Solved

Hello,     We are a mid-sized school in Pennsylvania, 4 buildings + admin, 3000 students etc. We are looking to replace a couple of 7+ year old SonicWall nsa 6600 devices with compairable Fortinet or PaloAlto devices, and I'm heavily leaning towards Fortinet because of a bad PaloAlto experence a number of years back at a different job. What is the suggested Fortinet hardware that would be compairable to the SonicWall 6600s that we have now? Currently we have dual fiber lines coming in from our primary ISP and a second fiber line coming into from a fall over ISP, All connections are currently registering as 1Gbps connections, although I'm checking with our Primary ISP if that is the true speed or just what our SonicWall is tapped out at. thanks in advance. 

I have FG 100 E, and I have it setupDHCP ServerAddress range 192.168.2.2-192.168.2.254Netmask 255.255.255.0is there something missing so that some devices sometimes can't get the IP address                                     Thanks.

Hello admins, Are there openings to become moderators in Fortinet forum?if so, would you please share details.Thank you

I am new to FortiClient EMS, I am installing and configuring at the moment. I can see that the FortiClient download URL is https://servername:1443/installers/ I am planning to configure IIS to run another website on port 1443.  Is there a way to change the FortiClient download URL to a different port? I am not sure if I can have 2 websites running on the same server with the same port.Please advice 

Hello all - new to Fortigate Central Nat and just wanted to run something by the community here.Looking to exempt NAT for a specific source and destination - while maintaining NAT\PAT to internet bound destinations for the same source. My questions are, can a "No NAT" rule be created\utilized in Central NAT, and how are the rules parsed\ matched ? Assume top-down correct? Here's an example of what I'm after - 3 interfaces on the firewall. I just want to NOT nat the Forti voice ip when the destination is the CCUM server ip. Can I create a rule with those sources and destinations and just turn NAT off -then create a rule below for everything else internet bound?  Thanks in advance all inside – outside – any – any – NAT\PAT  - to internet hosted –outside – Fortivoice IP – CCUM IPs– no NAT hosted – outside – any – any – NAT\PAT - to internet 

Good morning everyone.I need to configure an SMTP external to my administration on my FortiAuthenticator (v.6.6.2) to forward FortiTokens.I would like to use the Fortinet service "notification.fortinet.com" as SMTP, but I can't configure it to work.Can someone help me?Thanks.

Hi, I want to block custom files (bin, ova, ovf) on FortiProxy. I couldn't find these files in the file filter field. How can I block them? Has anyone done this? I would appreciate your support. Best Regards,İsmail Ürek

Dear Experts, When IPsec VPN at IPsec aggregation with SD-WAN is down, Trap fgTrapVpnTunDown(1.3.6.1.4.1.12356.101.2.0.302) is not sent,although "VPN tunnel down" is enabled at SNMP events.For information linkDown(2) of MIB 1.3.6.1.6.3.1.1.5 is sent. Can someone tell me how & what I should change so that fgTrapVpnTunDown is sent? Thanks in advance. 

Is it possible to make the Fortigate route traffic in this way:External dns pointing to fortigate public ip > fortigate external interface > route the traffic based on dns to a internal IP ONLY if it matches the requested dns?example using other dns names:google.com > 8.8.8.8 (fortigate external ip) > 192.168.1.200 (internal system) Essentially asking if the fortigate can serve the same purpose as a reverse proxy which checks source packets trying to match dns and redirect to a local server. I hope i explained in a understandable way and thanks in advance.

Hi, I have a problem with forticlient 7.2.2.0776 on Mac OS Sonoma 14.1.2.When I'm connected to forticlient for a specific customer, I can't access Internet at all (email, Teams, web browser...). However, when I log on to the same customer via forticlient on a Windows computer I don't have the problem. So it seems like an issue related to my Mac. But what is strange is that I have another customer who uses forticlient and when I log on to that customer on the same Mac, I have access to internet, so it doesn't seems related to my Mac after all. I'm very confused and don't know where the restriction is- Is it something that I should do on my Mac (but if yes why it's working for another customer on the same mac?)- Is it something that the admins of my customer should do on their side (if yes, do you know what they should do?) RegardsYoan.

