Solved

Hey everyone,Is anyone else getting this message when trying to launch a self-paced lab?“The Training Institute Lab platform is experiencing an unplanned outage affecting self-paced lab provisioning. Please try again later.”I’ve been trying for a while, but it still shows the same message.Is this a known issue or maintenance? Any update on when it’ll be fixed?Thanks!

Dear community, I am configuring DC agents to push logons information to Collector Agent (CA on dedicated server).I am using this msi setup command line:msiexec /i DCAgent_Setup_5.0.0302_x64.msi COLLECTORAGENTLIST="10.y0.xx.11;10.y0.xx.11" DONOTRESOLVE=1 IGNORELIST="mydomain\?*-s;mydomain\HEALTHMAILBOX?*" ENABLELOG=1My question is about IGNORELIST parameter. It seems that my DC agents is still sending information about service accounts (mydomain\?*-s) that are supposed to be filtered. This syntaxe is working well to filter at Collector Agent level, but I would prefer to filter as early as possible in FSSO process, so at DC agent level.The msiexec command is accepted, collector agents list param is well used to setup DC agent but not ingnorelist param.Thanks for any advices. 

Hello everyone, I tried to exempt an DDNS FQDN, but it still gets blocked by the FortiGate.SSL-Log:SSL connection is blocked, certificate-status: expired untrusted I tried with an Address FQDN object and also via this method https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-Exemption-based-on-FQDN-in-Proxy-based/ta-p/387569 . The connection to the FQDN still gets blocked. I also have to add we are using a different HTTPS port to reach the address (3438) and yes the remote certificate is expired since it came with the device.

"No logs from a device" rank top in the availability But, how to show which device not sending out the logs.  

I have three static routes to reaching my bgp Neighbour via ipsec tunnel by using ike/32 injection with same AD,metric and priority how fortigate will select the best path for bgp control plane message.@Jean-Philippe_P @msingh_FTNT @Anthony_E 

Newbie question here, I'm working in an MSP, and one of our clients Fortigate FW license expired which caused web browsing to be blocked. I've look into this and was able to get things working before we renewed the license. Our team is planning to give recommendations on purchasing a similar fortigate appliance with identical license but with different expiry dates. I just want to be sure if this will work, if the primary FW loses its subscription will the 2nd device take over if the subscription on it are still active?

Hello everyone,I’m planning to replace my current Vigor 3220 router with a FortiGate 100F as the main firewall and router for my network. Current Network TopologyCore Switches: 2 × Dell S4112F (OS10), N160-N161 configured as a VLT pair.Access: Dell N1148T Switches N162-N165 connected via trunk ports to Core Switch.Old Router: Vigor 3220 (172.16.16.221) Connected via 1Gbit Link to Dell N1148T -N162 Switch port52. SVLANs: 1 (Mgmt), 110 (Servers), 120 (Users), 140 (WiFi), 510 (Staging Server), 520 (Staging Users).FortiGate 100F (test LAN 172.16.16.222 :( connected to Dell N1148T-N162 on port 51 (trunk)Currently, all inter-VLAN communication happens at the Core Switch level (the Dell S4112F pair). Each VLAN has its own SVI and VRRP configuration on the cores.  Fortigate Test Network At the moment, I created two testing VLANs (510, 520) and added static routes on the core switches so that those VLANs go through the FortiGate: ip route 0.0.0.0/0 172.16.16.221ip route 10.5

Hi, we need to config remote-access ipsec vpn on fortigate. can configure using a floating public IP address?the routing for this floating IP is configured properly, should be routed to the firewall via internet and local internet router. Can someone please advise? thanks in advance! 

