Solved

Dear Team, I would like to understand the SSL VPN connectivity features of the latest version of Fortigate combined with FortiClient. In scenarios without EMS integration, is security posture checking still supported?As shown in the figure below:Bruce Liu   

Hi Team, Our client is requesting us to use Lets Encrypt certificate for SSL VPN certificate protection. We are hosting this customer on the 1200D datacentre firewall as a VDOM. Please advise if we can use this feature? I am getting the below message and the "Lets Encrypt" button is greyed out. Use Let's Encrypt and the ACME protocol to automate certificate creation and maintenance. You will need to enable DDNS or purchase a domain. Kind Regards,Shiv AdhikaryNetwork Engineer

we are currently testing proofpoint email security software.how do i whitelist proofpoint under application control ?currently this policy do not have any application control or web filter applied. 

 Hi everyone,I've recently upgraded FortiManager from 7.4.5 to 7.4.6 and noticed a change in behavior regarding policy block names. Previously, FortiManager would prepend the name of a policy block to the name of a policy when deploying the rules to the FortiGate. However, this no longer seems to be the case in version 7.4.6.Immediately after the update I noticed that when deploying policies to the FortiGate it would fail because of duplicate policy names.For instance I have a rule defined on a Policy Package for FortiGate1 which is named "DNS" and I have a policy block called "global" appended to that policy package which also has a rule defined named "DNS". If you check the names of the rules on the FortiGate directly they had the names "DNS" and "global-DNS" before the update.After the update both rules would now be called "DNS" which leads to this duplicate issue and therefore the policy install fails from FortiManager. Current workaround is to just make su

Cross posting with https://forum.opnsense.org/index.php?topic=44897.0 due to the reason I still found no answer or clueI have a S2S IPSec tunnel between an Opnsense (24.7.11) and a Fortigate 60F (current FortiOS) device. Establishing a connection is working, but after some time (Phase 2 rekeying?) the tunnel sometimes breaks and comes back way later without any action on both sides. I captured a log trace (no debug) on the OpnSense side, see below. Both configs are correct in my point of view.Any ideas, is a debug log necessary and if yes, there are a lot of logging options with IPSec, which one?I'm no VPN or network expert, so please excuse if this is an easy mistake on my side.   2024-12-28T22:13:46 3 Informational charon 82877 14[IKE] <a075e27f-ad8d-4e7a-bd35-2f5c5ea0cee5|3> CHILD_SA closed 2024-12-28T22:13:46 3 Informational charon 82877 14[IKE] <a075e27f-ad8d-4e7a-bd35-2f5c5ea0cee5|3> received DELETE for ESP CHILD_SA with SPI e8e6a428 2024-12

Hello, We are currently running two FSSO agents for two different domains on two different servers under these domains. Is it possible to query two different domains from a single server with a single FSSO agent? Is it possible to install two different FSSO agents on a single server? What is the best practice method for this? Regards,

Hello, I have a problem. Some companies do not have FortiGate licenses. Is it still possible to perform a firmware update? For example, from Firmware v7.4.3 build 2573 (Feature) to Firmware v7.6.1 build 2573 (Feature)

I am attempting to limit access to our SSL-VPN to only specific IP addresses.  It works great for IPv4, but any clients on AT&T mobile internet don't work because they receive an IPv6 public IP address.   I tried adding the public IPv6 addresses to the allowed hosts but it still will not allow the connection it just says "Unable to establish the VPN connection.  The VPN server my be unreachable" For troubleshooting I added the "all" IPv6 addresses object to the allowed addresses group but it still will not allow a connection.   I can't find in the logs were these blocked connections would be so that I can troubleshoot the issue. My questions are:Is there something else I need to do in the settings on the FortiGate-101F to allow these IPv6 connections?Where would I find the logs of connections blocked by the "Limit access to specific hosts" setting?

 We are planning to set up a High Availability (HA) cluster in Active-Active mode using two FortiGate 901 firewalls.Our question is straightforward: is it possible to create and manage an HA Active-Active cluster without using FortiManager?As far as I understand, the creation of the HA cluster does not require FortiManager. After the cluster is established, all settings configured on the primary unit can be automatically synchronized to the secondary unit through FGCP. Additionally, the primary unit can be accessed and managed directly via its web interface.I would appreciate an official response to this query so that I can share it with my manager.Thank you for your assistance.