Hello everyone,I’m planning a new installation for FortiNAC and I’m trying to decide between FortiNAC 9.4 or FortiNAC-F 7.6. I’m not entirely sure about the key differences between the two versions and which one would be the best fit for my needs.Could someone please explain the differences between FortiNAC 9.4 and FortiNAC-F 7.6? Specifically:What are the feature differences?Are there any performance or scalability considerations?Which one is more suitable for a medium to large enterprise environment?Additionally, if anyone has experience with configuring either of these solutions, I would greatly appreciate any tips, best practices, or even a step-by-step guide to help me get started.NB: my licence is : FortiNAC Control and Application Extended VM Certificate (FNC-CAX-VM for 2 VMs)(LIC-FNAC-PRO-100)Thank you for your help!Best regards,

Hi, We are planning on rolling out a handful of Fortigates 90G - currently we have 3 setup in a non-production environment. We are receiving a TLS link between some sites and other sites will use ADVPN Hub\Spoke with SD-WAN and dual ISP. The VPN part is working fine and so I've removed those links for the time being.  For the TLS we have 2VLANs on our hub FortiGate (200,300) setup under port3.  Our PC connected to the main Fortigate can each all other Fortigates. The other PCs connected to the other Fortigate can reach the hub but cannot each the Fortigate at the other end. The reason looks like BGP is not interesting the route into the routing table. As it is the only path to the destination, I am not sure why and am clearly missing something.  Willing to post any config that will help. Here are screen captures of what I'm referring to. The first one is the main Fortigate where the trunks for the TLS from our ISP will come in and the second one is th

greetings guys,I am trying to understand how the sd-wan performance SLA probing traffic (for example, Ping/ICMP) is steered.I have configured the SD-WAN performance SLA, two member interfaces are selected in the SLA, let's say, port1 (MPLS in the picture) and port2 (OL_INET in the picture). the SLA is using Ping as the probing protocol probing the detect server 10.74.x.x.port 1 is an MPLS underlay interface, port 2 is an overlay based on Internet IPsec tunnel. If I use the CLI in fortigate, I do see the probing traffic (ICMP echo/request) is flowing through the member interface added in the SLA. diag sniffer packet OL_INET 'dst host 10.74.x.x' 4 0 ainterfaces=[OL_INET]filters=[dst host 10.74.x.x]2025-02-24 06:43:45.156019 OL_INET -- 10.250.a.b -> 10.74.x.x: icmp: echo request diag sniffer packet OL_INET 'src host 10.74.x.x' 4 0 ainterfaces=[OL_INET]filters=[src host 10.74.x.x]2025-02-24 08:01:03.828714 OL_INET -- 10.74.x.x -> 10.250.a.b: icmp: echo reply the 1

Hi Team, Can you help with the following issues:I want to restrict the number of mails received from incoming emails from Gmail, Yahoo, and Outlook domains. However, the session profile can only be applied to the IP Policy and not directly to domains. What solution is available?Is there a way to see the sender's IP address (not the sending server's IP) for an email on FortiMail?Thanks. 

Hello community, Is there a way to block MAB for rogue devices in FortiNAC? The issue i'm facing is with a Cisco Switch with the following configuration in the portsinterface GigabitEthernet1/0/9switchport access vlan 31switchport mode accessswitchport voice vlan 18authentication host-mode multi-domainauthentication order mab dot1xauthentication priority dot1x mabauthentication port-control autoauthentication periodicauthentication timer reauthenticate 180mabsnmp trap mac-notification change addedsnmp trap mac-notification change removeddot1x pae authenticatordot1x timeout quiet-period 10dot1x timeout server-timeout 30dot1x timeout tx-period 10spanning-tree portfast This port is intended to work with MAB for a Phone and with 802.1x for PC, however when a PC with no supplicant with certificate connected to the phone, the switch sends mac to FortiNAC, and I see Login OK with mac address, and therefore the device is able to receive the Default VLAN (in this case VLAN 31 whi

Hello guys. We have a couple of HTTP 1.1 web sites which sit behind our FortiWeb and we're having some issues with the chunked transfer encoding configuration. We're trying to follow the fortiweb troubleshooting guide instructions on the topicHow does Web Protection modules support Transfer.Encoding: chunked . According to the docs, we should set chunk encoding to enable and this should be enough for ensuring that buffering won't be used for those type of requests. Unfortunately, this isn't what we're seeing after enabling this setting. For starters, all the resources from the HTTP server are returned to the clients as chunked (even those that aren't being encoded into chunks by the http server), ie, fortiweb is transforming all http server responses into chunked transfers after enabling the previous setting (ex.: the http server will buffer js files before returning them and these requests are transformed into chunks which are then sent to the real client).&nb

Hello guys, Even though I'm still not sure on how FortiWeb  supports chunked encoding, I'm hoping that someone can help me understand the faq's content on this topic, specificaly on the behavior form 7.0.2 onwards. The doc starts by saying the following: From 7.0.2, FortiWeb replaced set chunk decoding enable/disable with set chunk encoding disable/enable.The default configuration is disabled, which equals to set chunk decoding enable in 7.0.1; FortiWeb will decode chunked response and convert it with Content-Length.When configured as set chunk encoding enable on 7.0.2, FortiWeb decodes and reassembles the chunked response, performs the WAF modules’ operations, and encodes the new content with chunked again, then sends it to the clients. I understood it as saying that whenever FortiWeb detects a chunked encoded response from an HTTP 1.1 server, it will receive all the packets from the server, decode it and then apply all