We currently have two sites, Site A and Site B, with identical destinations defined over separate VPN tunnels. Each site has a separate SNAT range using different IP addresses, so they know which location/route to send traffic back to. Both of our firewalls are setup as Central SNAT, and they are running 7.4.6. We're about to implement a new solution that requires us to change the destination IP range at Site B, so that the new system can check each path for dropped packets, latency, etc., and then it will send the traffic over the best path. For example, our internal host 192.168.1.1 currently sends to VendorA host 192.168.2.55. Traffic to VendorA is advertised exactly the same to both of our sites, but SiteA is the preferred site. SiteB will only be used if SiteA goes down. This won't work with the new system. What we need to do is to keep the destination for VendorA going out SiteA as 192.168.2.55, but we need to change the VendorA subnet going out SiteB as 192.168.3.55. I

I'm on the verge of buying the FortiToken 410, but it comes in a 5-pack and I'm running a one-man show network. Can I use the FortiToken for authentication on other platforms—like my email account, web hosting provider, or password manager? Your answer is very much appreciated :) Thanks in advance <3

  I am currently working on integrating FortiGate with FortiSOAR and facing an issue while installing the FortiGate connector.FortiSOAR Version: [7.6.2]FortiGate Version: [7.0.0]Environment: VM (CentOS/RHEL baseWhen I try to install the FortiGate connector using the following command: sudo yum install cyops-connector-Fortinet-FortiGate  I get the following error:Errors during downloading metadata for repository 'fsr-app':- Curl error (28): Timeout was reached for https://repo.fortisoar.fortinet.com/7.6.2/fortisoar/x86_64/repodata/repomd.xml [Connection timed out after 30000 milliseconds]Error: Failed to download metadata for repo 'fsr-app': Cannot download repomd.xml I have already tried the following:Verified network connectivity (ping to 8.8.8.8 and 1.1.1.1 works).Edited /opt/cyops-integrations/.env/pip.conf to point index-url to https://repo.fortisoar.fortinet.com/connectors/deps/simple/.Increased timeout and retries in pip.conf.Still facing the same is

We have just upgraded our 100F from 7.0.17 to 7.4.9 with 7.0 going end of support.It upgraded to 7.2 and then to 7.4 Everything seems to work fine with the exception of FortiAnalyzer Cloud. It's refusing to connect and send logs. We did upgrade the FAZ from 7.4 to 7.6.4 however it hasn't seemed to make any difference and both versions seem to support our Fortigate version. I have also removed the device and re-added it to FA Cloud still with no luck.  There's no access issues that I know of # exec ping fortianalyzer.forticloud.comPING fortianalyzer.forticloud.com.geo.fortinet.net (154.52.2.161): 56 data bytes64 bytes from 154.52.2.161: icmp_seq=0 ttl=52 time=20.6 ms64 bytes from 154.52.2.161: icmp_seq=1 ttl=52 time=20.5 ms64 bytes from 154.52.2.161: icmp_seq=2 ttl=52 time=20.5 ms64 bytes from 154.52.2.161: icmp_seq=3 ttl=52 time=20.5 ms64 bytes from 154.52.2.161: icmp_seq=4 ttl=52 time=20.5 ms--- fortianalyzer.forticloud.com.geo.fortinet.net ping statistics ---5 pac

Hi, I have been trying to access the training portal for some hours. I tried login with master account, did not work, sub-user, did not work. I even created different account. I am using my own FortiCloud account. By the way this worked yesterday. Anyone else experiencing this issue?Thanks in advance 

Title - self explanatory.  

I am wanting to change the hostname of our fortigates so they are more self explanitory. However we have a NPS server running and the NAS identifier is set to the present hostname of the fortigate.Is it possible to change the fortigate hostname and then also the NAS identifier on the NPS server? Will this impact anything else? Such as certs of other EAP settings? We are using EAP TLS with cert. for authentication.Also how would you do this for two fortigates with two different hostnames? Can you add a second NAS identifier in NPS under EAP TLS properties and Connection request policies?Thank you 

Greetings Hi guys, can I get some help with this issue please, these services are DOWN, running FortiSIEM 7.2 on Rocky Linux 8.8 (Green Obsidian) after fresh install it went down. (see the image) Thank you!

For some reason, my Fortigate 40F (v7.0.13 build0566) is losing the date and time settings when it loses power (maybe the battery is dead) and when the power comes back on, the Fortigate displays the message "Fortigate time is out of sync". I have already set the Fortigate to use the NTP server 200.160.0.8 but it does not work. When running the command "diagnose sniffer packet any 'host 200.160.0.8' 4" I can see the UDP requests being generated from my public IP, but no response is received.  In "Fortiview sessions" no sessions are displayed.If I define this NTP server on a LAN host it works perfectly.It seems that the problem only occurs when the traffic is generated by the Fortigate itself towards the IP 200.160.0.8. Could this be a bug in this firmware version?

