Solved

Hello,I'm currently configuring a second client IPSec VPN. The new uses IKEv2, on the same WAN interface/IPaddress. I saw help pages about the PeerID and LocalID, but my tries aren't okay. I have an phase1 error. I put a PeerID on the Authentication frame, and I reported it on the LocalID in the Forticlient configuration as I understand. Is it okay ? What about the LocalID on the Fortigate ?  The existing Client VPN has this configuration :Is this configuration a problem ? 

Good day Fortipeeps! I just wanted to ask if anyone has any idea how to calculate the total average or maximum CPU utilization. For example, the total average over 24 hours. I’m a bit confused about per-core CPU utilization. it is considered alarming if one of the core have high utilization?I would appreciate your insights Thank you! 

Hello everyone,  I've configured the antispam profile action on FortiMail to use personal quarantine. However, the end user receives a notification about a quarantined email several hours later—sometimes even a full day later. I've checked the NTP synchronization, which appears to be fine, and the latency between the mail server and FortiMail is normal. My current FortiMail version is 7.4.2, and I plan to update to 7.6.0 to see if it resolves the issue. Does anyone have a better suggestion or know if there's a way to adjust this delay on FortiMail? Best regards,

I am setting a new Firewall Cluster, when I import the firewall policy (show firewall policy/show) from the previous Firewall into the new Firewall (excluding UUID details) I can see the new  policy on the new Firewall "show firewall policy" but I cannot see the policy in the GUI...! If I create a policy rule in the GUI I see the policy in "show firewall security-policy" but not in the "show firewall policy"  ouput I am really struggling to see why? There are no advanced features in the policy just source/dest/port/accept.Is there something I need to turn off? This should be just a simple import, there are too many existing rules to import manually.

Hi FGT adminsCan FortiOS be compromised? I mean like any other OS by an attacker or a malware.Have there been any known cases?Is there any method to check if my FortiOS is compromised?Does FortiOS checks itself for possible compromise?Note: here I'm talking about FortiOS itself, not about FortiGate configuration.

We can install any version of FortiClient VPN on brand new Macbook (15.3 Sequoia).Problem lies in the new MAC security layer in the OS.  Creating a connection then clicking on Connect produces an error: "To connect to the VPN with FortiClient, open Security & Privacy Settings and allow the system software from FortiTray".Problem is that option is NO longer available is the new Mac OS versions.Called Apple to confirm this is a  issue, and they report the section of the security applet has been removed and will not come back. See screenshot. Will there be a newer build to accommodate for this new Security Change is MAC OS?The version shown here is the latest 7.4.2.1717Thanks!Brett FlaggIntegraONE

Hello,I would like to know if it is possible to change the AND in the fields to OR because I would like my action to be triggered only if one of the parameters I define is triggered.Thank you in advance. 

I have lant to migrate all of virtual machine to new server in different location, and we need to keep same ip address.The vlan handled by core switch and the core switch connected to the fortinet, in new location i also have same devices and both location have internet connection.Since the migration will done partially, this need both location should have same ip address, same vlan and can communicate each other.So can we use VPN in fortinet to transfer Vlan ? In my mind if we can transfer vlan over VPN then the new location will have same vlan and each host on new location can communicate with devices in of location.IF migration is done for all virtual machine then i can shutdown vlan interface on old location and make new interface vlan on core switch in new location.

Hello everyone, I am exploring better options for configuring FortiMail HA across two different sites—one FortiMail device in Site A and another in Site B. My initial idea is to connect the two devices via an MPLS VPN. However, this approach can be costly for geographically distant sites and requires extremely low latency to function effectively. As an alternative, I am considering using DNS failover... Does anyone have a better suggestion ? Best regards,

Hi, We run 3 firewalls for VPN connections.I created a CR on the first one and we generated a multi SAN certificate which was uploaded and works fine.I tried the same cert on the other two and i get an error saying there is no CR for this certificate.Error message: Uploaded certificate has no matching certificate signing request (CSR)Does each FW require a seperate CR to generate a different multi san cert? TIA :) 

Hello everyone, I came across an information stating that FortiMail retains quarantined emails for 7 or 14 days before they are permanently deleted from the device. Is there a way to extend this retention period, for instance, to one month or so? Best regards,

Alert messages are not received because the recipient address cannot be registered 

hi,i have a licensed forticonverter and converted a cisco ASA config.the ASA config had only basic LAN, WAN, no NAT, and "inbound" ACL (internet > WAN) applied on the WAN/outside.my question:1.do i need an FW policy for the "outbound" traffic (LAN > WAN)? is this for "ALL" traffic outbound?2.do i need to have a "reverse" FW policy for each "inbound" ACL/FW policy? config firewall security-policyedit 1set srcintf "port 1"   <<< WAN/outsideset dstintf "any"set srcaddr "all"set enforce-default-app-port disableset dstaddr "all"set service "echo-reply"set schedule "always"set logtraffic disableset status enableset action acceptset comments "access-list acl_outside extended permit icmp any any echo-reply"nextedit 2set srcintf "port 1"    <<< WAN/outsideset dstintf "any"set srcaddr "all"set enforce-default-app-port disableset dstaddr "all"set service "time-exceeded"set schedule "always"set logtraffic disableset status enableset action acce

Hi there, I'm trying to generate an ACME cert on my FortiGate, just as I've done on my EMS server, but it always fails with a "Timeout during connect (likely firewall problem)" error:  Port 80 is wide open to the world and you can see the traffic coming in when running a diag sniffer. From me running a curl against http://vpn.<mydomain>.com:  I'm at a loss. Does anyone have any ideas or suggestions? Thanks!