If you buy a new firewall alone, does it do anything like stnd packet filtering?If you buy DNS & Video Filtering Service, will it work alone and offer firmware updates or do you need this plus FortiCare?Thank you

The goal is to restore a saved database from my PC to a new Fortinac build running Forti-OS v7.2.8.  Following this article.https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Restore-FortiNAC-Database-from-CLI/ta-p/201729  Having two issues: 1- Using WinSCP, I connect to Fortinac, get authenticated, but it stalls out at "starting the session". Same result on multiple NAC appliances. 2- Looking at my directory structure in the linux shell, I do not even have this directory: "/bsc/campusMgr/master_loader/mysql/" Any ideas ? 

Hi,I am getting the same error message same as in this KB: Incompatibilities with NGFW Policy mode d... - Fortinet Community Already tried to use a Custom Application Group, but I'm still getting the same error message:"app 43322 is incompatible with NGFW Policy mode due its large scan-range detection requirements." Is there any other way to resolve this? How do I know which value to input if I adjust this part of the configuration?config ips global    set ngfw-max-scan-range 4096end 

Hi,  Can 2x 10 GE SFP+ FortiLinks ports be used as WAN or LAN ports? If yes is there any document to set as WAN or LAN?Upon checking the datasheet they have already GE RJ45 WAN Ports.  Thanks!

Dear Fortinet Support Team, I am currently facing two issues with my Fortigate 60F device, running firmware version 7.6.1, and I would appreciate your assistance. 1- Enabling Explicit Proxy:I am trying to enable the Explicit Proxy feature on my Fortigate 60F device. However, I am unable to find this option in the "Feature Visibility" section. Could you please guide me on how to enable this feature or help me identify why it's not appearing in the list? 2- Advanced DLP Features:The "Advanced DLP Features" are currently disabled, and I received the following message:  To use the advanced features, the main Data Loss Prevention feature must first be enabled in Feature Visibility or via the CLI: config system settings set gui-dlp-profile enable end Unfortunately, I received the following error message:  command parse error before 'gui-dlp-profile' Command fail. Return code -61  Could you kindly advise on how to resolve this issue and suc

Hello everyone,How can I configure FortiClient VPN (full-tunnel mode) to:Use internal DNS server (e.g. 192.168.1.x) for resolving internal domain names onlyUse public DNS (8.8.8.8) for all external domain queriesAvoid the current 6+second delay caused by failed DNS resolution attempts to internal DNSCurrently, all DNS queries first try the internal DNS server before failing over to 8.8.8.8, causing noticeable delays. I want to maintain full-tunnel mode for security but need more efficient DNS resolution.I am attaching screenshot an nslookup and the tunnel configuration so you guys have a clearer understanding and hopefully can help me.

Hellowe have a problem that we unable to allow fortitray. If we try to use Forticlient VPN only version to connect to our vpn, it prompts a windows that Fortitray needs to be allowed. If we press on open security & privacy it just shows the general screen of security & privacy and not the windows where you can allow fortitray. We were using Forticlient 7.0.3 and upgraded to 7.0.7 but the issue persists.

Hi,Hoping that someone could help in regards to the correct OID required to query FortiAuth-VM in order to get the number of FortiTokens available for usage, since the one I've found in a old forum post is not returning the correct value - https://community.fortinet.com/t5/Support-Forum/FortiAuthenticator-OIDs/td-p/228761 Upon querying, 1.3.6.1.4.1.12356.113.1.202.6.0 , I get a value of 244 which is more than the total amount of registered/available tokens in FAC-VM. iso.3.6.1.4.1.12356.113.1.202.6.0 = INTEGER: 244FortiToken MobileUsed: 148Populated: 155Available: 7Disabled: 0 Using .1.3.6.1.4.1.12356.113.1.202.3.0 returns the correct amount of tokens since I also got 1 Yubikey registered (populated). iso.3.6.1.4.1.12356.113.1.202.3.0 = INTEGER: 156FortiToken Mobile / Yubikey TokensUsed: 148Populated: 155Available: 7Disabled: 0Used: 0Populated: 1Available: 1Disabled: 0I am trying to create a plugin in the internal monitoring platform in order to