In my test environment, I migrated from FortiEMS client 7.2.2 to 7.4.4.We deployed EMS on a Hyper-V VM.After a few manual tests, we'll migrate the remaining endpoints to the Linux EMS server by changing the EMS DNS record.How can I generate an overview of the EMS servers with endpoint connections/registrations?

when connect to FortiClient by laptop we lost the internet connection during VPN connecting (IPsec VPN), but when we use a mobile we don't lose the internet. How can we keep the internet connected using the laptop?note that the default route exist, the ping to 8.8.8.8 stopped even the default route exist

 Hi all! I am working with a FortiGate firewall that has an internet connection with a static IP.Our goal is to route the default gateway through an IPsec tunnel that breaks out via the headquarters. When configuring SD-WAN, a default route (0.0.0.0/0.0.0.0) is created toward the SD-WAN zone.Inside this SD-WAN setup, the IPsec tunnel is included with a performance SLA, so that the route is automatically disabled if the tunnel becomes unavailable. In this case, traffic should then fail over to the physical WAN interface.However, for the IPsec VPN, an inbound and outbound policy is required without NAT.These policies are placed at the top of the policy list: from IPsec to SD-WAN, and from SD-WAN to IPsec.The complication arises when the physical WAN interface is also placed inside the SD-WAN zone.In that scenario, NAT is required; otherwise, internet traffic via the local ISP will not work. One possible solution is to configure the physical WAN interface outside

I have an upcoming job where I’ll be installing and configuring a FortiGate to serve as the edge router at a facility currently running an all-Cisco internal network (from a previous contractor). The long-term plan is to replace all Cisco devices with Fortinet gear, but to avoid downtime, the Cisco network will continue operating through the FortiGate for now.Currently, a Meraki MX400 is acting as the edge router. Since we’re unsure of its configuration and I haven’t worked with one before, we don’t want to remove it yet. Instead, the MX400 will connect to the FortiGate, which will then connect to the ISP. We’ll begin building the new network off the FortiGate while keeping the existing Cisco network running through the MX400.The MX400 already performs NAT, so I want to avoid double NAT on the FortiGate. Would the correct approach be to create a firewall policy on the FortiGate for the interface handling Cisco traffic and simply disable NAT? 

Hi! Recently the new FortiOS 7.6 was released, so being an enthousiast I upgraded a new F40 straight out of the box.After the update the devices booted but I could not reach it by it's default IP.Booting the device via console, I got error messages about interfaces en the configuration. A few of these messages are:Initialize config error 44010The config file may contain errors.Please see details by the command 'diagnose debug config-error-log read'. The initial boot gives strange characters until it shows "system is starting" and after that everything is perfectly readable.After the device booted I am unable to type anything in de commandline.So, after this line it is stuck: Please see details by the command 'diagnose debug config-error-log read'. I also tried different serial configuration (baud rate etc.). But that doesn't do the trick.During boot I'm able to press a key but all the characters are gibberish, so a flash format is a challenge.  I

Anyone know are we able to query the SDWAN SLA performance to geeting information about jitter, packet loss and latency using CLI, SNMP or any other way?I have requirement to insert the SLA performance to the SQL database so I can make custom report for specific SLA performance.If we see in the SDWAN performance SLAs there are graph but is limited only to 10 minutes time window and i need more longer.

I recently purchased a Fortigate 50G, and the firmware on the device is v7.0.17 build7598 (Mature). I see possibility of upgrading beyond 7.0.17 but it doesn't see to be possible through the GUI. Also when I check the Firmware images available in Support section of Forticloud I don't find any firmware for 50G, I find them only for 50G-5G.Any info how I can upgrade?   

Hello,one of our customers will like to know if is possible to setup FortiMail FortiSandbox configuration so, that it will not prepend "[Scan Notification] Attachments are held for scanning" text to body and subject, when the message will be processed in the fortimail sandbox for a long time? ThanksMarko