I have one blocked when the MAC of the machine is not registered in my DHCP reservation it does not browse, would there be any warning when anyone tries to put a machine on my network to warn that it is trying to get IP?

Hi, In fortisase portal we are able to enable scheduled vulnerability scanning. We are checking for the option to enable the auto patching for the vulnerability.We checked fortisase admin guide and not seeing any option of auto patching.Will fortisase do the auto patching like Forticlient EMS ?Please guide..  Regards,Ganesh Karale

Hi,I'm looking to add radius authentication for administrators on the FAC in our deployment, currently we're using simple local users.I would like the Radius request to be sent to a remote radius server, from the FAC. The FortiAuthenticator is running version v6.6.2, build1669 (GA).I can't find any cookbooks or guides on how to enable radius for administrators using a remote radius servers. Is anyone able to provide me with either a guide, or some assistance ?Thanks in advance!

Hello everyone, I want the FML administrator(s) to receive a "notification" whenever an email is being quarantined, I thought about creating a notification profile, but I want a notification specific for quarantined emails. Does anyone have a better suggestion ? Thanks in advance Best regards,

I have a hub-spoke setup using BGP in a SDWAN setup. The SDWAN is due to having a fibre connection and a 4G for failover. So obviously I have both under each Zone.HUB -> Spoke1HUB -> Spoke2The hub has a Dialup IPsec tunnel for fibre connection and one for 4G connection to allow multiple connections from all the Spokes.Spoke1 has static IP IPsec VPN connection from its own fibre connection to the fibre connection of the HUB, and Dynamic DNS IPsec tunnel from its own 4G to the HUB's 4G connection. Spoke 2 has the same setup to connect to the HUB. I use BGP to advertise my internal networks of each of the 3 sites. Everything internally is working and the internal networks can talk to each other, including when failing over to 4G. My problem comes in with the FortiClient VPN. At each site I have a Dialup FortiClient VPN setup. When I connect to the remote VPN, I can access only the resources of the LAN at the site I am connected to. I can't talk to other IP ranges

We just had to revert to Forticlient VPN (free) 7.2.8 for IPSec with SAML and we're running into an issue with the inline webbrowser staying logged into the wrong Entra account (we support multiple clients). I can't find a way to clear the cookies. I've used the button within the app, deleted everything I could find in the Appdata\local\forticlient dir. cleared cached for microsoft in Chrome and Edge and Internet Explorer. I can't get it to shake my Entra joined Windows credentials. Does anyone know how to get it so that I get prompted for Microsoft credentials at each login. This was working earlier today and now doesn't.

Hi,I am facing the task of migrating EMS from version 7.2.8 to 7.4.x. If I follow the migration documentation, will the SAML SSO settings also migrate or will I have to re-configure SAML SSO for this installation? RegardsAndrzej

Hi, I read the CVE article below and wonder if I need to upgrade FortiOS:Fortinet Security Advisory: FG-IR-24-535My FortiOS version is 7.0.16, and the HTTP/HTTPS administrative interface is enabled only on the LAN interface (disabled on the WAN interface).Do I need to upgrade FortiOS to protect against this vulnerability?

I am stuck in a situation where I am facing an issue with Google Meet video and voice within the enterprise network.I am using a 100F FortiGate firewall and have created a policy to block all unnecessary traffic from the public internet. Additionally, I have created a policy for Google Meet with no inspection. However, I am still facing the same issue.Can anyone help me with this? Is there any issue with NPU-offloading which is causing the issue in the google meet performance. 1. Implemented QoS for Google Meet, but it did not work.2. Implemented a no-inspection policy to bypass UTM features. #fortigate

So, I have an E61 firewall and it's got a nice SSL VPN on it for my 10 or so users who are in other countries.  These users connect and we are using an LDAP integration for authentication. Today, I found out that people are trying to access the SSL VPN using real usernames from the org, and when they enter the wrong password three times, the user is locked out of Active Directory. For now, the SSL VPN is disabled. I need a solution for this.   My first thought is to get some tokens and enable 2FA. Can some of you experts make some suggestions about how to best mitigate this? Thanks

I need to make it so that when a machine plugs a network cable into my network it can't get an IP via DHCP, but when I register the machine's MAC it can use my NETWORK, how could I do that?