Hello,I'm trying to dedicate one wan link to a server in my infrastructure. I'm using a cluster of 601F, 3 Vdoms (Root, Internal, housing). The wan i want to use for my server is already NATed (ISP router cannot be set in bridge mode....) So i created the wan interface, using a private IP (192.168.10.10/24) on one VLAN interface of my root Vdom. Firewall is able to ping the ISP router But then i can't understand how i'm supposed to route traffic to/from my server through the 2 vdoms ...Do i need to create a VIP on the root vdom, pointing to the IP address of the internal Vdom on the Vlnk and then another VIP on the internal Vdom pointing to the server ?Is there any other solutions ? Thank youMatthieu  

For MAC-based filtering, please ensure the below points What is the maximum limit of MAC addresses that can be added?If we utilize the maximum limit of MAC address entry, is it to be cause any performance-related issues on the wireless controller (FGT) and FAP?Is there any option to import bulk MAC addresses from FMG at once or to add multiple MAC addresses one by one?

Hello everyoneA few weeks ago I was looking for a solution with the following post.....https://community.fortinet.com/t5/Support-Forum/Fortigate-7-6-1-policy-with-timer-and-passwort-release/m-p/365986#M259639Unfortunately it's still not the solution I want.I'm still looking for a way to somehow create a "session timer" with my Fortigate.I'm looking for a way to limit my children's devices, which are all enabled with fixed IP addresses via policies, so that an IP session can only access the Internet for 1 hour per day.Again for information...I am NOT looking for a solution with the scheduler because the internet hour is NOT at the same time every day.I'm looking for a solution to run an IP session for 1 hour daily.The solution with the web filter is very laborious and cumbersome (post with URL above).Don't you have another idea how I could implement this?Thank youGreetingsSwiss daddy

hello team i have uploaded VM licence but the status is Serial-Number: FGVM00UNLICENSEDLicense Status: No LicenseLicense Expiration Date: 2024-03-04VM Resources: 1 CPU/0 allowed, 985 MB RAM/0 MB allowedLog hard disk: Not available --- PLEASE HELP---

Hi there! Is it possible to install the same single policy to say 5 FGT Clusters from Forti Mrg, but each of the 5 Clusters has different interface names? The same single policy will be pushed to each Cluster as a Global FW policy not a VDOM.............or is the only way via a VDOM with normalized interfaces from the FM? later mapping INTERNAL interface to Port1 on Cluster-1 and INTERNAL3 on Cluster-2 etc.........  

Hello i have a problem when i set ha-mgmt-status with port mgmt1 I set vdom root in fg vm v 7.0 in this port but i cant port with the ip i assigned to this pruporse. FortiGate-VM64-KVM # show system interface mgmt1config system interfaceedit "mgmt1"set ip 192.168.25.3 255.255.255.0set allowaccess ping ssh httpset type aggregateset lldp-transmission enableset snmp-index 25nextendFortiGate-VM64-KVM # FortiGate-VM64-KVM # execute ping 192.168.25.3PING 192.168.25.3 (192.168.25.3): 56 data bytes64 bytes from 192.168.25.3: icmp_seq=0 ttl=255 time=0.6 ms64 bytes from 192.168.25.3: icmp_seq=1 ttl=255 time=0.1 ms64 bytes from 192.168.25.3: icmp_seq=2 ttl=255 time=0.2 ms64 bytes from 192.168.25.3: icmp_seq=3 ttl=255 time=0.1 ms64 bytes from 192.168.25.3: icmp_seq=4 ttl=255 time=0.0 ms--- 192.168.25.3 ping statistics ---5 packets transmitted, 5 packets received, 0% packet lossround-trip min/avg/max = 0.0/0.2/0.6 ms  ortiGate-VM64-KVM # show system haconfig system haset gr

Hello team!!!Happy new year to everyone using gregorian calendar!! I have the following 3 questions about Fortigate:1) To block phishing I am using web filter, is there another Fortigate feature to add, to help blocking phishing attempts?2) Is there any place in the Fortigate where I can see security alerts for applications installed on computers?  I dont think so, but I'm asking just in case3) You know another feature to block suspicious network activities in addition to DOS rules and IPS profiles?This is for all the traffic comming through the Fortigate, not for traffic between 2 computers in the same LAN, of course. Thanks in advance.Regards,Damián 

您好，客户的 foritgate 60f 防火墙已购买 ATP 和工业安全服务的许可证，并将在生产环境中以透明模式部署。我想了解一下在这个环境下如何完成防火墙部署，这个部署有哪些注意事项，以及如何使用工业安全服务特性库