Solved

After upgrading from FortiOS 7.4.4 to FortiOS 7.6.0 on Fortigate 100F I cannot modify an interface by GUI because of the following error message:"Invalid DHCP range. Start address is greater than end address."The interface IP address is 192.168.68.2/23 manual mode and DHCP range is 192.168.68.100-192.168.69.254 with subnet 255.255.254.0. On the other hand, I can modify its configurations in CLI. Have no idea what's wrong here?

Recently, mac OS 15 (Sequoia) was released, and I would like to know if Forticlient 7.4.0 version will work normally on that OS.Looking at the Document Library, I still only have mac OS 13,14.Unfortunately, I can't test because I don't have a MacBook.If anyone is using Forticient 7.4.0 for macOS 15 (Sequoia), please replyThank you.  

Hello FortiSOAR Team, I do not find reference to FortiSOAR MT_RegionalSOC license type in v7.6.0 in comparison with v7.5.0.Please refer to below two links and compare. In v7.6.0 there is no reference to FortiSOAR MT_RegionalSOC license type. Is this FortiSOAR MT_RegionalSOC license discontinued in v7.6.0 ? If not then provide corresponding documentation reference. What will be the impact for existing FortiSOAR MT_RegionalSOC license deployed? V7.5.0 Web Reference: https://docs.fortinet.com/document/fortisoar/7.5.0/deployment-guide/223944/licensing-fortisoar#/document/fortisoar/7.5.0/deployment-guide/223944/licensing-fortisoar#License_Manager_Page V7.6.0 Web Reference: https://docs.fortinet.com/document/fortisoar/7.6.0/deployment-guide/223944/licensing-fortisoar#/document/fortisoar/7.6.0/deployment-guide/223944/licensing-fortisoar#License_Manager_Page ThanksMalaya Manas 

Hello team, This is a stack with 2 Fortigates 100F (A-P)We found in "FortiView - Sources", a machine with "30" in the column "Threat score", all the others had 0When I drill down, I found the followingThis was: biserka.xyz (phishing).I have tried to find any log with more information about this but without luck.¿Do you know where can I find more information? Thanks in advance.Regards,Damián

Hi,I'm new with Fortigate and migrating from ASA world.  I'm a little surprised that the fairly basic configuration causes difficulties even for vendor.The question is: Does version 7.x support setup where traffic should travel from policy-based tunnel to policy-based tunnel and where the NAT should be used for source address. If so, is there any document to follow so that the implementation would be done correctly?  Already found some articles but still wondering do I need VPN Concentrator config to enable traffic flow between tunnels?  

Hi,I would like to manage my switches from the FMG but many options are lacking, especially the "Block Intra-VLAN traffic". Same for SSIDs and "Block Intra-SSID traffic". How to enable these from the FMG ?Thank you.

Windows 11 (intune enrolled), FortiClient 7.4.0.1658.If I setup a VPN that doesn't have a certificate associated with it, I have no issues.But if I associate a certificate with a connection, about 2 seconds later the console crashes. If I open it up again, it will crash a couple of seconds later.It doesn't log an error at the time it crashes.I have to uninstall and reinstall again to get it stable again but can't associate the connection with a certificate.Anyone got any thoughts? 

Scenario:I have a network setup consisting of a FortiGate , FortiSwitch and multiple FortiAP . The connections are as follow:FortiGate:Port1 (FortiLink) is connected to Port 24 on the FortiSwitch.I have created VLAN 400 (named "MGMT") on the FortiLink interface, which is used for managing the FortiAPs.FortiSwitch:Ports 21, 22, and 23 are configured in VLAN 400 for connecting the three FortiAPs. These ports are working correctly, and the FortiAPs are connected.SSID Configuration:I have configured three SSIDs on the FortiGate in Tunnel mode.Each SSID is associated with a different VLAN (configured as optional VLAN IDs within the SSID settings).DHCP is enabled on the FortiGate for these VLANs.Issue:When clients connect to the Wi-Fi SSIDs broadcasted by the FortiAPs, they are not receiving IP addresses from the DHCP server, even though DHCP is enabled and configured correctly on the FortiGate for the SSID VLANs.Upon further investigation, I noticed that the VLANs associated

Hello everyone, Can I update the Fortinet AV clients on the client computers via the EMS server? So we currently have version 7.2.4 on the clients and version 7.2.5 on the EMS. The version has been online for a few days and is not being rolled out to clients. Is there a way to roll out 7.2.5?  Thank you very much for your help.

Hello, I'm doing some cleanup in a fortigate environment that has not been kept very tidy. There are a lot of policy openings that i dislike as they have been allowing all protocols far too often.Now i want to crack down on these and limit some policies to only have access to the ports that are actually frequently used.Now the proper way of doing this would be to contact various parties and get lists of ports required for the respective services and applications but i wonder if there is some tool in FMG/Fortianalyzer that might help me? I imagine a tool to list ports accessed by a certain policy and how many hits they each have in a certain timespan.Is that possible? or is there a better/simpler solution? BrJohan

Hello, IPsec aggregation I/F is not seen when I try to input it as SDWAN member.Here is my environment.       (wan1) --- NAT router1 --- (wan2)FG1                                                     FG2       (wan2) --- NAT router2 --- (wan2) At FG1, as VPN tunnel, vpn1_1 and vpn1_2 are createdAnd AGGnat I/F is created as aggregation of the both.At FG2, the situation is similar.In VPN tunnel, AGGnat I/F is up. However, this I/F is not seen as SDWAN member. How can I solve? Any comments are appreciated.  

