10.1) then I could see this session is through SDWAN default rule (SDWAN service 0). Since my vlan interface also falls under 10.50.10.0/24 my ping from vlan interface to other spoke IP should go through service ID 10 only but not sure why it is hitting default SDWAN rule (Service ID - 0). IS this an expected behaviour or I should raise a TAC case for this issue?? 

hi, I am trying to remove a local certificate and get an error message. Apparently the FortiGate believes it is in use, but there is no reference to this certificate as you can see by the zero in the last column.  This is a Staging certifcate from Let's encrypt and i need to replace it with a non-staging one. Can anyone help? FortiGate  

Hi,  Whether anybody has tried VM snapshot of Fortimanager (Without HA). If this is possible, once we restore the snapshot whether all the configuration, settings, logs of Fortimanager will be intact?. Since Fortimanager is a single platform which holds all the configurations of Fortigate, so would like to understand whether VM snapshot backup is enough to restore all fortigate configs, logs etc..

Since the last update to Android 12 I can connect to our company with Forticlient VPN app but only have access to servers IPs no server name, it looks like there is no routing thru VPN DNS. But more unusual, I am able to access domain names out of the organization, like google.com. I followed google instructions for Android 12 known issues with VPN, clear cache and data, uninstall and reinstall, networking settings to factory reset, but no luck. 

Hello, I'm trying to follow the admin guides on installing fortiEMS server while installing SQL remotely (we have a fully licensed SQL server). The instructions are very vague at best.  Does anybody have a good "step-by-step" instructions on how to install fcems on a remote sql server?

Hello to all . can someone please explain or point to relevent data about this interface and its uses   thank you very much .

Hello friends, does anybody know how to solve the problem of certificate-warning when using a self-signed server-certificate for the ssl-vpn on the Fortigate-firewall? I use the FortiClient to establish a vpn-connection to the FortiGate-firewall. I already added/imported the (self-signed) ca-certificate of the FortiGate-firewall to the trused root authorities on my pc, but this didn't solve the problem. I recognized that the server-certificate was issued for the wrong hostname. The server-certificate was not issued for the hostname to which I connect when I establish the vpn-connection with FortiClient. Could this be the reason for the certificate-warning? Can I issue a new self-signed ssl-certificate on the FortiGate-firewall to use it as the server-certificate (for the ssl-vpn)?

Hello Expert, The monitor section is not visible on my fortigate.I am trying to monitor my ipsec traffic do not see the Monitor options. Regards 

in my setup the firewall outside interface uses a private ip as my isp router forwards my public ips toward my private outside interface and my existing firewall is cisco asa and it have nat rule where it does port forwarding natting using the outside interface which is a private ip "192.168.10.2". I need to move this port forwarding rule to my new fortigate which will replace my asa. so in order to do this should I put in "external ip " my private outside interface ip and in the "mapped ip" I will put my internal server ip? 

Hi all        I have to install FortiClient 6.4 on ubuntu server 18.0 for remote access vpn but it's not working. Please see log information below. Please advice. ------------ Create VPN Profile ERROR"Failed to save client certificate password. Cannot autolaunch D-Bus without X11 $DISPLAY"-------------------------------------- administrator@forticlient01:~$ /opt/forticlient/fortivpn edit CTH-VPN-SSL ===================== Create new VPN profile: CTH-VPN-SSL ===================== Remote Gateway: XXX.XXX.XXX.XXX Port [default=443]: 10443 Authentication (1.prompt / 2.save / 3.disable) [default=1]: 2 Username: username Client Certificate (.p12 file URL) [default=None]: Do not Warn Invalid Server Certificate (y/n) [default=n]: y Failed to save client certificate password. Cannot autolaunch D-Bus without X11 $DISPLAY DONE. administrator@forticlient01:~$ ------------------ Check SSLVPN profile-------------------------------- administrator@forticlient01:~$ /opt/forticli

Hello Folk, We have a Fortigate with the following data.##FortiOS V6.2.10 build 1263 G##Fortigate 100 Since we upgraded to the latest Fimware we have a continuous micro cuts are connected approx. 30 users thought it was something internal but it is discarded because we rebooted and corrected errors in the switch and network ports. Also to test we ping the public router and it does not lose packets. But if I do it to the IP of an internal computer I always have the loss of 3 packets. I do not know if this is a bug, could you advise me how I can follow up and go discarding points. Regards