Hello guys. I'm trying to use an openapi doc  to validate all the web api calls made to one of our web apps. I've already uploaded the openapi doc and set everything up. However, there's an issue: it seems like FWB can't handle array parameters passed through query string and it  will always consider them a violation of the openapi docs. Here's a snippet of our openapi doc that is used for validation: openapi: 3.0.1 ... /api/pedidosassistencias/pesquisa: get: ... parameters: - name: estados in: query schema: type: array items: $ref: '#/components/schemas/EstadoPedido' description: Estados do pedido a filtrar ... `EstadoPedido` is an enum and the openapi doc does enforce those values (the ones passed on the next snippet are all valid). We've tried several different strategies in order to pass the array through the query string: // several parameters option 1 (

I realize the following is a not so great idea but would like to know if this is even possible since management may require it.Is it possible to give all users with a valid AD account permissions to create pre-provisioned guest wireless accounts in FortiNAC? Based on the following snippet from the FNAC admin guide, I can't use the AD Domain Users group: "The domain users group cannot be used to set administrator privileges because user details for users in that group are not populated in FortiNAC when a directory synchronization is done." So, before I ask our AD admin to create a new group named something other than Domain Users and add all user accounts to it, I'm posting to see if this is even possible. 

Hi,As a replacement for SSL VPN for remote users, we have implemented IP SEC dialup.Users connect with forticlient. Everything works fine.However, I would like to be able to force the disconnection of sessions after a set time (i.e. 12 hours), even if traffic is generated.I have not been able to test any functional solutions.Do you have any idea how to do this?

Hi all, completely new into FortiEMS or in generell into Fortinet.Right now we are running on FortiEMS Cloud 7.2.5.1061 and would like to upgrade to the newest version. Found this article:https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-upgrade-the-firmware-of-EMS-cloud/ta-p/216177 Unfortunately there are no informations about what time (only day) this will happen or something about how long this will take (will there be any downtime?). Thanks, regardsMarc

hi,been trying to google search the "F" series platform/model (i.e. 40F, 101F) but got limited info/data sheets.just would like to ask:1.why is it called "F"? is it just an upgrade/iteration from previous "E" series2.is "F" series only got an upgraded ASIC/chip, i.e. SOC and CP and added number of CPUs?3.is item 2 above the only "selling" point of the "F" series?4.any other "unique" feature/distinction for the "F" series platform?

Hi,I'm trying to configure our Fortigate v7.4 to provide dialup IPSec VPN to FortiClient on Windows. The VPN works fine with user certificate but if I want to use computer certificate instead, or enable VPN before login, the VPN failed. I tried to give user access to the certificate key of the machine certificate without success. Any advices are much appreciated. Here is an abstract of the FG config: config vpn ipsec phase1-interface  edit "Staff VPN"    set type dynamic    set interface "portn"    set ike-version 2    set authmethod signature    set peertype peergrp    set net-device disable    set mode-cfg enable    set ipv4-dns-server1 x.x.x.x    set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-   prfsha256    set localid "StaffVPN"    set comments "VPN: Staff VPN (Created by VPN wizard)"   

Hello,i was looking for the OID in the FortiAP showing the number od client connected for each AP.Any guess ?Thank youB. 

Hi, Based on document, I try to download and install evaluation license. But I got the error message. Anyone can help to take a look at it? Thank you very much.  HQ-FW # execute vm-license-options account-id daxxxxx@gmail.comHQ-FW # execute vm-license-options account-password ayyyyyxHQ-FW # execute vm-licenseThis VM is using the evaluation license. This license does not expire.Limitations of the Evaluation VM license include:1.Support for low encryption operation only2.Maximum of 1 CPU and 2GiB of memory3.Maximum of three interfaces, firewall policies, and routes each4.No FortiCare SupportThis operation will reboot the system !Do you want to continue? (y/n)yRequesting FortiCare Trial license, proxy:(null)Forticare response error 61.Failed to download VM license. HQ-FW # get system statVersion: FortiGate-VM64-KVM v7.2.4,build1396,230131 (GA.F)Virus-DB: 1.00000(2018-04-09 18:07)Extended DB: 1.00000(2018-04-09 18:07)Extreme DB: 1.00000(2018-04-09 18:07)AV AI/ML Model: 0.000