Hello! I have several WLANs in Tunnel traffic mode (FortiAPs) with their own DHCP configuration, using external DNS.Additionally, I have VLANs that use our internal domain DNS/DHCP. The issue is that devices on these WLANs are attempting to communicate with devices on the VLANs (and vice versa).For example, logs related to Windows Delivery Optimization (TCP/7680) show this activity. Since there are no policies allowing communication between these networks, my logs are getting filled with 'implicit deny' entries:Same thing here: I could be mistaken, but since the tunnel is sending WLAN traffic directly to my Fortigate, and the only policy in place is for outbound to the WAN, devices on different networks shouldn't be able to see each other, correct?Where might the misconfig be? Thanks in advance.

I am going to be installing a Fortigate in a small secondary school. Can you guys give me a rundown of tips and best practices for content filtering in this environment? I would love to get a list of recommended config options along with instructions on how to set it up. Setting up filtering for a school seems like a bigger challenge as opposed to setting them up for a business which is where most of my experience with Fortigate is. Thanks!

Hello Experts, In site-to-site VXLAN under SDWAN IPsec over NAT,does Fortigate at NAT outside need to specify WAN IP address of the other Fortigate?Here is my network environment.    Inside    Outside  |---| -- NAT1 -- |--------| --- |---||FG1|            |Internet|     |FG2||---| -- NAT2 -- |--------| --- |---|   Inside    Outside   Both network I/F of FG2 are configured as "Dialup User".FG2 does not know WAN IP address of FG1 before FG1 connects to FG2.In order to establish VXLAN between FG1 and FG2, after getting FG1 network I/F IP addresses I needed to specify static route to the IP addresses at FG1. Are there any other solutions? Any comments are appreciated.

When I add FGT v7.2.8 build1639 (Mature) in FGTM v7.2.6-build1632 240809 (GA) a Detect Failed message appears. Can anyone help me? Fortimanager does not ping Fortigate. Fortimanager does not ping Fortigate. They are on the same network. I configured allowed ping. 

Hello Team,                 I am paloalto more guy and I used to utilize Paloalto's EDLs, so I wanted to ask about any Dynamic group that contains Malicious IP addresses, URLs, or domain lists that are included in the FortiOS and I can use them in my policies.If not, what are recommeded other sources "feeds" to add as External groups as feed that I can use for more protection in my policies?or also any  Malware Hash feeds that are valuable.TIA                  

Hello.I upgraded my gate firewall to 7.2.9->7.4.3->7.4.4 and the SSL VPN menu is gone.I can't find it when I look for it in Feature Visibility.Does anyone know?I've done 7 of them, and this is an issue with 2 devices that don't use a VPN.I also found that it is enabled in the preferences below. ----config vpn ssl settingssetstatus enable------ Does anyone know anything about this? Oh , For gate is 101F.

Hi Fortinet Community,I have a FortiGate 60F with a 7.4.4 with a Trusted Hosts configured for admins.But in Log & Report>System Events I see Alerts every 3 mins:Administrator remote2 login failed from https(188.124.36.193) because of invalid user name.How can I block this specific IP from login attempts?GUI tutorials are from couple of years old.Maybe someone can make CLI tutorial?Thanks in advance.

Hello, We have a production FortiGate with multiple vdom configured. And we would like to use the Security Fabric Automation feature. However, its only visible under the global vdom and not in any other vdoms like root and custom vdoms that were configured. Is there a way this automation can be turned for specific vdom? Thanks,

Dear Team, We have upgraded FAZ from v7.0.12 to v7.2.7 and post that getting error message "Please register this device" while trying to login to the FAZ gui.Please find attached snap and guide. Regards,Ganesh 

Kinldy let us know when the updated FortiOS 7.4.5 is getting relased. On 7.4.4 there is a known bug for SDWAN SLA performnace issue without any packet loss. The same seems solved on 7.4.5. 

How do we prevent a scenario when the first email is sent to a particular recipient within the IBE system, being intercepted by a hacker? After this hackers can create accounts in IBE and read emails. 

HiSo we are testing deep SSL inspection and have a policy setup with our own cert (tried it with default as well).If I go to a site that is outside of the allowed categories on the web filter I get the usual FortiGuard Intrusion prevention blocked, have the page re-evaluated or override.The page shows it's connected by HTTPS and has a valid certificate.If i click on override I'm taking to the same URL but on port 8015,eg : https www.cdn-national-lottery.co.uk:8015/ovrd?fblob=UE-1  but this site returns a "This site can't provide a secure connectoin" and ERR_SSL_PROTOCOL_ERROR, on closer "inspection" (cough) it doesnt seem to have a certificate against the site.   I can't see how the initial page has a valid Certificate but the 8015 port override page doesn't have a cert, any ideas?  If I change the 8015 URL to HTTP it then loads the page,  Login to override gets to to http on port 8015 with ERR_EMPTY_RESPONSE and "This page isnt working

I just download a VM machine of Fortigate 7.0.2 (I tried with 7.0.1 also) and i cant access with https to the forti GUI. I checked the interface and is perfectly configured: with "allowaccess ping https ssh fgfm"I also tried to to access with ssh and works perfectly fine.Even i tried to configure the interface and add "http" and worked too!(but i want https not http) The Chrome error that appears to me is the typical: [ This site cant be reached ---- "ERR_CONNECTION_REFUSED" ] (i also tried to disable the windows firewall, but nothing works) Its a new and default Fortigate VM System, so i dont know why doesn't work.Anyone knows what is happening? Thanks!

Hello, we are facing a number of issues using Forticlient version 7.2.4 , i undersand they may be fixed in future versions. Is there a plan and date to release a version 7.2.5 of Forticlient anytime soon? Thank you Martin